AMLR 2027: what Irish practices must do

When it applies

The Regulation was published on 19 June 2024 and applies from 10 July 2027. It is a regulation, not a directive, so it is binding in its entirety and directly applicable in all 27 member states.

What you must do for every client

Article 20(1) lists what customer due diligence consists of:

• Identify the client and verify their identity.
• Identify the beneficial owners and take reasonable measures to verify them, so you understand the ownership and control structure.
• Understand the purpose and intended nature of the relationship or transaction.
• Check whether the client or its beneficial owners are subject to targeted financial sanctions, and whether sanctioned persons control a company client or hold more than 50% of it.
• Understand the nature of the client's business, or their employment or occupation.
• Monitor the relationship on an ongoing basis, including where necessary the source of funds.
• Find out whether the client or beneficial owner is a politically exposed person, a family member or a close associate of one.
• Identify and verify anyone a transaction is carried out for, and anyone acting on the client's behalf, checking they are authorised to do so.

Due diligence also applies to an occasional transaction of EUR 10,000 or more, single or linked (Article 19(1)(b)).

When you cannot complete it

If you cannot complete due diligence, you must not take the client on, or must end the relationship, and you must consider whether to report a suspicion (Article 21(1)). Keep a record of what you did and why, including when you refuse a client (Article 21(3)). For accountants, tax advisers and lawyers, this does not apply to the extent you are ascertaining a client's legal position or representing them in judicial proceedings (Article 21(2)).

Higher-risk clients

• Enhanced due diligence applies to higher-risk cases, including relationships involving high-risk third countries and politically exposed persons (Article 34).
• High-risk third countries are designated by the European Commission (Article 29).
• When someone stops being a politically exposed person, enhanced measures continue for at least 12 months (Article 45(2)).

Keeping client information up to date

Article 26(2) sets the longest gap between updates of client information: one year for higher-risk clients, and five years for everyone else.

Your firm's own file

• Policies and procedures (Article 9). Policies are approved by the management body; procedures and controls at least at compliance manager level.
• A business-wide risk assessment (Article 10), taking into account at least six inputs: the Regulation's risk variables and factors, the Union risk assessment, national and sector risk assessments, information from standard setters, the Commission and AMLA, information from the authorities, and your own client base. It must be reviewed regularly.
• A compliance manager and a compliance officer (Article 11). The compliance manager is a member of the management body; the compliance officer runs AML day to day. The compliance manager reports to the management body at least once a year.
• Training (Article 12). Staff must know the requirements, your risk assessment and your policies, including on personal data.
• Staff integrity checks (Article 13). Anyone directly involved in compliance is assessed before they start, with the content approved by the compliance officer.

Suspicions

Firms and their staff must report suspicions to the FIU and reply to an FIU request for information within five working days, or less than 24 hours where the FIU says it is urgent (Article 69(1)).

Records

Keep due diligence records for five years (Article 77(3)). The clock starts when the relationship ends, when an occasional transaction is carried out, or when you refuse a client.

How Client Cleared helps

Client Cleared runs these checks for every client, keeps your firm's own file in one place, and keeps the record as you go. See everything it does, or common questions.