Document ID: chunk:federal_register_of_legislation:F2024C01198:body:0:p58
Version: federal_register_of_legislation:F2024C01198
Segment Type: other
Provision Reference: 
Character Range: 161765–164833

8.1.3 Some of the requirements specified in these Rules may be complied with by a reporting entity putting in place appropriate risk‑based systems or controls. When determining and putting in place appropriate risk‑based systems or controls, the reporting entity must have regard to the nature, size and complexity of its business and the type of ML/TF risk that it might reasonably face.

     8.1.4 For the purposes of these Rules, in identifying its ML/TF risk a reporting entity must consider the risk posed by the following factors:

         (1) its customer types, including any politically exposed persons;

         (2) the types of designated services it provides;

         (3) the methods by which it delivers designated services; and

         (4) the foreign jurisdictions with which it deals.

     8.1.5 Part A must be designed to enable the reporting entity to:

         (1) understand the nature and purpose of the business relationship with its customer types, including, as appropriate, the collection of information relevant to that understanding; and

         (2) understand the control structure of non-individual customers;

         (3) identify significant changes in ML/TF risk for the purposes of its Part A and Part B programs, including:

            (a) risks identified by consideration of the factors in paragraph 8.1.4; and

            (b) risks arising from changes in the nature of the business relationship, control structure, or beneficial ownership of its customers; and

         (4) recognise such changes in ML/TF risk for the purposes of the requirements of its Part A and Part B programs; and

         (5) identify, mitigate and manage any ML/TF risk arising from:

            (a) all new designated services prior to introducing them to the market;

            (b) all new methods of designated service delivery prior to adopting them;

            (c) all new or developing technologies used for the provision of a designated service prior to adopting them; and

            (d) changes arising in the nature of the business relationship, control structure or beneficial ownership of its customers.

     8.1.6 Part A must include a requirement that, in determining what is an appropriate risk‑based procedure for inclusion in Part B of the reporting entity's standard AML/CTF program, the reporting entity must have regard to ML/TF risk relevant to the provision of the designated service.

    Application

     8.1.7 Unless otherwise provided in the AML/CTF Act or these Rules, a reporting entity must apply Part A to all areas of its business that are involved in the provision of a designated service, including in relation to any function carried out by a third party.
          Part 8.2 AML/CTF risk awareness training program

     8.2.1 Part A must include an AML/CTF risk awareness training program that meets the requirements of paragraphs 8.2.2 to 8.2.3 below.

     8.2.2 The AML/CTF risk awareness training program must be designed so that the reporting entity gives its employees