Can a payment provider rely on your KYC for sub-merchants?Under conditions. In most markets, the provider stays liable.

Sometimes. Most AML rules let a regulated provider rely on another regulated firm's customer due diligence. The provider must get the data at once and copies on request. In most markets, it stays liable for the result. Under card scheme rules, a payment facilitator checks its sub-merchants and the acquirer answers for them.

General information, not legal advice. Check current rules with your providers and your own counsel.

This guide is for PSPs and platforms that onboard merchants and route their payments through a provider. That provider may open named USD accounts, run payments on behalf of your merchants, or pay out for them.

What is KYC reliance?

Reliance means a regulated firm uses another regulated firm's customer checks instead of repeating them. The global standard is FATF Recommendation 17. The June 2026 edition of the FATF Recommendations lists no change to it.

It sets three conditions and one rule for the firm that relies:

• It obtains the customer due diligence information immediately.
• It can get copies of identity documents from the third party without delay.
• It checks that the third party is regulated, supervised or monitored for due diligence.
• It keeps the final responsibility for the checks.

The last point answers most of the question. Reliance moves the work, not the liability.

Reliance, outsourcing or payment facilitator: which model are you in?

Four setups can look like reliance from the platform's side. The law treats them differently.

FATF says Recommendation 17 does not apply to outsourcing or agency. In outsourcing, the service provider applies the delegating firm's procedures, under its control. EU and UK rules draw the same line.

From 10 July 2027, the EU adds a limit. The provider must notify its supervisor before outsourcing starts. It cannot outsource the decision to enter into a business relationship.

Who stays liable?

The provider, under FATF and the EU, UK, Nigerian and Kenyan rules. The US bank rule works differently. The rules also differ on speed, contracts and country limits.

The US rule is narrow. A bank may rely on another financial institution only when reliance is reasonable. That institution must have an AML programme rule and a federal functional regulator. The AML programme rule for money services businesses has no matching reliance clause. A FinCEN proposal of 10 April 2026 would only rename the programme in the bank rule.

In the EU, the directive ends on 9 July 2027. The regulation applies from the next day. AMLA must issue reliance guidelines by that date. Its list of instruments, updated 7 October 2026, shows no reliance draft yet.

What does the provider still check?

Reliance does not end the provider's own work. Regulator guidance and scheme rules show what it keeps doing.

• Your licence and supervision. Reliance needs a regulated third party. In its 2023 consultation text, the Dutch central bank says a licence does not end the provider's gatekeeper duty.
• Your merchants' risk. In its 2025 good practices, the Dutch central bank gives an example. A payment institution counts sub-merchant risk in the platform's own risk profile.
• Sample files. The Dutch central bank's 2023 consultation text says annual reviews include a sample of sub-merchant files. Under one Mastercard route, the acquirer reviews at least 5% of new sponsored merchants each month.
• Audits. The same consultation text has the provider audit or check the platform for AML compliance.
• Websites. It also has the provider monitor the websites where sub-merchants sell.
• Named principals. On request, a Visa facilitator must give its acquirer each sponsored merchant's principals and their country of domicile.
• Owners and screening. Mastercard's Security Rules of 4 August 2026 cover each prospective sponsored merchant. The entity and its principal owners are identified and verified. They are screened against sanctions lists. A MATCH inquiry is submitted, with the website address for online sales.

The Dutch text dates from 11 December 2023 and is still a consultation. No final version had been published by 27 October 2026.

What do card schemes require from a payment facilitator?

Card schemes use their own model, separate from AML reliance. Visa's rules of 18 April 2026 set this out. An acquirer or a payment facilitator must review a merchant before contracting with it. The acquirer is liable for all acts and omissions of the facilitator and its sponsored merchants. The facilitator agreement also makes the facilitator liable for its sponsored merchants.

Mastercard's rules of 2 June 2026 also make the acquirer responsible for the facilitator and its sponsored merchants. The facilitator signs sponsored merchants as an agent of the acquirer. Its Security Rules of 4 August 2026 have the facilitator screen them under the acquirer's KYC policies. If it keeps the investigation records, it must hand them to the acquirer immediately on request.

When does a provider refuse reliance?

Expect a no in these cases.

1. You are not regulated for AML. Reliance needs a regulated, supervised third party. An unregulated platform can still do the work, but only as an outsourcer or agent.
2. You sit in a high-risk country. The EU directive prohibits reliance on third parties in high-risk third countries. Since 30 June 2026, UK rules bar it for FATF call for action countries. Both allow narrow exceptions inside a group.
3. Your checks were simplified. HMRC's guidance of 8 July 2026 covers the firms it supervises. It says a firm must not rely on a third party's simplified due diligence.
4. You cannot produce files on time. Every AML rule above except the US bank rule requires copies on request. A platform that takes weeks to send them fails the condition.
5. The provider does not support nested flows. Some providers open accounts only for clients they onboarded themselves. Others accept reliance for one product and not yet for another.

Ask early. Some platforms make reliance a condition, so they do not need the provider's approval for each merchant. Some providers cannot offer it in every currency.

What should the reliance agreement say?

Kenya requires an agreement on each party's role. From 2027, the EU requires a written one. Elsewhere, the conditions push you to one anyway. Check that it covers these points.

1. Which data you send for each sub-merchant at onboarding, and in what format.
2. How fast you deliver copies of documents on request.
3. Who reviews samples, how often, and what happens to a failed file.
4. Audit rights, and notice before an audit.
5. Which merchant types and countries are out of scope.
6. Who tells whom when a sub-merchant raises a red flag.
7. Access to records after the agreement ends.

Before you ask a provider, prepare your licence, your KYB policy and three sample sub-merchant files. The same pack helps when you compare providers for a payout API.

FAQ

For PSPs and platforms

Moving money for your merchants across Africa and beyond? Talk to our team. Nilos Canada Ltd is registered with FINTRAC as a money services business (MSB C100000178). A SOC 2 Type II report is available under NDA. See what Nilos builds for PSPs and fintechs.