FCA AML Supervision And Client Data In Law And Accountancy Firms

The FCA’s takeover of anti-money laundering (AML) supervision for law firms, accountants and trust and company service providers is primarily a story in financial regulation, but there are important data protection elements which are important to bear in mind.

AML supervision runs on personal data – client due diligence files, source of funds evidence, suspicion reports and risk assessments – much of it relating to alleged or suspected criminal conduct. Changing who supervises that work, and how, changes where that data goes, who sees it and what it is used for.

In this post we look at what is changing, the data protection questions it raises, and the practical steps firms can take ahead of the transition.

What is changing

The FCA will become the single AML supervisor for legal, accountancy and trust and company service providers. Today that work is split between HMRC and around 22 professional body supervisors, such as the SRA and ICAEW.

The Government estimates that around 60,000 businesses and sole practitioners will move across. The FCA expects a phased transition to start in autumn 2028 and finish around 2030. The reform depends on new legislation, which the Government refers to as the Financial Services Bill, together with secondary legislation including amendments to the Money Laundering Regulations, following its June 2026 consultation response.

The FCA has said that it intends to integrate legal and accountancy information and intelligence into its supervisory approach. It has also discussed the potential use of agentic technology in supervision. The eventual operating model, including the scale of information requests and the extent to which AI will inform supervisory activity, remains under development.

More data in one place

The biggest data protection shift is aggregation. Information that is currently distributed among 22 professional body supervisors and HMRC will increasingly flow into one regulator with extensive existing data and intelligence capabilities.

Much of what firms hand over may be criminal offence data under Article 10 UK GDPR, which can cover allegations and suspicions as well as convictions. A firm disclosing such data to the FCA will need an Article 6 lawful basis and, unless the processing is under the control of official authority, an applicable condition in Schedule 1 to the DPA 2018. The appropriate basis and condition will depend on the legal requirement, purpose and circumstances of the disclosure. Firms should document that analysis and maintain an appropriate policy document where the chosen condition requires one.

Transparency matters too. Firms whose privacy notices identify their current professional body, or describe recipients too narrowly, may need to update them to cover disclosure to the FCA for AML supervision. The notice should also explain the purposes of the sharing and, where required by the transparency rules, provide meaningful information about any relevant further use or combination with wider intelligence.

Firms should also keep an eye on the information-sharing provisions in the Economic Crime and Corporate Transparency Act 2023. They remove some civil liability barriers to sharing for economic crime purposes, but they do not displace data protection law. Any sharing still needs a lawful basis, a condition for criminal offence data and proportionate scope.

Agentic supervision and AI risk scoring

The FCA’s interest in agentic supervision deserves attention from a data protection angle. Risk-scoring a large company is one thing. Many of the 60,000 newly supervised entities are sole practitioners and small partnerships, where scoring “the firm” is in practice profiling identifiable people.

If risk scoring contributes to a decision about an identifiable sole practitioner or partner, the UK GDPR rules on profiling and automated decision-making may be relevant. The specific safeguards for significant automated decisions apply where a decision is based solely on automated processing and produces legal or similarly significant effects. Following the Data (Use and Access) Act 2025, a broader range of Article 6 lawful bases may support such decisions, but safeguards remain necessary. The position is more restrictive where special category data is involved.

Of course, we would expect the FCA to carry out data protection impact assessments for these tools and to be open about how they are used. Firms will reasonably want to know whether a supervisory visit, information request or enforcement referral was prompted by an algorithm, and what data went into it.

There is a mirror-image point for firms themselves. Many use automated screening and AI tools for client due diligence. A more data-literate supervisor is likely to ask how those tools work, so firms should make sure their own DPIAs and documentation are up to date.

Retention, minimisation and MLR regulation 41

The MLRs already contain their own data protection rules, and they are easy to overlook. Regulation 41 says personal data obtained for AML purposes may only be processed to prevent money laundering and terrorist financing, unless another law permits wider use or the client consents. Firms must also give new clients specific information about that processing.

