Relying on Third Parties for Customer Due Diligence

Sometimes another regulated firm has already done the identity checks on a client you are about to take on: the client's solicitor, their bank, or another accountant. It is tempting to ask for a copy and move on. The Money Laundering Regulations 2017 do allow a form of this, called reliance under regulation 39, but only in defined circumstances, and it never moves responsibility away from you. This guide explains what reliance is, what it covers, what it does not, how it differs from outsourcing or using an online verification tool, and what to put in place before you try it. It draws on HMRC's Economic Crime Supervision Handbook, the text of regulation 39 on legislation.gov.uk and guidance from the Insolvency Practitioners Association. Regulations change, so check the current wording and your supervisor's guidance before you rely on this page. It is general information, not legal advice.

What reliance is

According to HMRC, reliance lets a business rely on another person to carry out customer due diligence (CDD), and to check company registers and report discrepancies under regulation 30A. In practice it covers identifying and verifying the customer, any person acting for the customer, and the beneficial owners. HMRC says the records may be held by the other person, but the business must have obtained all the information it needs to meet its CDD requirements.

Who you can rely on

HMRC says the person relied on must be supervised under the 2017 Regulations or subject to equivalent measures in another country. They cannot be based in a high-risk third country, unless they are a branch or subsidiary of an entity subject to equivalent measures that follows its group's procedures. The Insolvency Practitioners Association puts it in similar terms: the third party must be in a regulated sector for AML purposes in the UK, or subject to an equivalent regime in a third country.

Reliance does not move responsibility

This is the point most often missed. HMRC states that reliance does not excuse a business from the CDD requirements, and that the business remains liable for any breaches if the CDD carried out is insufficient. The text of regulation 39 on legislation.gov.uk says the same in terms: the relying person remains liable for any failure to apply the measures. The Insolvency Practitioners Association adds that you need to understand what work the third party has done, that you should still carry out your own risk assessment, and that you must still perform ongoing monitoring.

Reliance does not cover enhanced due diligence

HMRC says that reliance does not extend to enhanced due diligence checks for customers deemed to be high risk. If a client is high risk, you will have to do those checks yourself. Our guide to enhanced due diligence for accountants explains what is involved.

What you need in place

• An arrangement that works. Regulation 39 requires arrangements that let you obtain copies of the identification and verification data, and other documents, immediately on request. The Insolvency Practitioners Association recommends a written agreement, and says it should require the third party to provide the documentation it used immediately on request.
• Record keeping. The third party must keep the records for the period set by regulation 40. HMRC covers record keeping separately in its handbook.
• Prompt delivery. HMRC says that when you ask for CDD records, you should expect them without undue delay.
• A reason on file. HMRC says its inspectors discuss why the arrangement is needed and how the business satisfies itself that it can meet its CDD obligations, so write that down.

What is not reliance

HMRC's handbook uses simple examples to separate reliance from other things that look similar:

• An online verification platform. In one case study an unsupervised online platform was used. HMRC treated that as outsourcing under regulation 39(7), not reliance, and the business remained fully liable and had to document its checks. HMRC also says that using an independent identity provider is not reliance.
• Assuming another firm's work is enough. In another, an estate agent assumed that a conveyancer's CDD was sufficient. The conveyancer had not agreed to provide it, so the agent had to carry out its own checks.
• A genuine reliance arrangement. In the third, two trust or company service providers in the same group had a reliance agreement, and one obtained CDD records from the other.

The lesson is the one HMRC draws itself: be careful with the word "rely" in meetings and file notes, since businesses often use it loosely. If there is no agreement and no access to the records, you are probably not relying on anything and need to do the work yourself. For digital identity tools, see our guide to the 2026 changes to the Money Laundering Regulations for the position on certification.

Outsourcing and agents

Regulation 39 also allows CDD to be carried out through an agent or outsourcing provider, but only where the arrangements keep the relying person liable for any failures, according to the text on legislation.gov.uk. An outsourcing provider is someone who performs a function you would otherwise do and who is not an employee. In other words, you may delegate the task but never the responsibility. If you outsource onboarding to a bookkeeping bureau or a virtual assistant, you need to supervise the work, check a sample, and keep the records.

A short checklist before you rely on anyone

1. Confirm they are supervised. Note their supervisor and registration number.
2. Agree it in writing. Include prompt access to documents and record retention.
3. Get the information. Request the CDD documents and read them, rather than accepting a confirmation letter alone.
4. Do your own risk assessment. Rate the client and decide whether enhanced checks are needed.
5. Keep monitoring. Reliance only covers the initial CDD. See our guide to KYC and customer due diligence for accountancy practices for the full process.

Training your staff to tell reliance, outsourcing and ordinary information-sharing apart is worthwhile, and our CPD courses can help.

Frequently asked questions

Can I rely on another accountant's due diligence?

Possibly, if they are supervised under the regulations or subject to equivalent measures, and you have an arrangement giving you the information and prompt access to the records.

Does reliance make the other firm liable?

No. HMRC and regulation 39 both say the relying business remains liable if the CDD is insufficient.

Does reliance cover enhanced due diligence?

No. HMRC says it does not extend to enhanced due diligence checks for high-risk customers.

Is using an online ID tool reliance?

No. HMRC says using an independent identity provider is not reliance, and an unsupervised platform is treated as outsourcing.

Does the agreement have to be in writing?

The text of regulation 39 requires arrangements, and the Insolvency Practitioners Association recommends a written agreement. In practice you should have one.