STR Ireland — goAML, ROS and section 42 CJA 2010

Ireland is the EU market where one suspicion produces two filings. Section 42 requires the report to go to the Garda Síochána and the Revenue Commissioners — two systems, two registrations, one obligation. FIU Ireland receives its copy through goAML; the Revenue Commissioners receive theirs through ROS. Section 42 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 also carries a rule most firms discover late: you may not proceed with the transaction before the report has been sent. This piece covers the statutory text, both channels, the timing, and three worked cases.

1. The obligation, in the words of the statute

Section 42(1) of the CJA 2010 requires a designated person who knows, suspects or has reasonable grounds to suspect, on the basis of information obtained in the course of carrying on business as a designated person, that another person has been or is engaged in an offence of money laundering or terrorist financing, to report that knowledge, suspicion or those grounds to the Garda Síochána and the Revenue Commissioners. Section 42(2) sets the timing: as soon as practicable after acquiring the knowledge, forming the suspicion or acquiring the grounds.

Three subsections then do most of the operational work, and they are easy to read past.

• Section 42(3) provides that a designated person is taken not to have reasonable grounds on the basis of having received information until it has been scrutinised in the course of reasonable business practice — and the subsection expressly includes automated banking transactions. Receipt of data is not knowledge; review is.
• Section 42(4) provides that a designated person may have reasonable grounds where it is unable to apply customer due diligence measures under the named sections because of a failure by the customer to provide documents or information. Failed CDD is a potential reporting trigger, not merely an offboarding one.
• Section 42(6) sets the content: the information on which the knowledge, suspicion or grounds are based; the identity of the person concerned if known; the whereabouts of the property or funds if known; and any other relevant information.

2. Two channels, two registrations

The dual addressee in section 42(1) is the feature that distinguishes Irish practice from every other market in this series, and it is a systems problem rather than a drafting quirk.

Two practical consequences follow. First, the registrations are sequential: Revenue asks for the FIU organisation ID, so the goAML registration has to come first. Second, goAML registration is organisational before it is personal — an individual cannot register alone and must belong to an organisation that is already registered. A firm that leaves this to the week it forms its first suspicion has sequenced the work backwards.

On format, the two systems are close enough to exploit and not so close that one submission covers both. The practical route is to complete the report in goAML, download the generated XML, and upload that file in ROS — one authored report, two submissions. Revenue has not accepted paper STRs since September 2020.

3. “As soon as practicable” — and the transaction you must not complete

Section 42(2) does not set a number of days. It sets a standard, and the standard is measured against what the firm could reasonably have done: the clock starts when the suspicion is formed, not when the investigation is tidy. Read with section 42(3), the sequence is: information arrives, the firm scrutinises it in the course of reasonable business practice, grounds crystallise, and from that point the report is owed as soon as practicable.

Section 42(7) is the subsection that changes operational design. A designated person required to make a report shall not proceed with the suspicious transaction or service connected with the report, or with the transaction or service that is the subject of the report, before the report has been sent — unless one of two conditions applies:

• it is not practicable to delay or stop the transaction or service from proceeding; or
• the designated person reasonably believes that failing to proceed may cause the other person to suspect that a report may be, or may have been, made, or that an investigation is under way or may begin.

Section 42(10) defines the suspicious transaction for this purpose as one there are reasonable grounds to suspect would, if it proceeded, comprise or assist in money laundering or terrorist financing. And section 42(8) removes any doubt about the second exception’s limits: nothing in 42(7) authorises proceeding where a direction or order under section 17 is in force. Under section 17, a Garda of superintendent rank or above may direct a person in writing not to carry out a specified service or transaction for a period not exceeding 7 days, and a District Court judge may order the same for a period not exceeding 28 days, renewable on more than one occasion.

4. Worked example — the alert that sat in a queue

Facts: a monitoring rule fires on a business account on a Friday. The case is assigned the following Tuesday, worked over two days, and escalated to the reporting officer, who files on the second Friday — thirteen days after the alert. The firm’s procedure describes a fourteen-day internal service level.

Which rule applies: section 42(3) means the clock did not start when the transaction hit the system; scrutiny in the course of reasonable business practice is what converts data into grounds. But once the analyst formed the suspicion mid-week, section 42(2) required the report as soon as practicable — and an internal service level is not a legal deadline. The five days between suspicion and filing are the exposed period, not the thirteen.

