GDPR Meets AML: New Joint Guidelines on Data Sharing for Financial Crime Detection

Financial institutions and fintechs face a growing paradox: GDPR demands strict data minimization, while anti-money laundering (AML) and counter-terrorist financing (CFT) regulations require broad data sharing to detect suspicious transactions. The European Data Protection Board (EDPB) and the Anti-Money Laundering Authority (AMLA) have released their first joint guidelines to resolve this tension. For CTOs and DPOs managing cross-border transaction monitoring, these guidelines are not just clarifications—they are a roadmap for avoiding regulatory collisions that could result in dual enforcement actions.

Why EDPB-AMLA Partnership Matters: The Regulatory Collision Point

The joint guidelines mark the first formal collaboration between the EDPB and AMLA, reflecting the EU’s recognition that financial crime detection and data protection are no longer siloed concerns. Under the Anti-Money Laundering Directive (AMLD6, Directive 2018/843), financial institutions must share customer data with Financial Intelligence Units (FIUs), law enforcement, and other obliged entities to identify suspicious transactions. Yet, GDPR’s Article 5(1)(c) mandates data minimization, and Article 6 requires a lawful basis for processing—principles that appear to conflict with AML’s transparency demands.

This collision point has left financial institutions in a compliance limbo. A 2023 survey by a major EU banking association found that 68% of respondents delayed or avoided data sharing due to GDPR concerns, even when AML obligations required it. The joint guidelines aim to eliminate this hesitation by providing a harmonized interpretation of how GDPR and AMLD6 interact.

The Core Tension: GDPR Minimization vs. AML Transparency Requirements

GDPR’s Data Minimization Principle

GDPR Article 5(1)(c) states that personal data must be "adequate, relevant, and limited to what is necessary" for the purposes of processing. For financial institutions, this means that customer data—such as transaction histories, IP addresses, or device fingerprints—cannot be shared indiscriminately. The principle is reinforced by Article 25, which requires data protection by design and default, embedding privacy into system architectures.

AML’s Transparency Demands

AMLD6, however, imposes obligations that seem to run counter to GDPR’s minimization principle. Article 32 of AMLD6 requires financial institutions to report suspicious transactions to FIUs, while Article 33 mandates cooperation with law enforcement. Additionally, Article 35 obliges institutions to share information with other obliged entities (e.g., banks, payment service providers) to detect cross-border money laundering schemes. These requirements often necessitate the sharing of large datasets, including personal data, to identify patterns indicative of financial crime.

The joint guidelines resolve this tension by clarifying that AML obligations constitute a legal obligation under GDPR Article 6(1)(c), providing a lawful basis for processing. However, this does not grant institutions carte blanche to share data. The guidelines emphasize that data sharing must still be necessary and proportionate to the AML objective.

What the Joint Guidelines Clarify on Lawful Basis and Necessity

Lawful Basis for Processing: GDPR Article 6(1)(c) and (e)

The guidelines confirm that financial institutions can rely on GDPR Article 6(1)(c) ("processing is necessary for compliance with a legal obligation") for AML-related data sharing. This applies to:

• Reporting suspicious transactions to FIUs (AMLD6 Article 32).
• Sharing data with other obliged entities for AML purposes (AMLD6 Article 35).
• Cooperating with law enforcement (AMLD6 Article 33).

For internal monitoring (e.g., transaction monitoring systems), institutions may also rely on GDPR Article 6(1)(e) ("processing is necessary for the performance of a task carried out in the public interest"), provided the processing is proportionate and aligned with AML objectives.

Necessity and Proportionality: The Balance Test

The guidelines introduce a three-step balance test to determine whether data sharing is necessary and proportionate:

1. 1Purpose Limitation: The data shared must be strictly for AML/CFT purposes. For example, sharing transaction data to detect money laundering is permissible; using the same data for marketing is not.
2. 2Data Minimization: Only the minimum necessary data should be shared. The guidelines provide examples: - For transaction monitoring, sharing the amount, date, and counterparty details may suffice; sharing the customer’s full transaction history may not. - For customer due diligence (CDD), sharing identity documents is necessary; sharing unrelated personal data (e.g., political opinions) is not.
3. 3Storage Limitation: Data should be retained only as long as necessary for AML purposes. The guidelines reference AMLD6 Article 40, which sets retention periods (typically 5 years after the end of a business relationship).

