Workspaces / Demonstration library / obligations
Obligations register
Every sentence in the workspace that states a duty (must, shall, is required to, within, no later than), split into who, what, condition and deadline, with the cited source. Use it as a starting register: a person must confirm each row against the source.
47 obligations
| Ref | Actor | Modality | Action | Condition | Deadline | Source |
|---|---|---|---|---|---|---|
| OB-001 | Enhanced CDD measures | obligation | be targeted to the customer’s specific ML/TF risks, proportionate to the risk level, effective at managing and mitigating the risk, and appropriate to the duration of the risk | [A01] AUSTRAC, Enhanced Customer Due Diligence Overview | ||
| OB-002 | AML/CTF policies | obligation | set out the policies, procedures, systems and controls for applying enhanced CDD | [A01] AUSTRAC, Enhanced Customer Due Diligence Overview | ||
| OB-003 | enhanced CDD | obligation | be applied in specified circumstances, including ; when a foreign politically exposed person (PEP) is the customer, beneficial owner, person on whose behalf the designated service is received, or person acting on behalf of the customer; when relevant persons are physically present in or formed in a | when the customer’s ML/TF risk is high | [A02] AUSTRAC, When Enhanced CDD Must Be Applied | |
| OB-004 | Enhanced CDD measures | obligation | be documented, including the circumstances requiring ECDD, reasons for measures, information collected, verification performed, SMR submission, changes to risk assessment, and decisions to mitigate risk or stop providing a designated service | [A04] AUSTRAC, Source of Funds, Source of Wealth and Record Keeping | ||
| OB-005 | including where an SMR may | obligation | be submitted ; and consideration of whether to continue designated services or end the business relationship | where enhanced measures cannot manage and mitigate the risks | before ECDD is finished | [A05] AUSTRAC, Responding to Enhanced CDD Findings |
| OB-006 | The supplied AUSTRAC material states that enhanced CDD | obligation | be conducted | where an entity is required to submit an SMR in relation to a customer and intends to continue providing a designated service | [A07] AUSTRAC, ECDD and Suspicious Matter Reporting Relationship | |
| OB-007 | Enhanced CDD is not | obligation | be completed | before the SMR is submitted | [A07] AUSTRAC, ECDD and Suspicious Matter Reporting Relationship | |
| OB-008 | The SMR | obligation | be submitted within the required timeframe even | if enhanced CDD is still being conducted | [A07] AUSTRAC, ECDD and Suspicious Matter Reporting Relationship | |
| OB-009 | A suspicious matter report (SMR) | obligation | be submitted to the relevant financial intelligence authority | when there are reasonable grounds to suspect a matter may relate to money laundering, terrorism financing or other reportable conduct | [P1] AML, Suspicious Matter Reporting | |
| OB-010 | Staff | obligation | escalate concerns to the financial crime team | promptly | [P1] AML, Suspicious Matter Reporting | |
| OB-011 | The organisation | obligation | retain relevant records in accordance with its record-retention policy | [P1] AML, Suspicious Matter Reporting | ||
| OB-012 | Third-party AI services | obligation | undergo security, privacy and model-risk due diligence | before material use | [P10] Responsible AI, Third Party Models | |
| OB-013 | Contracts | obligation | define data handling, service obligations, incident notification and audit rights | [P10] Responsible AI, Third Party Models | ||
| OB-014 | Endpoint security telemetry | obligation | be monitored for suspicious execution, credential abuse, persistence and lateral movement indicators | [P11] Security Monitoring, Endpoint Telemetry | ||
| OB-015 | High-severity alerts | obligation | be triaged and linked to an incident record | where appropriate | promptly | [P11] Security Monitoring, Endpoint Telemetry |
| OB-016 | Operational technology environments | obligation | be segmented from general enterprise networks | [P12] Critical Infrastructure, Operational Technology | ||
| OB-017 | Remote access | obligation | be controlled, monitored and reviewed | [P12] Critical Infrastructure, Operational Technology | ||
| OB-018 | Staff | obligation | follow the organisation's approved AML procedures and escalate suspected financial crime through the designated financial crime function | [P13] AML, Financial Crime Risk Management Overview | ||
| OB-019 | Staff | obligation | apply the organisation's approved FATCA procedures and obtain specialist tax or compliance advice | where applicability is uncertain | [P14] FATCA, Foreign Account Tax Compliance Act Reference | |
