Limits of Sharing Data and Intelligence in PPPs

1. Why This Topic Matters

Public-Private Partnerships (PPPs) are one of the most significant developments in modern anti-money laundering and counter-terrorist financing (AML/CFT). Financial institutions see transactional data; law enforcement and Financial Intelligence Units (FIUs) see criminal typologies, investigative leads and intelligence. When these two worlds exchange information, the result is faster detection of complex money laundering networks, better-quality Suspicious Activity Reports (SARs/STRs), and fewer defensive, low-value filings.

However, information sharing is not unlimited. Every PPP operates inside a web of legal, regulatory, operational and ethical constraints. The CAMS exam tests this topic because a compliance professional must understand not only the benefits of collaboration but also the boundaries: what can be shared, with whom, for what purpose, under which legal gateway, and what happens when those boundaries are crossed. A candidate who assumes that more sharing is always better will choose wrong answers. The exam rewards candidates who recognise that lawful, purpose-limited, confidential sharing is the standard.

This area sits within the CAMS domain on Regulatory Regimes, Risk Assessments and Collaboration, and it connects directly to FATF Recommendation 2 (national cooperation and coordination), FATF guidance on private-sector information sharing, the Egmont Group principles for FIU exchange, and national gateways such as Section 314(b) of the USA PATRIOT Act and the UK Criminal Finances Act 2017.

2. What Are PPPs in the AML/CFT Context?

A PPP is a structured, usually voluntary arrangement in which government bodies (FIUs, law enforcement, regulators) and private-sector entities (banks, money services businesses, fintechs, designated non-financial businesses) exchange information to improve the detection, prevention and disruption of financial crime.

Well-known examples include:
• JMLIT (Joint Money Laundering Intelligence Taskforce) in the United Kingdom, operated with the National Crime Agency.
• FinCEN Exchange in the United States, which convenes briefings between FinCEN, law enforcement and financial institutions.
• Fintel Alliance in Australia, led by AUSTRAC.
• ACIP (AML/CFT Industry Partnership) in Singapore, co-led by the Monetary Authority of Singapore and the Commercial Affairs Department.
• Project Protect in Canada, focused on human trafficking indicators via FINTRAC.
• The Europol Financial Intelligence Public Private Partnership (EFIPPP) at the European level.

PPPs typically operate on two levels:
• Strategic sharing: typologies, emerging threats, red-flag indicators and sanitised case studies. This is the least constrained form of sharing because it generally does not identify specific customers.
• Tactical or operational sharing: information about specific subjects, accounts or networks. This is far more constrained because it touches on personal data, bank secrecy, SAR confidentiality and the integrity of live investigations.

3. The Core Limits on Sharing

3.1 Legal Gateways and the Absence of Them
Information can only be lawfully shared where a legal basis exists. Without a specific statutory gateway, a financial institution disclosing customer information to another institution or to a government body may breach confidentiality duties, data protection law or bank secrecy law. Key gateways include:
• USA PATRIOT Act Section 314(a): allows FinCEN, on behalf of law enforcement, to request that financial institutions search their records for named subjects. Sharing flows from government to private sector and back; institutions must not disclose the request itself.
• USA PATRIOT Act Section 314(b): a voluntary safe harbor permitting financial institutions to share information with each other, but only after registering (notifying FinCEN), only for the purpose of identifying and reporting possible money laundering or terrorist financing, and only with other registered participants. Sharing for unrelated commercial or credit purposes is not protected.
• UK Criminal Finances Act 2017: created a voluntary information-sharing gateway between regulated-sector entities and with the NCA, together with a mechanism for joint disclosure reports (so-called super-SARs).
• FATF Recommendation 2 and the 2017 FATF Guidance on Private Sector Information Sharing encourage jurisdictions to create such gateways while respecting data protection and privacy rules.

3.2 SAR/STR Confidentiality and Tipping-Off Prohibitions
This is the most heavily tested limit. In virtually every jurisdiction, the existence or contents of a SAR/STR must not be disclosed to the subject or to unauthorised third parties. In the United States, 31 U.S.C. 5318(g)(2) prohibits disclosure of a SAR or any information that would reveal its existence, with narrow exceptions (for example, sharing within a corporate group under FinCEN guidance, or disclosure to appropriate regulators and law enforcement). Within a PPP, an institution cannot simply say we filed a SAR on this customer to a peer bank. It may share underlying transactional facts under a valid gateway such as 314(b), but SAR confidentiality remains intact. Tipping-off laws similarly prohibit alerting a customer that they are under suspicion, which limits how operational intelligence can be acted upon.

3.3 Data Protection and Privacy Law
Regimes such as the EU General Data Protection Regulation (GDPR) impose principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security. Personal data gathered for AML purposes cannot be freely repurposed. Cross-border transfers of personal data face additional restrictions. Even where a gateway exists, the institution must share only what is necessary and proportionate. Many PPPs therefore rely on aggregated, anonymised or pseudonymised data for strategic work, reserving identifiable data for narrowly defined tactical cases.

