The applicable law and a risk-based approach provide us with the minimum standard to follow and it is the responsibility of each business to set policies and procedures based on guidance from both the relevant regulatory body and the Group’s directives.