Outsourcing Your AML/CTF Obligations

Reporting entities may choose to outsource functions to assist in their compliance with the AML/CTF Act. While outsourcing can assist reporting entities by providing access to expert support for their AML/CTF obligations and help streamline compliance processes, it can also potentially create:

• compliance risks – where inadequate due diligence, implementation, or oversight of outsourcing agreements could cause you to fail to meet your AML/CTF obligations; and/or
• Money Laundering and Terrorism Financing ("ML/TF") risks – where your company has additional vulnerabilities as a result of outsourcing a particular function, that criminals could exploit.

Who is responsible for compliance?

Outsourcing comes with its own set of compliance requirements. Reporting entities are ultimately responsible for compliance with the AML/CTF Act and liable for any breaches and penalties arising from such breaches, even where an outsourcing agreement is in place. This means that you should ensure any service provider you engage complies with the same AML/CTF obligations that apply to the reporting entity. You cannot "outsource" your legal responsibility.

What should reporting entities do when outsourcing?

1. Identify the Outsourcing Risks

Reporting entities should consider whether the proposed outsourcing is in line with the approved risk tolerance of the business. Without any identification of the outsourcing risks, reporting entities and the service provider cannot put in place processes to control those risks. Reporting entities should work with service providers to:

• tailor the services to the reporting entity's identified ML/TF risks;
• ensure the service provider has the appropriate expertise and resources to carry out the relevant function;
• understand and adhere to the legal restrictions on information sharing under the AML/CTF Act; and
• ensure the service provider is subject to adequate oversight and monitoring by the reporting entity.

2. Conduct thorough Due Diligence

Reporting entities should carry out due diligence on any external providers prior to entering into an outsourcing arrangement.

AUSTRAC encourages reporting entities to consider the following criteria to ensure a service provider is a good fit and capable of upholding the necessary compliance standards:

• qualifications or expertise that are relevant to AML/CTF and the industry in which the reporting entity operates;
• experience providing AML/CTF services to businesses of a similar nature, size and complexity;
• willingness to agree to performance monitoring by the reporting entity;
• a demonstration of their services;

• an explanation of how the service provider will tailor the services to suit the reporting entity's business, but particularly the ML/TF risks faced by the reporting entity;
• references or reviews from similar businesses that have engaged the service provider;
• whether the service provider develops their product after consulting the reporting entity about the customers, designated services, delivery methods and jurisdictions dealt with.

3. Understand restrictions on sharing information with outsourced service providers

Certain information cannot be shared with service providers, regardless of the services they provide. Reporting entities must not share information in relation to:

• Suspicious Matter Reports ("SMR") and information which is requested by AUSTRAC in relation to a SMR, also known as 'tipping off'; and
• 'AUSTRAC information' provided to you by AUSTRAC staff.

This information should be carefully compartmentalised to only those employees of the reporting entity who require access to it. There are limited exceptions to the tipping off provisions, including in relation to obtaining legal advice. Read more about these here.

Reporting entities should seek legal advice before entering any outsourcing agreement, especially if it may involve SMR reporting obligations, AUSTRAC related information, or notices issued under sections 49 or 49B of the AML/CTF Act which relate to AUSTRAC's information gathering powers.

Reporting entities should also ensure any outsourcing agreements adhere to the restrictions in relation to information sharing in the AML/CTF Act, the Privacy Act 1988 (Cth) and any other applicable legislation.

4. Ensure a written agreement is in place

AUSTRAC advises reporting entities to ensure outsourcing arrangements are properly documented in a legally binding agreement. The agreement should adequately define the service provider's obligations to help ensure your service provider is able to fulfil the relevant AML/CTF obligations on your behalf.

At a minimum, AUSTRAC expects outsourcing agreements to:

• describe the services and performance goals the service provider must fulfil to perform the relevant AML/CTF functions on your behalf;
• include oversight mechanisms to ensure the service provider is delivering the agreed services; and
• contain mechanisms to deal with the risk of the relevant AML/CTF functions are not performed adequately by the service provider.

For ongoing outsourcing agreements, reporting entities should ensure there is substantial oversight, monitoring and review standards such as:

• develop performance goals a reporting entity wishes to achieve by the outsourced services provider, include quality, timeliness, and any additional standards that are appropriate;
• have appropriate oversight clauses in the outsource agreement to assess outsourced services provider is meeting your AML/CTF obligation;
• have range of options in the outsource agreement, enable you to respond to any breaches of the agreement in a measured and risk-aware manner;
• regular reporting by the service provider on the agreed performance targets;
• a maximum number of breaches permitted before a review of the outsourcing agreement is initiated by the reporting entity;
• maximum timeframes to implement changes to the agreement where the reporting entity's ML/TF risks change;
• record-keeping targets that align with the reporting entity's record-keeping obligations.

5. Review outsourcing arrangements

Ongoing outsourcing agreements, should be regularly reviewed by senior managers of a reporting entity. A reporting entity can take the following steps as part of a review:

• verify that the service provider is meeting its performance goals under the agreement and providing the service it is contracted to provide;
• confirm that the outsourcing agreement has the effect of helping the reporting entity to meet its AML/CTF obligations;
• adjust the agreement in light of any changes to the ML/TF risks the reporting entity faces.

6. Document procedures for managing outsourcing arrangements in the AML/CTF program

A reporting entity's AML/CTF Program should include the procedures for managing outsourced arrangements, including:

• the AML/CTF risks the reporting entity has identified which arise from outsourcing arrangements;
• the due diligence that will be carried out on service providers;
• who is responsible for evaluating whether a service delivered meets the reporting entity's requirements;
• how the reporting entity will monitor and review ongoing outsourcing agreements and who is responsible for actioning any findings;

• who is responsible for receiving reports from service providers and actioning any breaches or incidents; and
• how the reporting entity will resolve non-compliance with outsourcing agreements.

If you need further guidance on outsourcing and how to comply with your AML/CTF obligations, don't hesitate to reach out us here.

Further reading

Using Outsourcing to Help Meet Your AML/CTF Obligations

Transaction Monitoring

Independent Reviews of AML/CTF Program

Reliance on Customer Identification Procedures by a Third Party

Your Record-Keeping Obligations

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.