KYC Outsourcing vs Third-Party Reliance: EU Rules and the AMLR Changes

KYC outsourcing means a provider performs customer due diligence tasks for your firm, using your procedures and instructions. Third-party reliance means your firm uses specified due diligence measures performed by an eligible third party under its own AML/CFT obligations. In both models, your firm retains responsibility for compliance.

The distinction determines which provider you can use, what work the arrangement can cover, what evidence you must obtain and which decisions stay with your firm. Calling a contract a “KYC partnership” or a “reliance agreement” does not settle those questions. The actual operating model should be considered and carefully reviewed. The EBA’s final Q&A 2020_5100 explains why outsourcing controls alone do not satisfy the conditions for reliance.

Legal position checked: 12 October 2026. Today, apply your country’s implementation of Directive (EU) 2015/849, relevant supervisory requirements and sector rules. Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (AMLR), is already in force and generally applies from 10 July 2027. Its outsourcing rules are in Article 18; reliance is governed separately by Articles 48–50. This guide focuses on EU arrangements. Outside the EU, check the applicable local framework.

What is the difference between KYC outsourcing and third-party reliance?

The assessment generally starts with one question: is another party doing your firm’s work, or are you using that party’s own legally qualifying due diligence?

Question	KYC outsourcing	Third-party reliance
Whose procedures govern the work?	Your firm’s procedures and instructions, implemented by the provider.	The eligible third party’s own AML/CFT processes and obligations.
Who is the other party?	A service provider. It need not itself be an AML-regulated entity, although qualification and other applicable requirements still matter.	A party meeting the legal eligibility conditions. An ordinary KYC vendor does not qualify merely because it offers verification services.
What is the customer relationship?	The provider performs tasks for your firm. In the model described by the EBA, it has no independent business relationship with that customer.	In the EBA’s explanation, the third party has its own customer relationship and performs its own CDD.
What can the arrangement cover?	Permitted operational tasks, subject to applicable restrictions and retained decision authority.	Specified CDD measures. Reliance is not a transfer of the entire AML programme.
What evidence does your firm need?	Evidence that the provider applies your procedures effectively, with access, oversight and testing.	Necessary CDD information and access to supporting evidence, with eligibility and scope conditions satisfied.
Who remains responsible?	Your firm remains responsible for its compliance obligations.	The relying firm retains ultimate responsibility for the covered CDD requirements.

These distinctions follow Articles 25–29 of the current AML directive and the EBA Q&A. Internationally, FATF Recommendation 17 and its Interpretive Note also distinguish reliance from outsourcing or agency arrangements. FATF standards require implementation through the relevant jurisdiction’s framework; they do not create a universal outsourcing permission.

What do the current EU rules allow?

Reliance covers specified CDD measures, not ongoing monitoring

Under Article 25 of Directive (EU) 2015/849, Member States may permit reliance for the measures in Article 13(1)(a)–(c): customer identification and identity verification; beneficial-owner identification and reasonable verification measures; and assessment of the purpose and intended nature of the business relationship. Ongoing monitoring under Article 13(1)(d) is outside that reliance permission. Your firm must still meet its own applicable monitoring, risk assessment and enhanced due diligence duties.

Before using reliance, establish that national law permits the proposed arrangement, the third party meets Article 26’s CDD, record-keeping and supervision conditions, and any geographic restrictions are satisfied. Obtain the necessary CDD information. Article 27(2) requires adequate steps to ensure relevant identification and verification copies are provided immediately upon request. A statement that “KYC is complete” is not a substitute for the information and evidence the rules require. Source: Articles 25–28.

Outsourcing is a separate arrangement with retained accountability

Article 29 excludes qualifying outsourcing and agency relationships from the directive’s reliance section where the provider or agent is regarded as part of the obliged entity under the contractual arrangement. That does not create unrestricted permission to delegate every AML function. National law, the firm’s authorisation and applicable supervisory rules still govern what it may outsource.

For credit and financial institutions within their scope, the final EBA AML/CFT compliance officer guidelines, paragraphs 68–73, already address written allocation of responsibilities, provider due diligence, retained strategic decisions and oversight where national law permits outsourcing. The officer’s oversight includes checking provider performance, testing contractual commitments, ensuring access to customer data and reporting issues to the management body. These are existing expectations, not requirements that first appear in July 2027.

