EU AML Regulation and COSMIC Information Sharing

1. Why This Topic Matters

Two of the most significant anti-financial crime (AFC) developments of the 2020s are the European Union AML Package (centred on the new EU AML Regulation and the AML Authority) and Singapore's COSMIC digital information-sharing platform. Both appear in the CAMS domain Controls, Investigations and the AFC Organization because they represent the future direction of compliance: harmonised, directly applicable rules on one hand, and legally protected, technology-enabled collaboration between private institutions and the public sector on the other.

Examiners test these topics because they demonstrate three core ideas a CAMS professional must understand:
• Regulators are moving from national discretion toward a single rulebook that applies uniformly across borders.
• Criminals exploit the fact that each bank sees only a fragment of a network; information sharing closes that gap.
• Effective controls require a balance between financial crime detection, data protection, confidentiality and tipping-off rules.

If you understand why these frameworks were created, what problems they solve, and how they operate in practice, you will be able to answer scenario-based exam questions with confidence.

2. What Is the EU AML Regulation?

For decades the EU fought money laundering through directives (the 1st through 5th AML Directives). A directive must be transposed into national law by each Member State, which produced inconsistent rules, uneven supervision and regulatory arbitrage. High-profile scandals (for example Danske Bank, ABLV, Wirecard) exposed these weaknesses.

In response, the EU adopted a comprehensive AML Package, published in the Official Journal in June 2024, consisting of three instruments:

• The AML Regulation (AMLR) – Regulation (EU) 2024/1624: the Single Rulebook. As a regulation it applies directly in every Member State without national transposition. It sets the rules for obliged entities: customer due diligence, beneficial ownership, record-keeping, internal policies and reporting. Most provisions apply from 10 July 2027.
• The 6th AML Directive (AMLD6) – Directive (EU) 2024/1640: covers the institutional architecture that still needs national implementation – beneficial ownership registers, Financial Intelligence Units (FIUs), national supervisors and cooperation between authorities.
• The AMLA Regulation – Regulation (EU) 2024/1620: creates the Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt, which began operating in 2025 and will directly supervise selected high-risk, cross-border financial institutions from 2028, coordinate FIUs and issue binding technical standards.

Key features of the AML Regulation you should know:

• Expanded scope of obliged entities: all crypto-asset service providers (CASPs), crowdfunding platforms, traders in luxury goods (high-value cars, jets, yachts, jewellery), and – from 2029 – professional football clubs and agents.
• EU-wide cash limit: a cap of EUR 10,000 on large cash payments for goods and services (Member States may set lower limits).
• CDD thresholds: full CDD for occasional transactions of EUR 10,000 or more; for CASPs the occasional-transaction threshold is EUR 1,000.
• Beneficial ownership: the ownership-or-control test is harmonised at 25% of shares or voting rights (with a lower threshold possible for higher-risk categories of entities), plus clear rules on multi-layered structures, nominees and trusts, and central registers accessible to those with legitimate interest.
• Enhanced due diligence (EDD) required for very wealthy clients (assets of at least EUR 50 million, excluding the main residence) handling large transactions, for high-risk third countries, and for relationships with politically exposed persons (PEPs).
• Harmonised internal controls: a designated compliance manager at management level, a compliance officer, group-wide policies, outsourcing rules and whistleblowing channels.
• Partnerships for information sharing: the AMLR explicitly allows obliged entities to participate in public-private partnerships and to share customer information for AML/CFT purposes under strict safeguards, including data protection impact assessments and supervisory notification. This is the EU's legal bridge to collaborative models such as COSMIC.
• Sanctions screening and targeted financial sanctions compliance are embedded as explicit obligations.

3. What Is COSMIC?

COSMIC stands for Collaborative Sharing of ML/TF Information and Cases. It is a secure digital platform launched on 1 April 2024 by the Monetary Authority of Singapore (MAS) in co-development with six major banks: DBS, OCBC, UOB, Standard Chartered, Citibank and HSBC.

The platform allows participating financial institutions (FIs) to share customer information with one another when specific risk indicators (red flags) are triggered, so that they can detect and disrupt criminal networks that would be invisible to any single institution. MAS also has access to the shared information, strengthening supervision and the national intelligence picture.

