CHAPTER_2__211-240_.pdf

Transcript

1. Financial institutions have a legal and ethical obligation to protect customer data. Information must be stored securely, shared only on a need-to- know basis, and accessed only by authorized personnel. Data collected for one purpose (e.g., AML) cannot be reused for another (e.g., marketing). Once data has served its purpose, it must be securely destroyed. Global AFC Standards and Guidance Memorization Tip: Collect with care, share with need, destroy with speed. Duty of Data Security and Privacy www.camsprep.com
2. Laws in most jurisdictions specify how long financial data must be retained (for example, five years under many AML laws). Organizations must follow internal policies on data categorization, storage duration, and secure disposal to ensure compliance and reduce risk of unauthorized access or breaches. Global AFC Standards and Guidance Memorization Tip: Keep it only as long as the law says. Data Retention and Destruction www.camsprep.com
3. Many jurisdictions have specific data protection frameworks. The EU’s General Data Protection Regulation (GDPR) is among the strictest, setting standards for lawful processing, data minimization, and data subject rights (access, correction, deletion). Other countries have national equivalents, often inspired by GDPR principles. Global AFC Standards and Guidance Memorization Tip: GDPR = Global Data Protection Reference. . Global Data Privacy Laws www.camsprep.com
4. Data privacy laws often restrict the transfer of personal data across borders unless equivalent protection is ensured. Financial institutions must use approved mechanisms—like standard contractual clauses or adequacy decisions—to comply. Failure to follow transfer rules can result in fines or data breaches. Global AFC Standards and Guidance Memorization Tip: Before data travels, check its passport. Cross-Border Data Transfers www.camsprep.com
5. Physical data (paper files) must be secured after use and not left unattended. Electronic data must be stored only in approved databases, not on personal drives or USBs. Most institutions ban USB storage due to loss risk. Proper controls prevent breaches, insider threats, and regulatory penalties. Global AFC Standards and Guidance Memorization Tip: Lock the file, encrypt the byte. Physical and Electronic Data Controls www.camsprep.com
6. The Digital Operational Resilience Act (DORA) was enacted by the EU to strengthen cybersecurity and ensure digital resilience in the financial services sector. It applies to all EU financial institutions from January 2025, addressing ICT (information and communications technology) risks amid rising cyberattacks and third-party dependencies. Global AFC Standards and Guidance Memorization Tip: DORA = EU’s digital armor for finance. Purpose of the Digital Operational Resilience Act (DORA) www.camsprep.com
7. Institutions must have a robust ICT control framework led by an independent ICT risk function. This function sets the digital resilience strategy and risk tolerance levels, approved by management. Plans must include continuity of critical AFC functions and a secondary data site for backup. Global AFC Standards and Guidance Memorization Tip: Plan, protect, and prepare — ICT resilience in layers. ICT Risk Management www.camsprep.com
8. Financial institutions must promptly report significant ICT incidents (e.g., cyberattacks or major system failures) to the competent authorities. Quick reporting enhances regulatory coordination and incident containment. Global AFC Standards and Guidance Memorization Tip: Report fast — resilience depends on speed. Incident Reporting www.camsprep.com
9. Institutions must conduct annual vulnerability assessments. Regulators perform threat-led penetration testing every three years. If tests reveal weaknesses—especially involving third-party vendors—the institution must fix them immediately. Global AFC Standards and Guidance Memorization Tip: Test yearly, probe deeply, fix swiftly. Resilience Testing www.camsprep.com
10. The General Data Protection Regulation (GDPR) protects the privacy and personal data rights of individuals in the EU and EEA. It applies directly and uniformly across member states, without requiring national transposition. It covers both EU-based and non-EU organizations that offer goods/services to, or monitor, EU/EEA data subjects. Global AFC Standards and Guidance Memorization Tip: If you touch EU data — GDPR touches you. Purpose and Scope of GDPR www.camsprep.com
11. The GDPR extends to the entire EEA (EU + Norway, Iceland, Liechtenstein). It distinguishes between data controllers (who decide how and why data is processed) and data processors (who act on behalf of controllers), each with specific legal duties. Global AFC Standards and Guidance Memorization Tip: Controller decides, processor complies. GDPR Legal Framework and Reach www.camsprep.com
12. GDPR imposes two levels of fines: • Lower fines for controller/processor breaches or procedural issues. • Higher fines for violations of core privacy principles or data subject rights. Fines can reach up to 4% of global turnover. Global AFC Standards and Guidance Memorization Tip: Minor slip = lower fine, privacy breach = 4% pain. GDPR Key Provision: Two-Tier Fine System www.camsprep.com
13. Consumer protection laws safeguard individuals from unfair, deceptive, or harmful financial practices. They ensure fairness, transparency, accountability, and provide mechanisms for dispute resolution and redress. Global AFC Standards and Guidance Memorization Tip: Protect, prevent, and promote trust. Purpose of Consumer Protection www.camsprep.com
