Businesses operating in Ireland now face a materially different anti-money laundering landscape. The EU's Anti-Money Laundering Authority (AMLA) became operational in July 2025, binding technical standards are due by 10 July 2026, and both the Anti-Money Laundering Regulation (AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6) will apply directly from 10 July 2027 – with direct AMLA supervision of certain obliged entities commencing in 2028. Preparing your Irish operations for these changes requires a structured compliance review, gap analysis, and where necessary, engagement with the Central Bank of Ireland well before those deadlines.
Why This Matters Now for Businesses in Ireland
Ireland has consistently been an attractive jurisdiction for international holding structures, financial services, technology firms, and fund vehicles. That attractiveness brings heightened scrutiny. The Central Bank of Ireland is the designated AML supervisor for most financial sector obliged entities, and it has demonstrated a willingness to use its enforcement powers. At the same time, the incoming EU AML package represents the most significant restructuring of the AML/CFT framework in a generation.
The transition from a directive-based to a directly applicable regulation model – through the AMLR – removes much of the discretion that national legislators previously enjoyed. For firms already operating in Ireland, that means internal policies calibrated to current Irish transpositions of earlier directives may become non-compliant after 10 July 2027 without a deliberate update process. Starting that process in late 2025 or early 2026 is not premature; given the scale of internal change typically required, it may already be the last comfortable window.
If your business involves virtual asset service providers, crypto-asset activities, or MiCA-regulated products, the convergence of AML obligations with licensing requirements under MiCA adds a further layer of urgency. Our MiCA licensing practice in Ireland works alongside our AML team precisely because these frameworks increasingly overlap.
The Legislative Framework: AMLR, AMLD6, and AMLA's Role
The EU AML package consists of three interlocking instruments, each with distinct implications for Irish-based entities:
- AMLR (Anti-Money Laundering Regulation): A directly applicable EU regulation that harmonises customer due diligence, beneficial ownership verification, transaction monitoring, and record-keeping requirements across all member states. It applies from 10 July 2027 and leaves no room for national divergence on core obligations.
- AMLD6 (Sixth Anti-Money Laundering Directive): Governs supervisory architecture, Financial Intelligence Unit cooperation, and access to beneficial ownership information. Also applying from 10 July 2027, it will require Ireland to update its national AML framework, including the role of the Central Bank of Ireland and the Companies Registration Office (CRO) in maintaining and verifying beneficial ownership registers.
- AMLA: The new EU authority became operational in July 2025. Its regulatory technical standards (RTS) and implementing technical standards (ITS) must be completed by 10 July 2026. From 2028, AMLA will directly supervise a defined category of high-risk obliged entities operating across multiple member states. For the majority of Irish-regulated firms, supervisory relationships with the Central Bank of Ireland will continue, but AMLA's standards will be binding and its peer-review role will influence national supervisory expectations.
Understanding which instrument governs each specific obligation – and when – is the first analytical step in building a defensible AMLA-readiness programme.
Customer Due Diligence and Beneficial Ownership Under the New Rules
Customer due diligence (CDD) requirements under the AMLR will be more granular and less discretionary than those currently in force under Irish law. Enhanced due diligence triggers, the scope of politically exposed person (PEP) obligations, and the treatment of complex ownership structures will all be governed by directly applicable text rather than national transposition choices.
Beneficial ownership identification is an area of particular practical difficulty. The AMLR's approach to beneficial ownership thresholds and verification methodology has attracted substantial commentary from practitioners; the precise calibration of thresholds in the final RTS text – due by 10 July 2026 – will determine how firms must document and verify ultimate beneficial owners. Our analysis of the evolving UBO threshold debate under the AMLR is set out in this dedicated technical note.
For Irish-registered entities, the CRO's beneficial ownership register remains a key reference point, and AMLD6 will impose obligations on member states to ensure its accuracy and accessibility. Firms that have relied on nominee arrangements or complex layered structures should assess their position against forthcoming standards before July 2027.
Transaction Monitoring and Technology Considerations
The AMLR will impose explicit requirements around transaction monitoring systems – their calibration, the documentation of alert thresholds, and the governance of escalation procedures. For firms currently relying on legacy or lightly documented systems, the gap to compliance may be larger than anticipated.
There are also data protection dimensions that Irish businesses must navigate carefully. Any transaction monitoring programme that involves profiling customer behaviour intersects with obligations under the General Data Protection Regulation (GDPR) as administered in Ireland, including potential engagement with the Data Protection Commission. Balancing AML monitoring obligations against GDPR constraints is a recurring tension in practice and should be addressed explicitly in internal policies.
