AnonymFilesKYC and AML files with AI: review them without exposing identities
Yes, provided the AI only ever sees pseudonymized copies: no names, no ID documents, no addresses in the clear, and originals left untouched in your systems for the five-year retention period required in France by Article L. 561-12 of the Monetary and Financial Code (CMF). The AI helps check whether a file is complete, whether the source of funds holds together, or how an ownership chain works; screening against sanctions and politically exposed person (PEP) lists, which needs real names, stays in your own tools. And no suspicious activity report, even in draft, goes through an online AI service.
What can AI do on a KYC file, and what must it not do?
Reviewing customer due diligence files is reading work: spotting a missing document, checking that proof of income fits the declared profile, following an ownership chain to the declared beneficial owners. AI is good at this, and most of these checks don't require knowing who the customer is. Others can only be done with real names, or must not leave the institution at all.
| Task | On a pseudonymized copy? | Why |
|---|---|---|
| File completeness check | Yes | It's about which documents are present, not who the customer is |
| Consistency of source of funds, income and transactions | Yes | Amounts stay readable by default; the AI compares figures and narratives |
| Reading an ownership chain and beneficial owners | Yes | Stable placeholders are enough to follow who owns what |
| Periodic review summary, questions for the customer | Yes | Real names come back afterwards, on your computer |
| Sanctions, asset-freeze and PEP screening | No | It is precisely about names: it stays in your screening tool |
| Checking that an ID document is genuine | No | Photo, MRZ and number are masked; verification follows your institution's procedures |
| Deciding to onboard, keep or exit a customer | No | It stays human; the AMLR will require meaningful human intervention in any automated decision |
| Drafting or reviewing a suspicious transaction report | No | Its existence and content are confidential (CMF Article L. 561-18) |
Which rules govern AI on KYC and AML files?
Due diligence duties under the French Monetary and Financial Code
Before entering into a business relationship, obliged entities identify the customer and, where applicable, the beneficial owner, and verify those details on the basis of a reliable written document (CMF Article L. 561-5). They collect and update information on the purpose and nature of the relationship (Article L. 561-5-1), then exercise ongoing due diligence, making sure transactions are consistent with their up-to-date knowledge of the customer (Article L. 561-6). That consistency work is what AI can speed up.
Article L. 561-12 requires these records to be kept for five years from the closing of the accounts or the end of the relationship, and transaction records for five years from execution. The copy sent to the AI never replaces the original: it is an additional processing operation, and it should be deleted at the provider once it is no longer needed.
Banking secrecy
Article L. 511-33 of the CMF binds the officers and staff of credit institutions and finance companies to professional secrecy. It lists the cases in which covered information may be shared: credit transactions, disposals, “service contracts entered into with a third party to entrust it with important operational functions” (our translation), and case by case with the express consent of the persons concerned. Whether a generative AI service fits these exceptions is a legal call for your compliance team; a copy in which no customer can be recognized avoids having to make that call for every file.
Confidentiality of the suspicious transaction report
Under CMF Article L. 561-18, the report filed with Tracfin, the French financial intelligence unit, is confidential. The joint guidelines of the ACPR (the French banking and insurance supervisor) and Tracfin add that, within the institution, knowledge of its existence and content must be controlled, justified and restricted to the strict minimum of people involved, and recall that disclosure is punishable by a €22,500 fine (Article L. 574-1). An AI provider is not in that circle: keep draft reports, the analyses leading to them and any mention of a report out of the AI and out of your prompts.
The GDPR
A KYC file is personal data processing: data minimization (Article 5), a processing agreement with the AI provider if it processes data on your behalf (Article 28), security (Article 32). Pseudonymized data is still personal data (Recital 26), but the text sent to the AI no longer contains a single name.
ACPR guidelines
The ACPR's guidelines on customer identification, identity verification and knowledge of the customer (December 16, 2021) state that when an institution uses a technology solution developed by a third party, it must assess the risks of the tool, its reliability and its compatibility with the institution's procedures (§ 178), and that the institution remains responsible for the duties it outsources (§ 176). An AI tool used for file review falls under the same logic: document its use, its limits and the human control around it.
