Egmont Group ¦ Effective PPPs – Practical Guidance for Design, Governance and Operationalisation in the Fast-Changing ML/FT Context

Public-private partnerships need governance before they need data

Criminal networks spread their activity across banks, jurisdictions and asset classes so that no single institution sees the whole scheme. Public authorities hold enforcement powers and intelligence, while private institutions hold real-time transaction data and detection systems. Public-private partnerships (PPPs) are meant to close that gap, and the Egmont Group of Financial Intelligence Units has published practical guidance on how to design, govern and run them in the fight against money laundering and terrorist financing. It treats a PPP as a mechanism for systemic resilience that works only when legal certainty, governance, trust and measurable outcomes are built in from the start.

The guidance covers the whole lifecycle: legal feasibility and strategic anchoring, the governance architecture, the respective duties of authorities and private partners, trust, information exchange models, technology, adaptability, effectiveness measurement and the role of financial intelligence units. It addresses public participants such as FIUs, law enforcement, prosecutors, supervisors, ministries, tax and customs authorities, and private participants that traditionally include financial institutions, VASPs, DNFBPs and NPOs, and may extend to technology providers, academia, social media and telecommunications companies.

Legal certainty is the first precondition

Legal uncertainty, together with a lack of practical benefit, is one of the main reasons private institutions hold back from PPPs. Clarity prevents both over-sharing, which may breach confidentiality, and under-sharing, which weakens the partnership. The guidance describes a combination of instruments. Targeted legislative amendments give the strongest certainty where current law does not permit strategic sharing, structured case-level exchanges or private-to-private sharing. Memoranda of understanding do not create new powers but operationalise existing ones by fixing scope, safeguards, confidentiality and access rules. Explicit safe harbour protection for good-faith participation reduces defensive compliance behaviour. Standard templates, documented purpose limitation, access controls and audits complete the picture. Information sharing must be lawful, and it must also be perceived by participants as legally safe and institutionally supported.

Data protection is treated as a design question. Purpose limitation means information must be tied to a documented AML/CFT objective; sharing a full transaction history “just in case” would breach proportionality, while sharing specific patterns indicating trade-based money laundering within a defined working group may be justified. Data minimisation favours anonymised behavioural indicators over identifiable details, and the lawful basis – under the GDPR typically the statutory AML/CFT obligation or public interest – should be written into the PPP’s documentation. Retention limits, role-based access, audit logs, pseudonymisation, attention to data subject rights and early contact with the data protection authority complete the set of safeguards. The guidance notes that several PPPs, including the Austrian and German partnerships and the EFIPPP, only addressed data protection once they had matured, so partnerships may also be designed to integrate the topic later.

Bastian Schwind-Wagner _Follow

"Public-private partnerships usually stall over legal uncertainty and a lack of visible results. The Egmont guidance is useful because it is concrete about the plumbing: legal gateways, safe harbour, data protection by design, workplans tied to the national risk assessment and indicators that show whether anything changed.

For obliged entities, joining a PPP means sending people who can change monitoring scenarios, treating shared intelligence with discipline and never using it as a shortcut to de-risking. In return, they can expect structured feedback and equal treatment from the authorities."

Anchoring the partnership in documented risks

A PPP without a link to documented risks drifts towards whatever headline is current. The partnership should name its strategic foundation – the national risk assessment, sectoral assessments, FIU strategic analysis, supervisory risk outlooks, law enforcement threat assessments, sanctions risk analyses and FATF evaluations – and translate it into concrete themes. If the national risk assessment identifies trade-based money laundering as a major vulnerability, the PPP should have a working group or workplan on it.

An annual or biannual workplan should list priority risks, such as sanctions evasion, professional money laundering networks or crypto-mixing services, assign leads, define outputs such as typology papers, red flag updates or guidance notes, and set timelines. A simple impact-likelihood matrix can help prioritise, but expert judgement should prevail. Risk anchoring also determines participation: a focus on trade-based laundering calls for customs authorities and trade finance specialists, a focus on crypto-assets for VASPs and blockchain analytics experts.

