Industry Reference | Financial Services
Part of the industry reference. Restructured from the financial services deep dive for quick lookup. For GDPR/AMLD regulatory governance frameworks, see governance and ops.
Core challenge: regulation prohibits anonymization
The only vertical where regulation mandates identifiable retention of core operational data. AML directives require 5–10 year retention of KYC records, transaction logs, and SARs — premature anonymization is itself a compliance violation.
Data treatment by anonymizability
| Data type | Can anonymize? | Treatment | Regulatory basis |
|---|---|---|---|
| KYC / customer identification | No | Pseudonymize in Zone 1; identifiable in Zone 0 | AMLD5 Art. 13 (identification duty) + Art. 40 (5-year retention) |
| Transaction records | No (operational) / Yes (analytical derivatives) | Operational in Zone 0–1; analytical derivatives to Zone 2–3 | AML retention: 5 years (uniform under AMLR from July 2027) |
| SARs | No | Must include full identifying information | "No tipping off" restricts GDPR notification |
| Beneficial ownership records | No | Identifiable and verified | AMLD requirement |
| Risk assessments / PEP classifications | No | Retained with source data | Required for ongoing due diligence |
| Aggregated stats, segments, analytical outputs | Yes | k-anonymity, DP, synthetic data | Analytical zone serves product dev, market research |
Regulatory collision map
| Regulation | Requires | Conflicts with | Resolution |
|---|---|---|---|
| GDPR | Data minimization, storage limitation, right to erasure | AML mandatory retention | Anonymize analytical derivatives; retain operational data with documented lawful basis |
| AMLD/AMLR | 5-year identifiable retention | GDPR minimization | Documented AML legal obligation as lawful basis; auto-delete at retention expiry |
| PSD2/PSD3 | 5-year transaction records | GDPR minimization | Same resolution as AML |
| MiFID II | 5-year transaction retention | GDPR minimization | Same resolution as AML |
| DORA | ICT risk management, incident reporting | — | Applies to ~22,000 financial entities; anonymization of test data is one compliance lever |
| EU AI Act | Explainability for high-risk AI (credit scoring) | — | Dual compliance: GDPR Art. 22 + AI Act; synthetic data for model development |
See Module 01 and Module 09 for the full AMLD/GDPR regulatory treatment.
Cross-institutional fraud detection
| Approach | Privacy mechanism | Status |
|---|---|---|
| Federated learning | Raw data stays local; only model updates shared | SWIFT trial: 13 banks on Google Cloud, 2× fraud detection effectiveness |
| Synthetic transaction data | Train on synthetic; deploy on real | Gretel in DP mode for formal guarantees |
| Secure multi-party computation | Encrypted matching | Emerging; limited production deployment |
| Data clean rooms | Joint analysis without raw data exchange | BigQuery Data Clean Rooms for GCP-native participants |
Common client starting position
Two opposing regulatory forces — GDPR pushing toward minimization vs AML/KYC mandating identifiable retention. Reconciliation: clear classification scheme labeling each dataset's regulatory retention status. Operational data stays identifiable in Zones 0–1; analytical derivatives flow to Zones 2–3.
First engagement question: "Which data CANNOT be anonymized?" — map retention requirements before designing the anonymization pipeline.