Customer due diligence obligations updated; intermediaries must enhance measures for PEPs and revisit CDD on suspicion. Intermediaries must maintain an independent internal audit; periodically update all client and beneficial owner information collected under the Customer Due Diligence process; revisit CDD on suspicion of money laundering or terrorist financing; not apply low-risk provisions when suspicion exists; consult FATF and other public sources for high-risk jurisdictions; adopt risk management to identify Politically Exposed Persons and apply enhanced CDD and verification of source of funds for PEPs; retain identity records for ten years from termination; and observe a broad prohibition on 'tipping off' before, during and after suspicious transaction reporting.