It requires assessments of all business partners, internal approvals, books and record entries, and imposes records retention requirements in key risk areas related to government officials and business partners.