Compliance as a service

A compliance service provider performs defined steps of the work that anti-money laundering and supervisory law assign to a regulated firm. Typical tasks are the identity check during onboarding, often by video identification or a photo of the ID document, and the screening of customers and payments against sanctions and PEP lists. Many providers also handle the first review of the alerts that a transaction monitoring system raises and close the obvious false positives.

Some providers act as the external money laundering officer of a small firm or prepare the reports that go to supervisors. Identification firms sell single checks through an API, while groups such as Ephelia run a compliance unit for onboarding, monitoring and reporting next to their licenses and core banking. A firm that licenses software and operates it with its own staff buys regtech, which is a different arrangement from handing over the work itself.

Section 6(7) of the German Anti-Money Laundering Act (GwG) allows an obliged entity to have its internal safeguards carried out by a third party under a contract, once it has notified the supervisor in advance. The safeguards listed in section 6(2) GwG include the internal policies and controls, the appointment of the money laundering officer and the training of staff. The supervisor can prohibit the arrangement when the provider offers no assurance of proper performance or when control by the firm or by the supervisor would suffer, and the responsibility remains with the firm.

Credit and financial services institutions follow the same pattern under section 25h(4) of the German Banking Act (KWG), where BaFin can order an outsourced safeguard back into the institution. For customer due diligence, section 17 GwG lets a firm rely on certain third parties or transfer the checks by contract, and the responsibility for the checks again stays with the firm. An external money laundering officer has to work in Germany, and the firm reports the appointment to the supervisor in advance, as section 7 GwG requires.

German banks have two compliance roles that are easy to confuse: the money laundering officer under the GwG and the compliance function under MaRisk, which watches over the other legal and regulatory duties of the bank. The BaFin circular on minimum requirements for risk management counts the compliance function among its special functions, and its module AT 9 sets stricter standards for outsourcing them.

A complete outsourcing of the compliance function is allowed only for a subsidiary in a banking group that is not significant for the national financial sector or within the group, and for small institutions where a function of their own would not fit their size and business. Other banks may outsource parts of it, as long as they keep the knowledge to monitor the provider and could continue the work if the contract ends. The management tasks of the board cannot be outsourced at all, and the outsourcing rules for German banks require a risk analysis that decides whether an arrangement is material.

From 10 July 2027, Article 18 of the EU Anti-Money Laundering Regulation (AMLR) sets one outsourcing rule for every obliged entity in the EU. A firm may outsource tasks to a service provider after notifying its supervisor, but it remains fully liable for every act or omission of that provider and must be able to explain how each outsourced task mitigates its own risks. Six tasks may never be outsourced: the business-wide risk assessment, the approval of internal policies and controls, the risk profile of a customer, the decision to accept a customer, the reporting of suspicions to the FIU and the approval of the criteria that detect suspicious transactions.

The contract has to be in writing, the provider and any subcontractor apply the policies of the firm, and the firm checks their work at intervals that match how critical the task is. A provider in a high-risk third country is allowed only within the same group, and FIU reports may go to another group entity in the same member state. The EU authority AMLA in Frankfurt has to issue guidelines on outsourcing relationships and on supervisory expectations for critical functions by 10 July 2027. The same EU AML package requires a compliance manager on the management body and a compliance officer for daily operations, and a small group entity with low risk may share the compliance officer of another group company.

Sanctions screening needs current lists and has to keep pace with payments that settle within seconds. Since 9 January 2025, Regulation (EU) 2024/886 requires payment service providers that offer instant credit transfers to check their whole customer base against EU targeted financial sanctions at least once every calendar day and immediately after each new listing. A provider can run that daily batch, but the duty rests on the payment service provider, and the sanctions rules in Germany bind the bank that holds the account, whoever runs the check.

Transaction reporting is the case where the law moves part of the liability to the provider. Under Article 26(7) MiFIR, an investment firm that reports through an approved reporting mechanism is not responsible for failures that the mechanism caused, although it still has to take reasonable steps to check the reports. The Swiss supervisor wrote in its FINMA Risk Monitor 2024 that responsibility for proper business conduct cannot be delegated, and it saw room for improvement in how firms identify their entire chain of providers. When the service runs as software or in the cloud, the firm also manages the provider as an ICT third party under DORA.

Compliance as a service is the purchase of compliance tasks such as identity checks, sanctions screening, alert reviews or regulatory reporting from an outside provider. The regulated firm keeps its license and its legal responsibility, while the provider supplies software, analysts or both under a written contract. Outside finance, the same term describes IT providers that manage security certifications and audits for their clients.

Yes, German law treats the appointment of the money laundering officer as an internal safeguard, which a firm may have a third party carry out after notifying the supervisor under section 6(7) GwG. The external officer has to work in Germany, and the firm remains responsible for the work. From July 2027 the AMLR gives the compliance officer the duty to report suspicions to the FIU and keeps that reporting inside the firm or its group, so the coming AMLA guidelines will decide how external officers fit in.

Yes, a provider can carry out the steps of KYC in Germany, such as identifying the customer, establishing the beneficial owner and collecting documents. Under the AMLR the risk profile of the customer and the decision to accept the customer stay with the firm, which remains fully liable for the checks that its provider performs.

Regtech is software, such as a screening engine or a reporting tool, that a firm licenses and operates with its own compliance team. In compliance as a service the provider also runs the process, so the firm buys a result such as a completed identity check or a reviewed alert. Both models answer to the same EU rules, from the AMLR to DORA, that shape regtech in Europe.

The regulated firm answers to its supervisor, because the GwG, the KWG and Article 18 AMLR leave the responsibility with the firm even when the provider made the mistake. Any recourse against the provider depends on the contract, while fines and supervisory measures are addressed to the firm. MiFIR transaction reports are the main exception, because failures caused by an approved reporting mechanism are the responsibility of that mechanism.