KPMG Law LLP logo

8 August 2025

On 01 July 2025, the Central Bank of Ireland (‘CBI’) fined Swilly Mulroy Credit Union (“Swilly Mulroy”) €36,273 for breaches of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (“the 2010 Act”) and the Credit Union Act 1997 (“the 1997 Act”).

Background

Swilly Mulroy, a community-based credit union in County Donegal, is authorised and regulated as a credit union by the CBI. In April 2022, the CBI's Anti-Money Laundering Division carried out an inspection which identified breaches of both the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 and the Credit Union Act 1997. This inspection led to the commencement of to an enforcement investigation in the same month and found occasions of contraventions between January 2014 and June 2021.

Under that investigation, the CBI found breaches of AML/CFT from the period of January 2014 and June 2021 discovered during the inspection carried out in April 2022, and focused on four areas:

  1. Failure to manage Cash Lodgement Services;
  2. Failure in Systems and Controls for AML/CFT Compliance;
  3. Failure to conduct necessary Business Risk Assessments; and
  4. Prescribed Contraventions

Failings identified by the CBI

Failure to manage Cash Lodgements Services

Swilly Mulroy operated a Cash Lodgements Service where it solicited and accepted cash from depositors, most of whom did not hold accounts with the credit union. These deposits were forwarded by electronic funds transfer (EFT) to a local bank without first being deposited in the customer's name at Swilly Mulroy. This practice bypassed the necessary AML/CFT controls and requirements of the 2010 Act which mandates Credit unions to monitor dealings with customers with whom they have a business relationship.

Failure in Systems and Controls for AML/CFT Compliance:

The CBI found that Swilly Mulroy failed to conduct Customer Due Diligence (CDD) and Transaction Monitoring and did not carry out necessary Business and Customer Risk Assessments. It also did not apply or adopt AML/CFT policies for transactions related to the Cash Lodgements, and contrary to the requirements of section 33(1) of the 2010 Act, Swilly Mulroy failed to verify customers’ identities, in respect of the those depositors availing of the Cash Lodgements Service.

Failure to conduct necessary Business Risk Assessments:

Despite being aware of the risks associated with the Cash Lodgements Service, Swilly Mulroy's Board did not take steps to manage these risks through conducting a business risk assessment. The Board was informed of the risks multiple times by internal and external auditors and the Irish League of Credit Unions, yet no action was taken.

Prescribed Contraventions:

The CBI identified several prescribed contraventions, including failures to conduct CDD, carry out transaction monitoring, and perform necessary risk assessments. Swilly Mulroy also failed to adopt adequate policies and procedures to manage identified risks associated with the Cash Lodgements Service.

Sanctions by the CBI 

The CBI's decision to impose a sanction was based on the seriousness and duration of the contraventions, which were deemed reckless and a significant departure from expected standards.

As a result, the CBI imposed a reprimand and a monetary penalty of €51,819 on Swilly Mulroy. As Swilly agreed to a settlement, a 30% discount was applied to this fine reducing it to €36,273. The CBI published this enforcement action on 02 July 2025.

The enforcement action highlights the importance of adhering to AML/CFT obligations and maintaining robust risk management systems, especially in financial institutions dealing with cash-intensive transactions.

How we can help

Any party preparing to engage with the Central Bank on an investigation or enforcement action where they could be the subject of the exercise of a regulatory power, should approach those engagements with the necessary understanding of the relevant legal issues, including the operation of the principles of natural justice, and the requisite level of preparation and expert professional support.

Although no sanction was imposed against any individual in this case, the CBI can review personal liability under the IAF and SEAR frameworks. For more information on this please see some of our published articles listed below.

Experienced lawyers from KPMG Law LLP’s Financial Services Regulation team can provide firms and individuals with confidential legal advice on these issues. If you have any regulatory or enforcement requirements or expectations, please do not hesitate to contact our team below.

Derek Hegarty

Derek Hegarty

Partner, Head of Financial Services and Dispute Resolution

Nicola Munnelly

Nicola Munnelly

Director, Financial Services Regulation

Discover more in Financial Services Regulation