An AML/CFT programme sets out a reporting entity’s internal policies, procedures and controls to detect money laundering and financing of terrorism and to manage and mitigate the risk of it occurring. The programme must be in writing and be based on its risk assessment. Certain elements of a programme are specifically required by the Regulations, including: i. Vetting senior managers and AML staff; ii. Training senior managers and AML staff; iii. Customer due diligence, including enhanced CDD and simplified CDD; iv. Reporting suspicious transactions; v. Monitoring and record keeping; vi. Monitoring and managing compliance with the AML/CFT programme. Risk-based systems and controls should be based on the nature, size and complexity of a reporting entity’s business, along with any money laundering and financing of terrorism risks it may face.