For remote onboarding, EBA/GL/2022/15, paragraphs 46–49, adds practical expectations: specify who performs each activity, assess the provider’s capability, monitor implementation of your procedures and control changes to the onboarding process. In reliance, assess whether the third party’s own remote CDD process and collected information meet the relevant requirements.

What changes under the AMLR from 10 July 2027?

The AMLR introduces a more explicit common framework. It preserves the distinction between outsourcing and reliance rather than treating every external KYC arrangement alike.

Issue	Current framework	AMLR framework
Outsourcing permission	Article 29 distinguishes outsourcing from reliance; national and sector requirements determine permitted delegation.	Article 18 expressly permits outsourcing tasks, subject to exclusions, safeguards and retained liability.
Supervisor notification	Check applicable national and sector notification or approval rules.	Notify the supervisor before the provider starts the outsourced task. Notification is not a general requirement to obtain approval for every arrangement.
Provider controls	Applicable guidance and sector rules already require controls.	Assure provider qualification; use written terms; ensure providers and sub-providers apply the firm’s policies; perform regular controls reflecting task criticality.
Reliance scope	Article 13(1)(a)–(c) of the directive.	Article 20(1)(a)–(c): customer and beneficial-owner identification/verification, and purpose/intended nature of the relationship or occasional transactions.
Reliance evidence	Necessary information; relevant identification/verification copies immediately upon request.	Article 49 requires necessary information and requested supporting evidence without delay and, in any event, within five working days. Transmission conditions must be documented in writing, subject to the qualifying group exception.

Source: AMLR Articles 18, 20, 48 and 49. The five-working-day limit is not an onboarding grace period. It does not override identity-verification timing or the rules on inability to complete CDD. Read it alongside Articles 21 and 23, including their specific exceptions; today’s corresponding timing rules are in Article 14 of the directive.

Which tasks cannot be outsourced under Article 18?

Article 18(3) reserves the following tasks, subject to the specific derogations explained below:

• Proposing and approving the firm’s business-wide risk assessment.
• Approving internal AML/CFT policies, procedures and controls.
• Deciding the customer’s risk profile.
• Deciding to enter a business relationship or carry out an occasional transaction.
• Reporting suspicious activities or the specified threshold-based reports to the FIU under Articles 69, 74 and 80.
• Approving the criteria used to detect suspicious or unusual transactions and activities.

Map work at task level. Collecting documents, investigating discrepancies or supplying factual inputs differs from exercising a reserved decision or approval. For customer-risk and acceptance decisions, a provider’s recommendation must not become an automatic substitute for the decision your firm is required to retain. Keep a record showing who evaluated the evidence and exercised that authority.

Two exceptions matter. Article 18(3)(e) allows the specified FIU reporting to be outsourced to another obliged entity in the same group and the same Member State. Article 18(7) separately permits certain collective investment undertakings with no legal personality, or only a board of directors, that have delegated subscription processing and collection of investor funds, to outsource customer-risk decisions, relationship/transaction decisions and reporting. That derogation requires supervisory notification and approval. It is not a general exemption for every fund. Source: Article 18(3) and (7).

Article 18(6) also restricts outsourcing to providers in third countries identified under Chapter III, Section 2, with a conditional exception for a provider in the same group. The exception requires compliant or equivalent group policies and effective home-Member-State group supervision. This is a targeted geographic restriction, not a blanket prohibition on every non-EU provider.

Reliance remains limited, even with a regulated counterparty

Article 48 permits reliance on other qualifying obliged entities meeting the prescribed CDD, record-keeping and supervision requirements. It retains the relying entity’s ultimate responsibility. Reliance still covers only Article 20(1)(a)–(c), not all the other CDD measures listed in Article 20, such as ongoing monitoring or the separate PEP and targeted-financial-sanctions checks. Your firm must ensure its complete set of applicable obligations is met. Article 49 requires written transmission arrangements; a qualifying group procedure can replace the agreement where Article 48(3)’s conditions are satisfied.

For non-EU parties, assess equivalence and geographic risk. Article 48(4) prohibits reliance on entities in the specified third countries, subject to its conditional exception allowing EU entities to rely on their own branches or subsidiaries there. A regulated status or group connection alone is insufficient. Source: Article 48.

Further guidance is part of the transition. Articles 18(8) and 50 require AMLA outsourcing and reliance guidelines by 10 July 2027. The AMLA register checked on 10 October 2026 does not list final guidelines for these mandates and expressly states that it is non-exhaustive. Monitor AMLA publications before implementation. Existing EBA AML/CFT guidelines continue to apply until replaced by the relevant AMLA instruments.

