In episode #9 of Follow the Money, Pallavi Kapale, Senior Financial Crime Officer (2LOD) at Bank of China, and Salv's Taavi Tamkivi describe a barrier to entry that has all but collapsed.

Inside financial institutions, though, the instinct runs the other way: we hesitate to share the very data that would stop it, and for good reason. Attackers collaborate freely; defenders hold back. The barrier to fighting back, both argue, isn't the law or a lack of technology — it's how confidently institutions use the rules and the data they already have.

Fraud has outgrown the department it started in

Fraud used to sit at the end of the process — a small team after KYC, working on a tick-box basis. That has changed. Fraud now accounts for around 45% of all financial crime in the UK, and, as Pallavi described, it has moved from an afterthought to a management-level strategy, backed by the UK fraud strategy and the FATF 2026–2028 Fraud Strategy.

The operating model has not caught up. Investigations, first-line fraud, and the beneficiary side still sit in separate boxes, each seeing only its own slice. Meanwhile the barrier to entry for criminals has collapsed. Fraud as a service and phishing as a service mean an ordinary criminal can now buy organised-crime capability at the click of a button. When the attackers are joined up and the defenders are not, the org chart is doing the fraudsters a favour.

Privacy is the new excuse, just like friction once was

The friction-versus-fraud debate has largely settled: healthy friction, in the right place, is accepted as useful. In its place a new blocker has appeared — privacy versus fraud — and it is being used the same way, as a reason not to act.

Most of the time, the privacy objection does not survive contact with the detail. To flag that a single transaction is probably fraudulent, a bank does not need to hand over a customer's whole KYC profile. "You don't even need to give the name of the customer," Taavi noted. "You just need to refer to a transaction ID, or the IBAN, maybe the amount." Some European data providers already treat an IBAN as shareable rather than sensitive; some banks still treat the same field as untouchable. The difference is interpretation, not law.

Pallavi made the point from lived experience. Before the pandemic she could call another bank about a mutual customer and ask a simple question — wages or benefits? — and start building a picture in two minutes. That was legal then. It is still legal now. What has changed is that the rules around it are clearer, with audit logging and four-eye checks. Those are extra steps, not a prohibition.

The infrastructure exists; the confidence is what's new

The rails for compliant, encrypted, real-time collaboration exist. They have run in several countries for years, embedded in banks' daily procedures. What has shifted recently is legal clarity. Estonia's law from 1 July now states plainly that banks should exchange fraud intelligence and can slow or suspend an instant payment when fraud is suspected — following similar moves in Norway and France, and ahead of the EU Payment Services Regulation. One medium-sized EU country ran its entire tender in three months.

That clarity matters because it converts uncertainty into confidence. When a fraud team knows a concrete action — slowing a payment to buy time — is explicitly permitted, it is far more willing to automate real-time sharing rather than treat each case as a manual, one-off risk.

So what?

The honest starting point is internal. Most institutions cannot yet give their own crime fighters real-time access to the data they already hold, let alone data from the banks around them. Fix that first, and treat privacy as a design question rather than a veto. Otherwise the work simply gets displaced — close a mule in one bank and it reopens down the road, or the money moves cross-border, out of view. The collective network Pallavi predicted is no longer a someday idea. It is under construction, and the institutions that move now are the ones deciding to use the rules they already have.

Introduction

Nicola: Welcome to Follow the Money, brought to you by Salv. I'm Dr Nicola Harding, and today I'm hosting a conversation I'm really excited about, between Pallavi Kapale and Salv's CEO, Taavi Tamkivi. It comes about because every year Salv publishes the FinCrime Time Machine, which reflects on what's been happening and brings us forward with predictions of what we're likely to see. Pallavi has been a repeat contributor, and she gave us one of the boldest predictions in the whole paper: that beating fraud isn't a technology problem first, it's an organisational chart problem, and that the endgame is a collective, encrypted network of institutions sharing what they see in real time through machine learning. Today we find out what's actually happened since, and we hear from Taavi on how Salv has been building the very thing Pallavi described, and how it's launching across Europe. So we've got the prediction and the build, side by side. Welcome, both, and thank you for being here.

Taavi: Thank you.

Pallavi: Thank you, Nicola.

Nicola: Let's start with the predictions themselves. Pallavi, how much of what you described has actually happened? Were you too optimistic, or not optimistic enough? What's been happening in the world of financial crime as you see it?

Pallavi: Thank you again for having me — I always enjoy our conversations. You could call them bold predictions, but I've seen a lot of proof of them in the industry now, and I'm quite optimistic about the change. Take fraud becoming a strategic priority. That has been visible at conference after conference: the topic now is how fraud is dealt with at management level. When I started working in fraud, it was a tick-box, prevention-first approach — you saved the customer from falling victim, and the job was done. But fraud now sits at around 45% of all financial crime in the UK. Rather than saying the banks are going wrong, I'd say the criminals have got faster, and as banks it's our job to protect those customers and keep the bad actors out. Look at the fraud strategy released this year. Yesterday I attended the FATF 2026–2028 Fraud Strategy session, which talks much more about cross-border collaboration. When I started, fraud came after KYC — a small department within financial crime. On the AML side we always looked at the transaction, the proceeds of crime, and worked back from there. Now the industry is working backwards into fraud, and there's a lot of positive publication coming out on it. At the FCA conference I attended last month, there were clear calls to bring the social media companies into scope, because it's the banks bearing the brunt of the losses. So I'm optimistic. I can't say it will all happen in the next six months, but the direction is positive. It's slow, but we're getting somewhere.

What SARs reform changed inside the bank

Nicola: In terms of the regulatory reshaping you flagged — SARs reform, digital ID, Companies House, the Economic Crime Plan 2 — and your position at Bank of China, how have you seen that play out operationally inside the bank over the last twelve months?

Pallavi: SARs is a good one, because I write a lot of suspicious activity reports and I love writing them — the typologies, the linking, the controls. The threshold is now around £3,000, which lets the NCA focus on much higher-quality reports. Instead of volume, they're getting quality. I'm not saying anything below £3,000 isn't suspicious, but the bank now has the authority to exit those customers below the threshold. The other improvement is with law enforcement. It used to be routed from the NCA onwards; now the NCA can send SARs directly to law enforcement, and they're using a lot of AI to make that connection. So after the £3,000 revision, a lot of noise has been reduced and more quality SARs are going into the system. When I started, the threshold was only £250 — imagine how many SARs the NCA must have received every day. Now they can focus on predicate crimes and the more interesting reports. The next development is on victim SARs. It used to be that both the beneficiary bank and the victim's bank logged the same SAR on the same customer. That noise has been cut: the victim's SAR is now reported by the bank where the funds went through — the beneficiary bank. Because all of this has been reduced, operationally the investigators get more time for complex cases and can use that time wisely. On information sharing and the Economic Crime Plan 2, the call for evidence raised a lot of objections, because you can't just email another bank directly. There needs to be a proper process, a proper contact person: if I send this to a third-party bank, will it be protected? Is it fine under GDPR? Is my legal team happy for me to send this information to another third party? I'm very optimistic here, because information sharing is something I care about and would love to do, and the banks are taking steps. It's a bit slow, but we're getting somewhere. On Companies House — it's a big playground for fraudsters, and criminals find cracks all the time. You get cases where a customer opens an account at an address that already has 50 other customers registered to it; we'll leave it to the KYC team to figure out how to pull those together at onboarding. Even with the new ID verification at Companies House, I've come across cases where customers use a specific bank branch address and still manage to set up companies against it. So those examples still exist, and the gaps are still there.

Building the rails for real-time information sharing

Nicola: What's so interesting is that one of the main problems is a lot of talk and slow movement. You go to conferences, events, round tables, and you see movement, but it's creeping forward slowly. For me, the only way we really embed information sharing and the changes that are needed is through infrastructure. Taavi, can you give us an update on where you're building that infrastructure with Bridge? Because it's no longer just about banks talking to banks — it's these public-private partnerships that have thought it through legally, worked out what they can and can't do, and created the infrastructure to let it happen in real time.

Taavi: The infrastructure, or rails, for information exchange has existed in some countries for many years, so it isn't new in itself. We've been serving multiple countries in a fully compliant, encrypted way. As Pallavi mentioned, old-school emails — or in some countries encrypted emails — sort of work too, but they're not convenient, not scalable, not operational, and the auditability is poor. Some of this has run over Swift messaging for a long time as well, so proper technology is available: properly embedded into banks' daily procedures, integratable with internal tools to cut the manual jumping between systems, and able to automate some messages. On the infrastructure side, that's already business as usual in many countries. What's more interesting with the recent changes is what type of information is being exchanged and the additional value it brings. On one side, more countries — especially under EU regulation, usually via national banking associations — are taking the initiative to find proper infrastructure for their banks and to accelerate data exchange. We had one really exciting story with a medium-sized EU country that launched its tender in February and took just three months to run the whole selection and decide, at the end of May, that we'd won. That three-month cycle is a huge record. Other countries are moving more slowly, but the requirements are pretty similar. On the other side, regulators are trying to support their banks. There's a lot of talk about the PSR — the Payment Services Regulation — and Article 83, and a cross-European solution. But before that, individual countries are already changing their laws to make things clearer, especially around fraud. We saw good changes earlier this year in Norway, then France, and now, from 1 July, in Estonia, where a new law states clearly that banks should exchange data and mutual RFIs about fraud cases, and that instant payments can be suspended or slowed in cases of fraud. Before that law, some banks were doing it and some weren't; it was uncertain whether they could. Now it's written down, so fraud teams know that if they share intelligence through the infrastructure, one concrete action available to them is slowing a payment to win more time. That makes them more confident to do automated, real-time data sharing. In the old days it was manual: one agent triggered an RFI over the Bridge system, and the other bank's operations team responded. Now, thanks to the legal changes, they can use the same infrastructure for automated messages, which increases volume and processing power — and they catch more fraud. Speed is improving massively, the countermeasures are getting better, and countries' ability to adopt new technology has improved enormously over the last six months.

Handing money to another bank with no way to warn them

Nicola: The speed is crucial, isn't it — and the scalability. The will is there, the legal precedent is there, and it's happening across multiple countries. Pallavi, you're at Bank of China, serving multiple jurisdictions. You're based in the UK, but you have the cross-border challenge, and some of the regions Taavi is describing will include your customers. How important is it that we get to a more global way of doing this information sharing, and what could it mean for a bank like yours?

Pallavi: I've worked in this industry a long time, and I have handed terrorist-financing funds to another bank without any information, and I feel really sad about that. We knew the funds were from terrorist financing, we'd received consent, but we had to move them on to another third-party bank with no information attached. I'd love to see that gap close. In my experience with the high-street banks, a lot is still siloed: you work in fraud investigations, so you only handle investigations; you don't see what's happening on the fraud first line, or on the beneficiary side. Your job is just this much, and no more. Those silos need to break down. We used to worry about organised crime groups; now we're giving organised-crime capabilities to ordinary criminals too. The barrier to entry for fraudsters is so low. It used to be people specialising in phone fraud or romance scams; now, with fraud as a service and phishing as a service, they can buy everything at the click of a button. Take contact centres — I started my career in a contact-centre role. It was a big achievement to catch one fraudster in a nine-to-five day, to stop one person accessing an account, and it made me so happy. But now you've got voice cloning calling in and actually pulling funds out. So the change needs to come to contact centres first, because that's where they're attacking. Criminals are innovative and agile, and they know how every high-street bank works. As banks, we need to break those silos too and say: we had a fraud loss here, an AML loss there, and this is how we join them up. A lot of high-street banks are moving towards that approach, but again, everything is very slow.

Nicola: The contact-centre point is crucial, because it's a place where you can gather so much intelligence if you have the structures to do something with it. A lot of my recent work is with contact centres and financial institutions on the role they play in gathering intelligence — with the victim. How do they intervene? There's real skill in that, and the data gathered there will be important for whatever investigation comes next. But that information has to go somewhere. We can't just rely on payment risk scores on the payment rail; we have to bring all of that intelligence together — the investigators, the emotional first responders in the contact centres dealing with victims, or people who may be victims and don't realise it yet — in a way that's useful and gets to the right people at the right time. Taavi, in terms of where Bridge is being used across Europe, and Pallavi's point about deepfakes, synthetic voices and fraud as a service — how are we seeing Bridge and the movement in Europe disrupt some of these networks? Is it posing a particular challenge for you, or is it something you can actively tackle?

Why fraudsters don't need deepfakes

Taavi: For me these are two parallel discussions that are only semi-correlated. On one side, the fraud business model — how fraudsters operate in decentralised organisations, using more modern technology — is definitely happening, and we need to be very aware of it. I'm glad to see new startups tackling these specific problems: companies building AI agents that play the victim in front of fraudsters to waste their time, or gather evidence and data points about fraudulent IBANs and entities to hand to the banks. So there are initiatives tackling the newer trends. At the same time, from my own perspective, the average level of crime-fighting capability is so low that fraudsters don't need any modern technology. They just need to be half a step, or one step, ahead. There doesn't need to be any deepfake involved. Of course they're innovators and they can use it, but it's cheaper and more efficient to use old-school methods, because crime fighters aren't doing the basic hygiene. One of the core parts of fraud fighting is getting more data in real time — and if you do, you can build all the wonderful engines to make fair decisions and investigate. But the repetitive problem is that institutions can't even use the raw data they gather internally. They first need to resolve how to give crime fighters access, in real time, to the data they already control. It gets even worse when you talk about real-time data from other institutions around them. As long as we haven't solved that, fraudsters can use very basic technology and still make money. And some of what we're doing as a broader community actually makes it worse. In the EU there's the eIDAS 2.0 programme — an e-identity or virtual identity for people — and crime fighters in many countries expect it to reduce fraud, because in theory it should be more certain to verify who's behind the screen. In real life it will increase fraud. In countries where e-identity has been used for a long time, fraudsters find it very easy to take over someone's whole virtual identity, log into banks, take loans in their name and do everything else. E-identity is very good and useful for end users and consumers, but the quiet assumption that it will make crime fighters' lives easier is wrong — it will make their lives much harder, and make things easier for criminals.

