Data Protection Commission Inquiries
August 2023

1) Inquiry Concerning the Department of Health – June 2023

The Data Protection Commission (“DPC”) has imposed a fine of €22,500 on the Department of Health (“DoH”) after completing an inquiry into certain aspects of it’s processing of personal data in 29 litigation files.

The DPCs statutory inquiry was commenced following public allegations in 2021 that the DoH had unlawfully collected and processed personal data about plaintiffs and their families in the context of litigation surrounding the plaintiff special education needs.

The DPC concluded that the DoH did not infringe Data Protection law by seeking information about the services that were being provided to plaintiffs, however, the DoH did infringe data protection law by asking broad questions that resulted in the provision of sensitive information about the private lives of plaintiffs and their families. The DoH had no lawful basis for processing such data, and also did so in breach of the data minimisation principle.

The DPC imposed the fine of €22,500 for the DoH's infringements of Articles 5(1)(c) (data minimisation principle), 6(1) and 9(1) (lawful basis requirements), 6(4) GDPR (further compatible processing requirements). The DPC also issued a reprimand on the DoH in respect of these infringements, as well as for infringements of Articles 5(1)(c) and 32(1) (security obligations) and 14 (transparency obligations). In addition, the DPC imposed a ban on the DoH processing the excessive personal data and special category data in the litigation files in question for the purposes of determining an appropriate time to settle a case.

For more information, the full decision can be found HERE.


2) Inquiry concerning Airbnb Ireland – June 2023

The DPC has published the final decision, issued on 21st June 2023 in which it imposed a reprimand and corrective measures on Airbnb Ireland UC for violations of the GDPR. The SDPC commences its inquiry following a complaint that Airbnb Ireland had unlawfully requested a copy of the complainants ID to verify their identify, which had not previously been requested by Airbnb. Initial attempts by the complainant to verify their identify had been rejected by Airbnb as the ID provided did not meet their criteria. The complaint contented that this went against the principles of data minimisation and that Airbnb also failed to comply with the principles of transparency and provision of information.

Following its investigation, the DPC found that Airbnb’s retention of a copy of the complainants ID following successful completion of the verification process infringed the principles of data minimisation under Article 5(1)(c) and the principle of storage limitation under Article 5(1)(e). the DPC also found that the continued processing and retention of partially redacted and out of date IDs that had been deemed inadequate or insufficient to verify the identify of the complainant infringed the same principles.

In light of these infringements, the DPC issued a reprimand to Airbnb Ireland. In addition, the DPC made the following orders against Airbnb Ireland to remedy the infringements identified and to prevent similar infringements occurring in the future:

Delete from all of its systems and records the redacted and out of date copies of the complaints IDs
Delete from all of its systems and records the IDs that the complaint uploaded
Revise its internal policies and procedures concerning user verification to endure that

    a. Once the identify of data subjects has been verified to Airbnb Ireland satisfaction, discontinue the         practice of retaining improperly redacted and/or out of date IDs which may be submitted by data            subjects as part of the identify verification process; and

    b. The period for which valid or fraudulent or illegitimate IDs submitted by data subjects as part of            the identity verification process are stored is limited to a strict minimum period.

For more information, the full decision can be found HERE.

Department of Finance - MiCA: Consultation Opened on National Discretions
August 2023

On 9th August 2023, the Department of Finance (“DoF”) launched a public consultation on the exercise of certain national discretions contained in the EU Markets in Crypto-Assets Regulation (“MiCA”). The DoF is consulting on how Irish law should address transitional arrangements for existing Virtual Asset Service Providers (“VASPs”) already providing services in accordance with Irelands domestic regulatory framework.

Thile MiCA was enacted in June 2023, the new framework and obligations that it creates will mostly take effect during 2024. Read our previous blogpost on MiCA here. As an EU regulation, MiCA has direct effect in EU member states, however it does leave certain matters to each member state’s discretion and Ireland’s decision on those matters will need to be implemented through national legislation; thus the DoF’s current consultation.

The DoF is consulting on the following four discretions:

1. Public Disclosure of Inside Information (Article 88(3))
   
   
2. Administrative Penalties and Administrative Measures (Article 111(1))
   
   
3. Transition Period for Existing Crypto-Asset Service Providers (Article 143)
   
   
4. Simplified Authorisation Application for existing CASPs (Article 143(6))
   
   

This consultation represents an opportunity for participants, especially existing VASPs, to have their say on the shaping of some important policy and legislative issues. The consultation closes on 15th September 2023. 

Central Bank of Ireland: Product Oversight and Governance (“POG”) Thematic Review
August 2023

A thematic inspection of product oversight and governance was undertaken by the Central Bank of Ireland in the latter half of 2022. The inspection included a selection of six non-life insurance undertakings to assess the current level of controls, processes and systems in place relating to POG arrangements. The inspection focused on five key control areas:

1. POG policies & procedures
   
   
2. Underwriting controls
   
   
3. Post implementation reviews
   
   
4. Risk management oversight; and
   
   
5. Board oversight

Key themes identified:

1. Board Oversight
   
   The inspection found that there wasn’t always strong Board oversight of all new products and material changes to existing products. The CBI notes that Boards should have sign-off role for new products and material product changes.
   