Is a KYC platform, screening tool or group service centre outsourcing?

Software and data services: AMLR Recital 47 distinguishes using software, databases or screening services from outsourcing where the provider does not perform the underlying compliance requirement. If your staff use a tool to carry out the check and evaluate the result, that differs from a managed service performing the task for you. Review the full workflow, including analyst intervention, exception handling and decision rights. A contract’s “software” label does not settle classification.

Group arrangements: work performed within the same legal entity differs from work performed by a separate group company. A shared service centre can be an outsourcing provider; another group obliged entity’s own CDD can support reliance if the conditions are met. Group membership alone supplies neither an exemption from oversight nor permission to outsource reserved tasks. Current EBA guidance, paragraph 72, addresses group outsourcing. Future conditions are in AMLR Articles 18 and 48–49.

Other regimes may apply to the same service:

• Banks and other in-scope financial entities: assess ICT third-party risk under DORA, particularly Articles 28–30. DORA has applied since 17 January 2025. A service outside AMLR outsourcing classification may still be an ICT service within DORA.
• Payment institutions: consider operational outsourcing notification and safeguards under PSD2 Articles 19–20, alongside national implementation.
• Crypto-asset service providers: MiCA Article 73 requires retained responsibility, expertise, supervision and access safeguards for outsourced functions.
• Personal data: determine the actual controller/processor roles and applicable requirements under the GDPR, including Articles 28, 32 and 44 onwards. Contract labels alone do not determine those roles.

For institutions within their scope, also track the EBA’s final non-ICT third-party risk guidelines, published on 18 September 2026. At this article’s checking date, the EBA labels them not yet applicable and awaiting translation. They will replace its 2019 outsourcing guidelines when applicable; publication of the final report is not itself their application date.

Four practical examples: classify the work before appointing the provider

The following examples are illustrative. Their conclusions depend on the described facts and must be checked against the firm’s actual national and sector framework.

1. A bank uses an external team to clear a KYC remediation backlog

The team requests missing documents, checks ownership information against the bank’s standards and records discrepancies. The bank’s authorised staff retain decisions on customer risk and whether to continue the relationship. This is operational outsourcing, not reliance on the team’s independent CDD. Define which files require escalation and test whether the work meets the bank’s requirements. A “file completed” target should not reward closing unresolved beneficial-ownership issues.

2. A payment institution buys managed onboarding

The vendor’s analysts conduct checks using the institution’s rules and recommend an outcome. This is an outsourcing model on those facts. A contract allowing the vendor to approve customers automatically needs particular attention under AMLR Article 18(3)(d). Determine how the institution will retain the required acceptance decision and evidence meaningful control. Check existing PSD2 and national requirements now; do not postpone current obligations until July 2027.

3. A CASP’s staff use an identity-verification platform

The platform supplies document-authenticity and identity-matching results, while the CASP performs the underlying CDD review and handles exceptions. Under AMLR Recital 47, purchasing that tool alone need not constitute outsourcing of the underlying AML requirement. If the provider also supplies analysts who complete CDD for the CASP, reassess the arrangement. MiCA, DORA where applicable, data security and GDPR questions remain relevant in either delivery model. See also our MiCA customer onboarding guide.

4. A firm proposes to use another bank’s existing CDD

The bank performed CDD for its own customer under its own obligations. This could support reliance, subject to permission, eligibility, covered measures and evidence access. A bank account or introduction alone does not prove those conditions. Obtain the necessary information, identify what is missing for your own relationship and test retrieval of supporting evidence. Retain responsibility for your own monitoring and any additional measures required by your customer’s risk.

How to document and oversee the arrangement

A useful approval file connects the legal classification to the work actually performed. The following decision record is a practical structure, not a regulator-prescribed form.

Decision-record field	What to record
Entity and framework	Legal entity, authorisation, jurisdiction, supervisor, applicable rules and review date.
Classification and reason	Outsourcing, reliance, software/data service or internal work; whose procedures apply and who performs the underlying task.
Exact scope	Activities, customer segments, covered CDD measures, exclusions and retained decisions. For reliance, evidence of legal eligibility.
Accountable owners	Provider contact, firm oversight owner, decision authority and escalation route.
Evidence and access	Required information, supporting documents, retrieval arrangements, retention, access rights and supervisory access.
Controls and dependencies	Due diligence, written terms, changes, sub-providers, data transfers, conflicts and applicable notifications or approvals.
Testing and exit	Risk-based checks, findings, corrective-action owner and date; continuity, record export and termination/handover arrangements.

