Supervision

How are accountants supervised and what role does Chartered Accountants Ireland play?

Anti-money laundering legislation can be accessed  on the legislation pages of the website here.

The legislation identifies “designated” persons who must guard against their businesses being used for money laundering or terrorist financing purposes. Persons acting as an auditor, external accountant, tax adviser (which definition has been expanded by the CJA 2021) and/or trust or company service provider are designated persons and are, as such, subject to statutory AML obligations. They are sometimes referred to under the acronym DNFBP which means "Designated Non Financial Businesses and Professions". They are required to apply anti-money laundering measures in the course of their business.

The legislation also establishes competent authorities which monitor designated persons and secure compliance with legislative requirements. Chartered Accountants Ireland is one of those competent authorities. It is a self-regulating body under the legislation and is responsible for supervising certain designated persons. The Professional Standards Department of the Institute performs this regulatory function on behalf of Chartered Accountants Ireland. If you are a practising firm of Chartered Accountants Ireland, you are already subject to anti-money laundering supervision under the Institute’s public practice regulations.

In Ireland, if you are another designated person within the Institute's remit, registration is required and you will be supervised in accordance with the Money Laundering Supervision Regulations. An example is trust or company service providers (TCSPs).

More information is available from the Professional Standards Department area of the website.

New regulations introduced in 2019 in Ireland imposed significant additional responsibilities on the Institute as an AML supervisor including an obligation to  obtain certain additional information from firms regarding details of principals and the nature of services provided. See also Practice Matters October 2020  for more useful information in this area.

There is an abundance of resources for members to better understand their obligations and to navigate the complexities of the effects of AML regime on them. Further links and references to useful materials are provided on these AML pages. For example click here for information on introduction to AML in the UK, useful links and guidance and procedures.

What are my obligations as a practitioner?

Practitioners should and indeed are obliged to consult the  Technical Release 01 2019 AML Guidance for Members of CCAB-I when considering its obligations. The guidance is  due to be updated however and  must  be treated with a degree of caution as it  is based on the law as of November 2018 and there has been new legislation in the area since. For example the European Union (Money Laundering And Terrorist Financing) Regulations 2019 and Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Act 2021.Click here for Irish legislation  and here for UK legislation on money laundering.

Firm wide business risk assessment

Firms must carry out and keep up to date a firm-wide business risk assessment under section 30 A of the CJA 2010 (as amended) . The subsection was inserted under the CJA 2018. The assessment  should include consideration of the firm’s client base and the services it offers, the countries and geographical areas the firm operates in, the type of transactions carried out and the delivery channels used. For example, where the channel allows the service to be delivered without meeting the client face-to-face that might lead to a higher risk of exposure to money laundering.

The legislation also requires that firms have regard to any relevant information in a national risk assessment and any guidance on risk issued by the competent authority for the designated person. In addition to the Technical Release 01 2019 AML Guidance for Members of CCAB-I referred to above reference should be made to  The Chartered Accountants Institute Risk Outlook January 2021 which assesses the circumstances where there might be a high risk of money laundering or terrorist financing in the accountancy sector.

The business risk assessment must be documented and approved by senior management.

Failure to comply with the obligations is an offence.

Individual risk assessments for clients

It is now a statutory requirement under section 30B of the CJA 2010 (as amended), again inserted under the CJA 2018, to carry out a stand-alone risk assessment on each client to whom a firm provides an AML-regulated service. This is to determine the type of client due diligence to be applied to that client. The legislation details the matters the firm should have regard to such as

• its firmwide risk assessment
• any national risk assessment
• guidance from a competent authority
• relevant risk variables including
• the purpose of the relationship
• size and regularity of transactions
• duration of the business relationship
• the presence of certain factors scheduled in the legislation which might suggest a lower or higher risk.
• In relation to this, practitioners should have regard to schedules 3 and 4 of the CJA 2010 (as amended).

Schedule 3 contains a non-exhaustive list of factors suggesting potentially lower risk. For example public companies subject to disclosure requirements or dealings with third countries having effective anti-money laundering (AML) or combatting financing of terrorism (CFT) systems might suggest a potentially lower risk.

