According to the guidance issued by FinCEN and the Federal banking agencies, when a financial institution receives a request for SAR supporting documentation from FinCEN or an appropriate law enforcement or supervisory agency, it must first verify that the requestor is, in fact, a representative of such an agency. This is to ensure the confidentiality and security of the SAR information and to prevent unauthorized disclosures. A financial institution should have procedures for such verification in its BSA/AML compliance program, which may include, for example, independent employment verification with the requestor's field office or face-to-face review of the requestor's credentials.
References:
1: This web page explains the BSA requirement that financial institutions provide SAR supporting documentation in response to requests by FinCEN and appropriate law enforcement or supervisory agencies, and the need to verify the requestor's identity.
2: This document provides answers to frequently asked questions regarding SARs and other AML considerations, including the question of how to handle "keep open" requests from law enforcement.