· Jurisdiction Briefing · 6 min read

Qatar: when a QFC firm may rely on an introducer’s CDD, and why its senior management stays responsible

Illustration for “Qatar: when a QFC firm may rely on an introducer's CDD, and why its senior management stays responsible”

A firm in the Qatar Financial Centre can take on a customer without conducting customer due diligence (CDD) itself, if the customer arrives by one of three routes in the Anti-Money Laundering and Combating the Financing of Terrorism Rules 2019 (AML/CFTR): an introducer, a group company or an intermediary. Each route has its own conditions. None of them moves responsibility away from the firm.

This briefing relies on Version 6 of the AML/CFTR, effective 1 May 2026, the consolidated rulebook text and the current version on the QFC Regulatory Authority’s (QFCRA) rulebook when checked on 2 November 2026. It is not news. The rules’ amendment history lists no amendment to rules 3.4.7 to 3.4.12, and their text is the same in Version 5. It is a reference to the rules as they stand.

First, check that it is reliance at all

Division 3.4.B (“Reliance on others generally”) does not apply to CDD conducted for the firm by a third-party service provider under an outsourcing, or by an agent under a contractual arrangement between the firm and the agent (rule 3.4.7). It also excludes CDD under a correspondent banking relationship, if the firm is a bank, or a correspondent securities relationship, to which the firm is a party.

Outsourced CDD follows a different rule. Under rule 2.1.7 the firm and its senior management remain responsible for compliance, and the firm must, through a service level agreement or otherwise, ensure that the third party complies with the AML/CFT Law, the rules and the firm’s policies, except so far as the law of another jurisdiction prevents this.

The general rule

Rule 3.4.8 allows a firm to rely on introducers, intermediaries or other third parties to conduct some elements of CDD, or to introduce business, if it does so under, and in accordance with, the Division. Two points apply to every case:

  • The firm, “and, in particular, its senior management”, remains responsible for the proper conduct of CDD and ongoing monitoring for its customers.
  • In deciding whether to rely on a third party, the firm must have regard to any relevant findings published by international organisations, governments and other bodies about the jurisdiction where the third party is located.

The basic CDD requirement in rule 4.3.2 is expressly subject to the three routes below.

The three routes

All three share the same three tests for the third party. It must:

  1. be regulated and supervised, at least for AML and CFT purposes, by the Regulator or an equivalent authority, body or agency in another jurisdiction;
  2. be subject to the AML/CFT Law and the rules, or to equivalent legislation of another jurisdiction; and
  3. be based, or incorporated or otherwise established, in Qatar or a foreign jurisdiction that has an effective AML/CFT regime.

After that they differ:

Introducer (rule 3.4.9)Group introduction (rule 3.4.10)Intermediary (rule 3.4.11)
Who can use itA firmA financial institution in QatarA firm
The third partyIts function is merely to introduce the customerAnother financial institution in the same group, in or outside Qatar; that institution or another in the group has conducted the CDDHas the customer as its own, wherever located; must itself be a firm
Extra testNot subject to a secrecy law or anything else preventing the firm from obtaining information or original documentation it may needNone beyond the information and documents belowNone beyond the information and documents below
InformationReceived from the introducer: all CDD information the firm would need if it had conducted the CDD itselfThe firm has all such informationThe firm has all such information
DocumentsThe firm has, or can immediately obtain on request, a copy of every document it would needSameSame
CertificateAn introducer’s certificate must be receivedNot mentionedNot mentioned
EffectMay rely on the introducer’s CDD; need not conduct CDD itself or obtain the originalsMay rely on the group institution’s CDD; need not conduct CDD itself or obtain the originalsMay treat the intermediary as its customer; need not conduct CDD itself for the intermediary’s customer

Four details are easy to miss.

The introducer’s conditions come before the relationship. The firm must not start the business relationship relying on the concession unless the certificate, the information and the documents condition are all in place (rule 3.4.9 (3)). The Glossary has no definition of “introducer’s certificate”, and the Division does not prescribe a form or its contents.

The group route has a shortcut. The local firm need not satisfy itself on the conditions if the Regulator, or the equivalent authority where the group institution is established, has determined three things (rule 3.4.10 (2)): that the group’s programme, CDD and record-keeping requirements comply with the AML/CFT Law and the rules; that their implementation is subject to effective consolidated supervision; and that group policies adequately mitigate risks related to operations in high risk jurisdictions.

The intermediary route has an express fallback. If the firm is not satisfied that all the conditions are met, it must conduct CDD itself for the customer (rule 3.4.11 (3)). The rule’s example of an intermediary is a fund manager with an active, ongoing business relationship with a customer who holds funds on the customer’s behalf.

“Effective AML/CFT regime” comes with a required test. Rule 3.5.4 requires a firm making that decision to consider three factors, namely legal framework, enforcement and supervision, and international cooperation, having regard to relevant findings published by international organisations, governments and other bodies. Separately, rule 3.5.5 requires a firm to guard against customers or introductions from jurisdictions where the ability to cooperate internationally is impaired, and to apply enhanced CDD and enhanced ongoing monitoring to business relationships from them.

Certified copies are a separate test

Division 3.4.C deals with a narrower question: relying on a third party’s certification of an identification document rather than sighting it. It must be reasonable to rely on that certification, and the certifier must be an individual approved by the firm’s senior management (rule 3.4.12). Senior management may approve someone only if the MLRO has certified being satisfied, on satisfactory documentary evidence, that the individual adheres to appropriate ethical or professional standards, is readily contactable, and conducts their occupation or profession in Qatar or a foreign jurisdiction with an effective AML/CFT regime.

The State layer sits on top

The QFCRA says firms operating in or from the QFC are subject to the Qatar State legislation and the QFC AML/CFT Rules. Law No. (20) of 2019 lets financial institutions and designated non-financial businesses and professions rely on third parties for CDD, and makes them ultimately responsible (Article 12). The Implementing Regulations then set the conditions. When relying on third-party institutions, they must obtain immediately the necessary CDD information; ensure that copies of identification data and other relevant CDD documents will be available on request without delay; ensure the third party is regulated and supervised or monitored and has measures for CDD and record-keeping; and take into consideration information on the level of money laundering and terrorism financing risk in the countries where third parties are based (Article 20). For a third party in the same financial group, supervisory authorities may determine that those requirements are met in stated circumstances (Article 21). We read the English texts, which the QFCRA describes as unofficial translations of the Arabic.

Three things worth doing

These are my suggestions, not requirements of the rules.

  1. Classify every arrangement. List each third party that touches CDD and label it: outsourcing, agent, introducer, group or intermediary. The label decides which rule applies, and a vendor or agent should not be treated as an introducer by default.
  2. Write down why you were satisfied. Rules 3.4.9 to 3.4.11 turn on the firm being satisfied, but the Division does not itself say how to record that. Rule 3.4.4 (2) shows the regulator’s approach elsewhere: a firm relying on electronic verification must keep a record of the basis. I would keep the same for each third party, including the rule 3.5.4 jurisdiction decision, and retain it under rule 7.1.2, which requires records to be kept for at least 10 years after the day they are made and, for customer records, sets longer periods such as 10 years after the day the business relationship ends.
  3. Test “immediately”. The copy-of-every-document condition is only as good as the third party’s ability to deliver. Request a sample periodically, and agree your own form of introducer’s certificate, since the rules do not supply one.

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

Share LinkedIn X Email

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@infosystems.mu
We will get back to you to arrange a time.