| OB-020 | Staff | obligation | use the approved customer due-diligence procedure for operational decisions | [P15] KYC, Know Your Customer Glossary and Control Purpose | ||
| OB-021 | Potential matches | obligation | be investigated and escalated according to the approved sanctions procedure | [P16] Sanctions, Screening and Escalation | ||
| OB-022 | Alerts | obligation | be triaged using approved procedures, material cases must be investigated and relevant evidence must be preserved | [P17] Fraud Risk, Detection and Investigation | ||
| OB-023 | Staff | obligation | escalate suspected fraud to the designated fraud or financial crime function | [P17] Fraud Risk, Detection and Investigation | ||
| OB-024 | Assessment evidence | obligation | be retained and material model changes must trigger reassessment | [P18] AI Model Assessment, Pre-Production Review | ||
| OB-025 | Regulatory reporting processes | obligation | identify the applicable reporting obligation, accountable owner, source data, validation checks, approval requirements, submission timetable and evidence retention requirements | [P19] Regulatory Reporting, Governance and Evidence | ||
| OB-026 | Material reporting issues | obligation | be escalated and reporting evidence must be traceable to approved source records | promptly | [P19] Regulatory Reporting, Governance and Evidence | |
| OB-027 | Customer due diligence | obligation | be completed before establishing a relationship | unless a permitted exception applies | before establishing a relationship unless a permitted exception | [P2] KYC, Customer Due Diligence |
| OB-028 | Changes in beneficial ownership | obligation | be assessed and recorded | [P2] KYC, Customer Due Diligence | ||
| OB-029 | The rationale for enhanced due diligence | obligation | be documented, beneficial ownership information must be assessed | where relevant, and ongoing monitoring must be performed according to the approved risk-based procedure | [P20] Customer Due Diligence, Enhanced Due Diligence Triggers | |
| OB-030 | Personal information | obligation | be collected for a lawful and specified purpose and accessed only by authorised personnel | [P3] Privacy, Personal Information | ||
| OB-031 | Sensitive information | obligation | be protected by appropriate technical and organisational safeguards | [P3] Privacy, Personal Information | ||
| OB-032 | Privacy incidents | obligation | be escalated to the privacy team | without undue delay | [P3] Privacy, Personal Information | |
| OB-033 | High-risk AI systems | obligation | have an accountable owner, documented purpose, risk assessment, human oversight and monitoring controls | [P4] AI Governance, High-Risk AI | ||
| OB-034 | Decisions affecting customers | obligation | be explainable to an appropriate level and subject to escalation | [P4] AI Governance, High-Risk AI | ||
| OB-035 | Human oversight | obligation | be proportionate to the potential impact of an AI system | [P5] AI Governance, Human Oversight | ||
| OB-036 | Operators | obligation | be able to challenge, override or suspend an AI-assisted decision | where risk thresholds are exceeded | [P5] AI Governance, Human Oversight | |
| OB-037 | Oversight activities | obligation | be documented | [P5] AI Governance, Human Oversight | ||
| OB-038 | Privileged access | obligation | be approved, least-privileged and reviewed | periodically | [P6] Access Control, Privileged Access | |
| OB-039 | Administrative credentials | prohibition | be shared | [P6] Access Control, Privileged Access | ||
| OB-040 | High-risk privileged actions | obligation | be logged and monitored | [P6] Access Control, Privileged Access | ||
| OB-041 | Suspected security incidents | obligation | be reported through the approved incident channel | immediately | [P7] Incident Response, Cybersecurity | |
| OB-042 | The security team | obligation | preserve relevant evidence, assess impact, contain the incident and coordinate communications | [P7] Incident Response, Cybersecurity | ||
| OB-043 | Material models | obligation | undergo independent validation | before production use and periodically thereafter | [P8] Model Risk, Validation | |
| OB-044 | Validation | obligation | assess conceptual soundness, data quality, performance, limitations and monitoring thresholds | [P8] Model Risk, Validation | ||
| OB-045 | Regulated records | obligation | be retained for the period specified by the applicable retention schedule | [P9] Data Retention, Regulated Records | ||
| OB-046 | Disposal | obligation | be authorised and traceable | [P9] Data Retention, Regulated Records | ||
| OB-047 | Records subject to legal hold | prohibition | be deleted | [P9] Data Retention, Regulated Records |
Answers come only from the governed library and are decision support, not legal advice. Verify regulatory content against the regulator's current publication.