Managing AML Challenges Under GDPR

With GDPR in effect, financial institutions in the EU and beyond must manage their AML compliance obligations in a new data protection regime.

The General Data Protection Regulation (GDPR) was implemented on May 25th 2018, transforming the way organizations within the EU handle the personal data of their customers and clients. GDPR creates, clarifies, and harmonizes data security legislation across all EU member-states – but also affects organizations from outside territories wishing to do businesses within the bloc.

Practically, GDPR limits the ways in which businesses can collect, use, and store the personal data of their customers and clients – it also creates consequences for institutions with AML obligations.

GDPR vs AML

Since Anti-money Laundering (AML) efforts require an intense focus on personal data, the restrictions introduced by GDPR may represent a challenge for financial institutions. More specifically, the legal scope of GDPR may clash with the way institutions identify customers during their due diligence procedures and how they manage their risk thereafter.

As a financial institution, delivering GDPR compliance while managing your AML obligations is an important priority – especially since GDPR compliance penalties can reach up to €20 million (or 4% of global revenue). With the stakes so high, it’s worth exploring the points at which the two legislative frameworks clash and how any regulatory friction may be resolved.

Lawful Basis

Article 6 of GDPR requires data controllers to establish a legal basis for collecting and processing personal data – including data required for AML purposes. For institutions with AML obligations, the most relevant justifications provided by Article 6 are:

• Article 6(c) – which allows for the processing of personal data “for compliance with a legal obligation to which the controller is subject” – typically, AML laws or sanctions.
• Article 6(f) – which allows for data processing for “legitimate interests”, justifiable on a case-by-case basis.

ComplyAdvantage justifies its data processing activities under Article 6(f)  – since that data is necessary to serve our clients’ legitimate interests in delivering AML and sanctions compliance.

The Right to be Forgotten

One of the most significant aspects of the GDPR is Article 17, which introduces the “right to be forgotten”.  That right allows data subjects to request the deletion of their personal data under certain circumstances. This rule may be in contention with AML law, which requires data to be held long after a business relationship has ended.

Under GDPR Article 17(3)(b), however, legal requirements take precedence over the right to be forgotten. From an AML perspective, the EU’s 4th Anti- Money Laundering Directive (4AMLD) introduced the requirement that both customer due diligence and transaction records be retained for 5 years after the end of the customer relationship. In this context, the right to be forgotten would only be enforceable after this period had ended.

Appointing Processors

Article 28 of GDPR states that data controllers must appoint data processors, like ComplyAdvantage, who can offer and demonstrate “sufficient guarantees” of GDPR compliance. That being the case, it may be necessary to include GDPR compliance requirements – and the right to audit them – in contracts with third-parties. Similarly, the transmission of data between controllers and third-party processors must also be secure and in compliance with relevant GDPR rules.

Since ComplyAdvantage processes personal data for each of our clients for AML purposes, our GDPR compliance guarantees are set out, as standard, in our terms of service agreements.

Learn how our solutions will help you remain compliant with the most up-to-date AML regulations.