Anti-Money Laundering (AML)
an-tee mun-ee lawn-der-ing
Understand AML obligations for Irish companies, including customer due diligence, reporting requirements, and the penalties for non-compliance.
Understand AML obligations for Irish companies, including customer due diligence, reporting requirements, and the penalties for non-compliance.
Anti-Money Laundering, commonly referred to as AML, is the set of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. In Ireland, AML obligations affect every business, but they carry particular weight for companies that provide financial services, professional services, or act as company formation agents. If your business falls within the scope of the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010 to 2021, you are a "designated person" with specific compliance duties.
For Irish founders, AML compliance is not something you can defer until the business scales. Depending on your industry, your obligations may begin from the moment you start trading. Failing to implement proper AML controls can lead to criminal prosecution, substantial fines, and reputational damage that could end your business before it gains momentum. Even if your company is not directly regulated, understanding AML helps you navigate the checks that banks, investors, and service providers will apply to your business.
At its core, AML compliance is about knowing who you are doing business with and ensuring that the funds flowing through your company are legitimate. This principle, known as customer due diligence, underpins the entire framework and connects closely to the concept of identifying the beneficial owner of every entity you deal with.
Irish AML law applies to "designated persons," a defined list of businesses and professionals set out in the Criminal Justice Acts. This includes credit and financial institutions, insurance companies, auditors, accountants, tax advisors, solicitors, estate agents, trust or company service providers, and dealers in high-value goods where payments exceed €10,000 in cash. If your startup operates in any of these areas, you are subject to the full range of AML duties.
Even if your business does not fall within the designated person categories, you still encounter AML in practice. When you open a business bank account, apply for funding, or engage professional advisors, they will conduct AML checks on your company and its directors. Understanding what these checks involve helps you prepare the necessary documentation and avoid delays in critical business processes like due diligence for investment rounds.
Customer Due Diligence is the process of verifying the identity of your clients and understanding the nature of the business relationship. For designated persons, CDD must be carried out before establishing a business relationship or carrying out an occasional transaction above the relevant threshold. The process involves collecting identification documents, verifying them against reliable sources, and identifying any beneficial owners who hold more than 25% of the entity.
There are three levels of CDD. Standard CDD applies to most business relationships. Simplified CDD may apply where the risk of money laundering is demonstrably low, such as with publicly listed companies. Enhanced CDD is required for higher-risk situations, including dealings with politically exposed persons or entities based in jurisdictions with weak AML frameworks. Your risk assessment determines which level applies to each client.
If you are a designated person and you suspect, or have reasonable grounds to suspect, that a transaction or activity involves the proceeds of crime, you must file a Suspicious Transaction Report (STR) with the Financial Intelligence Unit of An Garda Siochana and the Revenue Commissioners. This obligation arises regardless of the size of the transaction. You must not "tip off" the person who is the subject of the report by telling them that a report has been or will be made.
Maintaining internal procedures for recognising and escalating suspicious activity is a core part of your AML programme. Staff training is essential so that employees understand the warning signs and know how to report concerns through the proper channels. The corporate compliance function should oversee this process and ensure records are retained for at least five years.
Designated persons must retain all CDD documentation and transaction records for at least five years after the business relationship ends or the transaction is completed. This includes copies of identification documents, records of the verification process, details of the business relationship, and correspondence relating to any suspicious activity. These records must be available for inspection by the relevant supervisory authority at any time.
Proper record-keeping is both a legal requirement and a practical safeguard. If your company is audited or investigated, comprehensive records demonstrate that you took your AML obligations seriously. They also support your company secretary and directors' duties by providing evidence of responsible governance.
The penalties for failing to comply with AML obligations in Ireland are severe. Individuals convicted on indictment can face fines of up to €500,000 and imprisonment for up to five years. Companies can face unlimited fines. The Central Bank of Ireland, which supervises financial institutions, has imposed multi-million euro fines on firms that failed to maintain adequate AML controls.
Beyond financial penalties, non-compliance can result in the withdrawal of licences, public censure, and lasting reputational damage. For startups seeking investment, any AML-related issue discovered during due diligence is likely to end negotiations immediately. Maintaining robust AML procedures from the outset protects both your personal position as a director and the long-term viability of your business.
AML requirements are closely tied to the company formation process. Formation agents and professional advisors who assist with incorporating companies are themselves designated persons and must carry out CDD on the founders and beneficial owners. This means you will need to provide photographic identification, proof of address, and details about the source of funds used for the company registration.
Additionally, every Irish company must maintain an accurate register of beneficial owners and file this information with the Central Register of Beneficial Ownership. This data protection compliant register ensures transparency about who ultimately controls each company. Keeping your beneficial ownership records current is both an AML obligation and a governance best practice that supports smooth interactions with banks, regulators, and potential investors.
