If a KYC provider identifies your customers or verifies their documents, the responsibility is still yours. From July 10, 2027, Art. 18 of Regulation (EU) 2024/1624 (AMLR) requires a written agreement, regular controls and prior notice to the supervisor. We draft or review that agreement.
Will your KYC agreement hold up under the AMLR? Free review
Tell us what your KYC provider does and we will tell you what your agreement is missing.
Outsourcing KYC is legal, but the AMLR sets what you can delegate, what you cannot and what the agreement must say. We tie it all down before SEPBLAC or your supervisor reviews it.
We separate what is outsourcing (the provider performs due diligence tasks for you) from what is not (using its software, its databases or its screening services), because different rules apply.
We check that the provider does not decide for you on the customer’s risk profile, the acceptance of the business relationship or the reporting of suspicious transactions.
We draft or review the written agreement: tasks, application of your policies, sub-outsourcing, access to information, audit, data retention and termination.
We document that the provider is sufficiently qualified, where it is established and how it protects data, before it starts work.
We prepare the prior notification to the supervisor and the plan of regular controls, with a frequency that matches how critical the task is.
We adapt your current agreements, signed under Law 10/2010 and Royal Decree 304/2014, so they reach July 10, 2027 without a rushed renegotiation.
The agreement with the provider is the first thing the supervisor asks for when customer onboarding is not done by your own team.
Video identification, document reading or biometrics handled by a third party: if it performs the task for you, it acts as part of your entity and you are the one liable.
AMLR Art. 18 will be directly applicable: a written agreement, regular controls and prior notice to the supervisor before outsourcing.
If it is established in a third country identified under the AMLR (high-risk, with compliance weaknesses or posing a specific and serious threat), you may only outsource within your group and with group-level controls.
You must be able to show that you understand the rationale behind what the provider does and that it mitigates your specific risks.
Data from Regulation (EU) 2024/1624 (AMLR), Law 10/2010 and Royal Decree 304/2014.
General date of application of Regulation (EU) 2024/1624.
Never outsourced: risk assessment, policies, risk profile, customer acceptance, reporting to the FIU and detection criteria.
The entity notifies the supervisor of the outsourcing before the provider starts performing the tasks.
Maximum time for the obliged entity you rely on to give you the due diligence information.
Today, reliance on third parties requires a prior written agreement and excludes ongoing monitoring of the business relationship.
The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) must issue guidelines on outsourcing by July 10, 2027.
We review the agreement and the actual process, and tell you what to change before the AMLR or an inspection arrives.
Would you rather we do it? Our team can handle KYC for your customers: KYC outsourcing, with the file ready within 24 business hours.
Yes. AMLR Art. 18 allows tasks deriving from the Regulation to be outsourced to service providers, and today Law 10/2010 allows reliance on third parties as well as outsourcing or agency relationships. In every case, the obliged entity remains fully liable for what the provider does or fails to do.
Under AMLR Art. 18(3): proposing and approving the business-wide risk assessment; approving internal policies, procedures and controls; deciding the customer’s risk profile; the decision to establish the business relationship or carry out the occasional transaction; reporting to the FIU of suspicious transactions or threshold-based declarations (except to another obliged entity in the same group and Member State); and approving the criteria for detecting suspicious transactions.
Not necessarily. AMLR Recital 47 clarifies that the use or purchase of third-party software, and access to databases or screening services, are not considered outsourcing when the entity is still the one meeting the requirement. It is outsourcing when the provider performs the due diligence task for you.
At a minimum, what AMLR Art. 18(4) requires: a written agreement setting the conditions for the tasks, the obligation of the provider and any subcontractor to apply your policies and procedures, and your regular controls; and, under Art. 18(5), nothing that hinders supervision. If you are a credit institution, payment institution or electronic money institution, it is also advisable to align it with the EBA Guidelines on outsourcing.
Under the AMLR, yes: the entity notifies the supervisor of the outsourcing before the provider starts (Art. 18(1)). The notification does not mean that the supervisor accepts the arrangement, but the supervisor can use it to assess your controls or prepare inspections.
In outsourcing, the provider acts as part of your entity and applies your policies. In reliance on third parties (AMLR Arts. 48–50), you rely on the due diligence already carried out by another supervised obliged entity, which must give you the information within five business days at most. In both cases, ultimate responsibility remains with you.
Yes, unless it is established in a third country identified under Section 2 of Chapter III of the AMLR: high-risk, with compliance weaknesses or posing a specific and serious threat. In that case, you may only outsource to a provider within your own group that applies group-wide policies compliant with the Regulation and is supervised at group level (Art. 18(6)).