Schedule 4 contains a non-exhaustive list of factors suggesting potentially higher risk. For example, a customer where the ownership structure of the company appears unusual or excessively complex given the nature of the company’s business or dealings in a country identified by credible sources as having significant levels of corruption or other criminal activity might suggest a potentially higher risk.

Customer Due Diligence (CDD) 

The client risk assessment referred to above, carried out when providing AML-regulated services, will determine the extent of client due diligence measures to be applied. Under the legislation customer due diligence must be applied at different junctures; before the start of a new business relationship or before carrying out occasional transactions and at appropriate points during the lifetime of the relationship. CDD measures must be applied at any time where the relevant circumstances of a customer have changed, or where the risk of money laundering and terrorist financing warrants their application.

Since the CJA 2021, customer due diligence measures must be applied, at any time when a designated person is obliged by  law to contact a customer for the purposes of reviewing any relevant information relating to the beneficial owner connected with a customer, including where obliged to do so to seek information for tax purposes.

When risk is low, simplified due diligence applies, depending on the customer profile. This will differ from case to case but would include the following checks which the firm must carry out :

• identify the client, and verify the client’s identity on the basis of documents (whether or not in electronic form), or information that the firm has reasonable grounds to believe can be relied upon to confirm the identity of the client . 
• identify any beneficial owner connected with the client or service concerned, and verify the beneficial owner’s identity. Since the CJA 2021 where a beneficial owner is a senior managing official of a legal  entity, a designated person must take the necessary measures to verify the identity of that person and must keep records of the actions taken to verify the person’s identity including any difficulties encountered in the verification process.
• In the case of legal arrangements such as trusts or partnerships, the firm must understand the ownership and control structure of the entity or arrangement concerned. 
• verify the identity and authority of persons purporting to act on behalf of the client.

Business relationships-beneficial owners

In the case of business relationships, section 35 of the CJA Act 2010 (as amended) provides that before the establishment of the business relationship the designated person must obtain information on the purpose and intended nature of it and must continue to monitor it afterwards. Further, since the CJA 2021, all designated persons must obtain information on the beneficial ownership if the beneficial owner of the customer is an express trust, is entered in the central register of beneficial ownership of companies and industrial and provident societies, or is entered in the central register of beneficial ownership of Irish collective asset-management vehicles, credit unions and unit trusts. 

Enhanced CDD

The legislation provides for enhanced CDD in certain circumstances.

Politically exposed persons (PEP)

A designated person is required to take steps  prior to establishing a business relationship or carrying out an occasional transaction, to determine if a customer, or a beneficial owner connected with the customer or service, is a politically exposed person or an immediate family member, or a close associate, of one. The legislation describes what a politically exposed person is. Please also refer to the  Technical Release 01 2019 AML Guidance for Members of CCAB-I  for guidance in this area. The definition of a PEP is broadened by the CJA 2021  to include any individual performing a "prescribed function". Under the CJA 2010 (as amended) “prescribed” means prescribed by the Minister (for Justice Equality and Law Reform ) by regulations made under that Act.

Senior management must approve before a relationship with a PEP is established and the designated person must determine the source of wealth and the source of funds and must apply enhanced monitoring of the business relationship with the customer. Also, if a designated person knows or has reasonable grounds to believe that a beneficial owner connected with a customer or with a service sought by a customer, is, or has become, a politically exposed person or an immediate family member or close associate of one, the designated person must  apply the enhanced due diligence measures in relation to the customer concerned.

The period of enhanced supervision of Politically Exposed Persons (PEP), which was 12 months after they cease to hold a prominent public function, is extended in the CJA 2021.It permits a designated person to continue monitoring someone who was previously a PEP as long as is reasonably required to take into account the continuing risk posed by that person and until such time as that person is deemed to pose no further risk specific to politically exposed persons.

The CJA 2021 empowers the Minister for Justice, with the consent of the Minister for Finance, to issue guidelines to the competent authorities, in respect of functions in the State that may be considered to be prominent public functions. As of May 2021 guidelines have not been issued yet but they are expected shortly.

If the person fails to provide documentation or information needed, then the relationship or service must be discontinued until provided. 

High risk third countries

The CJA 2021 now includes a specific list of enhanced due diligence measures that the designated person is required to apply when dealing with a customer established, or residing, in a high-risk third country.