Typical Pitfalls in Irish AML Compliance Programmes
Based on the structure of Central Bank of Ireland supervisory guidance and the content of the incoming AMLR, the following are recurring pressure points for firms operating in Ireland:
- Outdated policies: AML policies written to satisfy AMLD4 or AMLD5 transpositions will not automatically satisfy AMLR requirements. A line-by-line policy review is necessary, not a cosmetic refresh.
- Inadequate risk assessments: The AMLR requires documented, risk-based approaches. Generic enterprise-wide risk assessments that do not address product-specific, customer-specific, and geographic risk in granular terms are unlikely to satisfy supervisory scrutiny.
- Weak governance structures: AMLA expectations around the role of the designated AML compliance officer, board-level oversight, and independent audit of AML functions are likely to tighten. Irish-regulated firms should benchmark their current governance against the emerging AMLA supervisory guidelines.
- Underestimating cross-border complexity: Firms with operations in multiple EU jurisdictions may be subject to AMLA's direct supervision from 2028 depending on their structure and risk classification. This is not a matter solely for local counsel in each jurisdiction; it requires a coordinated group-level analysis.
- Delayed engagement with the Central Bank of Ireland: Where a firm identifies a material gap or has uncertainty about its supervisory status under the new framework, proactive engagement with the regulator is generally preferable to a reactive posture.
If you are assessing your current compliance programme against these criteria, we would be glad to assist. You can reach our team at info@ferrazwhitmore.com or through our contacts page.
AMLA-Readiness: A Practical Self-Assessment Checklist
The following questions are a starting point for any compliance officer or in-house counsel reviewing their firm's position ahead of the July 2027 application date:
- Has your firm mapped which AMLR obligations are new relative to your current Irish AML framework, and which represent a continuation of existing requirements?
- Are your CDD procedures documented at a level of granularity that would satisfy direct regulatory examination – including enhanced due diligence triggers and the basis for simplified CDD decisions?
- Is your beneficial ownership identification methodology consistent with the threshold and verification standards anticipated in the AMLR RTS (due 10 July 2026)?
- Does your transaction monitoring system have documented alert logic, calibration records, and a governance framework for threshold changes?
- Have you assessed whether your firm falls within the scope of entities likely to be subject to direct AMLA supervision from 2028?
- Is your AML risk assessment updated on a defined cycle and does it address all relevant risk dimensions at product, customer, and geographic level?
- Has the interaction between your AML monitoring programme and GDPR obligations been reviewed by both your AML function and your data protection adviser?
- If you operate across multiple EU jurisdictions, has a group-level AMLA-readiness review been initiated with coordinated external advice?
Cross-Border and Group-Level Dimensions
Many firms with Irish operations are part of wider EU or international group structures. The transition to AMLA oversight introduces complexity at the group level that cannot be resolved by each subsidiary acting independently. The AMLR contains group-wide AML policy requirements: an Irish subsidiary of an international group will need to demonstrate that its local policies are consistent with group standards and that group-level beneficial ownership and CDD data flows satisfy both the AMLR and applicable data protection frameworks.
Where a group may fall within AMLA's direct supervision perimeter from 2028, the interaction between AMLA, the Central Bank of Ireland, and supervisors in other member states will need to be anticipated and planned for. This is an area where early structuring advice can materially reduce regulatory friction at the point of transition. Our corporate practice in Ireland provides the structural and transactional context for that analysis: further information on our Irish corporate law services is available here.
For matters requiring judicial intervention – whether enforcement challenges, applications for access to beneficial ownership information, or disputes arising from supervisory decisions – Irish proceedings are heard in the High Court of Ireland, which has jurisdiction over regulatory matters of this nature.
How Ferraz & Whitmore Approaches AML Compliance Mandates in Ireland
Our approach to AML compliance and AMLA-readiness engagements in Ireland is structured around four phases. First, we conduct a gap analysis: mapping your current programme against AMLR and AMLD6 requirements as they will apply from July 2027, informed by the RTS and ITS standards in development ahead of the July 2026 deadline. Second, we assist with policy and procedure drafting – producing documentation that reflects both the regulatory baseline and the commercial reality of your specific business model. Third, where relevant, we support engagement with the Central Bank of Ireland, whether in the context of routine supervisory interaction or as part of a proactive dialogue about your firm's AML framework. Fourth, for group-level or cross-border mandates, we coordinate with our network of partner firms across EU jurisdictions to provide a consistent multi-jurisdictional analysis.
We do not offer a generic compliance template. The AMLR's risk-based approach requires that any defensible programme be calibrated to the specific risk profile of the entity it governs. Our drafting and advice reflect that principle.
To discuss how the AMLR and AMLA transition applies to your Irish operations, contact us at info@ferrazwhitmore.com or visit our contacts page to arrange a consultation with our team.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.