Nicola: Such a good point — both points, but the e-identity one especially. It's not just Europe; I work a lot in the UAE, where different jurisdictions have similar e-identities, and it creates a culture of "nobody can pretend to be us, because we all have our unique ID." It's very government-backed, and it creates a false sense of security — it must be true. But as you say, when a criminal gets hold of that, there are no checks later on, because you're not going to ask them to validate their identity a different way. You've already done it. So when it's compromised, it becomes an even bigger problem.

Privacy is becoming the new excuse

Nicola: I'm going to ask a bit of a wild-card question. About five years ago we talked a lot about friction versus fraud. The customer-experience people wanted everything frictionless — fast onboarding, fast payments, slick and quick — and that created a big problem for fraud and financial crime. We've since come round to the idea that some healthy friction, in the right place, makes people stop and think. So that argument has more or less gone away. What I see emerging now is privacy versus fraud. Privacy is used as a reason not to share data — GDPR, and so on — and we've unpicked that on other episodes to show it's simply not true. Another example: this week WhatsApp announced it will move from phone numbers to usernames, which is privacy by design — you don't necessarily want to give out your phone number. But in prioritising privacy, what do you think the knock-on effect for financial crime is?

Pallavi: It's going to create a bit of chaos. Whatever we do, we seem to be giving rise to more financial crime and more potential fraud victims. Friction versus fraud was still manageable — you knew it was the customer, they'd logged into their account, and you could ask, "Are you sure you want to make this payment?" With privacy, the controls have to change. They need to be designed around what information the customer is actually going to disclose. Again, the industry needs a proper process, and the regulator needs to step in and say, "This is what we're seeing, so let's start doing something about it." But it will all be slow. Mules are across every bank in the UK. If I close a mule down in my own bank, that person can open an account in another bank ten or twenty minutes down the road. So cross-bank and cross-border detection needs to step in, and something concrete needs to come in, because we're giving rise to more and more victims. It's not good when victims lose so much money and the industry can't do anything. There are cases where victims have lost huge sums, but the thing that stays with them for so long is the guilt they carry, even if the bank has reimbursed them. That needs looking into. It makes me really sad that we reimburse them, but at the end of the day it stays in their mind for a long time.

Nicola: Absolutely — the harm is always more than financial. Especially when we're dealing with numbers: going back to your point about SARs, under £3,000 you now don't need to produce one. Thirty thousand pounds to a large business may not feel like a lot, and may not carry the emotional harm, whereas £300 to someone who hasn't got that to lose can be life-changing and devastating, with much longer ramifications — particularly if it was done in a controlling, coercive way. So you're absolutely right, Pallavi. Coming back to privacy versus fraud, Taavi — this is something you've had to really understand the legalities of, particularly around data sharing. Do you think there's a pushback on privacy in the current environment, and that it's affecting financial crime?

Taavi: When you brought up WhatsApp, it reminded me of my work 20 years ago at Skype, where I was head of the data science and fraud team. At Skype we had usernames, and everyone could choose — whether it was Taavi.Tamkivi or some random combination of letters. People were free to choose, and Skype covered the whole world, but I never thought I needed to know exactly who was behind an anonymous account. So I still wonder why WhatsApp needs phone numbers at all. On our current topic — privacy and GDPR are still used by many people as an excuse not to take serious action. It's more convenient not to dig into the detail of the GDPR requirements. I've seen so many misinterpretations of what you can and can't do, what is and isn't personal data. Take an IBAN — can we treat it as an anonymous username, and is it okay to share, with the banks around you, how old the IBAN is, or the average incoming and outgoing volume on it? Some European-wide data providers share this kind of information quite freely, which means that for them an IBAN isn't super-delicate PII. Yet some banks still treat it as something they can't share with anyone — because it's easier not to act if you use that excuse. Some companies say GDPR requires PII to be treated with the highest security standards available on the market. That's not true: if you read the regulation, it has to be secure, you shouldn't over-engineer it or make it overly complex, but of course it must meet your legal obligations. There's also ongoing learning about how wide the set of data points needs to be to hand over a really crucial signal. Some people think they'd have to transfer the whole KYC profile to another bank, which sounds crazy — and it would be. But to give the signal that a single transaction is most likely fraudulent, you don't even need the customer's name. You just need to refer to a transaction ID, or the IBAN, maybe the amount — which is completely different from the whole KYC profile. If people won't get into that level of analysis — comparing AML regulations, fraud regulations and GDPR, and their own internal risk assessments — it's easy to say privacy matters more than fraud fighting, or vice versa, and that's not a constructive discussion at all. But I'm happy to see that, bank by bank and country by country, people are willing to dig in. The RFPs we see from banking associations are very mature about what they're asking technology providers for. They understand their members' data-processing rights and duties, and what's expected from providers. That maturity is spreading, and it makes it far easier to come up with constructive solutions.

Pallavi: I agree with a lot of Taavi's points on data sharing — it's been made into a major thing. Before the pandemic, before GDPR really kicked in, I was in a role where I could call up a third-party bank and say, "We have concerns about our customer — it's a mutual customer." Just simple questions, two minutes: is the customer funding the account with wages, or with benefits? The other person would say, "It's only benefits." Fine — that starts building a picture, rather than making it a big deal. We just wanted to know what had actually happened with a particular transaction. I've been in those roles: the funds have gone to that bank, so let's see — has the customer withdrawn them, or paid them to someone else? — and you could build a picture of the customer on your side. I'm really sad that it's all gone away, because we used to get the chance to speak to other banks. Keep it short and sweet — some small, minor piece of information can add a lot to your investigation.

Taavi: That's a really important point people should grasp. Compare the pre-pandemic data-protection layers: it was legal back then, and it's legal now. It's just that we now have clearer rules of the game, and people need to know how to use them. It's not about a lack of legislation, or overly controlling legislation. What's needed is more maturity in the responsible people's heads — to say, "Yes, I'm following it, I've been following it all along, but there are restrictions: audit logging, four-eye principles." There are extra steps, of course, but they don't mean you can't do what you were already doing years ago.

What the next twelve months hold

Nicola: It calls for strong leadership and transparency about what this actually looks like. That's one reason I like talking to you, Taavi, about what you've done in other jurisdictions — it offers a roadmap, and it reassures people. In a world with so much at risk in our roles, so much uncertainty around AI and regulation, so many changes at once, having strong leaders who know what they're talking about and give practical guidance is really helpful. So if you were writing your predictions on paper again today, what would you change, sharpen or add? Where do you think we're going over the next twelve months?

Pallavi: I'd love the social media companies to come under one umbrella. Almost every fraud and scam originates on social media, and that's why we struggle. As a bank, all I can see is that the customer has lost money — that's the whole story I get. I don't get to see whether the ad or post the customer responded to has been taken down. So it's high time the social media companies came under one banner and got this sorted. My other prediction is about AI — and this is the first podcast where I haven't mentioned it. AI is available to everyone, but the real differentiator won't be who has the best AI. It will be who has the best data, the best governance, the strongest collaboration, and the courage to redesign their financial-crime programmes around how criminals actually operate. Banks have gone digital — everything is digital — but financial crime is becoming more industrialised, and our response needs to evolve much more quickly.

Nicola: Absolutely. What about you, Taavi — what do you see over the next twelve months?

Taavi: It depends heavily on the region. Comparing the UK and the rest of Europe: in the UK, thanks to initiatives like Stop Scams and the Global Anti-Scam Alliance, and to FATF leadership, I think we'll see more collaboration between sectors — social media, as Pallavi said, but also telcos — and some success coming out of pilots and real-life work. Banks themselves moving fast into efficient crime fighting and cutting fraud losses significantly — that might take a bit longer. In the European Union, thanks to the Payment Services Regulation that's coming, more banks and associations are realising it's actually coming, with mandatory requirements, and the liability is being put on the banks — not on telcos yet, not on social media yet. So banks will find themselves under huge pressure to resolve it, which means they'll move faster on different initiatives — data sharing being part of it, but also the speed of actions. That's where I agree AI agents can help make faster decisions, but not only them: direct API integrations between systems will help too, because quite often these decisions are simple and programmable. They don't need broad context or dynamic decisioning, where agents are good — it's straightforward: if this happens, send a message there and suspend the payment. So there will be more technology providers helping to automate things, agentically or non-agentically, to increase the speed of these transactions and the controls over them.

Pallavi: I'd add one more point. After the PSR came into the UK, it only covers the UK jurisdiction. I can go and talk to another third-party bank about funds that are proceeds of crime — but fraudsters have found a gap by moving them into cross-border payments. So cross-border payment flows need to be streamlined. Look at which countries your customers are sending funds to, put those countries on your watch list or transaction-monitoring system, and start intervening in those payments and asking the customer questions. They've found a good crack: if it's a UK account it goes on the scanner, but if the funds travel internationally, they don't.

Nicola: Whenever we tighten a rule or regulation so we can't do something, we just get displacement — it sends the problem over there. The only way to truly tackle this is for the threshold to rise everywhere, with all the layers covered or overlapping. That's the constant problem. Predictions are easy to make and much harder to hold yourself to later, but you've both just done that — reflecting on where we've been and where we're going. If there's one thing to take from this conversation, it's that the collective network isn't a someday idea anymore. It's under construction. We're all part of it, piece by piece, and I'm sure we'll be back to check on it again. Thank you both so much for joining me on Follow the Money — we look forward to seeing you again soon.

Pallavi: Thank you, Nicola. Thank you, Taavi.

Nicola: Thank you.

Taavi: Thanks, both.

Scaling Confirmation of Payee: from 70 banks to 550

Nicola: Kate, before we get to the reimbursement rules themselves, can you give people a sense of scale? You took Confirmation of Payee from around 70 banks and PSPs to 550 in a single year. What does a jump like that actually take, and why did it matter for fraud prevention?

Kate: First, let me explain my role at that point. In 2022, 2023 and 2024 I was Chief Business Development Officer of Pay.UK, the payment scheme operator for all the non-card payment types in the UK. Part of that role was fraud prevention, and helping the participants of the schemes collaborate so we could get better fraud prevention wherever possible.

Confirmation of Payee was actually born six years ago, and it was first put in place for "fat fingers" — to stop misdirected payments, which was a large problem for banks. With real-time payments like Faster Payments, once you've sent the money, the person who's received it isn't obliged to give it back, even if they're not a fraudster.

That was the main reason for Confirmation of Payee initially. But we discovered it helped with several types of APP fraud too — for example, where someone had changed a bank account detail to impersonate somebody else, and people were sending money to them. The biggest thing it does is add another step to setting up a payment. It makes the consumer stop and think, and puts a bit of grit in the system. Most APP fraud happens when fraudsters put consumers under stress and ask them to act quickly, so a moment of friction at the point of setting up a new payee matters.

Taking it from 70 banks and PSPs to 550 mattered because although 70 covered 97% of Faster Payments volume, the remaining 3% — the long tail of smaller organisations — had less money to invest in fraud controls, both AML and onboarding. Ensuring there was a standard everyone followed meant every bank in the UK could say: when you set up a new payment, we'll do this check. It's become a hygiene factor. If you don't get the check, you notice something's wrong — people won't send money unless there's a check in the process.

What changed on the Monday after reimbursement went live

Nicola: We moved on from that check to the actual reimbursement rules changing at the end of 2024. It didn't go through uneventfully — there was pushback in the industry about potential unintended consequences. For anyone who only knows the headline: what actually changed the day it came in, and what was different for a bank on the Monday versus the Friday before?

Kate: This was a policy born out of the PSR — the Payment Systems Regulator. What they were trying to do was make sure everybody in the payment chain has skin in the game: the sending bank, and the receiving bank, which is often where the fraudster sits to disperse the money quickly. So the crux of the regulation was twofold — make sure both sides had liability, because that makes you act differently, and make sure victims were consistently reimbursed. In 2021, APP fraud in the UK hit £490 million, the first time non-card fraud exceeded card fraud.

Barnabás: And you already had instant payments at that time, right? In 2021?

Kate: Instant payments for 17 or 18 years in the UK — a long time. Starting at a policy level is fine, putting something down on paper is fine, but the practicality of putting it in place is far different. Pay.UK were given the challenge of turning those policy rules into the Faster Payments rules — the operational, practical rules to run a payment scheme. That was tricky for every participant.

The difference between the Friday and the Monday was significant, and the operational uplift was the hardest part. The policy had clarity: £85,000 is the limit that can be paid back, split 50-50 between sending and receiving bank. There are five days to solve the case — 35 if you stop the clock, but 35 is the absolute end game — and you can keep back up to £100 of every claim. Those were the key rules. But operationally: if I sit in a tiny bank, how do I know Bob from the fraud team at Barclays, his phone number, who I deal with, how we communicate quickly enough to deal with the case?

UK Finance, who represent most UK banks, already had a system for the voluntary scheme that existed before the regulation. Pay.UK also set up a communication and workflow system so every bank and PSP — even non-UK-Finance members — could use it. Participants had to pay for the build and for Pay.UK's new regulatory reporting regime. Even large organisations with big fraud teams had to retrain staff and rebuild internal workflows. Some of the bigger banks who were already in the voluntary scheme found it was sometimes a cost saving, because the receiving bank was now paying 50% back. But getting everybody to collaborate was probably the hardest thing to do — and Europe will be in exactly the same position. Definitely a learning from Pay.UK: get everybody looking at operational processes upfront, and get experts from the banks themselves to lead some of the workstreams, because they deal with it day in, day out.

The UK's head start on continental Europe

Barnabás: I wanted to express my admiration for what we're discussing here — UK and continental Europe. The UK story was always a few years ahead. Fast payments came, as you said Kate, more than probably 14 or 15 years before it became mandatory in the EU last October. Then fraud exploded in the UK, and Confirmation of Payee followed. It's the same story again and again — introducing fast payments without upping the defences, country by country. UK, but also Brazil, India, where it's used for all kinds of payments every day. Now Europe is facing the same situation as instant payments becomes more typical, whether retail or B2B. It's like building a very fast motorway without guardrails, and then trying to put them up after the fact.

Kate: There's one country that's actually learned the lesson — Payments Canada. I did some consulting for them last year. Their real-time rail isn't quite live yet, but as they were building it, they built in a version of Confirmation of Payee and real-time transaction monitoring at the centre from the start. The whole point of what we're discussing today is the benefit of data sharing — you can't understand the patterns unless you see the full picture, and then you can't stop more fraud.

