
29 Cal.Rptr.3d 894 (2005)
130 Cal.App.4th 378
UNION BANK OF CALIFORNIA, N.A., Petitioner,
v.
The SUPERIOR COURT of Alameda County, Respondent;
Grafton Partners, L.P., et al., Real Parties in Interest.
No. A107553.
Court of Appeal, First District, Division Three.
June 17, 2005.
*896 Nixon Peabody LLP, Paul J. Hall, Eric K. Larson and James D. Griffioen, San Francisco, for Petitioner.
Ernest C. Barrett, III and Manpreet Singh, Washington, DC, for Office of the Comptroller of the Currency, as Amicus Curiae on behalf of Petitioner.
*897 No appearance for Respondent.
Bartko, Zankel, Tarrant & Miller, John J. Bartko and Christopher J. Hunt, San Francisco, for Real Parties in Interest.
*895 McGUINESS, P.J.
National banks are required to file a suspicious activity report (SAR) with the federal government whenever they detect a known or suspected violation of federal law or a suspicious transaction related to money laundering. (12 C.F.R. § 21.11(a) (2005).) SAR's are confidential. (12 C.F.R. § 21.11(k) (2005).) Under federal law, national banks that are subpoenaed or otherwise requested to produce a SAR are prohibited from producing the SAR or providing information that would disclose whether a SAR has been prepared or filed. (Ibid.)
In this writ proceeding, petitioner Union Bank of California, N.A. (Union Bank) challenges a trial court order compelling production of Union Bank's internal suspicious activity reports, which Union Bank claims are generated as part of its procedure for preparing SAR's and complying with federal reporting requirements. The trial court reasoned the internal forms comprise "supporting documentation" generated in the ordinary course of business and are therefore not subject to the unqualified privilege preventing disclosure of SAR's or their contents. We disagree and grant a writ of mandate.

FACTUAL AND PROCEDURAL BACKGROUND
The action below arises from a Ponzi scheme disguised as a successful national mortgage lending business that purportedly "bilked $330 million from more than 160 individual investors" during its brief lifespan. The plaintiffs allege that two individuals set up PinnFund USA, Inc. (PinnFund), as a mortgage company to originate, purchase, and sell sub-prime mortgage loans. One of the individuals behind the Ponzi scheme also formed and operated three business entities, Grafton Partners, L.P. (Grafton), Allied Capital Partners, L.P. (Allied), and Six Sigma LLC (Six Sigma), to generate and collect investment dollars to fuel the operation. Contracts between each of these entities and PinnFund required all investor funds to be placed in a trust account to be used for the sole and exclusive purpose of funding loans. According to the complaint, the trust account was not used to fund loans but was instead used to pay fictional returns to earlier investors as well as to pay phony commissions and fees that enriched the two principals.
The lawsuit centers on the conduct of Union Bank, which opened and operated the PinnFund trust account that was allegedly looted. Real parties in interest Grafton, Allied, and Six Sigma, through their trustee in bankruptcy, along with several individuals acting on their own behalf and on behalf of a putative class of defrauded investors (collectively referred to as Grafton Partners),[1] filed suit against Union Bank, alleging fraud, conspiracy, aiding and abetting, and negligent misrepresentation. Grafton Partners contends, among other things, that Union Bank was complicit in the operation of the Ponzi scheme by allowing PinnFund to set up a "sham" trust account that was used to transfer millions of dollars to offshore accounts. Grafton Partners alleges the investors' losses would not have been as great and the Ponzi scheme would have been uncovered earlier if Union Bank had taken steps *898 to halt the illegal operation of the trust account and fulfilled its obligation to report suspicious activity to the federal government.
In an apparent attempt to learn whether Union Bank had filed SAR's reporting suspicious activity associated with the Pinn-Fund trust account, Grafton Partners initially sought permission from the federal government to allow Union Bank to produce certain SAR's it had filed during the relevant time frame.[2] The Office of the Comptroller of the Currency (OCC), the agency responsible for regulating national banks such as Union Bank, denied the request based upon a determination that SAR's and their contents are confidential under federal law.
During discovery Grafton Partners learned that Union Bank has in place internal procedures and forms to identify, register, and describe what might constitute suspicious activity. In particular, Union Bank has an internal form referred to as a "Form 00244" Suspicious Activity Report (Form 244), which is filled out by bank personnel to report suspicious activities. According to Union Bank, the sole purpose of the Form 244 is to aid the bank in complying with its obligation under federal law to report suspicious activity and file SAR's.
