FATF’s Latest Report Sheds Light on Effective Privacy Frameworks

FATF’s new report just dropped Wednesday (8 July), and the whole theme is centered around driving collaboration to overcome privacy hurdles.

In this report, the FATF highlights the effectiveness of Public-Private Partnerships (PPPs) in various jurisdictions around the globe. In many real life examples, they are proven to be effective for enhancing operational effectiveness.

The aim of this report is to encourage public and private sectors to adopt what works from these PPPs in order to better combat financial crime.

‍

Public-Private Partnerships (PPPs)

As digitalisation drives financial inclusion and transactional complexity, organisations are beginning to realise that establishing partnerships are a necessary prerequisite for overcoming intelligence gaps when tackling complex financial crime.

With this in mind, governments and private sectors form Public-Private Partnership (PPP) to stifle financial constraints, ensure clear standards of accountability, as well as extend operational and investigative reach.

Based on the report, 84 PPPs operate in 51 jurisdictions globally. Each tailored to the needs of the region, varying in purpose, governance and intelligence shared. About 62% of PPPs are coordinated by Financial Intelligence Units (FIUs), government agencies specialising in handling money laundering.

‍

What Works in APAC

The report draws us in on real-life examples of effective PPPs in APAC. 

1. Singapore’s ACIP

Singapore’s AML/CFT Industry Partnership (ACIP) was launched in 2017. Just 2 years later, an alert from a partner bank to the Commercial Affairs Department (CAD) led to the conviction of a CFO in a scheme that embezzled 16 FIs of over USD 469 million.

‍

2. Singapore’s COSMIC

Formed by Singapore’s MAS and 6 major banks, COSMIC is an AML/CFT digital platform that allows various FIs to securely document and share intelligence on high-risk profiles. This platform proved effective in 2023, uncovering a S$3 billion money laundering scandal and the vast underground network behind it.

‍

3. Australia’s Fintel Alliance

AUSTRAC launched its own PPP in 2017, with the initiative helping to disrupt an AUD 4 million “cuckoo smurfing” scheme (a money laundering technique involving wire transfers) through their collaborative analytics, as well as flagging a high-value target behind the scheme. 

‍

4. Indonesia’s SIPENDAR

Indonesia’s 2021 SIPENDAR online platform was pivotal in tracking and securing convictions of ISIS-linked networks involved in crypto funneling through humanitarian fronts.

‍

5. Hong Kong’s ADA

Hong Kong’s Anti-Deception Alliance (ADA) utilises a 24/7 stop-payment mechanism to expedite the interception of fraudulent payments and make recovery of stolen funds faster. Just last month in June, the ADA dismantled a romance-investment fraud syndicate which cost victims upwards of HK$10 million.

‍

Operational Challenges

The report featured results from a survey listing 

According to a survey conducted for the report, there were 4 main challenges when propping up

• Data protection and privacy rules (the biggest challenge, accounting for 52% of jurisdictions)
• Restrictive banking secrecy laws
• Lack of clear legal gateways for sharing sensitive data
• Lack of trust between stakeholders

The FATF urges PPPs to work with, and not against data protection authorities. Data protection authorities must be responsible for providing clear legal expectations and guidelines for sharing data.

‍

What Makes PPPs Successful

The report states that the PPPs that excel are the ones that conform to an iterative process: start by sharing strategic information to build trust, before expanding their scope to include more sensitive, case-specific operational data exchanges.

We are also seeing the emergence of private-to-private (P2P) information sharing mechanisms, which enables PPPs to better identify money laundering and terrorist financing.

As fraud exponentially acclimates to technological progression, the FATF stresses the need for close collaboration between FIs and VASPs, as well as non-traditional stakeholders such as social media and messaging platforms. Fraud no longer happens in payment rails, but can now happen outside that perimeter at more varied touchpoints.

‍

The Gaps We Need to Seal (L5 Unique Perspective)

The 4 operational challenges mentioned remain a governance challenge. The technology to securely transfer PII already exists (distributed tokenisation, hashed identifiers, secure multi-party computation). What is missing is the legal architecture to deploy it without ambiguity. Until data protection authorities and financial crime stakeholders build that framework together, the friction will remain, and the gap it creates will continue to be exploited.

In addition to this, only 51 jurisdictions out of 195 nation states deploy PPPs. That means that slightly over a quarter of the world has PPPs. The rest of the world remains dark where financial crime actors have an easier time to traverse loopholes and openings left by disconnected sectors.

‍