ML/TF Risk and Context

1. Ireland faces significant ML threats from foreign proceeds of crimes. In addition to the ML threat from domestic proceeds of crime, such as drug crime, fraud, or smuggling, Ireland is facing substantial ML threat from foreign proceeds of crime due to the prominence of Ireland’s financial sector. The ML/TF risks from abroad⁵ include foreign proceeds of crime (e.g., transnational organized crime, tax evasion, overseas corruption) flowing to Ireland for integration into the legitimate economy, funds intended for ML/TF passing through its financial sector and outflows of domestic proceeds of crime for ML layering.

2. Rapid growth in the size of the Irish financial center over the last three years has increased further the ML/TF risks from non-resident and cross-border activity. The total financial sector assets have increased by 30.2 percent between 2017 and 2020 to EUR 6.57 trillion, mostly driven by the growth of investment funds, which are seen as a sector particularly vulnerable to ML. The value of cross-border payments in Ireland has increased at a significantly higher rate— more than threefold from an already high base, a drastic change from the stable flows over the previous years. This rapid growth has deepened Ireland’s already strong international links and increased its importance as an international financial center, with associated increase in the inherent ML/TF risks. Relocation of FIs and redirection of some financial sector activity to Ireland as a result of Brexit has contributed to the appearance of new ML/TF threats in Ireland. Increasing use of authorization in Ireland to perform the activities throughout the Single Market (i.e., single authorization principle or passporting) has also impacted Ireland’s ML/TF risk profile, particularly as related to the payment services. Financial flows to offshore financial centers⁶ have also risen rapidly in recent years, increasing fivefold in value since 2017, and representing emerging ML/TF risks as some of these jurisdictions have lower effectiveness of AML/CFT controls, including supervision, do not cooperate for tax purposes, and focus on provision of services to non-residents, a higher ML/TF risk activity.

3. The authorities demonstrated a deep and robust understanding of domestic risk of ML/TF, but to a lesser extent of risks related to transnational aspects of ML and TF. The risk assessments, including the NRA, identified a broad range of domestic ML/TF threats and vulnerabilities (banks, investments funds, payment institutions), but the depth of the analysis of international ML/TF risks appears not to be in line with the level of international ML/TF risk Ireland is facing. Moreover, the 2016 NRA as a basis of national ML/TF risk understanding took place before the rapid growth and evolution of the financial sector that has substantially increased and changed Ireland’s international ML/TF threat exposure.⁷

Ireland: Aggregate Cross-border Payments

(Aggregate Index, 2015 = 100)

Citation: IMF Staff Country Reports 2022, 324; 10.5089/9798400222795.002.A001

Source: IMF Staff Calculations

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Ireland: Aggregate Cross-border Payments

(Aggregate Index, 2015 = 100)

Citation: IMF Staff Country Reports 2022, 324; 10.5089/9798400222795.002.A001

Source: IMF Staff Calculations

• Download Figure
• Download figure as PowerPoint slide

Ireland: Aggregate Cross-border Payments

(Aggregate Index, 2015 = 100)

Citation: IMF Staff Country Reports 2022, 324; 10.5089/9798400222795.002.A001

Source: IMF Staff Calculations

• Download Figure
• Download figure as PowerPoint slide

4. The authorities’ good understanding of overall ML/TF risks and domestic coordination provides a solid foundation for broadening risk assessments to include cross-border ML/TF threats. Considering the rapid evolution and growth of the financial sector, we recommend conducting a thematic assessment on transnational aspects of ML/TF risks, including non-resident and cross-border ML/TF threats. This thematic assessment should aim at the analysis of new and emerging ML/TF risks and rely on the broad range of quantitative indicators,⁸ which should crucially include cross-border payments statistics. Specifically, it should analyze in detail the business models and geographical reach of FIs and associated ML/TF risks, emergence of new ML/TF risks from abroad, scrutiny of economic rationale for the financial flows with potentially higher-risk countries and exposure of various sectors to cross-border and non-resident activity. The assessment should also avoid over-reliance on the views and perceptions of public sector’s and FIs’ AML/CFT experts and would benefit from the views of experts with developed understanding of the recent rapid growth of the financial sector and its AML/CFT implications, including of independent experts. The assessment should also incorporate analysis of potential vulnerabilities to tax evasion and the impact of recent changes in the main counterpart’s international tax policies.

