- Central Bank findings in the funds sector have flagged subscriptions processed before due diligence was complete, weak senior approval and enhanced due diligence for PEPs, and poor oversight of outsourced AML work.
- AMLR applies from 10 July 2027 with more prescriptive due diligence rules. AMLA published its customer due diligence standards on 30 September 2026, including conditions under which a fund can rely on an intermediary to verify underlying investors.
- The new annual ML/TF risk questionnaire is due by 31 March 2027 for fund management companies and 2 April 2027 for fund administrators, in a new XML format that asks for more detail on investor types and outsourcing.
What onboarding has to cover
For each investor, the fund needs to be able to show:
- Identity and verification: who the investor is, verified against reliable documents or data.
- Beneficial ownership: for entities, the individuals who ultimately own or control them, and how that was established.
- Screening: PEP, sanctions and adverse media checks, with each hit reviewed and the decision recorded.
- Risk rating: a documented assessment that decides whether simplified, standard or enhanced due diligence applies.
- Source of funds and wealth: where the risk calls for it.
- Tax status: valid FATCA and CRS self certifications.
- Ongoing monitoring: periodic reviews and trigger events, such as a change of ownership or a new screening hit.
In most Irish fund structures the work is done by the administrator or transfer agent, but the fund and its management company remain responsible for it. That is why the Central Bank keeps returning to the oversight of outsourced AML activity.
What the Central Bank keeps finding
The Central Bank has published several reviews of AML compliance in the funds sector. Its November 2021 bulletin on funds and fund management companies set out findings across governance, business risk assessment, outsourcing and customer due diligence. Among them:
- Transactions, including initial subscriptions, were processed before all due diligence was in place.
- There was insufficient evidence that new PEPs, and existing investors reclassified as PEPs, received senior management approval and enhanced due diligence.
- Documentation supporting simplified due diligence was not always retained.
- Outsourced service providers were not subject to regular, comprehensive due diligence reviews including sample testing, and there was too little oversight of the technology they used for PEP and sanctions screening and transaction monitoring.
- Board minutes did not always show adequate discussion and challenge of AML matters.
The Central Bank expects firms in every sector to assess themselves against these findings. Its 2026 supervisory plans also include a thematic review of AML transaction monitoring and suspicious transaction reporting in the funds sector.
What changes in 2026 and 2027
| Date | Change | What it means for onboarding |
|---|---|---|
| 1 January 2026 | CRS 2.0 and DAC8 changes apply in Ireland | Updated FATCA and CRS self certification forms, all tax residences and TINs captured, and reports that state whether a valid self certification is held. First returns under the new rules are due by 30 June 2027. |
| 31 March and 2 April 2027 | New sector specific ML/TF risk questionnaires replace the current AML/CFT questionnaire | Annual XML submission by fund management companies (31 March) and fund administrators (2 April), with more detail on fund structures, investor types, outsourcing, distribution and board AML oversight. |
| 10 July 2027 | AMLR applies across the EU | More prescriptive due diligence rules, harmonised beneficial ownership rules and AMLA standards replace national rulebooks. |
| 10 July 2027 | AMLD 6 transposed in Ireland | A general scheme of the Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Bill 2026 was published on 7 October 2026. |
On reliance, the AMLA standards published on 30 September 2026 allow a fund to rely on an intermediary to verify the final investors where the relationship is not high risk, the intermediary is effectively supervised for AML and the fund is satisfied with its controls. The standards still need to be adopted by the European Commission. Funds that distribute through platforms and nominees should map those relationships now.
Why onboarding stalls
- Documents arrive by email and sit in folders, so nobody can see what is missing at a glance.
- There is no single investor record, so the same data is keyed into several systems.
- The status of each case lives in a spreadsheet, or only one person knows it.
- Missing fields are found late, after the investor has already been asked twice.
- Screening hits are handled in a separate tool, with decisions recorded somewhere else.
- Periodic reviews slip because nothing schedules or chases them.
- Reports from outsourced providers are accepted without testing.
How to build onboarding as data, not documents
1. Keep one investor record
Hold each investor, their related parties and their documents in one structured record, with every version kept. The record is the source for onboarding, reviews, tax reporting and MI.
2. Drive requirements from rules
Decide the documents and checks required from the investor type, jurisdiction, distribution channel and risk rating, so the team and the investor see exactly what is needed at the start.
3. Gate subscriptions in the system
Make it impossible to process a subscription until due diligence is complete and approved. This answers the most repeated Central Bank finding directly.
4. Bring screening into the workflow
Connect PEP, sanctions and adverse media screening to the investor record, and log every hit, review and decision against it.
5. Schedule reviews and react to triggers
Set review dates by risk rating and open a review automatically when something changes, such as a new screening hit or a change in ownership.
6. Validate tax self certifications
Check CRS and FATCA self certifications for completeness and reasonableness against the rest of the investor record, including all tax residences and TINs.
7. Produce MI and returns from the same data
The MLRO, the board and the new risk questionnaire should all draw on the same records. That makes oversight evidence a by product of the work rather than a separate exercise.
Where AI helps, and where it should not
AI can read identity documents, company registry extracts and trust deeds, draft ownership structures for review, flag differences between what an investor declared and what the documents show, and summarise adverse media results. The risk decision, the approval of a PEP and the decision to accept an investor must stay with a person. Any AI used here processes personal data, so it needs to sit within your data protection and ICT risk controls.
How HST can help
HST Solutions builds onboarding workflows and data foundations for regulated financial services. For iRace Digital (FundBank) we delivered client onboarding on the Microsoft Power Platform, with review history, exception handling and a clear handover. Your MLRO and compliance team set the rules and approvals. Our engineers build them into working systems that keep evidence as they go. We are ISO 27001 and ISO 22301 certified.
If onboarding is slowing your launches or your audits, talk to an engineer, or see how we work with fund managers, ManCos and administrators.
FAQ
Sources
- Anti Money Laundering Bulletin on Funds and Fund Management Companies, November 2021, Central Bank of Ireland
- Central Bank of Ireland calls for fund ManCos to enhance their AML frameworks, Maples Group
- Funds Focus, October 2026, William Fry
- CBI 2026 regulatory and supervisory outlook: what Irish fund managers need to know, Mondaq
- 2024 FATCA and CRS return filing deadline and CRS 2.0, KPMG Ireland
- CRS amendments ahead: essential compliance steps, Grant Thornton Ireland
