Covers Reporting entities providing designated financial, payment, remittance, digital-asset and newly regulated professional services.

The main requirements are to conduct initial and ongoing CDD; identify beneficial owners; maintain an AML/CTF program; screen and monitor customers; apply transfer-information controls.

Customer due diligence builds a reliable picture of the person or organisation receiving a financial service. Collecting a name is different from verifying identity, and identifying a company's registered owner is different from understanding its ultimate beneficial owners or controllers. The purpose and expected use of the relationship provide context for assessing later transactions.

Risk-based treatment changes the depth and frequency of the work. Higher-risk circumstances can require additional information or enhanced review, while any simplified approach remains subject to the conditions of the governing framework. Customer information also changes over time: ownership, representatives, business activity and expected payment patterns can all affect the original assessment.

The operational outcome is a documented relationship between identity evidence, the risk decision and ongoing monitoring. Onboarding should feed the transaction-review process, and unusual activity should feed back into the customer assessment. Due diligence is therefore an ongoing information and decision-making process, rather than a one-time collection of documents or a name-screening result.

The instrument also addresses reporting and evidence: submit suspicious matter, threshold transaction and international funds-transfer reports and retain prescribed records.