Data Protection & AML Recordkeeping
AML/KYC creates sensitive records: identity documents, ownership evidence, screening results, adverse media notes, transaction context and escalation materials. These records must be retained and protected under the applicable legal framework.
1. The AML/privacy tension #
AML rules often require firms to collect, review, retain and sometimes share information. Data protection rules emphasise purpose, minimisation, security, access control, retention limits and individual rights. A good AML system has to satisfy both obligations.
2. What AML evidence can contain #
- identity and verification data;
- corporate registry extracts and UBO evidence;
- sanctions, PEP and adverse media screening results;
- source-of-funds or source-of-wealth materials where required;
- transaction context and monitoring alerts;
- internal notes, escalation reasoning and MLRO records.
These records can be sensitive even when they come from open sources, because the case file connects them to a person, company, risk assessment or internal decision.
3. Privacy-aware AML control principles #
| Principle | AML meaning |
|---|---|
| Purpose limitation | AML data should be collected and used for defined compliance purposes. |
| Data minimisation | Collect what is necessary for the AML purpose, not unlimited background material. |
| Retention governance | Keep AML records for the required period, then handle deletion/archiving under policy and law. |
| Access control | Limit access to people and systems that need the information. |
| Auditability | Record who accessed, changed, approved or exported sensitive AML evidence. |
| Security by design | Protect data at rest, in transit and in operational workflows. |
4. Data location and access architecture #
Where AML records are stored and processed can affect confidentiality, cross-border transfer rules, outsourcing risk, regulator access and incident response. The correct architecture may be on-premise, cloud, regional hosting or a controlled hybrid depending on applicable law and the institution’s risk model. The control question is not whether data is “local” by default, but whether location, access, transfer, retention and security are documented and lawful.
5. Open-source evidence is still personal or sensitive #
A common mistake is to treat public information as harmless. Public registry data, media articles or sanctions list entries can still become sensitive when stored in a case file, combined with other data, annotated by analysts or used in a risk decision.
6. Source basis #
- FATF Recommendations for recordkeeping, CDD and information-sharing concepts.
- FATF Private Sector Information Sharing guidance for AML/CFT information-sharing and safeguards context.
- EDPB statement on AML and data protection for the European data protection perspective.