Data Privacy and Protection Laws in AFC Work

1. Why This Topic Matters

Anti-financial crime (AFC) work runs on data. Customer due diligence (CDD), transaction monitoring, sanctions screening, suspicious activity reporting and investigations all require institutions to collect, analyse, store and share large volumes of personal information. At the same time, governments around the world have enacted increasingly strict data privacy and protection laws that limit how personal data may be collected, used, retained and transferred. The result is a constant tension: AML/CFT laws push institutions to gather more and share more, while privacy laws push them to collect less, keep it for shorter periods and share it only under tight conditions.

For the CAMS exam, this topic sits inside the domain on Regulatory Regimes, Risk Assessments and Collaboration because it directly affects how institutions cooperate with regulators, law enforcement, financial intelligence units (FIUs), group affiliates and other institutions. A compliance officer who ignores privacy law exposes the institution to fines, litigation and reputational damage; one who over-applies privacy law may fail to file reports, fail to share intelligence, or inadvertently obstruct investigations. The exam tests whether you can recognise and resolve this tension correctly.

2. What Data Privacy and Protection Laws Are

Data privacy and protection laws regulate the processing of personal data, meaning any information relating to an identified or identifiable natural person (names, identification numbers, account numbers, location data, online identifiers, biometric data and so on). Key frameworks you should know include:

European Union General Data Protection Regulation (GDPR): The global benchmark. It applies to organisations established in the EU and to organisations outside the EU that offer goods or services to, or monitor, EU residents. Core principles are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Fines can reach 4 percent of global annual turnover or 20 million euros, whichever is higher.

Other national and regional regimes: The UK GDPR and Data Protection Act 2018; the California Consumer Privacy Act (CCPA) and other US state laws; the US Gramm-Leach-Bliley Act (GLBA) and Right to Financial Privacy Act; Brazil LGPD; Canada PIPEDA; Singapore PDPA; China Personal Information Protection Law (PIPL) and Data Security Law; India DPDP Act; and many others. Several jurisdictions also impose data localisation requirements that restrict moving data outside national borders.

Bank secrecy laws: Distinct from data protection but closely related, these laws (historically associated with Switzerland, Luxembourg and several offshore centres) criminalise disclosure of client information. Most have been narrowed to permit AML/CFT reporting and tax information exchange, but residual conflicts remain.

3. The AML/CFT Side of the Equation

AFC obligations that rely on personal data include:

- CDD and KYC: Collecting identity documents, beneficial ownership information, source of wealth and funds, and purpose of the relationship.
- Ongoing monitoring: Analysing transaction patterns, which may involve profiling and automated decision-making.
- Screening: Checking customers against sanctions, PEP and adverse media lists.
- Record keeping: FATF Recommendation 11 requires records to be kept for at least five years after the end of the relationship or the transaction, and many jurisdictions require longer.
- Reporting: Filing suspicious activity or transaction reports (SARs/STRs) with the FIU, including personal data of the subject, without informing the subject (the tipping-off prohibition, FATF Recommendation 21).
- Information sharing: Within financial groups (FATF Recommendation 18 requires group-wide programmes including sharing for AML/CFT purposes), between institutions, and between the private sector and public authorities.

4. How the Two Regimes Interact

Lawful basis for processing: Under GDPR and similar laws, personal data may only be processed where a lawful basis exists. For AML/CFT work, the primary bases are compliance with a legal obligation (for example, performing CDD and filing SARs required by law) and performance of a task in the public interest. Legitimate interests may support activities that go beyond the strict legal minimum, such as enhanced screening, provided a balancing test is documented. Consent is generally a poor basis for AML processing because it can be withdrawn and because customers cannot realistically refuse.

Purpose limitation and further use: Data collected for AML/CFT purposes should be used for those purposes. The EU Fourth and Fifth AML Directives expressly state that personal data processed for AML/CFT should not be further processed for incompatible purposes such as marketing. Exam questions frequently test whether compliance data may be reused commercially; the answer is generally no.

Data minimisation and proportionality: Institutions should collect what is necessary for a risk-based approach, not everything available. Enhanced due diligence justifies collecting more data for higher-risk customers; it does not justify collecting excessive data on everyone.

Storage limitation versus record retention: Privacy law says keep data no longer than necessary; AML law says keep it at least five years (often longer). The AML retention requirement satisfies the privacy test because retention is necessary for compliance with a legal obligation. After the mandatory period expires, data should be deleted or anonymised unless another lawful reason exists (such as ongoing litigation or investigation).

Data subject rights and their limits: Individuals generally have rights of access, rectification, erasure, restriction and objection. Privacy laws contain exemptions (for example, GDPR Article 23) allowing restriction of these rights where necessary to prevent, investigate, detect or prosecute crime, or to protect regulatory functions. This is why a customer who is the subject of a SAR cannot use a subject access request to discover the SAR, and why a request to erase data cannot override the AML retention period. Institutions must handle such requests carefully to avoid tipping off.

