Section 4: Identification of customers.

(1) A financial institution and a designated non-financial business and profession shall—
(a) identify a customer, whether permanent or occasional, natural or legal person or any other form of legal arrangements, using identification documents as may be prescribed in any relevant regulation;
(b) verify the identity of that customer using reliable, independent source documents, data or information;
(c) identify the beneficial owner using relevant information or data obtained from a reliable source such that the financial institution or the designated non- financial business and profession is satisfied that it knows who the beneficial owner is; and
(d) take reasonable measures to verify that any person purporting to act on behalf of the customer is so authorised, identified and verify the identity of that person.
(2) Financial institutions and designated non-financial businesses and professions shall undertake customer due diligence measures when—
(a) establishing business relationships;
(b) carrying out occasional transactions above the applicable designated threshold prescribed by relevant regulations, including transactions carried out in a single operation or in several operations that appear to be linked;
(c) carrying out occasional transactions that are wire transfers;
(d) there is a suspicion of money laundering or terrorist financing, regardless of any exemptions or thresholds; or
(e) the financial institution or designated non-financial business and profession has doubts about the veracity or adequacy of previously obtained customer identification data.
(3) Financial institutions or designated non-financial businesses and professions shall—
(a) conduct ongoing due diligence on a business relationship;
(b) scrutinise transactions undertaken during the course of the relationship to ensure that the transactions are consistent with the institution’s knowledge of the customer, their business and risk profile and where necessary, the source of funds; and
(c) ensure that documents, data or information collected under the customer due diligence process is kept up-to-date and relevant by undertaking reviews of existing records, particularly for higher risk categories of customers or business relationships.
(4) Financial institutions and designated non-financial businesses and professions shall take appropriate measures to manage and mitigate the risks and—
(a) where higher risks are identified, apply enhanced measures to manage and mitigate the risk;
(b) where lower risks are identified, take simplified measures to manage and mitigate the risks, provided that simplified customer due diligent measures are not permitted whenever there is suspicion of money laundering or terrorist financing; and
(c) in the case of cross-border correspondent banking and other similar relationships and in addition to carrying out customer due diligence measures—
(i) gather sufficient information about a respondent institution,
(ii) assess the respondent institution’s anti-money laundering and combating the financing of terrorism controls,
(iii) document respective responsibilities of each institution in this regard, and
(iv) obtain management approval before establishing new correspondent relationships.
(5) A casual customer shall comply with the provisions of subsection (2) for any number or manner of transactions including wire transfer involving a sum exceeding US$1,000 or its equivalent if the total amount is known at the commencement of the transaction or as soon as it is known to exceed the sum of US$1,000 or its equivalent.
(6) Where a financial institution or designated non-financial business and profession suspects or has reasonable grounds to suspect that the amount involved in a transaction is the proceeds of a crime or an illegal act, it shall require identification of the customer notwithstanding that the amount involved in the transaction is less than US$1,000 or its equivalent.
(7) Financial institutions or designated non-financial business and profession shall put in place appropriate risk management systems and procedures to determine whether a customer or the beneficial owner of a customer is a politically exposed person.
(8) In relation to a foreign politically exposed person, the financial institution or designated non-financial institution shall in addition to the requirements of subsections (1) and (2)—
(a) obtain senior management approval before establishing (or continuing, for existing customers) such business relationships;
(b) take reasonable measures to establish the source of wealth and the source of funds of customers and beneficial owners identified as politically exposed persons; and
(c) conduct enhanced ongoing monitoring on that relationship.
(9) In relation to a domestic politically exposed persons or person who has been entrusted with a prominent function by an international organisation, the financial institution or designated non-financial institution shall in addition to the requirements of subsections (1) and (2), adopt the measures under subsection (8), where there is higher risk business relationship with such a person.