With certain exceptions a designated person is required to obtain additional information on:

• The customer and on the beneficial owner,
• The intended nature of the business relationship,
• Their sources of funds and sources of wealth, and
• The reasons for the intended or performed transactions.

The designated person must obtain senior management approval for establishing or continuing the business relationship and must conduct enhanced monitoring of the business relationship by increasing the number and timing of controls applied and selecting patterns of transactions that need further examination.

Reference should also be made to countries identified by  Financial Action Task Force (FATF) high-risk jurisdictions and European Union High Risk third countries .Recent UK regulations on high risk countries may also be of assistance.

Relationships with a higher degree of risk 

The legislation provides for enhanced customer due diligence  for “higher risk” relationships where, having regard to matters assessed in the individual risk assessment, a reasonable person would determine that the business relationship or transaction presents a higher degree of risk of money laundering or terrorist financing.

Failure to comply with the provisions for customer due diligence and enhanced due diligence can lead to fines, or imprisonment, or both, for the designated person.

What do you need to do at your firm: Policies, Controls, Procedures (PCPs)

All accountancy firms are required to have up to date internal policies, controls and procedures in place to protect against money laundering and terrorist financing. The CJA 2010 (as amended) places certain requirements on accountancy firms regarding record keeping, procedures and training. The specific statutory requirements about what a firm’s PCPs should cover are listed in section 54 of the CJA 2010 (as amended).

The internal policies, controls and procedures include dealing with the following:

• Identifying, assessing ,mitigating and managing risk factors,
• Customer due diligence measures,
• Monitoring transactions and business relationships,
• Identifying and scrutinising large/complex transactions, unusual patterns of transactions ,
• Under the CJA 2021 a designated person will be required , in accordance with adopted policies and procedures to examine the background and purpose of all transactions that are complex, are unusually large, are conducted in an unusual pattern, or do not have an apparent economic or lawful purpose,
• measures to be taken to prevent the use for money laundering or terrorist financing of transactions or products that could favour or facilitate anonymity,
• measures to be taken to prevent the risk of money laundering or terrorist financing through technological developments,
• reporting :Internal and external reporting (see our "Reporting Requirements" page for further details on external reporting),
• record keeping,
• keeping documents and information up to date,
• internal systems and controls to identify emerging risks and keep business wide risk assessments up to date,
• monitoring and managing compliance with, and the internal communication of, these policies, controls and procedures.

The policies procedures and controls must have regard to any guidance issued by the competent authority. They must be approved by senior management and kept under review and  up to date. (It is recommended that a written record of this exercise is maintained).

There is a statutory obligation under section 54(6) that the designated person ensures that persons involved in the conduct of the designated person’s business are instructed on the law relating to money laundering and terrorist financing and provided with ongoing training on identifying a transaction or other activity that may be related to money laundering or terrorist financing, and on how to proceed once such a transaction or activity is identified.

Since the European Union (Money Laundering and Terrorist Financing) Regulations 2019 (578/2019), a designated person must have in place appropriate procedures for reporting of a contravention internally through a specific, independent and anonymous channel, proportionate to the nature and size of the designated person concerned.

Appointing a money laundering reporting officer

Although not required by law unless requested by the Competent Authority, where appropriate to the size complexity and structure of an accountancy firm and in the light of the legal requirements imposed, the firm may find it beneficial to appoint an individual at management level or to appoint a member of senior management, a ‘money laundering reporting officer’ (“MLRO”) with responsibility for ensuring the firm’s compliance with the Irish anti-money laundering regime.

The role of the MLRO is not defined in legislation but has traditionally included responsibility for internal controls and risk management around money laundering and terrorist financing, in accordance with sectoral guidance. A firm may appoint a deputy to the MLRO.

The MLRO will generally:

• be familiar with AML legislation and regulation;
• monitor and manage compliance with AML legislation and regulation;
• have oversight of, and be involved in, AML risk assessments;
• create and maintain the business’s risk-based approach to preventing money laundering;
• create and maintain ML documentation;
• develop customer due diligence (CDD) policies and procedures;
• establish and maintain awareness and training; and
• receive internal suspicious transaction reports (STRs) and make external STRs to the Garda and Revenue; (See here for more details on making an external STR)  ;

Please also refer to the Technical Release 01 2019 AML Guidance for Members of CCAB-I for more information on the MLRO.