reg 19A Policies, controls and procedures in relation to proliferation financing
(1) A relevant person must— (a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of proliferation financing identified in any risk assessment undertaken by the relevant person under regulation 18A(1); (b) regularly review and update the policies, controls and procedures established under sub-paragraph (a); (c) maintain a record in writing of— (i) the policies, controls and procedures established under sub-paragraph (a); (ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and (iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business. (2) The policies, controls and procedures adopted by a relevant person under paragraph (1) must be— (a) proportionate with regard to the size and nature of the relevant person’s business; and (b) approved by its senior management. (3) The policies, controls and procedures referred to in paragraph (1) must include— (a) risk management practices; (b) internal controls (see regulations 21 to 24) ; (c) the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures. (4) The policies, controls and procedures referred to in paragraph (1) must include policies, controls and procedures— (a) which provide for the identification and scrutiny of— (i) any case where— (aa) a transaction is complex or unusually large, or there is an unusual pattern of transactions; or (bb) the transaction or transactions have no apparent economic or legal purpose, and (ii) any other activity or situation which the relevant person regards as particularly likely by its nature to be related to proliferation financing; (b) which specify the taking of additional measures, where appropriate, to prevent the use for proliferation financing of products and transactions which might favour anonymity; (c) which ensure that when new products, new business practices (including new delivery mechanisms) or new technology are adopted by the relevant person, appropriate measures are taken in preparation for, and during, the adoption of such products, practices or technology to assess and if necessary mitigate any proliferation financing risks this new product, practice or technology may cause; (d) which, in the case of a money service business that uses agents for the purpose of its business, ensure that appropriate measures are taken by the business to assess— (i) whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58 ; and (ii) the extent of the risk that the agent may be used for proliferation financing. (5) A relevant person must, where relevant, communicate the policies, controls and procedures which it establishes and maintains in accordance with this regulation to its branches and subsidiary undertakings which are located outside the United Kingdom.