Question 1

How long must AML records be kept?

Accepted Answer

| Jurisdiction | Period | Trigger |

Question 2

How does GDPR interact with AML record-keeping?

Accepted Answer

The GDPR (Regulation (EU) 2016/679) recognises AML obligations as a lawful basis for processing personal data (Art. 6(1)(c) — legal obligation). Retention beyond the AML statutory period is generally unlawful absent another legal basis. Subject access requests are limited where disclosure would p...

Question 3

What about California (CCPA / CPRA) and other US state privacy laws?

Accepted Answer

US state privacy statutes (CCPA / CPRA in California, VCDPA in Virginia, CPA in Colorado, and others) generally include exemptions for personal information collected, processed, sold or disclosed pursuant to the BSA / FinCEN regime. Compliance teams should map which exemption applies to which obl...

Recordkeeping & data protection