Ireland's 2026 National Risk Assessment

Home Knowledge Ireland’s 2026 National Risk Assessment

Ireland's 2026 National Risk Assessment

July 24, 2026

Ireland’s 2026 National Risk Assessment: Key Changes and What They Mean for Firms

Overview of the 2026 NRA

The Department of Finance (DoF) has recently published Ireland’s third National Risk Assessment (NRA). This 2026 NRA is central to Ireland’s continued efforts on anti-money laundering, countering the financing of terrorism and countering-proliferation financing (AML/CFT/CPF). It seeks to identify and evaluate threats and vulnerabilities facing Ireland’s financial system and wider economy.

Drawing insights from a range of authorities such as government departments and regulatory and supervisory bodies, the assessment is aimed at promoting a shared understanding of risk. It forms a key component of Ireland’s risk-based approach to AML/CFT/CPF and supports the development of proportionate supervisory, enforcement and policy responses, ensuring that Ireland’s frameworks are aligned with international standards and well suited to respond to threats.

The publication of the NRA is particularly significant for designated persons under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (CJA 2010), as section 30A requires them to take account of relevant risk assessments when conducting their Business Risk Assessments (BRAs).

The NRA also serves as a key preparatory document ahead of Ireland’s 2028 Financial Action Task Force (FATF) Mutual Evaluation and reflects important regulatory developments, including the EU AML package and the Markets in Crypto-Assets Regulation (MiCAR).

Key Findings

Using a four-tier risk rating scale consisting of Low, Moderate, Significant and Very Significant, the NRA has classified each threat, enabling the identification of areas exposed to higher levels of risk. This scale replaces the four-tier scale used in the 2019 NRA (Low, Medium-Low, Medium-High and High), which firms should bear in mind when comparing the new ratings against those referenced in existing BRAs.

The threat of Money Laundering (ML) is assessed as Moderate, reflecting Ireland’s open economy, international financial connectivity and exposure to cross-border financial crime, with drug offences and fraud identified as the most significant predicate offences driving Ireland’s ML activity. The threat of Terrorist Financing (TF) has been classified as Low, with risks arising from both domestic paramilitary groups and international terrorist networks, and particular vigilance required in respect of small-scale, self-funded operations and the use of digital platforms. The NRA highlights the need for ongoing vigilance despite the relatively low threat level, particularly given geopolitical developments and evolving financial technologies. The threat of Proliferation Financing (PF) is also assessed as Low, reflecting Ireland’s limited direct exposure to jurisdictions of PF concern, although the NRA notes that indirect exposure through complex financial flows and dual-use goods remains a risk requiring continued vigilance.

Sectoral risk ratings

At sectoral level, ML risk in traditional retail banks, digital banks, the crypto-asset sector, e-money institutions, payment institutions carrying out money remittance and non-securitisation special purpose entities is assessed as Very Significant. TF risk in traditional retail banks, digital banks, the crypto-asset sector and payment institutions carrying out money remittance is also assessed as Very Significant. The NRA attributes these heightened exposures to the sectors’ significant international linkages, the nature of the products and services they offer and their scale and importance in Ireland. All sectors are assessed as Low risk from a PF perspective.

The NRA also assesses a number of sectors for the first time, including MiFID investment firms and MiFID markets firms (each rated Moderate for ML and Low for TF) and retail intermediaries (rated Low across ML, TF and PF), and sets out a table of rating changes since 2019. Notable movements include increased risk ratings for the crypto-asset sector, funds management companies and remote bookmakers and reduced ratings for sectors such as bureaux de change, life insurance and legal services.

Changes from the 2019 NRA

The 2026 NRA has significantly expanded Ireland’s national risk framework by incorporating the country’s first dedicated assessment of PF Threats. This development reflects alignment with evolving FATF standards and the need to address the risks associated with the financing of weapons proliferation alongside the more established ML and TF threats.

The 2026 NRA also places greater emphasis on emerging technology-driven financial crime risks. While crypto-assets were an emerging issue in 2019, the 2026 NRA identifies them as a substantially higher risk area, with the sector’s ML and TF risk ratings rising from Medium-High in 2019 to Very Significant in 2026. The assessment highlights the misuse of crypto-assets for ML, TF and sanctions evasion. Crypto-asset service providers (CASPs), which have required authorisation under MiCAR since the expiry of the transitional period on 30 December 2025, should ensure that their BRAs and control frameworks reflect these elevated ratings.

The Action Plan

The NRA itself identifies five high-level priority actions, spanning risk identification and co-ordination, capacity building and public awareness, law enforcement, framework and policy measures, and regulatory and preventive measures. Alongside the NRA, the DoF published a 30-point Priority Actions Implementation Plan designed to address identified vulnerabilities and strengthen Ireland’s AML/CFT/CPF framework ahead of the 2028 FATF Mutual Evaluation. The Plan allocates responsibilities to government departments, supervisory authorities, law enforcement agencies and the private sector and establishes clear implementation timelines over the next 18 months.

What this means for firms

The publication of the 2026 NRA should encourage firms to review, and where necessary, update their BRAs to ensure they reflect the ML/TF/PF risks identified. Firms should consider whether their existing risk assessments, measures, and control frameworks remain appropriate and proportionate to risk exposures. The NRA also provides a clear indication of the areas likely to receive increased supervisory attention in advance of Ireland’s 2028 FATF Mutual Evaluation, making it important for firms to demonstrate that the findings of the NRA have been appropriately considered and incorporated into their AML/CFT/CPF frameworks.