Barnabás: And by the way, that's also a nice side effect of Confirmation of Payee in the UK — it created a kind of communication between the two parties of a transaction that wasn't there before. That's not the full scale of data-sharing-based joint action, but it's a step in the right direction: two banks having a system that checks both sides of the transaction.

Who absorbs the cost — and who doesn't

Nicola: Any regime like this is costly, and we often talk about the burden falling on payment providers — the 50-50 split — but the transformation needed within a bank or PSP is huge. Rather than telcos and social media platforms, where a lot of the fraud originates, how do you think the industry feels about financial services taking the weight of this problem?

Kate: Pretty angry, generally — and quite rightly. It's a hard problem, because not many countries are taking Meta to court, or bringing in strict regulation for the tech giants. That does need to change. In the UK, government is more involved now — there are ministers who look after fraud and financial crime, and more groups collaborating than ever before. There are more solutions looking at downstream signals from telcos and social media. I'm an optimist, but this will have to change, because fraudsters are very organised, global businesses. You're never going to get in front of them, but even to keep up, you need the knowledge and the signals — and those come from data shared carefully, because everyone worries about privacy. My vision was always: imagine if all the payment system operators globally linked up so fraud could be traced and stopped, because fraud doesn't stick to one jurisdiction.

Barnabás: That's very much in line with the EU's vision. The European Payments Council has a pragmatic view: let country-based information-sharing initiatives start or continue — some are already operational — and let Europe create an overarching layer that connects them without destroying what's already there. The global vision will take longer, but it's step by step. I wanted to ask you too, Kate, because you also advocate this should be cross-sectoral. There's a notion on the continental side that we start with banks, because they're so heavily and concretely regulated, and then broaden out. Do you follow that logic — should a country starting fresh begin with banks, then take on social platforms and others?

Kate: Yes. When it comes to the nitty-gritty of how that's structured, it gets hard, but there's definitely willingness to collaborate. We should learn from the card schemes — they have network-wide fraud detection capability globally, and they're good at making sure data doesn't leak. With any innovation, you should look at what's already there and apply it to a new use case.

Barnabás: Absolutely. I spent some years in card payments before joining the crime fighters, and you're right. A challenge is that instant payments in most countries is inherently a national, domestic initiative — in the EU you can call the Eurozone one domestic payment area. That's why we start with the same market or jurisdiction covered by instant payments, with the long-term vision that eventually there's not just cross-border within a market like the EU, but cross-regional too. One of the key corridors for that is EU-UK — and at Salv we're already operating UK-EU cross-border data sharing at PII level, which is valuable given how much of a payments innovation powerhouse the UK is, which brings its own risks. For the EU, the EU-UK corridor should be the priority once we've got our own act together.

Kate: There's a parallel — lots of global payment schemes are already setting up connections. Nexus in Asia, with Singapore, Malaysia and others joining their payment schemes so cross-border payments are cheaper and quicker. I can only see that growing across the globe. And it's exactly the same kind of connections you'd want from a financial crime and fraud perspective.

Reimbursement makes victims whole. It doesn't stop the harm.

Nicola: Starting with financial institutions means starting at the end of the problem. Before we move further upstream to data sharing, I want to spend a moment on reimbursement, because that became the big headline — the 50-50 split. It let us put a figure on the cost of fraud, without really examining the value of prevention. Reimbursement makes the victim whole — good — but it doesn't stop the fraud, and it still leaves money moving from the system into criminals' pockets. Given rules always create displacement — money mule accounts being one example — what did adaptation look like in practice? Was there a worry the rules had created their own workaround?

Kate: The biggest concern the UK industry had before the regulation went live was unintended consequences. If a consumer knows they'll get their money back, and someone down the pub says "send this money to me, tell your bank it's fraud, you'll get it back, and I'll give you 10% on top" — not everybody would do that, but there are people struggling financially for whom that looks like a victimless crime, because everyone thinks banks have the biggest pockets in the world. What people don't realise is the cost comes back to them — it's a cost to the country — and it's normally funding other, genuinely horrific crime. New types of fraud are always emerging; fraud adapts to whatever the easiest route to money is in the shortest time. So the rules and the policy aren't bulletproof — they're part of the solution, not the full solution.

What really stuck with me: we had Action Fraud, run by the police, come and speak to the team developing fraud tools at Pay.UK. They explained the calls they get from victims and the lasting mental health harm — for romance fraud, you feel doubly duped, you've lost your savings, but you also believed you were in love with someone real, and you feel massively stupid and heartbroken at the same time. Whatever can be done further up the chain to stop the crime happening in the first place is where we need to get to. What can be done at the point where cashing out happens, so banks can stop more fraud and let real payments through without unnecessary friction — but further up the chain there needs to be more activity too, for a better solution overall.

Nicola: It's a fully layered approach that's needed — including the cultural awareness point. We can learn from card payment providers and schemes, who face chargebacks at a similar or growing level, sometimes dubbed "friendly fraud" — culturally, "I haven't had a refund in a while, maybe I won't pay for that takeaway, I'll just say it was fraud." Less so in the UK, but an emerging problem, especially where it's made easy — in the US you can press a button in your banking app and get a chargeback done quickly. Wherever there's a will there's a way, and it's not just about what fraudsters might do, it's about what's culturally acceptable and what isn't. That spectrum runs right through to whether we reimburse victims or not.

Kate: There is, and there's an education piece for consumers — lots of organisations are doing that well. But even as a savvy person, some of the ways APP fraud is committed today, like deepfakes, would catch you out. If I got a phone call from my daughter — thinking it was her — saying "I've been in a car crash, I'm using someone else's phone, can you send me money, I'm stuck," I'd do it, because I'd be worried about her.

Barnabás: There's a scam for each of us, even for professionals. The EU is going to follow the reimbursement logic in a more constrained way, carved into the PSR from 2028 onwards. My assumption is that it will create a business case for investment in fincrime fighting — upping transaction monitoring, and for many countries, starting bank-to-bank, peer-to-peer data sharing and joint investigations for the first time. Do you already see that effect — beyond banks understandably complaining about the risk of reimbursement schemes — a wave of extra investment and attention to fraud mitigation?

The investment case, debanking risk, and collective intelligence

Kate: Yes — for the couple of years leading up to 2024 there was a lot of investment, because of the spike in fraud and the knowledge the regulation was coming. One challenge — and I see this now, working with a fintech — is making sure that when you're onboarding a customer you've got strong AML and fraud checks at the start, without discriminating against consumers who don't have six months of salary slips or an established financial footprint.

Barnabás: This is debanking.

Kate: Debanked people, yes. How do you balance that, so people can take part in a digital society — which everyone has to do to send and receive payments — without banking criminals? There's appetite to invest in different tools; the challenge is getting to the right people in an organisation to explain it. There's appetite not just for a one-off tool, but for something that learns and moves with the fraudsters, the way AI and machine learning do today, without needing heavy new integration every time.

Barnabás: That's a great example with onboarding and debanking risk, because if tools get smarter — not just more powerful — banks can use collective intelligence when assessing riskiness at onboarding. That's exactly one of the use cases we've run for years in our core North European market, where one bank can query whether a person being onboarded, or an existing customer under repeat due diligence, was already flagged by another bank as suspicious for money laundering or fraud — more than 200,000 queries so far. That's smart defence: it likely increases the chances of catching bad actors without increasing the debanking problem for certain socio-economic groups. Defences need to be not just more powerful — more AI, more of everything — but smarter, using collective intelligence.

Nicola: Particularly with data sharing, we tend to think of it only at the point of payment, but ongoing or dynamic KYC is a really good moment too — those routine checks that should be happening anyway, shared with potentially linked accounts at other banks. Being able to share that intelligence at a random KYC check is really valuable, because of account takeovers and other MOs. I've always advocated for switching things up — making checks as random as possible, which is difficult in a rules-based environment, but that's almost what you need to outstep the fraudsters. We can't quite get there, but where that randomness exists, sharing it is a valuable source.

Barnabás: Our own statistics confirm the need for that kind of smart, collective action in the markets where we run joint screening — it puts banks in a difficult position if they're fighting alone. That's a clear learning from the markets where Salv operates.

The 2024 proof of concept: 50% more fraud detected

Nicola: Kate, I wanted to ask about the 2024 proof of concept — seven UK banks, three fraud prevention vendors, 13 months of Faster Payments data analysed in a three-month window, with almost a 50% uplift in detection. What can we learn from that, and what still stands nearly two years later?

Kate: We were trying to prove the hypothesis that more data means more fraud found. Realistically we knew that was true — it's analytically the case — but you have to prove things. The hardest part was getting the data out of Vocalink, who operate the infrastructure behind Pay.UK, and safely to the vendors to test, under very strict rules the participating banks rightly wanted in place, because it's their customers' data. It did prove out: we used the data plus fraud flags the banks had applied, and the vendors ran their models and found around 50% more fraud than the banks' current systems had detected. It's a case that shows data sharing is needed to identify and stop more fraud.

The trouble with putting it into production was agreement on who could actually do that — what kind of company could all the UK's payment providers trust to hold that much data securely. Masking PII has moved on significantly since then — I think Salv has solutions in that space — but what we were asking at the time was whether every UK participant would jump into one system that shared data centrally with a fraud prevention provider, passing signals back to add accuracy on top of what banks already had. The banks weren't ready at that point. That's not to say it hasn't changed — there'll be a solution that works that way. Visa and Mastercard have some real-time payment solutions for the market, and there are other interesting solutions, but in the UK nothing has taken off for the majority yet. Everyone's buying their own.

Barnabás: In our experience, what helps solve that situation — where everyone agrees strategically but can't move operationally, because it's essentially a coordination problem, who connects all the players — is having an industry-level consortium builder or coordination agent. On the continental side it's often the bank association that brings banks together, maybe not all of them at first, but the ones responsible for the majority of transactions, with a mandate from member banks to embark on the journey and select a platform. Most importantly, they develop the playbook and the consortium-level governance together with the platform partner and the banks — because I don't see it as a technical challenge any more. The security layer, pseudo-anonymisation, these techniques have fulfilled GDPR's data privacy requirements for years, if — and only if — the governance layer is designed the right way. It works most effectively with central coordination — not bottom-up, and I wouldn't call it top-down either, but there's a governance structure around it. We work with a number of European bank associations this way, and most of our discussions are around governance: how to use a standard fraud typology, how to implement data minimisation and retention constraints so GDPR requirements are met. The technical implementation, after that, is relatively straightforward.

From "data swamp" to infrastructure

Nicola: I remember being in rooms, more than once, talking about data sharing and proofs of concept, where the term used was "data swamp" — not a very attractive term, the idea that all our data sits in a swamp people can just pull from. It sounds messy and disorganised.

Barnabás: And very likely not GDPR-conformant on the EU side.

Nicola: Exactly. I think that's the difference between how data sharing is talked about and imagined by the people in a position to make it happen. Terms like "data swamp" make it sound risky, something we don't want to do. But flip it and think about data sharing as infrastructure — that's how we secure things, with strong, robust frameworks, the way we think about critical infrastructure generally. "Data swamp" conjures an image; "infrastructure" means: how does it actually work? I think that's the shift I've seen over the last year or two — from "we just can't do this, it's dangerous, it's lurking in the shadows" to "okay, what does this actually look like." Barnabás, walk us through intelligence sharing and how it can minimise data, and where it can't. If we think of data sharing as infrastructure, and you can screen against real identifiers like IBANs — isn't an IBAN personal data? — how do you make sure that infrastructure is safe?

Barnabás: Honestly, I don't even like the phrase "data sharing," because what ultimately matters is the joint action that banks can take together, or in the relevant pair on two sides of a transaction — data empowers that joint action. What matters is being able to act at the speed the use case demands. For joint screening of persons — flagging someone as suspicious for money muling, say — you need to act within seconds if it's a digital onboarding process. For IBAN screening, you need to be within the time window of the instant payment transaction — milliseconds. For a joint investigation of a suspicious transaction, it shouldn't take more than minutes, because after half an hour or an hour, the likelihood the bad guy starts layering the money and moving it further out is much, much higher.

So we set up data sharing to enable exactly these kinds of joint actions — and in our experience it's possible even within the EU's strict privacy rules, if you set it up with the right governance structure. Rather than shying away from the GDPR discussion and building expensive, complicated technical solutions that make joint action harder — or impossible — our recommendation is to deal with the GDPR question, but deal with it the right way: privacy designed in, with a governance layer at the level of the consortium of banks that clarifies, concretely, how data minimisation is implemented in the operational use case. For example, we design the fraud typology and interfaces so only the data agreed for a specific fraud scenario is shared — no more, no less. That's GDPR compliance built in. And we pay attention to why fraud is a legitimate reason for data processing under GDPR — there's a suspicion behind the joint investigation that triggers the data sharing, which avoids the "data swamp" story that led to a regulatory catastrophe in the Netherlands, where TMNL's first-generation programme didn't get the governance structure right and had to be stopped. We've run data-sharing-based joint action, like in Latvia and other countries, for five years, and never had a single regulatory backlash, because we designed in privacy from the beginning, and had regulators involved from the beginning.

Kate: Which is a good way to do it — get the regulators in the camp.

What the EU should take from the UK's head start

Nicola: Kate, coming back to you: banks have to identify where funds went within five days, and the UK Finance fraud scheme is moving into Pay.UK so institutions can collaborate on cases. Is that collaboration infrastructure the real lesson for the EU — that reimbursement only works if you build the rails for banks to work together underneath it?

Kate: Definitely. I don't see how you can work significant volumes of cases unless you've got a tool that lets you quickly and easily identify who to speak to at another organisation, and pass information securely between organisations to work the fraud within the timescales. There has to be some form of directory and workflow capability. If you think about Verification of Payee — VOP — it's fundamentally a directory for Bank A to speak to Bank B when a customer sets up a payment. It's the same logic here. Whether it's regulatory- or rules-driven, there has to be a workflow that lets an operator at Bank A put the right information in to get a case moving quickly, and lets the operator at the other end understand what checks they need to do and what to give back. That's a key learning — something we probably underestimated in the UK, how hard it would be to do, how much it would cost, and how long it would take. We did manage to hit the timescales, which is why I've got so much grey hair now.

