Public-Private Partnerships for Information Sharing

1. Why This Topic Matters

Money laundering and terrorist financing are network crimes. A single bank sees only the fragments of criminal activity that touch its own accounts, a law enforcement agency sees evidence from investigations but not the live flow of funds, and a Financial Intelligence Unit (FIU) sees suspicious activity reports (SARs/STRs) but often lacks the commercial context behind them. Each participant holds one piece of a puzzle that none of them can solve alone.

Public-Private Partnerships (PPPs) for information sharing were created to close this gap. Instead of the traditional one-way street, where financial institutions file reports into a government black box and rarely hear anything back, PPPs create structured, two-way channels in which government agencies and regulated private-sector entities exchange intelligence, typologies and, in some cases, specific subject information. Regulators and the FATF now regard effective information sharing as a hallmark of a mature AML/CFT regime, and the CAMS exam tests it within the domain Regulatory Regimes, Risk Assessments, and Collaboration.

For a CAMS candidate, this topic matters for three reasons:
• It demonstrates understanding of how the AML ecosystem functions beyond the four walls of a single institution.
• It connects to adjacent testable concepts: FIUs, the Egmont Group, FATF Recommendations, tipping-off prohibitions, data-privacy law, USA PATRIOT Act Section 314, and SAR confidentiality.
• It reflects the modern shift from a compliance-driven, tick-the-box model toward an intelligence-led, outcomes-focused approach to fighting financial crime.

2. What a Public-Private Partnership for Information Sharing Is

A PPP is a formal or semi-formal collaborative arrangement in which public authorities (FIUs, law enforcement, supervisors, prosecutors) and private-sector institutions (banks, money services businesses, fintechs, casinos, professional gatekeepers) agree to share information, analysis and expertise to detect, prevent and disrupt financial crime more effectively than either side could alone.

The FATF, in its 2017 guidance Private Sector Information Sharing and its 2022 report Partnering in the Fight Against Financial Crime, describes three broad categories of information sharing that candidates should be able to distinguish:

• Intra-group sharing – information flows between entities within the same financial group (e.g., a parent bank and its foreign branches and subsidiaries). FATF Recommendation 18 requires group-wide programs that include policies for sharing information needed for CDD and ML/TF risk management.
• Private-to-private sharing – sharing between unaffiliated institutions, for example under Section 314(b) of the USA PATRIOT Act in the United States, which gives participating institutions a safe harbor to exchange information about possible money laundering or terrorist financing.
• Public-private sharing – the true PPP model, in which government bodies and private institutions share information in both directions. This is the focus of this concept.

Within public-private partnerships, two levels of sharing are commonly recognised:

• Strategic (or thematic) sharing – Exchange of typologies, red flags, emerging threats, national risk assessment findings and priority areas. No personal data about specific customers is exchanged; the aim is to improve the private sector's ability to recognise risk. Example: law enforcement briefs banks on how trade-based money laundering or romance scams are currently structured.
• Tactical (or operational) sharing – Exchange of specific information about named subjects, accounts or networks, typically in support of a live investigation. This level is the most valuable but also the most legally sensitive, because it engages tipping-off rules, data protection law, bank secrecy and the confidentiality of SARs.

3. The Legal and Policy Foundations

Several international standards underpin PPPs:

• FATF Recommendation 2 (National Cooperation and Coordination) – Amended in 2018 to require that countries have cooperation and coordination mechanisms that are, where appropriate, compatible with data-protection and privacy rules, and explicitly recognising the role of information exchange between competent authorities and the private sector.
• FATF Recommendation 29 (Financial Intelligence Units) – FIUs should be able to obtain additional information from reporting entities and should provide feedback to them.
• FATF Recommendation 34 (Guidance and Feedback) – Competent authorities should provide guidelines and feedback to assist financial institutions in applying AML/CFT measures, especially in detecting and reporting suspicious transactions.
• FATF Recommendation 18 – Group-wide information sharing.
• Egmont Group – Promotes FIU-to-FIU cooperation and has published principles on information exchange; many PPPs are hosted or chaired by the national FIU.
• Wolfsberg Group – Industry body of global banks that has issued statements supporting effective information sharing and calling for legal safe harbors.
• FATF Private Sector Consultative Forum – Ongoing dialogue between the FATF and industry.

