An AML investigation file gathers what a firm found behind an alert. It exists to test the principal offences in POCA 2002: concealing under s.327, arranging under s.328, and acquisition or use under s.329. anonym.plus removes names, identifiers, and account data from that dossier on your device. The findings and the timeline stay readable.
When this applies
Naming a suspect turns the file into criminal-offence data. UK GDPR Art. 10 allows that only under official authority or a basis in law. DPA 2018 s.10(5) points to a Schedule 1 condition, and AML work usually relies on Part 2 paragraph 10. Outside counsel asked for a second view needs the analysis, not the people.
How anonym.plus handles it
- Open the dossier in anonym.plus on your device.
- Local OCR reads scanned statements within it.
- The tool flags names, identifiers, and account numbers.
- Keep the findings and event timeline.
- Swap each identifier for a label.
- Save the clean dossier locally.
What you need to provide
- The investigation file (PDF, DOCX, or scan).
- An operator (Replace keeps the findings readable).
- Optional name map for repeat subjects across files.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Pia Lund → [SUBJECT] |
| Identifiers | UK_NINO | QQ 55 21 09 A → [NINO] |
| Financial | IBAN_CODE | GB94 BARC 2003 → [IBAN] |
| Money | MONEY | £63,400 → [AMOUNT] |
| Contact | EMAIL_ADDRESS | lund@example.co.uk → [EMAIL] |
| Location | LOCATION | Cardiff, UK → [LOCATION] |
Compliance achieved
- The file tests the offences in POCA 2002 ss.327-329: concealing, arranging, and acquisition.
- Naming a suspect creates criminal-offence data under UK GDPR Art. 10.
- DPA 2018 s.10(5) needs a Schedule 1 condition, and Sch. 1 Part 2 para 10 is the usual one.
- MLR 2017 reg 40 keeps the full dossier for five years, so this is a copy and never a deletion.
- Covers 48 languages for cross-border names and addresses.
Anonymise AML investigation files offline — see plans & start free →
Limitations & cautions
The firm must keep the full file for the reg 40 period. Share only a cleaned copy. A unique transaction chain can re-identify a subject indirectly, so read the narrative before you pass it on.
Frequently asked questions
Does MLR 2017 let me delete the file by redacting it?
No. Reg 40 requires the full dossier for five years. Redaction makes a safe copy for review, not a deletion.
Is a suspect's name special data?
It is criminal-offence data under UK GDPR Art. 10. DPA 2018 s.10(5) allows it only with a Schedule 1 condition, so keep distribution tight and the shared copy clean.
Can it handle names from several countries?
Yes. The tool covers 48 languages, so cross-border names are flagged consistently.