Rules and ethics
Part of Customer data platform for UK financial services: key considerations
Customer data platform for UK financial services: key considerations
How UK financial services firms should approach a customer data platform: FCA expectations, AML and KYC data separation, open banking consent and vendor questions.
What to take away
- A customer data platform in UK financial services must hold AML and KYC records apart from marketing profiles, because their lawful bases and retention rules differ.
- FCA expectations on financial crime and Consumer Duty shape what a firm may do with a customer record, not only how it stores one.
- Open banking consents carry scope, expiry and revocation, so treat them as records with their own lifecycle rather than flags on an account.
- Vendor contracts should name data categories, retention periods and deletion evidence before anyone signs.
Why general CDP guidance does not transfer
Most customer data platform guidance is written for retail and ecommerce. There, consent is the main constraint and one person usually means one record.
A bank or lender holds several records for the same person, each created under a different purpose. Purpose limitation becomes the design problem rather than match rate. That is why a generic scorecard, built around retail metrics, tells a lender very little.
The Data Protection Act 2018 and the UK GDPR apply to any profile a firm builds, and the ICO's guidance and resources set out the accountability and purpose limitation principles behind it.
Where FCA expectations land on data design
Consumer Duty asks firms to evidence good outcomes for retail customers. That test reaches marketing eligibility, vulnerability flags and contact-preference logic.
If those rules live in a spreadsheet outside the platform, a firm struggles to explain why a customer was included in a campaign or left out of one.
The FCA's Consumer Duty rules, set out in PRIN 2A of the FCA Handbook, are the reference point, and they apply to the firm holding the customer relationship, not to the software vendor.
Keeping AML and KYC data out of marketing profiles
Anti-money-laundering records exist because the law requires them: the Money Laundering Regulations 2017 require customer due diligence records to be kept for five years after a business relationship ends. Marketing data exists because the customer agreed, or because the firm has a legitimate interest, and UK GDPR sets no fixed period — the ICO expects a stated period tied to purpose instead.
Merge both into a single identity table and an erasure request becomes difficult to answer without damaging the audit trail.
The FCA's financial crime page sets out the systems and controls firms are measured against, with SYSC 6.1 as the Handbook rule at its core, and a customer data platform sits inside that perimeter.
Some firms do need to match a customer across a current account, a mortgage and a card. That work belongs in a documented identity resolution in UK CDPs process, with a stated rule for every link.
Three data categories and how each should sit
| Data category | Typical basis in a firm | Treatment in the platform |
|---|---|---|
| AML and KYC records | Legal obligation | Held in the source system, referenced by key, excluded from marketing segments |
| Product and transaction data | Contract | Held with the account, shared for servicing unless a separate basis exists |
| Marketing preferences and consent | Consent, or legitimate interests for existing customers | Versioned at attribute level with timestamp and source |
Treat the table as a starting map. Each firm should confirm the rows against its own legal advice rather than copying them.
Data categories and platform treatment
AML and KYC records
- Typical basis
- Legal obligation
- Platform treatment
- Source system, key reference
- Marketing segments
- Excluded
Product and transaction data
- Typical basis
- Contract
- Platform treatment
- Held with account
- Marketing segments
- Shared for servicing
Marketing preferences and consent
- Typical basis
- Consent or legitimate interests
- Platform treatment
- Versioned at attribute level
- Marketing segments
- Timestamped and sourced
The column that matters most is the third. A platform that cannot show separate treatment for each row will struggle at audit.
Platforms that appear on UK shortlists include Adobe Experience Platform, Salesforce Data Cloud, Tealium AudienceStream and Twilio Segment, alongside sector-specific tools. Test any of them against the rows above and the questions below; a feature sheet is not the evidence a reviewer will ask for.
Open banking consent as a record, not a flag
Open banking data arrives with scope, expiry and revocation attached to it. A balance or a transaction list is only lawful while the consent behind it holds.
In the UK that regime sits in the Payment Services Regulations 2017, which implemented PSD2, and in the FCA's rules on open banking. A third party that reads a customer's account data under open banking must hold the right FCA permission as an account information service provider — check it on the FCA register — while a supplier that only processes data on the firm's instructions does not.
If the platform stores the account data without the consent record, nobody can show six months later why the firm held it. Model consent as its own entity, linked to the customer and to the account, with version history.
Questions to put to a vendor
Four questions to ask before a demonstration, because a vendor that cannot answer them in writing will not answer them after signature.
- Which data categories can the platform keep separate, and how does it enforce that separation in the profile table?
- How does the platform store consentscope, start date, expiry and revocation — and how does it link a consent record to the account it covers?
- What retention periods can be set category by category, and what evidence does the platform produce when data is deleted?
- What audit trail does the platform expose for campaign eligibility, identity links and access, and how is it exported for an FCA or ICO request?
Vendor questions before demonstration
- Which data categories sit inside the platform?
- How is consent version and withdrawal recorded?
- What is the deletion path across sources?
- Can marketing rules be versioned and rolled back?
Ask for the answers in writing. Read the customer data platform contract areas covering exit, deletion and audit rights before you sign anything.
Common questions
Does a customer data platform need FCA approval?
No. The FCA regulates the firm's conduct, not its software. Buying a platform does not transfer responsibility for an AML control or a marketing decision.
Can one platform serve AML and marketing?
Rarely in one profile table. Keep the AML record in its source system and expose a reference key to marketing, so the two retention schedules stay separable.
How should open banking consent be stored?
As a record with scope, start date, expiry and revocation, linked to the customer and to the account it covers.
Who owns the retention schedule?
The firm. Name an owner for each data category and put the retention period in the contract rather than the user guide.
