The bank was found to be responsible for three breaches of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010.

The three CJA breaches stem from the bank’s failure to ensure that its automated transaction monitoring system monitored the transactions of certain categories of customers of its Irish branch, for a period of almost nine years, between 2010 and 2019.

The root cause of this failure was historic data filters that were applied within Danske’s automated transaction monitoring system, first implemented in 2005 and rolled out to the Irish branch in 2006.

Danske failed to consider the appropriateness of these historic data filters within the system or make any adjustments to the system to take account of the specific requirements of the CJA when it came into force in Ireland in 2010.

This led to the erroneous exclusion of certain categories of customers from transaction monitoring, including some customers rated by Danske as high and medium risk, which caused the three breaches of the CJA in this case.

Danske became aware of the inadequacies in its transaction monitoring system in 2015 as a result of an internal audit report, but failed to notify the Irish branch and to take adequate action for almost four years.

It is estimated that between 31 August 2015 and 31 March 2019, 348,321 transactions, equating to approximately one in forty or 2.43 per cent of all transactions processed through the Irish branch were not monitored for money laundering and terrorist financing risk.

The Central Bank has determined the appropriate fine to be €2,600,000, which has been reduced by 30 per cent to €1,820,000 in accordance with the early settlement discount scheme provided for in the Central Bank’s administrative sanctions procedure (ASP).

This is the first penalty that the Central Bank has imposed on a financial institution which is incorporated and supervised outside of Ireland (i.e. in Denmark) but which operates in Ireland as a branch on a passport basis.