Section 18, Terrorism Act, 2012

When applying a risk-based approach, all minimumstandards for compliance are obligatory; but where minimum standards are not specified, reporting entities may implement internal controls which correspond to the actual risks represented by the various products, services, clients, transactions, geographical or other risk factors, as long as they are consistent with prescribed risk levels or guidance issued by the Unit or supervisory authority as the case may be, for the respective sector.