Private-Sector Information-Sharing Consortia

1. Why This Topic Matters for the CAMS Exam

Money launderers and terrorist financiers deliberately spread their activity across many institutions so that no single bank, broker, money services business, or fintech ever sees the full picture. Each institution sees one fragment of a transaction chain and, on its own, that fragment often looks innocent. Private-sector information sharing exists to defeat this fragmentation. When institutions can lawfully compare notes, the hidden network becomes visible, suspicious activity reports (SARs/STRs) become richer and more actionable, and false positives fall because institutions can confirm that a customer or counterparty is legitimate.

For the CAMS exam, this subject sits inside the domain covering regulatory regimes, risk assessments, and collaboration. ACAMS treats collaboration as a core professional competency, not an optional extra. The FATF, the Wolfsberg Group, the Egmont Group, and national regulators such as FinCEN, the UK National Crime Agency, AUSTRAC, and the Monetary Authority of Singapore all emphasize that effective AML/CFT is a shared enterprise. Expect questions that test whether you understand (a) the legal basis that permits sharing, (b) the conditions and limits attached to that permission, (c) the difference between private-to-private, public-to-private, and FIU-to-FIU sharing, and (d) how a compliance officer should act in a scenario where sharing could help an investigation but could also breach confidentiality, tipping-off, or data-protection rules.

Candidates frequently lose marks here because they confuse adjacent concepts (for example, USA PATRIOT Act Section 314(a) versus 314(b), or the Egmont Group versus a private consortium) or because they assume that sharing is always permitted or always prohibited. The exam rewards nuance: sharing is permitted under defined conditions, for defined purposes, with defined protections.

2. What a Private-Sector Information-Sharing Consortium Is

A private-sector information-sharing consortium is a structured arrangement, formal or informal, through which two or more private financial institutions (and sometimes designated non-financial businesses and professions) exchange information about customers, transactions, typologies, or threats for the purpose of detecting, preventing, and reporting money laundering, terrorist financing, and related financial crime. The arrangement may be purely private (institution to institution) or may be a public-private partnership (PPP) in which law enforcement, the financial intelligence unit (FIU), and regulators participate alongside the private sector.

It helps to recognize the main models that appear in study materials and on the exam:

a) Bilateral or peer-to-peer sharing. Two institutions exchange information about a specific customer or transaction. The leading example is sharing under Section 314(b) of the USA PATRIOT Act, which permits financial institutions and associations of financial institutions, after notifying FinCEN, to share information with one another to identify and report activity that may involve money laundering or terrorist activity.

b) Intra-group sharing. Sharing within a single financial group across borders and legal entities. FATF Recommendation 18 requires group-wide AML/CFT programs, including policies for sharing information required for CDD and risk management, subject to confidentiality and data-protection safeguards. The exam may frame this as a prerequisite for enterprise-wide risk assessment.

c) Industry consortia and utilities. Multiple institutions pool resources: shared KYC utilities, shared typology libraries, fraud and mule-account databases, sanctions-screening collectives, and collaborative transaction-monitoring platforms. A frequently cited example is Transaction Monitoring Netherlands (TMNL), in which major Dutch banks collaborated to monitor transactions across institutions.

d) Public-private partnerships. Law enforcement or the FIU convenes private institutions to share strategic typologies and, in some cases, tactical intelligence on specific targets. Prominent examples include the UK Joint Money Laundering Intelligence Taskforce (JMLIT), hosted by the National Crime Agency since 2015; Australia's Fintel Alliance led by AUSTRAC (2017); Singapore's AML/CFT Industry Partnership (ACIP) and its COSMIC digital platform for bank-to-bank sharing of risk information; Hong Kong's FMLIT; Canada's Project Protect on human trafficking; and the Europol Financial Intelligence Public Private Partnership (EFIPPP).

e) Technology-enabled privacy-preserving sharing. Newer consortia use privacy-enhancing technologies such as homomorphic encryption, secure multi-party computation, federated learning, and pseudonymization so that institutions can detect overlapping risk without exposing raw personal data. The FATF's 2022 report on partnering in the fight against financial crime specifically addresses how data protection and information sharing can coexist through such technology.

What a consortium is NOT. It is not the Egmont Group, which is the network of FIUs (public bodies) sharing intelligence with each other. It is not Section 314(a), which is a one-directional request from law enforcement, via FinCEN, to financial institutions to search their records for named subjects. It is not a mechanism for sharing SARs themselves; SAR confidentiality rules remain intact. Understanding these boundaries is essential for the exam.

