What Article 18(3) of the AMLR keeps inside the firm
A service provider or a software tool may help with most AML/CFT work. Six tasks stay with the firm, with narrow exceptions for FIU reporting within a group and for some funds, and the firm stays fully liable for what it outsources.
Outsourcing is allowed, on conditions
Article 18 of the Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) lets obliged entities outsource tasks resulting from the Regulation to service providers. The entity must notify the supervisor before the provider starts the outsourced task.1
While performing those tasks, service providers are regarded as part of the obliged entity, and the entity remains fully liable for any act or omission connected to the outsourced tasks. For each outsourced task, the entity must be able to show the supervisor that it understands the rationale behind the provider's activities and the approach followed, and that those activities mitigate the specific risks to which it is exposed.2
Before outsourcing, the entity must assure itself that the provider is sufficiently qualified. The provider, and any sub-outsourcing provider, must apply the policies and procedures the entity has adopted. The conditions are laid down in a written agreement, and the entity performs regular controls, at a frequency set by how critical the outsourced tasks are.3 Outsourcing must also not materially impair the supervisors' ability to monitor and retrace the entity's compliance.4
The six tasks that stay with the entity
Article 18(3) first says that outsourced tasks must not be carried out in a way that materially impairs the quality of the entity's policies and procedures, or of the controls that test them. It then lists six tasks that shall not be outsourced under any circumstances.5
Point (a): the proposal and approval of the entity's business-wide risk assessment under Article 10(2).6
Point (b): the approval of the entity's internal policies, procedures and controls under Article 9.7
Point (c): the decision on the risk profile to be attributed to the customer.8
Point (d): the decision to enter into a business relationship or carry out an occasional transaction with a client.9
Point (e): the reporting to the Financial Intelligence Unit (FIU) of suspicious activities under Article 69, or of threshold-based reports under Articles 74 and 80, except where these activities are outsourced to another obliged entity belonging to the same group and established in the same Member State.10
Point (f): the approval of the criteria for the detection of suspicious or unusual transactions and activities.11
The exceptions the article allows
The first exception is in point (e) itself: the reporting to the FIU may be outsourced to another obliged entity of the same group established in the same Member State.10
The second is Article 18(7), which matters for funds. A collective investment undertaking that has no legal personality, or that has only a board of directors and has delegated the processing of subscriptions and the collection of funds from investors to another entity, may outsource tasks (c), (d) and (e) to one of its service providers. It may do so only after notifying the supervisor of its intention and after the supervisor has approved the outsourcing, taking into account the provider's resources, experience and knowledge in preventing money laundering and terrorist financing, and its knowledge of the undertaking's activities or transactions.12 Article 18(7) does not cover points (a), (b) and (f).12
A separate limit applies to providers residing or established in third countries identified under Section 2 of Chapter III: outsourcing to them is allowed only if all the conditions listed in Article 18(6) are met, the first being that the provider is part of the same group.13
What it means in practice
In our reading, these rules draw a line between preparing and deciding. A provider, or a software tool, may gather information, analyse it and draft documents. The entity stays liable, must understand and be able to explain the work done for it,2 and, subject to the exceptions above,1012 must take the six reserved steps itself.5
Point (a) needs care, because it reserves the proposal of the business-wide risk assessment as well as its approval.6 In our reading, an outside party can supply analysis and a draft, but the proposal put forward for approval must be the entity's own, made by people who have reviewed the draft and adopted it. Article 18 does not say exactly where preparation ends and the proposal begins. AMLA is to issue guidelines by 10 July 2027 on outsourcing, including the roles and responsibility of the entity and the provider.14
Keltes is designed on the same line. Its software drafts and proposes, cites the article each proposal serves, and leaves every reserved decision to a named person at the client, who reviews, confirms and owns the result.
About this article
This article is general information about the texts it quotes, as they stood when it was written. It is not legal advice and does not replace advice on your own entity's situation.
Sources
- AMLR Art. 18(1)
Obliged entities may outsource tasks resulting from this Regulation to service providers. The obliged entity shall notify the supervisor of the outsourcing before the service provider starts to carry out the outsourced task.
