The Outlier Lab

Consortium and Data Sharing

Sharing fraud intelligence across organizations, via FinCEN 314(b), bank-owned networks, industry consortia, ISACs and peer contacts, so repeat actors and mule destinations are recognized everywhere.

What it is

Fraudsters operate across institutions, while each defender by default sees only its own data. A mule account that received stolen funds at one bank, a scam payee reported at another, and a synthetic identity that busted out at a fintech are all invisible to the next target unless someone shares. Consortium and data sharing is the set of legal mechanisms, networks and operational practices that close that gap.

There's no single "consortium." Practitioners use several layers at once:

LayerWhat it isWho can participateTypical content
Statutory safe harbor (US): FinCEN 314(b)Voluntary sharing with liability protectionBSA-covered financial institutions, and associations of them, registered with FinCENCase-level details: accounts, transactions, identifiers, narratives, indicators
Bank-owned and network data utilitiesShared account-status and fraud data run by bank consortia or networksMostly banks, processors and fintechs via contractAccount validation, account-status and ownership signals, reported fraud
Commercial data consortiaVendors pooling client data into shared risk signalsContracting clientsDevice, identity, email, phone and payment reputation; consortium scores
Industry groups and ISACsSector communities sharing threat intelligenceMembersAttack indicators, typologies, alerts, early warnings
Peer-to-peer contactsAnalyst-to-analyst outreach, directories, working groupsPractitionersUrgent recall requests, case coordination
Government channelsReporting to and alerts from regulators and law enforcementReporting entitiesSARs, IC3 complaints, advisories, red-flag alerts

FinCEN 314(b): what changed in 2026

Section 314(b) of the USA PATRIOT Act gives eligible financial institutions a safe harbor from liability when they share information with each other to identify and report possible money laundering or terrorist activity. For years, many institutions were unsure whether fraud sharing qualified. In June 2026, FinCEN issued an updated 314(b) fact sheet, replacing the December 2020 version, that clarified the scope:

  • Fraud is in scope. Fraud offenses (mail, wire, bank, securities fraud and others) are specified unlawful activities for money laundering, so sharing about suspected fraud falls within the safe harbor.
  • Suspicion is enough. Institutions don't need to identify specific fraud proceeds before sharing.
  • No customer nexus required. The information doesn't have to relate to a specific customer or account at the receiving institution, which supports sharing of general indicators.
  • Any method, including real time. Written, verbal or electronic platforms are all fine. FinCEN gives examples of shareable fraud indicators such as new payees followed by large transfers, multiple accounts sharing identifying information, and logins from distant locations, plus video footage and IP data.
  • SAR confidentiality is unchanged. You can share underlying facts and discuss joint SARs, but you can't disclose a SAR or anything that would reveal whether one exists.

The Federal Reserve followed with SR 26-3 (July 9, 2026), distributing the guidance to supervised institutions. Participation stays voluntary, and FinCEN strongly encourages it.

Operational requirements (31 CFR 1010.540(b)):

  • Notice. File a notice with FinCEN (online at fincen.gov) and designate points of contact. The notice is effective for one year from filing; to keep sharing you must file a new notice.
  • Counterparty check. Before sharing, take reasonable steps to confirm the other institution has a current notice on file, using FinCEN's participant list or by confirming directly.
  • Use limits. Use received information only to identify and report money laundering or terrorist activity, to decide whether to open or maintain an account or conduct a transaction, or to meet BSA obligations.
  • Security. Maintain procedures to protect shared information; GLBA Section 501 safeguards applied to it satisfy this.
  • Failing any of these conditions forfeits the safe harbor. The rule withholds protection from an institution that fails the notice, verification or use-and-security conditions, so a lapsed annual notice means sharing without protection.

As of July 2026, credit unions were asking FinCEN to drop or lengthen the annual renewal (to three or five years); that was an advocacy request, not a proposed rule, so annual renewal still applies.

What it stops (and what it doesn't)

Stops well:

  • Mule destinations reused across institutions. Sharing receiving-account details lets the next bank stop the credit.
  • Scam payees. Reported payees and accounts can be flagged at the payment decision point (Payee Confirmation and Payment Friction).
  • Synthetic and stolen identities that have been used elsewhere (Credit Bureau and Consortium Signals).
  • Fast recall when funds are in flight. Peer contacts and rapid sharing improve the odds of freezing funds at the receiving institution.
  • Coordinated attacks hitting many institutions at once, where early warnings from an ISAC or peer group buy hours.

Doesn't stop:

  • Novel actors with no history in any network.
  • Cross-sector gaps. An actor known to a retailer consortium may be invisible to a bank network, and vice versa.
  • Poor-quality data. Unvalidated contributions, stale entries and false positives propagate across members.

Design considerations

Most consortia run on reciprocity, and their value depends on members feeding confirmed outcomes back. Build the contribution pipeline (confirmed fraud identifiers, mule accounts, scam payees) into your case-closure workflow (Case Management Systems).

Score the quality of each source. Shared data is one signal among several, so track each source's precision on your own outcomes and down-weight sources that produce false positives (Negative Lists and Deny Lists, External Intelligence Feeds).

Keep decision data and intel on separate paths. Account-validation and reputation data feeds real-time decisions, while threat intelligence (new typologies, campaign indicators) feeds analysts and rule development (Threat Intelligence and Horizon Scanning).