The AMLR, applicable from July 10, 2027
Regulation (EU) 2024/1624 will apply directly from July 10, 2027 (Article 90). Three articles matter for AI:
- Article 22: the information to collect on a natural person (all first names and surnames, place and full date of birth, nationalities, national identification number, habitual residence) and on a legal entity. That is your list of what to mask.
- Article 76: data is processed only for AML/CFT purposes, and processing it “for commercial purposes shall be prohibited”. Automated decisions, including by AI systems, are allowed if the data is limited to due diligence data, if any decision to enter into, refuse or maintain a relationship is subject to “meaningful human intervention”, and if the customer can obtain an explanation and challenge the decision.
- Article 77: retention for five years after the end of the relationship, then deletion of personal data, plus a duty to ensure that retained records “are not redacted”. Redaction happens on a working copy, never on the archive.
The same package created the EU Anti-Money Laundering Authority (AMLA), seated in Frankfurt am Main (Regulation (EU) 2024/1620). For an overview by sector, see AnonymFiles for financial services.
What should you mask in a KYC file?
What you mask depends on the task: a consistency review needs amounts and occupation, not the address. The table below assumes a copy meant for an online AI.
| Item | Where it appears | With AnonymFiles |
|---|---|---|
| Surnames, first names, birth name | ID document, proofs, customer form, articles | Detected automatically, in scans as in text; the same person keeps the same placeholder across the batch |
| Date and place of birth | ID document, customer form | Date masked by rule after French cues such as “né le” or “date de naissance”; on a scanned ID, check it during review |
| Address | Proof of address, tax notice | Detected automatically |
| French ID card, passport or driving license number | ID document, customer form | Recognized by rules when labeled as such (“passeport n° …”); on the document itself, check it |
| MRZ (the “<<<” lines at the bottom of the document) | ID card, passport, residence permit | No dedicated detection: draw an area over it and it is erased from the image |
| Photo, signature | ID document, signed forms | Suggested as areas to mask (image and ink detection, no face recognition) |
| French social security number | Carte Vitale, payslips | Detected by rule |
| IBAN, BIC | Bank details, statements, mandates | IBANs from nine European countries detected by rules, validated by their check digits when split or oddly spaced; BIC detected when labeled |
| Email, phone | Customer form, correspondence | Detected by rules (French phone numbers) |
| Corporate customer, SIREN, beneficial owners | Register extract, articles, beneficial ownership register | Organizations and people detected; SIREN and RCS numbers detected when labeled |
| Employer, occupation, nationality | Customer form, proof of income | The employer is a detected organization; occupation and nationality matter for risk analysis: keep them if needed, and watch the re-identification risk indicator |
| Amounts (income, wealth, transactions) | Tax notices, statements, deeds | Not detected: readable for the analysis, masked with one click if they would identify the customer |
The ACPR guidelines give an example of partial masking: when copying a Carte Vitale, mask the parts of the social security number not needed for identity verification, namely the last five digits (footnote 39). For a copy meant for AI, mask the whole number.
How do you prepare a batch of KYC files for AI, step by step?
- Frame the use. With compliance, the DPO and security: which tasks, which AI tool, which contract with the provider, which entry in the record of processing. Put in writing that no suspicious activity report goes through it.
- Build a working copy. Export the files to review into a local folder, one subfolder per customer. Originals in your document management system stay untouched.
- Set your term lists. “Always mask”: customers' trade names, holding company names. “Never mask”: your own institution's name and the authorities cited, if they reveal nothing.
- Process the batch in one go. AnonymFiles walks the folder and its subfolders: PDFs, scans and photos of documents read by on-device OCR, Word, spreadsheets, emails with their attachments. The same person gets the same placeholder throughout the batch: if a beneficial owner appears in three customer files, the AI sees the link without knowing the name.
- Review the ID documents. Scanned pages with uncertain reads are flagged. Accept the suggested areas (photo, signature, stamp) and draw one over the MRZ and over any number still visible.
- Approve and export. Each document is approved after a side-by-side review. At export, a blocking check rereads every file for the original values, and a processing report lists, for each document, what was masked by type and the fingerprint of each exported file, without any masked value: a useful trail to document your procedure.
- Query the AI, then re-inject. Real names come back into the summary on your computer; the encrypted mapping table never leaves the machine. The app itself calls no AI.
Which prompts work on pseudonymized KYC files?