Upon learning of Union Bank's internal suspicious activity report, Grafton Partners requested that Union Bank produce any Form 244 relating to PinnFund. Grafton Partners also served interrogatories requesting that Union Bank identify any suspicious activity it noticed with respect to the PinnFund trust account and identify all documents, including Form 244's, concerning the suspicious activity. Grafton Partners specifically excluded SAR's from the scope of its discovery requests. Union Bank objected to the discovery requests and refused to produce or identify its Form 244's, asserting the request was an improper attempt to circumvent the OCC's ruling precluding disclosure of SAR's, the Form 244's were privileged communications related to the SAR's, disclosure of the Form 244's would tend to disclose whether a SAR had been filed, and Grafton Partners' request was barred by the privilege relating to SAR's afforded under federal law. Grafton Partners moved to compel further responses to a number of discovery requests, including those that sought the Form 244's or information relating to the forms.
The trial court initially granted the motion to compel in part, ordering Union Bank to produce documents and further responses relating to the Form 244's.[3] The court noted, however, that if "Union Bank failed to notify the appropriate federal authorities of this motion, then the federal authorities may intervene ... and request reconsideration of this order."
Union Bank filed a motion for reconsideration in anticipation of the filing of a brief by the OCC (Office of the Comptroller of the Currency). The OCC subsequently filed an amicus curiae brief in the trial court in support of Union Bank's request for reconsideration. The OCC urged the trial court to protect from discovery not just the SAR's but also the process of preparing a SAR  including the *899 Form 244's utilized by Union Bank as well as documents generated by a financial institution as part of its internal process for filing SAR's as required by federal law. According to the OCC, to permit disclosure of the Form 244's would "conflict with federal law and would undermine public policy aimed at uncovering and reporting potential criminal activity...."
Upon reconsideration, the trial court affirmed its decision and ordered production of the Form 244's as well as further responses to all requests concerning the Form 244's. The trial court held the "SAR privilege covers draft SARs, the SARs themselves, and any communications concerning a SAR," but it found "no support for the proposition that all reports of suspected or possible violations or discussion that might lead to the preparation or filing of a SAR are protected by the SAR privilege."
The trial court found the "Form 224s [sic] were not part of Union Bank's process of drafting and filing SARs" and instead described them as "routine bank forms" used by Union Bank for "internal bank purposes as well as for initiating investigations that might lead to a SAR." The court also concluded that disclosure of the Form 244's would not inform anyone whether a SAR had been prepared or filed, because although 93 percent of Form 244's result in a filed SAR, some SAR's were prepared without a corresponding Form 244, and "one cannot tell whether a SAR has been filed just by looking [at] a 244."
Acknowledging that OCC's opposition to the motion to compel suggests there are substantial grounds for difference of opinion regarding the limits of the SAR privilege, the trial court found the issue appropriate for interlocutory appellate review.[4] Union Bank thereafter filed this petition seeking a writ of mandate.[5] Pending resolution of the petition, we stayed the trial court's orders to the extent they compel the production of Form 244's or otherwise direct Union Bank to respond to discovery requests concerning Forms 244's. We issued an order to show cause and granted OCC's request to file an amicus curiae brief.

DISCUSSION

1. Propriety and scope of review

Although writ review of discovery rulings is generally disfavored, interlocutory review by writ is the only adequate remedy when, as here, a court compels the disclosure of documents or information that may be subject to a privilege, because "once privileged matter has been disclosed there is no way to undo the harm which consists in the very *900 disclosure." (Raytheon Co. v. Superior Court (1989) 208 Cal.App.3d 683, 686, 256 Cal.Rptr. 425.) The scope of the socalled SAR privilege is an issue of first impression in the California courts, and, as the trial court recognized, there are substantial grounds for difference of opinion on the issue. Under these circumstances, interlocutory writ review is appropriate. (See OXY Resources California LLC v. Superior Court (2004) 115 Cal.App.4th 874, 886, 9 Cal.Rptr.3d 621.)
Appellate review of discovery rulings is governed by the abuse of discretion standard. "Where there is a basis for the trial court's ruling and the evidence supports it, a reviewing court will not substitute its opinion for that of the trial court. [Citation.]" (Johnson v. Superior Court (2000) 80 Cal.App.4th 1050, 1061, 95 Cal.Rptr.2d 864.) "The trial court's determination will be set aside only when it has been demonstrated that there was `no legal justification' for the order granting or denying the discovery in question." (Lipton v. Superior Court (1996) 48 Cal.App.4th 1599, 1612, 56 Cal.Rptr.2d 341, citing Carlson v. Superior Court (1961) 56 Cal.2d 431, 438, 15 Cal.Rptr. 132, 364 P.2d 308.) We defer to the trial court's factual findings if they are supported by substantial evidence. (Scripps Health v. Superior Court (2003) 109 Cal.App.4th 529, 533, 135 Cal. Rptr.2d 126.)

