An Irish payment firm reviewing a new business customer needs more than a name search. It needs to know who owns the customer, whether a possible match is the same person, and whether the result calls for PEP due diligence, sanctions action or further investigation.
Sanctions and PEP screening in Ireland brings together Irish anti-money laundering law and applicable EU restrictive measures. This guide focuses on the Republic of Ireland, with sources checked on 13 November 2026. Northern Ireland has a different legal framework.
Start with the firm's Irish obligations
The Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (CJA 2010), as amended, sets out the Irish AML framework. Its term designated person means a person or business within the statutory categories and activities. These include credit and financial institutions and specified professional, property, trust/company-service and other businesses. Section 25 contains activity conditions and exceptions; handling money alone is not the test.1
The Central Bank of Ireland supervises credit and financial institutions for AML/CFT purposes. Other sectors have different competent authorities. Check the firm's category under section 60 rather than assuming that every designated person reports to the Central Bank for every purpose.2
Sanctions are a separate layer. A business outside the AML designated-person categories can still be subject to EU sanctions. Identify the applicable regulation, its territorial and personal scope, and the restriction affecting the activity. A low AML risk rating does not override a sanctions prohibition.3
Define who is being checked
For customer due diligence, section 33 addresses identifying and verifying customers and beneficial owners, understanding ownership/control structures and checking people acting on a customer's behalf. Section 37 separately addresses PEP identification, including customers and connected beneficial owners. Do not substitute a search of the company's name for the people checks.45
Use the beneficial-owner and related-party screening guide to organise the supplied ownership information. A commercial screening result does not discover every undisclosed owner or verify the customer's identity documents.
The table below is a suggested operating plan, not a new statutory checklist. Adapt it to the firm's services and applicable rules.
| Party or event | What the team needs to establish | Practical screening step |
|---|---|---|
| New individual customer | Identity, purpose of the relationship and relevant political exposure | Compare names and available identifiers; investigate candidates before recording an outcome |
| New corporate customer | Entity identity, beneficial owners, ownership/control and relevant representatives | Screen the entity and identified people separately; retain each person's role |
| New owner or representative | What changed and which checks apply to that role | Update the file, check the new party and reassess affected decisions |
| Public-role or relationship change | Whether the facts meet an Irish PEP or connected-person category | Verify the office or connection and apply the relevant measures |
| New sanctions designation | Whether existing relationships or assets are affected | Recheck identity and ownership/control promptly; escalate applicable restrictions |
| Payment or other transaction | Relevant parties, activity and payment-specific rules | Apply the controls for that service; a customer check does not settle every transaction restriction |
Apply Irish PEP rules to the actual role or connection
A politically exposed person (PEP) holds, or has recently held, a prominent public function. Section 37 covers domestic and foreign political exposure and defines the relevant functions, immediate family and close associates. A family member need not hold public office; a casual acquaintance is not automatically a close associate. Record the actual office or qualifying connection, with its evidence.5
For Irish public roles, the January 2023 ministerial guidelines give local examples: the President, Taoiseach, Government Ministers and Ministers of State, members of Dáil Éireann and Seanad Éireann, Supreme Court judges and members of the Central Bank Commission. These are examples of functions, not a complete named-person database. Verify who holds the role and the relevant dates. The guidelines remain subject to the Act.6
Where a customer is a PEP, an immediate family member or a close associate, the required measures include senior-management approval before establishing or continuing the relationship, determining the source of wealth and funds for the relevant transactions, and enhanced monitoring. Section 37(6) applies those measures to the customer where the relevant beneficial owner qualifies. The statutory trigger includes knowledge or reasonable grounds to believe; a database label alone does not answer that question.5
The definition includes public functions held within the preceding twelve months. Section 37(4A) requires measures to continue for as long as reasonably required by continuing PEP-specific risk, until that risk is deemed no longer present. A departure date is therefore a review input, not an automatic expiry date.5
Use the source of funds and source of wealth guide for the evidence-gathering work. If company policy checks a wider set of political connections, distinguish that policy from statutory PEP classification. A PEP finding does not establish wrongdoing or require a sanctions freeze.
Check the applicable sanctions measure
The Central Bank links to EU and UN sanctions lists. Use them to locate records, then check the operative measure, dates and scope. A consolidated name search does not cover every sectoral, services or trade restriction. Do not assume that publication of a UN record and application of a particular EU measure are the same legal event.3
Our EU sanctions list overview explains the sources. If the business or transaction has a UK, US or other jurisdictional connection, assess those rules separately.
