Ongoing Monitoring and Record-Keeping Under Irish AML Law

Ongoing monitoring and record keeping are the two parts of Irish anti-money laundering (AML) compliance that continue long after a customer has been onboarded. This guide sets out what the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended, says about them on the Law Reform Commission's revised Act pages, and what Central Bank of Ireland material adds for financial firms. It deliberately stays on this narrower topic. For the wider duty to have policies and train staff, see our guide to AML training under section 54.

Who this applies to

The 2010 Act places obligations on "designated persons". The Central Bank's AML supervision page says it supervises credit and financial institutions, and that it treats these as "firms" and as designated persons under the Act. The Department of Justice's Anti-Money Laundering Compliance Unit supervises certain designated persons, and has published guidelines (published 28 March 2024, according to the gov.ie page) to help them meet their obligations. That page says the guidelines are not secondary legislation, do not replace or override any legal or regulatory requirements, are not exhaustive, and that the 2010 Act prevails if there is a conflict. The gov.ie page refers to designated persons supervised by that unit, which implies that others are supervised elsewhere. Check who supervises your firm before relying on any one guidance document.

What "ongoing monitoring" means in the Act

Section 35(3) of the 2010 Act, as shown on the revised Act page we opened, requires a designated person to monitor any business relationship it has with a customer to the extent reasonably warranted by the risk of money laundering or terrorist financing. The word "monitoring" is defined in section 24. In summary, the definition says that, on an ongoing basis, the designated person must do two things:

• Scrutinise transactions, and the source of wealth or of funds for those transactions, undertaken during the relationship, to determine whether they are consistent with the firm's knowledge of the customer, the customer's business and pattern of transactions, and the customer's risk profile.
• Ensure that documents, data and information on customers are kept up to date, in accordance with the firm's internal policies, controls and procedures.

Two practical readings follow from the wording. First, monitoring is scaled to risk; the Act does not prescribe the same intensity for every customer. Second, monitoring has a data-quality element: an out-of-date customer file undermines the second limb of the definition even if no transaction looks odd. The revised Act page we read shows the definition of "monitoring" as inserted on 26 November 2018 by the 2018 amendment Act; other definitions on that page were amended in 2025. The Law Reform Commission text is an unofficial consolidation, so check the current text before relying on this summary.

Ongoing monitoring sits alongside the checks done at the start of the relationship. Our post on customer due diligence and KYC covers onboarding; this guide picks up afterwards.

What the Central Bank says about transaction monitoring

The Central Bank published Anti-Money Laundering Bulletin Issue 6 on transaction monitoring in October 2020. It builds on the Central Bank's AML/CFT Guidelines (September 2019) and the European Supervisory Authorities' Joint Opinion (October 2019). It is addressed to financial firms and is a dated publication, so check whether more recent material has been issued. In summary, the bulletin says:

• Monitoring should be tailored to the firm's business risk assessment and customer risk assessments.
• Automated systems are expected in many cases but are not always practical; where a firm relies on manual monitoring it should fully assess whether that can detect suspicious and unusual transactions, and staff should still be able to spot suspicious activity manually.
• Customer due diligence, transaction monitoring and suspicious transaction reporting should be connected, with up-to-date customer information on file.
• Automated tools, including third-party tools, need a full suitability assessment and must be configurable by the firm.
• Controls should be reviewed regularly and recalibrated when risks change.

The bulletin also lists deficiencies the Central Bank had observed, including risk assessments not being used to configure monitoring, generic thresholds that ignored differences between products and customer types, delayed reviews of unusual activity that in turn delayed suspicious transaction reports, undocumented monitoring procedures with unclear roles, and generic rationales when alerts were closed. Boards and senior management were also criticised where they did not act on weaknesses raised by compliance or internal audit. Although written for regulated financial firms, these are useful prompts for any designated person thinking about what a regulator might ask.

Record keeping under section 55

Section 55 of the 2010 Act deals with keeping of records by designated persons. According to the revised Act page for that section, a designated person must keep:

• records of the procedures applied and information obtained under the Act's customer due diligence chapter for each customer;
• the original or a copy of every document used for those customer due diligence purposes, including documents used to verify identity; and
• records of the history of services and transactions for each customer.

How long records must be kept

Records must be kept for not less than five years, counted from a trigger date that depends on the type of record. According to the page, for a customer record it is the later of the end of the service to the customer or the date of the last transaction; for a single transaction it is the date the transaction is completed or discontinued; and other dates apply for correspondent banking relationships, series of occasional transactions and services. The page also says a member of An Garda Síochána of at least Sergeant rank can direct in writing that records be kept for up to an additional five years, and that the direction ends when the grounds no longer apply and the designated person is notified.

Format, location and data deletion

• Records may be kept electronically or in other non-written form only if they can be reproduced in written form.
• Records may be kept outside the State if they can be produced in the State when required.
• Where records are kept solely for the purposes of this section, personal data must be deleted once the retention periods expire.
• The obligations continue after a person stops carrying on business as a designated person, and extend to successor bodies corporate.

The page shows that failure to comply is an offence. The revised section page we opened did not show an "updated to" date, so confirm the latest consolidated text on the Law Reform Commission site.

Where retention and data protection meet

The requirement to delete personal data held only for the section 55 purpose once the retention periods end is a useful reminder that AML retention is not a licence to keep everything forever. Our suggestion: set a retention schedule that names the AML record types, the trigger date for each, the review date and who authorises deletion.

A practical approach to ongoing monitoring files

The following are our suggestions, not requirements stated in the Act or in the Central Bank bulletin.

• Tie review frequency to the customer's risk rating, and record the rating and the date of the last review on the file.
• Define triggers for an unscheduled review, such as a change in ownership, a change in the pattern of activity, or adverse information.
• Record why an alert was closed, with a specific rationale rather than a generic one; the Central Bank bulletin criticised generic rationales.
• Keep an escalation route to whoever handles reports. Our guide to suspicious transaction reports explains the reporting step.
• Test your records. Pick a customer at random and check you could reproduce the identity evidence, the monitoring decisions and the transaction history on request.

What we could not confirm

The Central Bank page on its risk-based approach to AML supervision shows no publication date, and it does not list AML/CFT guidelines itself. We did not open the full Central Bank AML/CFT Guidelines or the Department of Justice guidelines document, so we do not describe what they say about ongoing monitoring or record keeping beyond what the bulletin and Act pages state.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is ongoing monitoring the same as customer due diligence?

No. Customer due diligence is the set of checks made at the start of, and in connection with, a relationship; ongoing monitoring is the continuing duty under section 35(3) to scrutinise transactions and keep customer information up to date, to the extent warranted by risk.

How long must AML records be kept?

According to the revised Act page for section 55, for not less than five years from a trigger date that depends on the record type, with a possible Garda direction to keep records for a further period of up to five years. Check the current text of the Act.

Can records be kept electronically or abroad?

The section 55 page says non-written records are allowed if they can be reproduced in written form, and records may be kept outside the State if they can be produced in the State when required.

Does the Central Bank bulletin apply to accountants?

The October 2020 bulletin is addressed to firms the Central Bank supervises. Other designated persons have other supervisors, so confirm which guidance applies to you.

This article is general information based on the official pages named above and is not legal advice.