S.I. No. 310/2025 - European Union (Information Accompanying Transfers of Funds) Regulations 2025

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 22nd July, 2025.

I, PASCHAL DONOHOE , Minister for Finance, in exercise of the powers conferred on me by section 3 of the European Communities Act 1972 (No. 27 of 1972), and for the purpose of giving effect to Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023¹ on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (recast), hereby make the following regulations:

Citation and commencement

1.

• (2) These Regulations shall come into operation on 1 August 2025.

Interpretation

2.

“Act of 1942” means the Central Bank Act 1942 (No. 22 of 1942);

“Act of 2010” means the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (No. 6 of 2010);

“Bank” means the Central Bank of Ireland;

“enactment” has the same meaning as it has in the Interpretation Act 2005 (No. 23 of 2005);

“Member State” means a state, other than the State, which is a member of the European Union and, where relevant, includes a state, other than a member of the European Union, which is a party to the agreement on the European Economic Area signed at Oporto on 2 May 1992 (as adjusted by all subsequent amendments to that agreement);

“Transfers of Funds Regulation” means Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023² on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (recast).

• (2) A word or expression that is used in these Regulations and is also used in the Transfers of Funds Regulation has, unless the context otherwise requires, the same meaning in these Regulations as it has in the Transfers of Funds Regulation.

Competent authority for purposes of Transfers of Funds Regulation

3.

• (2) The Bank shall have all the supervisory and investigatory powers necessary for the performance of its functions under the Transfers of Funds Regulation and these Regulations.

• (3) The Bank shall monitor, in an effective manner, compliance with the Transfers of Funds Regulation and shall take measures that are reasonably necessary to ensure such compliance.

• (4) The measures referred to in paragraph (3) that are reasonably necessary include the reporting to An Garda Síochána and the Revenue Commissioners any knowledge or suspicion the Bank has that a payment service provider or a crypto-asset service provider has been or is engaged in money laundering or terrorist financing.

• (5) In determining, in any particular case, whether a payment service provider or a crypto-asset service provider has complied with the requirements of the Transfers of Funds Regulation, the Bank shall consider whether the provider concerned is able to demonstrate to the Bank that the requirements have been met.

• (6) If the Bank, in the course of monitoring a payment service provider or a crypto-asset service provider under these Regulations, acquires any knowledge or forms any suspicion that another person has been or is engaged in money laundering or terrorist financing, it shall report that knowledge or suspicion to An Garda Síochána and the Revenue Commissioners.

• (7) The powers provided for in these Regulations in respect of the Bank shall not be exercised in a manner or for a purpose inconsistent with its obligations pursuant to the Transfers of Funds Regulation and these Regulations.

• (8) The powers of the Bank referred to in paragraph (2) are without prejudice to the powers of the Bank under any other provision of these Regulations, the Transfers of Funds Regulation or any other enactment.

Reporting mechanisms

4.

• (2) Those mechanisms referred to in paragraph (1) shall include at least -

• (a) specific procedures for the receipt of reports on breaches and their follow-up,

• (b) appropriate protection for employees of payment service providers or crypto-asset service providers, or persons in a comparable position, who report breaches committed within a payment service provider or a crypto-asset service provider,

• (c) appropriate protection for an accused person, and

• (d) protection of the personal data, of both the person who reports a breach and the natural person who is allegedly responsible for the breach, at all stages of the procedures referred to in paragraph (a) unless the disclosure of the personal data is required by law or in the context of further investigation or subsequent administrative or judicial proceedings in accordance with the Data Protection Act 2018 (No. 7 of 2018).

• (3) Payment service providers and crypto-asset service providers, in cooperation with the Bank, shall establish appropriate internal procedures for their employees, or persons in a comparable position, to report breaches of these Regulations or the Transfers of Funds Regulation, through a secure, independent, specific and anonymous channel.

• (4) The procedures referred to in paragraph (3) shall be proportionate to the nature and size of the payment service provider or crypto-asset service provider concerned.

Record retention

5.

• (2) A direction under paragraph (1) shall only be given after the member of An Garda Síochána has carried out a thorough assessment of the necessity and proportionality of further retention, and where the member considers that –

• (a) such further retention is justified as necessary for the prevention, detection or investigation of money laundering or terrorist financing, or

• (b) notwithstanding the fact that a decision to institute proceedings against a person may not have been taken, such further retention is justified as necessary for the prosecution of an offence of money laundering or terrorist financing.

• (3) Where a direction has been given to a payment service provider of the payer and of the payee or to a crypto-asset service provider of the originator and beneficiary in accordance with paragraph (1) and neither subparagraph (a) nor (b) of paragraph (2) continues to apply, a member of An Garda Síochána shall, as soon as practicable, notify the payment service provider of the payer and of the payee or the crypto-asset service provider of the originator and beneficiary to whom the direction was given of that fact and the direction shall expire on the date of that notification.

