(1) A relevant person must take appropriate steps to identify and assess the risks of proliferation financing to which its business is subject.
(2) In carrying out the risk assessment required under paragraph (1), a relevant person must take into account -
(a) information in the report referred to in regulation 16A (risk assessment by the Treasury); and
(b) risk factors including factors relating to -
(i) its customers;
(ii) the countries or geographic areas in which it operates;
(iii) its products or services;
(iv) its transactions; and
(v) its delivery channels.
(3) In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business.
(4) A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required.
(5) A relevant person must provide the risk assessment it has prepared under p
…