AML outsourcing, for a fund, means having a fund administrator, transfer agent or specialist provider carry out investor due diligence and other parts of the AML program on the manager's behalf. Every major regime allows it, and every one keeps the manager responsible: FinCEN lets an adviser delegate "some or all aspects" of its program but leaves it "fully responsible and legally liable"; under UK rules the firm still answers for any measure left unapplied, whoever was doing the work; the EU AML Regulation makes the firm "fully liable" for outsourced tasks and, from 10 July 2027, forbids outsourcing the decision to accept a customer. Delegation changes who does the work, not who answers for it, so a manager needs its own view of every file. Botminds' Investor KYC/AML Onboarding is built for asset managers, private markets firms and fund administrators alike: whoever runs the file, each fact, screening decision and approval carries its evidence and its decider.
The examples come from Quillfield Capital, a fictional firm in the solution's sample data. The rules are quoted from the eCFR, FinCEN's final adviser rule, UK legislation and EU law.
Reliance and outsourcing are different tools, and each regime treats them differently
Relying on another regulated firm’s checks: Allowed if reasonable, the other firm has its own AML program rule and federal functional regulator, and it certifies every year by contract (1024.220(a)(6); 1010.230(j)).
Outsourcing the work to a service provider: A transfer agent or administrator works as the fund’s agent; the fund stays responsible for the program its board approved.
Relying on another regulated firm’s checks: The 2024 rule has no reliance clause of its own; the identification rule that would carry one is still a proposal.
Outsourcing the work to a service provider: Delegation of some or all of the program, including to a fund administrator, with the adviser fully responsible and able to demonstrate compliance.
Relying on another regulated firm’s checks: Reliance on a regulated third party for customer due diligence (reg. 39(1)–(6)): obtain the information immediately; arrange to get copies immediately on request.
Outsourcing the work to a service provider: An agent or outsourcing provider, under arrangements that keep the firm liable for any failure (reg. 39(7)).
Relying on another regulated firm’s checks: Reliance on another obliged entity for identification, beneficial owners and purpose of the relationship; ultimate responsibility stays with the relying firm (Art. 48).
Outsourcing the work to a service provider: Outsourcing to a service provider, notified to the supervisor first; the firm stays fully liable and six decisions may not be outsourced (Art. 18).
Can a fund outsource AML?
Yes, the work, and no, the responsibility. A US adviser may, under FinCEN's 2024 rule, "delegate contractually the implementation and operation of some or all aspects of its AML/CFT program to a third-party provider, including a fund administrator," but it "will remain fully responsible and legally liable for, and be required to demonstrate to examiners, the program's compliance" and must make sure FinCEN and the SEC can obtain the program's information and records (89 FR 72156). FinCEN added no rule text for this, because institutions already delegate routinely.
Outsourcing is common for a reason. Treasury describes fund administrators handling subscriptions and redemptions and, often, investor due diligence for the fund; it names the Cayman Islands and Ireland as popular places for the work. The same report lists "the outsourcing of key compliance responsibilities" among the business practices that raise illicit-finance risk in the sector (Treasury, 2024 Investment Adviser Risk Assessment). Both statements are true at once: outsourcing is efficient, and it is where accountability goes missing.
Why so much investor due diligence happens offshore, at someone else's desk
47%
of private funds advised by RIAs are domiciled outside the United States
32%
are Cayman Islands funds
5%
are Irish
4%
are Luxembourg funds
What cannot be outsourced under the EU AML Regulation?
Six decisions, listed in Article 18(3), may not be outsourced "under any circumstances" once the Regulation applies on 10 July 2027. Two of them sit inside every investor file: the decision on the customer's risk profile and the decision to enter into the relationship. An EU manager can have its administrator collect, read, verify, screen and draft; it cannot have the administrator decide (Regulation (EU) 2024/1624, Art. 18(3)).
Six AML decisions an EU fund manager keeps in-house from 10 July 2027
- (a)Proposing and approving the business-wide risk assessment
- (b)Approving the internal policies, procedures and controls
- (c)Deciding the risk profile attributed to the customer
- (d)Deciding to enter into a business relationship or carry out an occasional transaction
- (e)Reporting suspicious activity to the financial intelligence unit, except to a group entity in the same member state
- (f)Approving the criteria for detecting suspicious or unusual transactions
The rest of Article 18 reads like a checklist for the agreement. The firm must notify its supervisor before the provider starts; treat the provider's work as its own; be able to "demonstrate to the supervisor that it understands the rationale behind the activities carried out by the service provider and the approach followed in their implementation"; make sure the provider, and any sub-provider, applies the firm's own policies; set the terms in writing; and run regular controls on how the work is done.
