68. In addition to the ESAs guidelines on outsourcing , as applicable, and where the outsourcing of …

In addition to the ESAs guidelines on outsourcing²⁴ , as applicable, and where the outsourcing of operational functions of the AML/CFT compliance officer is permitted under national law, credit or financial institutions should have regard to the following key principles:

• a. The ultimate responsibility for compliance with legal and regulatory obligations, whether or not specific functions are outsourced, lies with the credit or financial institution.
• b. The rights and obligations of the credit or financial institution and the service provider should be clearly allocated and set out in a written agreement.
• c. The credit or financial institution relying on an outsourcing arrangement should remain accountable to monitor and oversee the quality of the service provided.
• d. Intra-group outsourcing should be subject to the same regulatory framework as outsourcing to service providers outside the group²⁵ .
• e. The outsourcing of functions cannot result in the del egation of the management body’s responsibilities. Strategic decisions in relation to AML/CFT should not be outsourced. These decisions include, in particular:
• i. the approval of the business-wide ML/TF risk assessment;
• ii. the decision on the internal organisation of the AML/CFT framework of the credit and financial institution;
• iii. the adoption of internal AML/CFT policies and procedures;
• iv. the approval of the methodology used to determine the ML/TF risk presented by a given business relationship and the assignment of the risk profile;
• v. the approval of the criteria to be used by the credit or financial institution to detect suspicious or unusual transactions for its ongoing monitoring and/or reporting purposes.

Credit and financial institutions remain ultimately responsible for the decision to report suspicious transactions to the FIU, including in situations where the identification and reporting of suspicious transactions is outsourced.

²⁴ EBA guidelines on outsourcing arrangements: EBA/GL/2019/02; EIOPA guidelines on outsourcing to cloud service providers: EIOPA-BoS-20-002; ESMA guidelines on outsourcing to cloud service providers: ESMA50-157-2403

²⁵ Point 27 of the Background sections of the EBA guidelines on outsourcing arrangements of 25 February 2019: EBA/GL/2019/02

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/