The Partnership for Information Sharing – the new EU way to keep up with money launderers and terrorism funders (part 4)

Navigating the North Sea between Scylla of AML/CFT and Charybdis of GDPR (privacy)

To understand the challenges which the recent European efforts to establish the effective AML/CFT information sharing did face, one shall acquaint him/herself – at least partly - with the ambition which the already famous Dutch Transactie Monitoring Nederland (TMNL) didn’t live up to*.

The TMNL was an ambitious project (and a separate legal entity) that 5 Dutch banks, ABN AMRO, ING, Rabobank, Tridos Bank and De Volksbank established in 2020 to – jointly (although “by the hands” of TMNL) – monitor (AML/CFT-wise) the transactions of their customers. Although the project seemed very promising, the publication of the AMLR in the Official Journal has put an end to this model of activity.

?

The confrontation with the exact text of the art. 75 of AMLR was not the only challenge that TMNL had to face at the time (the direct counteraction by the Dutch Human Rights in Finance Foundation (HRIF) was another one: see https://hrif.eu/wp-content/uploads/2024/07/HRIF-Zienswijze-138c-WvSr-incl.-vertaling-GERED.pdf pp. 5-7 as well as https://hrif.eu/en/2024/04/tmnlstopuk/).

However, these were the “impossibilities” of the art. 75 AMLR, like:

• inadmissibility of pooling information on ALL (not just “higher risk”) customers of the community of the partnering obliged entities,
• unacceptability of transferring the information on customers OUTSIDE of the partnership itself (incl. to another, specialized entity, like TMNL)

which became the root causes – IMHO – of the final July 2024 declaration that “TMNL will wind down its existing activities and capabilities in the coming period” (see the full text: https://tmnl.nl/en/article/transaction-monitoring-netherlands-adapts-its-working-method-to-new-european-legislation/). Many AML/CFT experts throughout Europe were sad to learn it but the TMNL's final decision actually seems inevitable.

What I would like to convey by this unusually short article of today is the message that the art. 75 AMLR (introducing the PFIS) is not any “promise of paradise” for the troubled community of obliged entities which become suspicious regarding transactions and fight scams and frauds every day. It is rather the raw but already rigorous framework for working out the proper formula(s) for establishing PFIS and for PFIS' operations. If these works are to be successful, they need a careful as well as close cooperation of the key partners which shall have their roles in forming these PFISes:

• supervisory authorities,
• authorities in charge of verifying compliance with GDPR,
• FIUs,
• obliged entities

all of them listed in art. 75 (2) of AMLR:

“Obliged entities intending to participate in a partnership for information sharing shall notify their respective supervisory authorities which shall, where relevant in consultation with each other and with the authorities in charge of verifying compliance with Regulation (EU) 2016/679, verify that the partnership for information sharing has mechanisms in place to ensure compliance with this Article and that the data protection impact assessment referred to in paragraph 4, point (h), has been carried out. The verification shall take place prior to the beginning of the activities of the partnership for information sharing. Where relevant, the supervisory authorities shall also consult the FIUs.”

Some of these entities were just listed, even without any particular function ascribed (like FIU). It is a sign, IMHO again, of how much the very regulators were uncertain regarding how the PFIS should really be formed and how it should work in reality. These uncertainities resulted from the - not conclusive enough - efforts to reconcile the already established principles of GDPR (or privacy in general) on the one side and of AML/CFT on another.

However, if there is already such a list of parties (although not all of them will become the final partners to the PFIS), they shall all work together to find the ways to make PFIS a reality. And they should start ASAP.

to be continued...

?

6 November 2024

The above publication contains its author’s private opinions only.

?

(*) Although the full story about TMNL is definitely much more complex and interested, I just wanted to share just a short summary of it with those of you who were not familiar with this case yet.

?