reg 18 Risk assessment by relevant persons
(1) A relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. (2) In carrying out the risk assessment required under paragraph (1), a relevant person must take into account— (a) information made available to them by the supervisory authority under regulations 17(9) and 47, and (b) risk factors including factors relating to— (i) its customers; (ii) the countries or geographic areas in which it operates; (iii) its products or services; (iv) its transactions; and (v) its delivery channels. (3) In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business. (4) A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required. (5) A supervisory authority may not give the notification referred to in paragraph (4) unless it considers that the risks of money laundering and terrorist financing applicable to the sector in which the relevant person operates are clear and understood. (6) A relevant person must provide the risk assessment it has prepared under paragraph (1), the information on which that risk assessment was based and any record required to be kept under paragraph (4), to its supervisory authority on request.