/>iIn 2024, the National Crime Agency (the “NCA”), which is the UK’s lead agency against organized crime; human, weapon and drug trafficking; cybercrime; and economic crime, announced its “groundbreaking” data sharing partnership with seven UK banks, namely Barclays, Lloyds, Metro Bank, NatWest, Santander, Starling Bank, and TSB.[1]
This new public-private partnership (“PPP”) was the largest of its kind anywhere in the world and the initial results of the project suggest it is revolutionizing the fight against financial crime.
Joint Analysis of Transactional Data that is Indicative of Potential Criminality
The project involved the seven banks voluntarily sharing customer and transactional data with the NCA with the aim of tackling criminality and kleptocracy, and preventing the flow of “dirty money” through the UK’s financial system. AML subject matter experts from the seven banks were then seconded to the NCA to work directly alongside the NCA’s own analysts in the scrutiny of banking data that is suggestive of criminal behavior, with the dual goals of identifying bad actors that are exploiting and misusing the financial system while ensuring that legitimate customers are left alone.
Promising Results
PPPs can be vastly effective in tackling the complexities of financial crime. Principally, this is because they help to bridge gaps in intelligence and enable more holistic or collaborative analytics. In the UK’s case, the NCA has reported that since the project went live in 2024, eight new criminal networks already have been confirmed. In addition, a further three suspicious networks have been identified and referred to the NCA’s intelligence division for further examination, while new leads have been uncovered related to 10 of the agency’s largest ongoing investigations. In sum, data sharing of this sort appears to be materially augmenting the ability of law enforcement to detect and disrupt criminality. The likely result will be the reduction of the financial crime risks that all banks have to manage on a daily basis and a consequential decrease in their “compliance costs.”
Data Protection Considerations
The major concern about data sharing initiatives of this sort relates to privacy, and banks have long been wary of sharing customer data with third parties for fear of contravening applicable data protection laws. On this, Andrew Searle, the Director of the NCA’s National Economic Crime Centre, has said, “the NCA and its banking partners have designed the [project’s] data sharing principles to ensure that only account data with multiple clear indicators of economic crime is included.” [2] Additionally, the banks have included in their terms and conditions the ability to share information without notification where the purpose of doing so is the fulfillment of the legal obligation to detect and prevent financial crime. Finally, the Financial Conduct Authority (the “FCA”), which regulates the UK’s financial services industry, is observing the project and providing an additional layer of oversight that has helped appease concern regarding inadvertent violations of data protection law.
Additional Considerations
A similar initiative has now been launched in Singapore: a digital platform called “COSMIC” (the “Collaborative Sharing of Money Laundering/Terrorism Financing (ML/TF) Information and Cases”) that allows six Singaporean banks, namely Citibank, Development Bank of Singapore (DBS), HSBC, Oversea-Chinese Banking Corporation (OCBC), Standard Chartered, and United Overseas Bank, to share information on customers exhibiting multiple red flags indicators of financial crime concern.[3] The major difference between the UK project and the Singaporean project is that the former is being led by the NCA, or UK law enforcement, while the latter, COSMIC, is a purely private sector initiative.
Given the promising results of the UK project and Singapore’s launch of COSMIC, we expect that other countries will follow suit in terms of facilitating the sharing of intelligence related to suspected money laundering, terrorism financing, and proliferation financing, whether it be via the PPP model or among only private sector participants. Either way, fostering true collaboration between multiple interested parties likely is going to be crucial in the effort to stay ahead of sophisticated criminals and emergent threats.
For that reason, it is incumbent upon public sector actors, from the perspective of preventing financial crime, to actively facilitate information sharing initiatives, for example by updating laws or supervisory instruments as necessary; making use of regulatory sandboxes and pilot programs; highlighting typologies or data types that would benefit from sharing; deploying secure platforms for sharing and oversight; promoting regular dialogue between data protection and AML/CFT authorities; and more.
Finally, banks around the world should remember that, even if currently they are not able to pool data with other stakeholders, for example because of applicable data protection laws or other jurisdiction-specific fundamental rights, they still need to do everything possible to mine the volumes of customer and transactional data that they already possess and/or can obtain from their correspondents, as well as the huge quantity of open source intelligence that is readily available online, for compliance purposes. This means not just performing real-time, list-based screening, but investing in additional headcount, advanced analytical solutions and experienced external counsel to conduct proactive investigations of post-transactional data, looking for suspicious typologies, actors, networks or other activities. Ever-increasing amounts of customer and transactional data need not be overwhelming; on the contrary, if viewed as a resource rather than a burden and if leveraged appropriately, they represent a material opportunity to better detect and prevent criminal activity, and to protect legitimate consumers.
FOOTNOTES
[1]Ground breaking public private partnership launched to identify criminality using banking data
[2] Ibid.