• (4) A payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary who is given a direction under paragraph (1) shall retain records of the information referred to in Articles 4 to 7 or Articles 14 to 16, respectively, of the Transfers of Funds Regulation until the earlier of the expiration of –

• (a) the additional period specified in the direction, and

• (b) the direction.

• (5) A payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary may retain the records of the information referred to in Articles 4 to 7 or Articles 14 to 16, respectively, of the Transfers of Funds Regulation wholly or partly in an electronic, mechanical or other non-written form only if they are capable of being reproduced in a written form.

• (6) The records required to be kept by a payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary under this Regulation may be kept outside the State provided that the payment service provider or crypto-asset service provider ensures that those records are produced in the State to a member of An Garda Síochána as soon as practicable after the records concerned are requested.

• (7) Upon the expiry of the further retention periods referred to in this Regulation, a payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary shall ensure that any personal data contained in any document or other record retained solely for the purposes of this Regulation is deleted.

• (8) The requirements imposed by this Regulation are in addition to, and not in substitution for, any other requirements imposed by any other enactment or rule of law with respect to the keeping and retention of records by a payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary.

• (9) The obligations that are imposed on a payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary under this Regulation continue to apply to a person who has been a payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary but has ceased to carry on business as a payment service provider or a crypto-asset service provider.

• (10) A requirement for a payment service provider of the payer and of the payee or a crypto-asset service provider of the originator and beneficiary that is a body corporate to retain any record under this Regulation extends to any body corporate that is a successor to, or a continuation of, the first-mentioned body corporate.

Administrative sanctions

6.

• (a) following an inquiry under section 33AO of that Act, or

• (b) in accordance with section 33AR or 33AV of that Act,

for a breach of the Transfers of Funds Regulation or these Regulations and may include any or all of the following:

• (i) a public statement which indicates the person responsible for the breach and the nature of the breach concerned;

• (ii) an order requiring the person responsible for the breach to cease, and desist from, the conduct concerned;

• (iii) withdrawal or suspension of any authorisation granted by the Bank;

• (iv) a temporary ban against any member of the institution’s management body or any other natural person, who is held responsible for the breach, from exercising management functions in the legal person concerned;

• (v) subject to paragraph (2), a direction to pay to the Bank a monetary penalty –

• (I) not exceeding €1,000,000, or

• (II) where the amount of the benefit derived from the breach can be determined, twice the amount of the benefit derived from the breach (including where that sum exceeds €1,000,000 or the maximum amount specified in paragraph (2)).

• (2) Without prejudice to paragraph (1)(v) and the sanctions set out therein, where a breach specified in any of paragraphs (a) to (d) of Article 29 of the Transfers of Funds Regulation is committed by a person that is a financial institution or a credit institution, the following sanctions may also be imposed:

• (a) in the case of a legal person, a direction to pay to the Bank a monetary penalty not exceeding €5,000,000 or 10 per cent of the total annual turnover of the legal person according to the last available accounts approved by the management body of the legal person concerned, or

• (b) in the case of a natural person, a direction to pay to the Bank a monetary penalty not exceeding €5,000,000.

• (3)
• (a) For the purposes of paragraph (2)(a), where a legal person is a parent undertaking or a subsidiary of a parent undertaking which has to prepare consolidated financial accounts in accordance with Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013³ , the relevant total annual turnover shall be the total annual turnover or the corresponding type of income in accordance with the applicable European Union law in the field of accounting according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking.

• (b) A word or expression that is used in this paragraph and is also used in Article 59(3) of Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015⁴ has, unless the contrary intention appears, the same meaning in this paragraph as it has in the said Article 59(3).

Application of sanctions

7.

• (a) the gravity and duration of the breach;

• (b) the degree of responsibility of the person concerned;

• (c) the financial strength of the person concerned, as indicated, for example, by the total turnover of a legal person or the annual income of a natural person;

• (d) the importance of the profits gained or losses avoided by the person responsible for the breach, insofar as they can be determined;

• (e) the level of cooperation with the Bank of the person responsible for the breach, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by that person;

• (f) previous breaches by the person responsible for the breach;

• (g) measures taken by the person responsible for the breach to prevent its repetition.

Obligation to cooperate with Member States

8.

• (a) carrying out of its duties, under these Regulations or under the Transfers of Funds Regulation, with those competent authorities of Member States, or

• (b) making use of the powers of those competent authorities of Member States, whether set out in these Regulations or under the Transfers of Funds Regulation.

Offences

9.

• (b) A payment service provider of the payee who breaches any provision of Articles 7 to 9, or Article 26(1), of the Transfers of Funds Regulation or Regulation 5 commits an offence.

