Document copies: when, why and how to keep them secure

When copying is mandatory

Section 25(8) requires selected entities to copy an ID during in-person identification under Section 8(2), typically first identification of a customer or new representative. These are credit institutions, payment-service providers or electronic-money issuers and providers of valuables custody or safe-deposit boxes.

Do not extend this specific duty to all accountants and estate agencies. Bank identity under Section 8a does not itself require an ID copy. Relevant copies are, however, part of the Section 11(7) remote method.

Where a covered institution uses a digital identity-document counterpart, section 25(8) requires obtaining the electronic document containing its data. A screen photograph or transcription of a few fields does not automatically meet this special duty; use the appropriate document-transfer function.

Permission needs justification

Section 8(11) permits copies or extracts for AML purposes without customer consent; Section 9(8) addresses due diligence documents similarly. Permission is not a duty to create the largest possible collection. Explain what the copy establishes, whether a record or extract suffices and how it addresses risk.

GDPR still applies: purpose, necessary scope, security and proper retention matter. Do not substitute blanket consent for statutory AML processing as if withdrawal would erase the legal duty.

Scope depends on the method

Where a method requires copying a relevant document part, do not arbitrarily remove mandatory data or security features. Copy relevant pages; a passport’s entire travel history is generally unnecessary for identification. Assess masking and editing against the particular legal purpose.

Distinguish identity documents, supporting documents and source-of-funds evidence. They have different functions. Identification documents should not become generally accessible CRM attachments.

Delivery and retention are part of the task

Use a protected channel and access limited to necessary roles. Avoid personal staff phones and open email folders. Check tool export and availability periods; the statutory archive cannot depend on subscription continuation.

Retention follows applicable Section 16 provisions, including special categories and starting points. Keep justified versions and changes, then ensure lawful deletion when the purpose and applicable period end rather than indefinite “just in case” storage.