Share fraud intelligence, not customer records. Continuous Account Intelligence uncovers risk on accounts your bank has never seen, while records stay with each institution.
Fraudsters operate as a network. Your defenses stop at your own perimeter.
Banks are willing to collaborate on fraud data sharing. What’s missing is a way that is private, accurate, and actionable at once. Consortium Manager closes that gap.
Criminals reuse tactics, devices, identities, and accounts across institutions, because to them the banking system is one connected surface. The scam tested on another bank’s customers, the money mule recruited next door, and the cash-out account three banks away all sit outside what you can monitor, until the loss lands on you.
Most fraud consortium models rely on a shared blacklist: static values with no context or classification that are slow to update or remove. Privacy platforms have the opposite problem. They protect the data but lack the context.
It is simply not possible for one bank to fight back alone; collaboration is required to ensure success.
American Bankers Association (ABA), Congressional testimony, September 2025
Consortium coverage
Visibility beyond your own accounts
Consortium Manager extends Acoru’s view beyond your own accounts to accounts and entities across member institutions, sharing fraud intelligence, not customer records. Every decision still stands on your own data, as the EU PSR will expect.
Benefits
Consortium Manager benefits
01
Visibility beyond your own customers
See risk on accounts and connected entities you have no direct relationship with, drawing on what other institutions in the network already know. Risk three banks away, from an entity linked to attacks elsewhere to a payee other members have seen scam victims pay, becomes visible before a transaction is initiated. Bad actors in your ecosystem surface proactively, including those you were sure you had already found.
02
Collaboration without exposing data
Members exchange derived intelligence, such as a classification state, a risk band, or a risk signal on an associated entity, not customer records, and no central node stores participants’ data. You keep full ownership of your records while gaining access to the network's intelligence. Banks share a signal, not a record.
03
Shared intelligence that is actually actionable
This is continuous risk intelligence, not a blacklist. Members share a live view of risk on accounts and everything associated with them, working across the heterogeneous data models financial institutions run, so the signal you receive is usable the moment it arrives. It takes only an event, not a transaction, to change what the network knows: one member's update cascades to the accounts and related entities linked to it, at every member that holds them.
04
Networks surface as networks, not isolated cases
Related risk shows up as clusters, so sleeper mule networks and entities shared across accounts appear as connected relationships, with laundering paths mapped across your account base. The AI Assistant explains in plain language why each account was flagged, with links to the evidence, so your analysts don’t wait on a data team. The platform prepares the case. Your analysts make the call.
05
Every member's input strengthens the whole
Each institution's classifications and signals sharpen the network's accuracy, and a sharper network feeds better intelligence back to every member. The defense compounds. Fraudsters lose the advantage of banks working alone.
06
Fewer false positives, more fraud caught
Network intelligence works in both directions. A payee other members have seen in good standing for years clears faster, and an account that looks clean at your bank but is flagged elsewhere gets stopped. Your models gain precision and recall: fewer alerts on genuine customers and more fraud caught than your own data would surface. Analysts spend less time clearing noise, and customers see less friction.
No central node holds participants' data. Each institution keeps full ownership of its own records and exposes only what it signs up for, while consulting the network's intelligence in real time. Sharing for every purpose is designed for data minimization and data protection. Privacy is a property of the design, not a policy bolted on top.
02 / 05
Safeguards proportionate to each purpose
Shared intelligence is protected by safeguards proportionate to each purpose and limited to what is legally permissible in each jurisdiction. Privacy-enhancing technologies (PETs) range from derived responses that disclose no identifiers to cryptographic matching and encrypted computation. Collaboration stays both powerful and private because the consortium’s members, not the vendor, set the terms.
03 / 05
Native risk intelligence, not a list
Consortium Manager uses the same continuous account classification as the rest of the platform. It separates victims from first-party fraud and splits money mules into complicit, witting, and unwitting, since most fraud tools miss the last two: the account looks legitimate. Shared classifications let a bank spot a victim or mule account it has no history with.
04 / 05
Flexible, permissioned consortia
Create customized, permissioned fraud consortiums and join as many as you need. Membership is configurable to your relationships and risk appetite, so you decide who you share with and on what terms. Consortium Manager is agnostic to the incumbent solution a member already uses, so no member has to replace its existing stack to take part.
05 / 05
Explainable, auditable consults
Every consult and every classification carries a rationale grounded in observable account behavior, captured at the moment of the decision. A hold you place on the strength of network intelligence is defensible, and the evidence trail supports supervisory and governance reporting. No black boxes: your analysts and auditors can see why.
01 — 05
Data privacy and residency
Acoru runs on-premises, in your private cloud, or in a hybrid environment.
Single- or multi-tenant: the institution decides where Acoru runs and who operates it. Shared intelligence follows data minimization: only what each purpose needs, within what each jurisdiction allows.
Shared fraud intelligence
How the consortium works
A network of banks, each holding its own accounts, with a single high-risk account or related entity visible across the network even though only one institution holds it directly. Signals move between banks; records never do. One risk, seen by all, owned by none.
Use cases
Relevant use cases
The mule network
Mule accounts recruited at one bank get flagged before cash-out at another.
Account opening
Identify an applicant’s mule-network exposure, even to entities you’ve never seen.
Linked entities
A fraud-linked entity gets flagged when it reappears at another member.
Beneficiary verification
Classify any new payee before the first payment clears, beyond a name check.
