Not every KYC task can be handed to a provider. Knowing exactly where that line sits, before signing a contract, is what separates a compliant outsourcing setup from a liability waiting to surface.
Six categories of AML/CFT tasks cannot be outsourced under the EU's new Anti-Money Laundering Regulation, including the approval of customer risk profiles and suspicious activity reporting. This guide focuses specifically on the European Union: the regulatory detail that follows, GDPR and the AMLR, applies directly to the 27 member states. The United Kingdom and Switzerland run parallel regimes, UK GDPR and Swiss data protection law respectively, that share the same logic but are not identical texts, so a provider compliant under EU rules is not automatically compliant under UK or Swiss law without separate verification.
KYC outsourcing in Europe means delegating the operational steps of customer identification and verification, document collection, and ongoing due diligence to a specialised provider, while the regulated entity retains full legal responsibility for compliance. The real question for a financial institution is not whether KYC can be outsourced, it clearly can, but which parts of it can, and how to choose a provider whose GDPR and AML practices hold up under regulatory scrutiny. This guide covers the regulatory boundaries, the operational criteria that matter, and the questions worth asking before selecting a provider.
Know Your Customer, or KYC, refers to the identification and verification processes financial institutions and other regulated entities must apply before establishing a business relationship with a customer. Know Your Business, or KYB, extends the same logic to corporate clients and their beneficial owners. Outsourcing these processes means delegating the operational execution, document collection, identity verification, data entry, to a provider, while the institution remains the "obliged entity" under EU law and carries the ultimate compliance responsibility.
This distinction between operational execution and legal responsibility is the single most important thing to understand before launching a KYC outsourcing project. A provider can verify a passport, cross-check a beneficial ownership register, or flag a discrepancy. It cannot decide, on the institution's behalf, whether a customer relationship should be approved, or whether a transaction is suspicious enough to report. That line is set by regulation, not by contract negotiation.
The EU adopted a new Anti-Money Laundering package in 2024, built around a single rulebook, the AML Regulation (AMLR), which applies directly across all member states from 10 July 2027. Unlike the previous directives, which each country transposed differently into national law, the AMLR removes that fragmentation: a bank operating in five EU countries will face one set of rules instead of five.
For outsourcing specifically, Article 18 of the AMLR introduces detailed conditions that did not exist with the same level of precision under previous legislation. Before outsourcing any AML/CFT task, the obliged entity must verify that the provider is qualified and will comply with its policies and procedures, and the terms must be set out in a written contractual agreement. Six categories of tasks are explicitly excluded from outsourcing: proposing and approving the business-wide risk assessment, approving policies and procedures, deciding on customer risk profiles, entering into a business relationship, reporting suspicious activities, and approving the criteria used to identify suspicious transactions.
Everything else, document verification, data collection, identity checks, screening against sanctions lists, ongoing monitoring support, can be outsourced. But the obliged entity must notify its supervisor before the provider starts the outsourced task, and must be able to demonstrate that it understands the rationale behind the provider's approach. Outsourcing to providers in high-risk third countries is prohibited unless strict group-level conditions are met. This is the framework every provider selection process should be built around, not retrofitted to.
KYC processing is, by definition, personal data processing: passports, proof of address, beneficial ownership details, sometimes sensitive categories of data. Every KYC outsourcing arrangement is therefore also a GDPR arrangement, governed primarily by Article 28, which sets out the conditions for engaging a data processor.
Article 28 requires a written Data Processing Agreement before any personal data changes hands. The provider may only process data on documented instructions, must guarantee staff confidentiality, must implement appropriate security measures under Article 32, and cannot engage a sub-processor without the institution's prior written authorisation. If the provider fails to meet its obligations, liability does not disappear into the contract, the institution remains accountable to the data subject and to the supervisory authority. Fines for non-compliance with Article 28 can reach 10 million euros or 2% of global annual turnover, whichever is higher, under Article 83.
In practice, this means the due diligence on a KYC provider has to cover two parallel tracks at once: AML competence and GDPR maturity. A provider that handles identity documents flawlessly but cannot produce a clear Data Processing Agreement, or cannot explain where its sub-processors are located, creates exposure on the data protection side even if its AML execution is sound.
