What Article 75 Was Afraid to Permit

The Twenty-Year Deadlock

For two decades, the fight against money laundering has been trapped in a paradox. Criminals exploit the gaps between institutions: structuring funds across banks, layering transactions through correspondent networks, building shell company webs that span multiple banking relationships. No single bank sees the complete picture. The pattern is only visible when information from multiple institutions is combined.

Everyone knows this. The Financial Action Task Force has said it. The European Commission has said it. Every MLRO at every bank in Europe knows that their institution's transaction monitoring system is blind to the majority of laundering activity that occurs across institutional boundaries.

For twenty years, every attempt to solve this problem has failed. The detection works. The data sharing violates privacy law.

TMNL: The Proof That Detection Works

The Netherlands came closest. Transaction Monitoring Netherlands (TMNL), a joint initiative of the five largest Dutch banks, demonstrated that cross-institutional transaction analysis could identify laundering patterns invisible to individual institutions. The detection worked.

TMNL encountered unresolved legal and proportionality objections. The Dutch data protection authority was critical of population-scale joint monitoring, the Council of State concluded that necessity and proportionality had not been demonstrated for the proposed statutory basis and advised its removal, and the bill carrying that basis was declared controversial after the government fell. With the AMLR applying from 10 July 2027, TMNL is winding down its existing model and redesigning to reconcile with it.

The lesson was clear: centralising data, even pseudonymised data, is not a viable path to cross-institutional AML detection in Europe.

Article 75: A Door Half-Opened

The EU Anti-Money Laundering Regulation (AMLR), adopted in May 2024 and applicable from 10 July 2027, attempts to break this deadlock. Article 75 creates, for the first time, a formal legal framework for "partnerships for information sharing" between obliged entities.

This is genuine progress. Article 75 establishes supervisory oversight, requires Data Protection Impact Assessments, provides a civil liability safe harbour for good-faith sharing, and permits the exchange of customer identification data, transaction information, risk factors, and suspicion reports, with FIU consent.

But Article 75 has a constraint that significantly limits its effectiveness:

This constraint is not arbitrary. It exists because sharing customer data, even within a supervised partnership, is a GDPR processing operation. Under Article 5(1)(c) of the GDPR (data minimisation) and Article 5(1)(b) (purpose limitation), personal data processing must be proportionate. Blanket sharing of all customers' data across multiple institutions, including the vast majority who present no AML risk, would be disproportionate.

The result: Article 75 permits sharing on higher-risk customers and post-suspicion cases. The criminals who are most dangerous are the ones who deliberately maintain a low-risk profile at each individual institution. They are precisely the ones excluded from cross-institutional scrutiny.

The paradox remains: the customers you most need to see across banks are the ones you are least permitted to share data about.

---

Bounded information sharing

The prototype supports bounded information sharing and signed decision records under the stated trust model.

Why This Changes the Article 75 Equation

The prototype supports bounded information sharing and signed decision records under the stated trust model.

Information shared under the stated trust model

During an MPC federation round, the data transmitted between institutions consists of elliptic curve points (blinded cryptographic values), garbled circuit ciphertexts (encrypted gate evaluations), and oblivious transfer labels (randomly masked keys). None of these values can be attributed to an identified or identifiable natural person. They are computationally indistinguishable from random byte sequences.

GDPR Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person." GDPR Recital 26 clarifies that the principles of data protection should not apply to anonymous information: information which does not relate to an identified or identifiable natural person, or personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

The prototype supports bounded information sharing and signed decision records under the stated trust model.

No institution gains access to any other institution's customer data.

The prototype supports bounded information sharing and signed decision records under the stated trust model.

The prototype supports bounded information sharing and signed decision records under the stated trust model.

Traditional data sharing partnerships rely on contractual obligations, access controls, and supervisory oversight to prevent misuse of shared data. These are administrative safeguards. They work when everyone complies and fail when someone does not.

MPC privacy is a property of the mathematics. A party cannot extract the other party's input from the protocol messages even if it deviates from the protocol, colludes with external parties, or has unlimited computational resources, in the information-theoretic security model. It is a theorem, not a policy promise.

---

The Implication: Full Customer Base Federation

If MPC federation does not constitute personal data sharing under GDPR, then the Article 75 restriction to higher-risk customers has no basis to apply. The restriction exists to limit disproportionate personal data processing. Where no personal data processing occurs, the proportionality analysis is moot.

MPC-based cross-institutional AML detection can, in principle, cover the entire customer base. Not just the customers already identified as higher risk. Article 75 was afraid to permit this. Effective AML detection requires it.

The practical difference between the two approaches:

The prototype supports bounded information sharing and signed decision records under the stated trust model.

---

The Evidence: Measured, Not Theoretical

The ZQUAS platform has been built, tested, and stress-tested. The following results are from actual execution on production hardware (NVIDIA RTX 5090, 32 GB VRAM), not projections or simulations.