Legal foundation: COSMIC is enabled by amendments to the Financial Services and Markets Act (FSMA) passed in 2023. The legislation provides a statutory safe harbour – FIs that share information in good faith and in accordance with the rules are protected from civil liability – and overrides banking secrecy restrictions for the permitted purposes.

Three initial priority risk areas:
• Misuse of legal persons – shell and front companies with no genuine economic purpose.
• Trade-based money laundering (TBML) – mis-invoicing, phantom shipments and abuse of trade finance.
• Proliferation financing (PF) – evasion of sanctions related to weapons of mass destruction.

Three modes of sharing (Request, Provide, Alert):
• Request: an FI that observes red flags about a customer can ask another FI that has dealt with the same customer for relevant information.
• Provide: an FI proactively passes information to another FI about a customer displaying red flags, where the other FI has an existing relationship with that customer.
• Alert: an FI places a customer on a watchlist on the platform after terminating the relationship or filing a Suspicious Transaction Report (STR) for serious concerns, so that other FIs are warned.

Safeguards:
• Sharing is only permitted when customer behaviour crosses defined red-flag thresholds set out by MAS; it is not a free-for-all data exchange.
• Participants must maintain strict confidentiality; onward disclosure and tipping-off are prohibited.
• Information received cannot be used as the sole basis to automatically de-risk a customer; FIs must conduct their own risk assessment.
• Robust data security, access controls and audit trails are mandatory.
• Participation was voluntary in the initial phase, with MAS indicating that sharing would become mandatory in defined higher-risk circumstances in later phases, and that more FIs and risk areas would be added over time.

4. How These Frameworks Work in Practice

EU AML Regulation in practice:
Imagine a payment institution operating in five Member States. Before the AMLR, it had to map five different sets of national CDD rules, beneficial ownership definitions and PEP requirements. From July 2027 it applies one directly binding rulebook. Its group compliance function implements harmonised policies, appoints a compliance manager on the management body, applies a 25% beneficial ownership test everywhere, and knows that AMLA may step in as direct supervisor if it is classified as high-risk and cross-border. Information gathered from EU-wide beneficial ownership registers and from FIU cooperation flows into its risk assessments and STR filings.

COSMIC in practice:
Bank A onboards a newly incorporated trading company. Within weeks the account receives large round-sum inflows from multiple jurisdictions followed by rapid outward transfers, with invoices that do not match shipping documents. These behaviours match MAS red-flag indicators for shell-company misuse and TBML. Bank A uses COSMIC to request information from Bank B, which also banks the company. Bank B reports that the company's beneficial owner has previously had accounts closed for similar activity. Bank A files an STR, exits the relationship and places an alert on COSMIC. Bank C, which receives a new account application from the same entity, sees the alert and conducts enhanced due diligence before deciding whether to onboard. Throughout, no employee informs the customer of the information exchange, and all sharing is logged and visible to MAS.

5. How COSMIC Fits the Global Trend

COSMIC is often compared with other public-private partnerships (PPPs) you may encounter on the exam:
• United Kingdom – JMLIT (Joint Money Laundering Intelligence Taskforce), led by the National Crime Agency.
• United States – Section 314(b) of the USA PATRIOT Act, allowing FIs to share information with each other under a safe harbour after notifying FinCEN, and the FinCEN Exchange.
• Netherlands – TMNL (Transaction Monitoring Netherlands), a bank collaboration on joint transaction monitoring.
• Australia – Fintel Alliance, run by AUSTRAC.
• EU – Article on partnerships for information sharing in the AMLR, giving a harmonised legal basis to similar initiatives across Member States.

The common thread: criminals launder across many institutions, while each institution historically could see only its own slice. Legal safe harbours and secure platforms allow the pieces to be assembled.

6. Key Facts to Memorise

• EU AML Package = AMLR (single rulebook) + AMLD6 + AMLA Regulation; adopted 2024.
• AMLR applies from 10 July 2027; AMLA is based in Frankfurt; direct supervision from 2028.
• Cash limit EUR 10,000; beneficial ownership threshold 25%; CASP occasional transaction CDD at EUR 1,000.
• Regulation = directly applicable; Directive = requires national transposition.
• COSMIC = Collaborative Sharing of ML/TF Information and Cases; MAS; launched 1 April 2024; six founding banks.
• Legal basis: Financial Services and Markets Act amendments (2023) with statutory safe harbour.
• Three priority risks: misuse of legal persons, TBML, proliferation financing.
• Three sharing modes: Request, Provide, Alert.
• Sharing only when red-flag thresholds are met; confidentiality and anti-tipping-off apply; voluntary initially, moving to mandatory in higher-risk cases.

