Pseudonymising Source-of-Funds Files and Bank Statements – UK GDPR-compliant anonymisation per Money Laundering Regulations 2017
A source-of-funds questionnaire is the MLR 2017 Regulation 28 document establishing the origin of transaction funds — required for EUR 15,000 transactions and higher-risk relationships. The FCA fined NatWest £264.8 million in December 2021 and Santander UK £107.7 million in 2022 partly for source-of-funds failures. anonym.legal pseudonymises customer identifiers while preserving the funds-origin narrative so compliance reviewers can assess verification adequacy.
When this applies
This task applies when source-of-funds questionnaires and supporting statements are reviewed by compliance oversight, quality-assurance teams, or external auditors assessing whether the firm has applied adequate verification measures under MLR 2017, and those reviewers have no need to know the identity of the specific customer.
How anonym.legal handles it
- Upload the completed source-of-funds questionnaire and any supporting bank statement extracts.
- The engine detects the customer's name, account numbers, sort codes, and any named transaction counterparties in the documents.
- Each individual and account identifier is pseudonymised consistently; account type, transaction categories, amounts, and date ranges are preserved.
- The funds-origin narrative and the compliance officer's verification notes remain in clear text.
- A reversible mapping table is produced with UK/EU data residency.
- Release the pseudonymised documents for oversight review; restore originals before any regulatory submission.
What you provide
- Completed source-of-funds questionnaire
- Supporting bank statement extracts (PDF or CSV)
- Compliance officer's verification notes
Limitations & cautions
- Bank statement images with embedded handwritten annotations may not be fully captured by automated entity detection; a manual review of the pseudonymised output is recommended.
- Transaction counterparties named in bank statements are pseudonymised; the transaction category and amount are preserved. UK GDPR maximum fines reach up to £17.5 million or 4 percent of annual global turnover (DPA 2018 s.157) — sharing unredacted statements beyond the compliance team creates a material regulatory risk.
- The tool does not assess whether the source-of-funds evidence provided meets the standard required by MLR 2017 Regulations 27 and 28.
FAQ
Are account sort codes and account numbers pseudonymised?
Yes. Sort codes and account numbers are personal data under UK GDPR when associated with an identifiable individual and are pseudonymised with consistent placeholder references.
Can I use pseudonymised source-of-funds files for AML training scenarios?
Yes. Pseudonymised questionnaires and statement extracts that preserve the funds-origin narrative and transaction patterns are suitable training materials. MLR 2017 Regulation 39 requires regulated-sector firms to provide staff with AML training at appropriate intervals, and realistic pseudonymised case studies support that obligation.
How are joint-account statements handled?
Each named account holder receives a distinct pseudonym; the joint-account structure is preserved in the pseudonymised output.