What the law asks, and how the system answers.
Monaco has its own data-protection law, its own authority, and a demanding anti-money-laundering framework for its regulated professions. None of it forbids AI. All of it shapes how an AI system must be built. This page says how, in plain words.
We are builders, not lawyers; your counsel has the last word. What follows is what we have learned building systems for regulated Monaco clients, and the rules we apply by default.
Personal data: Law 1.565 and the APDP
Monaco’s data-protection law, aligned with European standards and supervised by the APDP, applies to any AI system that processes personal data: an inbox assistant reads names and addresses by definition. In practice it asks for a lawful purpose, a description of the processing, minimisation, security, and the ability to say what was done with a person’s data. We build each of these in: scope limited to what the task needs, EU hosting, no training on your data, a log of every action, and a processing description you can hand to the APDP or a client. The dedicated guide goes further.
Regulated professions: Law 1.362 and AML duties
Banks, wealth managers, family offices, real-estate agents, lawyers, notaries, accountants, yacht brokers and dealers in high-value goods have due-diligence, monitoring and reporting duties under Monaco’s anti-money-laundering framework, supervised by the AMSF (formerly SICCFIN). AI can help with the mechanical part: collecting documents, checking a registration number, flagging an inconsistency, keeping the file complete, drafting the review. It must not make the decision, and the professional stays responsible. We built Trace, our client-verification product, on exactly this principle, and we apply it to every system for a regulated client.
Professional secrecy and the practical rules
For lawyers, doctors, notaries and bankers, secrecy is not a preference. The rules we apply: no client data in public chatbots, ever; models run under contracts that exclude training and retention; data stays in the firm’s own tools; a person approves anything that leaves; the log is the firm’s; and the system is documented so an auditor or a supervisor can read what it does. These are the same rules a careful firm would apply to a new employee, written into software.
What we do for it.
Law 1.565 in practice
The data-protection guide: what applies to an AI system and what we do about it.
Trace: client verification
Our own product for Monaco’s regulated professions, in production.
Finance and accounting
Where AI helps the finance side, with the controls built in.
Why this is a Monaco advantage
A Monaco firm that can show a client, a bank or a supervisor exactly what its AI does, where the data is and who decides is ahead of most competitors abroad. The Principality’s framework, taken seriously, becomes the firm’s argument. We write the documentation as part of every build for a regulated client, and we are in Monaco if the APDP or the AMSF has a question.
Questions.
Can we use ChatGPT on client files?
Not the public version. Enterprise plans with no-training and no-retention terms, or models run inside your environment, are the options; we set them up and write the rule for the team.
Does an AI system need to be declared to the APDP?
Processing of personal data has formalities under Law 1.565 that depend on the data and the purpose. We prepare the processing description; your counsel or DPO confirms the formality. We do not give legal advice.
Can AI do our KYC?
It can collect, check and prepare; the professional decides and signs. That is how Trace works and how any system we build for AML duties works.
Where are the models hosted?
In the EU by default, under contracts that exclude training and retention. For some clients, inside their own environment. Documented in the processing description.
Who is responsible if the AI makes a mistake?
The firm, which is why a person approves what leaves and why the system is built to stop rather than guess. The log shows what happened; the controls limit what can go wrong.
Related.
AI and Monaco’s data-protection law
Monaco’s data-protection law of 3 December 2024 (Law 1.565), supervised by the APDP, applies to every automation that reads an email, a file or a calendar. This page is how we build so that it does, in plain words. It is practical guidance, not legal advice.
Trace
Trace is client-verification software for Monaco’s regulated professions, built and run by bss works. A person, company or vessel is checked against 18+ official sources, 120,000+ politically exposed persons, 810,000+ offshore entities and the press, in under three minutes, with a dated, fingerprinted PDF report. In production at tracemonaco.com.
Family offices & wealth
Consolidated reporting from custodian data, counterparty screening, documents in confidence.
Start with a 30-minute call. Keep what it finds.
You tell us where the hours go. We tell you which two or three tasks to automate first, in a short written note. Free, in English or French.