5. An enhanced understanding of transnational ML/TF risks can inform fine-tuning of national AML/CFT policy priorities to address increasing cross-border and non-resident ML/TF risks. The Central Bank, which is already attentive to non-resident ML/TF risks, can incorporate the results of the thematic assessment on transnational ML/TF risks into its risk-based approach to supervision, leveraging enhanced understanding of the exposure of various financial sector subsectors to prioritize supervisory resources, enhance periodic data collection and institutional risk assessment with risk indicators on cross-border and non-resident exposure, leveraging an evolved understanding of higher-risk countries. The FIU can use the thematic assessment’s results for prioritization of its operational analysis and to conduct complementing strategic analysis going forward. Law enforcement, which tends to focus mostly on domestic threats, should integrate the focus on transnational ML/TF into its policies and objectives, including development of necessary capacity and skills.

AML/CFT RISK-BASED SUPERVISION OF BANKS AND VASPS

6. The Central Bank is the designated AML/CFT supervisor for FIs. The financial sector in Ireland comprises banks, insurance companies, credit unions, investment and insurance intermediaries, mortgage intermediaries, e-money institutions, funds and funds administrators, investment firms, stockbrokers, money lenders, exchanges, and money transmitters. The Central Bank is also the designated supervisor for TCSPs that are subsidiaries of credit or FIs.⁹ Further, per the Criminal Justice (Money Laundering and Terrorist Financing) Amendment Act of 2021 (CJ Amendment Act, 2021), the Central Bank is responsible for the regulation and supervision of VASPs. The Central Bank’s supervisory responsibilities are divided over four teams within its Anti-Money Laundering Division.

7. The number of FIs has increased considerably since the publication of Ireland’s 2017 mutual evaluation report (MER), from approximately 9,500 institutions in 2016 to 12,536 institutions by end-2021 (with significant increases in high and medium-high risk firms). This growth was largely a consequence of the Brexit vote with large international banks, investments funds, e-money institutions and other FIs shifting operations to Ireland to continue to benefit from EU passporting rules. While not all entities (e.g., sub-funds) are the focus of supervisory engagements, the significant increase in the size of the sector, along with the inclusion of VASPs in the supervisory population, is a cause for serious strains on the Central Bank’s supervisory resources, which has seen no commensurate increase in the same period. Recognizing the challenges arising from the increased number of firms, augmentation of technical and human resources in line with the growth of the sector would be necessary to maintain minimum supervisory engagement on a risk-sensitive basis at the level and quality observed during and continuously delivered since the 2017 MER.

8. The Central Bank undertakes extensive graduated supervision of the financial sector. The Central Bank has a well-designed and comprehensive minimum engagement model, whereby the frequency and intensity of minimum supervisory engagement is determined by sectoral and entity level risk rating. Beyond this minimum engagement, the Central Bank also applies supervisory resources to additional supervisory engagements/activities to further mitigate ML/TF risks in the financial sector. During 2021, the Central Bank undertook 34 inspections, 87 review meetings, and the issuance of 630 Risk Evaluation Questionnaires (REQs) to firms. Further, in 2021, the Central Bank participated in 31 AML/CFT supervisory colleges for firms with branches and subsidiaries established in Ireland and hosted 6 AML/CFT supervisory colleges. The Central Bank also has a very robust awareness raising and sensitization framework and issues frequent sectoral guidance on AML/CFT obligations in the financial sector. The Central Bank uses a wide range of communication channels to ensure that the supervisory population is well-aware of their obligations, including guidelines, bulletins, Dear CEO letters, and speaking engagements.

9. The Central Bank has a detailed risk assessment model guiding its supervisory approach, which could be further enhanced by increased input on cross-border risks and their evolution. The Central Bank has an independent risk assessment model that takes into account both internationally accepted inherent risk factors (scale and complexity, product type, geographic risk, etc.) as well as AML/CFT controls to assign risk ratings, which in turn are further tailored with supervisory engagements and information from other stakeholders. Based on risk levels, entities are divided into ultra-high risk, high risk, medium-high risk, medium-low and low risk categories, which determines depth of engagement. Domestic retail banks and the largest money remittance firm currently occupy the highest risk category (ultra-high-risk). This supervisory approach would be further enhanced by more detailed information on cross-border risks. For instance, determination of higher risk jurisdictions is presently guided by the EC’s list and findings of international organizations without accounting for Ireland’s inherent ML/TF risks from cross-border business relationships, including payments to or from Ireland. This is despite the striking increase in inflow/outflow patterns since 2017 as outlined above. A thematic risk assessment of cross-border threats referenced above and undertaken by central authorities would be valuable in informing depth of engagement. Further, insufficient focus on cross-border payments data, mostly conducted by international banks is a lacuna in the Central Bank’s supervisory approach. It is vital that the Central Bank relies on broader sources of data, particularly sources of aggregated transactional data (notably, cross-border payments) as an input to its determination of entity level and sectoral risk for minimum engagement. Notably, the Central Bank’s Anti-Money Laundering Division includes a specialized Risk Team that could prioritize development of models for analyzing broad cross-border data.

