AML/CFT and data privacy regulation: Achieving a peaceful co-existence

The Fourth Anti-Money Laundering Directive (Directive (EU) 2015/849, 4AMLD), implemented as of 26th June, 2017, imposes new onerous obligations on those entities that are subject to this framework (‘obliged entities’) and which is likely to require a substantial investment in dedicated resources. The changes brought about by the 4AMLD cannot however be seen in isolation, but must be considered in the context of other important developments, including imminent revisions to the 4AMLD itself as well as the much awaited General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) which came into force on the 25th May, 2018. At first glance, the obligations under the 4AMLD and those ushered in by the GDPR appear to be heading in different directions. The dual nature of personal data collected for customer due diligence (CDD) purposes means that this data is simultaneously governed by two regimes that set apparently conflicting obligations. On the one hand, anti-money laundering and countering of the financing of terrorism (AML/CFT) laws seek to protect the financial system from fraud, tax evasion, drug trafficking and criminal activity; on the other hand, data privacy laws purport to protect an individual’s identity and choices from government and privacy abuse. Yet, upon close consideration, there are a number of possible measures that obliged entities can take and that will allow them to bridge the gap between these two regimes. This paper exposes the divergences between the AML/CFT and data privacy frameworks while attempting to reconcile these seemingly incompatible requirements. For this purpose, this paper aims to advise the reader on what internal systems, controls and projects can be embarked on in order to ensure a seamless implementation which is not only legally compliant, but also makes sound business sense in the longer term.