Outsourcing of compliance functions: what the decision maker looks at

When an obliged entity outsources a compliance function — screening, monitoring, or reporting — the decision maker checks four things before signing anything. Does accountability stay inside the organisation? Is the provider's access to source data auditable? Are escalation triggers defined in writing? Is there an exit route that works before the arrangement goes live? Nothing else moves the approval forward.

What changes once a function moves outside the organisation

Moving a function to a provider does not move responsibility. The management body stays accountable for the compliance outcome, even where the day-to-day screening runs on a third party's system. What changes is the distance between the decision and the evidence: every escalation now passes through an extra layer, and a delay in that layer becomes the organisation's delay, not the provider's.

The risk decision makers most often underweight is continuity of service. The same structural question is examined When the licensor stops maintaining the right: what happens when the party you depend on stops delivering, and who decides the next step. A compliance outsourcing arrangement needs that answer before signature, not after the first missed alert.

Stages at a glance

What to do before signing anything

1. Map the candidate functions and rank them by AML weight, before any provider search starts. This is the compliance officer's task, not procurement's.
2. List every piece of source data the provider will touch, and lock down access logging from day one. IT and the compliance officer do this together.
3. Set escalation triggers with clear thresholds and named recipients on both sides, not a general promise to "flag anything unusual".
4. Request security and access terms before signing, not after. The same gap causes disputes When a security addendum arrives with the order form, where terms attached late change the deal without a matching negotiation.
5. Submit the arrangement for senior management approval, with a written record of the four checks above attached to the file.
6. Notify the supervisor where the outsourcing is material to AML controls, and keep the notification on file with a date stamp.

Who decides, and on what timeline

Approval sits with senior management, or with the management body where the entity's own governance requires it. Outsourcing does not lower that threshold — it raises it, because the entity now has to show oversight of a party it does not control. Where a supervisor has already opened a governance review, the timing question sharpens: the pattern is the one covered A supervisor asks about governance authorisation the deadline that, where the clock starts from the supervisor's request rather than from the entity's own planning cycle.

In practice, expect senior management sign-off within one internal cycle — the next scheduled board or management meeting. A supervisory response, where notification applies, follows the period the supervisor sets in its own request, not a fixed internal deadline.

Three forks in the decision

If the outsourced function is transaction monitoring or screening tied directly to reporting duties, oversight has to be continuous. A quarterly check is not oversight; it is a retrospective note.

If the provider sits outside the EU or the EEA, data access, audit rights and onward transfer need separate contractual treatment. A supervisor cannot inspect what it cannot reach.

If new information about the provider's capability surfaces after the arrangement is already running — a control gap, a missed alert, a change of ownership — the same sequencing question applies as When prior art surfaces after grant: who reopens the decision, and what triggers the reopening rather than waiting for the next scheduled review.

Where this stops

This page does not draft the outsourcing agreement, and it does not set the specific escalation thresholds for a given function — those depend on the entity's own risk appetite and the provider's actual system. It does not replace a data protection assessment either; access to personal data by a provider is a separate check with its own criteria and its own sign-off.

Verified

This sequence reflects standard governance practice for outsourcing arrangements in AML-obliged entities, reviewed as at October 2025. It does not cite specific statutory provisions: the procedural steps described here apply regardless of the entity's exact regulatory regime, and the entity's own counsel should confirm any regime-specific notification duty before the arrangement goes live.

Related reading

The same governance test runs on the other side of the relationship. See Onboarding remediation step by step for the equivalent sequence when the gap sits inside onboarding rather than in an outsourced function.

If your organisation is weighing an outsourcing decision and wants a second read on the file before it goes to sign-off, we are glad to look at the specific arrangement rather than the general pattern.

FAQ

How long does outsourcing of compliance functions take in practice?

Internal approval usually takes one management cycle once due diligence is complete. Where a supervisor notification applies, add the period the supervisor sets in its own request; there is no universal fixed length.

Which documents are needed to start?

A mapped list of candidate functions with their AML weight, a provider due diligence file, draft contract terms covering access and exit, and the written record of the four decision-maker checks. Without these, senior management has nothing concrete to approve.

What happens if the other side does not respond?

If the provider does not confirm access terms or continuity commitments within the agreed window, the arrangement should not proceed to signature. Escalate to senior management and treat the silence as a due diligence finding, not a delay to work around.

— Aleks Vaher, AURELIS