multi-bank fraud collaboration in Europe: beyond the rhetoric | Follow the Money #7

Barnabás Ferenczi is Head of Growth at Salv. Two months into the role, he’s been on the road across Europe—talking to banks, regulators, and bank associations about what intelligence sharing actually means on the ground.

In this conversation with Dr Nicola Harding on Follow the Money, Barnabás explains why the gap between claimed and actual intelligence sharing is where the real work sits, how one Central European country went from RFP to live in six months, and why actionable intelligence is fundamentally different from data sharing.

Nicola: So let’s dive straight in. You left G+D, which is this well-known global security technology company, to join Salv—a company you’d already been championing from inside. What did you see in Bridge that convinced you to bet your career on it?

Barnabás: I think the time has come that we move from individual defences to collective defences. The mission that inspired me was that we need to bring parties—the banks, and maybe after banks a broader set of parties—together to fight financial crime. Because fraud, money laundering, but especially fraud and scams, it became so bad that we need a new approach to fight it. This is a mission that sits in the background when I’m focusing on the business.

Nicola: I always find it interesting that when we talk about fraud and financial crime, we don’t look at cyber security, physical security, or fraud as separate silos. They come together. And intelligence sharing is crucial because we shouldn’t silo that information. It should flow to the right people at the right time. Is that a mindset you found coming from a security technology company into more specifically financial crime?

Barnabás: Absolutely. And it comes even earlier. Before G+D, I worked in a central bank in various roles. In the central bank you’re infused with a public policy mandate—you’re there to make your economy, your society, even using big words, better. Especially if you come from a region which is catching up, like Hungary and Central Europe. That mentality shaped how I became a young professional. At G+D I went into the thick of the payments industry. I worked on cash, on cards, on fraud trends and the work we supported and enabled to improve defences. The thinking that fraud and crime is a joint responsibility originates from that public sector mindset. It makes it easier for me to engage with central banks, with regulators, with bank associations—because they also have a public mandate. In payments, fraud and scams don’t respect organisational silos. They leverage the fact that organisations are silos. I remember discussions with very senior banking people where we set up an innovation sparing board. They said: sometimes at a bank, fraud information within the bank doesn’t come together because fraud is within product silos. There’s card-related fraud, credit transfer fraud, credit product fraud. That’s when I realised—my god, there’s so much to do to connect the dots and create a networked defence against a threat that was already a network.

Breaking down the infrastructure layer

Nicola: It’s astonishing how siloed organisations are. When you draw the org chart it makes sense, but working in practice it’s so difficult. In payments, the infrastructure itself—when a payment travels across a payment rail, there’s loads of things intersecting: cyber security, sanctioning, and more. That’s why it shocked me when working with Salv that this infrastructure layer around data sharing wasn’t there. But actually, the culture of sharing across infrastructure is embedded in the payment system. We just needed that layer. You’ve now spent the bulk of the last two months on the road. Paint a picture: who are you actually sitting across from in rooms, and what are they really asking?

Barnabás: I feel a bit like when you’re hungry and going to a hotel breakfast with everything on the table—you don’t know where to start first. There’s so much eagerness and appetite. Because fraud people and money laundering experts already know they have to talk to each other, even across banks and sometimes across borders. What they do out of necessity is they call each other, send encrypted emails, share lists and Excel files. Or they use very structured but very slow SWIFT messaging. They already reach out because they feel the pressure. When I’m talking to banking people, bank associations, central banks, multibank IT setups, we start by acknowledging the reality. To fight modern fraud and scams, banks already have collaboration. What we discuss is how to bring that collaboration to a structured, compliant, logged and fast working platform. So it doesn’t depend on whom you happen to know at the other bank and whether they’re on duty today. That conversation opens doors. Because what we’re talking about is not disruptive. The idea that fraud people contact each other is normal. They’re just looking for a way to do it more effectively and more compliantly.

Where the conversations are progressing

Nicola: I’m interested in where in Europe the most serious discussions are happening, and where you’re pointing them toward.

