An Irish investor file can hold certified identity documents and still leave a subscription waiting for approval. The ownership chain may end at a nominee, the source of funds may be unexplained, or nobody may have recorded who should resolve the exception. Customer due diligence needs evidence that answers those questions.
This guide focuses on AML compliance and KYC requirements for funds, administrators and other financial services firms in the Republic of Ireland. It explains the Irish legal framework and Central Bank of Ireland (CBI) expectations relevant to customer due diligence, or CDD. Our Ireland KYC services cover the operational work of onboarding, remediation and periodic reviews under your approved policy.
Establish which Irish AML obligations your entity holds
The Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended, sets the main Irish AML/CFT framework. Part 4 covers preventive obligations for designated persons. Sections 30A and 30B address business and customer risk assessments; sections 33 and 35 address identification, verification, the purpose of the relationship and ongoing monitoring.
The CBI supervises credit and financial institutions for AML/CFT compliance. Its financial-sector guidelines explain supervisory expectations. The CBI’s current guidance page identifies the revision of 23 June 2021. The guidelines support interpretation and implementation of the law; they do not replace it.
For Irish funds, distinguish the responsibilities of the fund, its management company and its administrator. A UCITS or AIF investor review needs a defined customer population and an agreed allocation of tasks. An administrator’s involvement does not, by itself, establish which obligations the fund has met. Banks, investment firms and payment firms must scope CDD around their own services and customers.
This guide does not cover every designated person or every financial-sector obligation. Northern Ireland follows a different framework. The Law Reform Commission’s revised Act is an administrative consolidation; its notices identify amendments not yet incorporated. Check those notices and commencement provisions before relying on a section.
Let the risk assessment determine the file work
Assess the risks of your business and each customer relationship. Relevant factors include the customer, products and services, delivery channels and jurisdictions involved. Record the rationale for the rating and the controls applied. A “low risk” field with no explanation gives the reviewer little to test.
The CBI’s risk guidance points firms to Ireland’s National Risk Assessment, including the assessment published in June 2026, and European risk-factor guidance. Use the material relevant to your business when reviewing its methodology.
Our operational recommendation for a backlog is to separate missing-document cases from unexplained ownership, unresolved screening and other higher-risk findings. Agree the priority with your compliance team. A convenient processing order should not silently become the firm’s risk policy.
Complete customer identification before moving the relationship forward
Section 33 addresses identifying the customer and verifying identity using reliable, independent documents or information. It also covers beneficial owners and persons acting on a customer’s behalf. Section 35 requires information about the purpose and intended nature of the business relationship.
In a corporate or fund investor file, document the legal entity, the person authorised to act, the ownership and control structure, and the expected relationship or activity. The documents needed depend on the customer, service and risk. A passport check cannot answer all of those questions.
CDD should generally be completed before establishing the relationship. The Act contains limited timing provisions with conditions. CBI guideline sections 5.2.4 and 5.2.2 explain, respectively, identity-verification timing and relevant beneficial ownership register checks. An account opened under a permitted exception may still be prohibited from transacting until the required checks are complete. Document which provision applies; a commercial deadline is not an exception.
Where the customer’s failure to provide information prevents the required measures, section 33(8) restricts providing the service or carrying out the transaction and requires discontinuing an existing relationship in the circumstances it covers. Escalate the case through the firm’s procedures and consider reporting obligations. Avoid returning funds automatically without assessing the facts and any applicable restrictions.
Check beneficial ownership beyond the register entry
CBI guideline sections 5.2.2 and 5.2.3 distinguish identifying beneficial owners from verifying their identity through risk-based measures. The firm must understand how ownership and control operate. Control can arise through voting rights, agreements or appointment powers as well as share ownership.
An ownership threshold alone can miss the person exercising control. For trusts and other arrangements, assess the relevant parties and roles under the applicable definition instead of applying a company-shareholding checklist. If senior managing officials are recorded as beneficial owners, investigate why that route was used and document the identification work already undertaken.
Ireland has more than one central register. The CBI’s beneficial ownership register page distinguishes its register for certain financial vehicles from the Register of Beneficial Ownership of Companies and Industrial and Provident Societies and Revenue’s register for trusts. Establish which regime applies to the entity, including where the customer is an Irish fund vehicle.
Section 35 includes requirements to confirm entry in the relevant register where applicable. Keep the register result with the underlying evidence, investigate differences and assess any discrepancy-reporting duty. A register search is one input to CDD; the file still needs a supported ownership and control conclusion.
Apply enhanced checks where the risk or law requires them
The Act and CBI guideline sections 5.5 to 5.7 address enhanced due diligence (EDD), including politically exposed persons, higher-risk situations and relevant correspondent relationships. Use current EU high-risk third-country requirements alongside your risk assessment; do not treat every country list as legally interchangeable.
