Contents
Colossal amounts of data… that need to be stored!
Security: A Prerequisite for Data Sovereignty
What is sovereignty?
The trap of extraterritorial laws
Certifying service providers that manage and store data
Sovereignty is based on trust
Faced with a growing regulatory burden aimed at better combating money laundering and terrorist financing, affected companies and organizations must manage and store ever-increasing of data.
Colossal amounts of data… that need to be stored!
Since compliance requires that data not only be collected comprehensively but also retained for several years, the issue of storage is crucial. According to a study byHitachi Ventara, 35% of financial institutions now rank managing data growth as their top storage priority. Furthermore, 30% identify regulatory compliance as a major focus of their infrastructure investments. While managing the data flows and volumes required to meet regulatory obligations remains technically feasible in-house, a growing number of organizations are choosing to outsource to cloud service providers. The promise of cost savings, operational optimization, simplified management, and performance gains makes this option particularly attractive.
Security: A Prerequisite for Data Sovereignty
Regardless of the method of management and storage, since data (comprehensive, reliable, traceable, etc.) is the key element in demonstrating compliance, security safeguards must be maximized. At least four criteria must be met to mitigate risks:
– maintaining confidentiality, with restricted access to data, particularly for KYC, KYT, and remediation requirements. This requirement falls directly within the scope of the European obligations under the GDPR regarding the protection of personal data, as well as the guidelines governing its processing in the context the fight against money laundering and terrorist financing.
– guarantee of integrity, the data must not be modifiable,
– ensuring the availability of data, in the event of a request from compliance oversight authorities. This leads to a requirement for reversibility when data is stored with third parties,
– the certainty of transaction traceability of transactions, so as to shed light on cases of fraud and money laundering.
At a time when AML-CFT regulations AML-CFT detailed and continuous monitoring of transactions, systematic behavioral analysis, and granular customer profiling, the data generated and analyzed in this context has become highly valuable from a strategic perspective.
This critical issue raises a central question: that of data sovereignty. Once this sensitive information is hosted in cloud environments, its location, control, and potential exposure to third-party jurisdictions become key issues.
In a context marked by geopolitical tensions and growing regulatory instability, data sovereignty is no longer merely an architectural choice but has become an imperative for governance and risk management.
What is sovereignty?
Sovereignty is defined as an organization’s ability to maintain control over all of its data by freeing itself from external dependencies, particularly extraterritorial regulations such as the Cloud Act or FISA (Foreign Intelligence Surveillance Act). These laws allow U.S. authorities to access data stored anywhere in the world, including in Europe, if it is held or controlled by entities subject to U.S. jurisdiction. This, of course, includes major cloud service providers such as Amazon Web Services, Google Cloud, and Microsoft Azure. Given their overwhelming market dominance, these providers store large amounts of AML-CFT data—related to the fight against money laundering and terrorist financing—collected by European companies on their servers. There is a real risk that this data could be compromised, altered, copied, or even blocked from access based solely on a political decision.
The Trap of Extraterritorial Laws
For example, if aFrench bank uses a Transaction Monitoring offered by an American fintech company and hosted on AWS, and that solution is subject to an injunction under the Cloud Act, the transaction data and risk profiles of that bank’s European citizens could theoretically be audited by a U.S. federal agency, beyond the control of any European judge. Similarly, if a U.S. software provider decides to cut off its services or unilaterally apply filtering rules based on U.S. law (rules of theOffice of Foreign Assets Control) rather than European law, the European financial institution finds itself paralyzed or in violation of the law.
Certify service providers that manage and store data
The strength of regulatory compliance must therefore never be compromised by digital vulnerabilities. In response to this risk of dependency, Europe is organizing its defense with the emergence of a sovereign, trusted cloud capable of ensuring that financial data does not leave European legal borders. In France, the SecNumCloud certification provides an effective solution. It consists of a set of technical, operational, and legal requirements designed to protect sensitive data and processing from cybercriminal threats and the application of extraterritorial laws.
The SecNumCloud certification, developed by theANSSI (National Cybersecurity Agency) provides a level of confidence in cloud services as well as in the operational practices of certified providers. The framework addresses several topics: access control, identity management, cryptography, security related to operations and communications, the acquisition, development, and maintenance of information systems, and relationships with third parties, who must have the same level of security as the provider itself. Additional requirements concern protection against non-European laws that require non-European digital service providers, at the request of authorities in their country of origin, to provide data on their customers, including European ones.
Sovereignty is based on trust
The key to ensuring data sovereignty for AML-CFT compliance AML-CFT to use European service providers certified by SecNumCloud. This is a mark of trust. Similarly, for Regtech companies, it is essential to prioritize providers that guarantee data security and sovereignty. This is the case with AP Solutions IO, which keeps data localized and backed up in France. It also offers maximum security guarantees: secure data transfers via HTTPS encryption, secure APIs, token-based authentication, password storage in a non-reversible format, document encryption, GDPR compliance, regular backups, and a business continuity plan…
By strengthening data sovereignty in AML-CFT compliance, the goal is to take control rather than be at the mercy of others.
Aurélien Zachayus
Co-Founder – CEO at AP Solutions IO
Reduce your false positives today