Company formation with AML checkpoints built in: a TCSP walkthrough

Company formation is fast, cheap and routine — which is exactly why it attracts people who want a clean-looking corporate wrapper for money that is anything but. If you form companies for clients in Ireland, you are a trust or company service provider (TCSP), a designated person under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, supervised by the AMLCU in the Department of Justice. Two dates make this urgent. The AMLCU's administrative financial sanctions regime is already in force — since 30 June 2026, under S.I. No. 307 of 2026 — so supervision has teeth today. And from 10 July 2027, the EU's AML Regulation (the AMLR, Regulation (EU) 2024/1624) replaces the substantive rulebook.

The good news: formation work is a process, and processes can carry checkpoints. Here is a walkthrough of where they go.

Checkpoint 1: know your client before you incorporate anything

Before any documents are drafted, identify and verify the person instructing you — and be clear about who that actually is. Is the individual in front of you the true principal, or an intermediary acting for someone else? If they act for another person, you need to identify that person too. Warning signs at this stage are behavioural as much as documentary: reluctance to explain why the company is needed, urgency with no commercial logic, or instructions routed through layers with no apparent purpose.

Record a risk rating for the client at this point. Factors that push it up include complex cross-border elements, connections to countries on the EU's high-risk third-country list, and requests for structures whose only obvious feature is opacity.

Checkpoint 2: establish the beneficial owners of the new company

The AMLR harmonises the beneficial-ownership test EU-wide: any natural person owning or controlling 25% or more, directly or indirectly. The Commission may later set a lower threshold — 15% or lower — for high-risk sectors by delegated act, following a review due by 2029, but 25% is the figure to build your process around now.

For a formation, this means mapping the intended ownership before incorporation: who will hold the shares, whether any holdings are indirect through other entities, and who exercises control by other means. If the proposed structure involves chains of companies across jurisdictions, keep asking "who is the natural person at the top?" until you have an answer you can evidence — or a reason to walk away.

Checkpoint 3: registers, extracts and discrepancies

Ireland's beneficial-ownership plumbing is part of your file, not somebody else's problem:

• The new company will need its own beneficial-ownership filing with the central register at rbo.gov.ie — build the reminder into your post-incorporation pack so clients do not discover the obligation late.
• Where your client is itself a company — for example, a corporate group asking you to form a subsidiary — you must obtain an RBO extract before entering the business relationship. Designated-person access is arranged via the BEN3A1 form, and extracts cost a flat €2.50 each.
• Compare the extract against what your CDD found, record the comparison, and report any discrepancy to the Registrar. The discrepancy duty (under Reg 20(3)(b) of S.I. No. 110 of 2019) is one supervisors can test easily: either your file shows the comparison happened, or it does not.

Company details themselves can be verified against the Companies Registration Office.

Checkpoint 4: money, thresholds and the cash cap

Formation fees are usually modest, but TCSP work often extends into handling larger flows — capital contributions, initial funding, onward services. Build the AMLR's numbers into your payment procedures: CDD for occasional transactions triggers at €10,000 (down from €15,000), occasional cash transactions of €3,000 or more trigger limited CDD, and an EU-wide €10,000 cap applies to cash in commercial transactions, counting linked payments together. A client who proposes paying anything substantial in cash is handing you both a compliance obligation and a risk signal.

Checkpoint 5: after incorporation — monitoring and reporting

A hypothetical example, clearly hypothetical: a formation agent incorporates a company for a non-resident client, provides the registered office, and eighteen months later notices the company's only activity is receiving and forwarding funds between unrelated jurisdictions. Formation was the start of a business relationship, not the end of the job — ongoing monitoring is what turns that pattern into an escalation. Where suspicion crystallises, Suspicious Transaction Reports are dual-reported in Ireland: to FIU Ireland via the goAML portal and to the Revenue Commissioners via ROS.

From 10 July 2027 the AMLR also prescribes a board-level compliance manager and a compliance officer of sufficiently high standing, and requires records to be retained for 5 years and then deleted.

What to do now

1. Map your formation process end to end and mark where each checkpoint above sits — instruction, structure design, incorporation, payment, post-incorporation.
2. Confirm your RBO designated-person access is in place and extracts are being obtained and compared on every corporate client.
3. Update payment procedures for the €10,000 cash cap and the €3,000 occasional-cash trigger.
4. Refresh your business-wide risk assessment with formation-specific risks: opacity, cross-border chains, intermediated instructions.
5. Assign the AMLR compliance roles and record the designation.
6. Review the AMLCU's published material — the administrative sanctions regime in force since 30 June 2026 makes documented compliance the safe default.

Where CompliDesk fits

CompliDesk Ireland turns this walkthrough into a workflow — CDD, ownership mapping, RBO evidence and monitoring reminders on every formation file, built to the AMLR from day one. See how it works for a TCSP: book a demo.