Nicola: I'll ask you both for one thought on the future. Kate, if you could tell the people who designed the UK scheme one thing before they started, what would it be?

Kate: The policy is fine, and the outcomes regulators want to deliver are fine. But unless you bring the operational impact to the front — what it will mean for everyone who has to adhere to the policy — everything ends up back-ended, difficult and problematic. Get experts from a selection of the affected organisations to help you with that work, because they know what it means day to day.

Nicola: And Barnabás — for the EU institution that wants to get ahead of this rather than react to it, what's the best first move?

Barnabás: Take GDPR, and look properly at what it says about fraud being a legitimate reason for data processing. Get a mentor, an experienced supporter for the journey of enabling joint action, because waiting for the regulation to arrive slows you down, and fraud will keep growing in the meantime. Get ahead of the curve, get ready, and when the regulation lands, you'll already be compliant from day one.

That was the first message sent through Salv Bridge. Five years on, that same flow — one bank flagging a risk to another — has become routine. One bank has averaged 60 of these messages a day, every working day, for five years.

Banks have always warned each other about risks. It just used to happen informally, as Taavi, one of Salv's founders, put it:

"Fincrime fighters compare notes over coffee, or send a 'you might want to take a look at this customer' message to a former colleague. That's suspicion passed on quickly, with good intentions. But quietly, informally, and outside policy."

— Taavi Tamkivi, CEO and Co-founder, Salv

Every bank has its own defences. What has been missing is a fast, compliant, secure way to see what the bank next door already knew. The same customer could be flagged as a risk at one institution and look completely clean at the next.

It started with one bank asking a question

Bridge was built because a customer had a problem: "I know this information is useful to another bank you work with. But I've got no compliant way to share it."

That request became a pilot, and the pilot became an operational network. Its first real stress test came when Russia invaded Ukraine and sanctions cases quadrupled almost overnight. The network had to prove it could hold up under real pressure, and it did.

What started with four banks in Estonia — Swedbank, SEB, Luminor and LHV — now spans banks across 16+ countries, including a dedicated cross-border cluster serving a pan-European and UK fintech group. Some markets got there the way Estonia did, banks organising themselves directly. Others got there through a bank association acting as the connecting body.

What five years of sharing fraud and AML data tells us

Across those 16+ countries, banks have collaborated on 75,000+ joint investigations spanning fraud, sanctions and AML, and run 200,000+ joint screening queries. Fraud cases shared through Bridge carry an 84% true-positive rate. The median response time from one bank to another sits at 17 minutes. Roughly 80% of cases see at least partial fund recovery.

This isn't a pilot anymore. It's a live network that fincrime teams have been routing real cases through, daily, for half a decade.

There's a piece of timing worth noting too. In 2022, Salv's first Bridge whitepaper predicted EU-wide rules mandating this kind of cross-bank data sharing "as early as 2024." The estimate was a little optimistic on timing, not direction: AMLR Article 75 brings mandatory AML information-sharing from July 2027, and PSR Article 83a is expected to bring the equivalent for fraud from early 2028, once the final transitional arrangements are confirmed. Later than the original guess, but the same bet.

Five years isn't the finish line

We're still here, still evolving, still adding new banks and consortia to the network. Every institution in Europe will eventually face the question Estonia's banks faced in 2021. The difference is they can follow a path — there are five years of learnings and results to look at first.

As Siiri Grabbi, Sanctions and CTF Officer at Coop Pank in Estonia, said:

"Bridge proves that collaboration works.

It helps us respond faster, protect more customers and, most importantly, build trust between people who once worked in isolation. Every message shared strengthens that trust. Every quick response shows why it matters. When people know the person on the other side, cooperation becomes instinctive. The best operation is cooperation!

— Siiri Grabbi, Sanctions and CTF Officer, Coop Pank

Five years ago, this journey started with one bank asking a question. We'd like to think the next five look much the same, but with more banks and many more cases solved.

In this conversation with Dr Nicola Harding on Follow the Money, Barnabás explains why the gap between claimed and actual intelligence sharing is where the real work sits, how one Central European country went from RFP to live in six months, and why actionable intelligence is fundamentally different from data sharing.

Nicola: So let's dive straight in. You left G+D, which is this well-known global security technology company, to join Salv—a company you'd already been championing from inside. What did you see in Bridge that convinced you to bet your career on it?

Barnabás: I think the time has come that we move from individual defences to collective defences. The mission that inspired me was that we need to bring parties—the banks, and maybe after banks a broader set of parties—together to fight financial crime. Because fraud, money laundering, but especially fraud and scams, it became so bad that we need a new approach to fight it. This is a mission that sits in the background when I'm focusing on the business.

Nicola: I always find it interesting that when we talk about fraud and financial crime, we don't look at cyber security, physical security, or fraud as separate silos. They come together. And intelligence sharing is crucial because we shouldn't silo that information. It should flow to the right people at the right time. Is that a mindset you found coming from a security technology company into more specifically financial crime?

Barnabás: Absolutely. And it comes even earlier. Before G+D, I worked in a central bank in various roles. In the central bank you're infused with a public policy mandate—you're there to make your economy, your society, even using big words, better. Especially if you come from a region which is catching up, like Hungary and Central Europe. That mentality shaped how I became a young professional. At G+D I went into the thick of the payments industry. I worked on cash, on cards, on fraud trends and the work we supported and enabled to improve defences. The thinking that fraud and crime is a joint responsibility originates from that public sector mindset. It makes it easier for me to engage with central banks, with regulators, with bank associations—because they also have a public mandate. In payments, fraud and scams don't respect organisational silos. They leverage the fact that organisations are silos. I remember discussions with very senior banking people where we set up an innovation sparing board. They said: sometimes at a bank, fraud information within the bank doesn't come together because fraud is within product silos. There's card-related fraud, credit transfer fraud, credit product fraud. That's when I realised—my god, there's so much to do to connect the dots and create a networked defence against a threat that was already a network.

Breaking down the infrastructure layer

Nicola: It's astonishing how siloed organisations are. When you draw the org chart it makes sense, but working in practice it's so difficult. In payments, the infrastructure itself—when a payment travels across a payment rail, there's loads of things intersecting: cyber security, sanctioning, and more. That's why it shocked me when working with Salv that this infrastructure layer around data sharing wasn't there. But actually, the culture of sharing across infrastructure is embedded in the payment system. We just needed that layer. You've now spent the bulk of the last two months on the road. Paint a picture: who are you actually sitting across from in rooms, and what are they really asking?

Barnabás: I feel a bit like when you're hungry and going to a hotel breakfast with everything on the table—you don't know where to start first. There's so much eagerness and appetite. Because fraud people and money laundering experts already know they have to talk to each other, even across banks and sometimes across borders. What they do out of necessity is they call each other, send encrypted emails, share lists and Excel files. Or they use very structured but very slow SWIFT messaging. They already reach out because they feel the pressure. When I'm talking to banking people, bank associations, central banks, multibank IT setups, we start by acknowledging the reality. To fight modern fraud and scams, banks already have collaboration. What we discuss is how to bring that collaboration to a structured, compliant, logged and fast working platform. So it doesn't depend on whom you happen to know at the other bank and whether they're on duty today. That conversation opens doors. Because what we're talking about is not disruptive. The idea that fraud people contact each other is normal. They're just looking for a way to do it more effectively and more compliantly.

Where the conversations are progressing

Nicola: I'm interested in where in Europe the most serious discussions are happening, and where you're pointing them toward.

Barnabás: The good news is it resonates across Europe everywhere, and even beyond. I just had a conversation with a global multiplicator organisation about Central Asia and other markets where fraud and scams are a real issue. But it resonates differently depending on the starting situation. Some markets already have strong multi-bank collaboration culture—not just culture but a track record with various multibank setups. Spain, Belgium. Countries with very strong central regulators who take a mandate operationally—like my old country, Hungary, or Romania. In these countries, driven by either multibank setups or a central regulator, there's already movement in the multibank collaborative fighting space. Central risk indicators, risk scoring systems are set up by the banks. There's already a start of suspicious IBAN sharing initiatives. In those situations, we acknowledge the multibank initiative and look at how to connect them to other markets. We're the only platform in Europe working cross-border at PII data level—personal identifiable data. So we can bring international connections to the multibank setups already championing the case within country. Or the risk scoring is doing its job for transaction monitoring. We can complement it with joint screening of suspicious persons in KYC situations—a preventive step. Or we help with joint investigations between banks after transactions, not yet covered by multibank risk scoring. We're flexible working around existing setups. On other markets, they're not yet there because regulators are more hands-off or leading analytically not operationally, or multibank joint setups don't exist. There we almost create or nudge the demand. The eagerness is there, but we bring the knowledge: here's how it's possible based on our five years' experience, at low complexity and reasonable cost. In these countries—still the majority around Europe—this opens the eyes. And it sometimes takes a longer journey. But, for example, if a Bank Association is convinced, we see in one concrete Central European country—which I still can't name—they did their own market research, RFI, RFP process to select the infrastructure. They want to bring them to this multibank fraud joint investigation use case within six months. We are proud to be the selected infrastructure. Within the next few months we're going to implement that infrastructure and they're able to go live within the next few months. This shows that if there's a strong central player bringing banks together—at least the first five banks or so—and they start, it's possible to go live after selecting the platform pretty fast.

Nicola: Speed is the essence here. Getting programmes running—in some markets we've talked about this forever but very little action happened. Lots of roundtables and sandwiches. To hear you're going from RFP selection to full implementation in six months—that's a huge feat and not to be underestimated.

Barnabás: What really helps is one good central coordination actor. And the other thing is we designed our infrastructure in a low-friction entry way. You can start working in a semi-manual way, so your IT department doesn't have to start a big project that needs prioritisation and takes ages. You might not be number one priority. You can start in a no-frills way. We can onboard the bank within a good week or so. Then once your IT department is able to prioritise your project, you can automate the whole thing via APIs. Then of course you have to do a bit more work, but that's step two. You already see the benefits of why to do that after step one.

The difference between data sharing and actionable intelligence

Nicola: It's astounding how much Salv knows what they're doing. In your estimation, where's the gap widest between how an organisation describes its intelligence sharing capability now and what's actually running underneath?

Barnabás: What surprised me in the last month is what everything "data sharing" can mean. Often the discussion starts with a bank manager or association manager telling me they're already doing data sharing. Nothing to see here. Then we get into what exactly they're doing, and I describe what banks on our infrastructure are actually doing. Then we realise: data sharing is not always data sharing enabling real action. Sometimes it's an analytical exercise. In one country, the fact that banks get together once a month and look at the so-called modus operandi—scam and fraud patterns—is also data sharing. It's based on shared information from the network. But it's not enabling action at the level of a suspicious case or transaction. The difference is: sharing is always good, as long as it's compliant. But collaborative intelligence is always good when it's actionable—when it leads to one fraudster not being onboarded to the next bank after being offboarded from two others on the network. Or when a transaction with real money gets stopped or frozen at the right level, and the victim and banks and PSPs around them get their money back. We saw one bank realise a €176,000 recovery because they did their investigation between two banks within ten minutes. That was enough to freeze the funds and get the money back. We don't know what's inside—so it's a very important design principle that we don't see sensitive information. We see the traffic. It's like I'm looking at the street from my window: I see cars moving left and right. I could count the cars, but I don't know who's inside, where they're driving, or why. It's similar. But it's very encouraging that in one single case so much money can be recovered. This is not a unique experience. A few months ago there was a hundred thousand euro recovery. There's real money involved in fraud and scam with real victims—private persons but also companies, especially smaller companies. The difference comes between data sharing for the purpose of getting more informed versus our type of intelligence sharing, which creates the basis of immediate action.

Nicola: It's life-changing for some people. A hundred and seventy thousand euros could be someone's life savings, their pension, their mortgage. We don't often think about what happens to that €170,000 once it's gone. A criminal has it. They might use it for terrorism, drugs, child exploitation. To hear you've stopped that in time and got it back—that's amazing.

Barnabás: Or it could have bankrupted a small company.

The EBAday pitch

Nicola: Congratulations on the EBAday pitch. Tell me about distilling two months of market conversations into a five-minute pitch. What did you lead with and why?

Barnabás: It's never easy to distil a company's core mission in three to five minutes. But if you have a clear mission and experience you can share with the audience and jury, it becomes easier. What really helped was clarity. I led with acknowledging the problem about networked crime. Then acknowledging the reality: fraud and AML people are already talking. But we help that talking be infrastructure-based and structured. Then I acknowledged the challenge: what about GDPR? What about my IT department? What about my budget and costs? And I was able to explain how we help the organisation—a bank or bank association—overcome these hurdles. What resonated was when I explained concrete use cases like joint screening in KYC or quick joint investigation after transaction. People nodded in the audience—they got it. Then the fact that we've been doing this for five years, with 60,000+ sharing transactions on the platform and millions of euros recovered. That brought home the point that this is not a PowerPoint, but we're talking about already operational activity. Then there was discussion. The jury had experienced business professionals, some with long history in payments, banking, or scaling enterprises. I actually enjoyed those questions. They were good discussion triggers. We even continued off stage about monetisation and cross-border, where we're already playing.

Nicola: Did the judges' questions give you any indication of where the industry's headed right now?

Barnabás: I think there's a lot of confusion because data sharing is kind of accepted as a good thing, but it means so many different things. People hear from more and more vendors—coming from generalist software, encryption technology, or fraud/AML sides—moving towards shared fighting of fraud. Customers and banks are confused about what's possible, and not everybody's clear about preconditions. Yeah, we can do shared things if you're all on my tool. That's different from open infrastructure where you can have any tool you want on your bank side, but use the sharing infrastructure for collective intelligence. The industry needs more transparency about what we're actually proposing, more clarity on preconditions, more realism. We should focus on the business problem we want to solve, not get carried away by the sexiness of technology. This is not a technology problem. We have a business problem.

Nicola: That's a really good point. This isn't a technology problem, it's a business problem. And we're beyond silver-bullet thinking. You've also highlighted that some platforms say: use this, but you've also got to be a client of ours in another area. That's a real tension for heads of fraud who have their own secret sauce—their unique combination of tools and approaches. What other objections or hesitations actually come up from the customer side, even at the point where you've proven it works, you've got strong case studies, it's working right now?

