This stage is about identifying and testing methods to manage the risks you have identified and assessed in the previous process. In doing this you will need to consider putting into place strategies, policies and procedures to help reduce (or treat) the risk.

Examples of risk reduction or treatment steps are:

• setting transaction limits for higher risk products
• having a management approval process for higher risk products
• having a process to place customers in different risk categories and apply different identification and verification methods
• not accepting customers who represent unregistered charities and wish to transact with a high-risk country.

Another way you can reduce the risk is to use a combination of risk groups to modify the overall risk of a transaction. You may choose to use a combination of your customer, product/service and country risk to modify an overall risk. For example, in the case of a bank-account-to-bank-account service (assessed as low risk by you), to a certain city/province (assessed as high-risk area by you), in a certain country (assessed as low risk by you).

It is important to remember that identifying a customer, product or country as high risk does not necessarily mean that ML/TF is involved. The opposite is also true - just because a customer or transaction is seen as low risk does not mean the customer or transaction is not involved in ML/TF. Experience and common sense should be applied to your risk management process.