Anonymising CDD Onboarding Files for Internal Review – UK GDPR-compliant anonymisation per Money Laundering Regulations 2017
Customer due diligence (CDD) is the identity and risk-rating process MLR 2017 Regulation 27 requires before establishing a business relationship or processing EUR 15,000 transactions. The FCA fined Santander UK £107.7 million in 2022; the NCA received over 901,000 SARs in 2022-23. anonym.legal pseudonymises CDD onboarding file identifiers so compliance teams can audit quality without exposing personal data.
When this applies
This task applies when CDD onboarding files are circulated to internal audit, compliance oversight teams, or training facilitators who require sight of the procedural quality and risk-rating rationale but have no legitimate need to process the named customers' personal data under UK GDPR Art. 6.
How anonym.legal handles it
- Upload the CDD onboarding pack (PDF or DOCX) to anonym.legal; document structure and formatting are preserved.
- The engine detects personal-data entities across 267+ categories — full names, dates of birth, addresses, national insurance numbers, passport references, and contact details of the customer and any associated beneficial owners.
- Each customer and associated individual is assigned a consistent pseudonym applied uniformly across the onboarding checklist, identity verification notes, and risk-rating decision record.
- Risk-rating outcomes, onboarding-stage timestamps, source-of-funds category, and procedural checklists remain in clear text.
- A reversible mapping table is generated with UK/EU data residency, enabling full re-identification by the originating compliance team.
- Release the pseudonymised pack for internal audit or training; use the mapping key to restore original identities when the file is required for regulatory inspection.
What you provide
- CDD onboarding checklist and decision record
- Identity verification notes (names, document types, verification outcome)
- Risk-rating rationale document
Limitations & cautions
- The pseudonymised pack is for internal review only; any regulatory production of CDD records must use the re-identified originals. UK GDPR maximum fines reach up to £17.5 million or 4 percent of annual global turnover under DPA 2018 s.157 — a further reason to restrict personal data access to those with a legitimate need.
- Scanned identity documents with low image quality may require OCR pre-processing for full entity detection.
- The tool pseudonymises personal data but does not assess whether the CDD procedure meets the standard required by the Money Laundering Regulations 2017 (MLR 2017 Reg 27 and Reg 28).
FAQ
Can I use pseudonymised CDD files for staff AML training?
Yes. Pseudonymised onboarding packs that preserve the procedural and risk-rating narrative are ideal for training purposes, removing the risk of unnecessary personal-data processing by trainees.
Does the engine detect non-UK identity document references?
Yes. The engine covers international identity document formats. Passport numbers, national identity card references, and similar identifiers are detected irrespective of issuing country.
What happens to the risk-rating score in the pseudonymised file?
Risk scores, risk categories, and the procedural rationale are preserved in clear text. Only the customer's identifying information is pseudonymised.
Is the mapping table stored in the UK?
All processing and storage occurs within UK/EU data residency boundaries in line with UK GDPR requirements. The lawful basis for processing CDD records is Article 6(1)(c) — compliance with a legal obligation — and, where criminal offence data is involved, Article 9(2)(g) with the Schedule 1 DPA 2018 condition.