Correspondent banking wire stripping is validated end to end as a named cohort on synthetic data across simulated participants. Trade-based over-invoicing, shell company layering and funnel account structuring are designed and in scope, not validated. In the validated cohort, no individual simulated bank's monitoring would have escalated the entity. Only cross-institutional federation detected the pattern.

The prototype supports bounded information sharing and signed decision records under the stated trust model.

---

Why Seconds, Not Hours

Readers accustomed to traditional AML batch processing, where transaction monitoring runs overnight and results are available the next morning, will reasonably question whether the performance figures above contain an error. They do not. The speed difference is not incremental improvement. It is a fundamental architectural shift.

Why traditional systems are slow

Conventional AML platforms were designed in the early 2000s. They run on CPU-based architectures, process transactions sequentially or in small batches, and evaluate rules one at a time against each transaction. When a bank processes 10 million daily transactions through 200 monitoring scenarios, the computation is: 10,000,000 transactions multiplied by 200 rules multiplied by CPU evaluation time per rule. On a 32-core server, this takes 4 to 12 hours depending on rule complexity.

Cross-institutional detection adds another layer. If five banks want to compare customer risk, the traditional approach requires extracting data, pseudonymising it, transferring it to a central facility, loading it into a shared database, and running comparison queries. Each step takes hours. The total cycle is measured in days.

Why ZQUAS is fundamentally different

1. GPU parallelism, not CPU sequential processing.

The NVIDIA RTX 5090 has 170 streaming multiprocessors, each capable of running 2,048 concurrent threads. That is 348,160 simultaneous computation units. When ZQUAS evaluates 500,000 entities, it does not process them one at a time. It evaluates thousands simultaneously in a single GPU kernel launch. The 29 compliance policies are compiled to deterministic bytecode that executes directly on the GPU. The comparison is not 500,000 sequential evaluations. It is approximately 1,500 batched parallel launches, each processing hundreds of entities at once.

2. The MPC protocol is computationally lightweight.

The prototype supports bounded information sharing and signed decision records under the stated trust model.

A common misconception is that "cryptographic" means "slow." Fully homomorphic encryption is slow: roughly 10,000-times overhead. MPC using garbled circuits and oblivious transfer is not. The overhead compared to plaintext computation is approximately 100 to 500 times for the comparison operation. The comparison itself is trivial, so 500-times overhead on a microsecond operation is still sub-millisecond.

3. Bounded information sharing

The prototype supports bounded information sharing and signed decision records under the stated trust model.

Scaling behaviour

500K entities under 2 seconds on the fixed synthetic fixture, with about 55K transactions. This is a detection test, not the full product cycle.

Privacy-preserving federation performance

Real network conditions add latency. The ~15 second figure is measured over TCP localhost. Federation rounds are expected to run nightly or on a configurable schedule aligned with existing monitoring cycles.

Comparison with batch processing

500K entities under 2 seconds on the fixed synthetic fixture, with about 55K transactions. This is a detection test, not the full product cycle.

---

Anticipating Challenges

A claim this significant invites scrutiny. We welcome it. Below are the objections we expect, and our responses.

"The MPC protocol hasn't been independently audited."

Correct. The ZQUAS MPC implementation (ECDH-PSI with Chou-Orlandi oblivious transfer, Yao's garbled circuits with Free-XOR optimisation, and OT extension) has been internally audited against a hostile threat model covering transport authentication, encryption, replay protection, deserialisation bounds, GPU memory safety, and timing side channels. 37 findings were identified and remediated. No independent third-party cryptographic audit has been conducted.

An independent audit is a prerequisite for production deployment, not for sandbox engagement. The sandbox is precisely the environment in which to conduct such an audit under regulatory supervision.

"The DPA hasn't confirmed MPC outputs aren't personal data."

Also correct. Our position is that MPC protocol messages are not personal data under GDPR, because they are computationally indistinguishable from random values. This is a legal argument, not settled law. No EU Data Protection Authority has issued a formal ruling on this question.

This is one of the three objectives of our sandbox proposal: to engage the Autoriteit Persoonsgegevens or the European Data Protection Board and obtain a formal assessment. If the DPA concludes that MPC protocol messages do constitute personal data, the Article 75 framework would apply and the scope would be limited to higher-risk customers. That is still a significant improvement over the current state (no cross-institutional detection at all), but it would not achieve full customer base federation.

"The performance numbers can't be real with production-grade policies."

This is the most important objection to address. The benchmark runs against a 56-policy logical catalogue, pinned by static assertion to the catalogue array, with a 128-policy corpus (34 fail-closed screening, 94 detection) used for scale characterisation. These are not toy rules. The decision logic includes multi-threshold scoring, temporal aggregation, counterparty risk assessment, and composite EDD weighting.