Law 10/2010 and Royal Decree 304/2014. Article 8 of the Law allows you to rely on third parties subject to anti-money laundering rules under a prior written agreement, except for ongoing monitoring, and it does not apply to outsourcing or agency relationships in which the provider is considered part of the obliged entity. In addition, from October 28, 2026, Article 21 of Royal Decree 304/2014 requires the “other secure procedures” for non-face-to-face identification to meet the minimum requirements of the general authorizations published by SEPBLAC.
The supervisor will not ask whether the provider is good, but whether you understand and control what it does.
Software and databases are not outsourcing; performing due diligence for you is.
The risk profile, customer acceptance and reporting to the FIU never leave the entity.
The agreement, the prior assessment, regular controls and notice to the supervisor show that the model works.
Source: Regulation (EU) 2024/1624 (Arts. 18, 48–50 and 90; Recitals 47–50), Law 10/2010 (Art. 8) and Royal Decree 304/2014 (Arts. 13 and 21).
These terms appear in Regulation (EU) 2024/1624, in Law 10/2010 and in any review of your customer onboarding process.
Identifying and verifying the customer and the beneficial owner, understanding the purpose of the relationship and monitoring it.
Assigning tasks deriving from the Regulation to a service provider; the provider is considered part of the entity.
Relying on the due diligence already carried out by another supervised obliged entity.
A company that performs compliance tasks on behalf of the obliged entity, even if it is not an obliged entity itself.
The provider assigning tasks to another provider, which must also apply the entity’s policies.
A task whose importance determines how often the entity must carry out controls.
The EU authority that must issue guidelines on outsourcing and on reliance on third parties.
A high-risk country, one with compliance weaknesses or one posing a serious threat, identified under the AMLR: outsourcing there is not allowed except within the group.
Under Law 10/2010, it cannot be entrusted to third parties under reliance, except within groups.
Outsourcing: a provider acting as part of your entity.
Reliance on another obliged entity: another obliged entity that has already carried out its own due diligence.
Outsourcing: yours, including in sub-outsourcing.
Reliance on another obliged entity: the other entity’s, which must comply with the AMLR or equivalent rules.
Outsourcing: a written agreement and prior notice to the supervisor.
Reliance on another obliged entity: a written agreement on the transmission of information.
Outsourcing: access under the agreement and regular controls.
Reliance on another obliged entity: delivery without delay and within five business days at most.
Outsourcing: full, borne by the obliged entity.
Reliance on another obliged entity: ultimate, borne by the relying entity.
These are the points that fail most often when an outsourced customer onboarding process is reviewed.
Tell us which KYC provider you use, which tasks you entrust to it and what agreement you have signed, and we will tell you what to change.
Updated October 15, 2026
Regulation (EU) 2024/1624 (AMLR), applicable from July 10, 2027, regulates the outsourcing of anti-money laundering tasks in a directly applicable EU regulation. Its Article 18 allows tasks to be entrusted to service providers, but it sets limits, requires a written agreement and keeps full responsibility with the obliged entity.
Obliged entities may outsource tasks deriving from the Regulation to service providers, and must notify the supervisor before the provider starts. The provider is considered part of the entity, which remains fully liable for any act or omission and must be able to explain to the supervisor the rationale behind what the provider does and how it mitigates the entity’s risks.
Article 18(3) excludes the business-wide risk assessment, the approval of policies and controls, the decision on the customer’s risk profile, the decision to establish the business relationship, reporting to the FIU of suspicious transactions or threshold-based declarations (except within the group and the same Member State) and the approval of detection criteria. There is a limited exception for collective investment undertakings without legal personality, with the supervisor’s approval.
Before outsourcing, the entity must make sure that the provider is sufficiently qualified. The conditions are laid down in a written agreement, the provider and its subcontractors apply the entity’s policies, and the entity carries out regular controls whose frequency depends on how critical the task is. For credit institutions, payment institutions and electronic money institutions, the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) add minimum content for agreements covering critical or important functions; in September 2026, the EBA published guidelines on third-party risk management that will replace them.
In the meantime, Article 8 of Law 10/2010 applies: you may rely on third parties subject to anti-money laundering rules to apply due diligence, except ongoing monitoring, under a prior written agreement and while retaining full responsibility. That article does not apply to outsourcing or agency relationships in which the provider is considered part of the obliged entity. Royal Decree 304/2014 sets out the agreement in more detail (Art. 13) and, from October 28, 2026, refers the “other secure procedures” for non-face-to-face identification to SEPBLAC’s general authorizations (Art. 21).
If you need the basic context, start with what KYC is. The agreement with the provider is part of your AML manual and your internal controls. If what you want is to delegate the management of your compliance to a law firm, see AML/CFT outsourcing; for the new EU framework as a whole, see our page on the AMLR.
More in KYC Outsourcing