   
2. Risk Management
   
   The CBI found that the risk function’s role in POG arrangements to be lacking in some instances. The CBI stated that the POG process should be meaningful and a control that is integrated with both the emerging risk and Own Risk Solvency (“ORSA”) process.
   
   
3. Policy Wording
   
   The CBI outlined its expectation that firms ensure sufficient resources and attention are provided to ensure any potential detriment to the firm and the customer is identified and mitigated without delay and also have in place a plan of ongoing policy wording reviews.
   
   
4. Protection Gaps
   
   The CBI found that while undertakings in general are aware of the EIOPA recent Supervisory Statement and the requirements within, these requirements need to be reinforced to ensure that the POG process considers both prudential and consumer considerations.

The CBI also outlined various good practices which firms should consider embedding into their own POG arrangements such as the CRO having a ‘gatekeeper’ role with responsibility for considering materiality of product changes, having at least one member of the Board with general insurance background and a detailed understanding of products, establishing a customer forum and dedicated wordings committees, implementing a schedule of product reviews and manual wordings, to name a few.

The CBI concluded that:

• To ensure they have a complete awareness of their exposures in connection to the products they offer, many undertakings need to take additional steps to guarantee they have reliable procedures and controls, as well as technical expertise to advise on and challenge.

Central Bank of Ireland: Dear Chairperson Letter on Trading Venue Compliance with Requirements under MAR
August 2023

The CBI has published a letter, dated 26th July 2023 addressed to trading venue operators, outlining the findings of the CBI’s thematic inspection of operators’ market surveillance arrangements and their compliance with the Market Abuse Regulation (“MAR”).

The inspection identified several failings concerning the effectiveness of market surveillance arrangements:

1. Governance, MI Reporting and Training: Boards, Senior Management Teams and Second Line of Defence were unable to demonstrate the necessary level of understanding, accountability and ownership with regards to surveillance systems. MI was not sufficiently detailed to evidence adequate escalation of issues and specific surveillance training was not provided in a formal basis to all staff, including Board members.
   
   
2. Prevention, Detection and Assurance: Trading Venues do not have sufficiently effective procedures, systems and staff in place to effectively prevent, monitor, detect and identify market abuse issues. Gaps were identified to relation to real time surveillance, resources, and controls.
   
   
3. Suspicious Transaction Order Reports (“STORs”): The number of STORs received by the CBI from Trading Venues have decreased substantially since 2018. This does not reflect the quantity of transactions has increased and the number of overall STPRs received by the CBI has increased. Issues identified during the inspection include Compliance officers having no formal role in relation to the production and review of STORs and no internally set deadlines to ensure timely STOR submission.

The CBI requires that the Chairpersons take responsibility for the findings in the letter, ensuring that it is discussed, minuted, and actioned. The CBI requires trading venues to immediately commence a review of the trade surveillance arrangements.

The full letter can be read HERE

Central Bank of Ireland: Engagement Update on Consumer Protection Code Review
August 2023

On 31st July 2023, the CBI published an engagement update following on from its discussion paper published in October 2022, on the review of the Consumer Protection Code 2012. The CBI has conducted a six month engagement programme across a wide array of stakeholder which included round tables, bilateral meetings, industry events, public surveys and written stakeholder submissions.

From the feedback sought, five themes have emerged:

1. Digitalisation: New technologies have provided greater opportunities for customers, but firms must ensure that the needs of all customers continue to be met.
   
   
2. Vulnerable Customers: firms need to be able to identify actual or potential vulnerability characteristics and support customers through changing life events.
   
   
3. Transparency: standardised and clear disclosure requirements need to be provided to accurately inform customers, ensuing that information provided is not excessive.
   
   
4. Financial Literacy: improved financial education can aid customers a number of key financial areas.
   
   
5. Regulatory status: it must be clear if firms and products are not regulated by the CBI. The availability of unregulated products by regulated firms creates confusion for customers.
   
   

The CBI intends to introduce a revised and modernised Consumer Protection Code 2024, which wil include consolidating existing riles with he Code of Conduct on Mortgage Arrears (“CCMA”). It plans to consult on the Code in December 2023.

Following adoption of the revised Code in 2024, work on further enhancements to the Code will be undertaken over the course of 2024, with additional Regulations planned for 2025.

The full Engagement Update can be read HERE

Central Bank of Ireland Discussion Paper on Macroprudential Policy for Investment Funds
July 2023

On 18th July 2023, the Central Bank of Ireland (“CBI”) published a Discussion Paper seeking views on a new macroprudential policy framework for investment funds (“DP11”). It aims to advance ongoing European discussions on how a macroprudential perspective in the regulation of the funds sector could be achieved. It discusses important factors to take into account when creating and implementing such a framework.

A macroprudential framework for the funds sector would adopt a systemic viewpoint and seek to make sure that this expanding area of the financial industry is more stress-resistant and less likely to magnify negative shocks. As a result, the sector would be better prepared to contribute as a dependable source of funding, supporting larger-scale economic activities.

The Central Bank is seeking feedback from stakeholders on a number of issues raised in the discussion paper to inform further analysis and policy work in this area via an online survey which will run until 15 November 2023.

The full Discussion Paper can be found here.

