(1) A relevant person must -
(a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1);
(b) regularly review and update the policies, controls and procedures established under sub-paragraph (a);
(c) maintain a record in writing of -
(i) the policies, controls and procedures established under sub-paragraph (a);
(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and
(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business.
(2) The policies, controls and procedures adopted by a relevant person under paragraph (1) must be -
(a) proportionate with regard to the size and nature of the relevant person’s business, and
(b) approved by its senior man
…