Financial institutions and designated nonfinancial businesses or professions shall apply a risk-based approach to undertake customer due diligence measures for verifying the identity of the customer and beneficial owner, and keep all information obtained through the customer due diligence measures.