Capital Market Licensees must maintain and regularly review and update the documented risk assessment. The risk management and mitigation measures implemented by a Capital Market Licensee must be commensurate with the identified ML/TF/PF risks.