Pseudonymising Source-of-Wealth Files for AML QA – UK GDPR-compliant anonymisation per Money Laundering Regulations 2017
A source-of-wealth questionnaire is the financial history document MLR 2017 Regulation 33 requires for PEPs — explaining overall net worth rather than specific transaction funds. The FCA fined NatWest £264.8 million in 2021 and Santander UK £107.7 million in 2022 for AML failures; the NCA received 901,000 SARs in 2022-23. anonym.legal pseudonymises identifiers while preserving the wealth-origin narrative for compliance review.
When this applies
This task applies when source-of-wealth questionnaires and supporting evidence are reviewed by compliance oversight, internal audit, or training facilitators who need to assess procedural adequacy under MLR 2017 without accessing the specific customer's wealth history and personal biographical data.
How anonym.legal handles it
- Upload the completed source-of-wealth questionnaire and any supporting evidence summaries.
- The engine identifies the customer's name, biographical details, employment history references, named business interests, and any named family members referenced in inheritance or gift explanations.
- Each individual is pseudonymised consistently; wealth-origin category, evidence type, and compliance-officer verification notes are preserved.
- Business entity names referenced as wealth sources are preserved unless you flag them for pseudonymisation.
- A reversible mapping table is produced with UK/EU data residency.
- Release the pseudonymised questionnaire for quality review; restore originals before any regulatory submission.
What you provide
- Completed source-of-wealth questionnaire
- Supporting evidence summary or inventory
- Compliance officer's adequacy assessment notes
Limitations & cautions
- The tool does not assess whether the source-of-wealth evidence provided is sufficient for the risk level of the customer. UK GDPR maximum fines reach up to £17.5 million or 4 percent of annual global turnover under DPA 2018 s.157 — processing wealth-origin data beyond its lawful basis compounds regulatory risk.
- Employment history references that contain employer names are pseudonymised at the individual identifier level; the employer name may be preserved unless flagged.
- The pseudonymised questionnaire is for internal review only; regulatory submissions require the re-identified original. MLR 2017 Regulation 39 requires staff who handle high-risk customer files to receive appropriate AML training.
FAQ
Should I pseudonymise employer names as well as the customer's name?
Employer names are typically corporate identifiers rather than personal data. However, if the employer name would readily identify the individual in context, you can flag it for pseudonymisation before processing.
How are inheritance or gift explanations handled when they name the donor?
Named donors or family members referenced in inheritance or gift explanations are pseudonymised as distinct individuals with consistent pseudonyms throughout the document.
Can a pseudonymised source-of-wealth questionnaire be used in external AML training?
Yes, provided the pseudonymisation is robust enough to prevent re-identification in the training context. MLR 2017 Regulation 39 requires firms to provide regular AML training to relevant employees, and pseudonymised wealth-origin case studies support this obligation. For external training, obtain legal advice on the adequacy of pseudonymisation for the specific disclosure context.