Irish TCSP Authorisation and AML: Central Bank Findings Guide

Trust or company service providers (TCSPs) sit at a sensitive point in the Irish anti-money laundering (AML) system: they form companies, supply directors and nominee shareholders, and provide registered office addresses. This guide sets out who counts as a TCSP under Irish law, how authorisation works, what the Central Bank of Ireland found when it inspected TCSPs, and how a well-known Central Bank fine on group outsourcing maps onto the same weaknesses. It builds on our wider guide to Irish AML obligations under the Criminal Justice Act 2010.

Who counts as a TCSP in Ireland

According to the Central Bank of Ireland's TCSP authorisation page, a TCSP is any person whose business is providing one or more of seven services. They are forming companies or other bodies corporate; acting, or arranging for another person to act, as a director, secretary, partner, trustee or nominee shareholder; and providing a registered office, or a business or administrative address, for a body corporate or partnership. Nominee shareholding for companies whose securities are listed on a regulated market is excluded.

Section 84 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as shown on the Law Reform Commission's revised acts site, excludes three groups from the definition: members of a designated accountancy body, barristers or solicitors, and credit or financial institutions. The Central Bank page advises anyone in doubt about whether they need authorisation to take legal advice.

Who authorises, and what the process involves

The Central Bank page splits authorisation between two bodies. A TCSP that is a subsidiary of a credit or financial institution applies to the Central Bank, which took on that power from 3 March 2014. Section 84(2) of the 2010 Act reflects this by reading references to the Minister as references to the Central Bank for those subsidiaries. All other TCSPs apply to the Anti-Money Laundering Compliance Unit of the Department of Justice, which the Central Bank page names as the Department of Justice and Equality.

The same page states that the application fee is 130 euro, that an authorisation lasts three years from the date it is granted, and that a renewal application must be received no less than ten weeks before the renewal date. On the decision itself, the Central Bank can revoke or refuse an authorisation, impose conditions, amend it, or serve a direction on the holder. A holder can appeal to an independent Appeal Tribunal convened by the Minister.

Fit and proper test

Section 85 of the 2010 Act, as substituted in December 2019, says a person is not fit and proper if they have been convicted of money laundering, terrorist financing, or an offence involving fraud, dishonesty or breach of trust (including equivalent offences abroad), if they are under 18, or if they have suspended payments to creditors, cannot meet their obligations to creditors, or are an undischarged bankrupt. The section also has a general limb for anyone who is otherwise not a fit and proper person.

Keeping the Central Bank informed

Authorised TCSPs must report changes without delay through the Central Bank's online Portal. The page lists additional or discontinued TCSP services, direct or indirect ownership changes, and changes of address, director, legal name, trading name, principal officer or contact as examples. The Central Bank also publishes a register of authorised TCSPs and says it publishes a list in Iris Oifigiuil at least once a year.

What the Central Bank found: the 2019 Dear CEO letter

On 17 October 2019 the Central Bank's Head of its Anti-Money Laundering Division wrote to TCSP chief executives, asking them to brief their boards. The letter reported findings from supervisory engagement and on-site inspections since a 2017 seminar. It noted some improvement but said many TCSPs had not acted on earlier findings, and that many still leaned too heavily on their parent company's controls.

• Board oversight: AML was not a regular board agenda item and there was little robust challenge. Outsourced AML work, mostly to group entities, often lacked detailed firm-specific service agreements and was not adequately overseen by the board.
• The money laundering reporting officer (MLRO): Some MLROs could not act independently, for example where they were also directors of client companies. Responsibilities were not always documented and some MLROs did not report to the directors.
• Risk assessment: Most TCSPs could not show a documented, business-wide money laundering and terrorist financing risk assessment. Some had assessed only individual customers or single services.
• Policies and procedures: Some firms had no policies of their own and relied on parent policies that did not mention the TCSP. Some staff did not understand the group policies they applied, and where firms had their own policies they were often generic and not board approved.

The expectations in the letter are specific. AML should be a standing board item supported by reporting such as suspicious activity reports and high-risk customers. Outsourcing needs detailed written agreements that the board tests and monitors. The MLRO must be independent, avoid conflicting dual roles, and have a direct line to the board. The business-wide risk assessment should be driven by the firm rather than the parent, cover products, customers, jurisdictions and distribution channels, be reviewed at least annually, and be approved by the board. Policies should be tailored to the firm, comply with Irish law, be reviewed at least annually, and carry documented board approval.

A parallel from enforcement: Ulster Bank, 2016

Ulster Bank is a bank, not a TCSP, but the Central Bank's 2016 fine shows the same outsourcing theme in an enforcement outcome. According to the Central Bank's announcement of 1 November 2016, it fined Ulster Bank Ireland DAC 3.325 million euro and reprimanded it for breaches of the 2010 Act, which the bank admitted. The Central Bank said the bank lacked service level agreements for 19 of its 25 outsourced AML activities, which were mostly handled by four Royal Bank of Scotland group entities, and did not assess its money laundering and terrorist financing risks for over two years. It also said the bank gave new products to 64,900 pre-1995 customers without completing required due diligence. The Central Bank cited cooperation and early settlement as mitigating factors. The Director of Enforcement warned that outsourcing within a group can breed complacency. For how the Central Bank supervises firms more broadly, see our guide to Central Bank of Ireland AML supervision.

Our suggestions for TCSP compliance teams

These are Learnsignal's suggestions, not Central Bank requirements. First, map every AML task that sits with a group entity and check a written, firm-specific agreement exists for each. Second, put AML on every board agenda with a short fixed set of indicators. Third, check that your MLRO has no conflicting role in client structures. Fourth, rewrite the business-wide risk assessment in your own words and date its annual review. Fifth, test whether staff can explain the policy they actually apply. Training that covers these duties is available through Learnsignal CPD.

What we could not confirm

We read the Central Bank's TCSP page and the 2019 letter on 22 October 2026 and could not confirm whether the fee, three-year validity and ten-week renewal rule have changed since those pages were written. The page still names the Department of Justice and Equality, so check the current department name and contact details. We did not review the application guidance form, the offence provisions for operating without authorisation, or any more recent Central Bank TCSP communications, so treat this guide as a starting point rather than a full compliance checklist.

Frequently asked questions

Do solicitors and accountants need TCSP authorisation?

Section 84 excludes members of a designated accountancy body, barristers and solicitors, and credit or financial institutions from the TCSP definition. Check your own position against the Act.

How long does an authorisation last?

The Central Bank page states three years from the date of authorisation, with renewal applications due at least ten weeks before the renewal date.

Can a group AML policy replace a firm-specific one?

The 2019 letter says firms using group policies should show they have assessed alignment with the TCSP's activities and Irish law and that staff understand them.