Emerging scam campaigns
A scam pattern one member spots reaches every member before the campaign does.
New regulation and payment-scheme rule books are moving fraud accountability earlier, to before a transaction is initiated. They are also spreading it across sending and receiving banks.
United Kingdom
Since 7 October 2024, the Payment Systems Regulator's reimbursement requirement has obliged payment service providers to refund victims of authorised push payment (APP) scams on Faster Payments and CHAPS, up to £85,000 per claim, unless the customer acted with gross negligence. The sending and the receiving Payment Service Provider (PSP) split the cost 50:50. Confirmation of Payee checks the name on the account; it cannot tell you the account is a mule.
“Now that both parties in the payment journey (the sending PSP and the receiving PSP) share the cost of reimbursing victims, there is a much stronger incentive for all PSPs to prevent APP scams from occurring in the first place.”
European Union
Since 9 October 2025, the Instant Payments Regulation (IPR) has required Verification of Payee (VoP) on euro credit transfers. A money mule account opened in the right name passes cleanly. Once they apply, the EU Payment Services Regulation and PSD3 will require fraud monitoring, fraud-data sharing, and refunds for consumers deceived by bank impersonators. The mule account is becoming the receiving bank’s problem.
“Mandatory fraud preventive measures will be applied and lead to less payment fraud. Banks have to share more of the burden if they fail to do their part.”
United States
Nacha’s Operating Rules are private-sector rules that bind every Automated Clearing House (ACH) participant by contract. The largest participants have been covered since March 20, 2026, and all others since June 19, 2026. The rules require risk-based monitoring of ACH credits initiated due to fraud, including those made under false pretenses. For a receiving bank, that means watching the credits that land in its customers’ accounts.
“These rules require fraud monitoring by Originators, Third-Party Service Providers, Third-Party Senders and ODFIs to identify ACH credit entries initiated due to fraud, including transactions authorized under false pretenses.”
Which solution is right for you
Holistic Fraud Prevention
If you are replacing legacy tools, consolidating or establishing a fraud stack baseline
When scams or money mules are your biggest challenge, add decisions span the full account lifecycle, with mule and victim subtypes and orchestration built in.
One member’s update cascades to every member that holds the account.
The defense compounds. Fraudsters lose the advantage of banks working alone.
FAQ
What is shared, and how is it protected?
Derived intelligence, not customer records: a classification state, a risk band, or a risk signal on an associated entity. No central node stores participants’ data, and each institution keeps full ownership of its own records.
Shared intelligence is protected by safeguards proportionate to each purpose and limited to what is legally permissible in each jurisdiction. Privacy-enhancing technologies (PETs) range from derived responses that disclose no identifiers to cryptographic matching and encrypted computation.
How is this different from a shared blacklist?
A shared blacklist holds static values with no context or classification that are slow to update or remove. Consortium Manager shares continuous risk intelligence: a live view of risk on accounts and everything associated with them, using the same account classification as the rest of the platform.
It takes only an event, not a transaction, to change what the network knows: one member’s update cascades to the accounts and related entities linked to it, at every member that holds them.
Do we need the consortium to get value from Acoru?
No. Your own accounts and their external counterparties deliver value from your own data. The consortium is the upgrade, the accounts with no relationship to any of your customers. Consortium Manager is an optional add-on when you want to share fraud intelligence with other institutions.
How does Acoru get our data?
In whatever form it already exists. Acoru takes structured and unstructured data in any format or schema, and normalizes it on ingestion. You can push data to Acoru through APIs, streams, or queues, or Acoru can pull it from your systems through plug-in connectors. Data can arrive in real time or in batches, as a full snapshot or just what changed. No migration project is needed.
How do our systems get results from Acoru?
Two ways, and you can combine them.
Pull: your systems query Acoru's API endpoints on demand. For example, your payment flow can check a new payee before releasing the payment.
Push: you provide the endpoint, and Acoru sends results to it as they change. This works for your SIEM, transaction monitoring system, core banking system, or case management. Results include scores, classifications, alerts, and executed policies, delivered through queues or standard connectors.
With push, risk changes reach you without waiting for a query. When a re-score cascades across linked accounts, each update arrives as it happens.
What data does Acoru need, and how do we provide it?
Three types: account data, transaction data, and session data.
Account data describes each account and its holder, such as opening date, product, status, and KYC attributes.
Transaction data covers payments in and out, with amount, channel, payment rail, and counterparty.
Session data captures digital activity: logins, device and network attributes, and events such as payee setup or limit changes.
Recent historical data lets the models learn your baseline, so Acoru is useful from day one. Extra sources such as onboarding, device intelligence, or case outcomes sharpen the picture, but you don't need them to start. None of this data leaves your environment. If you join a consortium, only the intelligence you choose to share reaches other members.
How is Acoru deployed?
On-premises, in your private cloud, or in a hybrid environment, single- or multi-tenant. Your institution decides where Acoru runs and who operates the infrastructure. Consortium Manager: each member connects through its own node, with no intermediate storage and no shared database.
![Benefits of Continuous Account Monitoring [A 2026 Guide] cover](/hubfs/acoru-2026/blog/benefits-of-continuous-account-monitoring.webp)
![Cross-Border Banking Regulatory Challenges [+Solutions] cover](/hubfs/acoru-2026/blog/cross-border-banking-regulatory-challenges.webp)
