AML/CTF reliance: relying on another firm’s customer due diligence

Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, a reporting entity can rely on the collection and verification of customer information carried out by another reporting entity (or an equivalently regulated overseas firm) instead of repeating it. Reliance can be under a standing written arrangement (section 37A) or case by case (section 38), in each case only if the statutory conditions are met. Reliance is what allows an accounting or legal firm and its corporate secretarial provider to avoid verifying the same client twice where the firm relied on is itself a reporting entity, or an equivalently regulated overseas firm.

A reliance arrangement under section 37A must: be in writing and approved by a senior manager; be with a reporting entity (or an equivalently regulated overseas firm) that has measures in place to meet its own CDD and record-keeping obligations; be appropriate to the money laundering and terrorism financing risk, taking into account the other party’s business, customers, delivery channels and country risk; give the relying entity all the KYC information before the service is provided and copies of the verification data immediately or as soon as practicable on request; and document each party’s responsibilities, including record keeping. The relying entity must reassess the arrangement at least every two years, and whenever circumstances change significantly, and make a written record of each assessment within 10 business days. Each of these matters if the arrangement is ever examined by AUSTRAC or tested after the fact.

Reliance flows in the direction of the designated service. The entity providing the designated service, for example a corporate secretarial provider forming a company, relies on the CDD performed by the instructing firm that holds the client relationship. The party relied upon is typically another reporting entity with its own AML/CTF program, such as an accounting or legal practice enrolled with AUSTRAC.

Reliance covers the collection and verification of customer information only. If the statutory conditions are met, the relying entity is treated as having done that part of the CDD itself. It remains responsible for meeting the reliance conditions, for assessing the customer’s risk and the purpose of the relationship, for ongoing due diligence and for its own record keeping. If the conditions are not met, it gets no protection and the CDD failure is its own. Equally, the party that performed the CDD remains responsible for the accuracy of what it represents.

Record-keeping underpins the whole arrangement. The party performing the CDD must keep the records, commonly for at least seven years, and must be able to provide copies of the verification data to the relying entity immediately or as soon as practicable on request. An arrangement that cannot deliver the underlying records when asked is not genuine reliance, and the relying entity should not treat it as such.

At CoSec Partners, firms that instruct us can set up a reliance arrangement through the client portal’s AML Compliance tab. We review each arrangement before relying on it and reassess it at least every two years, and our terms of service set out the basis of reliance, the records obligation, and the fact that each party retains responsibility for its own AML/CTF duties.