Ireland’s PEP framework includes domestic PEPs as well as foreign PEPs, with provisions for immediate family members and known close associates. Relevant measures include senior management approval, establishing source of wealth and source of funds, and enhanced ongoing monitoring. PEP status alone is not evidence of wrongdoing.
Source of funds explains the origin of the money used in the relationship or transaction. Source of wealth explains how the person accumulated their wealth. A bank statement may identify the sending account without explaining either adequately. Record the information and corroborating evidence appropriate to the requirement and risk, and escalate an explanation the evidence does not support.
Sanctions compliance also needs its own controls. A PEP match and a sanctions match require different assessments; neither should be resolved by changing a customer risk label alone.
Review on a risk-based schedule and when information changes
Section 35(3) requires ongoing monitoring of the business relationship to the extent reasonably warranted by money laundering and terrorist financing risk. CBI guideline section 5.3 expects periodic reviews at a frequency commensurate with customer risk, alongside consideration of trigger events. Document those intervals in your policy and track reviews through to completion.
Changes in ownership, control, customer activity or PEP status can require an earlier review. New information can also change the risk rating and the checks required. Keep the evidence, rationale and next review date current under the firm’s methodology.
Ongoing monitoring includes scrutiny of activity and transactions. Refreshing documents does not fulfil the whole obligation. When outsourcing periodic file reviews, record which monitoring tasks are included and who handles transaction monitoring, alerts and unusual activity.
Separate outsourced KYC from statutory third-party reliance
CBI guideline section 5.2.7 explicitly distinguishes an outsourced service provider or agent from reliance on a relevant third party under section 40 of the Act. Under an outsourcing arrangement, the provider performs agreed work on the firm’s behalf and the firm remains responsible for compliance.
Statutory reliance has separate eligibility, consent and information-access conditions. It concerns specified CDD measures and does not extend to ongoing monitoring. The guidelines also state that firms cannot rely on the third party to perform EDD or provide senior management approval, although it may help gather source of wealth and funds information. The relying firm remains liable for a failure to apply the relevant measures.
Before outsourcing, assess the rules and supervisory expectations applicable to the entity and arrangement. Our scoping recommendation is to agree the approved policy, quality checks, exception reporting, access to underlying evidence and exit arrangements. Confirm any notification requirements with the firm’s advisers. For customer data, assess GDPR roles, processor terms and international transfer safeguards before granting access.
AgentKYZ’s managed KYC service for Ireland is operational support. It does not establish a section 40 reliance arrangement or replace your MLRO, senior management approvals or reporting obligations.
Escalate suspicions and report to both authorities
Section 42 requires reporting where a designated person knows, suspects or has reasonable grounds to suspect money laundering or terrorist financing, with reporting as soon as practicable under the section. Follow the firm’s internal escalation process without allowing an ordinary document chase to delay a suspicion report.
Ireland requires dual reporting. Revenue’s submission guidance confirms that suspicious transaction reports go to both FIU Ireland through goAML and the Revenue Commissioners through ROS. Reporting to the Central Bank is not a substitute.
Record the assessment and the reason for reporting or deciding not to report. Apply the restrictions on tipping off when communicating with the customer or sharing the file. An outsourced reviewer should use the agreed escalation route; the firm must keep its reporting process effective.
Retain records that explain the decision
Section 55 sets record-retention requirements. Broadly, CDD records are retained for at least five years after the designated person ceases to provide services to the customer or the last transaction, whichever is later. Transaction records have their own five-year period after completion or discontinuance. Check the statutory triggers, any lawful extension and applicable data-protection requirements when setting retention and deletion rules.
CBI guideline section 9 addresses records including customer risk assessments, CDD and EDD evidence, monitoring, reporting decisions and approvals. Documents must remain retrievable when held by an agent or outsourced provider.
For remediation, we recommend a file-level exception log that records the missing evidence, action owner, escalation and final decision. Report unresolved items separately from completed reviews. The board and compliance team need to see the cases still requiring attention, even when the provider has finished its contracted work.
Prepare for the EU AMLR without applying it early
The CBI’s EU framework page states that the EU Anti-Money Laundering Regulation (AMLR) will be binding on obliged entities from July 2027. It separately describes the new AML directive and the EU Anti-Money Laundering Authority (AMLA). These are distinct instruments with different functions and implementation dates.
As at October 2026, firms should continue meeting applicable Irish requirements while planning changes for the AMLR. The CBI also explains that existing EBA AML/CFT guidelines and standards remain in force until AMLA replaces them. Track the relevant final texts and transition periods when changing policies, data fields and provider contracts.
For an immediate KYC backlog, define the entity, case population, available evidence and current approved policy. Our Ireland KYC outsourcing and remediation services return human-reviewed files and an exception log for your team’s decision. Share the case count and target date to agree scope, pricing and delivery before transferring documents.