An institution's AML/CTF policy is the foundational document for its risk management program. A critical component of this policy is the customer acceptance criteria, which must be clearly defined. This includes the methodology for assessing a customer's risk profile and ensuring that the institution only onboards customers whose risk level is within its pre-defined and board-approved risk appetite or tolerance.

A. Data transmission standards are highly specific, technical procedures, which would be detailed in procedural documents, not the high-level governing policy.

C. This describes the purpose or context for enhancing controls, which might be stated in a policy's introduction, but it is not a core procedural component itself.

D. This describes a methodology for risk identification. The policy would mandate that such a methodology exists, but the detailed approach itself is part of the risk assessment framework.

1. ACAMS. (2023). CAMS Risk Management (CAMS-RM) Study Guide. Chapter 4: Risk Governance, Section: Policy and Procedures, p. 4.4. "The policy should include...Customer acceptance criteria including the method for defining the AML/CTF risk represented by the customer and whether that is within the risk tolerance of the financial institution."

2. Financial Action Task Force (FATF). (2023). FATF Recommendations. Recommendation 10: Customer Due Diligence, p. 15. This recommendation requires financial institutions to have policies and procedures for customer acceptance.