Crypto KYC outsourcing under the 2027 EU AML rules

The Irish CASP provides regulated services through a branded app supplied by an Indian company. The supplier collects identity evidence, proposes risk scores, triages alerts and supports customers under the CASP’s procedures. The renewal would extend its role to approving the business-wide risk assessment and screening criteria, deciding customer risk and admission, and submitting suspicion reports through its own managed workflow.

For an in-scope CASP, those proposed decision powers conflict with Article 18’s reserved functions from 10 July 2027. The later application date for football agents and professional football clubs does not extend the CASP’s timetable. The parties should amend the allocation before renewing across that date. (AMLR, Articles 2(1)(6)(i), 2(1)(8)–(9), 3 and 90.)

Before then, Ireland’s amended Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 applies. Section 40 distinguishes eligible third-party reliance from performance through an outsourcing provider or agent, while retaining the designated person’s liability. Under the 2010 Act, senior management already approves the business risk assessment and internal policies and controls. The 2025 amendments brought the relevant CASPs under the Markets in Crypto-Assets Regulation (MiCA) within the national financial-institution definition. The renewal therefore needs an allocation that complies before July 2027 as well as a July 2027 schedule. (2010 Act, sections 30A(5), 40(6)–(7) and 54(4), as amended; 2018 Act, sections 10 and 26; S.I. No. 310/2025.)

European Banking Authority (EBA) guidelines also expect strategic AML decisions, including customer risk-profile assignment and detection-criteria approval, to remain with the institution. (EBA/GL/2022/05, paragraphs 6, 8–10 and 68(e).)

Ireland’s 2026 General Scheme for transition legislation is a legislative proposal. It does not itself repeal the duties under the 2010 Act. The existing article on crypto AML and KYC controls covers the broader baseline; the renewal must allocate responsibility for performing those controls.

First, the CASP can operate identity software, query a database or use a screening service itself. Recital 47 distinguishes these inputs from outsourcing where the supplier does not perform the AML requirement. The contract label and location of the server do not settle who performs it. A screening result remains an input where the CASP applies its own process to evaluate the result. (AMLR, recital 47.)

Second, the Indian contractor can perform defined checks under the CASP’s instructions: review documents, investigate mismatches, assemble evidence and triage monitoring alerts. That is outsourced performance. The CASP must understand the work, supervise it and retain the reserved decisions. The supplier may recommend a risk score without acquiring authority to assign the customer’s final risk profile. (AMLR, Article 18(1)–(5).)

Third, statutory reliance concerns another eligible obliged entity’s own due diligence. Articles 48–49 permit reliance for customer identification and verification, beneficial-owner identification and verification, and the purpose and intended nature of the relationship or transaction. The relied-upon entity must meet the applicable due-diligence, record-keeping and supervision conditions. Responsibility remains with the relying CASP; ongoing monitoring and customer admission do not pass through this route. (AMLR, Articles 20(1)(a)–(c) and 48.)

The CASP must obtain the necessary information and secure supporting evidence on request. Delivery must be without delay and within five working days; written transmission terms are required, subject to the qualifying group procedure. That limit is not permission to open an account before satisfying the applicable due-diligence timing requirements. A vendor’s “KYC passed” result, or separate commercial contracts with both parties, does not establish eligibility. The Indian supplier described here should remain a technical supplier or contractor unless the required regulated status and conditions are established. (AMLR, Articles 23 and 48–49.)

The European Digital Identity (EUDI) Wallet analysis addresses identity evidence and reliance in a different structure. Reusable evidence still needs a lawful route into this CASP’s own customer file.

The renewal’s responsibility schedule should implement all six Article 18(3) reservations.

