(1) A reporting entity must, according to the level of risk involved, verify the identity of a person acting on behalf of a customer and that person's authority to act for the customer so that it is satisfied it knows who the person is and that the person has authority to act on behalf of the customer.
(2) Verification of identity must be carried out before the business relationship is established or the occasional transaction is conducted or the person acts on behalf of the customer.
(3) For the purposes of verifying a person's authority to act in the circumstances described in section 16, a reporting entity may rely on an authority provided in an application form or other document provided to the reporting entity that shows a person's authority to act or transact on an account.