3. The Legal and Policy Framework

FATF standards. Recommendation 2 (national cooperation and coordination) encourages cooperation and, where appropriate, information exchange among competent authorities and with the private sector. Recommendation 18 governs group-wide programs and intra-group sharing. Recommendation 9 states that financial institution secrecy laws must not inhibit implementation of the FATF Recommendations. The FATF has issued guidance on private-sector information sharing (2017) and on data protection, technology and private-sector sharing (2022), stressing that sharing should be purpose-limited, proportionate, secure, and compliant with data-protection law.

United States: Section 314(b). The key features you must know:
- Participation is voluntary.
- An institution must file a notice with FinCEN (renewed annually) before sharing and must take reasonable steps to verify that the counterparty has also filed.
- Sharing is permitted for the purpose of identifying and, where appropriate, reporting activity that the institution suspects may involve possible terrorist activity or money laundering. FinCEN's 2020 fact sheet clarified that participants do not need to have conclusively determined that the activity is suspicious, do not need to identify a specific underlying specified unlawful activity, and may share information about attempted transactions.
- Participants receive a safe harbor from civil liability for sharing in compliance with the rule.
- Information received may be used only for the permitted purposes (identifying and reporting ML/TF, determining whether to establish or maintain an account or engage in a transaction, and assisting compliance with the BSA).
- Participants must maintain adequate security and confidentiality procedures.
- The rule does not permit disclosure of a SAR or of information that would reveal the existence of a SAR. Institutions may share the underlying facts and transaction information, but not the fact that a SAR was filed.
- Associations of financial institutions (for example, a consortium or an industry utility) may also register and act as a sharing platform.

United Kingdom. JMLIT operates under a legal gateway in the Crime and Courts Act 2013 and related provisions. The Criminal Finances Act 2017 introduced voluntary information-sharing provisions allowing regulated entities to share information where they have a suspicion of money laundering, with a view to submitting a joint or super SAR, and the Economic Crime and Corporate Transparency Act 2023 expanded the legal basis for business-to-business sharing with protection from certain civil liability.

European Union. The 2024 EU AML Regulation introduced an explicit legal basis for information-sharing partnerships among obliged entities, subject to supervisory oversight and GDPR safeguards. Prior to this, GDPR and national bank-secrecy rules were widely regarded as the main obstacles to private-to-private sharing in Europe.

Asia-Pacific. Singapore amended its Financial Services and Markets Act to enable COSMIC, which permits prescribed banks to share customer risk information when specified red flags are met, with legal protection for good-faith sharing. Australia's Fintel Alliance operates under AUSTRAC's legislative mandate.

Wolfsberg Group. The Wolfsberg Group has published statements supporting effective information sharing, emphasizing that it enables better risk management and more targeted reporting, and calling on governments to create clear legal gateways with liability protection.

4. How a Consortium Works in Practice

Step 1: Establish the legal gateway. Before any sharing, the compliance function identifies the precise statutory or regulatory provision that authorizes the exchange, documents the permitted purposes, and confirms the available safe harbor. In the US this means registering under 314(b); elsewhere it may mean joining a supervised partnership or executing a data-sharing agreement vetted by legal counsel and the data-protection officer.

Step 2: Verify counterparties. Institutions confirm that each counterparty is an eligible participant (for example, that the other institution has an active 314(b) notice on file). FinCEN provides a participant list to registered institutions for this purpose.

Step 3: Define what can be shared. Typical categories include customer identification details, account and transaction information, beneficial-ownership data, red flags and typologies, and the institution's assessment of risk. Prohibited categories include the existence or content of a SAR, information outside the permitted purpose, and in many jurisdictions information protected by legal privilege or specific secrecy statutes.

Step 4: Share through secure channels. Requests and responses pass through encrypted, access-controlled channels, often with templates that standardize the information and record the lawful basis for each request. In technology-enabled consortia, matching may occur on hashed or encrypted identifiers so that no participant sees another participant's raw data unless a match is confirmed.

Step 5: Use the information for permitted purposes only. The receiving institution uses the information to decide whether to file or enhance a SAR, whether to exit or restrict a relationship, or how to re-rate customer risk. Using the information for marketing, credit decisions unrelated to AML, or competitive advantage falls outside the gateway and forfeits the safe harbor.