10. Since 2017, the Central Bank has significantly broadened access to data from supervised entities; however, available cross-border data and analytical tools remain insufficient. Notably, since 2020, the Central Bank requires annual returns in the form of REQs from all supervised entities regardless of their risk level. REQs collect detailed information on client profiles, operations, and geographical reach of the supervisory population as well as the strength of their AML/CFT controls. While REQ information will greatly enhance development of entity risk-profiles, the existing data analysis system would be insufficient to adequately process the higher volumes of data. The Central Bank should update its data analytic toolkit to allow effective analysis of larger volumes of data, for example aggregating available data to monitor higher-level evolution of ML/TF threats as well as scrutiny of the pattern of cross-border activity on the level of individual FIs for more efficient identification of institutions and areas for further scrutiny. Investing in Suptech solutions, including those relying on network analysis, machine learning, and big data, could aid these efforts. The development of the Central Bank’s bank-wide data strategy presents an excellent opportunity to consider more sophisticated data analysis tools for AML/CFT risk-based supervision.

11. The Central Bank’s thematic supervisory engagements focus on the control frameworks and legal obligations of all firms and is very robust in assessing the strength of controls against laundering of proceeds of domestic crimes. The Central Bank’s recent supervisory engagements covered themes such as governance, CDD, transaction monitoring, STRs, BO, and politically exposed persons. On STRs, the FIU and Revenue Administration Suspicious Transactions Unit noted that they have seen improvements in quality and quantity of STRs from the financial sector, but STRs related to suspicious cross-border activities are fewer. However, threats from cross border illicit financial flows related to foreign proceeds of crimes are increasing at a fast pace and could potentially be channeled through the Irish banking system. To keep pace with the changes in the financial sector landscape, the Central Bank should ensure that thematic inspections on CDD, transaction monitoring, and STRs with international banks focus on cross-border activities that could be related to foreign proceeds of crimes (e.g., tax evasion, transnational aspects of corruption). The above-referenced thematic assessment of cross-border risks could help further fine-tune assessment of controls.

12. Commencement of the registration process for VASPs is a welcome move. With the promulgation of the CJ Amendment Act, 2021, Ireland’s AML/CFT framework for the VASP sector is almost entirely aligned with the FATF standards. A few minor deficiencies remain with respect to CDD thresholds and the travel rule as applicable to VASPs. These deficiencies are expected to be addressed in the recast EU 2015 Regulation which, will be directly applicable to Ireland, once adopted. Further, pursuant to the CJ Amendment Act, 2021, the Central Bank is currently processing a significant number of applications for registration of VASPs and expects a high volume of transactions in the sector. A comprehensive assessment of applicants is undertaken as part of the registration process, with detailed engagement and outreach. Once a VASP is registered and supervision commences, individual VASPs’ entity level risk rating will determine ongoing supervisory engagement. In the medium-long term, the authorities should also consider a thematic risk assessment of the virtual asset sector to further enhance the Central Bank’s continuous assessment of entity-level risk. The Central Bank should also invest in developing proper supervisory tools (considering, for instance, tailored data-collection tools and blockchain analysis solutions) for the sector, ensure upskilling to meet supervisory demands in the sector, and increase resources (e.g., human, technical, budget) commensurate with risks.

13. The Central Bank has a broad enforcement toolkit and can impose measures ranging from directions for remedial action to monetary penalties and should continue to vigorously pursue enforcement actions in line with compliance breaches and risk-levels. The Central Bank has a wide range of sanctions available in case of uncorrected breaches of AML/CFT obligations. Enforcement actions can result in, inter alia, reprimands, monetary penalties, restrictions, suspension or revocation of authorizations, and directions including those disqualifying/restricting concerned persons from serving management positions. Since 2015, nine enforcement actions in respect of suspected contraventions of AML/CFT requirements have resulted in monetary penalties.¹⁰ The Central Bank is in the process of enhancing the effectiveness of its enforcement framework through the Individual Accountability Project, which will, inter alia, enhance its ability to take enforcement action against individuals, in appropriate circumstances. The proposed Individual Accountability Framework could improve sanctioning of individuals for compliance breaches. To ensure that enforcement results in compliant outcomes, the Central Bank should vigorously pursue enforcement actions proportionate to level of controls failures detected and the entity’s ML/TF risk exposure. The authorities should also make full use of the broad range of enforcement tools (particularly criminal penalties against corporations and senior management officials) commensurate to the scale of the AML/CFT violations.