Central Bank of Ireland: Dear CEO Letter to High-Cost Credit Providers
July 2023

On 30th June 2023, the Central Bank of Ireland (“CBI”) issued a Dear CEO Letter to High-Cost Credit Providers (“HCCPs”). The aim of the letter was to give an insight into the findings from CBI supervisory engagements with HCPPs and to set out their expectations in relation to HCCPs compliance with their AML/CFT & Financial Sanction obligations.

The CBI highlighted a lack of compliance with legislative obligations in the following areas:

• HCCPs have not adequately considered their obligations under the CJA 2010 and therefore have not ensured that their business operations and control frameworks are compliant;

• Some HCCPs have not undertaken a business wide risk assessment (“BWRA”) and therefore are not in a position to identify their ML/TF;

• Some HCCPs have not sufficiently tailored the BWRA and/or AML/CFT policies and procedures to the business model, limiting their ability to implement an appropriate control framework;

• Many HCCPs were unable to demonstrate compliance with a number of obligations under the CJA 2010, including adequate customer due diligence, ongoing monitoring and suspicious transaction reporting.

Further points noted by the CBI in the letter include:

• The importance of complying with all relevant obligations under the CJA 202, regardless of size or structure of the entity.

• Many HCCPs did not have documented AML/CFT frameworks or AML/CFT policies and procedures in place,

• The CBI outlined their concern regarding the level of deficiencies it has observed in relation to the responses via the Risk Evaluation Questionnaire (“REQ”).

• The CBI reminded HCCPs of their obligation to provide accurate, complete and timely information when requested to do so by the CBI.

All HCCPs are required to review the findings and expectations in the letter and where gaps/weaknesses are identified by the HCCP, they are required to take steps to remediate the identified gaps/weaknesses in a timely manner.

The full Dear CEO Letter can be accessed here.

Central Bank of Ireland Consultation Paper seeking views on enhanced enforcement process
June 2023

On 22nd June, the Central Bank of Ireland (“CBI”) launched a 12 week consultation (“CP154”) on enhancements to the Administrative Sanctions Procedure (“ASP”). The purpose of CP154 is to seek views on the revised procedures in the ASP following the introduction of changes under the Individual Accountability Framework (“IAF”) and to provide guidance in an open and clear manner as to how the CBI proposes to operate these revised procedures.

The IAF was signed into law on 9th March 2023. The Act introduces several changes to the ASP under Part IIC of the Central Bank Act 1942. The strengthened ASP is designed to underpin and support the introduction of IAF and in particular, the Senior Executive Accountability Regime (“SEAR”) and conduct standards for firms and individuals.

This follows CP153 on the Enhanced governance, performance, and accountability in financial services, which closed on 13th June which included regulatory guidance and draft regulations supplementing the IAF. Read our blogpost on CP153 here.

The Consultation will remain open from 22nd June to 14th September. When submitting a response via email, the CBI asks that respondents include the following subject heading in their email “Consultation Paper 154 on the ASP Guidelines under the Individual Accountability Framework” and address their response to ASPconsultation2023@centralbank.ie. The CBI will then review all feedback received on the Consultation and prepare a Feedback statement for publication online. `View the full press release and consultation paper here.

European Commission: Retail Investment Package
June 2023

On 24th May 2023, the European Commission (“Commission”) adopted the Retail Investment Package as part of its 2020 capital markets union action plan. The retail investment package consists of two legislative proposals:

• A proposed Directive amending the UCITS Directive, Solvency II Directive, AIFMD, MiFID II Directive and Insurance Distribution Directive as regards retail investor protection rules (referred to as the “Omnibus Directive”) (here); and

• A proposed Regulation amending the PRIIPs Regulation as regards modernisation of the key information document (here).

One of the primary goals of the 2020 capital markets union action plan is to make the EU a safer place for long term investments. The retail investment package aims to achieve that goal while also encouraging involvement in EU capital markets.


Key Features of the Retail Investment Package

According to the Commission, the retail investment package includes ambitious and wide-ranging measures:

• Disclosure: the package will change the existing disclosure rules to respond to digitisation and to meet investors growing sustainability preferences. For example, investment firms, insurance intermediaries and insurance undertakings distributing insurance-based investment products will have to display appropriate risk warnings.

• Costs: new rules will require the use of standard presentation and terminology on costs. The package will include new provisions in the UCITs Directive and AIFMD to define the conditions for considering that costs are due and provide rules in the pricing process.

• Inducements: the package introduces restrictions and safeguards in relation to inducements and advice, based on a staged approach by:

• Banning inducements for sales of investment products where no advice is provided;

• For sales where advice is provided, replacing the current criteria with a new uniform test specifying the duty for advisors to act in the best interests of the client; and

• Where inducements are allowed, requiring distributors to inform clients about what the inducements are we well as their costs and impact on investment returns.

• Marketing: financial intermediaries will be fully responsible for the use and misuse of their marketing communications.

• Advisors: the package intends to apply a high standard of qualifications to financial advisors and compliance with requirements will need to be proved by obtaining a certificate.

• Professional Investors: The new rules are intended to reduce administrative burdens and increase product and service accessibility for sophisticated retail investors by making the qualifying conditions for becoming a professional investor more equitable upon request. MiFID II amendments include lowering the wealth criteria from €500,000 to €250,000, adding a fourth possible criterion pertaining to education or training, and allowing legal entities to qualify as professional.

