Central Bank of Ireland AML Enforcement: Three Case Studies

The Central Bank of Ireland publishes the facts behind its anti-money laundering (AML) enforcement actions, which makes them some of the most useful teaching material available to Irish firms. This guide reads three of them closely: Ulster Bank Ireland in 2016, Western Union Payment Services Ireland, and Swilly Mulroy Credit Union in 2025. Each shows a different weakness, and together they show what the Central Bank treats as serious. For how the regulator supervises firms day to day, see our guide to Central Bank of Ireland AML supervision.

Case 1: Ulster Bank Ireland DAC, 2016

According to the Central Bank's announcement of 1 November 2016, it fined Ulster Bank Ireland DAC 3.325 million euro and reprimanded it for breaches of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, which the bank admitted. The breaches covered the period from the Act's enactment on 15 July 2010 until 2016 and numbered eight.

• Outsourcing: no outsourcing policy from July 2010 to June 2011, and no service level agreements for 19 of 25 outsourced AML activities, mostly handled by four Royal Bank of Scotland group entities.
• Risk assessment: no assessment of money laundering and terrorist financing risk for over two years, and an assessment until April 2014 with no quantitative or qualitative evaluation.
• Customer due diligence: no review of whether documents for customers who pre-dated the 1995 Irish AML laws were adequate, new products given to 64,900 such customers without completing due diligence, exemption markers left on the system, and reliance on a third party under a contract that did not meet the Act's conditions.
• Training and red flags: non-executive directors not trained until 2013 and no suspicious activity training until March 2014, despite a 2012 Central Bank warning letter, and trade finance procedures without red-flag guidance until February 2015.

The Central Bank cited the seriousness of the conduct, the long duration (averaging over four years), cooperation, early settlement and remediation. It treated as aggravating that all but one breach continued after its enhanced enforcement powers took effect in 2013. Its Director of Enforcement warned that outsourcing within a group can breed complacency.

Case 2: Western Union Payment Services Ireland Limited

The Central Bank's published settlement document records a fine of 1.75 million euro plus a reprimand, with a 30 percent discount, which it describes as the maximum under its early discount scheme. The page we read does not state the date. The fine was imposed under section 33AQ of the Central Bank Act 1942 as it applied before 1 August 2013, when the maximum was 5 million euro and turnover-based penalties were not available. The breaches were of sections 54(1), 54(2), 54(6) and 55(2) of the 2010 Act.

• Outsourcing: key AML functions were outsourced to a group entity in Lithuania through a chained arrangement. Before 2012 the contract lacked adequate performance standards and reporting, and before 2013 there was no outsourcing policy covering money laundering prevention functions.
• Record retention: agents had no procedures to ensure they took and kept copies of the identity documents used to verify customers, which could weaken suspicious transaction reports and later investigations.
• Transaction monitoring: the IT systems did not monitor completed transactions below 500 US dollars or the euro equivalent. The Central Bank said splitting payments and small terrorist financing transfers are common methods, so excluding small transactions was a deficiency even with a group function in place.
• Training: only one person per agent location had to complete initial training before the location could transact, and there were no controls to confirm all agent staff were trained. Some agents did no initial or follow-up training.
• Occasional transactions: on some occasional transactions over 15,000 euro through an agent, the firm did not take originals or copies of identity documents.

Aggravating factors included the high-risk nature and global reach of the business and the case involving three enforcement priorities: AML compliance, outsourcing, and systems and controls. Mitigating factors were extensive proactive remediation, cooperation and early settlement.

Case 3: Swilly Mulroy Credit Union, 2025

The Central Bank issued its press release on 2 July 2025, and the High Court confirmed the sanctions on 13 October 2025. The credit union received a reprimand and a monetary penalty of 51,819 euro, reduced by a 30 percent settlement discount to 36,273 euro. The breaches were of the 2010 Act and of the Credit Union Act 1997, which requires risk management systems. The period ran from 2 January 2014 to 30 June 2021.

According to the Central Bank, the credit union accepted cash from people who did not hold accounts with it and transferred the money electronically to a local bank branch without first depositing it in an account in the customer's name, so it carried out no AML checks on the depositors or the transactions. The Central Bank had previously flagged this cash-intensive practice to the sector as higher risk. Over the period the credit union handled 2,329 cash lodgements totalling 8,751,694 euro. The board knew of the risks from 2015 but did not act, and a new management team stopped the practice in 2021 but did not report it to the Central Bank. The Central Bank's AML division found it during a 2022 inspection, and an enforcement investigation began in 2023. The Director of Enforcement said firms must have controls to identify customers and detect suspicious activity, and must report control gaps when they find them. Our guide to AML for Irish credit unions covers the wider obligations.

Patterns across the three cases

Our reading is that four themes recur. Outsourced or group-run controls were not properly documented or overseen in the first two cases. Gaps in basic customer identification or record keeping appeared in all three. Training gaps appeared in the first two. In the third, the board knew of a risk and did not act. These are our observations rather than a Central Bank statement.

Our suggestions

These are Learnsignal's suggestions, not Central Bank requirements. Map every outsourced AML task to a written agreement and a named owner. Check that transaction monitoring has no unexplained thresholds. Make sure identity records can be retrieved for every customer. Test training completion across agents and branches. Escalate known control gaps to the board and, where required, to the regulator. Training that covers these themes is available through Learnsignal CPD.

What we could not confirm

The Western Union document we read gives no settlement date, and we have not confirmed it. We have not read the Central Bank's other AML enforcement actions, including those against Bank of Ireland, Allied Irish Banks and Coinbase Europe, because we could not read primary Central Bank documents for them. The penalty rules cited in the older cases applied at the time and may differ from the current regime.

Frequently asked questions

What discount can a firm get for settling early?

The Western Union document describes 30 percent as the maximum under the Central Bank's early discount scheme, and the Swilly Mulroy action also applied a 30 percent discount.

Do sanctions on credit unions need court approval?

For Swilly Mulroy, the Central Bank said the sanctions take effect only after High Court confirmation, which was given on 13 October 2025.

Is outsourcing AML tasks to a group company allowed?

The cases show the Central Bank expects documented performance standards, reporting, a policy and oversight of any outsourcing, including within a group.