2. The source and scope of the SAR privilege

Evidentiary privileges are created by statute, and the courts of this state are not free to create new privileges as a matter of judicial policy but must apply only those privileges created by statute or that otherwise arise out of state or federal constitutional law. (Evid.Code, § 911; OXY Resources California LLC v. Superior Court, supra, 115 Cal.App.4th at pp. 888-889, 9 Cal.Rptr.3d 621.) The Evidence Code defines "statute" broadly to include treaties and constitutional provisions; the term is not limited to statutes codified in the Evidence Code or to state statutes in general. (Evid.Code, § 230; see also id., § 920 [Evidence Code's enumeration of privileges does not repeal by implication privileges not listed].) Thus, federal statutes and treaties may supply the basis for a privilege recognized by California courts.[6] (Cf. People v. Corona (1989) 211 Cal.App.3d 529, 540, 259 Cal. Rptr. 524 [treaty-based privilege is statutory privilege under Evidence Code].)
The SAR privilege is a product of federal law. Suspicious activity reports, or SAR's, derive from requirements imposed on financial institutions in the 1992 Annunzio-Wylie Anti-Money Laundering Act. (See Cotton v. PrivateBank and Trust Co. (N.D.Ill.2002) 235 F.Supp.2d 809, 812-813 *901 (Cotton).) The relevant statute gives the Department of the Treasury the power to require financial institutions to report suspicious transactions. (31 U.S.C. § 5318(g)(1).) That statute also prohibits disclosing to any person involved in a reported transaction the fact the transaction has been reported, and it provides a safe harbor for reporting financial institutions, which are not liable to any person as a consequence of reporting suspicious activities. (31 U.S.C. § 5318(g)(2)(A) & (g)(3)(A).) Aside from the limitation on disclosing the filing of a report to any person involved in a reported transaction, the statute does not refer to a SAR privilege or the confidentiality of the reports. In addition there is no official legislative history of the Annunzio-Wylie Anti-Money Laundering Act. (Coronado v. BankAtlantic Bancorp, Inc. (11th Cir.2000) 222 F.3d 1315, 1321, fn. 2.) Therefore, the plain language of the statute and its legislative history provide little guidance for assessing the scope of SAR confidentiality afforded by federal law.
Specific SAR filing and confidentiality requirements are the product of federal regulations. After the enactment of the Annunzio-Wylie Anti-Money Laundering Act, the Department of the Treasury and federal banking agencies issued virtually identical implementing regulations. (See, e.g., 12 C.F.R. §§ 21.11 [OCC], 208.62 [Federal Reserve Board], 353.3 [Federal Deposit Insurance Corporation] & 563.180 [Office of Thrift Supervision] (2005).) Under OCC regulations, a national bank is obligated to file a SAR whenever it detects any known or suspected violation of criminal law involving insider abuse, violations aggregating $5,000 or more when a suspect can be identified, violations aggregating $25,000 or more regardless of whether a suspect is identified, and transactions aggregating $5,000 or more that involve potential money laundering or that violate the Bank Secrecy Act. (12 C.F.R. § 21.11(c) (2005).) Completed SAR's are submitted to the Financial Crimes Enforcement Network of the Department of the Treasury (FinCEN). (12 C.F.R. § 21.11(b)(1) & (c) (2005).)
The regulations also provide that "SARs are confidential," specifying that any "national bank or person subpoenaed or otherwise requested to disclose a SAR or the information contained in a SAR shall decline to produce the SAR or to provide any information that would disclose that a SAR has been prepared or filed ...." (12 C.F.R. § 21.11(k) (2005), italics added.) Thus, the prohibition against disclosing a SAR protects from discovery not just the SAR and its contents, but also information that would disclose preparation of a SAR. (See Whitney National Bank v. Karam (S.D.Tex.2004) 306 F.Supp.2d 678, 682 (Whitney).) The federal statute, 31 U.S.C. § 5318(g), as implemented by regulation, 12 C.F.R. § 21.11(k), "creates an unqualified discovery and evidentiary privilege that courts have held cannot be waived. [Citations.]." (Whitney, supra, 306 F.Supp.2d at p. 682.) Although the regulation is broader in its prohibition against disclosure of the existence or content of a SAR than is the statute, it has been held consistent and in harmony with the enabling statute. (United States v. Holihan (W.D.N.Y.2003) 248 F.Supp.2d 179, 186 (Holihan); Weil v. Long Island Savings Bank (E.D.N.Y.2001) 195 F.Supp.2d 383, 388-389 (Weil).)
