| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Customer due diligence | Identity, NID, address | Legal obligation (MLPA 2012) | 5 years after the relationship ends |
| Suspicious transaction reporting | Transactions, narratives | Legal obligation | As BFIU requires |
| Fraud prevention | Device and behaviour signals | Legitimate interest | 90 days |
| Security monitoring | Sign-in logs, IPs | Legitimate interest | 30 days raw, 90 days hashed |