Central Register of Beneficial Ownership of Companies: New Restrictions on Access
June 2023

Since 13 June 2023, persons seeking to inspect information on the central register of beneficial ownership of companies must first demonstrate they have a “legitimate interest” in anti-money laundering and countering terrorist financing, to justify that access. The changes are introduced under new 2023 Regulations, following a significant 2022 judgement of the Court of Justice of the European Union.

Central Bank of Ireland Annual Report and Annual Performance Statement 2022-2023
June 2023

On 24th May 2023, the Central Bank of Ireland (“CBI”) published its Annual Report and Annual Performance Statement 2022-2023. The report provides an overview of activities and work completed by the CBI in 2022, as well as outlining key priorities for 2023.


Authorisation Activity

In 2022, the CBI received a high volume of new applications for various types of authorisations.

The investment fund sector continued to grow in scale and complexity with a significant volume of funds (744) and fund service provider (23) authorisations in 2022.

4 Virtual Asset Service providers (“VASPs”) were registered in 2022.

2022 also saw the CBI being authorisation processes for providers of hire purchase, buy-now-pay-later and consumer hires, as well as introducing new requirements for high cost credit providers.

233 applications for retail intermediary/brokers were approved.



2023 Key Priorities

In the near term, we can expect to see a feedback statement following the Discussion Paper on the Consumer Protection Code, followed by a consultation paper. The review of how the Innovation Hub is functioning will begin (that is also a key deliverable under the Government's updated 'Ireland for Finance' strategy).

The key priorities remain consistent with those signposted in detail by the Central Bank ‘Dear CEO’ letter to all regulated firms. See our published blogpost here


The Full Annual Report and Annual Performance Statement can be found here

Section 35 The Companies (Corporate Enforcement Authority) Act 2021 Commencement of section 888A of the Companies Act 2014
May 2023

With effect from 23rd April 2023, there is a new requirement to furnish Personal Public Service (“PPS”) number or Verified Identity Number (“VIN”) when filing the following forms with the Companies Registration Office (“CRO”):

• Form A1 – incorporation of a new company

• Form B1 – annual return

• Form B10 / B69 – notifying a change of director

The requirement protects both the integrity of the registration of businesses and the misuse of director identities.

The CRO will verify the director's first name, surname, date of birth and PPS number submitted by crosschecking the information against data held by the Department of Social Protection (“DSP”).

PPS numbers, RBO numbers and VINs will not be accessible on the public register.

In accordance with Section 888A(2) of Companies Act 2014, any person who, without just cause, fails to comply shall be guilty of a Category 4 offence which can result in a fine of up to €5,000.

Central Bank of Ireland Updated Fitness & Probity process for Individual Questionnaires
May 2023

In March 2023, the Central Bank updated its Individual Questionnaire (“IQ”) which must be submitted by any person seeking approval from the Central Bank to perform a PCF Function under the Fitness & probity Regime. It also published draft guidance on a new process for the submission of IQs via the Central Bank Portal, which is applicable from 20th April.

A PDF version of the updated IQ can be accessed here.

The Central Bank’s guidance on the submission of the IQ can be accessed here.

European Commission Markets in Crypto-Assets Regulation
May 2023

The European Commission introduced in September 2020 a proposal for a regulation on Markets in Crypto-Assets (MiCA) as part of its digital finance strategy.

MiCA will apply across the European Union without any need for national implementation laws. This approach is in line with consumer protection and ensuring effective and harmonised access to the innovative crypto-assets markets across the single market. The MiCA regulation has four essential objectives:

Data Protection Commission: Meta Fine of €1.2 billion
May 2023

On 22nd May 2023, the Data Protection Commission (“DPC”) announced that it had issued its decision (dated 12 May 2023) in which it fined Meta Platforms Ireland Limited €1.2 billion for breach of Article 46(1) of the General Data Protection Regulation (GDPR) relating to its delivery of its Facebook service.


Background to the decision

The DPC launched an investigation into Meta in August 2020. After conducting its investigation, the DPC released its draft decision in which it determined that Meta’s data transfers to its US equivalent, Meta Platforms, Inc., were done in violation of Article 46(1) of the GDPR and that those transfers should be stopped. 

Data Protection Commission New Guidance: The Records of Processing Activities (RoPA)
April 2023

On 21st April, the Data Protection Commission published new guidance on the Records of Processing Activities (RoPA). Article 30 of the General Data Protection Regulation (GDPR) requires Data Controllers to maintain a RoPA. Article 30 prescribes the information the records must contain and controllers and processors must be able to provide such records to the DPC on request. 

Central Bank of Ireland Industry Letter on costs and fees to fund managers
April 2023

On 24th March 2023, the Central Bank of Ireland (“the CBI”) published an industry letter on the 2021 Common Supervisory Action (“CSA”) on costs and fees of UCITs. The letter outlines the CBI’s findings from the CSA and supervisory expectations and key actions for fund managers.

AIF managers should be aware that while the CSA concentrated on the costs and fees of UCITS, the CBI expects that AIFMs will also take the findings and actions in the Letter into account with respect to the costs and fees charged to AIFs.

