AML teams often sit on a goldmine of sensitive information – passport scans, bank account details, IP logs, and behavioural data. Under the DPA 2018, holding that kind of data comes with a responsibility to get it right. Not only from a security standpoint but also from a purpose and retention point of view.
One of the first things to get clear is what’s legally required versus what’s simply convenient. It can be tempting to hold on to data just in case it becomes useful later. But retention needs to be tied to legal obligations. Under money laundering regulations, that’s typically five years after a customer relationship ends. But keeping it longer – without a legitimate reason – could land you in hot water with the ICO.
Then there’s the issue of lawful basis. You’ll almost always be relying on “legal obligation” when processing data for KYC, KYB, monitoring, or filing SARs. But if your firm also uses data for analytics or business development, that shifts the lawful basis – and that needs to be reflected in your records and your privacy notices. It’s worth sitting down with your Data Protection Officer (if you have one) or legal team and mapping out what basis applies to each data use case. It’s not something you want to leave to chance.
Another key area where the DPA 2018 and AML work overlap is in data sharing. Think about SARs: you’re expected to share certain information with law enforcement or regulators, but that doesn’t mean you can share it freely within your business or with third parties. Each disclosure needs to be necessary, proportionate, and documented. Blanket data access across departments is a red flag, especially if there’s no clear need-to-know basis.
Encryption, access controls, and audit logs aren’t just IT department concerns – they’re part of your data protection obligations. If a breach happens, and you can’t show that you had adequate technical measures in place, the ICO won’t look kindly on it. For AML managers, that means working closely with your tech and security teams to review how sensitive data is stored and accessed.
Finally, there’s training. Data protection can’t be siloed. If your front-line analysts don’t understand what a subject access request is, or how to respond to a customer who wants their data erased, you’ve got a gap. Regular, practical training – tailored to the AML function – goes a long way to keeping things on track.
Getting DPA 2018 compliance right is about protecting the trust your customers place in you and showing regulators that your AML setup is mature, responsible, and built to last. If you treat data the way you treat financial risk – with precision, accountability, and a clear audit trail – you’re already on solid ground.
