3. The tasks outsourced pursuant to paragraph 1 of this Article shall not be undertaken in such a way as to impair materially the quality of the obliged entity’s policies and procedures to comply with the requirements of this Regulation and of Regulation (EU) 2023/1113, and of the controls in place to test those policies and procedures. The following tasks shall not be outsourced under any circumstances:
|
(a)
|
the proposal and approval of the obliged entity’s business-wide risk assessment pursuant to Article 10(2);
|
|
(b)
|
the approval of the obliged entity’s internal policies, procedures and controls pursuant to Article 9;
|
|
(c)
|
decision on the risk profile to be attributed to the customer;
|
|
(d)
|
the decision to enter into a business relationship or carry out an occasional transaction with a client;
|
|
(e)
|
the reporting to FIU of suspicious activities pursuant to Article 69 or threshold-based reports pursuant to Article 74 and 80, except where such activities are outsourced to another obliged entity belonging to the same group and established in the same Member State;
|
|
(f)
|
the approval of the criteria for the detection of suspicious or unusual transactions and activities.
|