The Article 28(10) trap deserves particular attention during due diligence. If a provider starts making independent decisions about why or how data is processed, beyond what the institution instructed, it is automatically reclassified as a controller for that processing, inheriting full controller-level obligations without any of the contractual protections the institution would normally negotiate. This typically happens gradually: a provider that begins using KYC data for its own benchmarking, or that adapts a verification workflow without informing the institution, has likely crossed this line without anyone formally deciding to cross it. Asking a provider directly how it prevents this drift, and whether its staff are trained to recognise the distinction between instructed processing and independent decision-making, reveals more about its compliance culture than any certificate on file.
Sector track record, not general BPO experience. A provider with no documented experience in banking or financial services will face a longer and riskier learning curve before reaching operational maturity, regardless of how strong its general customer service capabilities are. Ask for concrete references in regulated environments, not case studies from unrelated industries.
Security and quality certifications. ISO 27001 for information security, PCI-DSS where payment data is processed, and relevant national quality certifications for contact centres are not guarantees in themselves, but their absence is a clear warning sign. These certifications signal an organisation with mature, audited security and quality management practices, not just a marketing claim.
Data localisation within the EU. For most European financial institutions, keeping personal data within the EU is either a regulatory requirement or a strong recommendation from internal compliance teams, particularly given the restrictions on transferring AML-related tasks to high-risk third countries. Ask exactly where the data is hosted, processed, and backed up, not just where the contracting entity is incorporated.
Clarity on the AMLR outsourcing boundary. A mature provider can explain precisely which parts of the KYC workflow it executes and which decisions remain with the institution's compliance team. A provider who blurs this line, or presents itself as capable of "handling KYC end to end" without qualification, has likely not internalised the regulatory distinction between operational execution and regulated decision-making.
Sub-processor transparency. Under GDPR, any sub-processor must be disclosed and authorised in advance. Ask for the current list of sub-processors, their location, and the process for notifying changes. A provider unable to produce this list on request is not ready for a regulated KYC engagement.
| Criterion | Why it matters | Question to ask the provider |
|---|---|---|
| Sector track record | Regulated environments require a shorter, lower-risk ramp-up | Which regulated financial institutions have you supported, and for how long? |
| Certifications | Signals audited, mature security and quality practices | Can you provide current ISO 27001 and, if relevant, PCI-DSS certificates? |
| Data localisation | Reduces exposure under AMLR's high-risk third country rules | Where exactly is the data hosted, processed, and backed up? |
| AMLR boundary clarity | Confirms the provider understands what it cannot decide | Which KYC decisions remain explicitly with our compliance team? |
| Sub-processor transparency | Required for GDPR Article 28 compliance | Can you provide your current sub-processor list and notification process? |
Neobanks and digital-first institutions frequently outsource onboarding support to accelerate growth without building large internal teams from scratch, guiding new customers through product activation and supporting KYC documentation completion, as outlined in key considerations for customer service outsourcing in banking. The temptation, in a competitive market, is to treat speed and compliance depth as opposing goals, and to choose a provider mainly on how fast it promises to onboard a customer.
This framing misses what actually slows down onboarding in practice. The bottleneck is rarely the speed of document verification itself, it is the rework caused by incomplete files, inconsistent risk scoring, or escalations that bounce between the provider and the institution because the workflow was never clearly mapped. A new corporate customer whose beneficial ownership structure spans three countries, for instance, generates exactly the kind of file that exposes a poorly designed handover: the provider collects documents correctly but cannot determine on its own whether the structure warrants enhanced due diligence, and if the escalation path to the institution's compliance team is not pre-defined, the file simply waits. A provider with genuine regulatory maturity reduces friction precisely because it knows where its role ends and the institution's begins, which means fewer files get stuck in an ambiguous zone between the two organisations.
This is the logic behind Armatis' Trust & Safety operations, where certified teams handle KYC and KYB processes with document collection tools and automated analysis, while GDPR requirements and sector-specific standards are built into every step rather than layered on afterwards. Real-time monitoring, regular audits, and structured reporting give the institution full visibility into volumes, detection rates, and processing times, which is what allows speed and compliance to reinforce each other instead of competing.
Selecting a provider is the easier half of the work. The harder part is verifying, on an ongoing basis, that the outsourcing arrangement still matches what was agreed at signature, particularly as regulatory guidance from the new EU Anti-Money Laundering Authority continues to be published in the lead-up to July 2027.
