5‑17 Policies relating to the obligation5‑17 Policies relating to the obligations of ordering institutions

5‑17 Policies relating to the obligations of ordering institutions

Scope (1) This section applies if a reporting entity is to provide a designated service covered by item 29 of table 1 in section 6 of the Act as an ordering institution. Policies relating to all transfers of value (2) For the purposes of paragraph 26F(4)(g) of the Act, the AML/CTF policies of the reporting entity must set out systems and controls to enable the reporting entity to comply with its obligation under subsection 64(5) of the Act to provide information to another institution in the value transfer chain as soon as practicable after receiving a request. (3) For the purposes of paragraph 26F(7)(b) of the Act, the AML/CTF policies of a reporting entity are taken to comply with the matters mentioned in subsection (2) in relation to the provision of information if they require provision of the information within 3 business days after receiving sufficient information from the other institution to process the request. Policies relating to merchant payments (4) Subsection (5) applies if: (a) the designated service relates to a merchant payment; and (b) the designated service is provided at or through a permanent establishment of the reporting entity in Australia. (5) For the purposes of paragraph 26F(1)(d) of the Act, the AML/CTF policies of a reporting entity must enable the reporting entity to provide the following information to another institution in the value transfer chain within 3 business days after receiving a request from the institution for that information: (a) the reporting entity’s full name; (b) the permanent establishment at or through which it provided the designated service. Policies relating to virtual asset transfers (6) For the purposes of paragraph 26F(3)(e) of the Act, the AML/CTF policies of a reporting entity must deal with the following if the designated service relates to the transfer of a virtual asset: (a) how the reporting entity will undertake due diligence to determine, for the purposes of subsection 66A(2) of the Act: (i) whether the wallet to which the virtual asset is being transferred is a custodial wallet or a self‑hosted wallet; and (ii) if the wallet is a custodial wallet—whether the person who controls the wallet is required to be licensed or registered under a law that gives effect to the FATF Recommendations, and, if the person is so required, whether the person is so licensed or registered; (b) if the person who controls the wallet is a person licensed or registered under a law that gives effect to the FATF Recommendations, or a person not required to be so licensed or registered—how the reporting entity will determine whether the beneficiary institution is capable of: (i) securely receiving the information that the reporting entity is required to pass on under subsection 64(3) of the Act; and (ii) safeguarding the confidentiality of that information; (c) if the wallet is a self‑hosted wallet—how the reporting entity will identify the payee and any steps the reporting entity will take to verify the person who controls the wallet; (d) how the reporting entity will manage and mitigate the ML/TF risk of transferring the virtual asset if the person who controls the wallet is: (i) the payee (in a case where the person who controls the wallet has not been verified); or (ii) a person not required to be licensed or registered under a law that gives effect to the FATF Recommendations.