Pseudonymising Firm-Wide Financial-Crime Risk Assessments – UK GDPR-compliant anonymisation per FCA SYSC 6
A firm-wide financial-crime risk assessment (FCRA) is the documented analysis FCA SYSC 6 and MLR 2017 Regulation 18 require — mapping fraud, laundering, and sanctions exposure and assigning controls to named senior managers. The FCA fined NatWest £264.8 million in 2021 and Santander UK £107.7 million in 2022; the FCA conducted 30 s.166 reviews in 2023. anonym.legal pseudonymises named individuals so FCRAs can be shared externally without disclosing personal data.
When this applies
This task applies when an FCRA is shared with external assurance providers, skilled-person reviewers, or board advisers who require sight of the risk methodology, exposure ratings, and control gaps under FCA SYSC 6 but do not need to know the identities of named individuals referenced in the assessment.
How anonym.legal handles it
- Upload the FCRA document (PDF or DOCX).
- The engine identifies named senior managers, named risk owners, and any named customer-segment examples referenced in the narrative.
- Each named individual is pseudonymised consistently; risk exposure ratings, control descriptions, gap analysis, and remediation timelines are preserved.
- Board-approval records and regulatory-submission history references remain in clear text.
- A reversible mapping table is produced with UK/EU data residency.
- Release the pseudonymised FCRA for external adviser or auditor review; restore originals before any regulatory submission.
What you provide
- Firm-wide financial-crime risk assessment document
- Risk-register appendix (if it names individuals as risk owners)
- Board-approval sign-off documentation
Limitations & cautions
- The tool pseudonymises personal references in the FCRA but does not assess whether the risk methodology or control framework is adequate under FCA SYSC 6 or MLR 2017 Regulation 18. UK GDPR maximum fines reach up to £17.5 million or 4 percent of annual global turnover under DPA 2018 s.157.
- FCRAs that reference named customer segments or customer types (rather than named individuals) do not require pseudonymisation of those segment descriptions.
- The pseudonymised FCRA must not be submitted to the FCA or UKFIU in place of the original. The FCA's 2023 Financial Crime Annual Report recorded 30 firms subject to s.166 reviews in the year.
FAQ
Should I pseudonymise the names of senior managers listed as risk owners?
Yes. Senior manager names are personal data under UK GDPR and should be pseudonymised when the FCRA is shared outside the compliance team. Role titles and responsibility areas are preserved.
Does the tool handle FCRAs that reference third-party correspondent bank relationships?
Named natural persons at correspondent banks are pseudonymised. Correspondent bank institution names are preserved unless you flag them for pseudonymisation.
Can a pseudonymised FCRA be shared with an external skilled-person reviewer?
Yes, for preliminary review purposes. However, the skilled-person reviewer may ultimately require the re-identified version to fulfil their obligations under an FCA s.166 review — confirm this requirement before sharing the pseudonymised version.