Third-Party Reliance & Outsourcing
Many AML/KYC processes depend on introducers, KYC utilities, screening vendors, corporate service providers, correspondent banks, consultants or outsourced operations teams. The control question is what can be relied on, what must be verified again and who remains accountable.
Key idea: using a third party does not automatically transfer AML responsibility. The regulated business usually remains accountable for its own compliance framework under applicable law and policy.
1. Reliance vs outsourcing #
| Term | Plain meaning | Main control question |
|---|---|---|
| Reliance | Using CDD/KYC work performed by another eligible party under rules that allow reliance. | Can the firm access the necessary information and evidence, and is reliance permitted? |
| Outsourcing | Contracting a service provider to perform part of the AML process. | Is the outsourced control governed, monitored, documented and auditable? |
| Introducer / agent | A party that brings or helps onboard customers. | Does the firm independently control acceptance, evidence and escalation? |
| Vendor tool | A data, screening, monitoring or workflow provider. | Are tool outputs understood as inputs, not final decisions? |
2. What can go wrong #
- the firm treats a third-party checklist as final clearance;
- underlying identity, UBO or source documents are not available when needed;
- screening vendors produce alerts but alert handling is not owned internally;
- outsourcing contracts do not define audit rights, data security or issue reporting;
- practitioners are commercially incentivised to onboard but not to challenge risk;
- correspondent or intermediary relationships create indirect exposure that is not reviewed.
3. Minimum control questions #
| Question | Why it matters |
|---|---|
| Who owns the final decision? | Prevents hidden delegation of regulated judgment. |
| Can evidence be obtained quickly? | Supports audit, review and escalation. |
| What is the scope of the third-party work? | A screening result is not the same as full CDD. |
| How are exceptions escalated? | Prevents unresolved discrepancies from being ignored. |
| How is quality tested? | Reliance and outsourcing need monitoring, not blind trust. |
4. Correspondent and intermediary relationships #
Financial institution relationships can create indirect exposure to customers, counterparties, payment chains and jurisdictions that the firm does not directly onboard. Correspondent due diligence and intermediary risk should therefore be understood as relationship-risk controls, not just document collection.
5. Source basis #
- FATF Recommendation 17 for third-party reliance concepts.
- FATF Recommendation 18 for internal controls and group-wide programme concepts.
- Wolfsberg Correspondent Banking resources for FI-to-FI due diligence and questionnaire framing.
See Also#
References#
- FATF risk-based approach and AML/CFT programme concepts listed in the Source Register.
- Wolfsberg/Basel-style governance and control-quality framing where applicable.
- Editorial & Source Policy for source hierarchy and reviewer-accountability boundaries.