An AML/CFT unit often compiles information about customer activity and product usage that might be of interest to other parts of the organization. Before allowing the unit to communicate such information internally, the organization must review:

While AML compliance policies are important, they primarily focus on preventing money laundering and terrorist financing rather than the specific legalities around data sharing. This choice overlooks the essential aspect of data privacy laws, which is critical before any internal communication can occur.

Though enterprise-wide risk assessments and employee handbooks may provide guidelines, they do not specifically address the legal requirements associated with data sharing. This choice fails to prioritize the necessary legal context provided by data privacy laws, making it insufficient for this situation.

While assessing customer risk ratings is important for risk management, it does not address the legal framework governing data sharing. This choice incorrectly emphasizes customer risk over the legal obligations related to data privacy, which are paramount before any communication can take place.