GDPR, BSA/AML and operational resilience
Data protection, US anti-money-laundering law, and keeping payments running under stress
GDPR, BSA and AML and operational resilience: data protection, US anti-money-laundering law, and keeping payments running under stress.
What You Can Do After This Chapter
Learning objective. Learner explains what counts as personal data in a payment, how data subject rights work against the AML retention wall, and when a cross-border payment is also a cross-border data transfer. Learner describes the US Bank Secrecy Act, operational resilience under DORA, and the first 72 hours of a payment outage, and brings GDPR, BSA and DORA together in one operating model.
Practical assessment. Learner receives a case where a customer asks for erasure of their payment history while the bank must retain it under AML rules, then explains the conflict, the lawful basis, and the answer the bank gives within one month under Article 15. Learner also drafts the incident response for a payment outage.
Expected deliverables.
- Data subject rights case note
- Cross-border data transfer map
- Incident response plan for a payment outage
- Compliance operating model diagram
Completion criterion. Learner explains the erasure conflict correctly, states the Article 15 one month deadline, and drafts a usable incident response for the first 72 hours.
- GDPR and payment data: what counts as personal data in a payment
- Data subject rights in payments: access, erasure and the AML wall
- Cross-border data transfers: when a payment message leaves the region
- The US Bank Secrecy Act: the BSA framework behind every dollar payment
- Operational resilience and DORA: staying open when things break
- Incident management and reporting: the first 72 hours of a payment outage
- A compliance operating model for a payments firm: putting GDPR, BSA and DORA together
Start Lesson 1: GDPR and payment data: what counts as personal data in a payment →