A practical guide to the EU AML package for Irish firms

European companies operating through Ireland are preparing for a significant change in how anti-money-laundering rules are structured and enforced. The EU anti-money laundering package moves more requirements into directly applicable law, strengthens oversight through a new authority and reshapes customer due diligence, ownership checks and cooperation with financial intelligence units.

The work reaches beyond policy updates: procedures, systems, contracts and staff knowledge may all need adjustment. Australian professionals working with Irish firms also need to distinguish EU obligations from Australian requirements instead of assuming one framework can cover both.

What the EU AML package changes

The package combines a directly applicable Anti-Money Laundering Regulation for obliged entities with a revised directive addressing criminal offences, penalties and national supervisory arrangements. Irish firms must examine obligations by legal entity and activity, including customer relationships managed from different countries.

The European Anti-Money Laundering Authority, or AMLA, becomes the central EU supervisory body. National authorities continue to supervise many businesses and coordinate with it, while AMLA gains direct responsibility for selected self-regulated entities and stronger mechanisms for information exchange. Ownership and control checks become more prominent when assessing whether people are suitable to run a regulated business.

Other changes include expanded attention to crypto-asset activity, politically exposed persons and beneficial ownership, alongside simplified due diligence for qualifying low-risk relationships and smaller firms. Penalties for legal entities can reach €10 million or 5% of total annual turnover, whichever is higher. Teams should explain not merely what checks were performed, but why a particular level of due diligence was proportionate and what evidence supported that decision.

Turning the rules into operational controls

Start with an obligation inventory covering legal entities, products, sales channels and jurisdictions. Identify where onboarding occurs, where a regulated activity is performed and where the customer or funds ultimately sit. A group policy can otherwise conceal responsibility for local checks performed in Ireland, another member state or an Australian business unit.

Translate requirements into procedures staff can execute across onboarding, trigger-based review, enhanced due diligence, source-of-funds enquiries, sanctions screening, ownership verification, escalation and offboarding. Record the risk rationale, review frequency, evidence obtained and decision taken. If simplified due diligence is justified, document the conditions supporting it rather than applying a blanket exemption or the full standard indiscriminately.

Technology can connect customer, ownership, payment and transaction data, but accountable judgement remains essential. Test automated monitoring against sampled alerts and relevant typologies, including money-mule networks and misuse of crypto services. Where specialist capacity is limited, Irish firms can consult Summit Finuas Network's approved training providers directory for role-appropriate AML and financial-crime courses. National reporting channels, including Ireland's Financial Intelligence Unit, should remain visible in escalation procedures.

What Australian teams need to know

Australian operations require a clear jurisdictional boundary. An Irish firm subject to EU rules may also encounter the Australian Anti-Money Laundering and Counter-Terrorism Financing Act 2006, administered by AUSTRAC. Australian due diligence, suspicious transaction reporting and record-keeping duties operate separately from EU obligations. Shared platforms can support both regimes, but risk decisions and reporting pathways must reflect the correct legal framework.

Local business habits reinforce that separation. Sydney and Melbourne host major banking, fintech and professional-services operations, while mobile banking, contactless cards, PayID and BPAY shape everyday payments. International remittance corridors and cryptocurrency platforms add cross-border data flows that Australian teams should map against AUSTRAC expectations, particularly for businesses offering funds transfer or digital asset services.

Cash still matters in Australian hospitality, clubs and small cash-intensive businesses, and businesses in designated sectors use the A$100,000 cash reporting threshold as a control point. A customer can present different risks depending on the product, payment method and ownership structure, making local due diligence just as important as group-level screening.

Building training and professional capability

Training requirements make capability building part of implementation rather than a separate staff event. Subject-matter owners should identify who needs AML, financial crime, operational risk, investment funds or business software training, then match learning to actual responsibilities. Customer-facing colleagues need to recognise warning signals, investigators need reporting and analysis skills, and managers need assurance that controls work in practice.

Scenarios should reflect the firm's products and customer journeys. Exercises might ask staff when to request beneficial ownership information, how to distinguish a documentation gap from a genuine warning sign, or when a payment pattern requires escalation. This gives learning a direct connection to casework and creates evidence that training content remains aligned with the risk assessment and procedures.

Managers also need to test whether knowledge has changed behaviour. Review referral quality, overdue reviews and recurring customer issues alongside completion records. When a rule change affects several teams, targeted refreshers can prevent inconsistent decisions, while new joiners receive role-specific induction. Coverage is strongest when business owners can point to the tasks each course supports.

A sequenced implementation approach

A sequenced implementation approach reduces disruption. Establish the legal and regulatory baseline for each business line, document revised risk assessments and ownership checks, then define the evidence needed to prove decisions were made correctly. Prioritise high-risk gaps before refining lower-risk procedures, particularly where complex ownership, cash-intensive activity or virtual assets are involved.

Assign an executive owner, a project lead and functional leads across compliance, operations, technology and legal. Track progress against legal deadlines, unresolved customer populations, alert quality and overdue remediation. For Australian staff, consider dependencies between shared systems, service providers and time zones, and ensure decisions can be made close to the customer.

Capability planning should continue beyond the initial programme. Staff entering the field can combine formal qualifications with workplace learning, using the network's professional development guidance to identify a suitable route. Durable compliance comes from people understanding their decisions, systems supporting timely action and governance identifying weaknesses before supervisors do.