S.L. 373.1 Art. 5Risk-assessment.  Amended:  L.N. 430 of 2018; L.N. 26 of 2020.  Cap. 373.     Cap. 9

(1) Every subject person shall take appropriate steps, proportionate to the nature and size of its business, to identify and assess the risks of money laundering and funding of terrorism that arise out of its activities or business, taking into account risk factors including those relating to customers, countries or geographical areas, products, services, transactions and delivery channels and shall furthermore take into consideration any national or supranational risk assessments relating to risks of money laundering and the funding of terrorism.

(2) Where the Financial Intelligence Analysis Unit considers the risk of money laundering and the funding of terrorism inherent in any particular relevant activity or relevant financial business to be clear and understood, it may exempt subject persons carrying out such relevant activity or relevant financial business from the obligation to perform risk assessments under this regulation.

(3) The risk assessment referred to in sub-regulation (1) shall be properly documented, and shall be made available to the Financial Intelligence Analysis Unit and any other relevant supervisory authority upon demand.

(4) Subject persons shall ensure that the risk assessment carried out in terms of sub-regulation (1) is regularly reviewed and kept up-to-date. AND FUNDING OF TERRORISM

(5) Every subject person shall: –

(a) have in place and implement the following measures, policies, controls and procedures, proportionate to the nature and size of its business, which address the risks identified as a result of the risk assessment referred to in sub-regulation (1):

(i) customer due diligence measures, record-keeping procedures and reporting procedures;

(ii) risk management measures including customer acceptance policies, customer risk assessment procedures, internal controls, compliance management, communications, employee screening policies and procedures;

(b) take appropriate and proportionate measures from time to time for the purpose of making employees aware of –

(i) the measures, policies, controls and procedures under the provisions of paragraph (a) and any other relevant policies that are maintained by the subject person; and

(ii) the provisions of the Prevention of

Money Laundering Act and of these regulations; of the

Sub-Title IV A "Of Acts of Terrorism, Funding of

Terrorism and Ancillary Offences" of Title IX of Part II

of Book First of the Criminal Code; and of data protection requirements;

(c) appoint, where appropriate with regard to the nature and size of the business, an officer at management level whose duties shall include the monitoring of the day-to-day implementation of the measures, policies, controls and procedures adopted under this regulation;

(d) implement, where appropriate with regard to the size and nature of the business, an independent audit function to test the internal measures, policies, controls and procedures;

(e) provide employees from time to time with training in the recognition and handling of operations and transactions which may be related to proceeds of criminal activity, money laundering or the funding of terrorism;

(f) monitor and where appropriate enhance the measures, policies, controls and procedures adopted to better achieve their intended purpose.

(6) To the extent that it may be applicable, any measures, policies, controls, procedures and changes thereto shall be adopted and implemented following senior management approval, and, where applicable, the management body of the subject person may identify one of its members who is to be responsible for the implementation of these measures, policies, controls and procedures.

(7) In this regulation, the term ''employees'' means those employees whose duties include the handling of either relevant financial business or relevant activity.

(8) Where a natural person undertakes any of the professional activities as defined under ‘relevant activity’ in regulation 2 as an employee of a legal person, the obligations under this regulation shall apply to that legal person.