Central Bank of Ireland Updates to Fitness and Probity Enforcement Procedures
April 2023

On 21st April 2023, The Central Bank of Ireland (‘CBI’) published an Industry letter notifying firms of the updated procedures for fitness and probity investigations, suspensions and prohibitions. The updated procedures apply from 20th April 2023.

Part 3 of the Central Bank Reform Act 2010 has been amended by the Central Bank (Individual Accountability Framework) Act 2023. The amendments, which were commenced by order on 19th April 2023 are summarised below:

1. Investigation of individuals who formerly performed CF roles: the central bank can now investigate a former controlled function (CF) role holder, provided that they performed the role within the shorter of the following periods: (a) the period since 19th April 22023 and (b) the 6 years before the date on which an investigation is commenced.
   
   
2. Commencement of investigation: a new statutory procedure has been introduced for giving notice of investigations.
   
   
3. Suspension: the limit for the initial duration of s suspension notice has increased from 3 months to 6 months. Suspension notices may now be appealed to the Irish Financial Services Appeals Tribunal. The period for which the High Court may extend a suspension notice has increased from 3 months to 6 months. The CBI may make subsequent applications to the High Court to further extend the suspension notice.
   
   
4. Investigation report: the statutory procedure for investigation reports has been changed to provide for the preparation and service of a draft report followed by a final report.
   
   
5. Discontinuing an investigation: the CBI may discontinue an investigation for reasons to be stated in a notice.
   
   
6. Prohibition Notices: will now only take effect when confirmed by the High Court or agreed in writing.
   
   
7. Varying/revoking prohibition: a new procedure allowing the CBI or the subject to apply to the High Court for an order varying or revoking a prohibition notice.
   
   
8. Regime extended to certain holding companies: the fitness and probity regime (upon CBI issuing regulations) apply to individuals performing certain CF roles in holding companies of certain regulated firms.
   
   
9. Enhanced independence requirements: certain requirements have been introduced to ensure the independence of an investigation and associated decision-making procedures.

The amendments to Part 3 of the 2010 Act have necessitated changes to regulations and guidance. The updated regulations and guidance are:

Central Bank Reform Act 2010 (Procedures Governing Conduct of Investigations) Regulations 2023

Fitness and Probity Investigations, Suspensions and Prohibitions: Guidance 2023

More information can be found at: https://www.centralbank.ie/regulation/how-we-regulate/fitness-probity/investigations-enforcement

RegSol’s Vulnerable Customers’ Seminar
March 2023

The RegSol team would like to give a massive thank you to all of those who attended our Seminar on Friday 24th March 2023 - 'Vulnerable Customers: Who cares about Accessibility in Financial Services?'

Central Bank of Ireland: Consumer Protection Outlook Report 2023
March 2023

The Central Bank of Ireland (‘CBI’) have published the Consumer Protection Outlook Report 2023. The report outlines the five key drivers of consumer risk in Ireland, in this changing and challenging economic environment.

These risk drivers reflect the feedback and engagement that the CBI has undertaken with various stakeholders over the last year which has been incorporated into their annual risk assessment. The five Key Drivers of Consumer Risks and associated CBI expectations of firms are:



1) The changing operational landscape

• Actively identify and address risks to consumers that may emerge from change in the landscape within which the firm and/or its consumers are operating

• Engage with financial innovation to address the needs and interests of consumers

• Have sufficient operational resilience to manage change

• Clearly distinguish between regulated and unregulated services for the consumer, particularly when they are being offered in the same digital space.

2) Poor business practices and weak business processes

• Place the best interests of consumers at the heard of commercial decisions

• Implement robust governance and oversight arrangements for the design, sale and delivery of the product

• Comply with suitability requirements

• Monitor products to ensure it is performing as intended and remains suitable for the target market

• Ensure proper resources are deployed to deliver a high quality service

3) Ineffective disclosures to consumers

• Provide clear information promptly, to consumers, disclosing key information upfront

• Support consumers by ensuing information is provided in a way that can be easily understood

• Ensure that statements of suitability and other disclosures are fully compliant with legislative requirements

• Ensure disclosure is as clear on digital media as with more traditional methods

• Avoid Greenwashing by producing disclosure documents that are clear and full compliant with legislative requirements

• Disclose exclusions to financial products effectively at the outset, to support consumers in making good decisions

4) Technology-driven risks to consumer protection;

• Have well defined and comprehensive IT and cybersecurity risk management frameworks, supported by sufficient resources

• Make sure that the interests of the consumer are the firm's top priorities when designing and distributing financial products digitally, and that the product will only be made available to suitable consumers

• Have effective measures to mitigate the risk of fraud and scams and be proactive in identifying and dealing with cases

• Demonstratable oversight of delegated or outsourced arrangements and evidence that associated risks are appropriately considered and managed

5) The impact of shifting business models

• Consider the impact of decisions on vulnerable customers and implement effective processes and communication plans

• Proactively assess and mitigate the risks and consumer impact of commercial decisions whilst ensuring that customers understand that changes mean for them

• Have sufficient customer service capacity and structures

• Only design and bring to market products that meet the needs of identified target market

The CBI have anchored on these risks for their work in 2023 and beyond, which means that regulated firms can focus on making long-term sustainable improvements. The report also includes a description of key bodies of work to be delivered by the CBI with respect to the Key Drivers of Consumer Risk.