Special Categories of Data: GDPR Article 9

AML investigations may occasionally require processing special categories of data (e.g., biometric data, health data, or data revealing racial or ethnic origin). The guidelines clarify that GDPR Article 9(2)(g) ("processing is necessary for reasons of substantial public interest") can apply, provided the processing is:

• Based on EU or Member State law.
• Proportionate to the objective.
• Subject to appropriate safeguards (e.g., encryption, access controls).

Practical Implementation: Data Sharing Architectures for Compliance

Internal Transaction Monitoring Systems

Financial institutions must design their transaction monitoring systems (TMS) to align with both GDPR and AML requirements. The guidelines recommend:

• Pseudonymization: Use techniques like tokenization to minimize the exposure of personal data. For example, replace customer names with unique identifiers in monitoring systems.
• Automated Filtering: Implement rules to exclude non-essential data from alerts. For instance, a TMS could flag transactions over €10,000 but exclude unrelated data (e.g., the customer’s browsing history).
• Access Controls: Restrict access to personal data to authorized personnel only, with logging and audit trails (GDPR Article 32).

Cross-Institutional Data Sharing

AMLD6 Article 35 allows financial institutions to share data with other obliged entities to detect money laundering. The guidelines provide a framework for compliant sharing:

1. 1Legal Basis: Ensure the sharing is covered by GDPR Article 6(1)(c) or (e).
2. 2Data Sharing Agreements (DSAs): Draft DSAs that specify: - The purpose of sharing (AML/CFT only). - The categories of data shared. - Retention periods. - Security measures (e.g., encryption in transit and at rest).
3. 3Joint Controllership: If two institutions jointly determine the purposes and means of processing (e.g., in a consortium for transaction monitoring), they must enter into a joint controllership agreement under GDPR Article 26. The agreement should define responsibilities for data protection compliance and liability.

Sharing with FIUs and Law Enforcement

When reporting suspicious transactions to FIUs (AMLD6 Article 32), institutions must ensure:

• Data Minimization: Only include data relevant to the suspicious activity report (SAR). For example, if a transaction is flagged for structuring, the SAR should not include unrelated personal data.
• Secure Transmission: Use encrypted channels for transmitting SARs. The guidelines reference ENISA’s recommendations for secure data sharing in the financial sector.
• Logging: Maintain logs of all data shared with FIUs, including the purpose, recipient, and legal basis.

Documentation and Consent: What Your DPA Audit Will Expect

Records of Processing Activities (ROPA)

GDPR Article 30 requires institutions to maintain a Record of Processing Activities (ROPA). For AML-related processing, the ROPA should include:

• The purposes of processing (e.g., "transaction monitoring for AML compliance").
• Categories of data subjects (e.g., customers, counterparties).
• Categories of personal data (e.g., transaction data, identity documents).
• Recipients of the data (e.g., FIUs, other financial institutions).
• Retention periods (aligned with AMLD6 Article 40).
• Technical and organizational measures (e.g., encryption, access controls).

Data Protection Impact Assessments (DPIAs)

The guidelines recommend conducting a Data Protection Impact Assessment (DPIA) under GDPR Article 35 for high-risk AML processing activities, such as:

• Large-scale transaction monitoring systems.
• Cross-border data sharing with third countries.
• Use of AI for suspicious activity detection.

The DPIA should assess:

• The necessity and proportionality of the processing.
• Risks to data subjects (e.g., false positives leading to unjustified investigations).
• Mitigation measures (e.g., human review of automated decisions).

Consent: Not a Viable Lawful Basis

The guidelines explicitly state that consent (GDPR Article 6(1)(a)) is not a suitable lawful basis for AML-related data sharing. This is because:

• Consent must be freely given, but customers cannot meaningfully opt out of AML compliance without violating the law.
• Consent can be withdrawn, which would undermine AML obligations.
• Financial institutions are in a position of power over customers, making freely given consent unlikely.

Cross-Border Flows: AMLA Coordination and Third-Country Transfers

Intra-EU Data Sharing

AMLA’s role in coordinating cross-border AML efforts adds a layer of complexity to GDPR compliance. The guidelines clarify that:

• AMLA’s coordination does not override GDPR: Even when AMLA facilitates data sharing between Member States, institutions must still comply with GDPR’s principles (e.g., minimization, purpose limitation).
• Lead Supervisory Authority (LSA): For institutions operating in multiple Member States, the one-stop-shop mechanism (GDPR Article 56) applies. The LSA will coordinate with other supervisory authorities to ensure consistent enforcement.

Third-Country Transfers

Sharing AML-related data with third countries (e.g., correspondent