There's a process to assessing information: to simplify, there's gossip/rumour, intelligence, fact.

The importance of information depends on where it falls on that scale. But there's another scale: immaterial, potentially material, material.

All intelligence gathering - which is what financial institutions are required to do - must be seen against this background or else harm is inevitable.

There is without doubt a place for information sharing between financial institutions but that leads to three questions:

1. Who can contribute and see pooled information and in what detail?
2. Where information is found, what should institutions do about it?
3. Who polices unfair use of information?

Let's pretend that the financial industry set up a common database, allowing almost exclusive access to only those players who, together, hold the vast majority of market share. Let's pretend that each of those players decide that if a customer doesn't fit within the narrow behavioural paremeters that they set, they will be added to the database. What might that be? If someone abandons a mortgage application, that might be enough. Now let's assume that person is not told he, or she, has been added to the database and that, even if he were to find out, he has no right of appeal.

Finally, let's assume that each of the other players, relying on that "marker" concludes that that person is high risk so his bank account is terminated, in the current argot, he is "de banked." And no other bank will allow him to open an account. Still he does not know why and if he asks, he gets the stock answer "we are unable to tell you for legal reasons." Next, the fact that his salary cannot be paid into a bank makes his employer suspicious of him or, worse, when he tries to get a job his status as, let's call it "unsuitable for banking" makes him almost unemployable. Even receiving benefits becomes difficult.

This is not imaginary. It's the UK financial Industry's inter-company database called CIFAS which before it decided to change its initials into a word was known as the Credit Industry Fraud Avoidance Scheme and Cifas is not the only such database in the UK. Across the world, other countries are looking at the scheme and working out how to adopt it.

They should read Asher's book to learn how not to do it.

The system of whispers between institutions is not public, often not publicly known. It is built into the KYC information distributed by dozens, if not hundreds, of KYC information providers who treat what it finds in the databases as unimpeachable. Somewhere in the KYC process, someone assigns a value to it - again without questioning its relevance, importance or accuracy. The fact that the marker exists becomes an unassailable, unquestioned fact.

The primary problem is the lack of supervision and the lack of accountability of private sector initiatives that can and, according to Asher's research, do destroy the lives of hundreds of thousands of people in the UK every year and while doing so removing from them the ability and power to repair the damage.

Asher has taken the operators of databases to court on behalf of victims. It is a long, stressful and expensive process because the operators take the view that the addition to the database is an absolute, not subject to review except in very limited circumstances. Asher says it's almost impossible to find out why the marker was placed, who placed it and to get a fair review by the operators.

The world needs measures to combat fraud, ideally by preventing it happening in the first place and it is widely accepted that fraudsters are often recidivists. But the creation of a marker does not necessarily mean that a person has committed fraud, merely that something short of the suspicion needed to submit a suspicious activity report has happened.

We might even consider that the process is akin to "there isn't suspicion but now we've had to look at it, let's do something about it."

That leads to a bizarre question: if something is referred to risk and compliance for consideration, do the KPI's give additional points for making an external report and if a suspicious activity report is not required, is the placing of a fraud database marker a way of collecting that point?

Let's posit a scenario: a computerised process produces an exception report because a customer does not answer calls from unknown numbers to his mobile phone; the bank gets fed up and marks the customer as problematic. The officer reviewing the report sees that the customer never answers the phone and regards that as an indicator that the customer is avoiding the bank. He presumes that no one avoids the bank unless they are up to no good. So, there being nothing suspicious about the account, the officer decides that the customer is a pain in the bum and and everyone else should be told about him.

That's extreme and may well not happen. There may be checks and balances within the organisation to make sure that reports are not made without evidence of wrongdoing. There may. Are there? If some of the cases described in Asher's book are typical, there can be no doubt that insufficient attention is taken to decide if a marker is justified.

Morally, politically, socially the scheme as it has developed, with no supervision or regulation and - because it is in the private sector - no way of using judicial review to address its harms is repugnant and claims as to fraud prevented, while often quoted, cannot be based in empirical data unless it shows exclusively failed attempts. There is nothing to suggest that it does.

A better, fairer way must be found.

Rarely can WMLR give an absolutely unequivocal statement that a book is for everyone involved financial crime risk and compliance. In this case, that statement is completely justified.