An investigative analyst for the Internal Revenue Service has been charged with leaking Michael Cohen’s personal bank records.

John Fry, 54, was charged Feb. 4 by the U.S. Attorney’s Office for the Northern District of California with improperly disclosing a suspicious activity report, also known as a SAR, according to the criminal complaint.

The Department of Justice had been investigating how the records had ended up in the hands of lawyer Michael Avenatti and news outlets.

Avenatti, the attorney representing porn star Stormy Daniels in her legal battle against President Trump and Cohen, posted a document in May 2018 detailing transactions made to a company controlled by Cohen sent by large firms that had business interests before the U.S. government.

Cohen received the payments through Essential Consultants LLC, a shell company he had set up to make hush money payments to Daniels to keep her quiet about her alleged affair with Trump.

Several news outlets also reported at the time that they had reviewed records detailing the transactions. Cohen’s attorney said the documents had been illegally obtained.

Avenatti has not said how he obtained the information, which appeared to come from a SAR. Banks are required to file the confidential reports with the Treasury Department when they suspect someone is money laundering, financing terrorism, or participating in other illegal activities.

The Wall Street Journal reported in April 2018 that the bank Cohen used to pay Daniels filed a SAR.

After Avenatti shared the document, the New Yorker interviewed a “law enforcement official” that the magazine said was the person who leaked the SAR. The official said they leaked the records because they feared a cover-up.

Fry has been employed by the IRS since 2008 and currently works in its San Francisco office. As part of his job, Fry reviewed SARs for potentially illegal activity.

“On May 4, 2018 John FRY logged onto the Palantir database from his work computer and conducted numerous searches related to Michael Cohen, the then-personal attorney of Donald Trump,” prosecutors alleged. “At approximately 2:54 p.m., FRY accessed and downloaded five SARs, according to file data from a Palantir download found on FRY’s work computer.”

After downloading the documents, he made two phone calls from his personal cellphone to a phone number linked to Avenatti, then conducted additional searches on the database for the Financial Crimes Enforcement Network, a bureau within the Treasury which collects and analyzes financial information, court documents said.

Three days later, Fry again searched for Cohen’s records in the FinCEN database and made another call to Avenatti.

On May 8, Avenatti posted the information on Twitter.

Prosecutors have also obtained WhatsApp messages and phone records between a reporter and Fry.

Fry was confronted on Nov. 26 about the unauthorized leaks and “confessed verbally to providing SAR information to Avenatti,” prosecutors said. Fry admitted he was also contacted by a reporter who had asked him to verify information given to him by Avenatti.

Fry faces up to five years in prison and a fine of $250,000 if found guilty.