Bookkeepers and payroll providers: are you in AML scope?

"I'm just the bookkeeper" is one of the most common sentences in Irish AML conversations — and one of the least reliable. If you provide bookkeeping, payroll or related services to clients in Ireland, the question of whether you carry AML obligations is not answered by your job title, your firm's size, or whether you belong to a professional body. It is answered by the services you provide. With the EU's AML Regulation (the AMLR, Regulation (EU) 2024/1624) applying from 10 July 2027, and Irish supervision already tightening ahead of it, this is the year to answer the question properly rather than by assumption.

This post walks through how to think it through. It is general guidance, not a ruling on your firm — boundary cases deserve specific advice.

Why do AML rules attach to services rather than titles?

The Irish framework — the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 — makes "designated persons" of firms carrying on certain activities, including external accountants and tax advisers: people who provide accountancy or tax services to third parties by way of business. The AMLR takes the same approach for its "obliged entities". Nobody checks whether your letterhead says "accountant". What matters is whether the work you do for clients falls within the regulated categories.

That cuts both ways. A qualified accountant doing no client work may be outside scope; an unqualified sole trader preparing accounts for thirty local businesses is very likely inside it.

Where does bookkeeping sit?

Bookkeeping — recording transactions, maintaining ledgers, preparing accounts information for clients — is generally regarded as the provision of accountancy services to third parties, which puts it in scope. The practical markers that point towards scope:

• You maintain books or prepare accounts for clients as a business.
• You prepare or file tax returns, or give any tax advice alongside the bookkeeping — tax services are a regulated category in their own right.
• Clients rely on you as their finance function, giving you visibility of their money flows.

That visibility is the whole point. A bookkeeper often sees a client's true financial picture more clearly than anyone else — the unexplained deposits, the round-sum transfers, the invoices that do not match any real activity. The AML framework treats that vantage point as valuable, and attaches duties to it.

What about payroll-only providers?

Payroll is the genuine grey area. A provider that does nothing but process payroll — calculating pay and deductions and running submissions — sits closer to the boundary than a bookkeeper, and reasonable practitioners land on different sides depending on exactly what the service includes. Two honest observations:

• The narrower and more mechanical your service, the stronger the argument you fall outside the accountancy-services category.
• In practice, very few payroll providers stay narrow. The moment you also do bookkeeping, prepare accounts, handle other tax filings or give advice, you have stepped into regulated territory.

If you are payroll-only, work through the designated categories carefully and record your reasoning either way. A written, dated analysis of why you concluded you are out of scope is worth a great deal if a supervisor or client ever asks; a shrug is worth nothing.

If you are in scope, who supervises you?

It depends on membership. Accountants and bookkeepers who are members of a designated accountancy body — Chartered Accountants Ireland, ACCA, CPA Ireland and others — are supervised by that body. Unaffiliated providers — no professional body membership — are supervised by the AMLCU, the Anti-Money Laundering Compliance Unit in the Department of Justice. Note that the AMLCU's administrative financial sanctions regime is in force, since 30 June 2026 under S.I. No. 307 of 2026, so supervision of the unaffiliated sector now carries direct financial consequences for non-compliance.

Being in scope means the full framework applies at a scale proportionate to your firm: a business-wide risk assessment, written policies and procedures, customer due diligence on clients, ongoing monitoring, staff training if you have staff, record-keeping, and suspicious transaction reporting — dual-reported in Ireland to FIU Ireland via the goAML portal and to the Revenue Commissioners via ROS.

What will the AMLR change for a small in-scope firm?

From 10 July 2027 the AMLR replaces the substantive rulebook. For a small bookkeeping or accounts practice, the headline changes are: CDD for occasional transactions triggers at €10,000 (down from €15,000); occasional cash transactions of €3,000 or more trigger limited CDD; an EU-wide €10,000 cap applies to cash in commercial transactions; beneficial ownership is harmonised at 25% or more, direct or indirect; prescribed compliance roles arrive — in a small firm, the same senior person may realistically carry the weight, but the designation must be deliberate and recorded; and records are retained for 5 years, then deleted.

What to do now

1. List every service you actually provide, client by client, and map it against the regulated categories — decide scope on evidence, not habit.
2. Write down your conclusion and reasoning, dated, whichever way it goes.
3. If you are in scope and unaffiliated, engage with the AMLCU's published requirements now — the sanctions regime is already in force.
4. Put the basics in place proportionately: risk assessment, CDD on each client, a simple monitoring routine, goAML and ROS registration.
5. Diarise an AMLR update of thresholds and roles well before 10 July 2027.

Where CompliDesk fits

CompliDesk Ireland is built for exactly this end of the market — small practices that need proportionate, evidenced AML compliance without an enterprise price tag. Not sure where you land? Our scope checker walks you through it in a few minutes.