Tipping-off — the prohibition and its exceptions
The tipping-off rule is broader than “don’t tell the customer you filed a report”. Article 73 of Regulation (EU) 2024/1624 (the AMLR) prohibits disclosing that transactions or activities are being assessed, that information is being, will be or has been transmitted, or that a money laundering or terrorist financing analysis is being, or may be, carried out. The prohibition therefore bites well before any report exists, and it binds agents and distributors as well as employees. This guide walks through what is caught, the five exceptions, how the rule sits next to the duty to hold a transaction, and three situations payment and e-money firms meet every week.
1. What is prohibited, and who is bound
Article 73(1) names three distinct disclosures, and the tense of each is the point:
- that transactions or activities are being or have been assessed under Article 69;
- that information is being, will be or has been transmitted under Article 69 or 70;
- that an ML/TF analysis is being, or may be, carried out.
The persons bound are obliged entities and their directors, employees, or persons in comparable positions, including agents and distributors. For a payment or e-money institution operating through an agent or distributor network, those are the operative words: the network is inside the prohibition, so agent training and scripts are a compliance artefact, not a commercial one.
The persons protected are the customer concerned and other third persons. A disclosure to a counterparty, to a customer’s accountant, to a partner platform’s support team, or to a journalist is caught just as a direct statement to the customer is. “Third persons” has no carve-out for commercial partners: a marketplace that onboarded the merchant is a third person unless it is itself an obliged entity covered by one of the exceptions below.
Because the prohibition covers analysis that “may be” carried out, the safe pattern is a standing, non-specific customer-facing explanation agreed in advance with the compliance function and used for every review, suspicious or routine. If the wording only appears when a report is in progress, the wording itself becomes the disclosure.
2. Which text applies today
The AMLR applies from 10 July 2027 (Article 90). Until then the operative rule is the national transposition of Article 39 of Directive (EU) 2015/849, which already contained the same core prohibition and a similar set of exceptions. The national provisions payment firms meet most often:
| Jurisdiction | Provision until July 2027 | Notable feature |
|---|---|---|
| Spain | Ley 10/2010, art. 24 (prohibición de revelación) | Group and network exceptions; dissuading a client is not disclosure |
| Germany | § 47 GwG (Verbot der Informationsweitergabe) | Covers intended or filed reports, resulting investigations and FIU information requests; some sharing needs prior FIU consent |
| EU, from 10 July 2027 | AMLR Article 73 | Directly applicable; adds the explicit “may be carried out” wording and names agents and distributors |
The practical consequence: a policy written today should cite both the national article and Article 73, and the scripts should already meet the AMLR wording, which is the wider of the two. Check the national text in each host state where you operate through agents or branches; the host-state rule binds the local network.
3. The five exceptions
| Provision | Permitted disclosure | Relevance to payment firms |
|---|---|---|
| Article 73(2) | To competent authorities and to self-regulatory bodies performing supervisory functions; and for the purposes of investigating and prosecuting ML, TF and other criminal activity | Supervisor, FIU, police and courts |
| Article 73(3) | Between obliged entities in the same group, and with their branches and subsidiaries in third countries, if those fully comply with the group-wide policies under Article 16 and those policies comply with the AMLR | Parent, sister EMIs, group compliance hub |
| Article 73(4) | Between auditors, accountants, tax advisors, notaries and lawyers (Article 3, point (3)(a) and (b)) working within the same legal person or a larger structure sharing ownership, management or compliance control | Rarely; relevant only to professional firms |
| Article 73(5) | For credit institutions, financial institutions and the professionals in (3)(a)-(b): between obliged entities involved in the same transaction, if located in the Union or an equivalent third country and subject to professional secrecy and data protection | The payer’s and payee’s PSPs on one transfer |
| Article 73(6) | Professionals in (3)(a)-(b) trying to dissuade a client from illegal activity are not disclosing | Not available to PSPs |
The group exception is conditional rather than automatic. It depends on the third-country branch or subsidiary fully complying with the group-wide policies and procedures, including the information-sharing procedures required by Article 16, so a group that has not evidenced that compliance cannot rely on it. Keep the evidence: the group policy, the third-country entity’s adoption of it, and the latest group audit.
The same-transaction exception in Article 73(5) is the one payment firms under-use. When your customer’s outbound transfer is suspicious, the beneficiary’s PSP is an obliged entity involved in the same transaction. The article permits disclosure between the two, within its conditions. It does not permit disclosure about other transactions of the same customer, and it does not reach a non-regulated platform in the chain. Where you want a structured, repeated exchange beyond one transaction, the route is a partnership for information sharing under Article 75, which requires prior notification to the supervisor.
4. The other side: disclosure to the FIU is protected
Article 72 provides that good-faith disclosure to the FIU under Articles 69 and 70, by the obliged entity or its employees or directors, breaches no contractual, legislative or administrative restriction on disclosure and creates no liability, even where the reporter did not know the underlying offence precisely and regardless of whether illegal activity actually occurred. Read with Article 73, the structure is symmetrical: the route to the authority is protected, and every other route is closed unless an express exception applies.
5. Holding the transaction without explaining why
Article 71(1) requires obliged entities to refrain from carrying out a transaction they know or suspect is linked to criminal proceeds or terrorist financing until they have reported under Article 69 and complied with any FIU instruction. If no contrary instruction arrives within 3 working days of the report, the firm may proceed after assessing the risk. Article 71(2) covers the case where refraining is impossible or would alert the beneficiaries: execute, then inform the FIU immediately.
