(1) A reporting entity must—
(a) conduct the verification of identity requirements for standard customer due diligence set out in section 14; and
(b) according to the level of risk involved, take reasonable steps to verify the information obtained under section 21(a); and
(c) verify any other information prescribed by regulations.
(2) Except as provided in subsection (3), a reporting entity must carry out verification of identity before establishing a business relationship or conducting an occasional transaction.
(3) Verification of identity may be completed after the business relationship has been established if—
(a) it is essential not to interrupt normal business practice; and
(b) money laundering and financing of terrorism risks are effectively managed through procedures of transaction limitations and account monitoring; and
(c) verification of identity is completed as soon as is practicable once the business relationship has been established.