For services through an Australian permanent establishment the AML/CTF policies must deal with identifying significant changes to the s 26C(3) risk matters, carrying out customer due diligence under Part 2, reviewing and updating the policies after a risk assessment review and after an independent evaluation report with adverse findings on the policies (Rules 5-4), and reviewing the policies at least once every 3 years. Rules 5-2 requires the policies to set out when the entity will collect, or collect and verify, each kind of KYC information for initial and for ongoing CDD, including when it will collect or verify source of wealth and source of funds.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.