Domestic enabling laws are critical because, without them, institutions risk breaching bank secrecy, tipping-off provisions or data-privacy laws (such as the EU GDPR). Effective PPPs are therefore built on legal gateways: statutory provisions or memoranda of understanding that clearly authorise the sharing, define its scope, and protect participants who share in good faith.

4. How a PPP Works in Practice

Although structures differ by jurisdiction, most PPPs follow a similar operating model:

Step 1 – Governance and membership. A steering group is established, usually chaired by the FIU, a law enforcement agency or a supervisor, with membership from major reporting institutions. Terms of reference set out purpose, confidentiality obligations, legal basis and decision-making.

Step 2 – Priority setting. Participants agree on threat priorities, often aligned with the National Risk Assessment (NRA): for example, human trafficking, drug-trafficking proceeds, corruption and politically exposed persons, fraud against vulnerable persons, terrorist financing, sanctions evasion or trade-based laundering.

Step 3 – Strategic sharing cycle. Public agencies share declassified typologies, indicators and alerts; private-sector members contribute observed patterns and suggest new red flags. Outputs are often published as alerts, advisories or joint typology reports, which institutions use to tune transaction-monitoring scenarios and train staff.

Step 4 – Tactical cells. Where legally permitted, vetted staff from banks sit alongside investigators in an operational cell. Law enforcement shares the names of subjects under investigation; banks search their records and report relevant activity (usually through the SAR/STR mechanism so that confidentiality protections apply). This accelerates investigations and produces higher-quality, intelligence-led reporting.

Step 5 – Feedback loop. Agencies tell institutions whether their SARs were useful, what happened to the intelligence and how reporting could be improved. This feedback is one of the biggest motivators for private-sector participation and is explicitly encouraged by FATF Recommendation 34.

Step 6 – Safeguards. Strict controls govern who may see shared data, how long it is retained, how it may be used (purpose limitation), and how customers are protected from unfair treatment. Participants may not use the information for commercial advantage, and must never disclose to a customer that they are the subject of an inquiry (tipping-off).

5. Key Real-World Examples You Should Recognise

• United Kingdom – JMLIT (Joint Money Laundering Intelligence Taskforce), 2015 – Often cited as the pioneering model. Hosted by the National Crime Agency, it brings together the NCA, HMRC, police forces, the FCA and major banks. It has both a strategic Expert Working Group layer and an operational tactical cell. Widely credited with contributing to arrests, account closures and asset restraints, and copied by many other countries.
• United States – FinCEN Exchange, 2017 – Voluntary PPP run by FinCEN convening law enforcement, FinCEN analysts and financial institutions to share information on priority threats. Operates alongside the mandatory Section 314(a) process (law enforcement requests that institutions search records for named subjects) and the voluntary Section 314(b) safe harbor for sharing between institutions. The Anti-Money Laundering Act of 2020 further formalised FinCEN Exchange and required FinCEN to provide more feedback to filers.
• Australia – Fintel Alliance, 2017 – Led by AUSTRAC, co-locates analysts from banks, remitters, gambling operators and government agencies; widely known for work on child exploitation, human trafficking and welfare fraud.
• Canada – Project Protect, 2016 – A FINTRAC-led initiative focused on human trafficking for sexual exploitation; a frequently cited example of a thematic PPP that generated a dramatic increase in targeted STRs.
• Hong Kong – FMLIT (Fraud and Money Laundering Intelligence Taskforce), 2017 – Hong Kong Police, HKMA and banks.
• Singapore – ACIP (AML/CFT Industry Partnership), 2017 – Co-chaired by the Monetary Authority of Singapore and the Commercial Affairs Department; produces best-practice papers on trade-based ML, misuse of legal persons and more. Singapore has also launched COSMIC, a digital platform for bank-to-bank sharing of risk information.
• Europe – EFIPPP (Europol Financial Intelligence Public Private Partnership), 2017 – A multilateral forum convened by Europol with banks, FIUs and law enforcement across EU member states.
• Netherlands – TMNL (Transaction Monitoring Netherlands) – Bank consortium for collective transaction monitoring, illustrating private-to-private collaboration supported by legislation.

