AML checks for estate agents in Ireland: what the 2010 Act actually requires

Search for what AML requires of an estate agent and most of what comes back is British. It describes a different statute, a different supervisor and a different registration regime, and none of it is authority for anything an Irish agency does. If a checklist mentions HMRC, MLR 2017, or registering your business with HMRC as an estate agency business, you are reading the wrong jurisdiction.

The retention row is the one that catches people out, because the headline number is the same on both sides and the fine print is not. Everything below is Irish law, and the Irish threshold that goes wrong most often is the letting one.

The duty runs across Chapter 3 of Part 4 of the Act — ss.33 to 40 as amended, read with the risk-based calibration in s.30B — not just the identification provisions in s.33.

If a customer fails to produce the documents, the Act is blunt (s.33(8)): you must not provide the service while the failure continues, and must discontinue the relationship — and the failure itself can be grounds for a suspicious transaction report.

Politically exposed persons add a layer: before establishing the relationship you must determine whether the customer or beneficial owner is a PEP (or family member or close associate), and if so obtain senior-management approval, establish source of wealth and funds, and monitor on an enhanced basis (s.37).

Section 39 requires enhanced measures wherever a business relationship or transaction presents a higher degree of risk of money laundering or terrorist financing.

It has been a duty rather than a discretion since 14 June 2013. That is the day s.10 of the Criminal Justice Act 2013 substituted the section, in terms that left no room: the designated person “shall … apply additional measures to those specified in this Chapter”. The permissive “may” it replaced was the originally enacted 2010 text — not something the 2018 Act flipped.

The 2018 Amendment Act substituted s.39 a second time, at s.19, and three parts of the section you read today are its work. Section 39(2) supplies an objective test: whether a reasonable person, having regard to the factors in s.30B(1)(a) to (f), would determine that the relationship or transaction presents a higher risk. That is also how Schedule 4 reaches s.39 — not directly, but through s.30B(1)(e), which is one of the paragraphs s.39(2) points at. Section 39(4) makes failure an offence in its own right, which the 2013 text did not.

Section 39(3) is something else again: a power for the Minister to prescribe further higher-risk factors additional to those in Schedule 4, exercisable only where satisfied that the factors do suggest higher risk. The Schedule itself was inserted by the same 2018 Act, at its own s.39 — a collision of numbering rather than a cross-reference.

Schedule 4’s own list of higher-risk factors reads like an ordinary week in estate agency:

Section 38A adds a mandatory case on top: a customer established or resident in a country the European Commission has designated high-risk, which applies whenever an overseas purchaser buys through a company registered there.

Failing to apply enhanced measures where required is an offence in its own right (s.39(4), s.38A(4)): a class A fine (up to €5,000) and/or up to 12 months’ imprisonment on summary conviction, or an unlimited fine and/or up to 5 years on indictment.

Section 34A allows reduced measures in a lower-risk situation — but only where that lower-risk area was already identified in your business risk assessment (s.34A(1)) and you judge the specific relationship lower risk.

Using it isn’t a shortcut. Section 34A(3) requires a record of why you judged the relationship lower risk, and of the evidence behind that judgement. It requires sufficient ongoing monitoring to catch anything that changes. And it stays expressly subject to the monitoring and record-keeping duties in s.33(1)(c) and (d). A firm that applies simplified due diligence without that paper trail has, on paper, done no due diligence at all.

Where a customer is a company, its senior managing official can stand in for the beneficial owner — but not on your say-so, and not on the Act’s word alone.

The gate sits in the Directive, not the section. Section 33(2)(b)(iii) bites only “where the beneficial owner is the senior managing official referred to in Article 3(6)(a)(ii) of the Fourth Money Laundering Directive”, and it is that Article that decides when anyone qualifies. Its condition is the demanding one: the official stands in only where, “after having exhausted all possible means and provided there are no grounds for suspicion”, no beneficial owner is identified — or there is doubt about the one who was.

What s.33(2)(b)(iii) adds is the work and the file, and its word is “necessary”, not “reasonable”: you must take the necessary measures to verify that official’s identity, and keep records of the actions taken, “including any difficulties encountered in the verification process”. It is not a free pass.

The Central Register of Beneficial Ownership (S.I. No. 110/2019) helps but doesn’t discharge the duty on its own: Regulation 25(1) gives you a right of access to it, but Regulation 25(2) says it “shall not be relied upon exclusively” — you still need your own verification.

Two duties run the other way, too.

The PSRA expects every client rated high, medium or low with the rating clearly recorded, and publishes templates and checklists for both. Complex, unusually large or apparently purposeless transactions must be examined and monitored more closely (s.36A).

Reporting to one does not discharge the duty to the other, and tipping off the subject afterwards is itself a criminal offence (s.49). PSRA inspectors expect licensees to demonstrate working knowledge of this at inspection.

Filing the report changes what you can do next. Section 42(7) bars you from proceeding with the suspicious transaction or service until the report has gone to both bodies.

