# FATF R.17 — Reliance on third parties - **Part of:** [[FATF Recommendations]] Countries may allow financial institutions to rely on third parties to perform the identification, verification and business-relationship-purpose elements of customer due diligence, or to introduce business, but ultimate responsibility for CDD remains with the relying institution. The relying institution must immediately obtain the required CDD information, be satisfied the third party will provide underlying documentation without delay on request, and confirm the third party is itself regulated, supervised and compliant with CDD and record-keeping requirements; country risk must also be considered when the third party is based elsewhere. ## Keyed AMLR articles - [[AMLR Art. 48 - Reliance on third parties|AMLR Art. 48]] — Reliance on third parties - [[AMLR Art. 49 - Process of reliance|AMLR Art. 49]] — Process of reliance - [[AMLR Art. 50 - Guidelines on reliance|AMLR Art. 50]] — Guidelines on reliance ## Authoritative text > [!quote]- FATF Recommendation 17 — text of the Recommendation (FATF Recommendations, updated June 2026); interpretive note not reproduced > **17. Reliance on third parties** > Countries may permit financial institutions to rely on third parties to perform elements (a)-(c) of the CDD measures set out in Recommendation 10 or to introduce business, provided that the criteria set out below are met. Where such reliance is permitted, the ultimate responsibility for CDD measures remains with the financial institution relying on the third party. > The criteria that should be met are as follows: > (a) A financial institution relying upon a third party should immediately obtain the necessary information concerning elements (a)-(c) of the CDD measures set out in Recommendation 10. > (b) Financial institutions should take adequate steps to satisfy themselves that copies of identification data and other relevant documentation relating to the CDD requirements will be made available from the third party upon request without delay. > (c) The financial institution should satisfy itself that the third party is regulated, supervised or monitored for, and has measures in place for compliance with, CDD and record-keeping requirements in line with Recommendations 10 and 11. > (d) When determining in which countries the third party that meets the conditions can be based, countries should have regard to information available on the level of country risk. > When a financial institution relies on a third party that is part of the same financial group, and (i) that group applies CDD and record-keeping requirements, in line with Recommendations 10, 11 and 12, and programmes against money laundering and terrorist financing, in accordance with Recommendation 18; and (ii) where the effective implementation of those CDD and record-keeping requirements and AML/CFT programmes is supervised at a group level by a competent authority, then relevant competent authorities may consider that the financial institution applies measures under (b) and (c) above through its group programme, and may decide that (d) is not a necessary precondition to reliance when higher country risk is adequately mitigated by the group AML/CFT policies.