1. The CASP’s compliance officer must draw up the business-wide risk assessment; its management body in its management function approves it. Both proposal and approval are reserved. The supplier can provide exposure data, statistics and technical analysis. Retain the officer’s assessment, reasons and approval record. A vendor-written assessment submitted for nominal approval does not establish that the CASP performed the reserved proposal. (AMLR, Articles 10(2) and 18(3)(a).)
2. The CASP approves its internal policies, procedures and controls. Internal policies require the management body’s approval; procedures and controls require approval at least at compliance-manager level. The contractor can prepare supporting material and implement approved procedures. Its system permissions should prevent unapproved policy changes, with each operative version linked to its approval. (AMLR, Articles 9(2) and 18(3)(b).)
3. A designated CASP decision owner must control the customer’s risk profile. Supplier scores and review recommendations can inform that decision. Preserve the evidence, applicable scoring rules, reasons and any override. The supplier should have no independent power to change the operative classification. Article 18 reserves the decision without prescribing one universal job title. (AMLR, Articles 18(3)(c) and 20(2).)
4. The CASP must decide whether to enter a relationship or carry out an occasional transaction. The supplier can collect missing documents and prepare the case. Account activation should depend on the CASP-controlled decision process, including any required senior-management approval. A vendor-controlled acceptance switch cannot be repaired by stating in the contract that every acceptance belongs to the CASP. (AMLR, Article 18(3)(d).)
5. Suspicion reporting remains with the CASP’s compliance officer, subject to the narrow exception below. Supplier staff can prepare factual investigation packs and draft material for review. Keep the reporting authority, submission record and follow-up correspondence within the controlled reporting process. (AMLR, Articles 11(2), 18(3)(e) and 69(6).)
6. The CASP must approve criteria for detecting suspicious or unusual transactions and activities. For this arrangement, assign approval to its compliance manager within the approved policies. The supplier can test matching logic, propose thresholds and analyse false positives. Production deployment should require recorded approval, with versions and changes traceable. Screening criteria that determine customer risk or admission also engage those separate reservations. (AMLR, Articles 9 and 18(3)(f).)

Automated document checks and calculated scores can support these functions. Article 18 does not prescribe a manual click for every check. Article 76(5), however, requires meaningful human intervention for the specified automated decisions about entering, refusing or maintaining relationships, occasional transactions, and increasing or decreasing due diligence. It also limits the data used and provides explanation and challenge rights, except concerning Article 69 reports. (AMLR, Article 76(5)(a)–(c).)

The operating model should identify who can examine the evidence, reject a recommendation, change a result and stop deployment. Record the human intervention where required. Periodic sampling alone should not be treated as satisfying the requirement for each covered decision. Configuration ownership, escalation permissions and decision logs must support the contractual allocation. The General Data Protection Regulation (GDPR) also restricts solely automated decisions with legal or similarly significant effects, subject to applicable exceptions and safeguards. (GDPR, Article 22.)

Article 18(3)(e) covers suspicion reports under Article 69 and applicable threshold reports under Articles 74 and 80. Those provisions do not create a general report for every crypto transaction above a single threshold.

The reporting exception requires another obliged entity in the same group and established in the same Member State. All three conditions matter. The Indian contractor described here does not meet that route. Common branding, a service agreement or access to a reporting portal is insufficient. Article 18(7)’s separate, supervisor-approved exception concerns specified collective investment undertakings; it does not supply a CASP exception. (AMLR, Article 18(3)(e) and (7).)

Irish reporting under the 2010 Act requires separate care. Sections 41–42 can extend duties to persons engaged under contracts for services, and reports go to both the Financial Intelligence Unit (FIU Ireland) and the Revenue Commissioners. Section 44(2)’s internal-reporting defence is employee-specific. The contract should require prompt escalation and preserve any direct statutory duty applicable to the contractor. It should not promise that escalation alone always discharges that duty. (2010 Act, sections 41–44, as amended.)

Article 18(1) requires notification before the supplier starts the outsourced task. It sets no standard notice period or prescribed form. Notification does not signify acceptance, and silence does not provide approval. For this Irish CASP, prepare the task allocation, control assessment, provider details and subcontractor map for its Central Bank supervisory channel. (AMLR, Article 18(1), recital 49.)

An existing agreement has no express Article 18 grandfathering exemption. Confirm how the Central Bank expects continuing and renewed arrangements to be notified before July 2027. The Central Bank’s supervisory expectations already call for advance dialogue on critical or important outsourcing and material changes. The Digital Operational Resilience Act (DORA) separately requires timely information about planned information and communication technology (ICT) arrangements supporting critical or important functions. A periodic outsourcing register or ICT register does not replace a required notification. (Central Bank Cross-Industry Guidance on Outsourcing, section 10.1; DORA, Article 28(3).)

The Central Bank’s CP173 consultation proposes replacement guidance. As at 9 November 2026, it has not replaced the 2021 Cross-Industry Guidance on Outsourcing.

Before outsourcing, the CASP must establish that the supplier is sufficiently qualified. Written terms must govern performance, and the supplier and subsequent subcontractors must apply the CASP’s policies. Regular controls must reflect the task’s criticality. Assess staff competence, technology, escalation capacity and evidence retrieval; retain the assessment and control results. (AMLR, Article 18(4).)