• (c) An intermediary payment service provider who breaches any provision of Articles 10 to 13 of the Transfers of Funds Regulation commits an offence.

• (d) A crypto-asset service provider of the originator who breaches any provision of Articles 14 to 15, or Article 26(1), of the Transfers of Funds Regulation or Regulation 5 commits an offence.

• (e) A crypto-asset service provider of the beneficiary who breaches any provision of Articles 16 to 18, or Article 26(1), of the Transfers of Funds Regulation or Regulation 5 commits an offence.

• (f) An intermediary crypto-asset service provider who breaches any provision of Articles 19 to 22 of the Transfers of Funds Regulation commits an offence.

• (g) A payment service provider or a crypto-asset service provider who breaches any provision of Article 24, 25 or 32 of the Transfers of Funds Regulation commits an offence.

• (2) A person who commits an offence under paragraph (1) shall be liable on summary conviction to a class A fine.

Liability of legal persons

10.

• (2) If a person commits one or more acts for the benefit of a legal person and the following conditions are satisfied:

• (a) the first-mentioned person stands (at the time of the commission of those acts) in the relationship to that legal person specified in paragraph (4); and

• (b) those acts constitute a breach specified any of paragraphs (a) to (d) of Article 29 of the Transfers of Funds Regulation,

then that legal person, as well as the first-mentioned person, shall be guilty of the breach and liable to be proceeded against and subject to the same sanctions as if it were guilty of the first-mentioned breach, and it is immaterial, for the purposes of this Regulation, whether the first-mentioned person was acting individually (as distinct from acting as part of an organ of the legal person).

• (3) If a person under the authority of a legal person commits one or more acts for the benefit of the legal person and the following conditions are satisfied:

• (a) the commission of those acts was attributable to the requisite degree of supervision or control of the first-mentioned person by another person (“the third person”) not having been exercised;

• (b) the third person stands (at the time of the commission of those acts) in the relationship to that legal person specified in paragraph (6); and

• (c) those acts constitute a breach specified in any of paragraphs (a) to (d) of Article 29 of the Transfers of Funds Regulation,

then that legal person, as well as the first-mentioned person, shall be guilty of the breach and liable to be proceeded against and subject to the same sanctions as if it were guilty of the first-mentioned breach and it is immaterial, for the purposes of this Regulation, whether, at the time the foregoing degree of supervision or control was not exercised, the third person was acting individually (as distinct from acting as part of an organ of the legal person).

• (4) The relationship, mentioned in subparagraph (a) of paragraph (2), of the first-mentioned person in that paragraph to the legal person referred to therein is that the first-mentioned person has a leading position within that legal person based on -

• (a) a power to represent that legal person,

• (b) an authority to take decisions on behalf of that legal person, or

• (c) an authority to exercise control within that legal person.

• (5) The reference in subparagraph (a) of paragraph (3) to the requisite degree of supervision or control is a reference to the degree of supervision or control (of the first-mentioned person in paragraph (3)) that ought to have been exercised in the circumstances by the third person mentioned in that paragraph.

• (6) The relationship, mentioned in paragraph (3)(b), of the third person to the legal person referred to therein is that the third person has a leading position within that legal person based on -

• (a) a power of representation of that legal person,

• (b) an authority to take decisions on behalf of that legal person, or

• (c) an authority to exercise control within that legal person.

Liability of directors and others for offences committed by corporate bodies or on behalf of unincorporated bodies

11.

• (2) Where the affairs of a body corporate are managed by its members, paragraph (1) applies in relation to the acts and defaults of a member in connection with his or her functions of management as if he or she were a director or manager of the body corporate.

Prosecution of offences

12.

Publication of sanctions

13.

• (2) The publication under paragraph (1) shall include at least information on the type and nature of the breach and the identity of the persons responsible.

• (3) Where the publication of the identity of the legal persons or of the personal data of the natural persons is considered by the Bank to be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where publication jeopardises the stability of financial markets or an on-going investigation, the Bank shall -

• (a) defer the publication of the decision to impose the sanction or measure until the reasons for non-publication cease to exist,

• (b) publish the decision to impose the sanction or measure on an anonymous basis if such anonymous publication ensures an effective protection of the personal data concerned, or

• (c) not publish the decision to impose a sanction or measure at all in the event that the options set out in subparagraphs (a) and (b) are considered to be insufficient to ensure -

• (i) that the stability of financial markets would not be put in jeopardy, and

• (ii) the proportionality of the publication of such decisions with regard to measures which are deemed to be of a minor nature.

• (4) In the case of a decision to publish a sanction or measure on an anonymous basis, the publication of the relevant data may be postponed for a reasonable period if it is envisaged that within that period the reasons for anonymous publication shall cease to exist.

• (5) Where the decision to impose a sanction or measure is the subject of an appeal, the Bank shall also publish, immediately, on the website referred to in paragraph (1) such information and any subsequent information on the outcome of such appeal.

