(1) A relevant person must -
(a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of proliferation financing identified in any risk assessment undertaken by the relevant person under regulation 18A(1);
(b) regularly review and update the policies, controls and procedures established under sub-paragraph (a);
(c) maintain a record in writing of -
(i) the policies, controls and procedures established under sub-paragraph (a);
(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and
(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person's business.
(2) The policies, controls and procedures adopted by a relevant person under paragraph (1) must be -
(a) proportionate with regard to the size and nature of the relevant person's business; and
(b) approved by its senior management.
(3) The pol
…