Ownership and control need their own review. The Council's EU Best Practices discuss ownership, aggregation and several indicators of control. A shareholding below 50% is not a safe harbour where control or another applicable restriction exists. Equally, one listed employee or director does not by itself establish that every company asset must be frozen. Assess the ownership path, voting and appointment rights, and other control facts against the applicable measure.7
Investigate a possible match before clearing it
Compare full names, aliases, dates, addresses, registration numbers, public roles and source references with the customer file. Check whether an apparent difference is reliable or simply missing or outdated information. Nationality alone is a poor basis for clearing a possible match.
Where information is insufficient, keep the identity question open and escalate promptly. An internal review hold and a legal asset freeze are different decisions. Review controls must prevent prohibited dealings while the team resolves the issue; “not yet confirmed” is not permission to release a payment. Record the evidence, remaining uncertainty and person responsible for the next step.
The Central Bank's reporting instructions specifically ask credit and financial institutions to take reasonable steps to establish that the identified party is the listed party before submitting the return.8
Keep the reporting routes separate
| Finding | Relevant route | What to keep distinct |
|---|---|---|
| Applicable financial sanctions match affecting accounts or transactions | The Central Bank instructs credit and financial institutions to freeze accounts and/or stop transactions immediately and report through its Financial Sanctions Return, uploaded to the Central Bank Portal | Follow the applicable measure and the affected assets/activity; a return is not an authorisation to release funds |
| Knowledge, suspicion or reasonable grounds to suspect money laundering or terrorist financing within section 42 | Report as soon as practicable to FIU Ireland and the Revenue Commissioners | A sanctions return is not a substitute; assess the statutory trigger rather than treating every PEP candidate as suspicious |
| Suspected sanctions breach | The Central Bank FAQ directs reporting to An Garda Síochána (the Irish police) | This is distinct from the frozen-assets return and from the section 42 assessment |
The first and third routes follow the Central Bank's sanctions instructions; the STR route follows section 42.893
Revenue's current instructions require STR submission to Revenue through Revenue's Online Service (ROS) and confirm dual reporting. They also describe exchanging the report's XML file with the FIU goAML system. Keep acknowledgements for both recipients instead of assuming one submission reaches both.10
Section 42(7) contains restrictions and exceptions concerning proceeding before a report is sent; subsection (8) preserves relevant directions or orders. Have the responsible compliance team apply those provisions. Sending a report does not override a sanctions prohibition or an instruction not to proceed.9
Recheck when the facts change
Section 35 requires monitoring proportionate to money-laundering and terrorist-financing risk. New ownership, revised identifiers or a newly discovered public role may change the customer assessment. Sanctions controls also need to address new designations and restrictions before a prohibited dealing occurs.113
Set responsibilities for those events as well as periodic file reviews. Do not present an annual review as sufficient for every sanctions obligation, or one daily screening rule as applying to every business. Payment firms must assess the rules specific to their services; the payment-institutions guide covers that separate workflow.
Agree responsibilities with administrators and distributors
For funds and fund management companies, the Central Bank's November 2021 bulletin addresses weaknesses in outsourced AML/CFT and financial-sanctions work. It states that firms retain responsibility for their obligations and must oversee outsourced activities.12
Make the handoff concrete: who identifies the investor and beneficial owners, investigates the candidate, seeks approval, applies restrictions and submits each report? Agree access to the evidence and arrangements for unresolved cases. An administrator's “screening completed” message is not enough if the firm cannot see what was checked or act on a later change.
Three examples of Irish screening decisions
These examples are fictional and do not describe actual listed people or Checklynx customers.
A common name with no full birth date
A new customer's beneficial owner has the same name as a sanctions candidate. The source has only an approximate birth year. The analyst gathers further identifiers and checks aliases and source documents. Missing data is not treated as a mismatch. If the evidence remains inconclusive, the case stays open with an escalation owner and appropriate transaction controls.
