Carry out AML/CFT business risk assessments at least every three months and on significant change, covering new and existing virtual assets (especially anonymity-enhanced ones), related technologies and products, business practices, other technologies such as AI and emerging risks, with results shown to drive policies, controls and resource allocation; firms enabling anonymity-enhanced transactions need enhanced controls and six-monthly verified enhanced due diligence on users, or must not offer them. Client risk assessments, with documented rating criteria, actions by risk tier and audit trails, are also required at least every three months.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.