14. AML/CFT compliance indirectly protects consumers by preventing the laundering of proceeds from crimes like fraud, scams, and ransomware. It also builds public trust in financial systems and safeguards market integrity. Global AFC Standards and Guidance Memorization Tip: Fighting dirty money keeps consumers safe. AFC and Consumer Protection Link www.camsprep.com
15. Inclusive banking ensures access to affordable financial services—such as accounts, loans, and insurance—for vulnerable and marginalized individuals. It promotes financial literacy, reduces economic exclusion, and enhances community resilience. Global AFC Standards and Guidance Memorization Tip: Banking for all = fairness for all. Inclusive Banking Concept www.camsprep.com
16. De-risking occurs when institutions terminate relationships with high-risk sectors or customers to avoid compliance risk. This can exclude legitimate clients. FATF promotes financial inclusion to prevent excessive de-risking while maintaining AML standards. Global AFC Standards and Guidance Memorization Tip: Don’t de-risk — include responsibly. De-Risking vs. Inclusion www.camsprep.com
17. FATF’s 2021 report, Opportunities and Challenges of New Technologies for AML/CFT, recognizes that AI can improve customer experience and compliance efficiency. However, it warns institutions to assess risks and avoid unintended harms from automation and digitalization. Global AFC Standards and Guidance Memorization Tip: AI can help — if risk doesn’t outweigh reward. FATF and AI in AML/CFT www.camsprep.com
18. In 2025, the US issued Executive Order 14179, Removing Barriers to American Leadership in AI. It promotes innovation over regulation, rescinding earlier AI governance frameworks. The US emphasizes flexibility and industry self-regulation over rigid legal standards. Global AFC Standards and Guidance Memorization Tip: US: Lead with innovation, not limitation. US Approach to AI Regulation www.camsprep.com
19. The EU AI Act is the world’s first comprehensive AI law. It classifies AI systems by risk level and imposes stricter rules on high-risk applications (e.g., biometric ID, critical infrastructure). It prioritizes human oversight, non-discrimination, and transparency, applying to all AI used in the EU, regardless of origin. Global AFC Standards and Guidance Memorization Tip: EU: Risk defines the rule. EU AI Act (2024) www.camsprep.com
20. The EU AI Act works alongside the Digital Services Act (DSA) and Digital Markets Act (DMA) to create a safe, transparent digital environment, preventing harm while promoting trust in technology. Global AFC Standards and Guidance Memorization Tip: DSA + DMA + AI Act = EU’s digital shield. Complementary EU Digital Framework www.camsprep.com
21. The UK adopts a principles-based approach, focusing on flexibility and innovation. The 2023 AI White Paper introduced five broad principles (e.g., fairness, accountability, safety), but left their sector- specific application to regulators. Global AFC Standards and Guidance Memorization Tip: UK: Flexible principles over fixed rules. UK AI Regulation Approach www.camsprep.com
22. China’s framework aligns with its national AI development plan. It includes deep synthesis provisions targeting misuse (e.g., deep fakes). Regulations emphasize state oversight, security, and social stability. Global AFC Standards and Guidance Memorization Tip: China: Innovation with control. China’s AI Regulation www.camsprep.com
23. The Hong Kong Monetary Authority (HKMA) issued the Ethical Artificial Intelligence Framework (2024) for banks. It promotes ethical use, privacy protection, and responsible AI governance within the financial sector. Global AFC Standards and Guidance Memorization Tip: HKMA: Ethics first in banking AI. Hong Kong’s Ethical AI Framework www.camsprep.com
24. Japan follows a sector-based regulatory model. Under its AI Strategy 2022, it promotes human- centric innovation and ethical governance. In 2025, Japan’s AI Policy Study Group highlighted the business sector’s leadership in responsible AI. Global AFC Standards and Guidance Memorization Tip: Japan: People-centered, business-driven AI. Japan’s AI Governance www.camsprep.com
25. Singapore’s National AI Strategy 2.0 emphasizes a trusted, inclusive, and innovative AI ecosystem. It seeks to balance progress with ethics while fostering digital trust and economic transformation. Global AFC Standards and Guidance Memorization Tip: Singapore: Smart AI with social trust. Singapore’s AI Strategy www.camsprep.com
26. The Financial Stability Board and other global bodies advocate for international harmonization of AI regulations to avoid fragmentation and ensure global standards for ethics, safety, and accountability. Global AFC Standards and Guidance Memorization Tip: One world, one AI rulebook — someday. Global Convergence Efforts www.camsprep.com
27. ESG (Environmental, Social, and Governance) is a framework that guides organizations in aligning business practices with sustainable development goals. • Environmental: Impact on the planet (carbon emissions, pollution). • Social: Relationship with employees, customers, and communities. • Governance: Leadership, ethics, and transparency. Global AFC Standards and Guidance Memorization Tip: E = Earth, S = Society, G = Governance. What is ESG? www.camsprep.com