Who is liable if the administrator misses something?
The fund manager, in every regime that applies to it. UK regulation 39 is the plainest: a firm that relies on a third party for customer due diligence stays liable for any failure, and where it outsources instead, the arrangements must "provide for the relevant person to remain liable for any failure to apply such measures" (MLR 2017, reg. 39(1), (7)). The EU Regulation says the firm "shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks."
The administrator may also be liable, under its own home law or its contract, but that is a second claim, not a substitute. A regulator examining the manager will ask the manager what it knew. The answer "the administrator did it" works only if the manager can show what the administrator did, on which evidence, and when the manager saw it.
Three dates that change how fund administrator AML agreements should read
- Today’s UK rules and national EU rules, until the AMLR applies on 10 Jul 20278 mo
- AMLR Article 18 in force; the US adviser rule starts on 1 Jan 20286 mo
What is an AML reliance letter?
It is a letter in which a regulated firm, often an administrator, distributor or nominee, confirms to a fund that it has carried out customer due diligence on the investors it introduces or holds for, and undertakes to provide the documents on request. It is a market instrument, not a legal one: none of the rules on this page defines it, and on its own it rarely meets the rules it is meant to satisfy.
The US rules ask for more than a letter. A mutual fund's reliance needs the other firm to be subject to an AML program rule and a federal functional regulator, and "a contract requiring it to certify annually" that it has implemented its program and will perform the fund's specified procedures (31 CFR 1024.220(a)(6)). The UK rules ask for the substance: the relying firm "must immediately obtain from the third party all the information needed" for the customer and its beneficial owners, and must have arrangements that let it obtain copies of the identification documents "immediately on request" (reg. 39(2)).
So a letter that says "we have done KYC on the investors listed" proves very little by itself. A letter that comes with each investor's identifying data and beneficial owners, a named contact, a retention commitment and the right to copies on request, under a contract with an annual certification, is the thing the rules describe. A manager receiving only the first kind should treat the investors behind it as unverified.
How is UK reliance different from US delegation?
Reliance is about whose checks count; delegation is about who does yours. UK reliance lets a firm accept a regulated third party's customer due diligence as its own, subject to getting the information at once; US delegation, as FinCEN describes it for advisers, has the provider run the adviser's own program. The liability lands in the same place, but the evidence each requires is different.
What the manager must hold under each route
| Route | What the manager must hold itself | What it may leave with the other firm |
|---|---|---|
| UK reliance (reg. 39(1)–(6)) | All the information needed to identify the customer and its beneficial owners, obtained immediately | Copies of the documents, if they can be obtained immediately on request and are kept for the record-keeping period |
| UK outsourcing (reg. 39(7)) | Arrangements that keep it liable; in practice, oversight of how the agent applies the firm’s measures | The work itself, done to the firm’s standards |
| US mutual fund reliance (1024.220(a)(6)) | A contract with an annual certification; a judgment that the reliance is reasonable | The specified identification procedures, performed by a regulated institution |
| US adviser delegation (2028 rule) | Enough to demonstrate the program’s compliance to examiners, and access for FinCEN and the SEC to information and records | Implementation and operation of some or all of the program |
| EU outsourcing (Art. 18) | Understanding of the provider’s approach, regular controls, and the six reserved decisions | Every other task, under a written agreement, notified to the supervisor |
A UK reliance arrangement is also bounded by geography. A firm may not rely on a third party established in a country on the FATF's call-for-action list, a test the 2026 amendments wrote into regulation 39(4). An administrator in a jurisdiction that later lands on that list stops being a permissible third party the day it does.
What should an AML outsourcing agreement say?
It should make the manager's oversight possible, not just promise that the work will be done. The clauses below follow what the texts require; a firm's counsel will add the rest.
Twelve clauses an investor AML outsourcing agreement should contain
- Scope, task by task
Which steps the administrator performs: collection, verification, beneficial owners, screening, risk scoring, refresh. Write each one down.
- The manager’s policies apply
The administrator follows the manager’s risk model, thresholds and document rules, not its own defaults; the EU Regulation requires it, including for sub-providers.
- Decisions reserved to the manager
Risk profile, acceptance, high-risk and PEP approvals, true sanctions matches and suspicious activity reports stay with the manager’s officer.
- Escalation triggers and timing
What goes to the manager, by when: high risk, PEPs, true matches, unexplained owners, register discrepancies.