Barnabás: Indeed, the classical three major obstacles that come up. First: how am I going to convince my data privacy officer that this is GDPR compliant? We come with a structured approach. We give advice on GDPR compliance, and we come with templates for data privacy impact assessments, for data processing agreements. A structured prepared approach. The good news is GDPR itself isn't a problem. GDPR says fraud mitigation is a legitimate reason to process data. And GDPR says when you protect data, take appropriate measures—not maximum possible measures. That would be strange. We're able to show that end-to-end encryption, the fact that even Salv doesn't see what's inside, the whole structure built in a privacy-protecting way—this fulfils the GDPR requirement for having the reason for data processing, having the right appropriate measures, and we take the design and governance structure very seriously with GDPR requirements for data minimisation, limited storage time, all these principles operationally. We operationalise GDPR compliance into the design. So we lead the partner—the bank or association—through that journey. We strongly recommend that nobody runs just with a simple question to a DPO: "Can I share data?" The answer is probably no. You come with a structured proposal: I'm proposing to share data for this purpose, this way, here's my documentation, let's talk. Then it becomes a productive, structured conversation about concrete points, less about the if. To other hurdles like: is it a big IT project which my IT department will prioritise maybe in three years? Is it costing me a lot? Do I have to fire people? All these hurdles can be mitigated because joining the infrastructure is a really low-friction step. The infrastructure already exists, so we're not building it with the customer. And we intentionally designed access to be semi-manual, so you can start reaping benefits without big IT projects. And costs are absolutely reasonable. Thanks to more than a hundred institutions using the platform and five years' history, we don't have development costs if we stay at normal standard level. So it becomes a really interesting and inspiring conversation for both parties. It takes time, nevertheless, for a group of banks in a country to get their governance together, to get to the notion of doing it jointly, especially in countries with no existing precedents or multibank collaboration in this space. That's where we can help. The heavy lifting is on the governance side. It has to be done by the banks or bank association.

Looking ahead

Nicola: Given everything you've seen over the last two months, how are you feeling about Bridge, about Salv, and about your decision to move from G+D? What does the future of Bridge look like?

Barnabás: The mission is fantastic. At the business level, we want to enable bank consortia, bank associations, groups of banks in more and more countries to leverage the infrastructure we've built. As mentioned, the next country—already in Central Europe—will go live soon. I'm looking forward to more such countries joining. At the same time, we're helping existing bank customers increase benefits via higher automation levels. From semi-manual we're accompanying them to an API-based way of working, which increases speed and reduces human work. And at one point, once collective intelligence creates a real good data environment, we'll leverage AI-based agents taking over routine work. Our philosophy is collective intelligence first, artificial intelligence second. We're already a prompt-first company, very AI native in how we work. That's fascinating—how such a small team achieves so much because a lot of routine work can be done with AI support. At a personal level, my kids see the change. I'm fascinated by our vision. I'm moving around Europe talking to bank associations and banks. They really understand that behind all this is a mission. It still resonates—what they told me: "Papa, finally you do something that matters and we understand." Those words I'll never forget.

Nicola: I really love that. Thank you, Barnabás, and congratulations on the EBAday win. If there's one thing to take from this, intelligence sharing is not a single thing you either have or don't have. It's a spectrum. The gap between what's claimed and what's genuinely running is where the real work sits. Knowing how to tell them apart might be the more valuable skill right now.

Barnabás Ferenczi was a guest on Follow the Money, Salv's podcast on financial crime and compliance.

In this episode of Follow the Money, host Dr Nicola Harding speaks with Edgars Pastars — partner at COBALT, one of the Baltic region's leading law firms, and adviser to Finance Latvia. Edgars sits at a rare intersection: he is a lawyer who holds both CAMS and CGSS certifications, which means he understands both sides of the table.

He has also put that into practice at market scale, helping build the legal infrastructure behind Latvia's intelligence sharing programme — part of the country's broader journey from near-FATF greylisting in 2020 to a confirmed highly effective rating in 2026. He also chairs the ACAMS Baltic chapter board and lectures at Riga Graduate School of Law.

The internal conversation and the external transformation, it turns out, are the same conversation at different scales.

Why compliance teams keep getting "it depends" from legal

Dr Nicola Harding: A compliance officer calls their legal team and says "can we do this?" — and the answer comes back: "it depends," or "probably not." The compliance person is stuck. They either don't move, or they move without the legal cover that's so important. You've articulated this as the difference between two questions: "is it mandatory?" and "is it allowed?" It feels like a subtle distinction, but I suspect it changes everything about how those conversations actually work. Can you explain it in practice?

Edgars Pastars: The main mistake that AML professionals — or business people — are making with lawyers is they're just throwing some vague question over the wall and they expect legal to provide all the answers and give their sign-off. It doesn't happen like this.

From a compliance perspective, their mission is to fight financial crime. They think: if we're doing the right thing, then everything we use to achieve this goal is legal and proportionate. But it's not always the case. AML teams are mostly interested in the idea that the more information we can have, the better — but that's not always the most compliant answer.

From a legal perspective, lawyers think differently. They sometimes stick to an approach I'd call "lawful but awful." Their mission is to protect the institution — to stop it from abusing the legal framework, from breaching the law, and then being held liable for that breach.

Both of them have their own legitimate missions. You need to find common ground. And one of those ways is to start the conversation with the legal department and explain: what risks are we addressing here? Why is this reasonable? What is the necessity? What information are we gathering and what will we achieve by it?

Everything still depends on the text of the law — and I'd say the vibe the lawyer can feel in the boardroom. It's important that business people set the tone at the top. Then the lawyer can decide: this is serious, the organisation would like to move to information sharing, or some other arrangement to help address money laundering risks.

Start the conversation by engaging them in solving the problem. Like a little kid — you give them a toy and they're trying to figure out how it works. With lawyers, you can't just say "can we do this?" That's not the right way to approach it.

What to do when legal still won't give permission

Dr Nicola Harding: If the compliance officer makes their case and legal still won't give permission — is that the end of the conversation? How do you bring them on board?

Edgars Pastars: It depends what type of lawyer you're addressing. If it's a data protection lawyer, you need to understand how their mind works — it's structured around data protection law, GDPR in Europe, for example. You need to present your case in the light of the mindset of the lawyer you're talking to. A civil law lawyer is one approach; a criminal or defence lawyer is a different one entirely.

But first, you need to start with the problem and solve it together — rather than prepare the whole solution and then say "take it or leave it."

We had a recent example when we set up information sharing on fraud. There was quite a vague sentence in the law, but it was still there — and that made the lawyers happy, but not happy enough. In order to convince them, we started thinking about risk mitigating measures. We said: okay, the information could be shared — but how can we reduce the amount we share? For how long are we keeping or processing the data?

"If you start talking about risk mitigating measures, you've started to engage the lawyer in the conversation. It's like showing a bone to a dog." — Edgars Pastars, Partner, COBALT

Start with the pain moments, the trigger points. That's how to start a conversation — not by starting an inter-department fight.

Scaling the conversation: getting competing banks to share data

Dr Nicola Harding: You've done this not just within one institution but across several competing banks — getting them to sit down and agree to share data under a legal framework that didn't fully exist. How do you even open that conversation to a bank's board or their compliance leadership?

Edgars Pastars: First you need to find common ground — or I would say common pain — for all the banks involved. Sometimes negotiating something between banks is like forming a coalition government in the parliament. But all of them are lacking something. They're always lacking information. So if they see benefit to it, it opens the door for conversation.

But that's not enough. Banks are different — and one of the things that makes them different is their size. A bigger bank may feel like it's losing competitive advantage by sharing information. So all of them must benefit somehow. And they must also contribute. What you share is what you get. If one bank is sharing and the other is just receiving, that's not a partnership — it's a one-way street.

Most compliance officers sitting in a bank can convince their boards by saying: we will need less money to mitigate those risks. We will have better information, so we are less exposed to financial crime. We can fight crime more efficiently. And it means for you — the board — that the probability of being fined and having our reputation damaged is way lower if we have this additional tool.

For example, if one customer is offboarded in one bank due to serious, grounded suspicions of money laundering — and then this customer immediately moves to another bank — or it's a money mule who was caught red-handed in one bank and then moves to another. If you don't have a warning system, you are not protected from those risks. Most likely you will catch them, but only after they have done their dirty work. And this creates exposure for you.

"Information sharing is like buying a radar — once you have it, you can't live without it." — Edgars Pastars, Partner, COBALT

Fragmentation: the vulnerability criminals rely on

Dr Nicola Harding: In financial services, we don't always think of the threat as external — as one that cuts across all our competitors. It's one of the genuinely unique propositions within the commercial world: we're all centred around the same adversary rather than each other as competitors.

Edgars Pastars: The criminal world is exploiting one vulnerability we all have as financial institutions, and this vulnerability is fragmentation.

As we work in silos — our organisations are separate and not sharing information, either typologies or even real names, operational data — they are getting the benefit of that. It's for the benefit of the criminals for us to be less equipped and fragmented in our approach to tackle financial crime.

How Latvia built its intelligence sharing infrastructure

Dr Nicola Harding: Latvia was on the verge of FATF greylisting in 2020. What changed on the ground, and how instrumental were these projects in creating a new compliance environment?

Edgars Pastars: First of all, we need to talk about several types of information sharing — and you constantly need to improve all of those solutions. They're not static. You can't just say "all done, we can move on."

Back in 2018, when we had issues with almost being greylisted for non-compliance with FATF standards in terms of efficiency — we had laws and regulations which were mostly compliant, but the efficiency was poor. So we started discussing how to improve efficiency. Efficiency means that banks can spot suspicious transactions, they can report them, those reports are actionable, and the police can investigate and then freeze and seize those illicit assets.

Then our colleagues from the UK's National Crime Agency helped us with some advice on public-private partnerships — how the banks and the police could meet on some safe ground, a safe space, and discuss things. Discussions which are not strictly allowed by banking secrecy, but which could lead to evidence obtained in due process.

We came up with this public-private partnership model, which is super effective. It was not common for any continental law country to have such an approach back then. It really helped banks to talk with the police. For example, if the police are monitoring one client, the bank can meet with the police or the financial intelligence unit at their office and say: what should we do, how do we do the monitoring? Then the police can ask: what data do you have? The bank says: we have this data, but you need to request it. And now the police can request that data more precisely — targeting what they actually need, not just what they think the bank could have.

Afterwards, we understood that public-private partnership is not the only thing we need. We already had some private-to-private information sharing on offboarded or rejected customers. And then we understood that we need a structured approach. We can't just share lists of people without ensuring that the data is protected, and that this right is not abused by banks.

So we ensured that the sharing is structured. We have clear rules on what we can and cannot share — for example, a bank's risk appetite for rejecting a customer cannot be shared. Only significant and appropriate data is shared, and it is deleted after a set period of time. You can't keep it forever, because sharing this data could facilitate financial exclusion. You need to be accurate when you share something.

That's why we chose Salv's platform. How we can share in a safe way, with structure. But of course, the structure was set up by us — what is shared, what can be shared, what is definitely prohibited from sharing, and how to ensure quality and data consistency. Because you can't just say "Edgars was rejected and most likely he was a money mule." It doesn't work like that. You need to provide structured data so you can analyse it and have it in good quality. It's not about whether you can or cannot share. It's about ensuring that the data is kept in good quality and that the right of sharing is not abused.

What intelligence sharing looks like operationally

Dr Nicola Harding: What does the compliance benefit actually look like for any bank participating? What do they get that they wouldn't get from their own data alone?

Edgars Pastars: They're joining a collective effort of figuring out who the bad actors are in the system — not only for money laundering, but for sanctions evasion, terrorism financing, and fraud.

If you want to fight fraud, which is a hot topic right now, you can't actually do that without sharing information across the whole fraud chain — mule accounts, device identifiers. If one bank notices that money is flowing to a mule account in another country, if that bank immediately warns others, the other banks can stop money flows to that specific account. For five hours, for a day — it's enough to protect hundreds of victims who are being targeted by scammers right now. Otherwise, those banks couldn't stop the money. Most likely they'd use algorithms to analyse transactions, but more people would have been harmed.

When it comes to AML, you need to set clear criteria. Risk appetite cannot be part of the equation. You need clear rules: if you have grounded suspicions of money laundering activity, you share those risk indicators. But the other bank is not entitled to fully rely on this information — it's just a risk indicator. It means: maybe accept the client, but do enhanced due diligence on specific transactions. Be more vigilant. You see risk patterns, you see those risk pockets. You might have spotted them eventually on your own — but maybe after one or two weeks, maybe a month. Here, you can spot the risk faster and know what to target.

The role of regulators

Dr Nicola Harding: What was the role of the regulators in all of this — were they for it, against it, partners?

Edgars Pastars: When we first presented the public-private partnership idea, eight or nine years ago, not all institutions understood what it actually meant. We needed to do some convincing — but at some point they got excited about the results this information sharing could bring.

When it comes to private-to-private information sharing, there was a sort of supervisory expectation that this sharing should take place — it wasn't out of the blue. Those rules had been included in the law for about fifteen years, but with a different mindset back then. We saw that we could utilise those old norms and improve them.

I'd say policymakers and supervisors were helpful. And in our case, a key factor was that the people at the data protection authority were quite familiar with anti-money laundering. That's not the most common background for data protection officials — but because of their previous work, it was easier to explain what financial crime prevention is and why information sharing helps.

But the one thing you must not forget is competition. Sharing information between competitors can create a breach of competition law. There must be assurances that competition law is followed — for example, what kind of information is shared must not create any sort of agreement to specifically service or not service segments of clients, or to use the data for commercial purposes. That's something you need to keep in mind when setting up information sharing arrangements.

Why having CAMS and CGSS as a lawyer changes everything

Dr Nicola Harding: You hold both CAMS and CGSS certifications, which most lawyers do not. Why does that combination matter for projects like this?

Edgars Pastars: My background is policy. I came from the public sector, doing quite a lot of policy work — not just focusing on how something is written in the law, strictly sticking to the letter of it.

Lawyers focus on compliance with the law. It's mostly black and white — compliant or not. There might be some interpretation, you can argue in a courtroom, but then the court decides, not you. Here you need to make a decision yourself. In order to make risk-based decisions and understand how risk is governed, what approach you should take, what the best practices are — I decided to go for those certifications.