Each time, remind the AI that placeholders replace real data, that it must not try to guess them, and that its answer supports the review; it is not a decision.
File completeness
Here is a pseudonymized customer due diligence file: bracketed placeholders such as [PERSONNE_2] or [ORGANISATION_1] replace real data. Do not try to guess identities. For a [natural person / legal entity] customer under [standard / enhanced] due diligence, list the documents present, their dates, and what is missing or expired against this checklist: [paste your internal checklist]. Do not conclude on the risk level.
Source of funds consistency
Compare the declared source of funds, the proofs of income and wealth and the recent transactions of [PERSONNE_1]. Flag each inconsistency (amount, date, nature of activity), quoting the document and the exact passage. Draft the questions to ask the customer to resolve each point.
Ownership chain
From the articles of association, the register extract and the beneficial ownership register extract, rebuild the ownership chain of [ORGANISATION_1] up to natural persons, with capital and voting percentages. Show who exceeds [your procedure's threshold], who exercises control by other means, and any discrepancy between documents.
Periodic review of a batch
For each customer subfolder in this export, produce a five-line sheet: customer type, activity, documents to update, inconsistencies found, open questions. End with the list of placeholders that appear in several files, and in which role.
What should you check?
- On scans: MRZ, document number, date of birth in the document's own format, photo, signature, and any handwriting (a pen annotation is not always read).
- On foreign documents: OCR reads French and English; a document in another script must be masked with areas.
- On spreadsheets: columns headed Nom, Prénom, Client, Titulaire, Bénéficiaire or N° de sécurité sociale (or Name, Customer) are masked entirely; review the other columns.
- In the AI's answer: check every flagged inconsistency in the cited document; an AI can invent a missing document or misread an amount.
What are the limits?
- AnonymFiles does no list screening, no authenticity check and no risk scoring: it prepares copies without identities.
- Automatic detection doesn't replace review, especially on scanned ID documents, where the layout often separates labels from values.
- The photo is spotted as an image, without face recognition; a suggestion can miss an area.
- A pseudonymized copy is still personal data processing: the record of processing, the contract and retention at the provider still need settling.
- AI makes mistakes: its findings support the review; they don't ground a decision.
More on reversibility: the mapping table and re-identification risk. On the GDPR and AI assistants: ChatGPT and GDPR.
Frequently asked questions
Can you use ChatGPT or Claude to review KYC files?
Not with the documents in the clear: they are covered by the institution's professional secrecy and the GDPR. On a pseudonymized, reviewed copy, through a business plan covered by a data processing agreement and approved by compliance, AI can check file completeness, source of funds consistency or an ownership chain.
Can AI do sanctions and PEP screening?
Not on a pseudonymized copy: screening is about names, and the names have been replaced by placeholders. It stays in your usual screening tool, on the original data.
How long must KYC records be kept in France?
Five years from the closing of the accounts or the end of the business relationship, and five years from execution for transaction records (Article L. 561-12 of the French Monetary and Financial Code). The AMLR keeps this five-year period from July 10, 2027 and requires retained records not to be redacted.
Can you draft a suspicious transaction report with AI?
Not with an online AI service. The report is confidential (Article L. 561-18 of the CMF), and the ACPR and Tracfin guidelines restrict its circulation to the strict minimum of people involved. An AI provider is not one of them, even on a pseudonymized copy.
Does AnonymFiles detect passport numbers and the MRZ?
An ID card or passport number is recognized by rules when it is labeled as such in the text. The MRZ has no dedicated detection: you mask it by drawing an area during review, and its pixels are erased from the image. The photo and signature are suggested as areas to mask.
Does French banking secrecy rule out AI?
Article L. 511-33 of the CMF doesn't ban a tool; it bans sharing covered information outside the exceptions it lists. If the AI only receives a copy in which no customer can be recognized, no covered information reaches it in a form that identifies the customer; have your compliance team validate this analysis.
What does the AMLR change for AI in KYC?
From July 10, 2027, Regulation (EU) 2024/1624 allows decisions made by AI systems under three conditions: data limited to due diligence data, meaningful human intervention in any decision to enter into, refuse or maintain a relationship, and the customer's right to an explanation and to challenge it. It also prohibits any commercial use of that data.