Barnabás: The good news is it resonates across Europe everywhere, and even beyond. I just had a conversation with a global multiplicator organisation about Central Asia and other markets where fraud and scams are a real issue. But it resonates differently depending on the starting situation. Some markets already have strong multi-bank collaboration culture—not just culture but a track record with various multibank setups. Spain, Belgium. Countries with very strong central regulators who take a mandate operationally—like my old country, Hungary, or Romania. In these countries, driven by either multibank setups or a central regulator, there’s already movement in the multibank collaborative fighting space. Central risk indicators, risk scoring systems are set up by the banks. There’s already a start of suspicious IBAN sharing initiatives. In those situations, we acknowledge the multibank initiative and look at how to connect them to other markets. We’re the only platform in Europe working cross-border at PII data level—personal identifiable data. So we can bring international connections to the multibank setups already championing the case within country. Or the risk scoring is doing its job for transaction monitoring. We can complement it with joint screening of suspicious persons in KYC situations—a preventive step. Or we help with joint investigations between banks after transactions, not yet covered by multibank risk scoring. We’re flexible working around existing setups. On other markets, they’re not yet there because regulators are more hands-off or leading analytically not operationally, or multibank joint setups don’t exist. There we almost create or nudge the demand. The eagerness is there, but we bring the knowledge: here’s how it’s possible based on our five years’ experience, at low complexity and reasonable cost. In these countries—still the majority around Europe—this opens the eyes. And it sometimes takes a longer journey. But, for example, if a Bank Association is convinced, we see in one concrete Central European country—which I still can’t name—they did their own market research, RFI, RFP process to select the infrastructure. They want to bring them to this multibank fraud joint investigation use case within six months. We are proud to be the selected infrastructure. Within the next few months we’re going to implement that infrastructure and they’re able to go live within the next few months. This shows that if there’s a strong central player bringing banks together—at least the first five banks or so—and they start, it’s possible to go live after selecting the platform pretty fast.

Nicola: Speed is the essence here. Getting programmes running—in some markets we’ve talked about this forever but very little action happened. Lots of roundtables and sandwiches. To hear you’re going from RFP selection to full implementation in six months—that’s a huge feat and not to be underestimated.

Barnabás: What really helps is one good central coordination actor. And the other thing is we designed our infrastructure in a low-friction entry way. You can start working in a semi-manual way, so your IT department doesn’t have to start a big project that needs prioritisation and takes ages. You might not be number one priority. You can start in a no-frills way. We can onboard the bank within a good week or so. Then once your IT department is able to prioritise your project, you can automate the whole thing via APIs. Then of course you have to do a bit more work, but that’s step two. You already see the benefits of why to do that after step one.

The difference between data sharing and actionable intelligence

Nicola: It’s astounding how much Salv knows what they’re doing. In your estimation, where’s the gap widest between how an organisation describes its intelligence sharing capability now and what’s actually running underneath?

Barnabás: What surprised me in the last month is what everything “data sharing” can mean. Often the discussion starts with a bank manager or association manager telling me they’re already doing data sharing. Nothing to see here. Then we get into what exactly they’re doing, and I describe what banks on our infrastructure are actually doing. Then we realise: data sharing is not always data sharing enabling real action. Sometimes it’s an analytical exercise. In one country, the fact that banks get together once a month and look at the so-called modus operandi—scam and fraud patterns—is also data sharing. It’s based on shared information from the network. But it’s not enabling action at the level of a suspicious case or transaction. The difference is: sharing is always good, as long as it’s compliant. But collaborative intelligence is always good when it’s actionable—when it leads to one fraudster not being onboarded to the next bank after being offboarded from two others on the network. Or when a transaction with real money gets stopped or frozen at the right level, and the victim and banks and PSPs around them get their money back. We saw one bank realise a €176,000 recovery because they did their investigation between two banks within ten minutes. That was enough to freeze the funds and get the money back. We don’t know what’s inside—so it’s a very important design principle that we don’t see sensitive information. We see the traffic. It’s like I’m looking at the street from my window: I see cars moving left and right. I could count the cars, but I don’t know who’s inside, where they’re driving, or why. It’s similar. But it’s very encouraging that in one single case so much money can be recovered. This is not a unique experience. A few months ago there was a hundred thousand euro recovery. There’s real money involved in fraud and scam with real victims—private persons but also companies, especially smaller companies. The difference comes between data sharing for the purpose of getting more informed versus our type of intelligence sharing, which creates the basis of immediate action.

Nicola: It’s life-changing for some people. A hundred and seventy thousand euros could be someone’s life savings, their pension, their mortgage. We don’t often think about what happens to that €170,000 once it’s gone. A criminal has it. They might use it for terrorism, drugs, child exploitation. To hear you’ve stopped that in time and got it back—that’s amazing.

Barnabás: Or it could have bankrupted a small company.

The EBAday pitch

Nicola: Congratulations on the EBAday pitch. Tell me about distilling two months of market conversations into a five-minute pitch. What did you lead with and why?

Barnabás: It’s never easy to distil a company’s core mission in three to five minutes. But if you have a clear mission and experience you can share with the audience and jury, it becomes easier. What really helped was clarity. I led with acknowledging the problem about networked crime. Then acknowledging the reality: fraud and AML people are already talking. But we help that talking be infrastructure-based and structured. Then I acknowledged the challenge: what about GDPR? What about my IT department? What about my budget and costs? And I was able to explain how we help the organisation—a bank or bank association—overcome these hurdles. What resonated was when I explained concrete use cases like joint screening in KYC or quick joint investigation after transaction. People nodded in the audience—they got it. Then the fact that we’ve been doing this for five years, with 60,000+ sharing transactions on the platform and millions of euros recovered. That brought home the point that this is not a PowerPoint, but we’re talking about already operational activity. Then there was discussion. The jury had experienced business professionals, some with long history in payments, banking, or scaling enterprises. I actually enjoyed those questions. They were good discussion triggers. We even continued off stage about monetisation and cross-border, where we’re already playing.