Automated decision-making and profiling: Transaction monitoring systems profile customers. GDPR Article 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects. AML systems normally generate alerts for human review rather than final decisions, which helps satisfy this rule, but institutions should ensure meaningful human involvement, explainability and bias testing in models.

Security and breach notification: Compliance data is highly sensitive. Institutions must implement appropriate technical and organisational measures such as encryption, access controls and audit logging. Under GDPR a personal data breach must be notified to the supervisory authority within 72 hours where feasible, and to affected individuals where there is a high risk. A breach involving SAR data could also compromise investigations.

Data Protection Impact Assessments (DPIAs): High-risk processing, which typically includes large-scale monitoring and screening, requires a DPIA before launch. The Data Protection Officer (DPO) should be involved in designing AML systems.

5. Cross-Border Information Sharing

This is the most heavily tested practical area.

Intra-group sharing: FATF Recommendation 18 and its interpretive note require financial groups to share information needed for CDD and ML/TF risk management across branches and subsidiaries, including information about unusual transactions and, where permitted, SARs. Privacy and secrecy laws in host countries may restrict this. Where a host country prohibits implementation of group standards, the institution must apply additional measures and inform its home supervisor. The institution should not simply ignore the restriction, and should not simply abandon group-wide risk management.

Transfer mechanisms: Under GDPR, transfers outside the European Economic Area require an adequacy decision, appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a derogation (for example, important reasons of public interest). The 2020 Schrems II judgment invalidated the EU-US Privacy Shield and required transfer impact assessments; the EU-US Data Privacy Framework was subsequently adopted in 2023. Institutions should map data flows and document the transfer basis for AML data.

Private-to-private sharing: In the United States, Section 314(b) of the USA PATRIOT Act provides a safe harbour allowing financial institutions that have registered with FinCEN to share information about possible money laundering or terrorist financing. Participation is voluntary and the information may only be used for the specified purposes. Section 314(a) allows law enforcement, through FinCEN, to request that institutions search their records for named subjects. Many other jurisdictions lack an equivalent safe harbour, which is why FATF and the Wolfsberg Group have called for legal gateways to enable sharing.

Public-private partnerships (PPPs): Examples include the UK Joint Money Laundering Intelligence Taskforce (JMLIT), the Fintel Alliance in Australia, the AML/CFT Industry Partnership (ACIP) in Singapore and similar bodies in Canada, the Netherlands and elsewhere. These operate within legal frameworks that balance intelligence sharing with privacy, often through gateways in AML legislation, secure environments, and strict purpose and access rules.

Privacy-enhancing technologies (PETs): FATF work since 2021, including the 2022 report Partnering in the Fight Against Financial Crime: Data Protection, Technology and Private Sector Information Sharing, highlights homomorphic encryption, secure multi-party computation, federated learning, pseudonymisation and zero-knowledge proofs as ways to detect financial crime across institutions without exposing underlying personal data. The exam may describe these in a scenario and ask how they help reconcile privacy and AFC goals.

FIU and law enforcement cooperation: FIUs exchange information through the Egmont Group under principles that require confidentiality, purpose limitation and prior consent for onward dissemination. Mutual legal assistance treaties (MLATs) govern formal evidence exchange. Both are designed to respect data protection while enabling cooperation.

6. FATF Guidance on Compatibility

FATF Recommendation 2 requires countries to ensure that AML/CFT cooperation and coordination mechanisms are compatible with data protection and privacy rules. The clear message is that these regimes are meant to coexist, not to defeat each other. Countries are expected to provide legal clarity so that institutions can comply with both. For exam purposes, remember that FATF views privacy as a legitimate constraint that must be designed around, not an excuse for inaction.

7. Practical Governance Measures for Compliance Programmes

- Appoint and involve a DPO or privacy officer alongside the AML Compliance Officer; establish clear escalation between them.
- Maintain a data inventory and data flow map for all AML data, including vendor and cloud arrangements.
- Document the lawful basis for each AML processing activity.
- Draft privacy notices that inform customers, in general terms, that data is processed for legal compliance including AML, without revealing specific reporting.
- Build retention schedules that align statutory AML periods with deletion at the end of those periods.
- Apply role-based access controls so SAR information is restricted to those with a need to know.
- Conduct DPIAs for monitoring and screening systems and for new data-sharing arrangements.
- Include data protection clauses in outsourcing and vendor contracts, and perform due diligence on third-party processors.
- Train staff on handling subject access requests without tipping off.
- Test and document that the institution can still meet regulatory requests promptly despite privacy controls.

