(1) A financial institution or person engaged in other business activity shall conduct a risk assessment of its operations in relation to money laundering, terrorist financing and proliferation financing by identifying, assessing and understanding the money laundering or other criminal conduct risks posed by —
(a) existing or potential customers;
(b) countries or geographic areas;
(c) products, services or transactions; or
(d) delivery channels for products, services or transactions.
(2) Where a financial institution or person engaged in other business activity conducts a risk assessment in relation to money laundering or other criminal conduct under subsection (1), that financial institution or person engaged in other business activity shall —
(a) document the risk assessment;
(b) consider the relevant risk factors, including the risks identified by the country's national risk assessment, before determining the level of overall risk and the appropriate level and type of mitigation to be applied;
(c) keep the risk assessment up-to-date;
(d) develop appropriate mechanisms to provide risk assessment information to the Authority.
(Inserted by Act 16 of 2021)