why does the bank ask about intermediaries in my business
Why the bank asks about agents and intermediaries
This is usually not a question about your service provision, but about the chain around it: the bank wants to know through which parties it indirectly faces risk. If you work with agents, resellers or other intermediaries who act on your behalf or receive money, the bank wants to know who they are, what they do and whether you keep track of their integrity. This is consistent with the client due diligence that banks must conduct for every business relationship — not only for you, but also for the parties connected to you.
In practice you often get sub-questions: how many intermediaries are there, in which countries are they located, and is there control over who acts on your behalf externally. The latter relates to in which countries the enterprise has establishments — an intermediary in another country often attracts extra attention, regardless of what that person actually does. If you have no agents or intermediaries, the answer is simply "no" and there is nothing to substantiate. If you do work with them, it helps if you have a current overview: name, role, and whether they are authorised to incur obligations on your behalf.
Where this comes from: the bank's client due diligence
There is no public standard list that prescribes this exactly — this follows from the bank's own duty of inquiry, not from a standard included as a source in the chain file. What is fixed and often serves as a basis is the formal identity of your enterprise: the statutory name and your registration number with the Chamber of Commerce, as recorded in accordance with the Trade Register Act 2007. Intermediaries that do not appear in that register are often reason for the bank to ask a follow-up question. If you do not have a firm answer to this question at hand, it is customary to pass the question on to whoever in your company does know this, rather than making a guess.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.