Label shared intelligence with a handling convention such as the Traffic Light Protocol 2.0 (FIRST, August 2022): TLP:CLEAR (no restriction), TLP:GREEN (community), TLP:AMBER (organization and its clients, need to know), TLP:AMBER+STRICT (organization only) and TLP:RED (named recipients only). This keeps sensitive case details from leaking.

Share the minimum needed, and use hashed or tokenized identifiers when the only purpose is matching.

Document the legal basis for each sharing channel: the basis itself (314(b), contract, privacy exemption, consent), what data flows, retention, permitted use and who approved it. Privacy, legal and compliance should sign off (Privacy and Data Use in Fraud Prevention).

Build peer relationships before you need them. When funds are leaving over a fast rail, an existing contact at the receiving institution is worth more than any platform. Maintain a contact list, and take part in working groups and conferences (Communities and Conferences).

Industry differences

Diagram: Confirmed case, Extract shareable indicators, Legal basis and TLP label, 314(b) partner institutions, Consortium contribution, ISAC or working group, Incoming shared data, Source-quality scoring, Decision features and lists, Analyst intel and new rules

Implementation path

StageWhat it looks likePrerequisites
CrawlRegister for 314(b) if eligible; join one industry community; maintain a peer contact list; consume one vendor consortium signalLegal and compliance sign-off; a named owner
WalkContribution pipeline from case closure; source-quality tracking; 314(b) request and response workflow with SLAs; TLP-labeled intel distribution; shared data in rules and modelsCase Management Systems; Rules Engine; documented legal bases
RunReal-time sharing integrations for mule and scam payees; multiple consortia with deduplication; privacy-enhancing matching (hashed or tokenized); intel driving rule and model updates within days; measured incremental value per sourceGraph Analytics; Machine Learning Models; Threat Intelligence and Horizon Scanning

Customer friction and trade-offs

Shared data adds little direct friction. The risks are false positives from someone else's mistake (a customer blocked on a consortium hit they can't see or challenge) and privacy expectations. Keep consortium hits as features or review triggers rather than automatic declines, unless the source is proven high-precision.

Measuring effectiveness

  • Incremental catch per source: fraud caught where the shared signal was decisive.
  • Source precision on your own outcomes.
  • Contribution volume and latency: how fast confirmed outcomes are shared.
  • 314(b) request turnaround and outcomes (funds frozen, cases joined).
  • Recall success rate on in-flight funds where peer contact was made.
  • Time from external alert to internal control.

Common failure modes

  • Consuming without contributing, which erodes consortium value.
  • Treating shared data as ground truth.
  • Expired 314(b) registration discovered mid-investigation.
  • Sharing SAR existence by accident in 314(b) conversations.
  • No legal-basis map for non-314(b) sharing.
  • Intel arrives but never turns into rules or features.
  • Sharing only within one sector and missing actors that cross from retail to banking.

Regulatory and policy notes

  • FinCEN 314(b): voluntary safe harbor for registered financial institutions; fraud explicitly in scope per the June 2026 fact sheet; SAR confidentiality preserved. See BSA-AML and SAR Filing.
  • SR 26-3 (Federal Reserve, July 9, 2026) relays the FinCEN guidance to Fed-supervised institutions.
  • Interagency payments fraud RFI (June 2025): the Federal Reserve, FDIC and OCC sought input on payments fraud, including data collection and information sharing. The 2026 314(b) clarification responded in part to that feedback.
  • Nacha 2026 rules require RDFIs to monitor incoming credits for fraud. Shared mule intelligence supports that (Nacha Rules and ACH Risk).
  • Privacy: non-FI sharing depends on privacy-law fraud exemptions and contracts (Privacy and Data Use in Fraud Prevention). For financial institutions, Regulation P (12 CFR 1016.15(a)(2)(ii)) exempts disclosures made to prevent actual or potential fraud or unauthorized transactions from the notice and opt-out requirements.
  • FCRA exposure when shared data drives denials. Under 15 U.S.C. 1681a, a "consumer report" is a third party's communication about a consumer that is used, or expected to be used, in deciding eligibility for credit, insurance, employment or another permissible purpose; a "consumer reporting agency" is one that regularly assembles such information to furnish to third parties for a fee or as a cooperative. Your own first-party transaction history is excluded. A consortium that pools members' data and returns it for account-opening or service decisions can therefore look like a CRA, and the CFPB treats checking-account screening companies as specialty CRAs: a bank that denies an account based on their report must send an adverse action notice naming the company. Whether a given fraud consortium's output is a consumer report turns on the facts (who assembles it, how it's used, the contract), so get a per-use-case opinion from counsel before using it for automated declines. The CFPB's December 2024 proposal to extend FCRA coverage to data brokers was withdrawn in May 2025, so the statute and existing guidance still draw the line.

Mechanisms addressed

Money Mules · Authorized Push Payment (APP) Scams · Investment Scams (Pig Butchering) · Impersonation Scams · Synthetic Identity Fraud · Fraud Rings and Collusion · ACH Funding Fraud · Check and Mobile Deposit Fraud · Account Takeover (ATO) · ACATS Transfer Fraud · Fraud-as-a-Service Ecosystem · Coupon Counterfeiting and Misredemption

Negative Lists and Deny Lists · Bank Account Ownership Verification · Graph Analytics · Machine Learning Models · Case Management Systems · Payee Confirmation and Payment Friction · Controls Index

See also Vendor Landscape, Regulatory and Government Sources and Frameworks and Taxonomies.

Sources and further reading