N.B. businesses with high-risk clients might need to keep CO