Reporting institutions may rely on third parties for the conduct of CDD or to introduce business provided that the relationship between the reporting institution and the third party must be governed by an arrangement that clearly specifies the rights, responsibilities and expectations of all parties, as required under paragraph 16.5 of the Policy Document.

Nevertheless, the conduct of CDD is the ultimate responsibility of the reporting institution, and must ensure that it is able to obtain the CDD information from the third party, immediately, upon request.  

Sharing of data is allowed strictly for CDD purposes and subject to prerequisites stated in the above paragraphs.

Reporting institutions are to take note that ‘third parties’ in the context of paragraph 16 refers to another reporting institution supervised by Bank Negara Malaysia. It does not include outsourcing or agency relationships because the outsourced service provider or agent would be regarded as synonymous with the reporting institution.

The “attestation” can be in any form that is mutually agreed by both parties.

The “attestation” should clearly specify the rights, responsibilities and expectations of all parties and satisfy the requirements stated under paragraph 16 of the Policy Document.