The agreement should identify permitted subcontracting, require notice and appropriate approval of changes, and carry access, confidentiality and policy obligations through the chain. These are proposed contractual controls implementing the CASP’s duties. Subcontracting must preserve the supervisor’s ability to monitor and retrace compliance. Test complete-file export and retrieval during an outage and on exit. (AMLR, Article 18(4)–(5); GDPR, Article 28(2)–(4); MiCA, Article 73.)

Non-EU location alone does not prohibit AML outsourcing. Article 18(6) restricts providers resident or established in countries identified under the AMLR’s three country-designation routes. Its exception requires a same-group provider, compliant or equivalent group AML, due-diligence and record-keeping measures, and effective home-Member-State supervision at group level. Those conditions are cumulative. (AMLR, Articles 18(6) and 29–31.)

As at 9 November 2026, India is absent from the EU high-risk-country list. That position cannot establish its July 2027 status. Recheck the applicable country designations, every delivery location and the actual supplier and ownership chain before performance. A sanctions check answers different restrictions and cannot replace the AML country assessment. (Delegated Regulation (EU) 2016/1675, Annex; AMLR, Article 18(6).)

For processing on the CASP’s instructions, the supplier needs GDPR processor terms. Any independent purpose requires a separate role and lawful-basis assessment. AML processing ordinarily rests on the applicable legal obligation; consent does not supply a universal basis for reuse or overseas access. Remote access by the separate Indian company can be an international transfer even when the data remain on European servers. (GDPR, Articles 4, 5–6, 28 and 44; EDPB Guidelines 05/2021, section 2.)

As at 9 November 2026, India has no EU adequacy decision. The parties should establish an appropriate transfer mechanism, commonly the applicable standard contractual clauses, assess Indian law and practices, and adopt necessary supplementary measures. If adequate protection cannot be achieved, restrict the access or change delivery. Record countries, recipients, subprocessors, access rights and deletion duties. (GDPR, Articles 44–46; Decision (EU) 2021/914, Annex, clauses 14–16.)

Customer support should receive only the information needed for its task. Separate investigation notes, suspicion reports and reporting status from ordinary support queues. The CASP must retain access to the full required evidence, including assessments that produce no report. The AMLR generally requires five years’ retention from relationship termination, the occasional transaction or refusal, with specified extensions. Supplier convenience cannot justify indefinite copies or commercial reuse. (AMLR, Articles 73 and 76–78; 2010 Act, sections 49, 54 and 55.)

Indian implementation also crosses a legal change. Core Digital Personal Data Protection Act duties are scheduled to commence in May 2027. Its exemption for specified processing of persons outside India under an overseas contract has conditions and preserves responsibility and security duties. Review the Indian security obligations in force and the regime commencing in May 2027 for the actual service; a foreign client does not establish a blanket exemption. (Digital Personal Data Protection Act 2023, sections 8 and 17(1)(d); G.S.R. 843(E), 13 November 2025.)

The following dates are proposed project milestones. The legal application date is 10 July 2027.

By December 2026, complete the Irish-law assessment for the period before July 2027 and classify every supplier activity. Remove conflicting decision powers from the renewal. Identify the CASP owners, reporting route, countries, subcontractors and evidence required for each task.

By March 2027, sign the task schedule, processor and transfer terms, and the applicable ICT provisions. Specify reserved decisions, escalation, change control, audit and supervisor access, retention, incident cooperation, continuity, exit and legal-change procedures. Begin supervisory communications sufficiently early for the relevant process.

By June 2027, test permissions, meaningful human intervention, report confidentiality, subcontractor compliance and record retrieval. Recheck Irish transition legislation, country lists and Anti-Money Laundering Authority (AMLA) instruments. AMLA’s October 2026 publications describe final draft technical standards submitted for Commission adoption. A final report or a statutory delivery deadline does not establish that an implementing rule applies. (AMLA, 1 October 2026; AMLR, Articles 18(8) and 50.)

From 10 July 2027, operate only the allocation that meets the applicable rules. Suspend or reassign a task if the CASP cannot exercise its reserved authority, obtain records or use the delivery location lawfully. Keep the approval evidence and monitoring results with the agreement.

Article 18 treats a contractor as part of the obliged entity for the outsourced task. It does not extend the CASP’s MiCA permission. Receiving customer orders, giving crypto advice, controlling custody or providing transfers requires a separate service assessment. MiCA has no tied-agent route permitting an unlicensed company to provide those services under a CASP’s authorisation. (MiCA, Articles 3, 59 and 73; European Commission answer to ESMA Q&A 2143, 12 September 2024.)

The white label crypto app guide addresses that provider boundary. The AML renewal should be tested against the same customer journey and system permissions.