Regulation 40 sets the retention rule: CDD records are generally kept for five years after the business relationship ends, then deleted unless an exception applies. In our experience, many firms keep AML records longer, often on a “just in case” basis or because they sit inside matter files with longer retention.

A more evidence-focused supervisor will add pressure in both directions. Firms will want to hold enough to show the FCA their controls work. They also need to resist reusing AML data for marketing, credit decisions or general client profiling, and to delete it on time. Now is a good moment to check that retention schedules and systems actually separate AML records from everything else.

Privilege, subject access and tipping off

The Government has confirmed that legal professional privilege will continue to be protected, so the FCA will not be able to compel privileged material. Some campaigners argue for a narrow exception, so this is worth watching as the Bill progresses.

For law firm DPOs, privilege already intersects with data protection through subject access. The LPP exemption in Schedule 2, Part 4, paragraph 19 DPA 2018 lets firms withhold privileged material in response to a subject access request.

The harder cases involve suspicion. A client under internal review, or the subject of a suspicious activity report, may make a subject access request. Disclosing that information could amount to tipping off under the Proceeds of Crime Act 2002. Firms can usually rely on the crime and taxation exemption in Schedule 2, paragraph 2, but only to the extent disclosure would be likely to prejudice the prevention or detection of crime.

That test needs applying case by case and documenting. Under FCA supervision, firms should expect their records of these decisions to be reviewed more closely. Joined-up procedures between the MLRO and whoever handles subject access requests are essential.

The handover

Moving 60,000 entities from more than 20 supervisors to one is, among other things, a very large data migration. Supervisory files, inspection findings, intelligence and enforcement histories will need to move between controllers.

That raises familiar questions: what is transferred and on what legal basis, whether inherited records are accurate and up to date, and how long the outgoing bodies keep their copies. Firms are entitled to understand what the FCA will receive about them. Sole practitioners and individual partners in particular may want to check, using their access rights, what their current supervisor holds.

The Government has proposed that the FCA should register in-scope firms and have appropriate gatekeeping powers. The final form and public accessibility of any register remain subject to legislation and implementation decisions. If information about sole practitioners is published, that information will be personal data and should be limited to what is necessary for the register’s purpose.

What firms should do now

None of this changes your obligations today, and the detail is still being settled. But the data protection groundwork is worth doing now, because it also strengthens your AML position.

Map your AML data. Know what you collect for CDD, where it sits and who can access it, and record it in your ROPA.

Review privacy notices. Make sure they cover the MLR regulation 41 information and are ready to name the FCA as a recipient.

Check your Schedule 1 conditions. Confirm which conditions you rely on for criminal offence data, and that your appropriate policy document is current.

Test retention. Check that AML records are deleted on time and kept separate from matter files with longer retention.

Join up subject access and the MLRO. Agree how requests touching on suspicion are handled, and document each use of the crime exemption.

Revisit DPIAs for screening tools. Cover any automated or AI-driven CDD and monitoring tools, including how decisions are reviewed by a person.

Prepare for information requests. Have a process for responding to FCA requests that discloses what is required, and no more.

Final thoughts

The move to FCA supervision is meant to make AML oversight more consistent and more intelligence-led. Done well, that is good for everyone. But more intelligence means more personal data, held centrally and analysed in new ways, and data protection needs to be part of the design rather than an afterthought.

Firms that get their AML data in order now will find both the transition and their data protection compliance easier.

If you would like help reviewing your AML data processing, privacy notices or DPIAs ahead of the transition, get in touch with our team at Data Protection People.

Sources

FCA: Anti-money laundering supervisory reform

Money Marketing: FCA to take AML supervision of 60,000 legal and accounting firms

TLT: FCA AML supervision reform: what law firms, accountants and TCSPs need to do now

Spotlight on Corruption: Government sets out its plan for making the FCA the super-regulator for money laundering