Outsourcing of compliance functions: stages and deadlines
Handing a compliance function to an external provider follows a fixed sequence: scoping the mandate, vetting the provider, signing the service agreement, transferring records, and running a supervised handover period before the client steps back. Each stage has a named owner inside the client organisation. The most common cause of later disputes is skipping the supervised handover and treating the transfer as instant.
What changes once compliance work moves outside the organisation
The client keeps legal responsibility for the compliance function even after work is delegated. Outsourcing changes who performs the daily tasks — screening, monitoring, filing — not who answers for the result. This is why the service agreement, not the provider's internal procedures, becomes the document a supervisor or auditor asks for first.
Deadlines in this process are set by the parties, not by a fixed statutory clock. A board resolution or an internal risk committee decision typically fixes the date by which scoping must close, the date the provider must demonstrate readiness, and the date the handover period ends. Building slack into each date matters more here than in processes governed by a statutory countdown, because there is no external date to fall back on if internal sign-off slips.
Who decides at each stage
The client's compliance officer or MLRO owns the scoping and the gap assessment. The board or an equivalent governing body approves the provider selection and signs the service agreement. The provider's own compliance lead owns the readiness demonstration before go-live. Once the handover period ends, the client's compliance officer resumes sign-off authority over the outsourced function, even though the day-to-day work stays with the provider.
| Stage | Owner | What fixes the deadline |
|---|---|---|
| Scoping and gap assessment | Compliance officer / MLRO | Internal risk committee sign-off |
| Provider due diligence | Compliance officer | Completion of the provider's audit trail review |
| Service agreement drafting | Legal and board | Board resolution date |
| Records handover | Outgoing team + provider | Agreed cut-off date in the service agreement |
| Supervised run-in | Compliance officer | Fixed run-in end date in the same agreement |
Documents to prepare before the first call
- Current policy set (KYC, monitoring, reporting) as actually applied, not the template version.
- List of open cases and unresolved alerts, with status.
- Record of prior supervisory findings, if any exist.
- Draft scope statement describing exactly which tasks move out and which stay in-house.
- Internal sign-off authority chart, so the provider knows who can approve exceptions.
The point of no return
Once records are physically transferred and the provider starts acting on live cases, reversing the arrangement stops being a formality. Rebuilding institutional knowledge in-house after a provider has run the function for months takes longer than the original handover did. Treat the records handover date as the last point where the arrangement can be unwound without material cost, not the contract signature date.
Where the timeline forks
If your business model changes while you are outsourcing compliance and also going through authorisation at the same time, the decision on how the two processes interact does not sit with the compliance officer alone — see The business model changes mid-application authorisation who decides a.
If a dispute surfaces during the outsourcing period that concerns licensing revenue rather than AML controls, the outsourced compliance function does not cover it and a separate track applies — see When royalties are underreported.
If a warning letter about a patent claim arrives during the same period, keep it on a separate track rather than routing it through the compliance provider — see When a warning letter arrives from a patent holder.
If the provider's own systems cannot be migrated because an exit clause in the underlying technology contract blocks it, that decision belongs to contract management, not to the compliance officer — see When a migration is blocked by an exit clause.
What this page does not decide
This page describes the internal sequence and the decision owners. It does not set a fixed number of days for any stage, because no external deadline applies to a contractual outsourcing arrangement of this kind. It also does not cover the selection criteria a supervisor applies when reviewing whether the outsourcing itself was adequate — that assessment depends on the specific supervisory relationship and sits outside a general procedure description.
Verified
This description reflects the outsourcing sequence we apply in current client work, reviewed in November 2025. No statutory deadline is cited because none applies to a purely contractual handover; where a specific supervisory question arises, it is addressed case by case with the relevant authority.
Related reading
For a comparable staged process on the client-facing side, see Onboarding remediation step by step.
Frequently asked questions
How long does outsourcing of compliance functions take in practice?
There is no fixed statutory duration. The parties set the timeline in the service agreement, and the practical length depends on how quickly the internal sign-off chain moves and how large the records handover is.
Which documents are needed to start?
The current policy set as actually applied, the list of open cases, any prior supervisory findings, a draft scope statement, and an internal sign-off authority chart. Missing any of these delays the provider's readiness demonstration.
What happens if the other side does not respond?
If the provider does not confirm readiness by the date fixed in the service agreement, the client's board or risk committee decides whether to extend the date, escalate within the provider organisation, or pause the handover before records transfer, since that transfer is the point past which reversal becomes costly.