Article 9 – Scope of internal policies, procedures and controls

(i)

the carrying out and updating of the business-wide risk assessment;

(ii)

the obliged entity’s risk management framework;

(iii)

customer due diligence to implement Chapter III of this Regulation, including procedures to determine whether the customer, the beneficial owner, or the person on whose behalf or for the benefit of whom a transaction or activity is being conducted, is a politically exposed person or a family member or person known to be a close associate;

(iv)

reporting of suspicious transactions;

(v)

outsourcing and reliance on customer due diligence performed by other obliged entities;

(vi)

record retention and policies in relation to the processing of personal data pursuant to Articles 76 and 77;

(vii)

the monitoring and management of compliance with such internal policies and procedures in accordance with point (b) of this paragraph, the identification and management of deficiencies and the implementation of remedial actions;

(viii)

the verification, proportionate to the risks associated with the tasks and functions to be performed, when recruiting and assigning staff to certain tasks and functions and when appointing agents and distributors, that those persons are of good repute;

(ix)

the internal communication of the obliged entity’s internal policies, procedures and controls, including to its agents, distributors and service providers involved in the implementation of its AML/CFT policies;

(x)

a policy on the training of employees and, where relevant, agents and distributors with regard to measures in place in the obliged entity to comply with the requirements of this Regulation, Regulation (EU) 2023/1113 and any administrative act issued by any supervisor;