A beneficial owner is the child of a serving legislator
A company supplies an owner with a 30% stake and states that she is the daughter of a serving member of the Oireachtas, Ireland's parliament. The team verifies the ownership, identities, office and relationship. If the statutory connection is established, it applies the required measures to the customer, including approval and source-of-wealth/funds work. It records the family-member category rather than claiming the owner personally holds office.5
A newly listed shareholder has a minority stake
An existing corporate customer has a shareholder who becomes designated. The supplied shareholding is 40%, but a shareholder agreement may give that person appointment rights or dominant influence. Compliance investigates the control facts and applicable measure instead of clearing the company on the percentage alone. It records affected assets and transactions, any required action/reporting and the basis for the conclusion. It does not return funds or terminate a loan as a shortcut around a restriction.7
Keep records with the correct retention dates
Section 55 distinguishes customer due-diligence records from transaction and service records. The general minimum is five years, but the starting event depends on the category. Customer records use cessation of services or the last transaction, whichever is later; particular transaction/service records have their own completion or discontinuance dates. A qualifying written Garda direction can extend retention by up to five years. The section also requires deletion of personal data retained solely under it when its retention periods expire.13
- Identify the subject, their role and why the check was made.
- Retain screening inputs, source references, date and candidate details.
- Explain the identity outcome and any separate PEP or ownership/control assessment.
- Record approvals, evidence requests and unresolved questions with an owner.
- Log freezing/stopping actions, reports and acknowledgements separately.
- Assign the relevant retention category, starting event and next review trigger.
Document the data-processing basis, access controls and applicable retention requirements. Broader internal screening policy does not itself create a statutory processing obligation. Use the GDPR and screening guide for the wider privacy assessment.
Evaluate screening software against the Irish process
Checklynx brings source records together into enriched, structured profiles. Available aliases, identifiers, public roles and source context help analysts compare candidates with the person or business being checked. That context can help resolve false positives; it does not guarantee that every profile contains every field or establish legal status.
Test sanctions screening and PEP screening with representative Irish customer cases: common names, supplied owners, family connections and changes during a relationship. Check dataset scope, update handling and review evidence. Compare pricing using the same population and requirements.
Frequently asked questions
Does this apply to Northern Ireland?
The Irish law and reporting routes described here concern the Republic of Ireland. Assess Northern Ireland under the applicable UK framework, with any other relevant jurisdictional connections considered separately.
Is a PEP result a reason to freeze an account?
PEP classification calls for the applicable due-diligence measures. A sanctions restriction requires its own assessment; do not infer one from political exposure alone.
Is one Irish STR submission enough?
Section 42 requires reporting to FIU Ireland and Revenue. Follow the current submission instructions for both and retain their acknowledgements.910
Can a company be cleared because a listed shareholder owns less than half?
Not on that fact alone. Investigate control, indirect and aggregated ownership, and the applicable restriction.7
Official sources
Footnotes
-
CJA 2010, section 25, designated persons and activity conditions. The Law Reform Commission's Revised Act is an administrative consolidation updated to 10 August 2026, consulted 13 November 2026. ↩
-
CJA 2010, section 60, competent authorities; Central Bank, regulatory requirements and guidance. ↩
-
Central Bank, financial sanctions FAQs, scope, ownership/control, freezing and suspected breaches; read with the applicable EU measure. ↩ ↩2 ↩3 ↩4
-
CJA 2010, section 33, identification/verification and ownership/control; apply the provision's conditions and exceptions. ↩
-
CJA 2010, section 37, particularly subsections (1)–(4A), (6), (8) and (10); Central Bank, AML/CFT Guidelines for the Financial Sector, June 2021, section 5.6. ↩ ↩2 ↩3 ↩4 ↩5
-
Minister for Justice, definitions of prominent public functions, January 2023, published by the Property Services Regulatory Authority; local role guidance subject to the Act. ↩
-
Council of the EU, EU Best Practices, 11623/24, 3 July 2024, particularly paragraphs 62–68 on ownership, aggregation and control; guidance, not a replacement for the applicable regulation. ↩ ↩2 ↩3
-
Central Bank, sanctions reporting, identity checks and Financial Sanctions Return submission through the Portal. ↩ ↩2
-
CJA 2010, section 42, triggers, dual recipients, timing and transaction restrictions. ↩ ↩2 ↩3
-
Revenue, how to submit STRs, ROS, dual reporting and FIU goAML file exchange. ↩ ↩2
-
CJA 2010, section 35, relationship information and risk-based monitoring. ↩
-
Central Bank, AML Bulletin for Funds and Fund Management Companies, November 2021, section 3, outsourcing and retained responsibility. ↩
-
CJA 2010, section 55, record categories, retention triggers, extensions and deletion. ↩