Recital 48

The possibility to outsource tasks to a service provider allows obliged entities to decide on how to allocate their resources to comply with this Regulation, but does not relieve them of their obligation to understand whether the measures they undertake, including those outsourced to service providers, mitigate the money laundering and terrorist financing risks identified, and whether such measures are appropriate. In order to ensure that such understanding is in place, the final decisions on measures that have a bearing on the implementation of policies, procedures and controls should always rest with the obliged entity.