Test outcomes as well as turnaround time. Useful checks include whether beneficial ownership was actually resolved, whether exceptions reached the right decision-maker, whether requested documents were retrievable and whether material process changes were communicated. Select samples by risk and include difficult cases; use findings to drive remediation. The applicable EBA officer guidelines, paragraphs 69–70, and remote onboarding guidelines, paragraphs 48–49, provide the regulatory basis for provider assessment and oversight within their scope.

Cost reduction, temporary capacity and specialist expertise can justify exploring outsourcing. Compare total cost, including retained supervision, systems integration, rework, evidence retrieval and exit. A cheaper file-processing fee may provide little benefit if your team repeatedly repairs poor decisions or cannot reconstruct the evidence. Reliance may reduce duplication of covered CDD; it does not remove the eligibility, information and monitoring work that stays with your firm.

What should firms do before July 2027?

1. Inventory arrangements by task. Include managed KYC, group centres, reliance and software/data services. Record the delivery model rather than relying on procurement categories.
2. Map retained authority. Compare current permissions with Article 18’s reserved tasks and specific exceptions. Identify contracts or workflows needing redesign.
3. Test evidence access. For reliance, verify eligibility, covered measures and retrieval arrangements. For outsourcing, establish whether your firm can demonstrate effective delivery and supervisory access.
4. Update terms and oversight. Address sub-providers, process changes, data, reporting, continuity and exit. Plan the relevant supervisor notification or approval process.
5. Refresh the legal assessment. Track AMLA’s outsourcing and reliance guidelines, sector developments and national implementation. Treat draft technical standards and final draft reports according to their legal status.

CDD specifications are also developing. Our AMLA final draft customer due diligence RTS analysis explains the related proposals. Publication of AMLA’s final report does not itself make those draft standards binding. Align your operating model with the applicable measures as well as the division of responsibilities.

Frequently asked questions

Can a firm outsource KYC to an unregulated provider?

Potentially, where national and sector rules permit the arrangement. The EBA distinguishes outsourcing providers, which may be supervised or unsupervised, from qualifying reliance parties. Check task restrictions, qualification, evidence access and oversight. An unregulated provider does not become eligible for reliance merely by providing KYC services.

Can we rely on another firm’s “KYC passed” certificate?

A certificate alone does not establish compliant reliance. Verify the party’s eligibility, the measures covered and the necessary CDD information and supporting evidence. Your firm remains responsible for the requirements on which it relies and for its remaining obligations.

Can we outsource transaction monitoring?

Operational monitoring tasks may be outsourced where permitted, with effective controls and retained responsibilities. That differs from reliance: ongoing monitoring is outside the specified reliance measures. From the AMLR application date, Article 18’s restrictions on detection-criteria approval and FIU reporting also need to be respected.

Does the AMLR ban outsourcing the MLRO?

Do not use a single EU-wide yes/no answer. Separate appointment to the relevant officer role from delegation of operational tasks. Check national appointment and supervisory requirements, existing applicable guidance, AMLR Article 11 and Article 18’s task restrictions. The terms MLRO, AML/CFT compliance officer and AMLR compliance manager should not be assumed interchangeable.

Does a group company qualify automatically for reliance?

No. Current group arrangements must satisfy the relevant directive and national conditions. Under AMLR Articles 48–49, the group conditions must also be met before group procedures can satisfy the requirements or replace the written reliance agreement.

Can onboarding proceed while documents arrive within five working days?

Not on that basis alone. AMLR Article 49’s information deadline does not displace Article 23’s verification timing rules or Article 21’s rules where CDD cannot be completed. Assess any permitted exception on its own conditions.

Current directive: Articles 13–14 and 25–29; EBA classification Q&A; AMLR: Articles 11, 18, 20–23 and 48–50.

Turn the decision into an outsourcing procedure

Once you have settled the classification, permitted scope and retained responsibilities, document how the arrangement will operate. AML Agent’s Document Generator supports drafting an outsourcing procedure which is highly tailored to your entity. If you already have a procedure, the Gap Assessment can help review documentary coverage against the selected AML framework.

About the author: George Filippakis is a financial services lawyer with a background in software development and practical AML compliance experience across large banks, payment service providers, crypto-asset service providers and investment firms. He is leading the development of AML Agent and researches the intersection of financial regulation, compliance and AI.