AML/CFT Risk-Based Supervision of Professional Gatekeepers

14. Continued efforts to inform and raise awareness of key ML/TF risks for lawyers (solicitors), accountants and TCSPs (professional gatekeepers) are very positive developments. The AMLCU, as well as self-regulatory bodies, continue to make extensive efforts to improve the understanding of supervised populations of their AML/CFT obligations through detailed guidance, training, and feedback. Awareness programs could improve compliance by supervised entities; however, STR filings in the sector remain dismally low.

15. Supervision of professional gatekeepers is fragmented.¹¹ AML/CFT supervisors for professional gatekeepers include the AMLCU for TCSPs not supervised by the Central Bank or designated accountancy bodies (DABs),¹² the Law Society of Ireland (a self-regulatory body) for solicitors,¹³ the Legal Services Regulatory Authority (LSRA) for barristers, the Property Services Regulatory Authority (PSRA) for property service providers and six designated accountancy bodies (DABs) (self-regulatory bodies) for their members who are accountants, tax advisors, auditors or who provide TCSP services. For accountancy, the majority of accountants in Ireland are members of DABs and are supervised by the relevant DAB, while the AMLCU supervises those accountants who are not members of a DAB. The supervisory population of gatekeepers has increased since 2016 with the exception of solicitor firms. Following recommendations in the MER, the AMLCU has also taken measures to broaden its supervisory reach for TCSPs and accountants not otherwise supervised.

16. Supervision of TCSPs, accountants, and solicitors is not commensurate with risk levels in the sector, with some supervisors largely focusing on improving awareness rather than on supervision and enforcement. The NRA classifies ML/TF risk within the professional gatekeepers as medium high. Since the NRA data of 2016, the post-Brexit boom in investment activity in Ireland could also contribute to increased importance of services provided by professional enablers. In a very welcome move, a risk-assessment of the TCSP sector was published in March 2022 with findings widely disseminated among the supervisory population.¹⁴ In the medium to long-term, updated risk-assessments for accountants and solicitors would help guide supervisory engagements. Further, while the AMLCU and several SRBs undertake systematic risk-based supervision, the focus of some supervisors is still largely on improving awareness of the sectors’ AML/CFT obligations rather than supervision or enforcement. Supervision should be informed by regularly updated risk assessments and should integrate wider sources of data and analytical tools to tailor supervisory engagement.

17. Fragmentation of supervision leads to inconsistency in supervisory approaches and potential for regulatory arbitrage. Due to the number of supervisors in the DNFBP sectors, including SRBs, supervisors regularly participate in forums to discuss supervisory approaches and best practices. Further, in a very welcome move, the AMLSC broadened its membership in 2021 to include SRBs supervising legal and accountancy sectors, the LSRA, the PRSA, the Charities Regulator, and some other relevant stakeholders. However, given the significant variations among supervisors of professional gatekeepers in understanding of risks, depth of supervision, and available sanctions,¹⁵ these efforts may be insufficient to prevent arbitrage in the TCSP and accountancy sectors. The authorities should take steps to ensure consistency in supervision of higher risk professional gatekeepers. A good practice would be to task a regulatory body with the role of ensuring consistency in supervisory approaches among SRBs, with appropriate sector specific safeguards. This is aligned with the 2021-EU AML proposals. It is notable that the mandate of the Irish Auditing and Accounting Supervisory Authority (IAASA)¹⁶ includes the independent and effective supervision of the Prescribed Accountancy Bodies’ (PABs) regulatory obligations and prompt, robust and proportionate action in instances of non-compliance. However, even with oversight of supervisors, jurisdictions sometimes struggle to maintain consistency in depth of supervisory engagement. Setting up risk-sensitive minimum supervisory standards and/or tasking better-resourced bodies with supervision of higher risk sectors and entities could also be considered.

