AMLR Article 75: information-sharing partnerships

Article 75 of Regulation (EU) 2024/1624 is the only article in Chapter VI. It is titled “Exchange of information in the framework of partnerships for information sharing”. If you were expecting a penalties article or a supervisory power, this is not it. It deals with something quite different: letting obliged entities share information with one another.

What it allows

Members of a partnership may share information when strictly necessary to meet their obligations under Chapter III (customer due diligence) and Article 69 (reporting of suspicions), with respect for fundamental rights and procedural safeguards. The categories that may be shared include customer identity data, the purpose of the relationship, transactions, risk factors, your own risk analysis, retained records and information about suspicions.

The conditions

• Tell the supervisor first. You notify your supervisory authority before joining. The authority checks that the partnership has compliance mechanisms and that a data protection impact assessment has been done.
• No blind reliance. You must assess what a partner tells you before acting, and you must record when partner information fed a decision to refuse or end a relationship.
• Record everything shared.
• Higher-risk customers only. Sharing is limited to customers with higher-risk behaviour or transactions, those in the enhanced due diligence situations of Articles 29 to 31 and 36 to 46, or those where you need more information to decide whether the risk is higher.
• Data protection impact assessment before any personal data is processed.
• No passing it on, except in limited cases such as sharing with another obliged entity, reporting to an FIU, giving information to AMLA, or answering law enforcement or judicial requests.
• Suspicion data can be shared only if the FIU that received the report agrees.
• AI-generated information can only be shared with adequate human oversight.
• You need internal policies on scope, roles and risk assessment before taking part, and supervisors may require an independent audit of the partnership.

Where it applies

Think of a group of banks building a shared mechanism to spot a mule account network that moves funds across all of them. Today that kind of exchange sits in a grey zone, mostly because of data protection and tipping-off worries. Article 75 gives it a legal route, with guardrails.

Not to be confused with group sharing

Sharing inside a corporate group is a different thing, handled in Article 16 and, for the definition of the parent that carries the duty, Article 2(1)(42).

Our view

Most firms will not set up a partnership in 2027. The provision is permissive: it lets you, it does not make you. But if your sector is considering a shared utility, move early on the data protection impact assessment, because supervisors will ask for it.

What this means for you

Not sure whether a data-sharing arrangement you already run, or are being invited to join, meets these conditions? Use the enquiry form to talk to an expert.

General information, not legal advice.