(1) Each regulator must prepare and issue a statement of its policy with respect to -

(a) the imposition of penalties under section 63A; and

(b) the amount of penalties under that section.

(2) Each regulator's policy in determining whether a penalty should be imposed, and what the amount of a penalty should be, must include having regard to -

(a) the conduct of the person on whom the penalty is to be imposed;

(b) the extent to which the person could reasonably be expected to have known that a controlled function was performed without approval;

(c) the length of the period during which the person performed a controlled function without approval; and

(d) whether the person on whom the penalty is to be imposed is an individual.

(3) Each regulator's policy in determining whether a penalty should be imposed on a person must also include having regard to the appropriateness of taking action against the person instead of, or in addition to, taking action against an authorised person.