26DReporting entities must review and update ML/TF risk assessment

26D  Reporting entities must review and update ML/TF risk assessment

Review of ML/TF risk assessment

 (1) A reporting entity must review its ML/TF risk assessment for the purpose of identifying and assessing any new or changed risks of money laundering, financing of terrorism and proliferation financing that the reporting entity may reasonably face in providing its designated services:

 (a) if any of the following occur:

 (i) there is a significant change to any of the matters mentioned in subsection 26C(3);

 (ii) AUSTRAC communicates to the reporting entity information that identifies or assesses risks associated with the reporting entity’s provision of its designated services;

 (iii) circumstances specified in the AML/CTF Rules; and

 (b) in any event—at least once every 3 years.

 (2) The review must be undertaken:

 (a) for a significant change that is within the control of the reporting entity—before the significant change occurs; or

 (b) for a significant change that is not within the control of the reporting entity—as soon as practicable after the significant change occurs; or

 (c) for information communicated for the purposes of subparagraph (1)(a)(ii)—as soon as practicable after the information is communicated to the reporting entity; or

 (d) for circumstances specified in the AML/CTF Rules—at the time, or within the period, specified in the AML/CTF Rules.

 (3) The review must be appropriate to the nature, size and complexity of the reporting entity’s business.

Updating ML/TF risk assessment

 (4) A reporting entity must update its ML/TF risk assessment to address any issues identified by a review:

 (a) for a significant change that is within the control of the reporting entity—before the significant change occurs; or

 (b) in any other case—as soon as practicable after the review is completed.