Financial Enterprise Content Management Systems (FECMS) have been recently deployed not only in intra-enterprises but also over the Internet to interact with customers. As FECMS contains a lot of sensitive and confidential information, there is an urgent need for tackling privacy and access control issues in these systems. In this paper, we proceed with our case study in an international banking enterprise on these issues. The FECMS is based on Web services technologies and we demonstrate the key privacy and access control policies for internal content flow management (such as content editing, approval, and usage) as well as external access control for Web portal and institutional programmatic users. Through the modular design of an integrated FECMS, we illustrate how we can systematically specify privacy and access control policies in each part of the system with the technology of Enterprise Privacy Authorization Language (EPAL)..