3.4 Bank Secrecy and Customer Confidentiality
Jurisdictions with strict bank secrecy laws (historically Switzerland, Singapore, Lebanon, certain offshore centres) impose criminal or civil penalties for disclosing customer information without legal authority. A global institution participating in a PPP in one country may be legally unable to contribute data held by a branch or affiliate in another country. This creates jurisdictional asymmetry within multinational groups.

3.5 Limits on What Government Can Share
The flow is not only private-to-public. Law enforcement and FIUs face their own limits:
• Classified or sensitive intelligence cannot be released to private parties.
• Live investigations may be compromised by disclosure; agencies share on a need-to-know basis.
• Egmont Group principles govern FIU-to-FIU exchange and generally require that information received from a foreign FIU not be passed to third parties (including private institutions) without the prior consent of the originating FIU.
• Evidential rules may restrict disclosure of material gathered under compulsory powers.
Private-sector participants often receive sanitised alerts, indicators or subject names rather than full case files.

3.6 Competition and Antitrust Concerns
When competing institutions sit in the same room, there is a risk that shared information could be used for anti-competitive purposes, for instance coordinating customer exit decisions or exchanging commercially sensitive data. PPPs generally adopt terms of reference prohibiting discussion of pricing, commercial strategy or coordinated de-risking.

3.7 Liability and Absence of Safe Harbor
Institutions fear civil liability for sharing inaccurate information that leads to account closure, reputational harm or denial of service to an innocent customer. Where a jurisdiction provides no safe harbor, institutions will share cautiously or not at all. Even where safe harbor exists, it is typically conditional (good faith, proper purpose, proper registration). Exceeding the conditions forfeits protection.

3.8 Trust, Reciprocity and Information Asymmetry
A practical rather than legal limit: private institutions often complain that they provide large volumes of data and receive little feedback. Government bodies, in turn, may question the quality or completeness of private data. Without trust, voluntary sharing declines. Many PPPs build in feedback loops and confidentiality protocols to address this.

3.9 Operational and Technical Limits
Incompatible data formats, lack of secure channels, limited analytical resources, and the inability to verify counterparties can all constrain sharing. Smaller institutions may lack the systems to participate meaningfully.

3.10 Membership and Scope Limits
PPPs often include only a subset of institutions (frequently large banks), which raises concerns about fairness and about criminals displacing activity to non-members. Scope is also limited to defined threat areas (for example, human trafficking, trade-based money laundering, fraud), not general commercial due diligence.

4. How Sharing Works Within the Limits

Effective PPPs use a set of mechanisms to stay within legal boundaries:
• Memoranda of Understanding and terms of reference setting out purpose, permitted participants, confidentiality and handling rules.
• Tiered information classification (for example, traffic-light protocols) to dictate how widely information can be redistributed.
• Need-to-know and purpose limitation controls, ensuring data received is used only for AML/CFT and not for marketing, credit or commercial decisions.
• Anonymisation and aggregation for typology development.
• Secure platforms and vetted personnel.
• Clear separation between participation in a PPP and the institution's independent legal obligations: receiving intelligence does not replace the duty to conduct one's own monitoring and to file SARs where suspicion arises.
• Registration and notification where statute requires it (as with Section 314(b)).
• Documented decision-making so the institution can evidence that each disclosure had a lawful basis and proportionate scope.

The guiding logic is simple: share what is necessary, with those who are authorised, for the purpose the law permits, and protect it once shared.

5. How to Answer Exam Questions on This Topic

CAMS questions in this area are usually scenario-based. A typical pattern presents a compliance officer at a bank participating in a PPP who receives or wishes to share information, and asks what the most appropriate action is. Use the following approach:

Step 1: Identify the direction of the information flow. Is it private-to-private, private-to-public, public-to-private, or FIU-to-FIU? Each has different rules.

Step 2: Identify the legal gateway, if any. Ask whether the scenario mentions registration, a statutory scheme, an MoU or a safe harbor. If no gateway exists, disclosing identifiable customer data is usually wrong.

Step 3: Check for SAR confidentiality and tipping-off triggers. Any answer that reveals the existence of a SAR to a peer institution, a customer or an unauthorised party is almost always incorrect.

Step 4: Apply purpose limitation. Information obtained through a PPP may only be used for AML/CFT purposes. Answers suggesting use for credit scoring, marketing, competitive advantage or blanket customer exit are wrong.

Step 5: Remember that PPP participation is voluntary and supplementary. It does not relieve the institution of its own monitoring, reporting and record-keeping duties, nor does it allow the institution to delay a required SAR while waiting for the partnership to act.

Step 6: Choose the most conservative lawful option. When two answers appear reasonable, the one that shares the minimum necessary information through the proper channel, with documentation, is usually correct.

6. Exam Tips: Answering Questions on Limits of Sharing Data and Intelligence in PPPs

• Tip 1 – SAR confidentiality is absolute in exam scenarios. Never select an answer where an institution tells another bank, a customer or a non-authorised party that a SAR was filed. Sharing underlying facts under a gateway is different from disclosing the SAR itself.

