Customer due diligence in Ireland: What the Central Bank expects

When is CDD required?

Under the Criminal Justice Acts, a designated person must apply customer due diligence:

• Before establishing a business relationship
• On an occasional transaction of €15,000 or more, whether in one operation or several that appear linked
• Whenever there is a suspicion of money laundering or terrorist financing, regardless of value
• Whenever there is doubt about the veracity of information previously obtained
• On an ongoing basis, for the life of the relationship

That last point is the one firms treat as optional. CDD is not an onboarding task that finishes.

Timing, and what to do when it cannot be completed

Verification is meant to be done before the relationship starts or the transaction is carried out. The Act allows it to be completed during the establishment of the relationship where that is necessary so as not to interrupt the normal conduct of business and the risk is low, provided it is finished as soon as practicable. That is a narrow exception, and the file should say why it was used.

Where a customer will not provide the documents or information needed, the firm cannot proceed with the relationship or the transaction, and the Act says that failure can itself amount to reasonable grounds to suspect money laundering. Every stalled file should reach the MLRO, because the next decision is whether a suspicious transaction report is required.

The three levels of CDD

Standard CDD

Identify the customer and verify identity from reliable, independent source documents or data. For a legal entity, identify the beneficial owners and take reasonable measures to verify them. Understand the purpose and intended nature of the relationship.

Simplified CDD

Available only where the risk is demonstrably low, and the demonstration has to be on the file. Simplified CDD is a reduced, risk-based package. It is not an absence of CDD, and treating it as one is a common finding.

The Act carries its own lists of lower-risk and higher-risk factors, added in 2018, and the business risk assessment is where a firm decides how they apply to its own customers. Simplified measures should trace back to a factor on the lower-risk list and to that assessment, not to the customer being long-standing or well known.

Enhanced CDD

Required for politically exposed persons, for high-risk third countries, for unusually large or complex transactions, and wherever the ordinary measures leave a question unanswered.

Enhanced due diligence is not more documents. It is a distinct control set: senior approval to enter or continue the relationship, verified source of wealth, and closer ongoing monitoring.

Politically exposed persons

Since 2018 the rules cover domestic PEPs as well as foreign ones, together with their immediate family members and known close associates. For each: senior management approval before the relationship starts or continues, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. Screening at onboarding is not enough. A customer can become a PEP during the relationship, and a person is still treated as one for at least twelve months after leaving the position.

High-risk third countries

Where a customer is established in, or a transaction involves, a country on the EU’s high-risk third country list, enhanced measures are mandatory rather than a matter of judgement: additional information on the customer and the beneficial owners, on the source of funds and wealth and on the purpose of the transaction, senior management approval, and increased monitoring. The list changes; somebody has to own checking it.

Beneficial ownership

For corporate customers, obtain an RBO extract or equivalent as part of CDD, and take reasonable measures to verify the identity of the people it names. An extract filed at incorporation and never revisited tells you about a company that may no longer exist in that form.

Ownership is only half the test. Where a person controls an entity by other means, through board appointment rights or a shareholders’ agreement, they are a beneficial owner at any percentage.

Screen each beneficial owner, not only the entity. PEP status and sanctions attach to people, and a customer with a clean entity-level result and an unscreened owner is an open finding. The beneficial ownership guide covers the 25% test, the three Irish registers and discrepancy reporting in detail.

Ongoing monitoring

Section 35(3) of the Act requires ongoing monitoring of the business relationship, including scrutiny of transactions and keeping the CDD data current. In practice that means a review cycle tied to risk rating, and a record showing the review happened and what it concluded.

A monitoring log with no entries for two years is worse than no log. It documents the absence.

Trigger events and the review cycle

The Act does not set review intervals; the firm’s policy does, and the policy is what an inspector tests the files against. Most Irish firms review high-risk relationships at least annually, medium-risk every two to three years and low-risk every three to five, with any of these bringing a review forward:

• A change in ownership, directors or the nature of the business
• A transaction that does not fit the expected pattern, in size, frequency, counterparty or jurisdiction
• A new product, service or delivery channel taken up by the customer
• A PEP, sanctions or adverse media alert on the customer or an owner
• An identity document or company filing that has expired or lapsed
• A request to change payment details, correspondence address or authorised signatories

Each review ends in a dated record of what was checked, what changed, and whether the risk rating moved. Automated transaction monitoring does not replace the periodic review; it feeds it.

Reliance, outsourcing and electronic verification

Relying on a third party

The Act lets a firm rely on due diligence carried out by a relevant third party, such as another regulated firm or a professional adviser, but the responsibility stays with the firm doing the relying. It needs an arrangement under which the information is available immediately and the underlying documents on request, and it has to be satisfied that the third party is subject to equivalent obligations and supervision. Reliance never extends to ongoing monitoring, which the firm does itself.

Outsourcing and agents

Where an agent or an outsourcer performs due diligence on the firm’s behalf, that is outsourcing rather than reliance: the firm sets the standard, trains the agent, tests the work and owns the outcome. Agent and distributor networks are where payment and e-money firms are most often found short, because the training stopped at the firm’s own staff.

Electronic verification

Verification must come from a reliable and independent source, and that includes electronic sources where the firm has assessed their reliability and recorded why. An app-based identity check is acceptable for the right customer at the right risk level. The file should hold the result, the provider, the date and the match outcome, not a note saying it was done, and the policy should say when a remote check is not enough on its own.

Common Central Bank findings

• CDD completed after the relationship started, or after the first transaction
• Risk ratings applied with no reasoning recorded
• Simplified CDD used without evidence that low risk was established
• PEP screening at onboarding only, never repeated
• Beneficial ownership taken from the customer without independent verification
• Enhanced measures triggered but never actually applied
• Files that cannot be reconstructed because documents live in someone’s inbox

A file review method for the MLRO

Inspectors sample files. An MLRO who samples first finds the problems on their own terms. A method that scales from a ten-person firm to a thousand:

1. Sample by risk. Every high-risk file over the year, a proportion of medium and low, and every file onboarded by a new joiner in their first months.
2. Test against the checklist below. Pass or fail per point, so the result is a number rather than an impression.
3. Find the cause, not the file. A missing source-of-funds record in one file is an error; in a third of the sample it is a training or a system failure.
4. Fix and date it. Remediation owners and deadlines for each cause, tracked to closure.
5. Report it. Results, causes and remediation status to the board each quarter, so the paper trail shows the firm found and fixed its own problems.

The CDD file checklist

What a complete file holds, at minimum:

1. Identity documents for the customer, and verification of them
2. Beneficial ownership evidence, including the RBO extract for corporates
3. The purpose and intended nature of the relationship
4. The risk rating, and the reasoning behind it
5. Source of funds, and source of wealth where the risk calls for it
6. PEP and sanctions screening results, with dates
7. Senior approval where enhanced measures apply
8. The ongoing monitoring log
9. The training record for the person who did the work

Keep the file for at least five years after the relationship ends or the last transaction, whichever is later, and keep it where the person who needs it at inspection can find it in minutes rather than days.

Training the team

CDD failures are almost always training failures. The person who accepted the document did not know what a reliable source looked like, or did not know the threshold, or did not know that an entity with a 45% shareholder can still be controlled by them.