Reliance on Third Parties

Reliance lets a firm meet part of its customer due diligence with information that another regulated firm has already collected on the same client. Article 48(1) of the Anti-Money Laundering Regulation (AMLR) permits it. The aim, stated in recital 101, is to avoid repeated customer identification procedures.

It covers three of the nine measures in Article 20(1): identifying the customer and verifying their identity, identifying the beneficial owners and verifying who they are, and understanding the purpose and intended nature of the relationship.

The other six measures stay with the relying firm. It still checks for targeted financial sanctions and for politically exposed persons. It still establishes the nature of the client's business, identifies anyone the client acts for, confirms that anyone acting for the client is authorised, and monitors the relationship.

Take a tax adviser that takes on a company which a bank onboarded a month earlier. If the bank agrees in writing, the adviser can use the bank's identification of the company and its owners. The adviser still runs its own sanctions check and decides for itself whether to act. If the bank's identification was wrong, the adviser answers for it: the ultimate responsibility remains with the firm that relies.

Only another obliged entity, meaning a firm that is itself subject to anti-money laundering rules. It may be located in a member state or in a third country. Article 48(1) sets two conditions. The other firm applies the due diligence and record-keeping requirements of the AMLR, or equivalent requirements if it is established in a third country. Its compliance is supervised in a manner consistent with Chapter IV of Directive (EU) 2024/1640, the chapter on anti-money laundering supervision.

A third-country firm needs a further step. Before relying on one, the firm must take into consideration the geographical risk factors in Annexes II and III of the AMLR and any guidance from the Commission, AMLA or other competent authorities (Article 48(2)).

Some countries are excluded. A firm must not rely on an obliged entity established in a third country that the Commission has identified under Articles 29 to 31. Those are high-risk third countries, countries with compliance weaknesses, and countries that pose a specific and serious threat to the Union's financial system. The one exception is for an EU firm's own branches and subsidiaries in those countries, where the group conditions are met (Article 48(4)).

The group conditions are in Article 48(3). The firm relies solely on information from an obliged entity in the same group. The group applies policies, due diligence measures and record-keeping rules that comply fully with the AMLR or with equivalent third-country rules. Their implementation is supervised at group level.

The relying firm must obtain the information at the start and be able to get the documents later. Under Article 49(1) it obtains from the firm relied on all the necessary information on the three measures.

It must also take all necessary steps to ensure that the other firm will provide three things on request: copies of the information collected to identify the customer, all supporting documents or trustworthy sources used to verify identity, and any information collected on the purpose of the relationship (Article 49(2)). The supporting documents include data obtained through electronic identification means and trust services under the eIDAS Regulation.

The handover has a deadline. The firm relied on must provide the information without delay and in any case within 5 working days (Article 49(3)). The conditions for transmitting it are set out in a written agreement between the two firms (Article 49(4)). Inside a group, an internal group procedure may replace the agreement (Article 49(5)).

Reliance is therefore never informal. A firm that accepts a client on another firm's word, with no agreement and no route to the documents, has not met these conditions.

In reliance, the firm uses checks that another obliged entity carried out under its own duties. In outsourcing, a service provider carries out tasks on the firm's behalf and under the firm's procedures. Article 18 of the AMLR governs outsourcing. The table sets the two side by side. In both, the firm that uses the arrangement stays answerable.

The six tasks that Article 18(3) keeps inside the firm include the decision on a customer's risk profile, the decision to enter into a business relationship, and the reporting of suspicions to the financial intelligence unit. The article allows narrow exceptions for reporting within a group in the same member state and for certain collective investment undertakings.