When assessing the risk associated with the way in which the customer obtains the products or services, firms should consider a number of factors including:

a) whether the customer is physically present for identification purposes. If they are not, whether the firm

i. used a reliable form of non-face-to-face CDD; and

ii. took steps to prevent impersonation or identity fraud.

Firms should apply Guidelines 4.29 to 4.31 in those situations.

b) whether the customer has been introduced by another part of the same financial group and, if so, to what extent the firm can rely on this introduction as reassurance that the customer will not expose the firm to excessive ML/TF risk, and what the firm has done to satisfy itself that the group entity applies CDD measures to European Economic Area (EEA) standards in line with Article 28 of Directive (EU) 2015/849;

c) whether the customer has been introduced by a third party, for example a bank that is not part of the same group or an intermediary, and if so

i. whether the third party is a regulated person subject to AML obligations that are consistent with those of Directive (EU) 2015/849, and whether the third party is a financial institution or its main business activity is unrelated to financial service provision;