While the regulation prohibits disclosure of SAR's and their contents, courts have uniformly held that "supporting documentation" underlying a SAR that is generated or received in the ordinary course of a bank's business is discoverable. (See Whitney, supra, 306 F.Supp.2d at p. 682; Gregory v. Bank One, Indiana, N.A. *902 (S.D.Ind.2002) 200 F.Supp.2d 1000, 1002 (Gregory); Holihan, supra, 248 F.Supp.2d at p. 187; Cotton, supra, 235 F.Supp.2d at p. 814; Weil, supra, 195 F.Supp.2d at p. 389.) The trial court relied heavily on the distinction between SAR's and supporting documentation in arriving at its holding, noting the regulations recognize a distinction between SAR's and supporting documentation but afford confidential status only to SAR's and their contents. (See, e.g., 12 C.F.R. § 21.11(g) [supporting documentation deemed filed with SAR] & (l) [distinguishing between SAR's and supporting documentation for purposes of safe harbor].) The trial court also gave great weight to commentary offered by the OCC when it promulgated the confidentiality regulation. Responding to public comment on the proposed regulation, the OCC wrote: "One commenter correctly noted that the proposed regulation is unclear as to whether the confidential treatment applies only to the information contained on the SAR itself or also extends to the supporting documentation. The OCC takes the position that only the SAR and the information on the SAR are confidential...." (61 Fed.Reg. 4336 (Feb. 5, 1996).)
These authorities confirm that documentation supporting a SAR is subject to discovery, but they beg the question of what comprises "supporting documentation." The court in Cotton described two types of supporting documents: "The first category represents the factual documents which give rise to suspicious conduct. These are to be produced in the ordinary course of discovery because they are business records made in the ordinary course of business. The second category is documents representing drafts of SAR's or other work product or privileged communications that relate to the SAR itself. These are not to be produced because they would disclose whether a SAR has been prepared or filed." (Cotton, supra, 235 F.Supp.2d at p. 815.) Thus, transactional and account documents such as wire transfers, statements, checks, and deposit slips are the types of documents generated in the ordinary course of business that are subject to discovery. (Id. at p. 814.) Such documents would be prepared regardless of whether a financial institution has an obligation to report suspicious activity to the federal government.
By contrast, a draft SAR or internal memorandum prepared as part of a financial institution's process for complying with federal reporting requirements is generated for the specific purpose of fulfilling the institution's reporting obligation. These types of documents fall within the scope of the SAR privilege because they may reveal the contents of a SAR and disclose whether "a SAR has been prepared or filed." (12 C.F.R. § 21.11(k) (2005).) Unlike transactional documents, which are evidence of suspicious conduct, draft SAR's and other internal memoranda or forms that are part of the process of filing SAR's are created to report suspicious conduct.
Grafton Partners contends that reports of suspicious activity other than SAR's are subject to discovery, citing Gregory, supra, 200 F.Supp.2d 1000 (regulation "requires confidentiality only of SARs and their contents, not of other reports of suspicious activity...."). (Id. at p. 1002.) Likewise, the trial court held that not all reports of suspicious activity are covered by the SAR privilege, and it concluded a bank may not expand the SAR privilege to cover its internal reports just by merging its internal investigations with federal reporting obligations. The trial court reasoned the SAR privilege is primarily intended to protect the confidentiality of communications between financial institutions and federal authorities.
*903 We do not suggest that all reports of suspicious activity are protected by the SAR privilege. We are mindful that evidentiary privileges should be narrowly construed because they prevent otherwise admissible and relevant evidence from coming to light. (McKesson HBOC v. Superior Court (2004) 115 Cal.App.4th 1229, 1236, 9 Cal.Rptr.3d 812.) Financial institutions may have risk management procedures in place for detecting suspicious activity wholly apart from their procedures for complying with federal reporting obligations. A bank may not cloak its internal reports and memoranda with a veil of confidentiality simply by claiming they concern suspicious activity or concern a transaction that resulted in the filing of a SAR.
Some internal reports or memoranda citing suspicious activity, however, may legitimately be part of the process for complying with federal reporting requirements. To ensure that financial institutions carry out their obligation to file SAR's, Congress has mandated that each institution establish anti-money laundering programs, including internal policies, procedures, and controls. (31 U.S.C. § 5318(h)(1).) The OCC had adopted regulations requiring each national bank to "develop and provide for the continued administration of a program reasonably designed to assure and monitor compliance with the recordkeeping and reporting requirements...." (21 C.F.R. § 21.21(b)(1) (2005).) A bank's internal procedures may include the development and use of preliminary reports subject to various quality control checks before the bank prepares the final SAR that will be filed. Revealing these preliminary reports, the equivalent of draft SAR's, would disclose whether a SAR had been prepared.
It is immaterial that these preliminary documents are not communicated to federal authorities. Although the SAR privilege encompasses communications between financial institutions and federal authorities, its rationale extends further. "Permitting the release of any SAR through civil discovery could harm the law enforcement interests the [Annunzio-Wylie Anti-Money Laundering] Act was intended to promote. Release of [a] SAR could compromise an ongoing law enforcement investigation, tip off a criminal wishing to evade detection, or reveal the methods by which banks are able to detect suspicious activity. Furthermore, [a] bank[ ] may be reluctant to prepare [a] SAR if it believes that its cooperation may cause its customers to retaliate. Moreover, the disclosure of [a] SAR may harm the privacy interests of innocent people whose names may be contained therein." (Cotton, supra, 235 F.Supp.2d at p. 815.) These concerns are implicated not just by the release of a SAR, but also by the disclosure of preliminary reports used to prepare a SAR. Compelling the production of such preliminary reports, the OCC maintains, would discourage financial institutions from filing SAR's and could undermine the cooperative effort between federal authorities and financial institutions to combat money laundering, identity theft, embezzlement, and fraud.
