AML compliancemust be balanced with data protection lawssuch asGDPR (EU), CCPA (U.S.), and local banking secrecy laws.
Option B (Correct):Data minimization ensures financial institutions only collect and retain essential customer dataneeded for AML compliance.
Option C (Correct):Regularly updating data processing policies ensures compliance with evolving data protection regulations.
Why Other Options Are Incorrect:
Option A (Incorrect):Unrestricted access to customer data increases privacy risksand canviolate GDPR and other data protection laws.
Option D (Incorrect):AML data must not be repurposed without regulatory justification, asGDPR requires data usage to align with its original collection purpose.
Best Practices for Managing Data Privacy in AML Compliance:
Restrict access to AML data on a need-to-know basis.
Implement strong encryption and security controls for customer data.
Ensure all AML-related data collection aligns with privacy regulations.
Reference:
General Data Protection Regulation (GDPR), Article 5 (Principles for Data Processing) FATF Recommendation 2 (National AML Cooperation & Data Sharing)
6th EU AML Directive (6AMLD) on Data Protection and AML Compliance

According to the Wolfsberg Anti-Money Laundering Principles for Private Banking, the beneficial owners of a private banking account are those who generally have ultimate control over the funds in the account and those who are the ultimate source of funds for the account and whose source of wealth should be subject to due diligence1. These two criteria are meant to ensure that the bank knows who is ultimately behind the account and where the funds come from, in order to prevent the use of the bank for money laundering or other criminal purposes. Authorized signers on the account or those who have legal title to a controlling share interest in the customer are not necessarily the beneficial owners, as they may act on behalf of others or have limited influence over the account.
1: Wolfsberg Anti-Money Laundering Principles for Private Banking (2012), Section 1.3.1 and 1.3.2, 1 Reference:https://www.wolfsberg-principles.com/sites/default/files/wb/pdfs/wolfsberg-standards/10.%
20Wolfsberg-Private-Banking-Prinicples-May-2012.pdf(2)

AML compliancemust be balanced with data privacy laws, such asGDPR (EU), CCPA (U.S.), and jurisdictional banking secrecy laws.
Option A (Correct):Data protection laws regulate how customer information can be shared internallyand externally, ensuringconfidentiality and regulatory compliance.
Option B (Incorrect):Enterprise risk assessments do not determine data sharing rules; legal and regulatory policies do.
Option C (Incorrect):Risk rating does not impact legal data-sharing restrictions.
Option D (Incorrect):AML policies must align with data protection laws, not override them.
Key Data Privacy Considerations in AML Compliance:
GDPR (Article 6) requires a legal basis for processing personal data, including AML investigations.
Banking secrecy laws restrict sharing certain customer information without consent or legal obligation.
Internal information-sharing policies must be clear on what AML teams can disclose.
Best Practices for AML & Data Privacy Compliance:
Consult legal teams before sharing AML-related data internally or externally.
Ensure compliance with GDPR, CCPA, and banking secrecy laws.
Minimize data sharing to what is strictly necessary.
Reference:
FATF Recommendation 2 (National Cooperation and Coordination)
EU GDPR Article 6 (Lawful Processing of Personal Data)
Wolfsberg Group AML & Data Privacy Guidelines

* A: The first step in any suspicious activity investigation is to review the transaction history and other relevant account information to establish context, identify patterns, and determine if the behavior is consistent with known typologies of money laundering.
* "The initial phase of an AML investigation is to review relevant account information and transaction activity to assess whether a SAR filing is warranted."
* This approach ensures that any subsequent decisions, such as escalation, SAR filing, or customer outreach, are based on a comprehensive understanding of the facts.
References:
CAMS 6th Edition, Suspicious Activity Monitoring and Investigation
FFIEC BSA/AML Manual, Suspicious Activity Reporting

Adverse media screening seeks to identify reputational or financial crime risk by:
* B: Identifying links to criminal activity or sanctions.
* C: Monitoring regulatory actions and updates for risk associations.
* D: Regularly scanning news and public records for negative information.
"Adverse media screening involves collecting and reviewing publicly available information, news, and regulatory actions to detect links to criminal activity or reputational risks." (CAMS 6th Edition, Adverse Media Screening; FATF Guidance) Incorrect:
* A and E: Customer sentiment and credit scores are not core to adverse media screening.
References:
CAMS 6th Edition, Customer Due Diligence and Screening
FATF Guidance on Customer Due Diligence