There are exactly two carve-outs, and they are narrow. Section 42(7)(a) applies where it is not practicable to delay or stop the transaction or service from proceeding. Section 42(7)(b) applies where you are of the reasonable opinion that failing to proceed may itself lead the other person to suspect that a report has been made or an investigation begun. Neither carve-out survives a s.17 direction: s.42(8) says subsection (7) does not authorise you to proceed against one.

Section 42(6) sets out what the report must contain, and s.42(6A) puts you on the hook to answer any follow-up questions from the FIU or Revenue.

Separately, a member of the Garda Síochána not below the rank of superintendent can direct by notice in writing that a transaction not be carried out for up to 7 days (s.17(1)). Section 17(2) is a separate thing rather than an extension of that: a District Court judge may order that a specified service or transaction not be carried out for up to 28 days, on information on oath of a member of the Garda Síochána and on the judge being satisfied both that there are reasonable grounds to suspect the transaction would comprise or assist money laundering or terrorist financing and that an investigation is taking place. The application is made ex parte and heard otherwise than in public (s.17(4)), and an order can be made on more than one occasion (s.17(3)). Breaching a s.17 direction or order carries up to 5 years on indictment.

There’s a prerequisite most firms discover too late: you cannot report “as soon as practicable” (s.42(2)) if your firm isn’t registered to report at all.

Register both before you need to report, not after.

Five years is the floor, not a ceiling. Section 55(4) is expressly subject to subsections (4A), (4B) and (4C): a member of the Garda Síochána not below the rank of Sergeant, having assessed the necessity and proportionality of further retention, may direct you in writing to keep specified records for up to 5 years beyond that period, where they are required for a money-laundering or terrorist-financing investigation or are likely to be required for a prosecution. The direction expires when the Garda Síochána notifies you that the grounds have fallen away, and you retain until the earlier of that notification and the end of the period the direction specifies.

Deletion after that point isn’t a GDPR housekeeping choice: s.55(7B), inserted by s.27(d) and (e) of the 2018 Amendment Act, requires you to delete personal data held solely for AML purposes once the retention period expires. Records you’re keeping for another reason at the same time — PSRA licensing, a Revenue obligation, defending a legal claim — sit outside that duty.

Staff must receive ongoing AML training, and your policies, controls and procedures must be adopted (s.54(1)), approved by senior management and kept under review (s.54(4)); the PSRA publishes a policies-and-procedures template it recommends every firm adopt.

Section 54 does not itself say “in writing”. The documenting duties are elsewhere and are worth knowing separately: the business risk assessment shall be documented (s.30A(3)) unless your competent authority decides otherwise and tells you, and the customer-level risk determination must be documented where the competent authority directs, which it may do for a whole class of designated persons (s.30B(2) and (3)). In practice a firm that cannot produce the documents cannot evidence any of it, so write them down regardless.

These are criminal obligations, and the penalty structure is the same across every core duty above — the business risk assessment, Customer Due Diligence, suspicious transaction reporting, tipping off, policies and training, and records (ss.30A(8), 33(9), 42(9), 49(3), 54(15), 55(12) and 56(2)):

Money laundering itself carries up to 14 years.

Regulation (EU) 2024/1624 (the new AML Regulation) applies directly from 10 July 2027. That date is in Art 90, and it carries one carve-out: football agents and professional football clubs — Art 3, points (3)(n) and (o) — are not caught until 10 July 2029.

The accompanying Sixth Directive (EU) 2024/1640 has no single transposition date. Art 78 sets four, staggered, and two of them have already passed.

On each of those it is the domestic transposing legislation, not the EU text, that will be the thing to read.

AMLA — the new EU AML Authority, established under Regulation (EU) 2024/1620 — exists. Its seat is fixed by Art 4, which puts it in Frankfurt am Main and, unlike most of the Regulation, has applied since 26 June 2024: Art 108 sets 1 July 2025 as the general application date but lists Art 4 among the articles that ran from the day the Regulation entered into force. It does not yet directly supervise anyone.

Art 13(4) is why. AMLA only commencesits first selection process by 1 July 2027, and then has six months to conclude it. Direct supervision begins six months after the list of selected entities is published. Recital 86 states the destination plainly: “Direct supervision of selected obliged entities should commence as of 2028.”

When it does begin, estate agents will not be in it. Only credit institutions and financial institutions can qualify as selected obliged entities (Art 13(1)), and the first list is capped at 40 of them (Art 106(2)). Estate agents stay with the PSRA.

Five changes in the Regulation will matter here. They take effect directly on 10 July 2027, with nothing for Ireland to transpose first:

EstatePilot builds the CDD file as the sale progresses. Proof of identity, proof of address, proof of funds, beneficial ownership declarations and company registration are held against the client record. Each is reviewed by a named person at your agency, with their notes attached and a SHA-256 checksum taken automatically. A five-year retention date is set the moment the file closes, matching the s.55(4) duty above.

For online auctions, no paddle number is issued until the registration is approved. See PSRA and AML compliance software or the companion guide to PSRA obligations.