The OCC's interpretation of its own regulation is entitled to deference. (See Olszewski v. Scripps Health (2003) 30 Cal.4th 798, 821, 135 Cal.Rptr.2d 1, 69 P.3d 927.) The trial court rejected the OCC's interpretation, however, apparently giving greater weight to the OCC's comments at the time it promulgated the regulation that confidential treatment does not extend to "supporting" documentation. (See 61 Fed. Reg. 4336 (Feb. 5, 1996).) We find no inconsistency between the OCC's position in this lawsuit and its earlier statement that supporting documentation is discoverable. *904 Draft SAR's and similar documents prepared in the process of complying with federal reporting requirements are not supporting documents generated in the ordinary course of business that provide the factual support for suspicious activity. Nothing in the OCC's earlier commentary on the proposed regulation suggests otherwise. (See 61 Fed.Reg. 4332 et seq. (Feb. 5, 1996).) Indeed, to the extent the OCC defined "supporting documentation," it limited the scope of the term to information "that would be relevant in proving the crime and the individuals who committed the crime." (61 Fed.Reg. 4335 (Feb. 5, 1996).) Unlike transactional or account documents that might be evidence of a crime, internal reports or investigations of suspicious activity are not "proof" of the crime or the identity of the perpetrators. Moreover, the OCC has consistently taken the position that "information on the SAR" is confidential (61 Fed.Reg. 4336 (Feb. 5, 1996)), a position suggesting that draft SAR's and similar internal documents prepared in anticipation of the filing of a SAR are confidential to the extent they contain the same information as a SAR.
The trial court also relied on the facts of Holihan, supra, in support of its conclusion that reports of suspicious activity other than a SAR, such as the Form 244, are subject to discovery. Holihan is distinguishable. In Holihan, a former bank teller charged with embezzlement sought the personnel files of other bank employees to show they had similar motives and were under suspicion in connection with the missing funds. (Holihan, supra, 248 F.Supp.2d at pp. 183-184.) The court held that SAR's were protected from discovery but that supporting documentation in the personnel files must be produced, "provided such documentation does not disclose either the existence or contents of [a] SAR." (Id. at p. 187.) Accordingly, the court modified the scope of the subpoena to "any information contained in the specified personnel files demonstrating that any such employees were initially considered suspects with regard to the alleged embezzlement, had personal financial problems thereby establishing a potential motive to embezzle funds, or had unexplained shortages or losses attributed to them." (Ibid.) However, the bank was not required to "disclose any information establishing the existence or contents of any SAR filed as to any such employee." (Ibid.)
While Holihan may stand for the proposition that all reports and investigations of suspicious activity are not necessarily covered by the SAR privilege, a point with which we agree, it does not establish that all such reports other than the SAR's themselves are discoverable. A bank may investigate suspicious activity for reasons other than to comply with federal suspicious activity reporting requirements. Documents reporting such suspicious transactions fall outside scope of the SAR privilege. In Holihan, there is no indication that any of the documents contained in personnel files were prepared for the purpose of investigating and filing a SAR. To the extent the documents were prepared for that purpose, they would presumably fall within the category of documents the Holihan court excluded from the scope of the subpoena.
We agree with the trial court that the SAR privilege covers draft SAR's, the SAR's themselves, and any communication concerning a SAR. However, we also hold that the SAR privilege extends to documents prepared by a bank "for the purpose of investigating or drafting a possible SAR." (See Cotton, supra, 235 F.Supp.2d at p. 816.)

3. Union Bank's Form 244 is covered by the SAR privilege

The trial court found the Form 244's are not part of Union Bank's process *905 of drafting and filing SAR's, comprise "routine bank forms" used for internal bank purposes, and will not inform anyone whether a SAR has been prepared or filed if they are disclosed. We conclude substantial evidence does not support the trial court's findings.
Substantial evidence is not synonymous with "any" evidence, but is evidence that is of ponderable legal significance. (Toyota Motor Sales U.S.A., Inc. v. Superior Court (1990) 220 Cal.App.3d 864, 871, 269 Cal.Rptr. 647.) "Where conflicting inferences may reasonably be drawn, the determination of the trial court will be accepted on appeal even though a contrary determination would likewise be upheld. [Citations.] However, where the facts are undisputed, the issue is one of law and the appellate court is free to reach its own legal conclusion from such facts[.] [Citations.]" (Id. at p. 872, 269 Cal.Rptr. 647.) Here, the relevant facts, which are drawn from the declaration and deposition of the manager of Union Bank's Risk Management Department, are largely undisputed. The dispute is over the legal significance of the facts.
