AML compliance must balance data privacy laws with financial crime prevention.
Option A (Correct): FIUs must document the purpose of SAR-related data sharing under FATF Recommendation 29 and GDPR compliance standards.
Option B (Incorrect): Customers do not have the right to request redaction of personal data in SARs, as this would compromise AML enforcement.
Option C (Incorrect): Many jurisdictions permit information sharing for AML purposes under formal agreements (e.g., 314(b) USA PATRIOT Act, GDPR exemptions).
Option D (Incorrect): AML reporting requirements override opt-in privacy preferences due to the legal obligation to report suspicious activity.