They were useful to give structure to what you know. It's like a bookshelf. You're obtaining the bookshelf, and then you are ordering and putting your books there.

Also, the clients of any law firm don't just expect legal advice. They expect that you understand risk — because business is based on risk, on how you take it, share it, manage it. If you don't understand that mindset, you are not able to set up any compliance approach. A rules-based approach imposed by lawyers who are not sophisticated enough creates the risk of over-compliance — focusing on ticking boxes rather than going after the actual risk, where your efforts actually matter.

Advice for markets starting from scratch

Dr Nicola Harding: Do you have any advice for anyone trying to implement a similar project in their country?

Edgars Pastars: Learn from others. Don't hesitate to reach out. Read RUSI — the think tank in Britain — their work is great, and they actually helped us. We could present that it's not just our crazy idea, but that other countries are doing this and reputable think tanks are writing about it.

Start with mapping your needs and bring your authorities on board — but don't go to them only with a problem. You need to show the risk, the mitigating measures, what you will do to address it. Don't just show what you will gain. Show also what you will do to reduce the risks.

You need people who are leaders in their industry and who can advocate for this. Mostly, information sharing fails because of phobias — people are scared that privacy will somehow be abused. Come up with a plan for how you will address that. There are plenty of ways. Think thoroughly through all the possible objections and address them.

Now, with the AML regulation coming into force, go for the maximum you can right now. During negotiations, you will most likely be asked to remove some of your ideas — so start ambitious.

And you need a partner from a technological point of view. We made this mistake in the past: you only talk about sharing, but the key part is technology. What will you use for the sharing? How will you measure the success of the data you shared and used? How will you ensure that this data is safe?

You can't just exchange emails or use a WhatsApp group. That's not sharing — it's something that is most likely illegal, because you're not protecting the data. Try to find what your peers have done in other countries. And have a partner with you who can provide those services — regardless of what kind of sharing you are doing, whether privacy-enhancing technologies or operational data, you need someone who knows it.

Dr Nicola Harding: What strikes me most about Edgars and his work is that he sits inside two conversations that most people treat as entirely separate. The first is internal: how do compliance officers and their lawyers actually collaborate? The second is external: how do you move an entire market and build the legal infrastructure that makes transformation possible?

But they're not separate at all. They're the same conversation. The market only transforms when the internal conversation changes. When legal stops asking "is it mandatory?" and starts asking "how is it allowed?" — that's when you get the permission structures that let institutions collaborate at scale.

Get clear on what you actually need. Brief your lawyer with the mandate, not a question. And understand that "we can't" is often code for "I don't have permission to say yes yet." Your job is to give them that permission.

Today, she is Sanctions and Counter-Terrorism Financing Officer at Coop Bank in Estonia. Siiri has a unique vantage point: she has seen why sanctions are designed the way they are (political urgency, diplomatic compromise, the pressure of a midnight deadline) and what it's like to implement and enforce them.

In a recent episode of our Follow the Money podcast series, Siiri joined host Dr Nicola Harding to talk about her career, Estonia's Salv-powered model of cross-institution intelligence sharing, and what the rest of Europe needs to understand before the AMLR Article 75 and PSR Article 83 deadlines arrive in 2027. Here are the key takeaways from the episode.

The intelligence sharing infrastructure Estonia built five years ago

Siiri shared how Estonia's banks have been sharing financial crime intelligence using Salv Bridge for over five years. What started as an informal working group inside the Estonian Banking Association — banks comparing notes on sanctions hits, flagging fraud cases over messaging apps — became a real-time, structured, encrypted, legally-grounded system with a full audit trail.

Siiri chairs the sanctions working group at the Estonian Banking Association, which brings banks, supervisors, and regulators together monthly to align on implementation, share evasion patterns, and collectively work through new regulatory requirements. That group formed the foundation for what became the Salv Bridge intelligence sharing network.

There are several use cases in-play, and one that Siiri outlined works like this: A sanctions screening alert raises a potential name match. Siiri sends a request to another Estonian bank — date of birth, citizenship, place of residence. Within minutes, the answer comes back. Payment released or blocked, with a documented rationale. No SWIFT messages to payment teams, no waiting for emails, or trying to call specific colleagues at other banks. Just a fast, encrypted exchange that both institutions can point to in a supervisory review.

Fraud cases work the same way. When a bank identifies that a client has been defrauded and the funds have moved to another institution, a message goes out immediately. The receiving bank can block the account before the funds travel further. In several cases, money that moved through a virtual IBAN — accounts that typically drain out of Europe within hours — has been recovered. Millions of euros have been actively recovered through these joint investigations.

On the 2027 intelligence sharing deadline

Siiri was frank about timing during her Follow the Money chat with Nicola. AMLR Article 75 and PSR Article 83 require EU financial institutions to have structured intelligence sharing frameworks in place by 2027. Siiri believes that the timeline is already tight.

"You need the passionate crime fighters to build it. There needs to be somebody who provides the platform who has the mission to do something. Is there a legal ground in place in the country, or do they wait for the regulations to kick in? Are the politicians ready? How do they interpret GDPR? It's so easy to say GDPR doesn't allow [sharing], but not all data [falls under] GDPR." — Siiri Grabbi, Sanctions and Counter-Terrorism Financing Officer, Coop Bank

The barriers she identifies aren't primarily technical. They're a combination of legal uncertainty, internal policy alignment, infrastructure readiness, and fundamentally a willingness to start before everything is perfectly resolved. Estonia didn't wait for all the answers. It started, learned, and expanded.

The misconception Siiri hears most often

"That we all want to get the other banks' clients to ourselves. But it's not the case. I don't want a criminal to become my client. I just want to receive the information and intelligence to know if my doubts are correct." — Siiri Grabbi, Sanctions and Counter-Terrorism Financing Officer, Coop Bank

The competitive instinct that makes many institutions reluctant to share is, in Siiri's experience, largely misplaced. Intelligence sharing doesn't hand customers to rivals. It stops bad money from moving. That benefits every institution the money would otherwise flow through.

What the rest of Europe needs to do now

Siiri's advice to a compliance officer at a mid-sized bank in another EU country: it starts with a shift in mindset. Intelligence sharing doesn't add workload. It compresses investigation time, produces fuller reports, and creates the audit trail that supervisors are increasingly expecting to see.

Her message to public authorities is direct: stop treating the private sector as an adversary, engage the industry earlier in drafting regulations, and set the example by sharing intelligence themselves.

As for what Estonia did right, she sums it up in one sentence: "We started straight away."

Watch the full episode on YouTube, follow Siiri on LinkedIn, or learn more about Salv Bridge.

In this episode of Follow the Money, host Dr Nicola Harding sits down with Siiri Graabi — sanctions and counter-terrorism financing officer at Coop Pank and chair of the sanctions working group at the Estonian Banking Association — to find out what that system actually looks like from the inside. How it was built. How trust between competing banks was established. What it took to bring public authorities into the same network. And what the rest of Europe needs to stop debating and start doing.

Siiri brings a perspective that very few compliance professionals have: before joining banking, she spent over a decade as an Estonian diplomat, including time in Brussels where she was in the room as EU sanctions packages were negotiated. She helped write the rules. Now she enforces them — and watches them get evaded in real time.

Introduction: the strange irony at the heart of AML compliance

Dr Nicola Harding There's a strange irony at the heart of financial crime compliance. We build our entire regulatory architecture around stopping money laundering, sanctions evasion and fraud. But the people tasked with enforcing those rules mostly work alone, bank by bank, institution by institution, unable to really share what they're seeing. Estonia decided to do something about that, not in theory, but in practice. And they built a real system in real banks with real results.

And today we're talking to someone who helped make it happen and who did something quite unusual before that. She helped write the rules in the first place. Our guest today is Siiri Graabi. Siiri is the sanctions and counter-terrorism financing officer at Coop Pank in Estonia and she chairs the sanctions working group at the Estonian Banking Association. Before banking she spent over a decade as an Estonian diplomat including time as a reflex councillor in Brussels which means she was in the room when EU sanctions were being negotiated and written. She now sits on the other side of that work watching how those same sanctions get evaded inside a bank in real time. It's a very genuinely rare vantage point and why she was absolutely essential to come on and talk to us here on Follow the Money. The context for this conversation matters, the rest of Europe is facing a hard deadline under AMLR article 75 and PSR article 83, financial institutions across the EU will be required to implement structured intelligence sharing frameworks by 2027. Estonia has been doing this for years and today we want to understand what they've actually built, how they built it and what everyone else should be thinking about right now. So Siiri, thank you for joining us and welcome to Follow the Money.

Siiri Graabi Hi Nikola and thank you so much for inviting me. I'm very glad to have the opportunity to share my experience with sharing the intelligence and with the rest, whatever your questions bring on the table.

From diplomat to banker: seeing sanctions from both sides

Dr Nicola Harding Well, glad that you're open for an honest and frank discussion because I know that you've got such brilliant insights to share. I want to start from the position of moving from a diplomat to banking. You know, most people arrive in financial crime through compliance or law enforcement. Your route has been genuinely unusual. Can you tell us what your work actually looked like, you know, day to day, moving from diplomat to banking?

Siiri Graabi Well, yeah, actually the reason why I left the Foreign Service was that a mini me came to my life. So kind of as usual there's something happens in a life that makes you kind of review your life in general, your career path, what you're doing and I decided that I don't want to be constantly absent traveling around and not seeing my child too much and not spending time with her, not seeing how she's growing. So I decided to take some time off. But as usual in Estonia, we tend to know each other. Like people are moving from one position to the other. You have cooperated with somebody. So I was cooperating with the head of AML department as a diplomat from the Estonian Swedbank. And then he had moved to another bank in Estonia. So we kind of we still kept going, interacting and as the sanctions became more and more noticed and understood as well in Estonia. So the sanctions officers were required in the banks more and more, especially with the in-depth knowledge. So that's how I was taken into the banking world.

Dr Nicola Harding When you crossed into the banking side, what was the most striking thing that you noticed? What did sanctions compliance look like from inside the bank compared to how it was conceived in Brussels?

Siiri Graabi Time was of essence. We cannot forget that the sanctions are actually a political tool. So if there is something going on in the world, you have to put the political pressure. You have to do it now. You have to achieve an agreement by certain date, by certain time, until certain meeting, right? You have to show the political will. But in the banks, things don't work with a fingertip that now it's done. Especially if it's not done and if it's not written in the practice of the bank, if it needs the IT development, different departments to be joined and so on and so on. It's, yeah, time of essence doesn't work in banks, especially if there are new measures coming in. I don't mean the new listings, but really like new financial measures where banks have to start collecting the data that they have never collected before and it has not been by any means the obligation they have to collect or that they have to do additional checks which has not been required previously like you have to train your whole bank to act differently, ask different questions and so on. It's not that easy. Even in a small bank, can you then imagine what it must be in a big bank? And of course, when you're a diplomat, then you just put something on the table. You mostly argue whether it's a must, shall or should in the legal act quite often because you have kind of the proposal, comes kind of the political will is there. We have to do so the legal text has to be correct.

But what we tend to do in banks is that maybe we overcomplicate things, we overthink things. And it's not only in the banks, but as well it's then the supervisors who give the guidance, as well the European Commission who gives the guidance, because those people who give the guidance, they don't participate in the political discussions and they don't always grasp the political aim that any of the sanctions has been having or the politicians or diplomats meant while adding it into the regulation.

Dr Nicola Harding When you were doing the kind of diplomatic work on this, the moments during that drafting process where you knew a measure would be hard to enforce in practice, or did that become more apparent when you were in the banking world?

Siiri Graabi I was there to discuss the Iran sanctions package. Remember those lively discussions still after midnight and whether it's implementable even or actually think it could be done. People don't suitcases with cash across the border, right, to Iran. And even then the SWIFT prohibition was discussed whether it would even be possible. Now with Russia's sanctions we know that it is possible and it's really kind of the extent it has become now that the sanctions they are they're going to be evolving and evolving and getting more and more difficult. More restrictions you have, the more evasion cases you have.

The working group that became the foundation

Dr Nicola Harding This is a real common thing for us as criminologists, one that people don't collect enough data or the right data so that when you want to analyse it, it simply isn't there. And what that means is you call it the dark figure of crime in criminology, but basically we know that it's there. It's the known unknowns. And when you start legislating, when you create, you know, crime is a social construction. It's created through the creation of laws and sanctions, because until you have those laws and sanctions, you don't recognise that that action is necessarily occurring or at least you can't kind of draw gates around it to be able to define it and understand the size of the problem and I think it's something I can very much relate to is that we see it not just in financial services but any large organisation when rules change, when processes change, that action is really difficult to implement but necessary.

But firstly you now chair the sanctions working group in the Estonian Banking Association. Can you tell us a little bit about what that group actually does and how it connects to your day-to-day role at a Coop Bank?

Siiri Graabi Yeah, well, we usually have regular monthly meetings and we actually discuss different topics that are relevant at the moment. For example, the implementation of the regulations, if something new comes out and if there is something new to understand, for example, like the instant payment regulation, there are still so many uncertainties, right? And we at least try to give the common understanding and the common ground so that we would at least implement the things similarly or the Russia sanctions and we also we we share the experiences what we have we have as well the supervisors on boards on the meeting so that if they have something valuable to add or we have any questions to them or they have questions to us then we can exchange the information. We do the trainings as well so I try to involve and share the information in different trainings to the colleagues and yeah and as well for example we have agreed on how we exchange the information and which information through Salv with each other related to sanctions. Yeah but it's kind of that it seems really simple, the thing we do, but at the same time, you have to really look into it. You need to understand what you're talking about. You have to chair the group. You have to collect the ideas, what to discuss. But in general, I would have to look into the same legal acts on my daily job anyway, so I look into it. So it's rather easier to do it collectively and we raise up the questions that we have, kind of we discuss, it's much easier than to do it on my own because we all notice different things, different patterns. And yeah, it's always good to know the different evasion cases or get the trainings because this is how I can set up the rules to discover evasion. Kind of train as well my own colleagues in the bank, share them with new information. So it's kinda of all related to the daily job a lot.