Step 6: Protect against tipping-off. Participants must ensure that sharing does not alert the customer that they are under scrutiny. Communications are kept internal to compliance functions, and relationship managers are not informed beyond what is operationally necessary.

Step 7: Document and retain. Institutions keep records of each request, the legal basis, what was shared, with whom, when, and how the information was used. These records demonstrate compliance to regulators and support the safe harbor.

Step 8: Govern and oversee. The program is covered in policies and procedures, staff receive training, the activity is included in independent testing, and senior management and the board receive reporting on participation and outcomes. In PPPs, a steering group of public and private members typically sets priorities, agrees on typology projects, and reviews results.

5. Benefits and Challenges You Should Be Able to Articulate

Benefits:
- Reveals cross-institutional networks (mule accounts, layering chains, trade-based laundering) invisible to any single participant.
- Improves the quality, specificity, and timeliness of SARs, making them more useful to FIUs and law enforcement.
- Reduces false positives and unnecessary de-risking by allowing institutions to confirm legitimate activity.
- Supports better risk assessment at the enterprise and national level by surfacing emerging typologies.
- Allows resource pooling, lowering the cost of compliance technology and expertise.
- Strengthens public-private trust and aligns private monitoring with law-enforcement priorities.

Challenges:
- Data protection and privacy law (for example GDPR) may restrict the processing and transfer of personal data, particularly cross-border.
- Bank secrecy and customer-confidentiality laws in some jurisdictions prohibit disclosure without a clear statutory exception.
- SAR confidentiality and anti-tipping-off rules limit what can be revealed.
- Liability concerns: without a safe harbor, institutions fear civil claims from customers.
- Competition and antitrust sensitivities when competitors exchange customer information.
- Data quality and standardization problems reduce the value of pooled data.
- Unequal participation: smaller institutions may lack resources to join, creating gaps criminals can exploit.
- Cross-border divergence: a consortium legal in one jurisdiction may be unlawful in another, complicating global groups.

6. How to Answer Exam Questions on This Topic

CAMS questions are typically scenario-based and ask for the best or most appropriate action. Apply this reasoning sequence:

Step A: Identify the direction of the flow. Is information moving private-to-private (consortium, 314(b)), public-to-private (314(a), JMLIT alerts, FIU feedback), private-to-public (SAR filing), or FIU-to-FIU (Egmont)? Many wrong answers simply point to the wrong channel.

Step B: Identify the legal gateway and its conditions. Ask: Is the institution registered or otherwise authorized? Is the counterparty eligible? Is the purpose within scope (ML/TF detection and reporting)? If any condition is missing, sharing is not yet appropriate and the best answer usually involves satisfying the condition first (for example, filing the 314(b) notice or consulting legal and compliance).

Step C: Check the absolute limits. Never choose an answer that discloses a SAR, reveals that a SAR was filed, or tips off the customer. These limits override the benefits of sharing.

Step D: Prefer the answer that uses the information for its intended AML purpose. Correct answers typically involve enhancing the investigation, filing or amending a SAR, or re-rating risk, rather than terminating the relationship immediately without analysis or using the data commercially.

Step E: Choose the governance-consistent option. When answer choices differ in process, pick the one that involves documentation, secure channels, and escalation through compliance rather than informal communications by front-line staff.

Worked example 1. A compliance analyst at Bank A notices that a customer is receiving structured deposits that are immediately wired to an account at Bank B. The analyst believes Bank B's view of the receiving account would clarify whether the pattern is suspicious. Which action is most appropriate? Options: (1) Call a friend in Bank B's operations team and ask about the account; (2) Confirm that both banks have current 314(b) notices on file with FinCEN and then make a documented request through compliance; (3) Send Bank B a copy of the draft SAR for comment; (4) Close the account immediately. The best answer is (2). Option (1) lacks the legal gateway and secure process; option (3) violates SAR confidentiality; option (4) is premature and forfeits intelligence.

Worked example 2. A European bank wishes to join a multi-bank transaction-monitoring utility. The primary legal obstacle it must address is most likely: (1) Lack of FATF recognition; (2) Data-protection and bank-secrecy constraints on processing and sharing customer data; (3) Egmont Group membership requirements; (4) The requirement to file a 314(b) notice. The best answer is (2). Egmont and 314(b) are inapplicable to a European private utility, and FATF does not recognize individual consortia.

