Can a firm rely on a third party for CDD?

Reliance covers the first three CDD measures: identifying and verifying the customer, identifying and verifying the beneficial owner, and assessing the purpose and intended nature of the relationship. Ongoing monitoring is not on the list; the firm that owns the relationship keeps watching it. Whatever is relied on, the relying firm remains ultimately responsible if the CDD turns out to be deficient.

A third party is a credit or financial institution, an auditor, external accountant, tax adviser, independent legal professional or trust and company service provider covered by AML rules, or another institution or person in the EEA or a third country that applies CDD and record-keeping measures consistent with the EU AML Directive and is supervised in a way consistent with it.

Third parties based in high-risk third countries are off limits. The competent supervisor may exempt an EU obliged entity's branch or majority-owned subsidiary based there, if it fully complies with the group's policies and procedures. Within a group, supervisors may also accept that the firm meets the reliance conditions through its group programme, if the group applies EU-standard CDD, record keeping and AML programmes and is supervised at group level.

The law requires the firm to obtain the necessary CDD information from the third party immediately, and to make sure that copies of the identification and verification data, including electronic identification data, will be provided immediately on request. Under CySEC's rules those copies must be certified as true copies of the original documents collected during CDD.

CySEC adds practical steps. The firm confirms that the third party is professionally registered and supervised for AML purposes where it operates, carries out CDD on the third party itself before any business is introduced, signs an agreement that sets out each side's obligations, and keeps a separate file for each third party. Starting the cooperation, and accepting the third party's verified data, both need the AML Compliance Officer's approval.

CySEC also limits when reliance can be used: only at the start of a relationship or occasional transaction, to verify the customer's identity. Information needed later, to update the economic profile or look into unusual transactions, comes from the people who control and manage the customer, such as its directors and beneficial owners.

No. When a firm outsources CDD work, or uses an agent, under a contract that makes the provider effectively part of the firm, the reliance rules do not apply: the provider's work is treated as the firm's own, and the firm's own procedures and oversight govern it.