A reporting entity must develop and maintain AML/CTF policies (policies, procedures, systems and controls) that appropriately manage and mitigate its ML, TF and proliferation financing risks, ensure it complies with the Act, the regulations and the Rules, are appropriate to the nature, size and complexity of its business and meet any Rules requirements. Together with the ML/TF risk assessment they form its AML/CTF program (s 26B), which replaced the former Part A and Part B program from 31 March 2026 (1 July 2026 for newly regulated tranche 2 services). It must not commence to provide a designated service unless it complies (s 26F(8), a civil penalty per service or per day offshore). Specific proliferation financing controls are not required where the entity reasonably assesses that risk as low and manageable through its ML and TF controls, a legal burden it carries (s 26F(11) and (12)). A holder of an Australian financial services licence providing only item 54 arranging services needs only risk-appropriate initial CDD policies (s 26T).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.