AML/CFTR 2.1.7 Application of AML/CFT Law requirements, policies etc to outsourced functions and activities

(1) This rule applies if a firm outsources any of its functions or activities to a third party.

Note See also rule 2.1.3 (2) (d) and (e) (Matters to be covered by policies etc) for other requirements relating to outsourcing.
(2) The firm, and its senior management, remain responsible for ensuring that the AML/CFT Law and these rules are complied with.
(3) The firm must, through a service level agreement or otherwise, ensure that the third party, and the officers, employees, agents and contractors of the third party, wherever they are, comply with the following in relation to the outsourcing:
(a) the requirements of the AML/CFT Law and these rules;
(b) the firm's AML/CFT policies, procedures, systems and controls;
except so far as the law of another jurisdiction prevents this subrule from applying.
(4) Without limiting subrule (3), the firm's AML/CFT policies, procedures, systems and controls:
(a) must require the third party, and the officers, employees, agents and contractors of the third party, wherever they are, to provide suspicious transaction reports for transactions in, from or to this jurisdiction involving the firm (or the third party on its behalf) to the firm's MLRO; and
(b) must provide timely, unrestricted access by the firm's senior management and MLRO, and by the Regulator and FIU, to documents and information of the third party, wherever they are held, that relate directly or indirectly to the firm's customers or accounts or to transactions in, from or to this jurisdiction involving the firm (or the third party on its behalf);
except so far as the law of another jurisdiction prevents this subrule from applying.
(5) Subrule (4) (a) does not prevent a suspicious transaction report also being made in another jurisdiction for a transaction in, from or to this jurisdiction.
(6) If the law of another jurisdiction prevents a provision of this rule from applying to the third party or any of its officers, employees, agents or contractors:
(a) the third party must immediately tell the firm about the matter; and
(b) the firm must immediately tell the Regulator about the matter.
(7) If the firm is an authorised firm, this rule is in addition to any other provision of the Regulator's Rules about outsourcing.
Derived by QFCRA RM/2019-8 (as from 1st February 2020)