Reliance vs outsourcing — two different AML routes
These are two different legal mechanisms with two different sets of conditions, and firms routinely describe one while operating the other. Reliance under Articles 48 and 49 of Regulation (EU) 2024/1624 means using due diligence another obliged entity has already performed. Outsourcing under Article 18 means having a provider perform tasks for you. The counterparty, the conditions and the paperwork all differ.
1. Reliance — Articles 48 and 49
Obliged entities may rely on other obliged entities, whether in a Member State or a third country, to meet the customer due diligence requirements in Article 20(1), points (a), (b) and (c) — that is, identifying and verifying the customer, identifying beneficial owners, and assessing the purpose and intended nature of the relationship. Two conditions apply:
- the other entity applies the customer due diligence and record-keeping requirements of the Regulation, or equivalent requirements where established in a third country; and
- its compliance is supervised in a manner consistent with Chapter IV of Directive (EU) 2024/1640.
Ultimate responsibility remains with the entity that relies. Article 48(1) says so expressly. And Article 48(2) requires the geographical risk factors in Annexes II and III, plus Commission and AMLA material, to be taken into account when deciding to rely on an entity in a third country.
2. The five-working-day rule
Article 49 makes reliance operational rather than nominal. The relying entity must obtain all necessary information concerning those due diligence measures or the business being introduced, and must take all necessary steps to ensure the entity relied upon provides, on request:
- copies of the information collected to identify the customer;
- all supporting documents or trustworthy sources used to verify the identity of the client and, where relevant, of beneficial owners or persons on whose behalf the customer acts — including data obtained through electronic identification means and relevant trust services under Regulation (EU) No 910/2014;
- any information collected on the purpose and intended nature of the relationship.
That information must be provided without delay and in any case within five working days. An arrangement with no contractual mechanism capable of meeting that deadline is not a workable reliance arrangement.
3. Side by side
| Reliance (Articles 48–49) | Outsourcing (Article 18) | |
|---|---|---|
| Counterparty | Another obliged entity, supervised | Any service provider |
| What moves | Due diligence already performed on that customer | Performance of tasks on your behalf |
| Scope | Article 20(1)(a), (b) and (c) only | Tasks arising from the Regulation, minus the never-outsourceable list |
| Key limit | Ultimate responsibility stays with the relying entity | Six tasks may never be outsourced, including the customer risk profile and the onboarding decision |
| Timing duty | Information on request within five working days | Ex-ante notification to the supervisor before the provider starts |
AMLA is due to issue guidelines on reliance on other obliged entities by 10 July 2027 under Article 50, which is the date to watch for firms building group or introducer models now.
FAQ
Can we rely on a provider that is not an obliged entity?
No. Reliance is available only in respect of other obliged entities whose compliance is supervised consistently with Chapter IV of Directive (EU) 2024/1640. A non-obliged provider is an outsourcing question under Article 18.
Does reliance transfer responsibility?
No. Article 48(1) states that ultimate responsibility for meeting the customer due diligence requirements remains with the entity that relies.
How quickly must the underlying documents arrive?
Without delay and in any case within five working days of the request, under Article 49(3).
Related: AMLR outsourcing · The customer risk profile · EBA remote onboarding guidelines