You do not need every detail of each, but you should recognise the names, the host agency and the general purpose, and understand that JMLIT and FinCEN Exchange are the most likely to appear.

6. Benefits of PPPs

• Faster and more targeted detection of criminal networks that span multiple institutions.
• Higher-quality, intelligence-led SARs/STRs rather than defensive, high-volume filing.
• Better allocation of compliance resources toward genuine national priorities.
• Improved understanding of emerging typologies, which strengthens risk assessments and transaction-monitoring rules.
• Enhanced trust and feedback between regulators, law enforcement and industry.
• Measurable law-enforcement outcomes: arrests, asset freezes, account closures, disruption of trafficking and fraud networks.

7. Challenges and Limitations

• Legal barriers – bank secrecy, data protection (GDPR), tipping-off offences and SAR confidentiality can restrict what can lawfully be shared, particularly tactical information and cross-border data.
• Liability concerns – institutions fear civil claims or regulatory criticism if they share information that turns out to be wrong; hence the importance of safe harbors.
• Unequal participation – PPPs often include only the largest banks, leaving smaller institutions, MSBs and DNFBPs outside the circle, which criminals can exploit.
• Confidentiality and insider risk – shared intelligence could leak or be misused; vetting and access controls are essential.
• De-risking and fairness – customers named in a PPP inquiry may face account closure without due process; safeguards against unfair treatment are required.
• Measuring effectiveness – outcomes are hard to quantify, making it difficult to prove value to boards and legislators.
• Cross-border limits – most PPPs are domestic; international sharing still relies on FIU-to-FIU (Egmont) channels and mutual legal assistance.

8. How PPPs Connect to Other CAMS Concepts

• Risk-based approach – PPP typologies feed enterprise-wide risk assessments and help calibrate monitoring.
• FIU functions – receipt, analysis and dissemination of financial intelligence; PPPs enhance the dissemination and feedback function.
• SAR/STR process – PPP-driven intelligence typically results in SARs; the SAR remains the legally protected channel for reporting specifics.
• Tipping-off – participation never permits an institution to warn a customer; this is a classic exam distractor.
• International cooperation – PPPs complement, not replace, Egmont, MLATs and FATF-style regional body cooperation.
• Technology – privacy-enhancing technologies (encryption, federated analytics, secure platforms like COSMIC or TMNL) are increasingly used to allow sharing without exposing raw personal data.

9. Exam Tips: Answering Questions on Public-Private Partnerships for Information Sharing

Tip 1 – Know the purpose in one sentence. If a question asks for the primary objective of a PPP, the best answer will refer to improving the detection, prevention and disruption of financial crime through two-way exchange of information between government and the private sector. Distractors often focus on commercial benefits, reducing compliance costs, or avoiding regulatory penalties; these are secondary at best and usually wrong.

Tip 2 – Distinguish the three types of sharing. Be able to classify a scenario as intra-group (Recommendation 18), private-to-private (e.g., Section 314(b)), or public-private (e.g., JMLIT, FinCEN Exchange, Section 314(a)). Many questions hinge on exactly this distinction.

Tip 3 – Section 314(a) versus 314(b). 314(a) is a government-to-institution request mechanism, initiated by law enforcement through FinCEN, and compliance is mandatory for covered institutions. 314(b) is a voluntary institution-to-institution sharing safe harbor that requires registration with FinCEN and good-faith sharing solely for the purpose of identifying and reporting possible ML or TF. Mixing these up is one of the most common errors.

