Intelligence sharing for AML: a practical guide

Foreword

The shift from optional to expected

Taavi Tamkivi Co-founder & CEO, Salv

Anyone reading this will know that financial crime moves faster than the controls most teams have in place to catch it. Most fincrime teams still work in silos. Not by choice. Because collaboration is operationally and technically complex, and most of us are stretched thin already. We built Salv Bridge to fix that.

We have been building cross-border intelligence sharing networks and stress-testing them against the regulatory standards they must meet. Today, Salv Bridge connects more than 100 financial institutions across the EU and UK, running live exchanges every day. In one market, the median fraud response time has dropped to 14 minutes. Across the same network, participating banks have prevented an estimated €3 million in customer losses.

The shift this guide covers, from optional collaboration to a structured supervisory expectation under the EU Anti-Money Laundering Regulation (AMLR) Article 75, is both operational and legal. The institutions reading it will need to act on both fronts. The direction of regulatory travel is clear. Regulators will ask: show us exactly how you share intelligence.

AMLR Article 75 is the legislative answer to a question many AML teams have been carrying for years: when can we share what we know with another obliged entity, and on what basis? The framework is clear in direction. It is, in places, still being clarified in practice, particularly on cross-border supervisory notification, on the precise contours of "strictly necessary", and on how tipping-off prohibition interacts with platform-mediated exchange.

Two practical points sit at the centre of this guidance. The first is that banking secrecy obligations in the EU markets are no longer the obstacle they were assumed to be: the statutory carve-outs that always existed are now squarely engaged by Article 75 once a partnership is properly constituted. The second is that anchoring the arrangement within an Article 75 partnership substantially strengthens the GDPR position. The processing remains under Article 6(1)(f) — Article 75 authorises partnership-based sharing but does not compel participation, so Article 6(1)(c) is not available — but the EU legislator's express recognition of the partnership framework does much of the heavy lifting on the necessity and balancing prongs of the legitimate-interests assessment that institutions otherwise carry alone.

This is the working document we use with the institutions joining Salv Bridge, formed over five years of operation. Where the rules are still evolving, we have flagged it. Where they are settled, we have said so plainly. For PSPs whose remit also covers fraud-specific obligations under PSR Article 83a, our companion guide treats that framework in the same depth. If you have questions, or want us to sense-check your approach, get in touch.

Executive summary

Points of attention for institutions, based on our experience

Section 03

What AMLR Article 75 actually establishes

Diana Karyan Legal Counsel, Salv

The AMLR, specifically Article 75, establishes the conditions under which obliged entities may share information within formal partnerships for the prevention, detection, and investigation of money laundering, its predicate offences (which include certain frauds), and terrorist financing. It sets out requirements around necessity, data minimisation, supervisory notification, and governance.

Supervisory expectations are hardening in parallel. Regulatory authorities in multiple EU jurisdictions have begun asking, in the course of routine AML examinations, whether institutions have implemented structured intelligence sharing arrangements. Institutions that cannot demonstrate a formalised, auditable sharing capability will find that position progressively harder to defend.

AMLR Article 75 and PSR Article 83a — complementary, not sequential

The AMLR sits alongside the EU Payment Services Regulation (PSR), specifically Article 83a, which addresses a different and narrower perimeter: mandatory participation in formalised fraud-specific intelligence sharing arrangements for PSPs. The two regimes are complementary rather than sequential — AMLR Article 75 authorises broader AML/CTF partnership sharing on a permissive basis; PSR Article 83a imposes a narrower fraud-specific duty.

At the European level, supervisors and policymakers are converging on a "hub and spoke" or "network of networks" model, with a European layer interlinking national or bank-consortia data sharing setups. Each existing and newly developed national or regional arrangement is expected to contribute to that landscape.

Section 04

Five guiding principles

Article 75 does not tell institutions how to share intelligence well. It tells them when they may do so, within what kind of partnership, and subject to what governance. These are the principles that make the difference between an arrangement that satisfies Article 75 in form and one that holds up under examination.

Section 05

When and why to collaborate

Financial crime is not contained within a single institution. Organised criminal networks move funds across banks, EMIs, PSPs, and CASPs before any one institution can respond. No single institution has the full picture from its own transaction data alone. AMLR Article 75 provides the operative framework for obliged entities to address this through formalised sharing arrangements. Structured intelligence sharing allows institutions to confirm or rule out suspicions faster, identify cross-institution patterns, and act before funds are moved beyond recovery. The obstacles today are no longer legal or technical — they are governance-related.

Why intelligence sharing is best organised at consortium level

Consortium-based approaches — motivated by a bank regulator, central bank or bank association, and operated by appropriate multi-bank, joint-venture or similar setups — provide structural governance advantages that bilateral arrangements cannot replicate: network effects that increase detection value with each additional participant; standardisation of data formats and definitions; legal efficiency through shared DPIAs and partnership agreements that substantially reduce the compliance lift on each individual participant; and cost efficiency through shared infrastructure. An institution that participates in a consortium-level arrangement — with its DPIA, partnership agreement, and supervisory notification all in order — is in a materially stronger position under regulatory examination than one relying on a series of bilateral arrangements stitched together.

Patterns that will not meet supervisory expectations

• Bulk data sharing — sharing large datasets without linkage to specific cases or articulated suspicion. Directly inconsistent with the strict-necessity standard and GDPR Article 5(1)(c).
• No audit trail — insufficient documentation of what was shared, when, by whom, and on what basis. Under Article 75, supervisors may commission independent audits.
• Informal collaboration channels — email-based intelligence exchange is not a compliant alternative. It is precisely the practice Article 75 is designed to replace.
• No clear suspicion threshold — the absence of defined criteria for what constitutes objectively justified suspicion is both a legal and an operational failure. Consortium-level agreement on a sufficient suspicion standard, documented in shared SOPs and consistently applied across participants, is what supervisors expect.