First, there is nothing to prevent a current registrant selling a domain to someone acting in bad faith. The only remedies that the UDRP provides are transfer and cancellation, neither of which can affect a party which has already sold the domain.
For the new owner, the three-prong test at UDRP para 4(a) still applies. A complaint will be upheld if
(i) your domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; and
(ii) you have no rights or legitimate interests in respect of the domain name; and
(iii) your domain name has been registered and is being used in bad faith.
In this case, the "you" now refers to the (possibly bad faith) purchaser of a domain from the original (good faith) registrant.
If the new owner has purchased the domain solely for cybersquatting, this clearly satisfies all three prongs (and therefore would likely be transferred). This is the situation regardless of whether it was purchased from a current registrant or registered anew. But if the new owner has legitimate rights in the domain (and therefore does not satisfy prong (ii)), the complaint would not be upheld.
By way of hypothetical example, there was the very famous (but settled well before the UDRP) dispute between Apple (the Beatles' music company) and Apple (the computer company). Both parties owned a trademark for "APPLE" (albeit in different fields).
One day Apple (Music) buys the domain apple.com from a small-town fruit vendor (the original good faith registrant), with a view to preventing Apple (Computer) from having it. This is identical to a trademark in which Apple (Computer) has (and so prong (i) is satisfied). This was done in bad faith to affect Apple (Computer) (and so prong (iii) is satisfied). But Apple (Music) has legitimate interests in the domain, in that they have a business and trademarks of their own by that name. So prong (ii) is not satisfied, and so a complaint would not be upheld. Nor would a complaint be possible against the small-town fruit vendor (since they don't own the domain, so there is no possible remedy against them).