GRA · Financial Crime and Fraud Risk
Spatial financeWhere capital meets hazard, exposure and transition
Financial crime data rights
Financial crime controls collect, analyse and share large amounts of personal data, and can close accounts or block payments. These powers affect privacy, access to financial services and the right to explanation and redress. De-risking excludes whole groups. This page sets out how financial crime controls interact with data protection and rights, how effects are measured, and who decides the balance.
Financial crime data rights in seven parts.
- 01The questionFinancial crime data rights: how the risk develops
- 02IndicatorsWhat is measured, and how well
- 03SourcesWhere the evidence comes from
- 04DecisionsWho decides, and what the evidence serves
- 05Core questionsWhat experts ask
- 06Mechanisms and driversNecessary intrusion, with limits
- 07Methods and dataHow the evidence is built, and where it stops
Financial crime data rights: how the risk develops.
Sensitive data and privacy boundaries. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Monitoring is broad
Transaction monitoring and screening process data on all customers to find a few suspects. Data protection law requires necessity, proportionality and safeguards.
De-risking excludes
Institutions close accounts or refuse whole categories of customers, such as charities, money transfer operators or people from certain countries, to avoid risk and cost.
Tipping-off limits explanation
Laws against tipping off suspects stop firms explaining why accounts are closed or payments blocked, leaving innocent customers without reasons.
Sharing needs safeguards
Information sharing between institutions improves detection and raises risks of wrongful exclusion. Legal gateways and oversight define what is allowed.
Alert triage and investigations.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Alert triage and investigations
Financial crime data rights · Bank B monitoring · Today
- Alerts today1807
- Escalated to cases9pct of alerts
- Open cases older than 30 days109Watch
- Reports filed this month77Normal
Alert queue
- HRapid in-out through new accountsScenario TM-07 · score 924 h
- MTrade invoice price outlierScenario TB-03 · score 744 h
- MStructuring below thresholdScenario TM-02 · score 805 h
- LName match, sanctions listLikely false positive3 h
Counterparty network, case CS-6304
red: accounts under review
Case path
- Alertscenario
- Triageanalyst
- Investigatecase
- DecideMLRO
- Reportto FIU
- Feedbacktuning
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Account closures for financial crime reasons | count | annual | Firm and regulator data | REPORTED |
| Complaints about account closures and refusals | count and share upheld | annual | Ombudsman data | Published statistics |
| Correspondent banking relationships | count by region | annual | CPMI data | Published statistics |
| Adults without an account | share of adults | periodic | World Bank Global Findex | ESTIMATED |
| Data protection decisions involving financial crime processing | count | annual | Data protection authority records | Published statistics |
| Legal gateways for information sharing | categorical by jurisdiction | on change | Legislation | Published statistics |
What financial crime data rights means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in financial crime data rights reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| FATF guidance on financial inclusion and de-risking | Risk-based approach and unintended consequences | Free, FATF terms |
| FATF stocktake on data pooling and privacy | Data protection and AML information sharing | Free, FATF terms |
| European Data Protection Board statements on AML | Data protection views on AML measures | Free, EU reuse terms |
| Financial Ombudsman Service decisions | Complaints about account closures and blocks | Free, terms per ombudsman |
| World Bank studies on correspondent banking withdrawal | Effects of de-risking on countries | Free, World Bank terms |
Who decides, and what the evidence serves.
Financial Crime and Fraud Risk prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Legislators | What information sharing and data retention the law permits | Comparative laws and rights assessments |
| Data protection authorities | Whether financial crime processing is lawful and proportionate | Complaints and processing records |
| Firm compliance and conduct functions | How to apply controls without unjustified exclusion | Closure, complaint and outcome data |
| Ombudsmen and courts | Whether customers were treated fairly | Case records; the page serves context only |
Outputs this topic produces
- Guide to data protection in financial crime controls
- Brief on de-risking and financial exclusion
- Comparative notes on information sharing gateways
- Questions for boards on proportionality and redress
What experts ask.
Data rights specialists ask how financial crime controls can respect privacy and fairness.
- What legal bases allow institutions to process personal data for financial crime purposes?
- How can information be shared between institutions to detect crime without excessive intrusion?
- How do automated controls affect different groups, and how are bias and errors detected?
- What rights do people have when they are flagged, restricted or excluded?
- How long should financial crime data be retained, and how is it secured?
Necessary intrusion, with limits.
Anti-money laundering and fraud obligations require institutions to collect and analyse personal data, often with legal exemptions from some data protection rights. Information sharing between institutions can improve detection of networks but raises privacy concerns and must have a legal basis. Privacy-enhancing technologies offer ways to analyse data jointly without exposing it, though their use is still developing.
Automated controls can produce errors that fall unevenly. Names common in particular communities may generate more false matches; behaviour typical of certain groups may be flagged as unusual. People affected may face restricted services without explanation. Governance, testing for bias, human review and redress mechanisms are central safeguards.
How the evidence is built, and where it stops.
- 01
Legal analysis
Comparing data protection and financial crime law. Interpretation varies.
- 02
Bias testing
Assessing outcomes of automated controls across groups with AI and machine learning methods. Data on protected characteristics may be unavailable.
- 03
Privacy-enhancing technology review
Evaluating techniques for joint analysis with data engineering, interoperability and stewardship. Many are not yet mature.
- 04
Governance review
Examining data governance and identity safeguards, drawing on digital identity research. Practices vary across firms.
How it is studied, and what the methods cannot say.
- 01Data engineering, interoperability and stewardshipScreening data quality · Monitoring coverage checks · Retention and minimisationApplied here
- 02Digital identity and public digital systemsAssurance levels for onboarding · Defending against deepfakes · Inclusion testingApplied here
- 03Artificial intelligence and machine learningReal-time fraud scoring · Alert prioritisation · Fairness in fraud controlsApplied here
Questions and answers.
What is de-risking?
Why won't a bank explain an account closure?
Does data protection law apply to AML monitoring?
Can banks share customer data to fight fraud?
Can automated financial crime controls be biased?
Does GRA collect customer data?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.