art_18__para_3

3. The tasks outsourced pursuant to paragraph 1 of this Article shall not be undertaken in such a way as to impair materially the quality of the obliged entity’s policies and procedures to comply with the requirements of this Regulation and of Regulation (EU) 2023/1113, and of the controls in place to test those policies and procedures. The following tasks shall not be outsourced under any circumstances: the proposal and approval of the obliged entity’s business-wide risk assessment pursuant to Article 10(2); the approval of the obliged entity’s internal policies, procedures and controls pursuant to Article 9; decision on the risk profile to be attributed to the customer; the decision to enter into a business relationship or carry out an occasional transaction with a client; the reporting to FIU of suspicious activities pursuant to Article 69 or threshold-based reports pursuant to Article 74 and 80, except where such activities are outsourced to another obliged entity belonging to the same group and established in the same Member State; the approval of the criteria for the detection of suspicious or unusual transactions and activities.

← art_18__para_2__para__2 · All articles · (a) →

Source: EUR-Lex CELLAR · retrieved 2026-09-04 · Text as adopted (Official Journal); later amendments are not incorporated in this text.