(1) A reporting entity must—
(a) take reasonable steps to satisfy itself that the information provided under section 13 is correct; and
(b) according to the level of risk involved, take reasonable steps to verify any beneficial owner's identity so that the reporting entity is satisfied that it knows who the beneficial owner is; and
(c) if a person is acting on behalf of the customer, according to the level of risk involved, take reasonable steps to verify the person's identity and authority to act on behalf of the customer so that the reporting entity is satisfied it knows who the person is and that the person has authority to act on behalf of the customer; and
(d) verify any other information prescribed by regulations.
(2) Except as provided in subsection (3), a reporting entity must carry out verification of identity before establishing a business relationship or conducting an occasional transaction.
(3) Verification of identity may be completed after the business relationship has been established if—
(a) it is essential not to interrupt normal business practice; and
(b) money laundering and financing of terrorism risks are effectively managed through procedures of transaction limitations and account monitoring; and
(c) verification of identity is completed as soon as is practicable once the business relationship has been established.