The statement another provider does our AML can describe several different arrangements. Staff may operate software themselves, a contractor may perform an AML function on the firm's behalf, or the firm may seek to rely on CDD completed elsewhere. Identify the arrangement before deciding what agreement, assessment and oversight are needed. A supplier's marketing label does not allocate the practice's legal responsibilities.
Describe who actually does each task
Map information collection, verification, risk assessment, investigation, reporting and record storage separately. Record who makes the decision, which system holds the evidence and whether work is performed under the practice's instructions or another entity's own procedures. One supplier can support more than one arrangement. A hosted application used by your staff is not automatically the same thing as outsourcing the decision to a separate service team.
Select the correct legal and operational assessment
AUSTRAC's outsourcing guidance expressly separates outsourcing from RegTech use and third-party customer-identification reliance. For an outsourced function, assess capability, relevant risks and oversight. For reliance, examine the particular legal conditions and information-access requirements. Do not infer either arrangement from receiving a completed form. Set out which steps the practice still performs, including any customer-risk, enhanced-CDD or monitoring work that the supplier's delivery does not resolve.
Write an agreement that can be tested
A useful operational schedule names the functions, expected records, response times, restrictions, escalation contacts and process for handling errors. Include what happens if records cannot be retrieved, the supplier changes subcontractors or the arrangement ends. Match access and privacy controls to the actual information shared. Test a sample evidence request before depending on the arrangement; a promise of audit readiness is less useful than proof the right record can be obtained.
Review delivery against your own risk profile
For example, a supplier may support straightforward individuals but struggle with layered trust structures used by your practice. Check the relevant cases rather than assuming a high overall completion rate covers them. Track missing information, incorrect decisions, delayed records and unresolved findings. Assign remediation and follow it through. Keep the arrangement and review conclusions in the program's governance records, with approval of changes where the applicable requirements call for it.
Official sources
Confirm the current rules against these primary sources, last checked .
Questions
Does using software transfer legal responsibility?
No. Understand the service and decisions it supports, and maintain the controls and responsibilities that apply to your reporting entity.
Is a shared identity report automatically lawful reliance?
No. Assess the applicable reliance conditions, provider suitability and access to relevant KYC and verification information.
Can one supplier cover every customer type?
Only if its actual capability and your arrangements support those cases. Review limitations instead of assuming a standard report resolves every structure.
General information for Australian professionals, not legal advice. It does not replace the AML/CTF Act, the Rules or AUSTRAC guidance. See our editorial standards.
Keep reading
- Reliance agreements4 min
When Australian reporting entities can rely on another entity's customer identification, what a reliance arrangement requires and what each party still owns.
- Outsourced formation and responsibility3 min
Document what the accounting practice and formation provider each do, separating designated-service scope from outsourced AML functions and CDD reliance.
- Provider outages and manual work3 min
Separate technical failure from an adverse customer result, control the service boundary and use an alternative verification method only where permitted.