Tip 4 – Strategic versus tactical. If a scenario describes typologies, red flags and trend briefings with no customer names, it is strategic sharing. If it involves specific subjects and live investigations, it is tactical. Tactical sharing is where legal safeguards and tipping-off risks are greatest.

Tip 5 – Tipping-off is never allowed. Any answer option suggesting an institution may inform a customer that they are the subject of a PPP inquiry, or may decline to file a SAR because information was already shared with law enforcement in a PPP, is wrong. PPP participation supplements, but does not replace, statutory reporting obligations.

Tip 6 – Watch for the legal-basis theme. Questions often test the idea that effective PPPs require clear legal gateways, safe-harbor protections and compatibility with data protection and privacy law. FATF Recommendation 2 (national cooperation, amended 2018) is the standard most associated with this. Recommendation 34 is about guidance and feedback; Recommendation 29 is about FIUs.

Tip 7 – Recognise the flagship examples. JMLIT (UK, NCA-led, 2015, first of its kind), FinCEN Exchange (US, 2017), Fintel Alliance (Australia, AUSTRAC), Project Protect (Canada, human trafficking), ACIP (Singapore), FMLIT (Hong Kong), EFIPPP (Europol). Expect questions to describe a partnership and ask what it is called or which agency leads it.

Tip 8 – Think in terms of benefits and challenges. When a question asks for the greatest benefit, lean toward intelligence-led, higher-quality SARs and a collective view of criminal networks. When it asks for the main obstacle, lean toward legal restrictions such as data privacy, bank secrecy and tipping-off, or liability concerns absent a safe harbor.

Tip 9 – Pick the compliance officer's best action. Scenario questions frequently cast you as the compliance officer. The best action is usually: participate through authorised channels, verify the legal basis and confidentiality terms, restrict access to vetted staff, use shared typologies to enhance monitoring and training, and continue to file SARs where warranted. Avoid options involving informal sharing with peers at other banks without a legal gateway, sharing customer data for marketing or commercial purposes, or unilateral account closures based solely on an unverified name list.

Tip 10 – Eliminate absolutes. Options containing words like always, never, all institutions must or replaces the need for SAR filing are generally incorrect. PPPs are voluntary in most jurisdictions, membership is typically limited, and they complement rather than replace existing obligations.

Tip 11 – Connect to the risk-based approach. If an answer links PPP outputs (typologies, priorities, feedback) to updating the institution's risk assessment and monitoring scenarios, it reflects the FATF effectiveness mindset the exam rewards.

10. Quick-Reference Summary

• Definition: Structured two-way information exchange between public authorities and private institutions to combat ML/TF.
• Types of sharing: intra-group, private-to-private, public-private.
• Levels: strategic (typologies, no personal data) and tactical (specific subjects, live cases).
• Key standards: FATF R.2 (cooperation, 2018 amendment), R.18 (group sharing), R.29 (FIU), R.34 (feedback); FATF 2017 and 2022 guidance; Egmont Group; Wolfsberg statements.
• US mechanisms: Section 314(a) (mandatory, government-initiated), Section 314(b) (voluntary, institution-to-institution safe harbor), FinCEN Exchange (voluntary PPP).
• Flagship models: JMLIT, FinCEN Exchange, Fintel Alliance, Project Protect, ACIP, FMLIT, EFIPPP, TMNL.
• Benefits: better detection, intelligence-led SARs, focused resources, feedback, measurable disruption.
• Challenges: privacy and secrecy laws, tipping-off, liability, limited membership, confidentiality, cross-border limits, measuring results.
• Golden rules for the exam: PPPs supplement SAR obligations, never permit tipping-off, require a legal basis and safeguards, and aim at effectiveness rather than commercial gain.