Nicola: Did the judges’ questions give you any indication of where the industry’s headed right now?

Barnabás: I think there’s a lot of confusion because data sharing is kind of accepted as a good thing, but it means so many different things. People hear from more and more vendors—coming from generalist software, encryption technology, or fraud/AML sides—moving towards shared fighting of fraud. Customers and banks are confused about what’s possible, and not everybody’s clear about preconditions. Yeah, we can do shared things if you’re all on my tool. That’s different from open infrastructure where you can have any tool you want on your bank side, but use the sharing infrastructure for collective intelligence. The industry needs more transparency about what we’re actually proposing, more clarity on preconditions, more realism. We should focus on the business problem we want to solve, not get carried away by the sexiness of technology. This is not a technology problem. We have a business problem.

Nicola: That’s a really good point. This isn’t a technology problem, it’s a business problem. And we’re beyond silver-bullet thinking. You’ve also highlighted that some platforms say: use this, but you’ve also got to be a client of ours in another area. That’s a real tension for heads of fraud who have their own secret sauce—their unique combination of tools and approaches. What other objections or hesitations actually come up from the customer side, even at the point where you’ve proven it works, you’ve got strong case studies, it’s working right now?

Barnabás: Indeed, the classical three major obstacles that come up. First: how am I going to convince my data privacy officer that this is GDPR compliant? We come with a structured approach. We give advice on GDPR compliance, and we come with templates for data privacy impact assessments, for data processing agreements. A structured prepared approach. The good news is GDPR itself isn’t a problem. GDPR says fraud mitigation is a legitimate reason to process data. And GDPR says when you protect data, take appropriate measures—not maximum possible measures. That would be strange. We’re able to show that end-to-end encryption, the fact that even Salv doesn’t see what’s inside, the whole structure built in a privacy-protecting way—this fulfils the GDPR requirement for having the reason for data processing, having the right appropriate measures, and we take the design and governance structure very seriously with GDPR requirements for data minimisation, limited storage time, all these principles operationally. We operationalise GDPR compliance into the design. So we lead the partner—the bank or association—through that journey. We strongly recommend that nobody runs just with a simple question to a DPO: “Can I share data?” The answer is probably no. You come with a structured proposal: I’m proposing to share data for this purpose, this way, here’s my documentation, let’s talk. Then it becomes a productive, structured conversation about concrete points, less about the if. To other hurdles like: is it a big IT project which my IT department will prioritise maybe in three years? Is it costing me a lot? Do I have to fire people? All these hurdles can be mitigated because joining the infrastructure is a really low-friction step. The infrastructure already exists, so we’re not building it with the customer. And we intentionally designed access to be semi-manual, so you can start reaping benefits without big IT projects. And costs are absolutely reasonable. Thanks to more than a hundred institutions using the platform and five years’ history, we don’t have development costs if we stay at normal standard level. So it becomes a really interesting and inspiring conversation for both parties. It takes time, nevertheless, for a group of banks in a country to get their governance together, to get to the notion of doing it jointly, especially in countries with no existing precedents or multibank collaboration in this space. That’s where we can help. The heavy lifting is on the governance side. It has to be done by the banks or bank association.

Looking ahead

Nicola: Given everything you’ve seen over the last two months, how are you feeling about Bridge, about Salv, and about your decision to move from G+D? What does the future of Bridge look like?

Barnabás: The mission is fantastic. At the business level, we want to enable bank consortia, bank associations, groups of banks in more and more countries to leverage the infrastructure we’ve built. As mentioned, the next country—already in Central Europe—will go live soon. I’m looking forward to more such countries joining. At the same time, we’re helping existing bank customers increase benefits via higher automation levels. From semi-manual we’re accompanying them to an API-based way of working, which increases speed and reduces human work. And at one point, once collective intelligence creates a real good data environment, we’ll leverage AI-based agents taking over routine work. Our philosophy is collective intelligence first, artificial intelligence second. We’re already a prompt-first company, very AI native in how we work. That’s fascinating—how such a small team achieves so much because a lot of routine work can be done with AI support. At a personal level, my kids see the change. I’m fascinated by our vision. I’m moving around Europe talking to bank associations and banks. They really understand that behind all this is a mission. It still resonates—what they told me: “Papa, finally you do something that matters and we understand.” Those words I’ll never forget.

Nicola: I really love that. Thank you, Barnabás, and congratulations on the EBAday win. If there’s one thing to take from this, intelligence sharing is not a single thing you either have or don’t have. It’s a spectrum. The gap between what’s claimed and what’s genuinely running is where the real work sits. Knowing how to tell them apart might be the more valuable skill right now.

Barnabás Ferenczi was a guest on Follow the Money, Salv’s podcast on financial crime and compliance.