The Form 244 is a one-page document entitled "Suspicious Activity Report" and contains much the same information as the SAR form developed by the Financial Crimes Enforcement Network of the Department of the Treasury (FinCEN). When a branch-level bank employee observes a suspicious transaction, the employee is required to complete a Form 244 and provide information such as the identity of the bank branch, the identity of the suspect, and a description of the suspicious transaction. The 20 categories of suspicious transactions on the Form 244 (e.g., money laundering, identity theft) are identical to and in the same order as the 20 categories on the SAR. Completed Form 244's are sent to the risk management department, which may conduct an investigation to determine whether to file a SAR. In many cases, the SAR is copied verbatim from the Form 244 but in other cases the risk management department may edit or add to the Form 244. Explaining why branch-level employees do not fill out the SAR form itself, the manager of Union Bank's risk management department explained that the people who submit Form 244's, who are "not experts at knowing exactly what a write-up should look like," submit their suspicions for the risk management department to investigate.
The trial court concluded the Form 244's should be considered "supporting documentation" instead of "drafts of [SAR's]," apparently because employees who prepare the Form 244 do not typically conduct any further investigation or draft the SAR that is ultimately filed. If the trial court assumed the term "draft SAR's" encompasses only drafts on the official FinCEN form prepared by the employee responsible for filing a SAR, then the trial court's inquiry was too narrow. As discussed above, the SAR privilege encompasses documents prepared by a bank for the purpose of investigating or drafting a possible SAR. A Form 244 plainly serves that purpose. Simply because the employees who fill out the Form 244's do not ultimately prepare the SAR that is filed does not make them any less a part of the process of investigating suspicious activity and preparing SAR's.
In support of its conclusion that Form 244's are routine bank forms used for internal bank purposes, the trial court cited the following evidence: (1) before the Bank of California merged with Union Bank and adopted Union Bank's Form 244, reports of suspicious activities were typically made by phone or memo because the Bank of California did not have an *906 internal form for that purpose; (2) Union Bank instructed its employees to submit a Form 244 even if a transaction did not meet the dollar threshold for reporting to federal authorities; (3) Union Bank retains Form 244's that did not lead to the filing of a SAR, along with a cover sheet or note explaining why no SAR filing was made; and (4) the Form 244 is used instead of a blank memo form because it is administratively convenient for Union Bank. The trial court reasoned a bank cannot expand the SAR privilege by formatting its internal reports like the SAR and merging its internal investigations with its federal reporting obligations. Grafton Partners also cites evidence that it contends stands for the proposition that the Form 244 is an "all-purpose" risk-prevention form that has been used to prevent or reduce Union Bank's exposure to liability.
Contrary to Grafton Partners' characterization of the evidence, Union Bank never described the Form 244 as an "all purpose" form. Rather, the manager of Union Bank's risk management department testified that employees are encouraged to report suspicious activity even if the reporting threshold is not met. He also testified that employees who prepare the Form 244's are encouraged to submit their suspicions and leave it to the risk management department to determine if a transaction meets the criteria for reporting. Several suspicious transactions taken together may meet the reporting threshold. (See 12 C.F.R. § 21.11(c)(2) [transactions aggregating $5,000 must be reported if suspect is identified].) Also, Union Bank on some occasions filed a SAR to report unusual activity even when the dollar threshold was not met. Thus, the mere fact employees are encouraged to report suspicious transactions that may not meet the reporting threshold does not render the Form 244 "all purpose" or suggest it primarily serves internal bank purposes.
Grafton Partners is correct in pointing out that Union Bank's risk services department manager testified there had been occasions when Union Bank was able to prevent or reduce its exposure to liability as a result of receiving a Form 244. However, Union Bank's witness was not asked to elaborate on the point and did not volunteer any further information. Thus, it is unclear what significance to attribute to the statement. The witness may have been referring to the safe harbor from liability associated with filed SAR's. There is certainly no evidence the form was designed to fulfill a general risk management function. Even if Union Bank has on occasion benefited from information gleaned from a Form 244, this fact does not transform the Form 244 into a general purpose form. Indeed, instead of characterizing the Form 244 as a general purpose form, Union Bank's witness was consistent in describing it as fulfilling Union Bank's obligation to report suspicious activities to the federal government. This characterization is consistent, too, with information in Union Bank's internal manuals for reporting suspicious transactions and completing Form 244's. For example, on an internal flow chart for reporting suspicious transactions used at one time by Union Bank, the preparation of a Form 244 culminates in the filing of a SAR. No evidence of any substantial character has been brought to our attention suggesting the Form 244 serves a purpose other than to fulfill Union Bank's obligation to file SAR's.