Buy-in, resources and a realistic mandate

Without visible support from senior leadership, a PPP risks becoming symbolic or under-resourced. Endorsement at ministerial, board or executive level gives legitimacy, ensures that representatives can commit their institutions, protects the partnership during uncomfortable discussions and secures continuity when priorities or people change. The guidance recommends presenting a clear value proposition – better STR quality, better supervisory targeting, stronger international reputation – involving leaders in the design phase, and formalising the PPP through a ministerial mandate, board approval or inclusion in the national AML/CFT strategy.

On resources, liaison officers should have PPP duties written into their job descriptions, meeting time should be institutionalised, secure infrastructure funded and administrative support assigned; a small secretariat can make a significant difference. Expectations should be modest and phased, for instance starting with strategic exchange before moving to operational cooperation. The rule of thumb: decision-makers on the governance level, subject matter experts in the working groups.

Governance in three layers

The guidance describes three layers. The strategic steering layer sets objectives and reviews performance. Because partners arrive with different priorities – authorities with disruption and evaluation results, supervisors with compliance quality, law enforcement with evidential value, private institutions with regulatory clarity and operational feasibility – objective-setting should start with an expectation-mapping exercise in which each partner states its problem, its definition of success, its constraints and what it can contribute. Common and partner-specific objectives should be distinguished, framed as risk reduction rather than institutional advantage, matched to each partner’s mandate and reviewed regularly.

Performance indicators fall into three groups: operational, such as STR quality in targeted areas, faster urgent exchanges, adopted red flags and asset freezes linked to PPP intelligence; strategic, such as inclusion of findings in the national risk assessment or supervisory guidance; and engagement, such as participation, diversity and follow-through. An annual review should ask whether the PPP addresses the risks it committed to, whether it produces measurable improvements and whether adjustments are needed. The steering layer also decides on dissemination: closed models suit sensitive operational work, open models extend preventive reach, and many mature PPPs combine the two.

Operational working groups do the substantive work. Typology analysis should go beyond describing past cases to identify triggers, structuring techniques, exploited gaps and indicators that can actually be built into monitoring systems. Red flags should be behavioural rather than formal – rapid movement of funds through newly created entities without economic activity says more than an offshore incorporation – distinguish primary from contextual indicators, be tested for operational feasibility and false positive rates, come with an explanation of the underlying typology and be reviewed periodically. A technical and data subgroup handles secure exchange.

Operational intelligence with safeguards

Sharing information on specific individuals, entities or networks multiplies impact but also legal complexity. Its purpose is to enable enhanced monitoring within legal limits, not to outsource investigations or create informal blacklists. Authorities may share identifiers where permitted, associated entities, behavioural and transactional patterns and geographic or sectoral exposure. The guidance sets out safeguards: an explicit legal basis, strict purpose limitation, no automatic account closures without an independent internal assessment, no de facto sanctions regimes outside judicial processes, restricted access, a ban on onward dissemination without consent, documentation of what was shared under what authority, and avoidance of classified information where possible.

Three forms of exchange are described: direct targeted sharing under predefined crisis protocols where assets risk being dissipated, pattern-based sharing that describes a network without full identifiers so institutions can screen internally, and structured information requests with partial identifiers and voluntary feedback. The guidance recommends introducing operational exchange progressively, once legal clarity and trust are sufficient.

What each side owes the partnership

Public authorities must provide strategic direction and contextual intelligence, be explicit about what constitutes good reporting, and institutionalise feedback, which is one of the most common frustrations in AML/CFT systems. They must treat participants equally, without regulatory leniency or privileged access, protect confidentiality – even within the FIU, onward disclosure to other departments requires prior authorisation – coordinate among themselves, refrain from shifting investigative work to private partners, allocate resources and be transparent about their limits.

Private partners must send representatives who can change monitoring frameworks and procedures, share operational insights in good faith, contribute to typologies and adjust controls on the basis of PPP outputs. Shared intelligence must not lead to automatic de-risking or indiscriminate account closures, and must never be used for competitive advantage. Feedback on red flags that generate excessive false positives is part of the role. Contributions should be reciprocal, with larger institutions contributing more.

