To establish the s 28(2) matters the entity must: for an individual, take reasonable steps to establish the customer is who they claim to be; identify the customer's ML/TF risk from KYC information reasonably available before commencing, taking into account (for Australian establishments) its ML/TF risk assessment, the kind of customer, the designated services, the delivery channels, the countries dealt with and Rules matters; collect KYC information appropriate to that risk; and verify, using reliable and independent data, so much of it as is appropriate to that risk. Collection and verification may be done by an agent, the entity remaining liable (s 37). Where an individual genuinely cannot obtain or access identity evidence, the matter is taken to be established if reasonable steps were taken, the risk-based steps were followed using reasonably available data and additional risk is managed under the policies (Rules 6-10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.