We also fail to see the significance of the fact that the Form 244 replaced earlier methods for reporting suspicious transactions. The assumption underlying the trial court's reasoning is that because a memo or e-mail reporting suspicious activity *907 would not be protected from discovery, a Form 244 conveying the same information should also be subject to discovery. The assumption is faulty because the SAR privilege extends to documents a bank prepares for the purpose of investigating or drafting a possible SAR, including memos or e-mails drafted for that purpose. For example, in Cotton, a party sought handwritten notes prepared contemporaneously with disputed business transactions. (Cotton, supra, 235 F.Supp.2d at p. 816.) The notes were subject to discovery, but only to the extent they "were not prepared for the purpose of investigating or drafting a possible SAR." (Ibid.) Likewise, memos or e-mails reporting or commenting on suspicious transactions are not discoverable if prepared as part of a bank's process of investigating and preparing SAR's. The fact a Form 244 resembles a SAR is not dispositive on the issue of whether it is protected by the SAR privilege, although this fact strengthens the case in favor of confidentiality because it tends to show the form serves the purpose of complying with federal reporting obligations.
As the trial court acknowledged, 93 percent of Form 244's result in filed SAR's. The trial court concluded, however, that one cannot tell whether a SAR has been filed just by looking at the Form 244, apparently because one cannot know whether the Form 244 is one of the 7 percent that does not result in a filed SAR. We reject this rationale. The Form 244 echoes the official SAR form, is labeled a "Suspicious Activity Report," and calls for a "Description of Suspicious Transaction." These facts telegraph that a SAR was likely prepared and filed.
In any event, regardless of whether one can tell with certainty that a particular Form 244 resulted in the filing of a SAR, the fact that some Form 244's did not result in a filed SAR does not strip all Form 244's of their confidential status. Nor does this fact mean that Union Bank must produce all Form 244's for which no SAR was filed. "[S]uspected or possible violations that did not culminate in the filing of a SAR" fall within the scope of the SAR privilege. (Whitney, supra, 306 F.Supp.2d at p. 683.) The SAR privilege protects not just the SAR but also the process of preparing the SAR, a process that may from time to time not result in a filed SAR. If financial institutions knew that draft SAR's or similar preliminary documents were subject to discovery because no SAR was ultimately filed, they would be less willing to engage in the process of investigating and filing SAR's. Moreover, financial institutions are prohibited from disclosing whether they filed a SAR with respect to any particular transaction. (Lee v. Bankers Trust Co. (2d Cir.1999) 166 F.3d 540, 544.) A requirement that Union Bank disclose Form 244's not culminating in the filing of a SAR would violate this prohibition by revealing that no SAR was filed for certain transactions initially identified as suspect by branch employees.
Accordingly, we conclude the evidence relied upon by the trial court is too insubstantial to support a reasonable inference that the Form 244 is a routine bank form primarily used for purposes other than Union Bank's process of investigating and filing SAR's.

4. Standing to assert the SAR privilege

A party may challenge a ruling disallowing a claim of privilege only if that party is the holder of the privilege, except when the party challenges a ruling disallowing a claim by a spouse premised on the spousal privilege. (Evid.Code, § 918.) Grafton Partners contends that Union Bank has no standing to assert the SAR privilege because the OCC is the holder of *908 the privilege. Although the OCC is indisputably the holder of the SAR privilege, we disagree that Union Bank has no standing to assert the privilege.
The OCC has the discretion to disclose SAR's and their contents. (12 C.F.R. §§ 4.31-4.40 (2005).) By contrast, national banks have no such discretion and are required by federal regulation to decline to produce SAR's or any information that would disclose that a SAR has been prepared or filed. (12 C.F.R. § 21.11(k) (2005).) A person or entity served in civil litigation with a subpoena or other request for such information must notify the OCC. (Ibid.) At the time the confidentiality regulation was promulgated, the OCC commented that the notification requirement allows the OCC to determine whether it should intervene in the proceedings. (61 Fed.Reg. 4336 (Feb. 5, 1996).)
We find no support for the proposition that the OCC must intervene as a party in order for the court to give effect to the SAR privilege. (Cf. Mylan Laboratories Inc. v. Soon-Shiong (1999) 76 Cal.App.4th 71, 80, 90 Cal.Rptr.2d 111 [client need not intervene as party to assert attorney-client privilege].) Even if a national bank had no authority to claim the SAR privilege, a court would still be obliged to exclude information subject to the privilege if no holder of the privilege was a party to the proceeding. (Evid.Code, § 916, subd. (a).) National banks, however, are not just authorized to claim the SAR privilege; they are required to do so. (12 C.F.R. § 21.11(k) (2005).) Similarly, in the case of the attorney-client privilege, although the client is the holder of the privilege, the attorney must claim the privilege unless instructed otherwise by a person with power to waive the privilege. (Evid.Code, §§ 953, 954, subd. (c), & 955.) Just as a lawyer has standing to assert the attorney-client privilege, a national bank has standing to assert the SAR privilege.