↑ - AMLR Art. 18(2)
When performing tasks under this Article, service providers shall be regarded as part of the obliged entity, including where they are required to consult the central registers referred to in Article 10 of Directive (EU) 2024/1640 (‘central registers’) for the purposes of carrying out customer due diligence on behalf of the obliged entity. The obliged entity shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks that are carried out by service providers. For each outsourced task, the obliged entity shall be able to demonstrate to the supervisor that it understands the rationale behind the activities carried out by the service provider and the approach followed in their implementation, and that such activities mitigate the specific risks to which the obliged entity is exposed.
↑ - AMLR Art. 18(4)
Before an obliged entity outsources a task pursuant to paragraph 1, it shall assure itself that the service provider is sufficiently qualified to carry out the tasks to be outsourced. Where an obliged entity outsources a task pursuant to paragraph 1, it shall ensure that the service provider, as well as any subsequent sub-outsourcing service provider, applies the policies and procedures adopted by the obliged entity. The conditions for the performance of such tasks shall be laid down in a written agreement between the obliged entity and the service provider. The obliged entity shall perform regular controls to ascertain the effective implementation of such policies and procedures by the service provider. The frequency of such controls shall be determined on the basis of the critical nature of the tasks outsourced.
↑ - AMLR Art. 18(5)
Obliged entities shall ensure that outsourcing is not undertaken in such way as to impair materially the ability of the supervisory authorities to monitor and retrace the obliged entity’s compliance with this Regulation and Regulation (EU) 2023/1113.
↑ - AMLR Art. 18(3), first subparagraph
The tasks outsourced pursuant to paragraph 1 of this Article shall not be undertaken in such a way as to impair materially the quality of the obliged entity’s policies and procedures to comply with the requirements of this Regulation and of Regulation (EU) 2023/1113, and of the controls in place to test those policies and procedures. The following tasks shall not be outsourced under any circumstances:
↑ - AMLR Art. 18(3), point (a)
the proposal and approval of the obliged entity’s business-wide risk assessment pursuant to Article 10(2);
↑ - AMLR Art. 18(3), point (b)
the approval of the obliged entity’s internal policies, procedures and controls pursuant to Article 9;
↑ - AMLR Art. 18(3), point (c)
decision on the risk profile to be attributed to the customer;
↑ - AMLR Art. 18(3), point (d)
the decision to enter into a business relationship or carry out an occasional transaction with a client;
↑ - AMLR Art. 18(3), point (e)
the reporting to FIU of suspicious activities pursuant to Article 69 or threshold-based reports pursuant to Article 74 and 80, except where such activities are outsourced to another obliged entity belonging to the same group and established in the same Member State;
↑ - AMLR Art. 18(3), point (f)
the approval of the criteria for the detection of suspicious or unusual transactions and activities.
↑ - AMLR Art. 18(7)
By way of derogation from paragraph 3, where a collective investment undertaking has no legal personality, or has only a board of directors and has delegated the processing of subscriptions and the collection of funds as defined in Article 4, point (25), of Directive (EU) 2015/2366 from investors to another entity, it may outsource the task referred to in paragraph 3, points (c), (d) and (e) to one of its service providers. The outsourcing referred to in the first subparagraph of this paragraph may only take place after the collective investment undertaking has notified its intention to outsource the task to the supervisor pursuant to paragraph 1, and the supervisor has approved such outsourcing taking into consideration: (a) the resources, experience and knowledge of the service provider in relation to the prevention of money laundering and terrorist financing; (b) the knowledge of the service provider of the type of activities or transactions carried out by the collective investment undertaking.
↑ - AMLR Art. 18(6)
By way of derogation from paragraph 1, obliged entities shall not outsource tasks deriving from the requirements under this Regulation to service providers residing or established in third countries identified pursuant to Section 2 of Chapter III, unless all of the following conditions are met: (a) the obliged entity outsources tasks solely to a service provider that is part of the same group;
↑ - AMLR Art. 18(8)
By 10 July 2027, AMLA shall issue guidelines addressed to obliged entities on: (a) the establishment of outsourcing relationships, including any subsequent outsourcing relationship, in accordance with this Article, their governance and procedures for monitoring the implementation of functions by the service provider and in particular those functions that are to be regarded as critical; (b) the roles and responsibility of the obliged entity and the service provider within an outsourcing agreement;
↑