Customer Due Diligence in Ireland: When the Criminal Justice Act 2010 Requires It

If your firm is covered by Irish anti-money laundering law, one of the first practical questions is when exactly you must carry out customer due diligence (CDD). Under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended, the answer is: before you establish a business relationship, before an occasional transaction, and in a number of other situations, including where you have grounds for suspicion or doubt about identity. This guide walks through those triggers, what the Act says CDD involves, the timing exceptions and what must happen when a customer will not cooperate. It is a plain-English overview, not legal advice. If you also want the wider picture of the Act's staff-awareness duties, see our guide to AML training under section 54.

Who has to apply CDD

CDD duties fall on "designated persons". The Central Bank of Ireland's regulatory requirements page explains that the 2010 Act, as amended, is the primary legislation, that the Act defines designated persons, and that a schedule to the Act lists activities that are subject to AML obligations regardless of the entity's regulatory status. The Central Bank page does not itself list who is covered, so check the Act's own definition for your business type. The law is national, so the position is the same for a Dublin-based firm as for one anywhere else in Ireland.

The triggers: when CDD must be applied

The revised text of section 33 on the Law Reform Commission's Revised Acts site sets out when a designated person must apply CDD. In summary, the measures must be applied:

• Before establishing a business relationship with the customer.
• Before an occasional transaction, or before carrying one out with, for or on behalf of the customer.
• Before carrying out any service where there are reasonable grounds to suspect money laundering or terrorist financing, judged by factors such as the customer, the service, its value and the source of funds. The page notes this wording was substituted in 2013.
• Before carrying out any service where there are reasonable grounds to doubt previously obtained identity documents or information and no other reliable documents or information have been obtained.
• At any time, including after a change in the customer's relevant circumstances, where the risk of money laundering or terrorist financing warrants it (inserted in 2018 and reworded in 2021).
• At any time where another enactment or rule of law requires the customer to be contacted to review beneficial owner information (inserted in 2021).

Two points stand out. First, CDD is not only an onboarding exercise: the "at any time" triggers mean a change in risk can require you to apply measures to an existing customer. Second, the Central Bank guidelines say the level of CDD depends on the firm's risk determination under section 30B, which the guidelines say should be documented in writing.

Business relationship and occasional transaction

Section 24 of the Act defines the two terms that drive the first triggers. The revised page describes a business relationship as a business, professional or commercial relationship between a designated person and a customer that the person expects to be ongoing, with no threshold. An occasional transaction is a single transaction or a linked series of transactions for a customer with whom there is no business relationship. The page shows thresholds that vary by the type of designated person and transaction: EUR 15,000 in all other cases, EUR 10,000 for one category, EUR 2,000 for another, and EUR 1,000 for certain transfers of funds under an EU regulation. The page also records amendments in 2013 and 2018 and a later amendment that had not been commenced at the revision date. Because the threshold depends on which category you fall into, read section 24 against your own activity rather than assuming the general figure applies.

What CDD involves

According to the revised section 33, CDD has these core elements:

• Identify the customer and verify identity using documents or information the firm has reasonable grounds to believe can be relied upon, including documents from a government source.
• Identify any beneficial owner and take risk-based measures to verify that person's identity, so the firm is satisfied it knows who the beneficial owner is. For certain legal entities and arrangements the firm must also understand the ownership and control structure.
• Where the beneficial owner is recorded as a senior managing official, take verification steps and keep records of them, including any difficulties encountered.
• Check authority: verify that anyone acting on the customer's behalf is authorised, and verify that person's identity.

The Central Bank guidelines add that CDD goes beyond identity verification: firms should know their customers, understand what to expect from the relationship and watch for money laundering or terrorist financing risk. They also say firms set their own lists of acceptable documents, that information on the purpose and nature of the relationship should be gathered at the outset and refined over time, and that senior managing officials should be recorded as beneficial owners only after all other means of identifying the beneficial owner have been exhausted. The guidelines in the version we read were published on 6 September 2019 and revised on 23 June 2021.

Timing exceptions

The general rule is verification before the relationship starts. The revised section 33 allows limited flexibility:

• Verification may take place during the establishment of the relationship if waiting would interrupt normal business and there is no real risk of money laundering or terrorist financing. It must then happen as soon as practicable.
• A credit institution or financial institution may open an account before verification is complete, but must ensure no transactions are carried out on it until verification is complete.
• Special rules apply to credit institutions and financial institutions for beneficiaries of life assurance and other investment-related policies, whose identity is verified at payout.

The Central Bank guidelines repeat the first two points. Our suggestion: treat these as narrow exceptions and document your reasons, not as a routine way to speed up onboarding.

When a customer will not cooperate

The revised section 33 provides that if CDD cannot be applied because the customer has failed to provide the required documents or information, the designated person must not provide the service or carry out the transaction while the failure continues, and must end any existing business relationship. A carve-out exists for relevant legal professionals ascertaining a person's legal position or representing them in proceedings. Failure to comply is an offence: on summary conviction the page shows a fine of up to EUR 5,000, up to 12 months' imprisonment, or both, and on indictment a fine, up to five years' imprisonment, or both. Whether a suspicious transaction report is also needed is a separate question, covered in our guide to suspicious transaction reports and the FIU.

Turning the rules into a working process

Our suggestion: build your CDD procedure around the triggers above so that staff can see at a glance which one applies to the matter in front of them. A practical approach is a short onboarding checklist that records the trigger, the risk determination, the documents relied upon, the beneficial owner check, any use of a timing exception with the reason, and what was done if verification could not be completed. For a practitioner-level walkthrough of the KYC steps, see our guide to customer due diligence and KYC.

Where to check the current law

The revised Act page we read states it is updated to 1 August 2025 and warns that some later changes may not yet be reflected, directing readers to the Irish Statute Book for those. Amendments to sections 24 and 33 are noted on the page for 2013, 2018 and 2021. Before you rely on any figure or trigger in this article, check the current text on the day, and take legal advice on edge cases.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does CDD apply to every customer?

The triggers in section 33 apply to designated persons dealing with customers, but the level of measures depends on the firm's risk determination. The Central Bank guidelines say the level of CDD depends on that assessment, which should be documented in writing.

What is an occasional transaction?

Section 24 describes it as a single transaction or a linked series of transactions for a customer with no business relationship, above thresholds that vary by category. Read the section against your own activity.

Can we verify identity after the relationship has started?

Only in the limited circumstances in section 33: where delay would interrupt normal business and there is no real risk, and then as soon as practicable. Credit institutions and financial institutions can open an account first, but must ensure no transactions are carried out on it until verification is complete.

What if the customer refuses to provide documents?

The Act says the firm must not provide the service or carry out the transaction while the failure continues and must end any existing business relationship. Failure to comply is an offence.

Does CDD stop once the customer is onboarded?

No. The "at any time" triggers, including after a change in the customer's circumstances where risk warrants it, mean CDD can be required again. The Central Bank guidelines also say purpose and nature information should be refined over time.

Anti-money laundering compliance rests on knowing when the law bites, so keep the triggers in front of your onboarding team and check the current text regularly.