The performance is real because the bottleneck in cross-institutional detection is not policy evaluation. It is the cryptographic protocol. The policy catalogue evaluates in microseconds per entity on GPU. The MPC round (PSI, garbled circuit, oblivious transfer) takes milliseconds. Even if policies were 100 times more complex, the round time would increase only marginally, because the policy evaluation component is already the smaller term.

"What about false positives at scale?"

No measured false positive rate is published. Producing one requires the detection baseline suite to be run and recorded, and until that exists no figure appears here. What the synthetic cohort showed is that entities below the combined threshold were not escalated through federation. The cross-bank correlation acts as a natural filter. Moderate risk at one bank is not suspicious unless corroborated by risk at another bank.

The relevant question is what the false positive rate will be on real customer data. Real customer bases have sanctions name collisions, PEPs with legitimate business, and cash-intensive entities with ambiguous profiles. Industry-standard AML false positive rates are 90 to 95 percent. A production rate of 1 to 5 percent would be a significant operational improvement. Quantifying this requires a pilot with real or representative data, which is one of the objectives of the sandbox engagement.

"How does this integrate with our existing Actimize, Oracle, or SAS stack?"

ZQUAS does not replace a bank's existing transaction monitoring system. It sits alongside it. The bank's existing system produces risk scores for its customers. ZQUAS consumes those scores and federates them across institutions. The integration point is a single data feed: entity identifier plus risk score. No changes to the bank's existing alert workflow, case management, or SAR filing process are required.

For banks that wish to use ZQUAS for single-institution monitoring as well, the 29 CPL policies can replace or supplement existing rules. This is optional. The cross-institutional detection, the capability no existing system provides, requires only a risk score per entity.

"What infrastructure does each bank need?"

For a pilot with 3 to 5 banks, each bank deploys a ZQUAS installation (one server or VM) and opens outbound TCP connections directly to the other participants. A 3-bank pilot requires 2 outbound connections per bank. A 5-bank pilot requires 4. No relay server. No neutral third party. No additional infrastructure beyond the installation itself. All connections are encrypted with AES-256-GCM and authenticated with Ed25519.

As the network grows beyond 10 to 15 institutions, an optional relay server simplifies the network topology. Each bank then maintains a single outbound connection to the relay instead of N-1 connections to individual peers. The relay is a stateless encrypted message router. It cannot read, modify, or store any message content. The transition from direct to relay mode is a configuration change, not a code change.

At production scale (50 or more banks), the relay operator should be a regulated AML utility, analogous to CLS Bank in foreign exchange settlement. Jointly owned by participating institutions, independently audited, regulated by the relevant financial authority. That governance discussion follows after the pilot proves the detection works.

"What if a participating bank is compromised?"

The MPC protocol is secure against a semi-honest adversary: a bank that follows the protocol correctly but attempts to extract additional information from the messages it receives. Under this model, a compromised bank learns nothing beyond the binary escalation signal.

The prototype supports bounded information sharing and signed decision records under the stated trust model.

Stronger malicious-adversary guarantees are architecturally designed for networks exceeding 30 institutions, based on 4-party MPC with guaranteed output delivery. This is not yet implemented. It is the natural evolution for large-scale production deployment.

---

The Path Forward

We are not asking regulators to take our word for it. We are asking for the opportunity to demonstrate, in a supervised environment, that MPC federation achieves the detection capability that Article 75 partnerships seek, without the privacy trade-off that Article 75 was forced to accept.

1. Regulatory sandbox engagement (DNB InnovationHub / FCA Digital Sandbox)ZQUAS was accepted into the FCA's Digital Sandbox in March 2026. The FCA does not endorse ZQUAS, its products or its results.

Deploy the ZQUAS federation platform in a sandbox environment with synthetic or historical data from participating banks. Demonstrate cross-institutional detection of known laundering typologies. Measure false positive rates. Validate the cryptographic attestation mechanism. Establish whether MPC protocol messages constitute personal data under GDPR.

2. Data Protection Authority consultation

Engage the Dutch Autoriteit Persoonsgegevens and the European Data Protection Board to obtain a formal assessment of whether MPC federation falls within the scope of personal data processing under GDPR. If it does not, the Article 75 restrictions on customer scope are inapplicable, and full customer base federation is legally permissible.

3. Pilot with participating institutions

Begin with a 12-week local pilot on the institution's own data and infrastructure. Review the local results before deciding on an optional network phase. Any network phase requires a separate agreement on participating institutions, sharing policy, legal basis and success measures.

The technology exists. The regulatory framework exists. The criminal activity that both were designed to address continues at an estimated $800 billion to $2 trillion annually according to the UNODC. What remains is the willingness to test whether mathematics can solve what policy could not.