KYC, AML, and Client Due Diligence

When an IB refers a client to a forex broker, the KYC and AML obligations remain with the broker -- but the IB's role in the onboarding process creates compliance touchpoints that must be managed carefully. A broker cannot outsource its regulatory KYC responsibility to an IB, yet the IB often serves as the first point of contact and may collect client information, documents, or even preliminary suitability data. How this handoff is structured determines whether the broker maintains compliance or creates gaps.

KYC Responsibility in IB Relationships

Under the EU Anti-Money Laundering Directives (AMLD 5 and the forthcoming AMLD 6), the obligation to verify client identity and assess money laundering risk sits with the regulated entity -- the broker. However, brokers can use third parties, including IBs, to perform certain CDD (customer due diligence) elements, provided the broker retains ultimate responsibility and can demonstrate adequate oversight. This is known as reliance on third parties under Article 25-29 of AMLD 4.

AML Obligations for IB Networks

Multi-tier IB networks create specific AML challenges. When a master IB has 50 sub-IBs, each referring clients independently, the broker must ensure that AML screening covers every client regardless of which IB or sub-IB level originated the referral. The risk is that sub-IBs in higher-risk jurisdictions -- or sub-IBs who themselves have inadequate AML awareness -- introduce clients that the broker would have flagged during direct onboarding.

A CySEC-licensed broker with an IB network spanning 20 countries should implement risk-based CDD tiers. Clients referred from low-risk EEA countries may follow simplified due diligence. Clients from high-risk third countries on the EU's FATF grey list require enhanced due diligence -- additional documentation, source of funds verification, and senior management approval before the account is activated.

Client Suitability and Appropriateness

MiFID II requires brokers to assess whether complex financial instruments (including CFDs and forex margin products) are appropriate for each client. This appropriateness assessment evaluates the client's knowledge and experience with the specific product type. For execution-only services -- which cover most retail forex trading -- the broker must conduct an appropriateness test, though not a full suitability assessment.

• Appropriateness test (execution-only): Assesses client knowledge and experience with the product; mandatory for complex instruments under MiFID II Article 25(3)
• Suitability assessment (advisory services): Required when the IB or broker provides personalized recommendations; covers knowledge, experience, financial situation, and investment objectives
• Client categorization: Retail, professional, or eligible counterparty -- determines the level of protection and disclosure required
• Risk warning acknowledgment: Client must confirm receipt and understanding of standardized risk warnings before trading CFDs or forex on margin
• Negative balance protection: ESMA requires brokers to provide NBP for retail clients -- affects risk calculations in IB commission models

Scaling KYC Without Creating Friction

The tension between compliance thoroughness and onboarding speed is real. A broker that requires 15 documents and a 48-hour review for every IB-referred client will see conversion rates collapse. Quality IBs will move their referrals to brokers with faster onboarding. The solution is risk-based automation: tiered CDD that applies minimal friction to low-risk clients while escalating high-risk referrals to manual review.

Practical implementation means connecting your affiliate management platform's referral tracking to the broker's KYC system. When an IB-referred client arrives, the system should automatically determine the CDD tier based on the client's country, the IB's risk rating, and the product type. Low-risk combinations trigger automated verification (eKYC, document OCR, database checks), completing onboarding in under 10 minutes. High-risk combinations route to a compliance queue with clear SLA targets -- 24 hours for enhanced due diligence, not 5 business days.