The full Report can be found at:

Central Bank of Ireland Consumer Protection Outlook Report 2023

Individual Accountability Framework Consultation Paper (CP153)
March 2023

Following the enactment of the Central Bank (Individual Accountability Framework) Bill 2022 on 9th March, the CBI has launched a three-month consultation (CP153) on key aspects of the implementation of the Individual Accountability Framework (IAF). This includes the publication of draft Regulations and guidance.


The draft regulations and guidance seeks to provide clarity in terms of the Central Bank’s expectations for the implementation of three aspects of the framework: the Senior Executive Accountability Framework (SEAR), the Conduct Standards and certain aspects of the enhancements to the Fitness & Probity Regime.

The following implementation timeline is proposed:

• Conduct standards including accountability of senior individuals to apply from 31st December 2023

• Fitness & Probity Regime – Certification and inclusion of Holding Companies to apply from 31st December 2023

• Allocation of responsibilities and decision making to apply to in-scope firms from 1st July 2024

The consultation will remain open until 13th June 2023. The full Consultation Paper can be found here:

Consultation Paper 153: enhanced Governance and performance and accountability in financial services

Central Bank Dear CEO letter – MiFID Structured Retail Product Review - Supervisory Guidance
March 2023

On 3rd March 2023, the Central Bank of Ireland (the “CBI”) published further Supervisory Guidance following the “Dear CEO” of April 2022, which outlined its findings of a review identifying issues in the marketing of complex investment products - Structured Retail Products (SRPs) - manufactured and distributed by MiFID investment firms.

The Supervisory Guidance supplements this letter and provides clarification to firms on how the warnings on use of a decrement index should appear, and the presentation of back-testing.

FSPO Levy Regulations
February 2023

The Financial Services and Pensions Ombudsman (‘FSPO’) resolves complaints from consumers, small businesses and other organisations, against financial service providers and pension providers.

On 20th January 2023, the Financial Services and Pensions Ombudsman Act 2017 [Financial Services and Pensions Ombudsman Council] Financial Services Industry Levy Regulations 2023 (‘the Regulations’)were signed (here).

The Regulations came into operation on 1st February 2023.

The Regulations require that each financial service provider is liable to pay an annual levy in relation to the services provided by the FSPO to the finance industry.

The levy payable by each type of financial service provider for the year ended 31st December 2023 is to be calculated by reference to the criteria in each category under the Schedule to these Regulations.

In order to ensure an equitable distribution of the levy among financial service providers, on an annual basis an exercise is carried out to ensure that the proportion of the levy applicable to each category of financial service provider reflects the volume of complaints received by the FSPO in the previous three-year period.

The Regulations also provide for the collection and recovery of the levy and provide for certain obligations in respect of self-assessment and record keeping by financial service providers.

For more information regarding the levy, the FSPO has issued a helpful guidance which can be found at the following link:

The Financial Services and Pensions Ombudsman Levy Report 2023

Central Bank Dear CEO Letter on Financial Regulation Priorities for 2023
February 2023

On 16th February 2023, the Central Bank issued a Dear CEO Letter setting out its key regulation and supervision priorities for 2023.

The Letter first highlights the challenging macro-financial environment and the risks facing the financial system and global markets, which were also highlighted in the Central Bank’s most recent Financial Stability Review. The Central Bank expects the Irish economy will continue to experience positive (although lower) growth in 2023 and notes that it is facing increased downside risks given the size of the energy and inflation shock and the slowdown in the global economy. The Central Bank confirms that this economic context will be central to their regulatory focus in 2023 to ensure the financial system and firms operate to support the interests of consumers and users as they cope with those risks and challenges.

The Letter then identifies the Central Bank’s key 2023 regulatory and supervisory priorities as follows:

1. Authorisations 
    
   The Central Bank aims to provide a clear, open and transparent authorisation process through active and constructive engagement with industry and other stakeholders. It is focused on creating the regulatory context in which the potential benefits of innovation for consumers, investors, businesses and society can be realised, while the risks are effectively managed and mitigated.
   
   
2. Operational Resilience
    
   The Central Bank will be assessing and managing risks to the financial and operational resilience of firms. This includes the potential decline in asset quality arising from prevailing inflationary pressures, lingering effects from the pandemic and a slowdown in the UK economy.
   
   
3. Non- Banking Sector 
   
   Actions on the systemic risks generated by non-banks will be progressed, in particular by advancing a macro-prudential framework for non-banks and improvements to legislative frameworks and investor protections in the investment fund sector.
   
   
4. Banking Sector 
   
   The Central Bank will continue to oversee the consolidation of the Irish banking sector and associated programme of account migration, implement new credit supervision mandates and continue to monitor for emerging risks in relation to distressed debt, investor protection and product governance.
   
   
5. Engagement 
   
   The Central Bank will continue to consult and engage on regulatory developments under the Consumer Protection Framework and Individual Accountability Framework leading to enhancements in existing and new regulations.
   
   
6. Credit Unions 
   
   Changes will be implemented to credit union regulations/guidance arising from the Department of Finance-led Policy Framework Review, including through engaging with sectoral stakeholders.
   
