AML vs GDPR: how to verify a customer's identity without risking compliance breaches?

The scope of data processed within a KYC process should primarily result from AML regulations, while the extent and intensity of customer due diligence measures should reflect the identified risk level, customer type, nature of the business relationship, and other circumstances specified by law.

Such data may include:

• full name,
• nationality,
• PESEL number or date of birth,
• identity document series and number,
• address details,
• identification data of the customer's representative,
• beneficial ownership information,
• ownership structure information,
• source of funds information, where enhanced due diligence measures require it.

The new EU AML framework promotes greater harmonisation, digitalisation, and a risk-based approach. Among other things, the EU AML package emphasises proportionality, digital identification, and tailoring the scope of collected information to the actual level of risk, rather than mechanically collecting excessive data from every customer.

From a GDPR perspective, however, the key requirement is that the obliged entity must be able to demonstrate that the specific scope of data collected was necessary to fulfil AML obligations. In other words, being subject to AML regulations does not automatically grant an organisation the right to collect "everything, just in case."

This is one of the most common questions in both AML and data protection practice. The answer is not always straightforward.

Copying an identity document may be permissible where it is necessary to fulfil AML obligations and falls within the scope of customer due diligence measures being applied. However, this does not mean that every organisation should automatically copy the documents of all customers in every situation. Under Article 34(4) of the Polish AML Act, obliged entities may process information contained in customers' identity documents and may create copies of such documents for customer due diligence purposes.

The key word is "may." Article 34(4) does not impose a general obligation to copy identity documents.

Importantly, this approach has also been confirmed by the President of the UODO, who pointed out that the possibility of creating copies of identity documents constitutes a right available to obliged entities rather than a universal obligation applicable in all cases.

From a GDPR perspective, organisations should assess:

• whether a copy of the document is genuinely necessary;
• whether recording the information contained in the document would be sufficient;
• whether the scope of data captured on the copy can be limited, for example through technical measures, provided such measures do not prevent compliance with AML obligations or the ability to document them;
• who will have access to the copy;
• how long the document will be retained;
• whether storage systems provide an adequate level of security.

The greatest risk arises when organisations routinely collect scans of identity documents without assessing necessity, without a retention policy, and without access restrictions. Such practices may violate the principle of data minimisation and increase the impact of any security incident.

AML and GDPR pursue different objectives. However, both frameworks rely on a risk-based approach, although the subject and purpose of the risk assessment differ.

Under AML regulations, organisations must assess risks associated with customers, products, transactions, countries, distribution channels, and ownership structures. The intensity of verification measures should correspond to the level of money laundering or terrorist financing risk. Within both the Polish and EU AML frameworks, the risk-based approach is one of the fundamental principles of customer due diligence.

Under the GDPR, a risk-based approach means that controllers should assess risks to the rights and freedoms of individuals and implement appropriate technical and organisational safeguards.

A properly designed KYC process should therefore answer two questions simultaneously:

1. What AML risk is associated with this customer?
2. What privacy risk arises from the customer verification process?

Only by combining these two perspectives can an organisation create a procedure that is both regulatory-compliant and data protection-compliant.

The most common customer identity verification mistakes include:

• collecting excessive information "just in case"; ,
• copying identity documents without assessing necessity;
• failing to align the scope and intensity of customer due diligence measures with the identified risk level;
• failing to keep customer information up to date;
• retaining AML documentation longer than legally required;
• failing to restrict access to KYC documentation;
• not providing customers with clear information about data processing;
• inconsistencies between AML procedures, privacy notices, and records of processing activities.

Another significant issue is treating AML and GDPR as separate processes managed by different teams. Effective compliance requires consistency. AML procedures, data protection documentation, IT systems, and operational practices should work together.

To minimise compliance risks, organisations should implement several practical measures.

Customer identity verification does not have to create a conflict between AML and GDPR. Problems arise only when organisations act automatically, without risk assessment, without documentation, and without control over the scope of processed data.

A well-designed KYC process should be:

• compliant with AML requirements,
• proportionate from a GDPR perspective,
• tailored to the identified risk level,
• properly documented,
• technologically secure,
• easy for employees and customers to understand.

In practice, the safest organisations are those that view AML and GDPR not as competing obligations but as two components of the same compliance framework.

Customer identity verification is required under AML regulations, but it must also comply with GDPR principles. The key challenge is finding the right balance between effective anti-money laundering measures and personal data protection.

Key takeaways

• AML and GDPR are not contradictory. They complement one another. AML obligations provide the legal basis for processing personal data, but they do not remove the need to comply with GDPR requirements.
• Organisations should process only the information necessary to fulfil AML obligations, in line with the principle of data minimisation.
• The type of data collected should result from AML requirements, while the scope and intensity of customer due diligence measures should reflect the identified level of risk.
• The AML Act allows obliged entities to create copies of identity documents for customer due diligence purposes, but it does not impose a general obligation to do so. Each organisation should assess whether making a copy is justified and necessary in the specific circumstances.
• Both AML and GDPR rely on a risk-based approach. Organisations should assess not only money laundering risks but also privacy risks affecting individuals.