Dr Nicola Harding It feels like the working group is like a bit of a kind of sanctions kind of engine behind some of the things that are going on in Estonia. And I can completely relate, you know, we kind of have that phrase, don't we, that more heads are better than one. But being able to come and share those experiences and kind of elevate each other's standards as well without having to do that in and see that this is a competitive but rather cooperative is really —

Siiri Graabi Indeed, that is very helpful and as well it builds trust, that if we see each other, if we all discuss things openly, and it doesn't build only trust between the banks, but as well with the public sector, because we know each other, we have each other's phone numbers, so that the person who is calling you, you know the face, you know that there's somebody who has a trouble and he or she wants to discuss them, then it's so much easier to do if you know and trust the people.

How intelligence sharing works in practice

Dr Nicola Harding Let's now get into that system itself. For people who are maybe listening to this but haven't encountered it in practice, what is cross-institution intelligence sharing in Estonia? What does it actually involve? And if you're able to, can you walk us through a specific scenario, like anonymised, if it makes it easier, of like a fraud case or a sanctions hit? What happens?

Siiri Graabi Well in Estonia we have had Salv up and running for over five years now and it's a really useful tool.

First, I think we were kind of, we were really looking forward to it. We were open. We wanted to exchange the information and, you know, the information is exchanged anyway. Not only in Estonia, but as well in other countries. We all have those, know those WeChat groups and different forums where to share the information or just text messages, groups, whatever that are accessible. Right. But why not to do it then actually in legal encrypted way so that we can actually track then afterwards the information where did we receive it, what we are basing our information on, or where did we receive it? The kind of all the audit trail is really important. So and it's really simple if you can say that yes, we have this exchange of information platform and we got it there. We got the date of birth directly from the source, right? And so that when we started sharing the information. It started slowly. We were not really sure how to ask, what to ask. But sanctions. Sanctions were really easy. If you sent a sanction RFI, usually what you need is the father's name, date of birth, citizenship, or whether the person is resident currently so you can kind of eliminate that actually this Sergei Ivanov is not the sanctioned Sergei Ivanov.

So that was really easy and that has been up and running really fast. And really the practical case is that you have an alert because we all have to do the screening. So I can send it takes literally seconds to send from the template to the other bank. Could you please send the date of birth and citizenship, whatever is required. And you'll get the reply within minutes. So the money can really flow because the aim is to make the payment happen for my client and the aim for the other bank should be to receive the funds for their clients so that both of our clients can be happy. And if there's nothing wrong, why not?

And with the fraud, it's the same. We actually do see when there's the fraudulent case. We see if our client is a victim. For example, let's take our client as a victim. The funds from her account, his account have been sent to another bank. I can instantly send the message, our client has been frauded, we just got the confirmation. And then the other bank can block the account where the funds were sent to, so that the funds are not sent to the other bank's, PSPs around the world. So that there is much higher possibility to get the funds back when then the official recall is presented.

And actually we even have managed to receive funds back if the vIBAN account has been used. So that means that vIBAN we all know it might not even be the citizen of the EU or SEPA area. So those funds usually travel out really fast from Europe.

And what we also do is that we exchange the information as well. If I see that, for example, my bank's client is a victim and I know that he or she has an account in another bank as well. I can straight away notify that our client is making the transfer between own accounts. Have you seen the fraudulent behavior as well? Please pay attention to that account. And it's quite often then that the funds actually can be stopped because we have all those wonderful other tools as well to notice the different behavior, we have the monitoring rules and so on and so on. But, you know, we don't check every payment from the first euro, right? The fraudsters, they have their own companies with the psychological knowledge. They have trainings, they have call centers and so on. So it's quite common that those people who have been victims of the fraud at some point they are turned to become the money mules themselves for example. And if a person who has been manipulated and hears the same information from different banks, from different people, then the person is much more open to understand that he or she has been frauded.

Dr Nicola Harding It really strikes me in everything that you've described is that I always think about data as kind of different if you think about the night sky and stars. So each little data point is one of those pinpricks of light. What you're describing is almost where you're able to make those connections, whether it be from the victim's bank into a money mule account or what have you. But the point that you made around have they opened other accounts and stuff like that, it's almost like you start to be able to see the constellations and how they all connect together before it kind of completely collapses.

Siiri Graabi Mm-hmm.

Dr Nicola Harding Having this kind of infrastructure in place allows people who maybe haven't been in the industry as long, haven't been able to network and make those connections. It's less reliant on who you know and are able to talk to and more as an infrastructurial base that will last beyond those relationships. And I think that's the key thing for me is that you've got that clear audit trail as you said but it comes back to still trust and I think you know you mentioned this earlier trust is the real foundation of this between institutions that can also sometimes be considered competitors. I'd really love to dig into more about how that trust was actually built in Estonia, you know, were their early sceptics among the banks and what shifted their position?

How trust was built between competing banks

Siiri Graabi Well, I wouldn't say that we have had really those skeptics in the banks because where it all started from was as well that we used to have information sharing working group as well in the banking association. And kind of the idea first came from there because of the working group, it met bi-weekly, so not too often and there was really kind of there were those urgent cases that you really had to share. So it was kind of raised then to the people in the banks. Salv was already on the market as well, opening their screening and monitoring tool, so the Salv people were involved and since of the Estonian banks, were actually willing and understood the issue. So straight away the authorities were involved, the legal acts were reviewed, whether it allows, as well from the GDPR's perspective. So the Estonian Data Protection Authority was involved straight away. So I think there was such a strong, both political will and as well kind of from the industry side, there was the will to make it official, to make it faster, and to really fight the financial crime. That it just happened naturally, I would say, out of the necessity.

There was like, is this actually allowed by the law that we can share? Trying to find the limits what we can do, what we cannot do and kind of then the memorandum of understanding was drafted so that we would all behave. It all started. It was kind of the combination of everything.

Dr Nicola Harding I think because of everything you've already mentioned, obviously Estonia being quite small, but also there seems to be that genuine will to want to collaborate and collaboration already happening, but just needing that avenue to really embed it in infrastructure. So we've got Estonia sorted. I'm really interested in how this now goes across border. I know that Estonian banks are now sharing intelligence with Lithuanian institutions. Including different fintechs. Like how did that cross-border extension happen and what were the additional complexities if any compared to just doing it within Estonia?

Going cross-border and the fintech question

Siiri Graabi It's always much easier if you do it in your own country, right? Where we have our own language and then Lithuania it has it's completely different language. But luckily we have the common financial language.

I wouldn't say that there were any complications, but there were hesitations, there were discussions whether it's allowed, is it possible, what would be the legal basis to do that cross-border. But we found the common ground, the possibilities, and again, there's the will. If we see that most of the fraudulent funds go to one fintech in another country and the other fintech doesn't want to be as the fintech where all the fraudulent funds go, right? Then they want to the cooperation and we want to receive the funds back for our clients. So it's all the matter of the will in the end. And I think the cooperation is really good.

Dr Nicola Harding Are there any kind of operational difference between fintechs and more traditional banks? You know, obviously the fintechs were supposed to be the disruptors in this marketplace. Now they're a little bit older and they've been around a little while. Do you think that kind of this kind of cooperation, is it something that's favoured more by fintechs or traditional banks or do you think that it's much in the same?

Siiri Graabi I think it's rather more maybe even favoured by traditional banks because we have the compliance structures in place, we have the the ground is more solid where to start from while you are the fintech or just a smaller PSP. You have so many things to do and there's always the shortage with staffing and sometimes the fintechs might not be part of the banking associations. But those who want, they will find means and they will join and they will do it.

Dr Nicola Harding Think that's again where this collaboration comes in, isn't it? Is that there's a lot that can be learnt, not just through the sharing of intelligence, but even like the practices and I you said at the beginning, you know, at first you didn't know even what questions to ask. You know you guys have got that experience now, not just that fintechs can learn from more traditional banks, but also that the rest of Europe should be looking at Estonia as a case study. Yes, OK, you're small, but you're doing it and that model can be replicated Europe-wide and obviously with the new regulations coming in, should be. So it's not a case of you how do we do this now, it's being done, it's how can we roll this out.

We've focused a lot on banking so far and I wanted to just touch a little bit upon the public-private dimension because intelligence sharing infrastructure in Estonia doesn't just connect banks to banks, there's also a relationship with the public authorities. So what does that look like in practice?

Public authorities in the system

Siiri Graabi Yeah, well with Salv, we actually have as well the public sector involved and that is also based on trust and they need to exchange the information. So it started slowly as well, kind of private sector was already in, but the public sector was still, whether they can exchange the information or not, kind of the platform is secure enough, whether it's encrypted enough. So that's always the question as well, right? That it's not so easy in public sector to have some private platform attached to their systems, especially if there's a lot of restricted material in maybe.

If that that was all through and checked in we had our first public sector authority who was joined and with whom we started exchanging the information straight away actively because this is as well kind of the information that you wouldn't otherwise share with the kind of text message so it's rather kind of best if it is encrypted and treated confidentially. And as well then, as in Estonia the law changed, we have to inform as well some other authorities of the sanction evasion cases that we discover, not only than the financial sanctions, but for example trade sanctions or other restrictions and since now there were new authorities who had to receive the information that they didn't receive before and they didn't have the platform like the Estonian FIU has for the reporting so they needed something. So Salv was there as the fastest easiest option to open the route for us, the encrypted route where you can as well attach the documents as many as needed because just, you know, encrypting a large amount of documents usually the emails don't allow such volume to be sent through, so it had to be in different batches and so on, now it's nice, secure, easy way for the authorities to receive the information and as well to export it from Salv so that they could add it or copy it to their own systems.

That has been really fruitful, that it's easy. We have the structure, we took people from Salv and from the authorities behind the table. We drafted all together kind of the basis, the kind of form we have to fill, what everybody would find easy to do. So that has been kind of a really easy and smooth process for each party.

Dr Nicola Harding Is this something that the regulators being involved in as well? Because obviously, like you said, the informal networks were there, but this is not the type of data or the type of sharing that you could have done within those networks. So it's been able to expand out the ability, you know, with criminals, they have no regulation, they don't care, they share data. And it's surprising with criminals, you would think, if you've got one organised crime group, they want to keep all of their secrets away from another. But actually that information getting exchanged and shared is currency in the criminal world. So if they want to go from there to there, they can do it without any restrictions in ways that we simply can't. Being able to share this data now safely and in legal ways that can then be actioned upon. To take actions against these criminal entities, you know, is needed in the fight against financial crime and serious organised crime. What was the regulator's take on the regulator's role? Is this something that they're helping with? Have they supported?

Siiri Graabi Yeah, the regulators have really been supporting it. As I said previously as well, then was as well the political understanding and the political will and Salv was being part of the discussions with the politicians, with the regulators, with all the different sides as well as the platform provider and then the banks, they were all jointly backing that we really need this platform.

Received and for example when we have received the regular feedback as well from the Estonian FIU as well they actually appreciate if we put down in our reports that we have received bits and pieces of information through Salv Bridge because then they know that there will be probably within the days a new report coming from a different bank as well adding some additional investigation points or they they could choose to actually build the whole case and they know that they will see a much bigger, wider picture. Otherwise it might have been lost, you know you might discover the dots a few years later when it's too late, right? There's nothing to do, the crimes already happened, the funds are wasted, washed, whatever is done with it.

The 2027 deadline and advice for Europe

Dr Nicola Harding So thinking forward now, the rest of Europe has got a deadline. The AMLR Article 75 and the PSR Article 83 intelligence sharing frameworks require across EU institutions by 2027. That sounds like a long time. Is it for what needs to be achieved?

Siiri Graabi I would say already —

Dr Nicola Harding What do you think is the minimum viable timeline to build something that actually works, not just ticks a box?

Siiri Graabi You need the passionate crime fighters to build it like are in Salv. Each time when I meet anybody from Salv I just feel that how the knowledge and the brains and the vibes to do something better in the world hit me. I all of a sudden feel much smarter. But so first of all, so there needs to be somebody who provides the platform. Who have the mission to do something themselves. So is there a platform? Is there a legal grounds in place at all in the country or do they wait for the regulations to kick in and then they start kind of writing their own regulation? Are the politicians ready to give such possibilities even? How do they interpret GDPR? Like it's so easy to say that, no, no, no, we are not allowed, GDPR doesn't allow. Not all data is GDPR. First of all. So let's start from there. And then what is under GDPR? Let's see if the GDPR allows to share the data exchange and share the data, the intelligence or not. It's not all restricted, right? And then the internal policies of the banks and fintechs, they have to correspond. You have to have enough resources. Then you have to have your IT department ready to install the systems right. Some systems are more complicated than the others. It does take time. So I say that 2027 it's already —

Dr Nicola Harding Based on everything that you've seen and experienced in Estonia and right from your origins in the beginning as a diplomat, what do you think is the most important thing that public authorities need to do differently to make this happen?

Siiri Graabi Public authorities have to be more open and more willing to share themselves while they should set the example that sharing is fine. As well, discuss with us the new possible financial measures and sanction regulations where we could give our feedback, improve the wording of the regulations, say straight away that it wouldn't work. So, yeah, this is where we should start, kind of the openness, from as well from the public sector side.

Dr Nicola Harding Completely agree. What do you think is the biggest misconception that European banks have about intelligence sharing right now?

Siiri Graabi That we all want to get the other banks' clients to ourselves, but it's not the case. I don't actually want your criminal to become my client. I just want to receive the information and intelligence to know if my doubts are correct. Or I don't want your client. I just want your client to receive the funds and I need the date of birth to eliminate the sanctions applicability.

Dr Nicola Harding For a compliance officer at a mid-sized bank in Germany or France listening to this right now, what would their version of what you've built actually look like? Where would they need to start?

Siiri Graabi That would look pretty much like we have in Estonia, right? But it's just that they need to start understanding that it's a requirement and they should change their mindset that it's a will and they shouldn't be afraid that it will bring much more workload. Actually, it helps to do the investigations much faster, much simpler. You have much fuller reports, so it benefits. And it doesn't create more work. So this is where to start, of shifting the mindset.

Dr Nicola Harding What's one thing that Estonia did right that the rest of Europe hasn't understood yet?

Siiri Graabi We started straight away from doing and not —

Dr Nicola Harding The moment you realised that the system was actually working?