What the practitioner does: instruments the two intervals separately — alert to scrutiny, and suspicion to submission — and reports the second to the board. Removes the sign-off steps that add days without adding judgement, and allows the reporting officer to file and then complete the narrative through a follow-up rather than holding the submission for completeness.

Outcome: the firm can evidence what “as soon as practicable” meant in each case. A firm measuring only end-to-end time cannot say when the suspicion was formed, which is the one date a supervisor will ask for.

5. Worked example — the customer who stopped answering

Facts: during a periodic review, an e-money institution asks a corporate customer for updated beneficial-ownership evidence and source-of-funds documentation. Three requests go unanswered over six weeks. The account continues to receive third-party credits. The relationship manager proposes exiting the customer for non-cooperation and closing the review.

Which rule applies: section 42(4). Inability to apply the CDD measures because of a failure by the customer to provide documents or information may give reasonable grounds to suspect. It does not do so automatically — the subsection is permissive, and section 42(5) confirms it does not limit the other circumstances in which grounds may exist — but it means the failure itself has to be assessed for suspicion rather than filed as an administrative outcome.

What the practitioner does: builds the reporting question into the exit workflow so that no account can be closed for CDD failure without a recorded suspicion decision. Where the answer is yes, files before or alongside the exit, and considers section 42(7) in relation to the closing payment out.

Outcome: a category of cases that is frequently handled entirely as customer lifecycle work is routed through the reporting decision. The pattern to watch is a firm with a healthy volume of exits for non-cooperation and almost no reports arising from them.

6. Worked example — the payment that was released while the report was drafted

Facts: a payment institution identifies a suspicious outbound transfer on a Thursday afternoon. The reporting officer begins the goAML report. The payment is on a cut-off, and operations release it that evening so the customer is not alerted by a delay. The report is submitted to goAML and ROS on Friday morning.

Which rule applies: section 42(7). The default position is that the transaction must not proceed before the report is sent. Releasing it is defensible only if it was not practicable to delay or stop it, or if the firm reasonably believed that not proceeding might cause the customer to suspect a report or an investigation — and the file must record which exception was relied on and why. “The cut-off was close” is not by itself either exception.

What the practitioner does: gives the reporting officer a documented hold capability with an agreed escalation path to operations, and a template that forces an explicit 42(7) determination before release: which limb, who decided, on what basis. Where a section 17 direction or order is in force, removes the discretion entirely — section 42(8) leaves none.

Outcome: the firm either delays the payment or records a reasoned exception. The failure mode is neither of those: a release with no determination, which reads afterwards as an operational default rather than a decision.

7. What section 42 does not require, and what it costs to get wrong

Section 46 carves out disclosure of information subject to legal privilege, and information a relevant professional adviser receives in the course of ascertaining a client’s legal position — though not where the information was received with the intention of furthering a criminal purpose. For payment and e-money institutions these carve-outs rarely bite, but section 42(9) expressly frames the offence as arising “except as provided by section 46”.

The penalty is set out in section 42(9): on summary conviction, a fine not exceeding €5,000 or imprisonment for a term not exceeding 12 months, or both; on conviction on indictment, a fine or imprisonment for a term not exceeding 5 years, or both. The same penalties attach to failure to comply with a direction or order under section 17.

FAQ

What to do, today

• Confirm both registrations exist and both have live users — goAML organisation and users, and ROS with the STR obligation and sub-user certificates. Register goAML first: Revenue asks for its organisation ID.
• Prove the dual filing in your case records. Every report should carry a goAML reference and a ROS acknowledgement against the same case.
• Measure suspicion-to-submission, not alert-to-closure, and put the first figure in front of governance.
• Add an explicit section 42(7) determination to the reporting workflow, with a named decision-maker and a recorded basis, before any connected transaction is released.
• Route CDD-failure exits through the reporting decision and review the ratio of non-cooperation exits to reports arising from them.

Related: The Risk Evaluation Questionnaire — Ireland’s AML supervisory return · Filing a SAR in Luxembourg — the CRF and goAML · Inability to complete customer due diligence