The General Data Protection Regulation (GDPR) is a regulation issued by the European Union (EU) that sets out requirements for the processing and protection of personal data. It applies to any company that processes personal data of individuals in the EU, and requires organizations to take appropriate measures to protect the personal data of individuals, such as implementing appropriate security measures, limiting the amount of data collected and stored, and providing clear explanations of how the data will be used. In the context of financial crime investigations, the GDPR requires organizations to ensure the security and confidentiality of personal data that they collect and process, and to take measures to ensure that the data is used only for the purpose of the investigation and not for any other purpose.

Verified Answer: = A. Collect further customer reference data and determine what must be screened and at which frequency. and C. Deploy an independent risk-based test to ensure the screening on this customer is effective.
Comprehensive Detailed Explanation: = When an existing customer changes its business scope and jurisdictions, banks need to manage sanctions compliance risk effectively. Here are the steps they should take:
1. Collect Further Customer Reference Data: Obtain updated information about the customer's new business activities, locations, and counterparties. Understand the nature of their transactions and assess the associated risks. Determine what specific data elements need to be screened (e.g., names, addresses, beneficial owners) and establish the appropriate screening frequency.
2. Deploy an Independent Risk-Based Test: Conduct a comprehensive risk assessment tailored to the customer's changes. This assessment should consider factors such as the customer's industry, geographic exposure, and transaction volume. The risk assessment helps identify high-risk areas that require enhanced scrutiny.
3. Screen Directors and Ultimate Beneficial Owners: Perform sanctions screening not only on the customer but also on their directors and ultimate beneficial owners. This ensures that any potential risks associated with these individuals are identified and mitigated.
4. Perform Politically Exposed Person (PEP) and Negative Media Screenings: Continue to screen the customer and related parties against PEP lists and negative media sources. This helps detect any adverse information related to politically exposed individuals or entities.
By following these steps, banks can proactively manage sanctions compliance risk and safeguard their institution's reputation while adhering to regulatory requirements12.
References:
1. Protiviti: Sanctions Risk Assessment: A Key Risk Management Tool
2. Moody's: What Businesses Need to Know About Sanctions Compliance

The FATF Regional Style Bodies (FSRBs) are autonomous regional organizations that help the FATF implement its global AML/CFT policy, which revolves around its 40 Recommendations, in over 200 affiliated countries1. One of the key characteristics of the FSRBs is that they emphasize regional co-operation between member countries, as stated in the High-Level Principles and Objectives approved by the FATF Plenary in October 20122. This means that the FSRBs facilitate information exchange, technical assistance, training, and mutual support among their members to enhance their AML/CFT capacities and compliance. The FSRBs also promote regional perspectives and specificities in the FATF policy-making process and foster dialogue and collaboration with other regional and international bodies2.
References:
1: What are the 9 FATF-Style Regional Bodies (FSRBs)? - Sygna
2: FATF-Style Regional Bodies (FSRBs) - Asia/Pacific Group on Money Laundering

The Office of Foreign Assets Control (OFAC) administers and enforces economic sanctions programs [1][2], which are designed to protect US national security, foreign policy, and economic interests. Transactions that would otherwise be prohibited can be allowed through an OFAC licensing process, in which the OFAC evaluates the request to determine that the transaction does not undermine US policy objectives.