While AML legislation requires firms to collect and assess client information before doing business, it doesn’t excuse you from complying with GDPR. AML law provides a legal basis for the obtaining and processing of this information, however, there are other responsibilities to consider. Here are the top three areas to watch out for:
1️. Secure Information Handling:
- Avoid receiving AML data via email, especially sensitive documents like passports or IDs. Email isn’t secure!
- AML information should be stored securely, and retained in a location that has restricted and controlled access.
2. Limited Use Of Data:
- This data is obtained for the purpose of crime detection and prevention only. It cannot be used for another purpose. In particular, be careful not use this privileged information as a basis for marketing or promoting additional services.
3. Data Retention:
- All information provided for this purpose should have a natural end of life. This is typically five years following the date of cessation of business with a client. Holding this data for longer is a breach of the principal of ‘storage limitation’ and can expose a firm to harm.
AML and Data Protection regulation is rarely in conflict, however, can be considered by some to be open to interpretation. This opening often attracts enthusiastic debaters. When considering these issues I think that a large degree of common sense and practicality should be applied. This is more likely to save you time and effort, and on most occasions keep you on the right side of the law.
#GDPR #DataProtection #AMLCompliance #LegalTech
