Due Diligence

Third-Party Reliance

Third-party reliance is when a regulated firm uses customer due diligence (CDD) carried out by another regulated firm, instead of repeating it, under conditions set by anti-money laundering rules. The third party usually has its own relationship with the customer and applies its own procedures. The key point under FATF and in the Singapore, Hong Kong, UK, Cayman Islands and EU rules covered here is that the firm relying on the third party remains responsible if the CDD turns out to be deficient. The US provisions do not use that wording, so check them separately.

See Investor Onboarding Back to Glossary

Reliance reduces duplicated checks where a customer already deals with another regulated firm. A common fund example, in our view, is an investor introduced by a bank, broker or distributor that has already done its own CDD. FATF Recommendation 17 lets countries permit reliance for CDD elements (a) to (c) in Recommendation 10, or for introducing business, and the ultimate responsibility for CDD stays with the institution relying on the third party. Recommendation 10 lists ongoing due diligence separately as element (d), so it falls outside Recommendation 17. Singapore and Hong Kong expressly bar reliance on a third party for ongoing monitoring.

Third-party reliance compared with outsourcing

The Interpretive Note to Recommendation 17 draws this line, and MAS and the SFC repeat it. In our view it often decides which rulebook applies: an administrator running your KYC under your procedures is normally an outsourcing or agency arrangement, not reliance.

	Third-party reliance	Outsourcing or agency
Whose procedures?	The third party's own	Yours; the provider follows them
Relationship with the customer	The third party usually has its own, independent one	Not required; the provider applies the measures on your behalf
Your control	You assess the third party and obtain the information	You control effective implementation of the procedures
Fund example (our illustration)	A regulated distributor or bank that introduces an investor it already knows	An administrator or transfer agent running your KYC under your policy
Rule	The reliance rule of your regime	Outside the reliance rules under FATF (INR 17), MAS Guidelines 9-1 and SFC 4.15.2. UK reg 39(7) allows agents and outsourcing providers if the firm remains liable. Check your outsourcing and delegation rules

Reliance rules by regime

The table summarises the main conditions; check the full text before using a route. These rules set conditions on the reliance itself, and in our view the relying firm still needs to assess its customer risk.

Regime	Who may be relied on	Key conditions	Responsibility
FATF Recommendation 17	Financial institutions or DNFBPs that are supervised or monitored, if the country permits reliance	Immediately obtain the information on CDD elements (a) to (c); copies available on request without delay; satisfied on regulation and measures; countries have regard to country risk	Stays with the relying institution
Singapore: MAS Notice SFA04-N02, para 9	Appendix 2 institutions, FATF-standard supervised institutions and related corporations, with exclusions for certain payment and token licensees (9.1)	Satisfied on supervision and measures; country risk understood; not precluded by MAS; data provided without delay (9.2). Document the basis, except for Appendix 2 institutions, and immediately obtain the CDD information (9.4)	The capital markets intermediary (CMI) remains responsible (9.5). No reliance for ongoing monitoring (9.3)
Hong Kong: SFC Guideline 4.15; AMLO Sch 2 s.18	Specified domestic intermediaries (4.15.8), overseas intermediaries in equivalent jurisdictions (4.15.10) and related foreign financial institutions (4.15.12)	Written confirmation that it agrees to act and which CDD part it performs; documents on request without delay (4.15.3); obtain the data immediately (4.15.4); undertakings on retention (4.15.5); sample tests (4.15.6)	Ultimate responsibility stays with the FI (4.15.1). No reliance for continuous monitoring (footnote 57)
United Kingdom: MLR 2017, reg 39	Another relevant person; a third-country person under equivalent requirements and supervision; organisations of those persons	Immediately obtain the information; arrangements for copies immediately on request and for retention. No reliance on a third party established in a "FATF call for action country" (39(4), wording in force from 30 June 2026), except qualifying group branches and majority-owned subsidiaries (39(5))	Relevant person remains liable (39(1))
Cayman Islands: AMLRs (2025 Revision), reg 25	An introducer in a reg 22(1)(d) category (25(1)), which must confirm it is supervised or monitored and has measures in place (25(1)(da))	Written assurance confirming identity, nature and purpose, verification, source of funds, supervision and measures, and copies on request without delay. Relieves verification of identity only	Relying person is liable for the introducer's failure to obtain, record or produce the documentation; ultimate responsibility remains with it (25(2), (3))
EU from 10 July 2027 (most obliged entities): Regulation (EU) 2024/1624, Arts 48, 49	Other obliged entities, in a Member State or third country, under equivalent rules and supervision	Information without delay and in any case within 5 working days; written agreement; no reliance on entities in identified third countries, with a group exception	Ultimate responsibility stays with the relying entity (48(1))
United States: 31 CFR 1010.230(j); 1023.220(a)(6)	Another financial institution, including an affiliate, subject to an AML program rule and regulated by a Federal functional regulator	The customer also has an account or similar relationship with that institution; reliance reasonable under the circumstances; contract requiring annual certification of its AML program and performance of the specified requirements. These paragraphs cover covered financial institutions' beneficial-ownership duties and broker-dealers' CIP duties	These paragraphs set conditions and do not state that responsibility stays with the relying firm; check each rule and take advice. Investment advisers: see below

US investment advisers. FinCEN's adviser rule (89 FR 72156) takes effect on 1 January 2028 (91 FR 36). Its preamble notes that the separate proposed customer identification rule for advisers included a provision permitting advisers to rely on other financial institutions to perform CIP, subject to conditions. That proposal is not a final reliance rule, so advisers should check its status before planning around it.

