Recital 47

Obliged entities might outsource tasks relating to the performance of certain AML/CFT requirements to a service provider. In the case of outsourcing relationships on a contractual basis between obliged entities and service providers not covered by AML/CFT requirements, any AML/CFT obligations upon those service providers arise only from the contract between the parties and not from this Regulation. Therefore, the responsibility for complying with AML/CFT requirements should remain entirely with the obliged entity. The obliged entity should in particular ensure that, where a service provider is involved for the purposes of remote customer identification, the risk-based approach is respected. Processes or arrangements that contribute to the performance of a requirement under this Regulation, but where the performance of the requirement itself is not carried out by a service provider, such as the use or acquisition of third-party software or the access to databases or screening services by the obliged entity, are not considered to be outsourcing.