Internal controls

The level of internal controls and extent to which monitoring needs to take place will be affected by:

• The size of the business
• The nature, scale and complexity of its operations
• Its overall risk profile

Issues which may be covered in an internal controls system include:

• The level of personnel permitted to exercise discretion on the risk-based application of the 2007 Regulations, and under what circumstances
• CDD requirements to be met for simplified, standard and enhanced due diligence
• When outsourcing of CDD obligations or reliance will be permitted, and under what conditions
• How the business will restrict work being conducted on a file where CDD has not been completed
• The circumstances in which delayed CDD is permitted
• When cash payments will be accepted
• When payments will be accepted from or made to third parties
• The manner in which disclosures are to be made to the MLRO