A lot of people have been wondering where exactly Stormy Daniels‘ attorney Michael Avenatti got the dirt on Michael Cohen he put out Tuesday on Twitter. You can add the inspector general of the U.S. Treasury Department to that list of the curious.

The Washington Post reported Wednesday afternoon that Treasury’s Inspector General (IG) Eric Thorson, a George W. Bush appointee, is currently investigating “possible improper dissemination of Bank Secrecy Act information.”

“We are conducting an inquiry into possible improper dissemination of Bank Secrecy Act information,” IG spokesman Rich Delmar said, “predicated on information that was in the New York Times article earlier this week.”

As Bloomberg noted, the Bank Secrecy Act requires financial institutions to report suspicious transactions to the U.S. Treasury through “suspicious activity reports” or SARs. The unauthorized disclosure of a SAR is a criminal offense, Bloomberg added, which doesn’t mean Avenatti is going to jail, by the way. He may have released the information after receiving it from a source, but he wasn’t the one who disclosed it in the first place. But whoever did disclose it could be in some legal trouble.

The U.S. Treasury Financial Crimes Enforcement Network (FinCEN) says that the unauthorized disclosure of SARs is both a violation of federal criminal law and undermines the purpose of requiring SARs. Here’s what FinCEN’s website has to say on the matter:

The unauthorized disclosure of Suspicious Activity Reports is not only a violation of federal criminal law, but it undermines the very purpose for which the suspicious activity reporting system was created – the protection of our financial system through the prevention, detection, and prosecution of financial crimes and terrorist financing. The unauthorized disclosure of Suspicious Activity Reports can compromise the national security of the United States as well as threaten the safety and security of those institutions and individuals who file such reports. The Bank Secrecy Act Advisory Group is committed to continuing to work with the Financial Crimes Enforcement Network, the federal functional regulatory agencies, law enforcement, and the financial services industry to ensure that the information contained in Suspicious Activity Reports is safeguarded, and that anyone who makes an intentional, unauthorized disclosure of a Suspicious Activity Report is brought to justice, whether that person is inside or outside of the Government.

The Code of Federal Regulations (CFR) has more to say in this area, so bear with us as we make our way through the weeds. 31 CFR 1020.320 covers reports by banks of suspicious transactions and stipulates what banks are required to do and what may not be done.

Beginning with 31 CFR 1020.320(e)(1)(i), the general rules against disclosure by banks:

No bank, and no director, officer, employee, or agent of any bank, shall disclose a SAR or any information that would reveal the existence of a SAR. Any bank, and any director, officer, employee, or agent of any bank that is subpoenaed or otherwise requested to disclose a SAR or any information that would reveal the existence of a SAR, shall decline to produce the SAR or such information, citing this section and 31 U.S.C. 5318(g)(2)(A)(i), and shall notify FinCEN of any such request and the response thereto.

Then (e)(2), prohibition against disclosures by government authorities:

A Federal, State, local, territorial, or Tribal government authority, or any director, officer, employee, or agent of any of the foregoing, shall not disclose a SAR, or any information that would reveal the existence of a SAR, except as necessary to fulfill official duties consistent with Title II of the Bank Secrecy Act. For purposes of this section, “official duties” shall not include the disclosure of a SAR, or any information that would reveal the existence of a SAR, in response to a request for disclosure of non-public information or a request for use in a private legal proceeding, including a request pursuant to 31 CFR 1.11.

Finally, (g), the compliance rule:

Banks shall be examined by FinCEN or its delegaees for compliance with this section. Failure to satisfy the requirements of this section may be a violation of the Bank Secrecy Act and of this chapter. Such failure may also violate provisions of title 12 of the Code of Federal Regulations.

Avenatti has been talking on Twitter and television for some time now about the Treasury Department’s “refusal […] to release to the public” three SARs filed in regard to Essential Consultants, LLC activities. Consider this tweet from Wednesday morning:

But back to the subject of where these Cohen records came from. As Law&Crime noted Tuesday, many people were asking this question: Where on earth did Avenatti find this?

Avenatti told the Washington Post Wednesday that the source of the information is “nobody’s business.”

“The source or sources of our information is our work product, and nobody’s business,” he said. “They can investigate all they want, but what they should be doing is releasing to the American public the three Suspicious Activity Reports filed on Michael Cohen’s account. Why are they hiding this information?”

It’s also notable that Avenatti said on CNN Tuesday night that he will continue his media blitz strategy because it is clearly working.

“Because we’re so out front on this, people send us information, people want to help our cause. People contact us with information,” he said.

While Avenatti said there is “There is no question [the information] is accurate,” Cohen said, “His document is inaccurate.”

Multiple credible news outlets did say they reviewed documents and confirmed Avenatti’s claims, and Avenatti pointed to this in his Twitter feed.

But Michael Cohen’s lawyers disputed some Avenatti facts in a letter to Judge Kimba Wood on Wednesday. Notably, the lawyer said the report included two Michael Cohens that were not their client.

Editor’s note: the story was updated after publication with Michael Cohen’s response.

[Image via Yana Paskova/Getty Images]