Business Risk Assessment in Ireland: Section 30A Guide for Accountants

Every Irish designated person, including accountancy firms, has to carry out a documented business risk assessment before it can sensibly design its anti-money laundering controls. That duty sits in section 30A of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, which was inserted in November 2018. This guide sets out what the section requires, using the Law Reform Commission's revised Act, for accountants and finance students. For the Act as a whole, see our guide to Irish AML law for accountants.

Please read "What we could not confirm" at the end. We read the section and its annotation, not supervisory guidance on how the assessment should look.

What the section requires

According to section 30A, a designated person must carry out a business risk assessment to identify and assess the money laundering and terrorist financing risks in its business activities. The assessment must consider at least these risk factors: the types of customer, products and services, countries or geographic areas of operation, types of transaction, and delivery channels. The Minister may prescribe further factors, but only where needed to assess these risks accurately.

What to draw on

The section tells designated persons to consider relevant information in the national risk assessment and risk guidance issued by their competent authority. For credit and financial institutions it also points to guidelines from the European Banking Authority, the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority. The text we read does not name the competent authority for accountants, so check which body supervises your firm.

Documentation and approval

The assessment must be documented. A competent authority can decide, under Article 8 of the Fourth Money Laundering Directive, that an individual documented assessment is not required, but it must notify the designated person if so. Senior management must approve the assessment. Without such a notification, a firm should assume it needs its own written document.

Keeping it up to date

The designated person must keep the assessment and related documents up to date under the internal policies, controls and procedures adopted under section 54. In practice that means the risk assessment and the section 54 policies are two halves of one system. Our guide to section 54 policies and training covers the second half.

Access for the regulator

On request, the designated person must make its records available to its competent authority. The risk assessment should therefore be readable by someone who has never seen your firm.

Penalties

Failure to comply is an offence. On summary conviction, the penalty is a class A fine (a fine not greater than €5,000, as provided by the Fines Act 2010), up to 12 months' imprisonment, or both. On conviction on indictment, it is a fine, up to 5 years' imprisonment, or both.

When it was added

The annotation says section 30A was inserted on 26 November 2018 by section 10 of the Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Act 2018 (Act No. 26 of 2018), under S.I. No. 486 of 2018. Firms that set up their controls before that date should check that their assessment follows the section.

A structure for a practice assessment

These are our own suggestions, not requirements of the Act. Use the five factors in the section as headings: customer types, services, countries, transaction types and delivery channels. For each, record the risks you see in your own client base, the controls that answer them, and the owner. Show the date of senior management approval and the date of the next review. A short sample of real client types, anonymised, makes the document more convincing than generic text. Our guide to customer due diligence in Ireland shows where the assessment feeds into client-level decisions. For structured study, see our CPD courses.

Frequently asked questions

Does a small firm need a written assessment?

Section 30A says the assessment must be documented, unless a competent authority decides that an individual documented assessment is not required and notifies the firm.

Who approves it?

Senior management must approve the assessment.

How often must it be updated?

The section says to keep it up to date under the section 54 policies, without fixing a calendar interval in the text we read.

Putting the assessment to work: our suggestions

These practical steps are our suggestions, not requirements taken from the section. First, write the assessment down in plain language and date it, so a reviewer can see what the firm knew at the time. Second, keep a short list of the client types, services, delivery channels and countries your firm deals with, and note which of them you regard as higher risk and why. Third, link each identified risk to a control you actually operate, such as enhanced checks for higher risk clients or sign-off by a named senior person. Fourth, diarise a review whenever something material changes, for example a new service line, a new type of client or a change in the firm structure, and record the outcome even when nothing changes. Finally, make sure staff know where the assessment sits and how it feeds into their client onboarding work, so it informs day-to-day decisions rather than sitting in a drawer.

What we could not confirm

The Law Reform Commission page gives no separate consolidation date for the section, so later amendments may exist. We did not read the national risk assessment, any competent authority guidance for accountants, or the text of section 54. We could not confirm which competent authority applies to a particular firm. This post is general information, not legal advice.