- Information at once, copies on request
Identifying data and owners delivered with each file; documents produced immediately on request, as UK regulation 39 requires for reliance.
- Regulators’ access
FinCEN, the SEC or the competent EU or UK supervisor can obtain information and records through the manager.
- Retention
At least five years after the relationship ends, and the right to take the files on exit.
- Evidence per decision
For every conclusion, the document and page it rests on and the person who made it, in a form the manager can read without the administrator’s system.
- Testing rights
The manager may re-perform any file, sample files on a schedule, and see the results of the administrator’s own quality checks.
- Annual certification
Where US reliance is used, the contract requires a yearly certification of the program and of performing the specified procedures.
- Sub-outsourcing
No onward outsourcing without consent; the same terms flow down.
- Change and exit
Notice of changes to the administrator’s own program, and an orderly hand-back of every file and its evidence.
How do you test the administrator's AML work?
By re-performing files, not by reading the administrator's policy. A useful programme takes every high-risk file and a random sample of the rest each quarter, re-reads each against its source documents, and counts three things: facts that differ from the document, decisions without a recorded reason, and files that reached the manager late. No regulator or independent study publishes a pass rate to compare against, so the manager's own trend over four quarters is the measure.
Two habits make the test honest. The re-performer must not be the person who prepared the file, the same separation the manager's own procedures need. And the sample must include the files the administrator rated low and closed fast, because that is where an outsourced process saves the most time and hides the most error. In the sample firm's settings, one in twenty low-score screening discounts goes to a second reviewer, for exactly that reason.
One investor file as a thread: each agent's step, its source and what it asked a person to decide
AML outsourcing services, in-house software, or both?
The choice is less either-or than it looks. Many managers outsource the administration of the fund and keep the risk decisions, and the real question is what the manager can see. A provider whose files reach the manager as a PDF memo leaves the manager signing a summary; a shared file in which each fact links to its page lets the manager re-perform any of it in minutes.
Vendors and administrators do not publish their prices for investor due diligence, and no regulator publishes what a KYC file costs, so a manager has to price it on its own volumes. Count last year's new investors by risk band, the hours an analyst and reviewer spend on each band today, and the manager-side hours spent overseeing the provider. Outsourcing moves the first two to the provider's invoice; the third remains, and in the EU from 2027 it cannot fall to zero.
The manager's own rules, applied by whoever runs the file
Investor KYC/AML Onboarding fits on either side of the contract. A manager can run it in-house and keep its administrator for fund accounting; an administrator can run it for many managers, each with its own risk model and thresholds; or both can work in the same file, with the administrator's analysts preparing and confirming and the manager's MLRO deciding. It does not take on the manager's liability, and it will not decide a risk profile or accept an investor: those stay with named people, which is what Article 18 requires. The MLRO function at a fund covers who that person is in each regime, and 12 questions to ask investor AML software turns the oversight duty into buying questions. To see a file end to end, start from Investor KYC/AML Onboarding.
Questions people ask
Can a UK firm rely on a fund administrator's KYC?
Yes, if the administrator is a relevant person under the UK regulations or an equivalent regulated and supervised firm abroad, and not established in a FATF call-for-action country. The relying firm must immediately obtain all the information it needs about the customer and beneficial owners, must be able to get copies immediately on request, and remains liable for any failure.
Does outsourcing AML need regulator approval?
Under the EU AML Regulation from 10 July 2027, the supervisor must be notified before the provider starts the task; notification, not approval. UK and US firms should also check their regulators' general outsourcing rules, and in every regime the firm must be able to show supervisors and examiners how the outsourced work is done.
Can a fund administrator file a SAR for the fund?
Under the EU Regulation, reporting to the financial intelligence unit is one of the six tasks that may not be outsourced, except to another obliged entity in the same group and member state. In the US, a SAR may be filed jointly by institutions that share a transaction, but the obligation and its confidentiality stay with each institution.
Is a reliance letter enough for US beneficial ownership?
Not on its own. 31 CFR 1010.230(j) allows reliance only where it is reasonable, the other institution is subject to an AML program rule and a federal functional regulator, and a contract requires it to certify annually that it has implemented its program and will perform the specified requirements.
Can an adviser outsource its whole AML program from 2028?
FinCEN says an adviser may delegate the implementation and operation of some or all aspects of its program, including to a fund administrator. It remains fully responsible and legally liable, must be able to demonstrate compliance to examiners, and must ensure FinCEN and the SEC can obtain the program's information and records.