Suspicious Transaction Reports in Ireland: Who Must File and How

A suspicious transaction report (STR) is the report that certain businesses must make when they know or suspect that money laundering or terrorist financing is taking place. In Ireland the duty comes from section 42 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, and reports go to two places: FIU Ireland, the financial intelligence unit within An Garda Siochana, and the Revenue Commissioners. This guide explains who must file, what triggers a report, how filing works in practice and what to avoid, using the Act itself and the pages of FIU Ireland, Revenue, the Central Bank and Chartered Accountants Ireland. It sits alongside our guide to AML training under section 54 of the 2010 Act, which covers the separate duty to train staff.

Who must file an STR

Section 42 places the duty on a "designated person". Section 25 of the Act (Revised Acts version) lists the categories, which include credit institutions and financial institutions; auditors, external accountants and tax advisers; relevant independent legal professionals for defined services; trust or company service providers; property service providers; certain traders in goods and art traders; and other classes the Minister may prescribe. Some categories are limited by thresholds, and the page shows amendments affecting gambling-related entries under the Gambling Regulation Act 2024 as not yet commenced, so check the current text for your sector.

The Garda page on FIU Ireland says financial institutions and designated non-financial businesses or professions, such as accountants, solicitors, high-value goods dealers and auctioneers, must file STRs under section 42. If you work in a Dublin accountancy practice, bank, fund administrator or law firm, you are likely to be covered, but whether your business is a designated person is a legal question to confirm for your own circumstances.

What triggers a report

Under section 42(1), a designated person must report where, based on information obtained in the course of carrying on business as a designated person, they know, suspect or have reasonable grounds to suspect that another person has been or is engaged in money laundering or terrorist financing. The section adds that reasonable grounds may arise where the designated person cannot apply certain customer due diligence measures because the customer has not provided documents or information.

Three further points from the section are worth noting:

• Timing. The report must be made "as soon as practicable" after the knowledge or suspicion is formed.
• Scrutiny. A designated person is not taken to have reasonable grounds from information received until it has been scrutinised in the course of reasonable business practice, including automated banking transactions.
• Proceeding with the transaction. The section bars proceeding with the suspicious transaction or service before the report is made, unless that is not practicable or failing to proceed might alert the other person to the report or an investigation.

The Act's amendment notes on the page show that the reference to FIU Ireland and a duty to respond to requests for further information were added in November 2018, and a duty on FIU Ireland to give feedback where practicable was added in April 2021. The page shows no overall last-updated date.

What a report must contain

Section 42 says the report must include the information on which the suspicion is based, the identity of the person if known, the whereabouts of the property or funds if known, and any other relevant information. After filing, the designated person must respond as soon as practicable to requests for further information. The Central Bank's bulletin on suspicious transaction reporting (issue 2, November 2017, so now dated) adds supervisory expectations: reports should have accurate, current customer details, transaction dates and amounts, and the reason for suspicion; there is no minimum monetary threshold; and attempted transactions should be considered. It also says that where a possible underlying offence such as fraud or theft is identified, a separate report should go to An Garda Siochana.

How to file: FIU Ireland and Revenue

Two channels apply, and both are required:

• FIU Ireland via goAML. The Garda page says entities must register on goAML with FIU Ireland to file STRs electronically, and that individuals can only register if they are part of an organisation that is already registered. Chartered Accountants Ireland's page (updated 30 April 2024) says registration is required before a first submission and that paper reporting is no longer accepted.
• Revenue via ROS. Revenue's page (last updated 19 February 2025) says STRs go to Revenue through the Revenue Online Service only, that paper STRs stopped being accepted on 7 September 2020, and that you need ROS login details, a valid digital certificate, STR registration on ROS (which requires the FIU Organisation ID) and a sub-user certificate for each MLRO. It states that dual reporting is still required.

Chartered Accountants Ireland's page says a designated person must be registered on goAML before submitting a first STR, so a firm that has never filed may wish to register before it needs to. That is our suggestion rather than a legal rule, but it avoids a delay at the moment "as soon as practicable" matters.

Tipping off and the penalties on the face of the Act

Section 49 prohibits a designated person who knows or suspects that a report has been or must be made, or that an investigation is contemplated or under way, from disclosing anything likely to prejudice it. The section extends to agents, employees, partners, directors, other officers and contractors acting on the designated person's behalf. Failing to comply is an offence, and the page states a fine of up to 5,000 euro or up to 12 months' imprisonment, or both, on summary conviction, and a fine or up to five years' imprisonment, or both, on indictment. Section 42 carries the same penalty structure for failing to report.

Our suggestion (not a statutory requirement): staff who suspect something could escalate internally and avoid discussing the matter with the customer or with colleagues who do not need to know.

Building a workable internal process

The following is a practical approach based on the Central Bank bulletin's inspection findings, not a legal checklist. The bulletin reported firms where staff raised suspicions verbally or by email rather than the required form, where MLROs did not always acknowledge internal reports, where monitoring systems were rarely reviewed, and where MLRO files lacked reasoning for reporting or not reporting.

• Give staff one clear internal reporting route and form, and make sure the MLRO acknowledges each report.
• Record what triggered the suspicion, what further enquiries were made, whether a report was filed and why.
• Test your transaction monitoring so that alerts are neither overwhelming nor silent.
• Train staff on both internal escalation and the tipping-off rule. Where your firm is also regulated by the Central Bank, our guide to the Central Bank Minimum Competency Code and CPD covers a separate competence regime.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is there a minimum amount that triggers an STR?

The Central Bank's 2017 bulletin says there is no minimum monetary threshold. The test in section 42 is knowledge, suspicion or reasonable grounds to suspect, not an amount.

Who receives an STR in Ireland?

Both FIU Ireland, through goAML, and the Revenue Commissioners, through ROS. Revenue's page states that dual reporting is still required.

Can I tell the customer I have filed a report?

No. Section 49 prohibits disclosures likely to prejudice an investigation that may follow a report, and extends to employees and contractors of the designated person.

Does an individual accountant register on goAML?

According to the Garda FIU page, individuals can only register if they are part of an organisation that is already registered, so the organisation registers first.

Always check the current Act and the FIU and Revenue pages before you rely on this summary.