GDPR and AML, what can go wrong ?

The intersection of GDPR and Anti-Money Laundering (AML) regulations creates unique compliance challenges for organizations. AML obligations require collecting and retaining extensive personal data, which must be reconciled with core GDPR principles such as data minimization, purpose limitation, and storage limitation.

Here is the complete recorded presentation for the speech “GDPR & AML what can go wrong” :

The intersection is becoming even more complex with the EU Anti-Money Laundering Authority (AMLA) becoming operational in 2026, as this new centralized supervisor will impose additional harmonized data collection and retention requirements that organizations must reconcile with their existing GDPR obligations. Organizations subject to both AML and GDPR requirements should ensure they have a clear legal basis for processing, typically a legal obligation under Article 6. The legitimate interest basis may also apply for certain fraud-prevention activities. For a step-by-step approach to meeting both sets of requirements, see our GDPR compliance checklist.