Article 18 › 3

The tasks outsourced pursuant to paragraph 1 of this Article shall not be undertaken in such a way as to impair materially the quality of the obliged entity’s policies and procedures to comply with the requirements of this Regulation and of Regulation (EU) 2023/1113, and of the controls in place to test those policies and procedures. The following tasks shall not be outsourced under any circumstances: (a) the proposal and approval of the obliged entity’s business-wide risk assessment pursuant to Article 10(2); (b) the approval of the obliged entity’s internal policies, procedures and controls pursuant to Article 9; (c) decision on the risk profile to be attributed to the customer; (d) the decision to enter into a business relationship or carry out an occasional transaction with a client; (e) the reporting to FIU of suspicious activities pursuant to Article 69 or threshold-based reports pursuant to Article 74 and 80, except where such activities are outsourced to another obliged entity belonging to the same group and established in the same Member State; (f) the approval of the criteria for the detection of suspicious or unusual transactions and activities.

← 2 · All articles · 4 →

Source: EUR-Lex CELLAR · retrieved 2026-09-04