Kifid sets limit: personal data from anti-money laundering investigation kept for up to five years
Kifid has drawn a clear line for banks: personal data collected during anti-money laundering investigations may not be kept for longer than five years. The ruling follows a complaint against ING and sets a clear boundary for the entire sector.
Banks.com June 4, 2025
Banks face a tricky balancing act: on the one hand, they are required by law to accurately combat money laundering and fraud, and on the other, they must be very careful with their customers' sensitive information. That balance is often precarious in practice.
Klifid, the independent complaints desk for consumers and entrepreneurs in the financial sector, brings this tension into sharp focus with its recent judgment.
At ING, the relationship with two customers was recently terminated after insufficient cooperation in a money laundering investigation. The bank then recorded their personal data in an internal warning register for eight years. And that is too long, Kifid argues. According to the Wwft, data from customer investigations can only be kept for a maximum of five years.
The Disputes Committee explains that registration in a bank's internal register may be justified if customers do not cooperate with an investigation, but banks must strictly adhere to the legal retention period.
ING must reduce the registration period from eight to five years. The ruling will serve as a guide for similar complaints in the future.
