For business relationships the entity must review and where appropriate update its assessment of the customer's ML/TF risk when a s 28(4) risk matter changes significantly, when unusual transactions or behaviours arise, and when the Rules require (a nested services customer at least every 2 years); and review, update and reverify KYC information at a frequency appropriate to the customer's risk, when it doubts the adequacy or veracity of KYC information, and when the Rules require (a customer or associated person becoming a foreign PEP, or a high-risk domestic or international organisation PEP, Rules 6-24; nested services customers every 2 years or when a new kind of nested service starts, Rules 6-26). Where enhanced CDD applies because of high risk, a suspicion or a high-risk jurisdiction, the refresh must ensure source of wealth and funds information is held where relevant (Rules 6-21).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.