When it appears a national bank is making an overbroad claim based on the SAR privilege, a court may be warranted in questioning whether the OCC agrees with the bank's position. Indeed, after initially ruling on the motion the trial court in this case gave the OCC an opportunity to respond. The OCC chose to proceed as amicus curiae in the trial court, as it has done in this writ proceeding. The OCC could have chosen in the alternative to file a declaration in the trial court clarifying its assertion of the SAR privilege over the documents at issue. (Cf. Wolpin v. Philip Morris Inc. (C.D.Cal.1999) 189 F.R.D. 418, 425.) While the OCC's participation may assist the court, there is no requirement the OCC must appear in an action, either as a party or otherwise, before the SAR privilege will be given effect.
Finally, Grafton Partners asserts that Union Bank lacks standing in this writ proceeding because it has no beneficial interest in the subject matter of the action. (See Waste Management of Alameda County, Inc. v. County of Alameda (2000) 79 Cal.App.4th 1223, 1232, 94 Cal.Rptr.2d 740.) The argument lacks merit. "To establish a beneficial interest, the petitioner must show he or she has some special interest to be served or some particular right to be preserved or protected through issuance of the writ. [Citation.]" (Ibid.) Although the OCC holds the SAR privilege, Union Bank has an obvious interest in protecting from disclosure documents in its possession that were prepared with an understanding they would be maintained in confidence, particularly when Grafton Partners seeks to predicate liability on those documents. Furthermore, the fact Union Bank is compelled by federal law to resist disclosure of documents covered by the SAR privilege gives *909 it a sufficient beneficial interest in the subject matter of this action to enforce the privilege in a writ proceeding.

DISPOSITION
Let a peremptory writ of mandate issue directing respondent court to vacate its orders of June 9, 2004, and August 2, 2004, and to enter a new and different order denying Grafton Partners' motion to compel as it concerns the production of Form 244's and any further interrogatory responses or requests for admission requiring disclosure of the contents of Form 244's. The stay previously issued by this court shall be dissolved upon the issuance of the remittitur. Petitioner shall recover the costs it incurred in this writ proceeding.
We concur: CORRIGAN and PARRILLI, JJ.
NOTES
[1]  Richard Kipperman is the trustee in bankruptcy for Grafton, Allied, and Six Sigma. The individual plaintiffs are Tom Frame, Bruce Miller, and Ronald VandenBerghe.
[2]  The Code of Federal Regulations provides a mechanism for litigants to request nonpublic information from the OCC, including SAR's. (12 C.F.R. § 4.31 et seq. (2005).) The OCC has sole discretion whether to grant a request. (12 C.F.R. § 4.35(a) (2005).)
[3]  The discovery requests relating to the Form 244's are identified as special interrogatories 1 through 13, request for admission 13, form interrogatory 17.1 (as it relates to request for admission 13), and document requests 62, 63, 65, and 66.
[4]  The trial court's order cites "C.C.P. 166.6," an apparent reference to Code of Civil Procedure section 166.1, which provides in relevant part: "Upon the written request of any party or his or her counsel, or at the judge's discretion, a judge may indicate in any interlocutory order a belief that there is a controlling question of law as to which there are substantial grounds for difference of opinion, appellate resolution of which may materially advance the conclusion of the litigation."
[5]  In addition to challenging the trial court's discovery orders relating to Form 244's, Union Bank also purports to challenge a much earlier trial court order denying Union Bank's motion to strike references to or claims based on SAR's. We decline to entertain that challenge, which is untimely. (See Volkswagen of America, Inc. v. Superior Court (2001) 94 Cal. App.4th 695, 701, 114 Cal.Rptr.2d 541 [appellate court should deny petition as untimely if filed beyond 60-day period generally applicable to appeals].) Moreover, absent unusual circumstances, rulings on pleadings motions are not appropriate for interlocutory appellate review. (Babb v. Superior Court (1971) 3 Cal.3d 841, 851, 92 Cal.Rptr. 179, 479 P.2d 379.) We express no view on the merits of the motion to strike.
[6]  The trial court reasoned that, because the privileges contained in the Evidence Code are exclusive, the SAR privilege is given effect through California's official information privilege, codified in Evidence Code section 1040. The parties do not dispute the applicability of the official information privilege. We believe, however, that reliance on the official information privilege is both unnecessary and misplaced. The SAR privilege, the product of a federal statute and regulations implementing the statute, is given effect as a privilege created by statute. (See Evid.Code, § 230 [definition of "statute"].) The privilege is not the product of federal common law. Accordingly, we need not rely on the official information privilege to "give effect" to the SAR privilege. Moreover, because the official information privilege encompasses only information "acquired in confidence by a public employee" (Evid.Code, § 1040, subd. (a)), it would be improper to rely on the official information privilege to protect from disclosure draft SAR's or similar documents prepared by a national bank but never transmitted to federal authorities, because such information has not been acquired in confidence by a public employee.