• Tip 2 – Know Section 314(b) conditions precisely. Voluntary, requires notice to FinCEN, applies only to money laundering and terrorist financing purposes, protection applies only when sharing with other registered institutions, and the recipient must safeguard the information. Questions often test a scenario where one party has not registered or where the purpose is fraud unrelated to ML/TF.

• Tip 3 – Distinguish 314(a) from 314(b). 314(a) is a government-initiated request to search records; institutions must not disclose that they received the request. 314(b) is institution-to-institution sharing.

• Tip 4 – Recognise data protection vocabulary. Words such as proportionality, data minimisation, purpose limitation, lawful basis and cross-border transfer signal that the correct answer respects privacy law rather than maximising disclosure.

• Tip 5 – Remember Egmont third-party rules. Intelligence received from a foreign FIU cannot be passed on, including to private-sector partners, without the originating FIU's consent.

• Tip 6 – Watch for competition-law traps. Any answer involving coordination of commercial decisions, pricing or joint de-risking among competitors is incorrect.

• Tip 7 – PPP intelligence does not replace independent judgment. If a PPP alert names a customer, the institution must still conduct its own review and decide whether suspicion exists. Filing a SAR solely because a name appeared, without review, or refusing to file because the partnership did not instruct it, are both wrong.

• Tip 8 – Government sharing is limited too. If a question asks why law enforcement provides only sanitised indicators, the answer relates to protecting live investigations, classified sources and evidential integrity, not to lack of interest.

• Tip 9 – Multinational groups face jurisdictional limits. A correct answer will recognise that data held in a strict bank secrecy jurisdiction may not be exportable to a PPP in another country without local legal authority.

• Tip 10 – Documentation and governance. Where an answer option includes recording the legal basis, the purpose and the recipients of a disclosure, it is usually a strong candidate for the correct response.

• Tip 11 – Eliminate extremes. Options stating that institutions should share all available data freely, or that institutions should never share anything with peers, are both distractors. The exam sits in the middle: lawful, purpose-bound, confidential sharing.

7. Practice Scenarios

Scenario A. A bank registered under Section 314(b) is contacted by another bank asking for transaction details on a shared customer suspected of laundering drug proceeds. The requesting bank has not filed a 314(b) notice. What should the compliance officer do?
Answer: Decline to share under 314(b) until the requesting bank has registered, because safe-harbor protection applies only between registered participants. Sharing without that basis risks breaching confidentiality duties.

Scenario B. During a PPP meeting, a law enforcement officer asks a bank representative to confirm whether a SAR has been filed on a named individual so the task force can prioritise cases.
Answer: The representative should not confirm or deny SAR filings in a multi-party setting. SAR information may be provided to law enforcement through the proper, direct legal channels (for example, in response to a lawful request to FinCEN or the FIU), not disclosed informally in a group forum where other private parties are present.

Scenario C. A bank receives a list of typologies and indicators from a PPP. Its marketing team asks to use the list to profile high-value customers for a new product.
Answer: Refuse. Information received through the PPP is subject to purpose limitation and may only be used for AML/CFT detection and reporting.

Scenario D. An FIU receives intelligence from a foreign FIU via the Egmont Secure Web and wishes to brief domestic banks in its PPP on the specific subjects.
Answer: The FIU must first obtain the consent of the originating FIU before disseminating to third parties, including private-sector partners.

Scenario E. A global bank's compliance officer in the United Kingdom wants to contribute account data held by the bank's Swiss branch to a JMLIT case.
Answer: The officer must first confirm that Swiss bank secrecy and data protection law permit the transfer; absent a lawful basis in the holding jurisdiction, the data cannot be shared, regardless of the UK gateway.

8. Key Terms to Memorise

• Legal gateway – a statutory or regulatory provision that authorises disclosure.
• Safe harbor – protection from civil liability for good-faith sharing within defined conditions.
• Purpose limitation – data may only be used for the purpose for which it was lawfully obtained.
• Data minimisation – share only what is necessary and proportionate.
• Tipping off – unlawfully alerting a subject that they are under suspicion or investigation.
• SAR confidentiality – prohibition on disclosing a SAR or its existence to unauthorised persons.
• Need-to-know – access restricted to those who require the information for a legitimate purpose.
• Third-party rule (Egmont) – FIU intelligence may not be forwarded without originator consent.
• Strategic vs tactical sharing – typologies and trends versus subject-specific intelligence.

9. Summary

PPPs are powerful tools, but their power depends on operating within clear limits. For the CAMS exam, remember that every disclosure needs a lawful basis, that SAR confidentiality and tipping-off rules are never overridden by partnership participation, that data protection and bank secrecy laws constrain what can cross organisational and national borders, that government agencies have their own restrictions on what they can release, and that information received must be used only for AML/CFT purposes and never for competitive advantage. When in doubt on the exam, select the answer that shares the minimum necessary, through the proper channel, with proper documentation, while preserving the institution's independent obligations.