Capacity asymmetry gets particular attention. Large banks with dedicated intelligence teams and data science capacity can dominate discussions and produce red flags that smaller institutions, fintechs or non-financial obliged entities cannot implement. Tiered participation, scalable guidance with basic and advanced options, joint training, accessible platforms and a culture in which resource constraints can be discussed openly help avoid a two-speed partnership. The same asymmetry exists among public authorities.

Trust is cumulative

Trust rests on clear roles, equal treatment, transparent decision-making, visible results, strict confidentiality, reciprocity, continuity of representatives, room for disagreement, realistic expectations and an understanding of the different incentives in the public and private sectors. A single breach of confidentiality can undo years of work. Trust cannot be mandated, but it can be structured through consistent governance and nurtured through repeated cycles of shared analysis, responsible exchange, feedback and observable results.

Strategic, operational or hybrid

The strategic-only model exchanges anonymised or aggregated typologies, trends and sectoral vulnerabilities. It is the easiest to set up where legal constraints are tight, reaches the widest audience and can share outputs with the whole sector or the public, but outputs take longest to prepare and show effect. The operational case-based model shares targeted information on individuals, entities or transactions, often within days or hours, with a narrow group of affected participants and strict safeguards. The hybrid model, used by many mature PPPs, layers broad strategic sharing, restricted tactical alerts and tightly controlled operational intelligence.

Technology, agility and measuring results

Technology moves PPPs from dialogue to structured collaboration through secure platforms, shared typology and red flag libraries, privacy-enhancing technologies such as secure multi-party computation and federated learning, structured templates, audit logs and scalable access rights. AI can help cluster indicators or detect trends, but it must remain human-driven, explainable and supervised. Technology should match the PPP’s maturity; overly ambitious tools at an early stage can overwhelm participants.

Agility is one of the strengths of PPPs, but it must be structured: annual reassessment of priorities, predefined crisis protocols for sanctions developments, terrorist financing alerts or fraud waves, temporary working groups with sunset clauses, documented approval of changes by the steering layer and controlled inclusion of newly exposed sectors.

Effectiveness should be measured across operational impact, strategic impact, system improvement – such as less low-value reporting and better calibrated monitoring – and partnership health. The guidance warns against over-attribution: the aim is to show plausible contribution, not exclusive credit. Measurement should support improvement, not rank institutions.

Transnational PPPs and the role of FIUs

Transnational PPPs already exist, most visibly in Europe, and are most viable around inherently international threats such as sanctions evasion networks, virtual asset misuse, large-scale cyber-enabled fraud, trade-based laundering, terrorist financing by large groups and professional laundering networks. They need a credible convenor. Information can flow through FIU channels, which offer established safeguards but may slow multidimensional cooperation, through broader governed frameworks involving supervisors, law enforcement and private institutions, or through a tiered hybrid. FIUs can use the Egmont Secure Web to find counterparts with PPP experience, within the Egmont Principles for Information Exchange. The guidance also recognises the growing role of private-to-private cooperation.

FIUs are described as primus inter pares: intelligence integrators with a system-wide view of suspicious activity, trusted intermediaries between reporting entities and law enforcement, contributors to supervisory alignment and anchors for risk-based prioritisation. Because their capacity is limited, they should concentrate on what only they can provide – aggregated insight, cross-sector pattern detection, prioritisation and structured feedback – and leave administrative coordination to others.

What this means for obliged entities

For banks, fund managers, VASPs and other obliged entities, the guidance sets out what to expect from a well-run partnership and what will be expected of them. Participation means committing senior, empowered representatives and analytical resources, turning typologies and red flags into monitoring changes, handling shared intelligence confidentially and proportionately, and giving honest feedback when indicators do not work. In return, institutions should expect clear legal gateways, structured feedback on reporting, equal treatment and protection for good-faith sharing. Luxembourg institutions will recognise the direction of travel: since July 2026, the CRF may share fraud-related tactical and operational information directly with specified credit institutions, payment-sector entities and VASPs, which makes internal processes for receiving and acting on such information a practical necessity.

Dive deeper

• Egmont Group ¦ Effective PPPs – Practical Guidance for Design, Governance and Operationalisation in the Fast-Changing ML/FT Context ¦ Link