Other uses of the word. Reliance is different from simplified due diligence on a regulated investor, or a nominee's written assurance, even though they can look similar on file. Our guide to KYC for fund of funds and nominee investors sets out those routes.

What fund compliance teams should do

1. Classify each arrangement. For each distributor, introducer, administrator and transfer agent, record whether it is reliance, outsourcing, or the provider's own obligation. Our article on fund administrator AML responsibilities covers the division of duties.

2. Test eligibility from a primary source. Check the third party's licence and regulator, and record how you assessed the country. MAS Guidelines 9-4 list options such as mutual evaluation reports and professional advice.

3. Get the paperwork right. Use the wording your regime requires: for example, a written confirmation in Hong Kong, a written assurance in the Cayman Islands, and arrangements for copies in the UK.

4. Collect the information at the start. FATF, Singapore, Hong Kong and the UK require you to obtain the CDD information immediately, and the EU sets an outer limit of 5 working days. Access to it later is not enough under those rules. Add it to the investor file with your know-your-investor record.

5. Test the arrangement. Ask for copies of underlying documents on a sample basis, as SFC 4.15.6 suggests, and record the results. If the third party is slow or cannot produce them, reconsider the route.

6. Keep responsibility for monitoring. You may be able to outsource tasks such as first-level alert review (MAS Guidelines 9-7), but in our view responsibility for screening refreshes, transaction monitoring and suspicious activity decisions stays with you. See the LP onboarding checklist for how this fits in.

Key points

Reliance lets a regulated firm use another regulated firm's CDD, under conditions set by its AML rules
Under FATF and the Singapore, Hong Kong, UK, Cayman Islands and EU rules covered here, responsibility stays with the firm relying on the third party
FATF limits it to CDD elements (a) to (c) or introducing business, and Singapore and Hong Kong expressly exclude ongoing monitoring
Outsourcing is different: there, the provider follows your procedures under your control

How One Constellation helps

One Constellation gives fund managers, administrators and transfer agents an investor onboarding portal that holds identity verification, KYB and beneficial-owner records, sanctions, PEP and adverse-media screening, and case management with STR and SAR workflows. Teams can continue screening and transaction monitoring after onboarding.

Explore Investor Onboarding

Frequently asked

What is third-party reliance in AML?+

It is an arrangement in which a regulated firm uses customer due diligence carried out by another regulated firm instead of repeating it, under conditions in its AML rules. The third party usually has its own relationship with the customer and uses its own procedures. Under FATF and most of the rules covered here, the firm relying on it remains responsible.

What does FATF Recommendation 17 say?+

It says countries may permit financial institutions to rely on third parties for elements (a) to (c) of the CDD measures in Recommendation 10 or to introduce business. The institution should immediately obtain the necessary information, satisfy itself that copies will be available without delay, and satisfy itself that the third party is regulated, supervised or monitored and has measures in place. Countries should have regard to country risk when deciding where the third party can be based. Ultimate responsibility remains with the relying institution.

What is the difference between reliance and outsourcing?+

In reliance, the third party applies its own procedures and usually has its own relationship with the customer. In outsourcing or agency, the provider applies your procedures on your behalf, subject to your control. FATF, MAS and the SFC all treat outsourcing as outside their reliance rules.

Can a firm rely on a third party for ongoing monitoring?+

Not under the texts covered here: MAS Notice SFA04-N02 paragraph 9.3 (capital markets intermediaries) and footnote 57 of the SFC Guideline (licensed corporations and SFC-licensed VASPs) both exclude it. FATF Recommendation 17 covers CDD elements (a) to (c) or introducing business, and ongoing due diligence is element (d). A firm can outsource monitoring tasks where its rules allow, but that is a different arrangement.

Is a fund administrator a third party for reliance?+

It depends on the facts. An administrator running KYC under the fund's or manager's procedures is, in our view, usually an outsourcing or delegation arrangement. Where it applies its own procedures, the analysis may differ, and it may have its own obligations. Record the classification, and take advice for your structure.

Sources

This entry is general information, not legal advice. Check the current text with the regulator before relying on it. Sources read on 6 November 2026.

Keep Your Onboarding Evidence Together

Bring identity verification, KYB, screening and monitoring together in an investor onboarding portal built for fund managers, administrators and transfer agents.

Book a Demo Explore Investor Onboarding