The solution provider is. That is the beauty of this setup. You are not legally responsible for any such issues as AML, CFT, PF, KYC, KYCC, CIP, Compliance. All the 3-letter acronyms you can throw at it, the service provider is responsible for it. You are not responsible for such areas.
Needless to say, if you are a licensed entity, then you are responsible for regulatory compliance.