18. The enforcement toolkit of supervisors of professional gatekeepers is limited. The AMLCU has no power to issue administrative fines and is limited to issuing legal directions or revoking authorizations in the case of TCSPs or liaising with An Garda Siochána with a view to a criminal prosecution being pursued. Most SRBs are also limited in sanctions to issuance of orders/reprimands/directives and withdrawal of licensing, although some accountancy bodies are empowered to impose fines.¹⁷ Following the Minister for Justice bringing a working group report recommending expanding the regulatory toolkit of the AMLCU to government in December 2021, the government decided that the AMLCU should be given powers to issue administrative fines for strict liability compliance breaches by supervised entities by end Q2-2023. Such powers could highly enhance the AMLCU’s sanctioning framework. Similarly, all supervisors, including SRBs, should have powers to impose monetary penalties, at the minimum, for strict liability offences.¹⁸

Entity Transparency and Availability of Accurate Beneficial Ownership Information

19. Ireland has taken an important step forward with the creation of three BO registries in 2019 and 2020 for companies, trusts, and certain financial vehicles. A sectoral risk assessment for legal persons and legal arrangements was published in 2020¹⁹ showing a significant risk of ML for certain entities, particularly those with complex ownership structures. The Pandora Papers recently highlighted potential misuse of limited partnerships and, in particular, suggested that a lack of transparency in respect of the third-country partners based in certain jurisdictions meant that some limited partnerships could not be easily subject to scrutiny. The authorities should however continue advancing legal reforms and their implementation to limit the risk of misuse of legal companies. More precisely, a review of the 1907 Limited Partnership Act was launched with a view to strengthening the legislation. The Companies (Corporate Enforcement Authority) Act 2021 contains a new requirement for company directors to use their personal public service number (PPSN) when incorporating a company, making an annual return or changing director’s details on the Register of Companies. The new requirement is expected to come into force in early 2023. This would help strengthen the accuracy and transparency of the register.

20. Although significant efforts have been made to collect the information, the central Beneficial Ownership Register should ensure registration is complete and up to date. Ireland established a Central Register of Beneficial Ownership of Companies and Industrial and Provident Societies on June 22, 2019 under SI 110 of 2019.²⁰ From that date, relevant entities have been obliged to file information regarding their beneficial owners with the Central Register and to update such information if there are any changes to it. Statistics related to progress in the registration of companies and societies are publicly available to the end of 2020.²¹ At that time, it is reported that almost 189,000 (81 percent) of companies and 616 societies (64 percent) had filed beneficial ownership information with the register.²² While the register is still in its early stages, it would be important to ensure the registration of companies is complete and up to date.

21. While verification is being regularly conducted, the Central Beneficial Ownership Register should enhance accuracy and access to the information.²³ While the 2020 Annual Report mentions that only two discrepancies notices were received from competent authorities, and none were received from designated persons and the general public,²⁴ the feedback gathered during the mission seems to point to a larger number of discrepancies noticed, signaling accuracy concerns. While the relevant statistics may be updated in upcoming annual reports, it would be important for the register to look into the source of the discrepancies and explore additional verification mechanisms to ensure the accuracy of the beneficial ownership information collected. Inter-operability with other registers, such as the Central Register of Beneficial Ownership of Trusts and Beneficial Ownership Register for Certain Financial Vehicles (CFVs), as well as cross-checks with other public beneficial ownerships registers, should also be considered. For designated persons who form a business relationship with a relevant entity or are taking CDD measures in relation to a relevant entity, and for members of the public, there is a fee to access the register information, only payable by credit card. The register may want to consider facilitating access for designated persons so that there are alternative ways of access, allowing for a high-volume of simultaneous consultations, not limited by single transactions. In addition, easier access to information could facilitate crowdsourcing of the accuracy of the information.

22. The professional gatekeepers through the effective application of CDD could assist in improving the quality of beneficial ownership information. Designated persons (including the full range of FIs and DNFBPs) are obliged to collect BO information of legal entities or arrangements utilizing financial or professional services. Following up on the MER recommendations, Ireland now has an obligation for designated persons to identify and verify the person purporting to act on behalf of the customer. The legislation also incorporates Article 3 of the Fourth Money Laundering Directive of the EU whereby there is a requirement to identify senior managing officials if all means to identify the BO of a legal person are exhausted. Existing customers are now subject to CDD at any time, including when the relevant circumstances of a customer have changed and, where warranted, by the ML/TF risk. Ensuring consistent quality in the CDD procedures across financial institutions and DNFBPs, including for professional gatekeepers, is key, in particular, as there is an increased use in complex structures. In addition, streamlining the submission of discrepancies by supervised entities with AML/CFT obligations during their own CDD activities could enhance verification of the data and its timeliness.