Central Bank of Ireland v Bank of Ireland: €3.15m AML Fine

The Central Bank of Ireland fined Bank of Ireland €3,150,000 and reprimanded it for twelve breaches of Ireland's anti-money laundering law, which Bank of Ireland admitted. The settlement is one of the Central Bank's earlier cases against a major bank, and it is useful because it lists, section by section, the controls a regulated firm is expected to have. This guide walks through what the Central Bank's public statement says and what compliance teams can take from it. For other Irish cases, see our guide to Central Bank of Ireland AML enforcement case studies.

The headline facts

• Penalty: €3,150,000 and a reprimand.
• Breaches: twelve, all admitted by the bank.
• Law breached: the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010.
• Period: 15 July 2010 to 18 December 2015.
• Discount: the maximum 30 percent for settling early, which implies a penalty of €4.5 million before the discount.

The statement says the breaches persisted for an average of more than three years. It also describes the case as the Central Bank's third enforcement action arising from its anti-money laundering investigations of the Irish banking sector, and records it as the Central Bank's 109th settlement since 2006. The statement we read carries no publication date. Press reports at the time put the announcement at 30 May 2017, so treat that date as reported rather than confirmed from the document.

What went wrong, by section of the Act

Suspicious transaction reporting (section 42)

The bank failed to report six transactions to An Garda Síochána and the Revenue Commissioners as soon as practicable. The statement frames the failure as not reporting as soon as practicable.

Policies and procedures (section 54)

Section 54 concerns policies and procedures. The Central Bank found gaps covering suspicious transaction reporting, risk assessment, trade finance, customer due diligence and the handling of exceptions. It also noted weak escalation and management information around reporting.

Correspondent banking (section 38)

Before entering a correspondent banking relationship with a credit institution outside the European Union, the bank had to carry out enhanced due diligence and document the anti-money laundering responsibilities of each party. The statement cites section 38(1) and section 38(1)(e) for failures in these areas.

Politically exposed persons (section 37(4)(b))

For a non-resident politically exposed person, the bank did not carry out the source of funds and source of wealth checks that the section requires. Our guide to politically exposed persons covers the equivalent UK rules, which are different law.

Customers who do not provide information (section 33(8))

The bank breached the rule on how to deal with customers who did not give the customer due diligence information it required.

Reliance on third parties (section 40(4))

Reliance on third parties for customer due diligence was not properly arranged for 178 corporate customers. Relying on another firm does not remove the obligation to make sure the arrangement is in place and works.

Risk assessment and training

The Central Bank found the bank's risk assessment inadequate for 2012, and found that the assessments for 2012 and 2013 left out geographical and sectoral risks. It also found gaps in how risks in trade finance were documented, and in staff training.

Lessons for other firms

• Report on time. The test is as soon as practicable, not when the investigation is finished.
• Write down the risk assessment, and cover geography and sector. A risk assessment that omits those factors can be treated as inadequate.
• Treat correspondent relationships as a separate risk. Enhanced due diligence and documented responsibilities are expected before the relationship starts.
• Check third-party reliance arrangements. Know which customers rely on which firm and confirm the arrangements are in place.
• Do the PEP checks properly. Source of funds and source of wealth for a non-resident politically exposed person need to be established and recorded.
• Keep exceptions under control. Exceptions to the procedures should be documented, not informal.

Anyone responsible for these processes needs regular training. Our CPD courses include anti-money laundering topics for finance professionals.

How this fits with later Irish cases

The same themes appear years later in the Central Bank's transaction monitoring case against a crypto firm, covered in our guide to the Coinbase Europe settlement. The Bank of Ireland statement applies the 2010 Act as it stood during the breach period, so check the current legal text before applying the section numbers to your own firm.

What we could not confirm

We read the Central Bank's public statement but not the underlying settlement agreement or any press release. The statement is undated, so the May 2017 announcement date comes from press reports. We have not checked how the 2010 Act's sections read today.

Frequently asked questions

How much was Bank of Ireland fined?

€3,150,000, after the maximum 30 percent settlement discount, plus a reprimand.

Which law did the bank breach?

The Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, including sections 33, 37, 38, 40, 42 and 54.

Did the bank admit the breaches?

Yes. The statement records that Bank of Ireland admitted the twelve breaches.

How long did the breaches last?

The period runs from 15 July 2010 to 18 December 2015, and the statement says they lasted over three years on average.