Reliance on Third Parties for CDD in Ireland: Section 40

Sometimes a client has already been through customer due diligence with another regulated firm, and it is tempting to ask that firm for a copy rather than repeat the work. In Ireland, section 40 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 allows a designated person to rely on certain other persons to carry out customer due diligence, but only on set conditions, and the designated person stays responsible. This guide summarises section 40 from the Law Reform Commission's revised Act. Our wider guide to customer due diligence in Ireland explains the checks that are being relied on.

What can be relied on

According to the revised Act, a designated person may rely on a relevant third party to apply the customer due diligence measures that the designated person must apply under section 33 or section 35(1). Reliance covers those measures, not the firm's wider duties, such as its own risk assessment or ongoing monitoring.

Who counts as a relevant third party

The section lists several groups.

• Irish designated persons: credit institutions; financial institutions (other than those whose only activities are foreign exchange or payment services); external accountants and auditors who belong to a designated accountancy body; tax advisers who are also solicitors, members of an accountancy body or members of the Irish Taxation Institute; relevant independent legal professionals; and trust or company service providers meeting specified membership or Central Bank authorisation conditions.
• Other EU Member States: credit institutions, financial institutions, and certain accountants, auditors, tax advisers, legal professionals and trust or company service providers that are authorised and supervised under the Fourth Money Laundering Directive.
• Non-EU places: persons in a place that is not a high-risk third country, supervised to requirements equivalent to the Fourth Directive, and falling within similar categories.
• High-risk third countries: only persons who are branches or majority-owned subsidiaries of an EU obliged entity and who fully comply with group-wide policies under Article 45 of the Fourth Directive.
• Group route: a person in the same group can qualify if the group applies equivalent customer due diligence and record-keeping policies and the competent authority of the parent's home state supervises their implementation at group level.

The conditions for reliance

Three conditions stand out in the text. There must be an arrangement, in writing or otherwise agreed, between the designated person (or the employer) and the third party permitting reliance. The designated person must be satisfied either that the group circumstances apply or that the third party has agreed to forward documents and information on request. And on request, the third party must provide, as soon as practicable, the documents and information it obtained when carrying out the measures, including information from relevant trust services under the Electronic Identification Regulation, a reference inserted by the 2021 amending Act.

Responsibility stays with you

The section says the designated person remains fully liable for any failure to apply the required measures. Relying on another firm does not move the responsibility. This is the reason many firms treat reliance as the exception and keep their own records of what was checked.

Outsourcing and agents are different

Under the section, outsourcing service providers and agents are not relevant third parties. A designated person may still apply customer due diligence measures through them, but remains liable for any failure. In practice this means a firm that uses a verification provider or an agent should treat the work as its own.

Where this fits with other guidance

For a general overview of how reliance works across several systems, see our guide to reliance on third parties for customer due diligence. For the Irish framework as a whole, see our overview of the Criminal Justice Act 2010 for accountants.

Practical steps: our suggestions

These steps are our suggestions rather than requirements from section 40. Put the reliance arrangement in writing before you depend on it. Check and record why the other firm falls within one of the listed categories. Ask for the documents and information at the start rather than only when a problem appears, and note when you received them. Keep your own record of the risk reasoning for the client. If you cannot tell whether a firm qualifies, do the checks yourself.

What we could not confirm

We did not read sections 33 and 35 themselves, or any Central Bank, accountancy body or Department of Justice guidance on third-party reliance, including the Central Bank bulletin on the subject that appeared in our search results. We also did not confirm the penalty position for section 40 specifically, because the summary we read did not state one, or check for amendments made after the revised Act was last updated. The revised Acts are an unofficial consolidation, so check for later changes before relying on the text. This post is general information, not legal advice.