Two practical checks deserve regular attention. First, re-confirm that the list of tasks performed by the provider has not silently expanded into territory reserved for the obliged entity, a risk that grows naturally as a working relationship matures and informal shortcuts creep into daily operations. Second, audit the sub-processor chain at agreed intervals, not only at contract signature, since GDPR liability for a sub-processor's failure still flows back to the original processor and, ultimately, to the institution. A provider that welcomes these audits as routine, rather than treating them as adversarial, is usually the one that has built compliance into its operating model rather than into its sales pitch.
A poorly structured selection process produces offers that cannot be compared on equal footing. Each provider highlights its own strengths, frames its limitations favourably, and the selection committee ends up comparing marketing narratives rather than substantive capabilities mapped against the same regulatory framework.
Three practices avoid this trap. First, narrow the shortlist to providers with documented experience in regulated financial services, not generalist BPO providers who treat KYC as one service line among many. A provider whose core business is not compliance-adjacent will often respond with generic promises rather than a concrete operating model. Second, require a standardised response format on the structural questions, AMLR task boundaries, sub-processor list, data residency, certifications, so that every provider answers the same questions in the same order, rather than steering the conversation toward whichever strength suits its pitch. Third, ask for a live walkthrough of an actual KYC case file, anonymised if necessary, rather than relying solely on a written proposal. A provider that can show, end to end, how a file moves from intake to the point where it hands a decision back to the institution demonstrates a level of operational maturity that a glossy deck cannot fake.
Weighting also deserves attention before the request for proposal goes out, not after offers come back. If price counts for the majority of the final score, the committee will mechanically favour the cheapest bidder, even when that bidder's compliance maturity is visibly behind the rest of the field. Documenting the weighting in advance, and sharing it with every provider consulted, removes the temptation to rationalise a decision after the fact and keeps the process defensible if a regulator later asks how the provider was chosen.
Not directly. The regulatory detail covered here, GDPR and the AMLR, applies to the 27 EU member states. The UK operates under UK GDPR and its own AML framework, and Switzerland has a separate data protection regime. The general principles around outsourcing boundaries and provider due diligence are similar, but the specific legal texts differ, so compliance under one regime should not be assumed to cover the others.
No. The AMLR explicitly excludes six categories of tasks from outsourcing, including approval of customer risk profiles, entering into a business relationship, and suspicious activity reporting. Operational tasks such as document verification and data collection can be outsourced, but final compliance decisions must remain with the obliged entity.
GDPR's general rules apply, but KYC data often includes identity documents and sometimes sensitive categories of information, which raises the bar for the security measures required under Article 32 and for the due diligence performed before selecting a processor.
Not always strictly mandatory, but it is frequently a regulatory expectation or an internal compliance requirement for European financial institutions, especially since AMLR restricts outsourcing AML/CFT tasks to providers in high-risk third countries.
Under GDPR, the original processor remains fully liable to the controller for the sub-processor's failures. In practice, this means the financial institution should require visibility into the full sub-processor chain, not just the primary provider's own practices.
The AMLR enters into force across all EU member states on 10 July 2027, replacing the previous directive-based framework with a single, directly applicable rulebook, including specific provisions on outsourcing under Article 18.
KYC outsourcing in Europe is not a binary choice between doing everything in-house or handing the whole process to a provider. It is a question of mapping precisely which operational tasks can be delegated under the AMLR, securing the GDPR processing relationship with a proper Data Processing Agreement, and selecting a provider whose certifications, data localisation, and sub-processor transparency hold up to scrutiny, not just to a sales pitch.
At Armatis, Trust & Safety operations are built around certified teams, GDPR-aligned processes from day one, and continuous regulatory monitoring, so that compliance becomes a competitive advantage rather than an operational burden. Discover our Trust & Safety approach.
Sources
Armatis is a European specialist in customer relations and business process outsourcing (BPO), operating across multiple continents with thousands of employees serving companies of all sizes and sectors. The company designs and manages end-to-end customer service operations: multichannel contact centres, complaints handling, technical support, back-office and digitised processes. Backed by integrated technology infrastructure and the ability to adapt to any sectoral and regulatory context, Armatis helps its clients combine operational performance, quality of experience and cost control, wherever they need it.
Contact our teams to discuss your challenges and find out how we can support you
Join the leaders who trust our multilingual and technological expertise.