57Minimum requirements for AML/CFT programmes

1. A reporting entity’s AML/CFT programme must be in writing and be based on the risk assessment undertaken in accordance with section 58 and include adequate and effective procedures, policies, and controls for—

2. vetting—
   1. senior managers:
   2. the AML/CFT compliance officer:
   3. any other employee that is engaged in AML/CFT related duties; and
3. training on AML/CFT matters for the following employees:
   1. senior managers:
   2. the AML/CFT compliance officer:
   3. any other employee that is engaged in AML/CFT related duties; and
4. complying with customer due diligence requirements (including ongoing customer due diligence and account monitoring); and
5. reporting suspicious activities; and
6. reporting prescribed transactions; and
7. record keeping; and
8. setting out what the reporting entity needs to do, or continue to do, to manage and mitigate the risks of money laundering and the financing of terrorism; and
9. examining, and keeping written findings relating to,—
   1. complex or unusually large transactions; and
   2. unusual patterns of transactions that have no apparent economic or visible lawful purpose; and
   3. any other activity that the reporting entity regards as being particularly likely by its nature to be related to money laundering or the financing of terrorism; and
10. monitoring, examining, and keeping written findings relating to business relationships and transactions from or in countries that do not have or have insufficient anti-money laundering or countering financing of terrorism systems in place and have additional measures for dealing with or restricting dealings with such countries; and
11. preventing the use, for money laundering or the financing of terrorism, of products (for example, the misuse of technology) and transactions (for example, non-face-to-face business relationships or transactions) that might favour anonymity; and
12. determining when enhanced customer due diligence is required and when simplified customer due diligence might be permitted; and
13. providing when a person who is not the reporting entity may, and setting out the procedures for the person to, conduct the relevant customer due diligence on behalf of the reporting entity; and
14. monitoring and managing compliance with, and the internal communication of and training in, those procedures, policies, and controls.

15. In developing an AML/CFT programme, a reporting entity must have regard to any applicable guidance material produced by AML/CFT supervisors or the Commissioner relating to AML/CFT programmes.