• (6) Any decision annulling a previous decision to impose a sanction or a measure shall also be published on the website referred to in paragraph (1).

• (7) The Bank shall ensure that any publication in accordance with this Regulation remains on the website referred to in paragraph (1) for a period of at least 5 years after its publication.

• (8) Personal data contained in a publication under this Regulation shall only be kept on the website referred to in paragraph (1) for the period which is necessary in accordance with the Data Protection Act 2018 (No. 7 of 2018).

Consequential amendments of Act of 1942

14.

• (a) in section 2(2A), by the substitution of the following paragraph for paragraph (an):

• “(an) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023⁵ ;”,

• (b) in section 33BC, by the substitution of the following subsection for subsection (10):

• “(10) This section does not apply where Regulation 13 of the European Union (Information Accompanying Transfers of Funds) Regulations 2025 (S.I. No. 310 of 2025) applies.”,

and

• (c) in Part 2 of Schedule 2, by the substitution of the following item for item 68:

“68	S.I. No. 310 of 2025	European Union (Information Accompanying Transfers of Funds) Regulations 2025	The whole instrument.

Amendment of Act of 2010

15.

• (a) in section 24(1) –

• (i) by the deletion of the following definitions:

• (I) “custodian wallet provider”;

• (II) “virtual asset”;

• (III) “virtual asset service provider”,

• (ii) in the definition of “correspondent relationship”, in paragraph (b), by the substitution of “funds transfers or relationships established for transactions in crypto-assets or transfers of crypto-assets” for “funds transfers”,

• (iii) in the definition of “financial institution”–

• (I) by the insertion of the following paragraph after paragraph (g):

• “(gi) a crypto-asset service provider;”,

and

• (II) by the deletion of paragraph (h),

and

• (iv) by the insertion of the following definitions:

“ ‘crypto-asset’ means a crypto-asset as defined in Article 3(1), point (5), of Regulation (EU) 2023/1114, except where falling within the categories listed in Article 2(2), (3) and (4) of that Regulation or otherwise qualifying as funds;

‘crypto-asset service provider’ means a crypto-asset service provider as defined in Article 3(1), point (15), of Regulation (EU) 2023/1114, where performing one or more crypto-asset services as defined in Article 3(1), point (16), of that Regulation, with the exception of providing advice on crypto-assets as referred to in Article 3(1), point (16)(h), of that Regulation;

‘Regulation (EU) 2023/1114’ means Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023⁶ on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937;”,

• (b) in section 25(1), by the deletion of paragraph (ia),

• (c) by the repeal of Chapter 9A of Part 4, and

• (d) by the insertion of the following section after section 109E but in Chapter 10 of Part 4:

“Requirement to appoint central contact point

109F. (1) The Central Bank of Ireland may require an electronic money issuer as defined in Article 2, point (3), of Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009⁷ , a payment service provider as defined in Article 4(11) of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015⁸ or a crypto-asset service provider operating in the State under the right of establishment in forms other than a branch, and whose head office is situated in a Member State other than the State, to appoint a central contact point in the State that shall –

• (a) ensure, on behalf of the entity operating on a cross-border basis, compliance with AML/CFT rules, and

• (b) facilitate supervision by supervisors, including by providing supervisors with documents and information on request.

• (2) A word or expression that is used in this section and is also used in Article 45(9) of the Fourth Money Laundering Directive (amended by Article 38(6) of Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023⁹ ) has, unless the contrary intention appears, the same meaning in this section as it has in the said Article 45(9).”.

Transitional provision consequent on amendment of Act of 2010

16.

• (a) the relevant virtual asset service provider is granted or refused an authorisation pursuant to Article 63 of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023¹⁰ on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937, or

• (b) the transitional period expires.

• (2) In this Regulation –

“relevant virtual asset service provider” means a person who immediately before 30 December 2024 was registered as a virtual asset service provider with the Bank under Chapter 9A of Part 4 of the Act of 2010;

“transitional period” means the period commencing on 30 December 2024 and ending on 30 December 2025.

Revocation of European (Information Accompanying Transfers of Funds) Regulations 2017 and saver

17.

• (2) The revocation effected by paragraph (1) -

• (a) does not affect any direction given by the Bank, any investigation undertaken, or disciplinary or enforcement action undertaken by the Bank or any other person, in respect of any matter in existence at, or before, the time of the revocation, and

• (b) does not preclude the taking of any legal proceedings, or the undertaking of any investigation, or disciplinary or enforcement action by the Bank or any other person, in respect of any contravention of an enactment (including anything revoked by these Regulations) or any misconduct which may have been committed before the time of the revocation.

GIVEN under my Official Seal,

10 July, 2025.

PASCHAL DONOHOE ,

Minister for Finance.

Footnotes