Central Bank of Ireland AML Supervision Explained

Firms in Ireland that fall under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 are supervised by competent authorities, and for most of the financial sector that authority is the Central Bank of Ireland. Knowing how the Central Bank decides whom to inspect, and how often, helps a firm judge what to expect. This guide summarises the Central Bank's page on its risk-based approach to AML supervision. It builds on our guides to the 2010 Act for accountants, the business risk assessment and AML supervision of accountancy firms.

A two-part risk-based approach

The Central Bank describes its approach as having two elements: identifying and assessing money laundering and terrorist financing risk, and supervisory engagement to monitor firms and bring about compliance. It says supervision is meant to match the risks identified. It maintains a risk assessment of the Irish financial sector from a supervisory perspective, which looks at each firm's business-model risks and the quality of its AML/CFT controls. The factors it lists include the nature, scale and complexity of the business, customer types, distribution channels, and products and services. The assessment is iterative, drawing on supervisory engagement, outreach, and intelligence sharing with law enforcement, financial intelligence units and other authorities.

Risk ratings

According to the page, sectors receive one of four ratings: high, medium high, medium low or low. Firms are initially given their sector's rating, but an individual firm's rating can differ depending on its business model and the quality of its controls. Certain firms with the highest risk may be rated ultra high and face more intensive or frequent engagement. The page adds that a higher rating does not necessarily mean poor compliance, since some firms remain higher risk even with robust frameworks. The sector-by-sector ratings were shown in an image we could not read, so we have not listed them.

How often the Central Bank engages

The page includes a table of minimum engagement by rating:

• High: an inspection cycle of three years, with AML/CFT review meetings annually and a Risk Evaluation Questionnaire annually.
• Medium high: an inspection cycle of five years, review meetings every five years and a questionnaire annually.
• Medium low and low: engagement described as strategic, spot check and responsive, with a questionnaire annually.

The Central Bank may apply additional measures, such as appointing relationship managers, meeting key control function holders and attending board meetings. The engagement types it names are on-site inspections, which are used for higher-risk firms, the AML/CFT Risk Evaluation Questionnaire, review meetings, and outreach such as presentations and seminars.

Reading the table: our interpretation

In our reading, the table means a high-rated firm should expect contact from the Central Bank every year, in the form of a questionnaire and a review meeting, and an on-site inspection at least every three years. A medium-high firm has a longer inspection cycle, but still completes the questionnaire annually. Lower-rated firms are not exempt, since the page lists the annual questionnaire for every rating and describes spot checks as part of engagement. The page also stresses that a higher rating does not necessarily reflect poor compliance. We have not seen the Central Bank's own explanation of how each rating is applied, so treat this as an interpretation.

Statutory powers

The page says the Central Bank's powers under the Central Bank (Supervision and Enforcement) Act 2013 include requiring reports on AML/CFT matters, including financial sanctions measures, and requesting information needed for its competent authority role. It can also appoint authorised officers to enter premises, conduct searches and question persons, subject to warrants or occupier consent.

Outcomes and enforcement

Firms found in breach must carry out remediation. Firms that fail to engage or remediate, or that commit serious breaches, may face action under the Administrative Sanctions Procedure, which the page says applies to certain breaches of Part 4 of the 2010 Act. The page links to settlement agreements with a number of firms, including Danske Bank A/S, Bank of Ireland, Allied Irish Banks, Ulster Bank Ireland DAC, Western Union Payment Services Ireland Limited and several credit unions and asset managers, though it gives no dates for them in the text we read.

What this means for a firm: our suggestions

These steps are our suggestions, not requirements on the Central Bank page.

• Find out which sector rating applies to your firm and think about whether your own business model and controls would move you up or down.
• Diarise the annual questionnaire, since the page lists it for every rating.
• Check that your business risk assessment, customer risk scoring and sanctions controls are documented, because the Central Bank can ask for reports on AML/CFT matters including sanctions.
• Read the settlement agreements for the type of firm closest to yours to see what failings were identified.

For structured learning, browse our CPD courses.

What we could not confirm

The page text did not include the sector ratings table, the number of firms supervised, the inspection process step by step, or inspection outcome statistics, and it did not give dates for the settlement agreements. We did not read the settlement agreements themselves, or the Central Bank's guidelines. Accountants and some other designated persons are supervised by other bodies, so this page does not apply to every firm covered by the 2010 Act. This post is general information, not legal advice.