8. Common Conflicts and How to Resolve Them

Scenario: A customer demands deletion of all personal data under a right-to-erasure law. Correct response: The institution must retain data required under AML record-keeping rules for the statutory period and should respond that data is retained to comply with legal obligations, without disclosing any suspicion.

Scenario: A foreign subsidiary refuses to send customer information to head office citing local secrecy law. Correct response: Assess whether the local law truly prohibits the transfer, seek lawful mechanisms (regulatory permissions, anonymisation, aggregated risk data), apply additional controls, and inform the home supervisor if group standards cannot be implemented.

Scenario: Marketing wants to use AML risk scores to target products. Correct response: Refuse; this is an incompatible further purpose.

Scenario: Two banks suspect the same network is laundering funds and want to compare notes. Correct response: Use an available legal gateway such as Section 314(b) in the US or a recognised PPP; otherwise, each should file reports with the FIU, which can connect the information.

Scenario: An institution suffers a cyber breach exposing KYC files. Correct response: Activate incident response, notify the data protection authority within the required window, assess harm to individuals and to investigations, and notify the financial regulator as required.

9. Exam Tips: Answering Questions on Data Privacy and Protection Laws in AFC Work

Tip 1: Look for the answer that reconciles both regimes. CAMS questions rarely want you to choose privacy over AML or AML over privacy. The best answer usually complies with the AML obligation while using the least intrusive, best-documented method. Options that say refuse to comply with the AML requirement because of privacy law or ignore privacy law because AML always prevails are typically distractors.

Tip 2: Legal obligation is the lawful basis. If a question asks on what basis an institution processes customer data for CDD or reporting, choose compliance with a legal obligation or public interest, not consent.

Tip 3: Never tip off, even when responding to privacy requests. Any option that involves telling a customer about a SAR, an investigation or a law enforcement request is wrong, regardless of the privacy right invoked.

Tip 4: Retention trumps erasure during the statutory period. Remember FATF minimum of five years. Deletion requests cannot override this, but data should not be kept indefinitely without reason either.

Tip 5: Purpose limitation is strict. AML data may not be repurposed for marketing, credit decisions unrelated to legal requirements, or other commercial uses.

Tip 6: Cross-border transfers need a documented mechanism. If an answer involves sending data across borders, prefer the option that references adequacy, contractual safeguards, intra-group rules, regulatory approval or anonymisation, and that considers local law before transferring.

Tip 7: Know the safe harbours and partnerships by name. Section 314(b) (voluntary, requires registration with FinCEN, safe harbour from liability), Section 314(a) (law enforcement requests via FinCEN), JMLIT, Egmont Group principles, FATF Recommendations 2, 18 and 21. Questions often hinge on one defining feature of each.

Tip 8: Escalate and document. When a scenario presents a genuine conflict of laws, the correct answer usually involves consulting legal counsel and the DPO, documenting the analysis, applying mitigating controls and informing the supervisor, rather than a unilateral decision by a front-line employee.

Tip 9: Watch for the word solely in automated decision-making questions. Alerts reviewed by analysts are acceptable; account closures decided solely by an algorithm with no human review are problematic.

Tip 10: Eliminate extreme answers. Words such as always, never, all data, delete immediately or share freely usually signal a wrong option. The exam rewards proportionality and the risk-based approach.

Tip 11: Read for the jurisdiction. If the question specifies the EU, think GDPR concepts (DPIA, 72-hour breach notification, data subject rights, transfer mechanisms). If it specifies the US, think GLBA, Right to Financial Privacy Act and Section 314. If it mentions a secrecy jurisdiction or a data localisation regime, think about group-wide programme obstacles under Recommendation 18.

Tip 12: Remember the FATF position. Privacy and AML/CFT are meant to be compatible. Any answer that frames privacy as an obstacle to be bypassed, or AML as something to be abandoned, contradicts FATF guidance and is likely wrong.

10. Quick Revision Summary

- Personal data is central to CDD, monitoring, screening, reporting and sharing.
- Privacy laws (GDPR and others) impose lawfulness, purpose limitation, minimisation, storage limitation, security and accountability.
- AML processing is lawful under legal obligation or public interest; consent is inappropriate.
- Record retention of at least five years satisfies storage limitation because it is legally required.
- Data subject rights are restricted where needed to prevent crime; never tip off.
- Intra-group sharing is required by FATF Recommendation 18, subject to local law, with additional measures where blocked.
- Cross-border transfers need adequacy, safeguards or derogations.
- Legal gateways (Section 314(b), PPPs) and privacy-enhancing technologies enable sharing while protecting privacy.
- FATF Recommendation 2 requires AML/CFT cooperation to be compatible with data protection.
- In exam scenarios, choose the proportionate, documented, escalated answer that satisfies both regimes.