Client-account risk and AML: what Irish solicitors should watch

Your client account is the reason your practice matters to money launderers. It moves large sums quickly, it carries the credibility of a regulated profession, and money that has passed through it looks clean on the other side. That is why client-account activity sits at the centre of AML supervision of solicitors by the Law Society of Ireland — and why it deserves a fresh look now, before Regulation (EU) 2024/1624 (the AMLR) applies on 10 July 2027.

Irish solicitors have been "designated persons" under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 for over fifteen years. Most firms have an AML programme of some kind. But the AMLR is a directly applicable EU regulation that replaces the substantive rulebook your current policies were written against. If your risk assessment and procedures still read like they were drafted for the CJA 2010 world, the client account is where the gap will show first.

Why the client account concentrates risk

A solicitor's client account is attractive to criminals for reasons that have nothing to do with any wrongdoing by the firm. Patterns worth building into your firm's risk assessment include:

• Funds in, transaction aborted, funds out. A purported purchase or settlement collapses and the client asks for the money back — sometimes to a different account than it came from. The client account has just acted as a pass-through.
• Overpayment and refund. A client "accidentally" sends more than required, then requests the surplus be returned or redirected. The refund arrives with your firm's name on it.
• Third-party funds. Money for a client matter arrives from a person or company that is not your client, with a thin explanation of why.
• Use of the account as a banking facility. Requests to hold or move funds where there is no genuine underlying legal service.
• Complex or opaque sources in conveyancing and probate. Property transactions remain a classic route for integrating criminal proceeds, and large estate distributions can obscure where money originally came from.

None of these patterns proves laundering. Each of them should trigger questions, and your procedures should say who asks them, what evidence is expected, and where the answers are recorded.

What the AMLR changes for your firm

From 10 July 2027 the AMLR becomes the operative rulebook for customer due diligence, beneficial ownership, internal controls and reporting. The headline changes that touch client-account work:

• Lower CDD thresholds. The threshold for occasional transactions drops to 10,000 euro (from 15,000 euro), and occasional cash transactions of 3,000 euro or more trigger limited CDD.
• An EU-wide cash cap. Commercial transactions are capped at 10,000 euro in cash, whether as a single payment or linked operations. Any attempt to route large cash sums through a matter should be treated as a hard stop, not a judgement call.
• A harmonised beneficial-ownership test. A beneficial owner is anyone with 25 per cent or more ownership interest, direct or indirect, applied consistently EU-wide.
• Prescribed compliance roles. Firms must designate a board-level (or equivalent management-level) compliance manager plus a compliance officer of sufficiently high standing. The compliance officer also becomes responsible for implementing targeted financial sanctions from 10 July 2027.
• Enhanced due diligence for high-net-worth relationships. Clients with assets of 5 million euro or more handled for a client whose total wealth is 50 million euro or more, attract enhanced measures — directly relevant to firms handling significant property and probate work.
• Faster FIU response times. Requests from the FIU must be answered within 5 working days, with shorter deadlines for some categories. Your file organisation needs to support that speed.
• Records: five years, then delete. The AMLR requires retention for five years followed by deletion — a discipline many firms have never operationalised.

Terminology shifts too: Irish law says "designated persons"; the AMLR says "obliged entities." You will see both in supervisor communications through the transition.

Source of funds is the client-account question

For client-account risk, customer due diligence is only half the job. The harder half is being able to explain, on the file, where the money funding a transaction came from — savings, a mortgage drawdown, a gift, sale proceeds, an inheritance — and having evidence proportionate to the risk. A conveyancing file that shows identity documents but no source-of-funds narrative is exactly the kind of file that looks weak under inspection.

A practical habit: for every matter where money will move through the client account, record at the outset who is expected to pay, from which account, and why. Any deviation from that expectation is your trigger for further enquiry.

Beneficial ownership and the RBO

Where your client is a company, remember the register duties that already apply. Since April 2021, designated persons must obtain an extract from the Register of Beneficial Ownership (rbo.gov.ie) before entering a new business relationship, and must report discrepancies between the register and what your own CDD finds. Access for designated persons is restricted post-CJEU; firms register using the BEN3A1 form and pay a small fee per extract. Under the AMLR's 25 per cent test, verify the ownership chain yourself — the extract is a cross-check, not a substitute for your own work.

When suspicion arises: dual reporting

If client-account activity gives your MLRO knowledge, suspicion or reasonable grounds to suspect money laundering or terrorist financing, Ireland requires dual reporting of Suspicious Transaction Reports: to FIU Ireland via the goAML portal (fiu-ireland.ie) and to the Revenue Commissioners via ROS, which accepts the goAML-generated XML. Your MLRO must be registered on both systems before the day you need them. Note that Ireland has no threshold transaction reporting regime — reporting is driven by suspicion, not by amounts.

What to do now

1. Refresh your business-wide risk assessment with client-account typologies named explicitly: aborted transactions, overpayments, third-party funds, banking-facility requests.
2. Map your current CDD thresholds and procedures against the AMLR figures — 10,000 euro occasional transactions, 3,000 euro occasional cash, the 10,000 euro cash cap.
3. Designate your compliance manager and compliance officer roles, and document who holds sanctions responsibility from 10 July 2027.
4. Build source-of-funds enquiry into matter opening for conveyancing, probate and settlements, with expected-payer details recorded up front.
5. Confirm your MLRO's goAML and Revenue ROS registrations, and your firm's RBO access via BEN3A1.
6. Test whether you could answer an FIU request within 5 working days from your current filing system.
7. Set a retention and deletion policy that delivers "five years, then delete."
8. Watch the Law Society's AML guidance (lawsociety.ie) and re-verify positions as AMLA standards and Irish transposition land through 2026 and 2027.

Getting AMLR-ready with CompliDesk

CompliDesk Ireland is being built for the AMLR from day one — risk assessment, policy pack, CDD workflows and STR preparation designed around Regulation (EU) 2024/1624 rather than retrofitted from the old regime. See the AMLR explainer for a full picture of what changes on 10 July 2027.