   
7. Innovation 
   
   The Central Bank will consult on its approach to innovation that will include an exploration of new ways of engagement with innovators and their products.
   
   
8. AML & Sanctions 
   
   There will be ongoing focus and vigilance around the integrity of the financial system and preventing misuse through detecting and sanctioning market abuse, supervising firms’ compliance with Anti-Money Laundering/Combating the Financing of Terrorism obligations and administering and enforcing financial sanctions (working closely with An Garda Síochána and other relevant bodies in all these areas). 
   
   The Central Bank will also be ensuring that the EU’s Anti-Money Laundering Action Plan, including the establishment of a single supervisory authority (the Anti-Money Laundering Authority (AMLA)), results in a consistent and robust EU-wide framework.
   
   
9. EU Regulation 
   
   The Central Bank will be contributing to progressing European regulation, particularly the review of the Payment Services Directive (PSD2) and the functioning of open banking, as well as implementing new EU regulations on digital operational resilience (DORA) and markets in crypto assets (MiCA).
   
   
10. ESG 
    
    The Central Bank will be aiming to strengthen the resilience of the financial system to climate change risks and its ability to support the transition to a climate-neutral economy, along with implementing the EU’s Sustainable Finance Disclosures Regulation.

If your firm has a query regarding any of the key priorities highlighted by the Central Bank above, feel free to contact us at info@regsol.ie

To read the Dear CEO Letter in full, please follow the link below:
Dear CEO Letter - Central Bank's key regulation and supervision priorities for 2023

DPC Fines Meta (Facebook, Instagram & WhatsApp) nearly €400 Million for incorrect legal basis relied upon to justify data collection under GDPR
January 2023

On 4th January 2023, the Data Protection Commissioner (the ‘DPC’) announced that it had concluded two inquiries into Meta Platforms Ireland Limited’s (‘Meta’) data processing operations in respect of its Instagram and Facebook services.

Final decisions have now been made by the DPC where it has fined Meta Ireland €210 million and €180 million for breaches of the GDPR relating to its Facebook and Instagram services, respectively. Meta has also been directed to bring its data processing operations into compliance within a period of 3 months.

Rise of the Money Mule in Ireland
January 2023

It is estimated that the most prolific fraud gang in Ireland — the Black Axe crime network - a notorious West African-based criminal organisation formed in the 1970s and now operating world-wide, has stolen or laundered €64 million in Ireland in recent years. While that gang has its origins in Nigeria, it is believed that more than 4,000 people who have used Irish addresses are laundering money for the gang.

The Garda National Economic Crime Bureau’s (GNECB) long-running probe, called Operation Skein, is an ongoing investigation into fraud being committed in Ireland that includes international business email compromise (BEC), invoice redirect fraud and romance scams. The investigation also targets the laundering of the proceeds through Irish accounts.

Central Bank Dear CEO Letter to Payment & E-Money Institutions
January 2023

On 20th January 2023, the Central Bank published a Dear CEO Letter (‘January 2023 Letter’) to payment and electronic money institutions highlighting recent supervisory weaknesses and reaffirming supervisory expectations and actions for these sectors.

The January 2023 Letter follows the December 2021 Dear CEO Letter from the Central Bank to these institutions which it provided greater clarity on its supervisory expectations for the sector. The January 2023 Letter also refers to the Consumer Protection Outlook Report 2022 published in March 2022 which sets out the key cross sectoral risks identified by the Central Bank as the primary drivers of risk for consumers of financial services in Ireland and across the EU today. The Central Bank highlights these risks are particularly relevant to the payment and e-money sector based on what it has observed over the course of 2022.

It also refers to the recent reference in the International Monetary Fund’s (IMF) Technical Note on Oversight of Fintech in Ireland of the payment and e-money sector’s growing importance within the broader fintech sector in Ireland.

The January 2023 Letter sets out actions identified by the Central Bank to remedy deficiencies in five key areas, namely:

1. Safeguarding,
   
   
2. Governance, risk management, conduct and culture,
   
   
3. Business model, strategy, and financial resilience,
   
   
4. Operational resilience, and
   
   
5. Anti-money laundering and countering terrorist financing.

Safeguarding

The main focus of the January 2023 Letter is safeguarding. In the December 2021 Dear CEO Letter, the Central Bank asked all firms to comprehensively review compliance with the safeguarding requirements set out in the E-Money Regulations or Payment Services Regulations (as appropriate) by 31st March 2022. One quarter of those firms self-identified deficiencies in their safeguarding risk management frameworks, and deficiencies were later identified in other firms.

As a result, the Central Bank sets out its expectations as follows for firms to:

• Have robust, Board approved, safeguarding risk management frameworks in place which ensure that relevant users’ funds are appropriately identified, managed and protected on an ongoing basis. This includes the clear segregation, designation and reconciliation of users’ funds held on behalf of customer.

• Be proactive in ensuring that the design and operating effectiveness of the firm’s safeguarding frameworks is tested on an ongoing basis.

• Notify the Central Bank immediately of any safeguarding issues identified.

• Take mitigating and corrective measures immediately to ensure that users’ funds are safeguarded where, in exceptional circumstances, issues are identified.

• Investigate and remediate on a timely basis the underlying root cause of the safeguarding issue(s).

