4.5 Reliance on third parties and outsourcing

In addition to the points set out in paragraph 9, credit and financial institutions should include in their policies and procedures specifications setting out which remote customer onboarding functions and activities will be carried out or performed by the credit and financial institution, by third parties or by another outsourced service provider.

4.5.1 Reliance on Third Party Providers in accordance with Chapter II, Section 4 of Directive (EU) 2015/849

In addition to the EBA Risk Factors Guidelines¹⁶ , in particular to guidelines 2.20 to 2.21 and 4.32 to 4.37 of those Guidelines, they should apply the following criteria:

• a) take the steps necessary to be satisfied that the third party’s own CDD remote customer onboarding processes and procedures and the information and data they collect in this context, are sufficient and consistent with requirements laid down in these Guidelines;
• b) ensure the continuity of the business relationships established between the customer and the credit and financial institution to guard against events that might reveal shortcomings on the remote customer onboarding process carried out by the third party.

4.5.2 Outsourcing of CDD

¹⁶ EBA/GL/2021/02

Where credit and financial institutions outsource all or parts of the remote customer onboarding process to an outsourced service provider, as referred to in Article 29 of Directive (EU) 2015/849, credit and financial institutions should apply in addition to guidelines 2.20 to 2.21 and 4.32 to 4.37 of the EBA Risk Factors Guidelines and in addition to the EBA Guidelines on Outsourcing¹⁷ where applicable, before and during the business relationship with the outsourced service provider the following measures, the extent of which should be adjusted on a risk-sensitive basis:

• a) ensure that the outsourced service provider effectively implements and complies with the credit and financial institution’s remote customer onboarding policies and procedures in accordance with the outsourcing agreement. This should be achieved through regular reporting, ongoing monitoring, on-site visits or sample testing;
• b) carry out assessments to ensure that the outsourced service provider is sufficiently equipped and able to perform the remote customer onboarding process. Assessments may include, but are not limited to, the assessment of staff training, technology fitness and data governance at the outsourced service provider;
• c) ensure that the outsourced service provider informs the credit and financial institutions of any proposed changes of the remote customer onboarding process or any modification made to the solution provided by the outsourced service provider.

¹⁷ EBA Guidelines on outsourcing arrangements.docx (europa.eu)

Where the outsourced service provider stores customer data, including, but not limited to, photography, videos, and documents, during the remote onboarding process, credit and financial institutions should ensure that:

• a) only necessary customer’s data is collected and stored in line with a clearly defined retention period;
• b) access to the data is strictly limited and registered;
• c) appropriate security measures are implemented to ensure that the stored data is protected.