LSEG-Refinitiv, LexisNexis, Dow Jones, Acuris, and ComplyAdvantage are among the world’s leading providers of financial intelligence and risk management data. They offer specialised databases designed to support compliance and due diligence processes within the financial sector. Products such as LSEG-Refinitiv’s World-Check, LexisNexis WorldCompliance, Dow Jones Risk & Compliance and Factiva, Acuris KYC6, and ComplyAdvantage’s AI-powered sanctions and adverse media database assist financial institutions and other regulated entities in meeting legal and regulatory obligations, monitoring sanctions, and conducting customer due diligence.

These databases collect publicly available and other lawfully obtained information on individuals and organisations, generate risk profiles, and license this information to financial institutions and other entities subject to anti-money laundering and counter-terrorist financing (AML/CFT) obligations for use in Know Your Customer (KYC) and Customer Due Diligence (CDD) processes.

The primary purpose of these databases is to assist financial institutions in identifying potential risks relating to money laundering, terrorist financing, sanctions violations, and other financial crimes. However, the inclusion of an individual in one of these databases does not, in itself, establish that the individual has committed any criminal offence or engaged in unlawful conduct. Many entries are compiled from publicly available sources, including media reports, court decisions, sanctions lists, and Politically Exposed Persons (PEP) databases. The accuracy, currency, and context of such information must therefore be assessed on a case-by-case basis.

European Union data protection law, together with numerous national and international legal frameworks, requires that personal data be processed in accordance with the principles of accuracy, data quality, proportionality, transparency, and accountability. Individuals therefore have the right to know what personal data are being processed about them, to request the rectification of inaccurate or incomplete information, to seek the erasure of personal data under certain circumstances, and to object to automated or semi-automated risk assessments where applicable. In practice, inaccurate identity matches, outdated records, name similarities, or media reports taken out of context may result in significant consequences for individuals, including restrictions on access to banking services, disruption of commercial relationships, and reputational harm. Effective use of the available data protection remedies is therefore of considerable practical importance.

Individuals who believe that their rights have been adversely affected by such data processing activities should first submit a request directly to the relevant data provider or financial institution, seeking disclosure of the personal data being processed, correction of inaccurate information, deletion of outdated records where appropriate, or reconsideration of the information underlying any risk assessment. If these requests are unsuccessful, complaints may be submitted to the competent national data protection authority within the European Union or the European Economic Area. A list of the competent supervisory authorities is available on the website of the European Data Protection Board. In the United Kingdom, data protection complaints are handled by the Information Commissioner’s Office. Where the dispute concerns access to financial services, account closures, payment services, or other banking matters, individuals may also consider using the relevant national financial dispute resolution mechanism. The FIN-NET, established by the European Commission, provides information on the competent financial dispute resolution bodies in each participating country.