Data Protection & AML Recordkeeping
AML/KYC creates sensitive records: identity documents, ownership evidence, screening results, adverse media notes, transaction context and escalation materials. These records must be retained and protected under the applicable legal framework.
1. The AML/privacy tension #
AML rules often require firms to collect, review, retain and sometimes share information. Data protection rules emphasise purpose, minimisation, security, access control, retention limits and individual rights. A good AML system should be designed for both obligations rather than treating privacy as an afterthought.
2. What AML evidence can contain #
- identity and verification data;
- corporate registry extracts and UBO evidence;
- sanctions, PEP and adverse media screening results;
- source-of-funds or source-of-wealth materials where required;
- transaction context and monitoring alerts;
- internal notes, escalation reasoning and MLRO records.
These records can be sensitive even when they come from open sources, because the case file connects them to a person, company, risk assessment or internal decision.
3. Privacy-aware AML control principles #
| Principle | AML meaning |
|---|---|
| Purpose limitation | AML data should be collected and used for defined compliance purposes. |
| Data minimisation | Collect what is necessary for the AML purpose, not unlimited background material. |
| Retention governance | Keep AML records for the required period, then handle deletion/archiving under policy and law. |
| Access control | Limit access to people and systems that need the information. |
| Auditability | Record who accessed, changed, approved or exported sensitive AML evidence. |
| Security by design | Protect data at rest, in transit and in operational workflows. |
4. Why local deployment matters #
For Tom Custos, local deployment is a privacy and control feature: sensitive AML evidence can stay inside the client’s infrastructure rather than being pushed into an uncontrolled external workflow. Locality does not solve all legal obligations, but it supports better control over access, audit logs, retention and data movement.
5. Open-source evidence is still personal or sensitive #
A common mistake is to treat public information as harmless. Public registry data, media articles or sanctions list entries can still become sensitive when stored in a case file, combined with other data, annotated by analysts or used in a risk decision.
6. Source basis #
- FATF Recommendations for recordkeeping, CDD and information-sharing concepts.
- FATF Private Sector Information Sharing guidance for AML/CFT information-sharing and safeguards context.
- EDPB statement on AML and data protection for the European data protection perspective.