That three-day window is exactly when customers call. The hold has to be explained without explaining it, so the support script, the in-app status and the automated email for a held payment must be identical to those used for ordinary compliance checks, sanctions false positives and technical delays. Article 71(2) is also a tipping-off tool in its own right: if refusing a payment would itself alert a sophisticated network, executing and reporting can be the lawful choice.
6. Worked example: the blocked account and the angry call
Facts: An EMI’s monitoring flags a retail account receiving 40 small transfers from unrelated senders in two days, each forwarded out within minutes. The analyst restricts outbound payments and opens an internal assessment. The customer calls support asking why their transfer is “pending review” and whether “the bank has reported them”.
What the rule says: The assessment under Article 69 has started. Telling the customer that activity “is being assessed” for suspicion, or confirming or denying a report, is a disclosure under Article 73(1). Saying nothing substantive is not.
What the practitioner does: Support uses the standing script: the account is subject to a routine review, the firm is required to verify certain activity, and it will be in touch. Support has no view into case-management notes, so it cannot leak what it cannot see. If the customer asks directly whether a report was filed, the answer is the same script, never “no”. The analyst documents the call in the case file, because the customer’s reaction is itself evidence.
Outcome: The report is filed, the three-day window passes, and the account relationship is ended on a notice that cites contractual grounds only.
7. Worked example: the partner platform asks why payouts stopped
Facts: A payment institution provides merchant accounts to sellers on a third-party marketplace under a distribution agreement. It suspects one seller of processing proceeds of fraud and freezes payouts. The marketplace’s account manager emails asking whether the seller “is under an AML investigation” so they can delist them.
What the rule says: The marketplace is a third person. It is not a distributor in the Article 73(1) sense on these facts (it does not distribute e-money on the firm’s behalf), and it is not an obliged entity in the same group or in the same transaction. No exception applies.
What the practitioner does: The reply states only that the account is subject to the firm’s standard compliance procedures and that the firm cannot comment on individual accounts. The distribution agreement should already say this, so the reply is contractual, not improvised. If the marketplace has its own concerns, it can file its own report where it is an obliged entity, or refer the matter to the authorities.
Outcome: The firm protects the FIU’s analysis and the marketplace’s decision remains its own. Agreements signed after this case add a clause pre-agreeing the non-specific wording.
8. Worked example: asking the beneficiary’s PSP
Facts: A customer of a Spanish-branch EMI sends EUR 18,000 to an account at a PSP in another Member State, then reports that they were manipulated into paying. The EMI suspects the beneficiary account is a mule and wants the other PSP to look at it.
What the rule says: Both firms are financial or credit institutions involved in the same transaction, both in the Union, both bound by secrecy and data protection. Article 73(5) permits disclosure between them about that transaction. Before July 2027 the national equivalent governs; check that the local text already contains a same-transaction exception before relying on it.
What the practitioner does: The EMI sends a recall and a fraud notification through the payment scheme’s channels, limited to the transaction, and files its own report with its FIU. It does not share its wider view of the payer or other beneficiaries.
Outcome: The receiving PSP can act on its own account and file its own report. Each firm reports to its own FIU; neither tells the account holders.
9. Controls that make the rule workable
- One script for every review. Support, collections, onboarding and agents use identical wording for any restriction, whatever its cause.
- Need-to-know case files. Case notes and report status sit in a system the front line cannot read.
- Agent and distributor training with an attestation, because Article 73(1) names them expressly.
- A pre-approved exception log. Every intra-group or same-transaction disclosure is recorded with the paragraph relied on.
- Offboarding letters on contractual grounds, reviewed by compliance before sending.
FAQ
Does the prohibition apply before a report is filed?
Yes. It covers disclosing that activity is being assessed and that an analysis is being, or may be, carried out, both of which precede any filing.
Are agents and distributors covered?
Expressly, yes. Article 73(1) names agents and distributors alongside directors, employees and persons in comparable positions.
Can we tell our parent company?
Only under the Article 73(3) group derogation, and only where the conditions are met, including full compliance by third-country branches and subsidiaries with the Article 16 group-wide policies and procedures.
Can we talk to the other PSP on a suspicious transfer?
Under Article 73(5), yes, about that transaction, provided both are in the Union or an equivalent third country and bound by professional secrecy and data protection. Wider exchanges need an Article 75 partnership.
Is closing the account a disclosure?
Not in itself. Ending a relationship is permitted; explaining it by reference to a suspicion or a report is not. Use contractual grounds and standard wording.
Can we answer a court order or police request that mentions the customer?
Yes. Article 73(2) exempts disclosure to competent authorities and for investigating and prosecuting criminal activity. The exemption covers the authority, not the customer’s lawyer.
When does Article 73 replace national law?
From 10 July 2027, when the AMLR starts to apply. Until then, the national transposition of Article 39 of Directive (EU) 2015/849 governs.
What to do, today
- MLRO: map your policy to both the national article and AMLR Article 73, including the 73(5) same-transaction route.
- Head of support: replace any restriction wording that varies by cause with one standing script.
- Partnerships: add a non-comment clause to agent, distributor and platform agreements.
- Group compliance: file the evidence that third-country entities adopt the Article 16 policies before relying on 73(3).
Related: The AMLA STR format · Reporting of suspicions under Article 69 · AMLR governance · AML record retention
