Regulation 18

the risks of money laundering, the financing of terrorism and proliferation financing; and

the size of the law practice.

take appropriate steps to identify, assess and understand the risks of money laundering, the financing of terrorism and proliferation financing, in relation to —

the law practice’s clients;

the countries, territories or jurisdictions that the law practice’s clients are from or in, or have operations in; and

the law practice’s products, services, transactions and delivery channels;

for the purposes of sub-paragraph (a) —

document the risk assessments;

consider all relevant risk factors before determining the overall level of risk and the appropriate type and extent of mitigation to be applied;

keep the risk assessments up to date; and

provide the risk assessments to the Council upon the Council’s request;

develop and implement internal policies, procedures and controls, which must be approved by the law practice’s senior management, including —

making appropriate compliance management arrangements; and

applying adequate screening procedures when hiring employees,to manage and mitigate the risks of money laundering, the financing of terrorism and proliferation financing identified by the law practice or notified to the law practice by the Society or Director of Legal Services;

obtain confirmation of the implementation, and the review, by an independent party of the internal policies, procedures and controls referred to in sub-paragraph (c);

take enhanced measures to manage and mitigate the risks of money laundering, the financing of terrorism and proliferation financing where higher risks are identified;

have an ongoing programme to train the law practice’s partners, directors and employees on —

the laws and regulations relating to the prevention of money laundering, the financing of terrorism and proliferation financing; and

the internal policies, procedures and controls mentioned in sub-paragraph (c); and

monitor the implementation of the internal policies, procedures and controls mentioned in sub-paragraph (c) and enhance the internal policies, procedures and controls (if necessary).