Worked example 3. Which statement about Section 314(b) is correct? (1) Participation is mandatory for all US depository institutions; (2) Institutions may share SARs with other participants; (3) Participants must notify FinCEN and may share information to identify and report suspected money laundering or terrorist activity under a safe harbor; (4) It allows law enforcement to request record searches from financial institutions. The correct answer is (3). Option (4) describes 314(a).

7. Exam Tips: Answering Questions on Private-Sector Information-Sharing Consortia

Tip 1: Memorize the 314(a) versus 314(b) distinction cold. 314(a) = government-to-private, mandatory response to FinCEN requests, search of records for named subjects. 314(b) = private-to-private, voluntary, requires notice to FinCEN, safe harbor, purpose-limited. This single distinction is among the most tested points in the topic.

Tip 2: SAR confidentiality always wins. If an answer choice involves sharing a SAR or disclosing that one was filed with another institution, eliminate it immediately, even if the other institution is a trusted consortium partner. Underlying transactional facts may be shared under a lawful gateway; the SAR itself may not.

Tip 3: Look for the words voluntary, safe harbor, notice, and purpose. These are the signature features of lawful private sharing regimes. An answer that treats sharing as mandatory, unconditional, or usable for any business purpose is wrong.

Tip 4: Distinguish public-sector networks from private consortia. Egmont Group = FIUs. FATF = standard setter, not a sharing platform. Wolfsberg Group = private banks issuing guidance, not a data-sharing utility. JMLIT, Fintel Alliance, ACIP, EFIPPP = public-private partnerships. TMNL, COSMIC, KYC utilities = private or regulated private sharing platforms.

Tip 5: Recognize intra-group sharing as a FATF Recommendation 18 requirement. If a question asks about sharing within a banking group across borders for CDD and risk-management purposes, the anchor is group-wide programs under Recommendation 18, with data-protection safeguards.

Tip 6: When in doubt, escalate through compliance and legal. Scenario questions reward answers that involve the compliance function, legal counsel, or the data-protection officer before sharing, and penalize informal or front-line communications.

Tip 7: Connect sharing to risk assessment. The exam places this topic alongside risk assessments and regulatory regimes. Be ready to explain that consortium intelligence feeds the institution's enterprise-wide risk assessment, customer risk rating, and typology-driven monitoring scenarios.

Tip 8: Know the benefit-challenge pairs. If asked for the principal benefit, think visibility of networks and better SARs. If asked for the principal obstacle, think data protection, bank secrecy, and liability. If asked for the policy solution, think clear legal gateways, safe harbors, and privacy-enhancing technology.

Tip 9: Beware of absolute language. Answers stating that institutions can never share customer information, or can always share once registered, are usually distractors. The correct framing is conditional and purpose-limited.

Tip 10: Read for the best answer, not merely a correct one. Several choices may be defensible; the examiner wants the option that is lawful, purpose-aligned, secure, documented, and most effective at advancing AML/CFT objectives.

8. Quick Revision Summary

- Purpose: break information silos so institutions can see cross-institution laundering networks and file better SARs.
- Forms: bilateral (314(b)), intra-group (FATF Rec 18), industry utilities (TMNL, KYC utilities), public-private partnerships (JMLIT, Fintel Alliance, ACIP/COSMIC, EFIPPP), technology-enabled privacy-preserving platforms.
- Legal essentials: voluntary participation, legal gateway, notice or registration, counterparty verification, purpose limitation, safe harbor, security and confidentiality, no SAR disclosure, no tipping-off, documentation.
- Standards and guidance: FATF Recommendations 2, 9, 18 and FATF 2017 and 2022 guidance; Wolfsberg statements; FinCEN 314(b) fact sheet (2020); EU AML Regulation partnership provisions; UK Criminal Finances Act 2017 and Economic Crime and Corporate Transparency Act 2023.
- Key distinctions: 314(a) versus 314(b); Egmont (FIUs) versus private consortia; sharing facts versus sharing SARs.
- Exam approach: identify the flow, confirm the gateway and conditions, respect absolute limits, choose the AML-purpose and governance-consistent answer.

Master these points and you will be well prepared for any CAMS question on private-sector information-sharing consortia, whether it tests definitions, legal conditions, international examples, or judgment in a realistic compliance scenario.