Performance of Due Diligence Obligations by Third Parties; Contractual Outsourcing

(1) To fulfil the general due diligence obligations under section 10(1), nos. 1 to 4, an obliged entity may rely on third parties. Third parties may only be 1. obliged entities under section 2(1), 2. obliged entities within the meaning of Article 2(1) of Directive (EU) 2015/849 in another Member State of the European Union or in a state party to the Agreement on the European Economic Area, 3. member organisations or associations of obliged entities under no. 2, or institutions and persons established in a third country, provided they are subject to due diligence and retention obligations a) that correspond to the due diligence and retention obligations laid down in Directive (EU) 2015/849, and b) compliance with which is supervised in a manner consistent with Chapter VI, Division 2 of Directive (EU) 2015/849. Responsibility for fulfilling the general due diligence obligations remains with the obliged entity.
(2) Obliged entities may not rely on a third party established in a high-risk third country. Exempted from this are 1. branches of obliged entities established in the European Union under Article 2(1) of Directive (EU) 2015/849, where the branch fully complies with the group-wide strategies and procedures to be applied under Article 45 of Directive (EU) 2015/849, and 2. subsidiaries majority owned by obliged entities established in the European Union under Article 2(1) of Directive (EU) 2015/849, where the subsidiary fully complies with the group-wide strategies and procedures to be applied under Article 45 of Directive (EU) 2015/849.
(3) Where an obliged entity relies on third parties, it must ensure that the third parties 1. comply with the provisions of this Act when identifying persons established in Germany, 2. obtain the information necessary to carry out the due diligence obligations under section 10(1), nos. 1 to 4, and 3. transmit that information to it without delay and directly. It shall further take appropriate steps to ensure that the third parties, on its request, provide it without delay with copies of those documents which are material for establishing and verifying the identity of the contracting party, of any persons acting for it, and of any beneficial owner, including information, insofar as available, obtained by electronic means under section 12(1), first sentence, no. 4, as well as other material documents. The third parties are authorised to make and forward copies of identity documents for this purpose.
(3a) The third party may, for the purpose of identifying the contracting party, a person, where applicable, acting for it, and a beneficial owner, also rely on information under subsection (3), first sentence, no. 2 obtained in connection with an earlier identification of that person, provided 1. the identification took place in connection with the establishment of the third party's own business relationship and was not carried out applying simplified due diligence obligations, 2. the identification, or its last update, was completed in compliance with section 12 not more than 24 months previously, 3. there are, for the obliged entity, on account of external circumstances, no doubts as to the accuracy of the information transmitted to it, and 4. the validity date of any identification document used in the identification, or in its last update, in compliance with section 12 has not yet expired. Subsection (3), second and third sentences apply correspondingly.
(4) The conditions of subsections (1) and (3) are deemed to be fulfilled where 1. the obliged entity relies on third parties belonging to the same group as itself, 2. the due diligence obligations, retention provisions, strategies and procedures applied within that group for the prevention of money laundering and terrorist financing are consistent with the provisions of Directive (EU) 2015/849, or with equivalent provisions, and 3. the effective implementation of these requirements at group level is supervised by an authority.
(5) An obliged entity may transfer the carrying out of the measures necessary to fulfil the due diligence obligations under section 10(1), nos. 1 to 4 to other suitable persons and undertakings besides the third parties referred to in subsection (1). The transfer requires a contractual agreement, and the obliged entity shall ensure that the other suitable persons and undertakings comply with the provisions of this Act. The measures taken by those persons or undertakings are attributed to the obliged entity as its own measures. Subsection (3) applies correspondingly.
(6) The transfer under subsection (5) may not impair 1. the fulfilment by the obliged entity of its obligations under this Act, 2. the ability of the obliged entity's management to direct or control the matter, or 3. supervision of the obliged entity by the supervisory authority.
(7) Before making a transfer under subsection (5), the obliged entity shall satisfy itself as to the reliability of the persons or undertakings to which it intends to transfer measures. During the course of the cooperation it must satisfy itself, by spot checks, of the appropriateness and orderliness of the measures taken by those persons or undertakings.
(8) Insofar as a contractual agreement under subsection (5) is concluded with German embassies, foreign chambers of commerce or consulates, these are deemed suitable by virtue of the agreement. Subsection (7) does not apply.
(9) The provisions on the outsourcing of activities and processes under section 25b of the Banking Act and under Article 73 of Regulation (EU) 2023/1114 remain unaffected by a transfer under subsection (5).