26CReporting entities must undertake an ML/TF risk assessment

26C  Reporting entities must undertake an ML/TF risk assessment

 (1) A reporting entity must undertake an assessment (an ML/TF risk assessment) that identifies and assesses the risks of money laundering, financing of terrorism and proliferation financing that the reporting entity may reasonably face in providing its designated services.

 (2) The steps taken by a reporting entity in relation to undertaking the reporting entity’s ML/TF risk assessment must be appropriate to the nature, size and complexity of the reporting entity’s business.

Additional obligations that apply to reporting entities that provide designated services at or through permanent establishments in Australia

 (3) If the reporting entity provides designated services at or through a permanent establishment of the reporting entity in Australia, the reporting entity must have regard to the following matters in undertaking an ML/TF risk assessment:

 (a) the kinds of designated services provided, or proposed to be provided, by the reporting entity, including any new or emerging technologies relating to those services;

 (b) the kinds of customers to whom the reporting entity’s designated services are or will be provided;

 (c) the delivery channels by which the reporting entity’s designated services are or will be provided, including any new or emerging technologies relating to those delivery channels;

 (d) the countries with which the reporting entity deals, or will deal, in providing its designated services;

 (e) information communicated either directly or indirectly by AUSTRAC to the reporting entity that identifies or assesses the risks associated with the reporting entity’s provision of its designated services;

 (f) the matters (if any) specified in the AML/CTF Rules.

 (4) Subsection (3) does not limit subsection (1).