According to the Financial Action Task Force (FATF) standards for suspicious activity reports (SARs) information sharing within a financial group, "Financial institutions should establish adequate procedures to ensure that confidentiality of information is maintained and that information is only used for purposes permitted under national law. Where the parent institution is located in a country that does not permit such sharing, financial institutions should take measures to address this limitation" (CAMS Manual, 6th Edition, page 476). Therefore, financial institutions must establish sufficient safeguards concerning the confidentiality of information shared for AML purposes.

The most important risk factor in this scenario is the proposed offshore jurisdiction that is known for its strong privacy laws limiting access to customer information by law enforcement. This indicates that the customer may be trying to evade tax, hide the source or destination of funds, or engage in other illicit activities that could expose the bank to money laundering or terrorist financing risks. Offshore jurisdictions are often used by criminals to create complex corporate structures that obscure the beneficial ownership and control of the entities involved. The bank should conduct enhanced due diligence on the customer, the offshore company, and the nature and purpose of the transactions.
References:
* ACAMS CAMS Certification Study Guide, 6th Edition, Chapter 2, page 35-36, 38-39
* ACAMS CAMS Certification Video Training Course, Module 2, Lesson 2.3, Offshore Financial Centers
* 1, CAMS Certification Package - 6th Edition | ACAMS, Offshore Financial Centers and Money Laundering
* 2, CAMS Certifications: How to Get CAMS Certified | ACAMS, CAMS Exam Outline, Domain 2, Task
2.3

Financial institutions are required by law to maintain records and documentation of customer transactions and to provide this information to law enforcement agencies upon request. However, financial institutions should also have policies and procedures in place to ensure that they comply with legal and regulatory requirements and protect customer privacy. Providing protected documents that are privileged under attorney-client privilege or freezing an account immediately may not be the appropriate response and may expose the financial institution to legal or reputational risks.
Reference: CAMS (6th ed.), Chapter 6, p. 261-262.