In August 2025, the Polish Data Protection Authority (UODO) sent a clear signal to the financial services industry. It imposed a fine of more than PLN 18 million (approximately EUR 4.3 million) on ING Bank Śląski for systematically scanning and storing customers’ ID documents without sufficient legal justification.

Between April 2019 and September 2020, the bank copied IDs of millions of clients – even in circumstances unrelated to anti-money laundering (AML) obligations, such as when customers submitted a simple complaint. The authority found that the practice violated the EU’s General Data Protection Regulation (GDPR) because:

• No proper necessity or risk assessment was conducted before rolling out the practice.
• ID copies were collected without a valid legal basis.
• The scale of the processing – covering 4.7 million customers – magnified the risk and heightened the expectation of diligence.

This case has reverberated far beyond Poland. It is a timely reminder for financial institutions everywhere: balancing eKYC and AML requirements with data protection and privacy obligations is not optional, it is critical.

Why This Matters Beyond the EU

It might be tempting to dismiss the ING Bank fine as a “GDPR problem.” But the underlying principle is universal. Whether operating in the Cayman Islands, the British Virgin Islands (BVI), or any other financial centre, institutions face the same challenge: ensuring that measures taken to combat financial crime do not overreach into unnecessary or unlawful personal data processing.

Cayman’s Data Protection Act (2021 Revision) and the BVI’s Data Protection Act, 2021 recently enacted and awaiting full implementation, both borrow heavily from GDPR principles such as necessity, proportionality, fairness, and accountability. While Cayman has already demonstrated progress in aligning with international standards, the BVI remains under FATF enhanced monitoring, underscoring the continued global scrutiny on AML/CFT compliance across offshore financial centres.

That dual pressure, robust AML on one hand, strict data protection on the other, creates a fine line for compliance teams to walk. The ING case demonstrates the consequences of tipping too far in one direction.

The Compliance Tightrope: AML vs. Data Protection

AML/CFT regulations require financial institutions to know their customers. This typically includes collecting and verifying government-issued identification, proof of address, and where applicable, beneficial ownership information. In Cayman, the Anti-Money Laundering Regulations set the standard; in the BVI, the AML Code of Practice plays a similar role. Internationally, FATF Recommendations reinforce the need for strong, risk-based customer due diligence (CDD).

However, data protection frameworks introduce equally binding duties. Collecting, storing, and processing ID documents is considered “high risk” because IDs contain sensitive, immutable personal data. Under Cayman’s DPA, the principles of data minimisation and purpose limitation mean an institution must be able to show that:

• Each data item collected is necessary for AML compliance.
• Data is not repurposed for unrelated functions (for example, customer service complaints).
• The retention of documents does not exceed the legal AML record-keeping period.

In other words, financial institutions must demonstrate that AML compliance and data protection are not in conflict but in balance.

Best Practices for Balanced eKYC

So how do institutions strike that balance? The ING sanction offers several lessons that apply globally.

1. Adopt a Risk-Based Approach

Collect and scan ID documents only when necessary. For low-risk clients or transactions, electronic verification methods may be sufficient without full document capture. For higher-risk scenarios, scanning may be justified, but it should be documented through a risk assessment.

2. Define Clear Purpose and Limit Use

ID documents should only be used for customer due diligence under AML/CFT laws. Using them for other purposes such as general complaints handling creates unnecessary exposure and breaches the purpose limitation principle.

3. Apply Data Minimisation

Where only certain information is required (e.g., full name and date of birth), consider redacting or masking irrelevant parts of the ID. Advances in eKYC technology allow for “field extraction” without retaining an entire scanned copy.

4. Align Retention with AML Obligations

AML laws typically require records to be kept for five years after the end of the relationship. Retaining data beyond that period creates risk. A documented retention and disposal policy demonstrates accountability.

5. Ensure Vendor Oversight

For institutions outsourcing eKYC to technology providers, contractual controls must ensure that vendors also comply with AML and data protection requirements. This includes clarity on data storage, security, and deletion.

6. Document Decision-Making

The absence of a documented necessity and risk assessment was a critical factor in ING’s penalty. Institutions should create and maintain records of their rationale for ID scanning, including minutes from compliance committee meetings or data protection impact assessments (DPIAs).

Why It Matters for Offshore Centres

Cayman and BVI operate in a global regulatory ecosystem where reputation is paramount. A misstep in data protection particularly when tied to AML/CFT processes, could undermine the perception of these jurisdictions as trusted, well-regulated centres.

Moreover, local regulators increasingly expect institutions to take a holistic view of compliance. The question is no longer “Did you collect the ID copy to satisfy AML?” but “Did you collect it in a way that was necessary, proportionate, and respectful of data protection principles?”

Demonstrating that balance can reduce regulatory risk, protect customer trust, and strengthen the credibility of offshore jurisdictions in the global financial system.

Closing Thought

The ING Bank case serves as a powerful reminder: robust AML controls and strong data protection are not opposing forces, they are complementary pillars of responsible compliance.

Financial institutions must view eKYC not as a tick box exercise but as a carefully balanced practice. Every ID scan, every document retained, every field extracted should pass through a simple but vital filter: Is this necessary, proportionate, and defensible?

For Cayman, BVI, and beyond, the path forward is clear. Compliance leaders must embed both AML and data protection into the DNA of their eKYC frameworks. Doing so will not only prevent multimillion-euro fines but also protect what matters most: the trust of customers and the integrity of the financial system.