AML checks for estate agents in Ireland: what the 2010 Act actually requires

The duty runs across Chapter 3 of Part 4 of the Act — ss.33 to 40 as amended, read with the risk-based calibration in s.30B — not just the identification provisions in s.33.

If a customer fails to produce the documents, the Act is blunt (s.33(8)): you must not provide the service while the failure continues, and must discontinue the relationship — and the failure itself can be grounds for a suspicious transaction report.

Politically exposed persons add a layer: before establishing the relationship you must determine whether the customer or beneficial owner is a PEP (or family member or close associate), and if so obtain senior-management approval, establish source of wealth and funds, and monitor on an enhanced basis (s.37).

Section 39 (as substituted by s.19 of the 2018 Act), together with Schedule 4 to the Act, requires enhanced measures wherever a relationship or transaction presents a higher risk of money laundering — and Schedule 4’s own list of higher-risk factors reads like an ordinary week in estate agency:

Section 38A adds a mandatory case on top: a customer established or resident in a country the European Commission has designated high-risk, which applies whenever an overseas purchaser buys through a company registered there.

Failing to apply enhanced measures where required is an offence in its own right (s.39(4), s.38A(4)): a class A fine (up to €5,000) and/or up to 12 months’ imprisonment on summary conviction, or an unlimited fine and/or up to 5 years on indictment.

Section 34A allows reduced measures in a lower-risk situation — but only where that lower-risk area was already identified in your business risk assessment (s.34A(1)) and you judge the specific relationship lower risk.

Using it isn’t a shortcut: s.34A(3) requires a record of why you judged the relationship lower risk and the evidence behind that judgement, plus sufficient ongoing monitoring to catch anything that changes, and it stays expressly subject to the monitoring and record-keeping duties in s.33(1)(c) and (d). A firm that applies simplified due diligence without that paper trail has, on paper, done no due diligence at all.

Where a customer is a company, s.33(2)(b)(iii) lets you fall back on identifying its senior managing official only where you’ve taken reasonable measures to verify the beneficial owner’s identity and kept a record of the difficulties encountered — it is not a free pass.

The Central Register of Beneficial Ownership (S.I. No. 110/2019) helps but doesn’t discharge the duty on its own: Regulation 25(1) gives you a right of access to it, but Regulation 25(2) says it “shall not be relied upon exclusively” — you still need your own verification.

Two duties run the other way, too.

The PSRA expects every client rated high, medium or low with the rating clearly recorded, and publishes templates and checklists for both. Complex, unusually large or apparently purposeless transactions must be examined and monitored more closely (s.36A).

Reporting to one does not discharge the duty to the other, and tipping off the subject afterwards is itself a criminal offence (s.49). PSRA inspectors expect licensees to demonstrate working knowledge of this at inspection.

Filing the report changes what you can do next. Section 42(7) says you must not proceed with the transaction until the report has been sent, subject to narrow carve-outs where that’s genuinely impracticable or would itself tip off the subject, and s.42(6) sets out what the report must contain; s.42(6A) also puts you on the hook to answer any follow-up questions from the FIU or Revenue.

Separately, a Garda superintendent can direct that a transaction be held for up to 7 days under s.17, and the District Court can extend that to up to 28 days by an order made ex parte and heard in camera, renewable — breaching a s.17 order carries up to 5 years on indictment.

There’s a prerequisite most firms discover too late: you cannot report “as soon as practicable” (s.42(2)) if your firm isn’t registered to report at all.

Register both before you need to report, not after.

Deletion after that point isn’t a GDPR housekeeping choice: s.55(7B), inserted by the 2018 Amendment Act, requires you to delete personal data held solely for AML purposes once the retention period expires. Records you’re keeping for another reason at the same time — PSRA licensing, a Revenue obligation, defending a legal claim — sit outside that duty.

Staff must receive ongoing AML training, and your policies and procedures must be written down, approved by senior management and kept under review (s.54); the PSRA publishes a policies-and-procedures template it recommends every firm adopt.

These are criminal obligations, and the penalty structure is the same across every core duty above — the business risk assessment, Customer Due Diligence, suspicious transaction reporting, tipping off, policies and training, and records (ss.30A(8), 33(9), 42(9), 49(3), 54(15), 55(12) and 56(2)):

Money laundering itself carries up to 14 years.

Regulation (EU) 2024/1624 (the new AML Regulation) applies directly from 10 July 2027 (Art 90), and the accompanying Sixth Directive (EU) 2024/1640 is due to be transposed into Irish law by the same date — it’s that domestic transposing legislation, not the EU text itself, that will be the thing to watch as the date nears.

The new EU AML Authority, AMLA, established under Regulation (EU) 2024/1620, has been operating from its Frankfurt seat since 1 July 2025 — but it directly supervises only a shortlist of higher-risk financial entities; estate agents stay with the PSRA.

Five changes will matter here once transposed:

EstatePilot builds the CDD file as the sale progresses: proof of identity, proof of address, proof of funds, beneficial ownership declarations and company registration held against the client record, each reviewed by a named person at your agency with their notes attached and a SHA-256 checksum taken automatically, and a five-year retention date set the moment the file closes — matching the s.55 duty above.

For online auctions, no paddle number is issued until the registration is approved. See PSRA and AML compliance software or the companion guide to PSRA obligations.