As an obligor or obligated party under money laundering law, you must establish appropriate business- and customer-related internal safeguards to manage and mitigate money laundering and terrorist financing risks through appropriate policies, procedures and controls.

You may also outsource the implementation of internal safeguards to a third party under contractual arrangements. However, you must notify the relevant supervisory authority of the intended outsourcing in advance. The Money Laundering Act contains standard examples of the safeguards to be put in place. This list is not exhaustive. Further internal security measures may be required in individual cases. The internal security measures still require the approval of the member of management responsible for money laundering prevention in their company.

As an obligated party or obligated party, you may have the internal security measures carried out by an (external) third party within the framework of contractual agreements if you have notified the supervisory authority of this in advance. The supervisory authority may prohibit the transfer if

• the third party does not provide a guarantee that the security measures will be carried out properly.
• the control options of the obligated parties are impaired, or
• the supervision by the supervisory authority is impaired.

For you as an obligor or obligated party, this means that you must state in your notification that the conditions for prohibiting the transfer do not exist.

You must also state in the notification which internal security measures are the subject of the transfer

The notification must be made by obligated parties themselves or, if applicable, by the appointed money laundering officer.

Important Notice:

The responsibility for fulfilling the internal security measures remains with the obligated parties. If the third party does not properly fulfill the contractually assigned obligations, for example, you remain responsible for non-compliance with the internal security measures.