Siiri Graabi That was like, wow, it really works. The transactions actually go through much faster. You don't have to have this extra work for sending SWIFT messages to another bank in Estonia. Or you don't have to call to another colleague in the bank who has actually already changed the position or moved to another bank or on maternity leave or parental leave or, you know, enjoying the life in Bahamas. All of the sudden, some of the things became so simple.

Dr Nicola Harding What piece of regulation do you wish you could rewrite now that you've seen the other side?

Siiri Graabi I don't know if there would be any real regulation I would write differently, but I would engage the financial associations more to understand better how actually the banks work.

Dr Nicola Harding And the one thing that public authorities could do tomorrow that would make the biggest difference?

Siiri Graabi Open, start sharing and don't treat us like enemies but as collaborators.

Dr Nicola Harding And finally, if you weren't doing this, what would you be doing?

Siiri Graabi I would be probably living in New Zealand, being a shepherd, reading the books under the tree in the shade and having my daughter and my dog with me and just, you know, enjoying life. Or I would do the charity work.

Dr Nicola Harding Brilliant. That sounds idyllic. It really does.

Siiri you've been an absolute brilliant guest. I'm so fascinated and I honestly could just talk to you all day. Thank you so much for joining us today. Really, really appreciate it and for sharing your experiences and for all the work that you've done both in Estonia and in the EU. Thank you so much.

Siiri Graabi Thank you once again for having me and it was really a lovely chat.

In this post, we recap the key takeaways from a recent episode of Follow the Money, in which criminologist Dr Nicola Harding sits down with Taavi Tamkivi, Salv's CEO, and Diana Karyan, Salv's legal counsel, to work through five of the most persistent legal myths keeping financial institutions from sharing intelligence. Diana spent years navigating the intersection of GDPR, banking secrecy law, and the incoming EU AML regulatory package. The conversation covers what the law actually allows — and why the legal architecture for collaboration has existed for longer than most compliance teams realise.

Myth 1: GDPR makes data sharing between banks illegal

This is the most commonly cited blocker. A compliance officer or DPO says "we cannot share customer data with another institution because of GDPR" — and the conversation ends there.

Diana explains where the confusion comes from:

"GDPR is not a legal prohibition. It never was. It is a different framework that specifies the conditions under which personal data processing is lawful."

— Diana Karyan, Legal Counsel, Salv

Article 6 of the GDPR and Recital 47 have always recognised fraud prevention as a legitimate interest. That legal basis existed before the AML regulatory package arrived. What has changed is that AMLR Article 75 now provides an explicit EU-level framework for information-sharing partnerships — mandating regulatory oversight and data protection impact assessments, but leaving no serious argument that sharing is prohibited. PSR and PSD3, which reached political agreement in November last year, go further still, making fraud detection and prevention not just permitted, but expected.

The real issue, as Taavi explains, is not the law — it's ownership:

"If you just go to your DPO and ask 'can I share customer data with another bank?', the obvious answer is no — because you haven't explained why, what the use case is, what governance structure is in place. Someone has to be the business owner for this. Without that, even a strong legal basis isn't enough."

— Taavi Tamkivi, CEO and Co-founder, Salv

DPOs and CISOs are stakeholders, not initiators. The business case has to be built first — specific use case, governance framework, data minimisation controls — before legal review becomes productive.

Myth 2: Banking secrecy laws prevent us from sharing anything

Banks in Central and Eastern Europe frequently cite their national Credit Institution Acts as an absolute barrier. The fear is real: individual compliance officers worry about personal criminal liability for disclosing customer data.

Diana explains why the framing itself is the problem:

"A lot of times I hear practitioners asking which obligation wins — banking secrecy or AML law. That framing assumes a conflict between the two. The first thing to establish is that they are not in conflict. They are in a structural relationship."

— Diana Karyan, Legal Counsel, Salv

Banking secrecy is a general obligation. AML law provides a specific statutory exception to it. Once you understand the structure, the conflict dissolves.

She points to Estonia as one of the clearest examples. The Credit Institution Act establishes a broad banking secrecy obligation. Section 16 of the Money Laundering and Terrorist Financing Prevention Act then provides an explicit exception — purpose-limited, controlled, and specific to financial crime prevention. The two laws coexist. Neither wins because they were never at war.

Taavi adds a detail that tends to surprise people:

"I was quite shocked to see that the Bank Secrecy Act has about twenty exceptions — police, tax, customs, and many others. AML data sharing is just one of them. Banking secrecy is a bit over-dramatised. As a customer, it's quite shocking to realise how many organisations can lawfully access your bank data if they have legal basis."

— Taavi Tamkivi, CEO, Salv

The EU's shift from directives to regulations matters here too. Historically, six generations of AML directives required national transposition — leading to inconsistency, delay, and fragmented enforcement. AMLR is a regulation. Once its applicability date arrives in July 2027, it is law across every member state simultaneously, with no transposition process and no room for gold-plating. PSR is also a regulation.

Myth 3: Sharing information between banks constitutes tipping off

This one genuinely frightens compliance teams. Tipping off is a criminal offence. The fear is that if Bank A and Bank B share intelligence about the same individual, the suspect could somehow find out they are under scrutiny.

Diana explains what tipping off actually covers:

"Tipping off prohibition applies to the unlawful disclosure to the customer or any third party that a suspicious transaction report has been filed, that an investigation is underway, or that information has been requested by the FIU. Its target is the subject of suspicion — not the parties who might alert each other."

— Diana Karyan, Legal Counsel, Salv

Inter-institutional intelligence sharing and tipping off are governed by different legal instruments. AMLR Article 75 and PSR Article 83A expressly permit information sharing between financial institutions, drafted with the explicit understanding that effective financial crime prevention requires intelligence to flow. They coexist with tipping off prohibitions — they don't conflict with them.

Technology and operational controls handle the residual risk. On a platform like Salv Bridge, only credentialled representatives of member institutions have access. There is no pathway by which a suspect could be informed. Audit logging, four-eye principles, and pre-agreed governance structures manage the risk that remains — which is no different in kind from the internal tipping off risks that already exist in every AML investigation.

Taavi notes what happens in practice:

"When we launched, tipping off was among the top ten objections. After banks started actually exchanging information, I've never heard the question come back. That's the ultimate proof — the risk exists, but it is very well mitigated."

— Taavi Tamkivi, CEO, Salv

Myth 4: AML and fraud are the same problem

This myth works in the opposite direction. Rather than preventing action, it causes institutions to conflate two legally distinct regimes and build solutions that may be non-compliant by design.

The reality, as Taavi explains, is more complicated:

"Yes and no. I've spoken to very senior heads of AML who haven't heard of PSR or mandatory reimbursement. And vice versa. They're working in their own silos — which are enormous — and it's understandable."

— Taavi Tamkivi, CEO, Salv

The convergence is real. The Financial Action Task Force, historically focused on AML, is moving rapidly into the scam and fraud space, because the pattern is now classical: fraud converts into money laundering. But the tools used to fight each problem were built for a different era.

Legacy AML transaction monitoring systems were designed for a world where money laundering involved large transactions, slow timelines, and limited volume. Scam fraud looks nothing like that — it is high-frequency, real-time, and involves authorised payments that look indistinguishable from normal behaviour. Old AML tools are not fit for this purpose. Neither are legacy card fraud systems, which were built for unauthorised transactions, not authorised push payment scams.

"There's a middle part between old AML and old fraud that neither covers. That's where data sharing, real-time monitoring, behavioural profiling, and device fingerprinting all become relevant. New tool categories are emerging to fill it."

— Taavi Tamkivi, CEO, Salv

Merging the two regimes without understanding the legal distinction creates its own compliance risk. AML and fraud have different statutory obligations, different reporting requirements, and — under PSR — different reimbursement rules. Treating them as identical leads to both operational gaps and potential non-compliance.

Myth 5: We don't need to do this until the law forces us to

The wait-and-see position has some internal logic: regulation is not yet fully enforced, supervisors haven't mandated participation, and peers are not moving. Why go first?

Taavi works across multiple European markets and sees the cost clearly:

"Countries are moving at very different speeds. Some aren't moving at all. Others are already running RFPs and forming task forces. But new product approval processes take 12 to 18 months — from start to live. Count the months back from July 2027 and there aren't many left."

— Taavi Tamkivi, CEO, Salv

The commercial risk is measurable. Mandatory reimbursement under PSR means that APP fraud losses — which were previously absorbed by customers — will increasingly fall on banks. Every month of delay is a month in which preventable fraud losses are not being prevented, and a month closer to liability under a reimbursement regime that is already coming.

On the regulatory side, the question is not whether fines will arrive but when. AMLR's direct applicability removes the ambiguity that existed under directives. There is no transposition gap to hide in.

Diana puts it plainly:

"The upcoming regulation doesn't just permit sharing — in some cases it mandates it. The question institutions should be asking is not 'are we allowed to do this?' but 'what is our plan for compliance?'"

— Diana Karyan, Legal Counsel, Salv

There is also a network effects argument. Institutions that participate in shared intelligence networks early help shape the standards, governance models, and interoperability frameworks that the rest of the market will eventually adopt. Those who wait will find themselves onboarding into a structure they had no hand in designing.

What the law is actually inviting

The legal architecture for financial crime collaboration exists. GDPR provides the lawful basis. Banking secrecy laws contain explicit AML exceptions. Tipping off prohibitions govern a different set of actors. AMLR and PSR are regulations — directly applicable, with hard deadlines, and no room for local reinterpretation.

What remains is institutional will. The decision by compliance teams, general counsels, and executive leadership to move past these myths — and to build the infrastructure the law is actively inviting them to build.

The myths persist not because the law is ambiguous, but because no one in the organisation has taken ownership of the use case. That is a business problem, not a legal one. And it is one that can be solved.

This article is based on an episode of Follow the Money with Dr Nicola Harding, featuring Taavi Tamkivi and Diana Karyan. Watch the full episode here.

This is because of the AML stack most EMIs inherited from a simpler era. It doesn't fit the business anymore, and that's beginning to be a concern for regulators.

What changed for EMIs

EMIs are no longer treated as "fintech lite". Under the EU AMLD framework and the UK Money Laundering Regulations, they carry the same CDD, monitoring, SAR and governance obligations as a bank, but operate nothing like one.

There are four key problems:

• Instant rails have no buffer: SEPA Instant and Faster Payments both clear in seconds, so by the time a T+1 monitoring rule fires, the money has hopped twice.
• Fraud and AML have merged: account takeover flows into mule payouts, romance scams end in laundering chains, and regulators expect EMIs to detect the AML side of fraud, not just process chargebacks.
• Most EMIs operate across several jurisdictions: a Lithuanian licence, a UK partnership, customers in the Baltics and beyond, with each supervisor's risk appetite, expectations and typology focus defying a single global rule set.
• Customer expectations are brutal: any hold or "please verify" message becomes a support ticket and Trustpilot review, while regulators reject customer experience as an excuse for weak controls.

In short, bank-grade AML must run on EMI rails, with the constraints of fewer staff and higher customer expectations.

What good architecture looks like

The EMIs that pass audits run screening, monitoring and risk scoring as one decision layer, with each capability fed by the others. For them, sanctions screening is zero-tolerance and real-time; PEP and adverse media screening is risk-based. That's standard. What's less so is screening that produces usable context, not just a binary hit/no-hit, but match confidence, which list triggered it, whether the customer has been cleared before, and how their screening behaviour has shifted.

This doesn't require new data. It uses data they already collect, but in the correct context. Device IDs, IP ranges, login anomalies, recent profile changes, velocity spikes, new beneficiaries added minutes before a high-value transfer, customers who contacted support in distress then tried to increase their limit — all sits in fraud systems, product logs and CRM tables, but for most EMIs, little reaches the AML monitoring engine.

Smart EMIs use it to make scenarios sharper. Instead of "high-value payment to high-risk country," which fires constantly to little effect, the rule can be: new device + unusual country + first high-value outgoing instant payment within 30 minutes of a phone number change → block and escalate. That rule catches account takeover but barely fires for legitimate customers.

Risk scoring must keep up. Static onboarding ratings are a compliance fiction. Customers drift and fraud happens, so the score should recalculate as new signals arrive and feed back into the monitoring engine so a customer crossing a threshold automatically picks up tighter scenarios. A risk score in a CRM record that isn't read by anything downstream is useless.

Screening context belongs inside monitoring rules

Most vendors treat screening and monitoring as separate products: screening sees the customer's name and details, monitoring sees the transaction, and the alerts go into separate queues. What I wish I'd understood earlier is that the signals are most valuable together.

A near-miss PEP match is interesting. Combine it with a sudden 10x increase in outgoing volume to a new beneficiary in a higher-risk corridor and it becomes actionable. A sanctions match confidence score of 62% on a common name is usually a false positive, but if that counterparty appears in three other customers' outgoing payments that week, a mule ring is lighting up.

Here's the rule pattern that unlocks this:

IF customer has any screening context in the last 90 days (cleared PEP, adverse media hit, near-miss sanctions) AND transaction crosses velocity/counterparty thresholds → elevate risk score and route to enhanced review.

A monitoring engine can't run that unless it can read screening outcomes as a data field. Those that can, in my experience, cut false positives by 80–90% while catching patterns they once missed.

The point for an MLRO: screening and monitoring should sit in one decision layer where screening outputs feed monitoring scenarios and risk scoring reads from both.

What this looks like in practice

With screening, monitoring and risk scoring in one engine, a cleared sanctions near-miss from last quarter stays visible as context, not noise. New fraud signals — a device change, a SIM swap, a support complaint — raise the risk score immediately and tighten rules evaluating the next payment. Counterparty-level patterns surface at network level; a receiving account hit by unrelated victims appears as a ring, not four disconnected alerts. Jurisdiction-specific logic runs in parallel: UK customers evaluated against UK expectations, Baltic against Baltic, with one audit trail.

This doesn't depend on consortium data sharing, an ML black box or a multi-year build, only a platform flexible enough to treat the institution's own data as first-class inputs.

The honest test for an MLRO is whether their current tool can run a monitoring scenario that references last month's screening outcome against a current transaction. If it can't, that gap becomes a harder conversation with the supervisor over the next 12 months. The EMIs already ahead got there through architecture, not compliance headcount: AML running as one decision layer that gets smarter as more data flows through it. That's the shift worth making now, before regulators force the timeline.

If you have any questions, don't hesitate to reach out today.