Simplified Due Diligence in Ireland: What the Law Allows and What It Does Not

Simplified due diligence is often described as a shortcut. In Ireland, it is not. Section 34A of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended, lets designated persons apply reduced customer due diligence measures only where specific conditions are met, and only where the reduced measures are "reasonably warranted" by a lower risk. This guide explains what the Act and the Central Bank of Ireland's guidelines say about simplified due diligence (SDD), what the law allows, and where its limits are. It is a plain-English overview, not legal advice. For the standard measures that SDD scales back, start with our guide to customer due diligence and KYC.

What section 34A says

The Law Reform Commission's Revised Acts page for section 34A (headed "Simplified customer due diligence") sets out the framework. In summary:

• A designated person may apply simplified measures in place of the measures in section 33(2) and section 35, but this is subject to section 33(1)(c) and (d). Those are the triggers where there are reasonable grounds to suspect money laundering or terrorist financing, or where there are reasonable grounds to doubt previously obtained identity documents or information and no other reliable documents or information have been obtained. In those situations simplified treatment is not available.
• The simplified measures must be "reasonably warranted by the lower risk" of money laundering or terrorist financing.
• Two conditions must both be met: the person identifies a lower-risk area in its relevant business risk assessment, and it considers that the relationship or transaction presents a lower degree of risk.
• To identify a lower-risk area, the person must consider the matters in section 30A(2), any factor in Schedule 3 to the Act, and any additional factor prescribed by the Minister.

The page shows the section was inserted on 26 November 2018 by the 2018 Amendment Act. It does not show a "revised to" date for the section itself, so confirm the current text on the Irish Statute Book. We did not read the list of lower-risk factors in Schedule 3, so we do not reproduce it here. Read the Schedule itself when you build your own risk assessment.

The conditions in practice: assess, test, record, monitor

Four obligations sit around any use of SDD:

• Risk assessment first. The lower-risk area must come from your business risk assessment. A customer cannot be treated as lower risk simply because it would be convenient.
• A reasonable-person test. The Revised Acts page says a relationship or transaction may be treated as lower risk if a reasonable person, considering the matters in section 30B(1), would reach that conclusion.
• Records. The person must keep a record of its reasons for the lower-risk determination and the evidence it relied on.
• Monitoring. The person must carry out sufficient monitoring of transactions and business relationships to detect unusual or suspicious transactions.

So the law does not remove the risk assessment or the monitoring. SDD changes how much CDD is applied, not whether you have to think about risk.

What the Central Bank guidelines add

The Central Bank's Anti-Money Laundering and Countering the Financing of Terrorism Guidelines for the Financial Sector (published 6 September 2019, revised 23 June 2021, version 2.0) deal with SDD in section 5.4. Key points from the text we read:

• The older exemptions in sections 34 and 36 have been repealed, and SDD now sits under section 34A.
• Before applying SDD, the firm should carry out appropriate testing to confirm the customer, relationship or transaction qualifies for simplified treatment.
• SDD must not become a de facto exemption from CDD, and firms must not defer CDD where other legislation requires information at the outset.
• The guidelines state that SDD does not exempt a firm from reporting suspicious transactions to the FIU Ireland and the Revenue Commissioners.
• Firms must obtain enough information to be reasonably satisfied that their low-risk assessment is justified and enough about the relationship to spot unusual or suspicious activity.
• Any reduction in the amount, timing or type of CDD must be proportionate to the low risk identified.

These guidelines are addressed to firms the Central Bank supervises. If your business is supervised by a different competent authority, check what guidance applies to you.

Examples of SDD measures the guidelines list

The guidelines present a non-exhaustive list of measures a firm may apply where the conditions are met, and say firms should set out the specific SDD measures they use in their own policies and procedures. The examples include:

• Timing: verifying identity during the establishment of the relationship, or setting defined thresholds or time limits, with systems to detect when those limits are reached.
• Quantity of information: verifying identity from one reliable, credible and independent source, or assuming the purpose of a single-use product such as a company pension scheme.
• Quality or source of information: accepting customer-provided information to verify a beneficial owner's identity (not the customer's identity), or relying on the source of funds where risk is very low, such as state benefit payments.
• Frequency: adjusting how often CDD is updated or reviewed to match the customer's risk level.
• Monitoring: monitoring only transactions above a set threshold, provided the threshold is reasonable and the firm can detect linked transactions that together exceed it.

Notice what is not on the list: skipping identification altogether, or ignoring a customer who later behaves unusually.

What the law does not allow

Putting the Act and the guidelines together, SDD does not permit you to:

• Apply it where section 33(1)(c) or (d) applies, that is, where there are reasonable grounds to suspect money laundering or terrorist financing, or reasonable grounds to doubt previously obtained identity information and no other reliable information has been obtained.
• Rely on a customer category alone without a business risk assessment that identifies the lower-risk area.
• Stop monitoring the relationship.
• Skip suspicious transaction reporting.

Our suggestion, not a requirement stated on the pages we read: build a trigger into your procedures to re-examine the lower-risk decision when a customer's activity, ownership or geography changes.

When a lower-risk conclusion no longer holds, the contrast case is enhanced due diligence. See our guide to enhanced due diligence for accountants for the other end of the risk spectrum.

Documenting an SDD decision

A practical approach is a short, dated SDD record on each file that notes the lower-risk area in the business risk assessment it relies on, the factors considered, the reduced measures applied, who approved the decision and when it will be reviewed. This is our suggestion, not a statutory form, but it maps directly onto the requirement to keep reasons and evidence. Staff who make these calls also need to understand the law behind them, which is one reason the Act's training duties matter. See our guide to AML training under section 54.

Checking the current position

The Revised Acts main page for the 2010 Act states it is updated to 1 August 2025 and warns that some later changes may not yet be reflected. The Central Bank guidelines we read carry a 2021 revision date. We did not locate a Department of Justice page on SDD, so rely on the Act and the Central Bank guidelines and confirm the current versions before you act.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is simplified due diligence an exemption from CDD?

No. The Central Bank guidelines say SDD must not become a de facto exemption. Section 34A allows reduced measures only where lower risk is identified, tested and recorded.

Do we still need a business risk assessment?

Yes. Section 34A requires the person to identify a lower-risk area in its relevant business risk assessment before applying SDD.

Can we use SDD if something looks suspicious?

No. Section 34A is subject to the triggers in section 33(1)(c) and (d), which cover reasonable grounds to suspect money laundering or terrorist financing and reasonable grounds to doubt previously obtained identity information where no other reliable information has been obtained.

Do we still have to monitor and report?

Yes. The Act requires sufficient monitoring to detect unusual or suspicious transactions, and the Central Bank guidelines state that SDD does not exempt a firm from reporting suspicious transactions.

What must we record?

The Act requires a record of the reasons for the lower-risk determination and the evidence relied on.

Simplified due diligence rewards firms that assess risk carefully, so keep the reasoning on file and review it when circumstances change.