Dáil Éireann Debate, Thursday - 5 February 2026
186. Deputy Ken O'Flynn asked the Tánaiste and Minister for Finance whether the Central Bank of Ireland requires firms relying on third parties for customer due diligence to conduct periodic assurance testing to confirm that full underlying documentation can be produced without delay; and how compliance with this requirement is monitored at supervisory level. [9066/26]
View answerThe Central Bank of Ireland has informed me that section 40(3) of the Criminal Justice Act (CJA) 2010, provides that firms can rely on certain relevant third parties (“Third Party” or “Third Parties”) as set out under Section 40 subsections (1) (a) to (d) of the CJA 2010 to complete customer due diligence (CDD) measures required under Section 33 or 35(1) of the CJA 2010.
Section 40(4) of the CJA 2010 provides that firms may rely on a Third Party to apply the measures under Section 33 or 35(1) of the CJA 2010 only if:
• there is an arrangement in place between the firm and the Third Party confirming that the Third Party accepts being relied upon; and
• the firm is satisfied, that the Third Party is a person that is supervised or monitored for compliance with the requirements specified under the Fourth Anti-Money Laundering Directive (4AMLD), or requirements equivalent to those under 4AMLD, and on the basis of the arrangement, the Third Party will forward to the firm, as soon as practicable after a request from the firm, any customer due diligence documents or information, including any information from relevant trust services as set out in the eIDAS Regulation, relating to the customer obtained by the Third Party.
Section 40(5) of the CJA 2010 further provides that firms that rely on a Third Party to apply measures under Section 33 or 35(1) of the CJA 2010 remain liable for any failure to apply the measure. Failure to comply with the requirements of section 33 or 35 is an offence under the relevant section.
When placing reliance on Third Parties to undertake CDD, the Central Bank expects that the firm conducts regular assurance testing to ensure documentation can be retrieved without undue delay, and that the quality of the underlying documents obtained is sufficient.
The Central Bank has also informed me that firms placing reliance on a Third Party in accordance with Section 40(3) of the CJA 2010 does not include a situation where a firm has appointed another entity to apply the necessary measures as an outsourcing service provider, intermediary, or an agent of the firm.
In such cases, the outsourced service provider, intermediary, or agent may actually obtain the appropriate verification evidence in respect of the customer but the firm remains responsible for ensuring compliance with the obligations contained with the CJA 2010.
On an annual basis and as part of a Risk Evaluation Questionnaire, firms have been asked by the Central Bank to confirm whether they have any Third Party Reliance arrangements in place and to confirm that assurance testing is conducted.
The Central Bank will follow up with firms if required where anomalies are noted. In addition, Third Party Reliance arrangements may be examined (where relevant) as part of supervisory engagements.
