Compliance outsourcing: what can be outsourced and what stays with the company

Short answer: In compliance outsourcing, operational tasks such as KYC reviews, alert handling, screening, training and control testing can be outsourced. Responsibility, overall management and strategic decisions stay with the company: in Switzerland they cannot be outsourced under FINMA Circular 2018/3, and in Germany responsibility remains with the obliged entity even after a notified transfer under section 6(7) of the Anti-Money Laundering Act (GwG). Often, temporarily reinforcing your own compliance team is enough instead of outsourcing.

This guide is for heads of compliance, money laundering reporting officers, risk officers and management at banks, insurers, financial services firms and industrial companies in Switzerland and Germany. It explains what compliance outsourcing can cover, what stays with the company and which form suits which task. Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region.

What compliance outsourcing means

Compliance outsourcing means that a service provider performs compliance tasks independently and on an ongoing basis for a company. This is different from temporary reinforcement, where professionals work inside your team and the company directs the work.

• Outsourcing: the provider performs a function or process with its own staff. Supervised institutions face specific rules on notification, contracts, oversight and audit rights.
• Staff leasing: the professional is employed by the staffing provider and integrated into your organisation; you generally direct the work. In Germany this is called Arbeitnehmerüberlassung (temporary agency work), in Switzerland Personalverleih.
• Freelancing: the professional works independently within the agreed mandate.

Whether a specific assignment counts as outsourcing for regulatory purposes is assessed and documented by the institution case by case. Alpinum does not offer managed services with responsibility for results: Alpinum provides professionals and teams, while direction and responsibility for results remain with the client.

What can be outsourced and what stays with the company

Operational, well-defined tasks are the main candidates for outsourcing. Responsibility, and anything involving decisions about risks and client relationships, stays with the company.

The rules in Switzerland and Germany

Switzerland and Germany both require responsibility to remain with the company, but the routes differ.

In Austria, according to the circular of the Financial Market Authority (FMA), the function of the money laundering officer may be outsourced if responsibility stays with the company, an internal contact exists and the FMA is notified in writing.

How to proceed: six steps

1. Inventory the tasks: which compliance activities arise, at what volume and with which deadlines?
2. Allocate responsibility: record for each task who decides and who executes.
3. Check the regulatory position: is the task material, notifiable or excluded? Document the result.
4. Choose the form: an ongoing, well-defined process suits outsourcing; a project, backlog, vacancy or peak suits temporary reinforcement inside the team.
5. Draft the contract: scope, instruction and control rights, data protection, confidentiality, audit rights and exit.
6. Monitor: check quality through sampling, metrics and regular reporting to management.

Roles and capacity

Temporary reinforcement needs roles at every level: analysts (junior to experienced) for KYC files, screening and alerts; compliance officers for policies, training and controls; team leads to run larger teams; and senior profiles for interim leadership roles. Professionals can also take on formal functions, such as data protection officer or compliance officer with regulatory responsibility, through staff leasing or freelancing. For the money laundering reporting officer or the Swiss AML function, regulatory requirements may rule out an external mandate or require staff leasing.

A real assignment shows the scale: in 2025, a taskforce of 8 full-time staff on staff leasing worked on KYC remediation and transaction monitoring at a financial institution; the team lead reported to internal compliance and the project was completed in 10 months. The details are in the case study KYC file review with transaction analysis. The guide interim MLRO or AML project team covers the options for anti-money laundering roles in more depth.

Limits and risks

• Responsibility cannot be transferred: in both countries, management and line remain accountable even when a provider does the work.
• Notification and documentation duties: an outsourcing that was not notified or documented is a regulatory finding.
• Dependency on the provider: without internal knowledge, quality and results cannot be assessed. An internal contact is both a requirement and good practice.
• Data: client data, banking secrecy and data protection require clear rules on access and storage.
• No legal advice: Alpinum provides professionals and does not give legal advice as a law firm. The regulatory classification is for the institution to make.

Frequently asked questions about compliance outsourcing

Can a Swiss bank outsource its entire compliance function?

No. Under FINMA Circular 2018/3, operational compliance tasks can be outsourced in all supervisory categories, but overall management, central management tasks and strategic decisions cannot. Banks and insurers in categories 1–3 also need an independent compliance function. What can be outsourced is the execution, not the responsibility.

Can the money laundering reporting officer in Germany be external?

Yes, under conditions. Under section 6(7) GwG and BaFin's interpretation guidance (July 2025), the function of the money laundering reporting officer can be outsourced. It must be notified at least two weeks before the start, there must be an internal contact, and it always counts as material outsourcing. Responsibility remains with the obliged entity.

Is an interim compliance professional a form of outsourcing?

That depends on how the assignment is set up and is assessed and documented by the institution case by case. Under staff leasing, the professional is integrated into your organisation and you direct the work; in Germany, MaRisk AT 7.1 treats temporary agency workers as part of staffing. Under freelancing, the professional works independently within the mandate.

Which compliance tasks are best suited to external support?

Good candidates are high-volume tasks with clear rules: KYC remediation, alert backlogs, screening, policy reviews and training programmes. They can be managed through guidelines, sampling and metrics. Decisions on client relationships, suspicious activity reports and risk appetite stay in-house.

How quickly can an interim compliance team be in place?

At Alpinum, selected profiles are usually available within 48 hours; the client and Alpinum agree the start date together. In the KYC case study, the team started around two weeks after the order. System access, a review protocol and an internal contact determine how fast the team gets up to speed.

Next step

Describe the tasks, volume and deadlines; we will show which roles and which model fit your needs. The regulatory classification stays with you.

• General compliance & compliance management
• AML, KYC & financial crime compliance
• Legal outsourcing: which in-house legal tasks can be outsourced
• Costs & procurement: all guides on costs, providers and selection
• Discuss your needs

Last updated: 10 November 2026.