The European Union's new anti-money laundering regulation becomes directly applicable 10 July 2027, introducing a more harmonized AML framework across the EU. While the regulation is primarily aimed at strengthening the fight against money laundering and terrorist financing, it also introduces important rules on how AML-obliged entities use, share and store personal data.

The AML regulation does not create a separate data protection regime. Instead, it supplements the EU General Data Protection Regulation by establishing more specific requirements for processing personal data in the AML context, particularly regarding automated processing, the further use of AML-related information and safeguards for affected individuals — such as data subjects.

The regulation applies to a broad range of obliged entities, including financial institutions, insurers, crypto-asset service providers, lawyers, notaries, real estate agents and trust or company service providers. As of 10 July 2029, it also extends AML obligations to certain professional football clubs and football agents.

The AML regulation is part of a broader legislative package that also established the Anti-Money Laundering Authority, which will coordinate supervision, support national financial intelligence units and promote consistent AML practices across the EU. For privacy professionals, however, the most significant changes are found directly in the AML regulation's provisions on data usage and processing.

Automated processing requires human oversight

Automated processing has become essential for modern AML compliance. Customer onboarding, transaction monitoring and ongoing customer due diligence increasingly rely on systems capable of analyzing large volumes of information quickly and consistently. For large financial institutions, manual review of every customer or transaction is no longer realistic.

The AML regulation expressly recognizes this reality. Recital 150 acknowledges the role of automated processing in AML activities, but Article 76 introduces additional safeguards designed to protect individuals affected by automated analysis, the most important of which is the requirement for human involvement.

Under Article 76(5) of the AML regulation, obligated entities may use automated processes, including profiling and AI systems, but certain AML decisions require meaningful human intervention. This applies particularly to decisions to enter into or refuse a business relationship, maintain such a relationship, carry out occasional transactions or adjust the extent of customer due diligence measures.

The AML regulation does not replace Article 22 of the GDPR and its general rules for automated individual decision-making. Instead, it adds sector-specific safeguards for AML processing, particularly by requiring meaningful human intervention for specific AML decisions.

The GDPR regulates solely automated decision-making but does not generally require human intervention whenever automated processing is permitted under its exceptions. Another safeguard in the AML regulation is that customers have the right to obtain an explanation of the decision reached by the obliged entity and to challenge that decision, except where this would relate to a report submitted to financial intelligence units under Article 69 of the AML regulation.

Special categories of personal data in AML processing

The AML regulation also provides greater certainty regarding the processing of special categories of personal data. Articles 76(2) and 76(3) expressly permit such processing where necessary for AML purposes. The processing remains based on Article 6(1)(c) of the GDPR, while Article 76 of the AML regulation provides the specific conditions allowing the processing of special categories of personal data under Article 9(2)(g) of the GDPR.

The AML regulation does not provide unrestricted access to special categories of personal data. Article 76 subjects such processing to a number of safeguards. Obliged entities must inform customers that the data may be processed for AML purposes, ensure that the information is obtained from reliable sources and remains accurate and up to date, prevent decisions that could result in biased or discriminatory outcomes, and implement a high level of security in accordance with Article 32 of the GDPR, with particular emphasis on protecting the confidentiality of the data.

These safeguards reflect lawmakers' recognition that the broader ability to process special categories of personal data which are more sensitive from the data subject point of view for AML purposes must be accompanied by stronger protections for them.

AML data cannot become general business data

Another significant obligation introduced by the AML regulation concerns the further use of personal data collected for AML purposes. The regulation makes it clear that information obtained solely to prevent money laundering and terrorist financing cannot simply become a general source of business information. Recital 151 and Article 76(4) of the regulation reflect a basic principle: data collected exclusively for AML purposes cannot subsequently be used for incompatible purposes.

The extensive access to personal information granted to obligated entities is justified by the public interest in combating financial crime, not by commercial interests.

In practice, organizations should distinguish between two categories of data. The first consists of information an organization already processes for other purposes, such as providing financial services, managing customer relationships or performing contractual obligations, and which is then processed for AML purposes as well. The AML regulation does not restrict the use of such data for original or further business purposes, but further processing does remain subject to the GDPR, including the compatibility assessment under Article 6(4), where necessary.

The second category includes information collected solely and only because AML legislation requires it. This may include the source of wealth or funds, politically exposed person status, the intended nature of a business relationship, transaction patterns or information obtained through ongoing monitoring. Where such information has been collected solely for AML purposes, it cannot be reused for marketing, customer profiling or other commercial activities. This remains true even where the information is already available within the organization's systems.

For many organizations, this will require a more precise approach to data governance. It will no longer be sufficient to classify information only by system or database. Organizations should also understand the legal purpose for which data was originally collected and ensure that AML-specific information remains subject to appropriate restrictions throughout its whole life cycle.

What does the AML regulation mean for GDPR compliance?

From a GDPR perspective, the AML regulation does not fundamentally change the legal basis for AML-related data processing. Processing remains based on compliance with a legal obligation under Article 6(1)(c) of the GDPR. The regulation mainly provides more detailed rules on what information may be processed, how it may be used and what safeguards must apply.

The AML regulation also harmonizes retention requirements for AML-related records. Under Article 77, obliged entities must retain documentation and information obtained for AML purposes for five years, with a possible extension for a further five years by national law.

Most GDPR obligations remain unchanged. Organizations must continue to implement appropriate technical and organizational measures, ensure security of processing and comply with accountability requirements. The AML regulation also does not introduce new data subject rights. Recital 157 clarifies that existing GDPR restrictions continue to apply where disclosure of information could undermine AML objectives, such as tipping off customers or compromising investigations.

The practical impact for privacy teams will, therefore, not be a complete redesign of GDPR compliance programs. Instead, organizations should review whether their AML processes reflect the additional safeguards introduced by the AML regulation, particularly regarding automated processing, special categories of personal data processing and restrictions on further use of AML-specific information.

The regulation also raises an important governance question. Article 11 requires AML-obliged entities to designate a compliance manager responsible for ensuring compliance with the AML framework. In smaller organizations, compliance responsibilities are often combined within a single department or assigned to one person. This raises the question of whether the AML compliance function could also be performed by the data protection officer without creating a conflict of interest under the GDPR, another topic to explore.

Search resources

Featured resources

NIS2 Directive: Mapping the Interplays with the GDPR

GDPR at 10: A Look Back at the Past 10 Years

EU AI Act: Mapping the Interplays with the GDPR

Digital Services Act: Mapping the Interplays with the GDPR

All IAPP resources

Filter results

Resource type

Subject

Industry

Law and regulation

Domain

State of Data Rights Report

10 Tips for Global Compliance with Privacy and Data Protection Laws

How the EU's new AML regulation will change personal data processing

Managing agents in the agentic AI era: The critical role of purpose and data minimization