This part of our series on the AML-package features the regulations on outsourcing. The introduced AML-Regulation (AML-R) will be directly applicable to obligated entities.
Status quo
Section 6 paragraph 7 of the German Anti Money Laundering Law (Geldwäschegesetz – GwG) stipulates that internal security measures can be carried out by third parties, if they were reported the competent authority beforehand. The competent authority may prohibit the transfer of tasks if the conditions defined in para. 7 are met.
Currently, outsourcing is possible to a huge extent. Restrictions solely apply to the responsibility of management, which cannot be transferred via outsourcing.
Even in the case of outsourcing the obliged party continues to be responsible for the fulfilment of the security measures.
What stays the same?
The new AML-R states in Article 14a that tasks can still be outsourced to third parties by contractual agreement between the obliged party and the service provider. The supervisor is also to be notified of the planned transfer. Furthermore, the obliged party will remain fully liable for any action that is carried out by the service provider.
What’s new?
In contrast to Sec. 6 para. 7 GwG, the AML-R stipulates stricter requirements and introduces limits to outsourcing of specific functions.
-
Prohibition of outsourcing of certain tasks
The following tasks may not be outsourced:
- The proposal and approval of the obliged party’s business-wide risk assessment (Art. 8 AML-R),
- the approval of policies, controls and procedures (Art. 7 AML-R),
- decision of the risk profile of customers,
- the decision to enter into a business relationship with customers,
- the reporting of SARs to the FIU (Art. 50, 54a, 59 AML-R), and
- the approval of criteria to identify suspicious transactions.
Especially the restrictions on the SAR-filing will introduce changes for the obliged entities since it restricts the full transfer of the AML-function to an external party. External service providers will therefore have in the future an enhanced supporting function that may prepare policies, instructions, individual decisions and the handling of internal SARs. The last decision and the external filing of SARs will however be in the non-transferrable power of the obliged entity.
-
Obligation to ensure quality
Obliged entities will have to ensure the sufficient quality of the service provider to be able to carry out the outsourced tasks. Furthermore, obliged entities will have to make sure that service providers as well as subsequent service providers apply policies and procedures effectively. This obligation goes alongside the responsibility to carry out regular controls. Their frequency is determined by the critical nature of the outsourced tasks.
-
Location of service providers
In comparison to the GwG states art. 14a AML-R that tasks cannot be outsourced to service providers that are located outside the European Union with their own AML/CFT legislation or enforcement regimes. Under strict conditions, a transfer to service providers located in a third country may be possible.
The newly founded Anti Money Laundering Authority (AMLA) will supervise the outsourcing of tasks by obliged entities. They have also been tasked with the issuance of guidelines in the following three years after implementation oft he regulation. Those guidelines include will for example the definition of functions that are considers as critical.
Conclusion
In conclusion the new AML-R still allows tasks to be delegated to service providers. The scope of tasks that may be delegated will however be severely limited compared to the current status quo.
