Which factor should a bank consider before sharing information about a customer with its broker- dealer affiliate in the case of an investigation?

The primary and most critical factor to consider before sharing a customer's information, even with an affiliate, is the legal framework governing data privacy and protection. Regulations such as the General Data Protection Regulation (GDPR) in Europe and other national data privacy laws impose strict controls on the processing and sharing of personal data. Financial institutions must ensure they have a legal basis for sharing information for an investigation, as unauthorized sharing can lead to severe regulatory penalties and legal action, regardless of the AML/CFT purpose.

A. Whether the broker-dealer affiliate can rely on the due diligence done by the bank This pertains to customer onboarding and reliance provisions, not the legal permissibility of sharing sensitive information during an active investigation.
B. Whether there is a mutual legal assistance treaty in place between the two institutions Mutual Legal Assistance Treaties (MLATs) are formal agreements between countries to exchange information for legal proceedings, not between private corporate entities.
D. Whether both institutions have an account or are in the process of opening an account for the customer While a shared customer relationship is a common reason for sharing, it does not automatically grant legal permission; the sharing itself must still comply with data protection laws.

1. ACAMS CAMS6 Study Guide (6th Edition). Chapter 4, "Compliance with Privacy Regulations," pp. 255-257. The guide emphasizes that "financial institutions must be cognizant of and comply with the applicable privacy laws and regulations of their country" and that a conflict often exists between AML/CFT reporting requirements and privacy laws, which must be carefully navigated.

2. Financial Action Task Force (FATF). FATF Recommendations (Updated October 2023). Recommendation 18, Internal controls and foreign branches and subsidiaries, Interpretive Note, para. 6(c). The note states that financial groups should have mechanisms for sharing information, "subject to any legal/regulatory requirements on data privacy/protection." This confirms that data protection rules are a prerequisite consideration.

3. Wolfsberg Group. Frequently Asked Questions (FAQs) on Correspondent Banking (2022). Page 10. The guidance discusses information sharing within a financial group, noting that it must be "subject to any data protection, privacy or bank secrecy restrictions that may apply." This highlights the primacy of privacy laws in governing intra-group data exchange.