49. Where the outsourced service provider stores customer data, including, but not limited to …

Where the outsourced service provider stores customer data, including, but not limited to, photography, videos, and documents, during the remote onboarding process, credit and financial institutions should ensure that:

• a) only necessary customer’s data is collected and stored in line with a clearly defined retention period;
• b) access to the data is strictly limited and registered;
• c) appropriate security measures are implemented to ensure that the stored data is protected.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/