7. Exam Tips: Answering Questions on EU AML Regulation and COSMIC Information Sharing

Tip 1 – Distinguish instrument types. If a question asks why the EU moved from directives to a regulation, the answer is direct applicability and harmonisation – eliminating divergent national transposition and regulatory arbitrage. Remember that beneficial ownership registers, FIUs and national supervisors remain in the Directive (AMLD6), while obligations on firms sit in the Regulation (AMLR).

Tip 2 – Know the role of AMLA. AMLA does not replace national supervisors for every firm. It directly supervises a limited set of high-risk cross-border financial institutions, indirectly oversees others, coordinates FIUs and sets technical standards. Options claiming AMLA supervises all EU obliged entities are distractors.

Tip 3 – Watch the numbers. CAMS questions frequently use near-miss figures. EUR 10,000 is the cash limit and general occasional-transaction CDD threshold; EUR 1,000 applies to crypto-asset service providers; 25% is the beneficial ownership benchmark. Dates such as July 2027 (AMLR applies) and 2028 (AMLA direct supervision) can also appear.

Tip 4 – Understand the purpose of COSMIC, not just the acronym. The best answer usually reflects the problem it solves: enabling FIs to share information on customers exhibiting red flags so that criminal networks spanning multiple banks can be detected. Answers emphasising marketing, credit assessment or general customer profiling are wrong.

Tip 5 – Apply the red-flag threshold rule. In scenario questions, an FI may share via COSMIC only when the customer's behaviour meets the defined risk indicators within the priority areas. If a scenario describes a merely unusual but non-red-flag transaction, or curiosity about a competitor's client, sharing is not permitted.

Tip 6 – Match the scenario to the correct sharing mode. Asking another bank about a suspicious client = Request. Proactively sending information to a bank that also serves the client = Provide. Flagging a customer after an exit or STR so others are warned = Alert.

Tip 7 – Remember confidentiality and tipping-off. Any option suggesting the FI informs the customer, uses COSMIC data for unrelated purposes, or shares it with third parties outside the platform is incorrect. Information received through COSMIC should trigger the FI's own risk assessment, not automatic account closure without review.

Tip 8 – Recognise the safe harbour concept. Questions may ask what makes COSMIC or US Section 314(b) sharing legally possible. The answer is a statutory protection from civil liability (and an override of secrecy rules) for good-faith sharing within the framework. Link this to the EU AMLR provision on partnerships for information sharing when asked about European equivalents.

Tip 9 – Identify stakeholders correctly. COSMIC is operated under MAS (Singapore), not FATF, not the EU, not the US. The EU package is EU-level legislation; AMLA is an EU agency. Mixing jurisdictions is a classic distractor technique.

Tip 10 – Use the CAMS best-answer approach. When two options seem plausible, choose the one that reflects a risk-based, legally compliant and proportionate action: share only what is permitted, document decisions, escalate to the MLRO, file an STR where suspicion exists, and protect data. The exam rewards answers that balance effectiveness against legal safeguards.

8. Quick Self-Check Questions

1. Why does the EU AMLR not require national transposition? (Because it is a regulation, directly applicable in all Member States.)
2. Which authority will directly supervise selected high-risk cross-border financial institutions in the EU, and where is it based? (AMLA, Frankfurt.)
3. What are COSMIC's three initial priority risk areas? (Misuse of legal persons, trade-based money laundering, proliferation financing.)
4. Under what condition may an FI share customer information via COSMIC? (When the customer's profile or behaviour crosses MAS-defined red-flag thresholds.)
5. What protects FIs that share information in good faith through COSMIC? (A statutory safe harbour from civil liability under the amended Financial Services and Markets Act.)

9. Summary

The EU AML Regulation delivers a directly applicable single rulebook, backed by a new central authority (AMLA), harmonised thresholds and an explicit legal basis for information-sharing partnerships. COSMIC demonstrates how a regulator and major banks can build a secure, legally protected platform to share red-flag intelligence on shell companies, TBML and proliferation financing. For the CAMS exam, master the purpose, the structure, the key thresholds and the safeguards of each framework, and always choose the answer that combines effective detection with lawful, confidential and risk-based practice.