The Central Bank also request all payment institutions and e-money firms who are subject to the safeguarding requirements to commission an audit of their compliance with those requirements from an audit firm which has the necessary specialist skill to audit compliance in this area. Each firm must provide that audit opinion, together with a response from its board to the outcome of that audit, to the Central Bank by 31st July 2023.

Given the 31st July 2023 deadline, the January 2023 Letter should promptly be brought to the attention of the board of any payment institution or electronic money institution and if your particular entity has a query regarding any of the issues highlighted by the Central Bank above, feel free to contact us at info@regsol.ie

To read the January 2023 Letter in full, please follow the link below:

Dear CEO Letter - Supervisory Findings and Expectations for Payment and Electronic Money (E-Money) Firms (centralbank.ie)

RegSol’s Vulnerable Customers Seminar 24th March 2023
January 2023



Are you missing out on engaging with potential clients because your website isn’t fully accessible or your meeting space isn’t physically accessible?

Are you fearful of engaging with clients who have identified vulnerabilities because you don’t know how to navigate those needs or know what reasonable accommodations should be offered?

This half day in-person event is designed to inform, encourage and support Financial Advisors in embracing a thitherto under-served market.

You will learn what the legal and regulatory requirements are but more importantly, how best to support individuals that do require some assistance to ensure your services are truly accessible.

Cost: €100 p/p

* CPD accreditation for this event is sought from the Insurance Institute, Institute of Bankers, LIA and ILCU

AXA Life Europe DAC fined €3,640,000 for failures in Corporate Governance and Risk Management
December 2022

On 8th December 2022, the Central Bank reprimanded and fined AXA Life Europe DAC (AXA) €3.64 million for failures in corporate governance, risk management and handling of conflicts of interest.

The fine relates to three breaches of European insurance regulations by AXA, authorised by the Central Bank in Ireland to carry out life insurance business and who set up a German branch in 2006 on a freedom of establishment basis where it started selling an insurance product known as TwinStar.

The German Federal Financial Supervisory Authority (BaFin) regulated the German branch for conduct of business.

Between 2006 and 2012, AXA sold around 350,000 TwinStar policies, of which approximately 203,000 remain in place.

When the policies first went on sale between 2006 and 2007, there was a reference in the documentation to a Parental Claims Guarantee (PCG) provided by AXA’s parent, AXA SA, to provide AXA with the necessary resources to pay all outstanding German policyholder claim liabilities, if AXA became unable to do so itself. The PCG was provided because AXA, as an Irish-based insurer, could not participate in the insolvency protection scheme for German life insurance companies.

In 2006, BaFin, wrote to AXA’s German branch and told it that the references to the guarantee in some of the documentation inferred a higher level of security than had actually been provided. This was because some policy documentation failed to make clear that the PCG was conditional and could terminate automatically if certain conditions were met.

In early 2018, the sale of AXA was being considered by its parent and as part of this consideration, the Central Bank became aware that policies sold in 2006 and 2007 may not have been updated to disclose the conditional nature of the PCG, despite the letter from BaFin. As a result, the Central Bank commenced an investigation.

Central Bank Publishes Research on Insurance Engagement and Switching
December 2022

On 1st December 2022 the Central Bank published an Economic Letter, “Engagement, switching, and digital usage in consumer and insurance markets: who does it and why it matters” examining engagement and switching patterns among car and home insurance consumers.

The Letter examines the traits of consumers who find it difficult to look for and buy financial products, including insurance, online.

The Letter highlights factors that may prevent policyholder participation and switching from a comprehensive survey of Irish policyholders as well as behavioural economics. Among its main conclusions are:

Central Bank FAQs re Ireland Safe Deposit Box, Bank and Payment Accounts Register
December 2022

FAQs - Ireland Safe Deposit Box, Bank and Payment Accounts Register

On 15th December 2022, the Central Bank updated its frequently asked questions (FAQs) in relation to Ireland Safe Deposit Box, Bank and Payment Accounts Register (ISBAR).

ISBAR was recently established and will be administered by the Central Bank to hold information on accounts identifiable by IBAN (including account holders, beneficial owners and signatories), and information on safe deposit box services. The register is established in line with 5th EU AML Directive requirements and is designed to enable Financial Intelligence Unit within An Garda Síochána to search and retrieve information as part of criminal investigations.

Any credit institution established in Ireland, which issues Irish IBAN identifiable accounts, or holds Safe Deposit Boxes on behalf of its customers, is required to provide Bank Account and Safe Deposit Information to ISBAR.

The obligation for credit institutions to provide information will commence once formally notified by the Central Bank to do so in Q1 2023.

Legislation will be enacted at a later date to extend the scope of the reporting obligation to other financial service providers who issue Irish IBANs.

The FAQs cover What is ISBAR, General Reporting Requirements, File Generation and Technical Questions. 

Consumer Rights Act 2022 Soon to be Commenced
November 2022

The Consumer Rights Act 2022 (the Act’), which has been signed into law on 7th November 2022 and is expected to be commenced soon, is the biggest overhaul of consumer protection in Ireland, strengthening consumer rights, protections and remedies in a range of key areas.

The Act consolidates and modernises Irish consumer rights legislation for the sale of goods and supply of services, ensuring that the updated legislation is more in keeping with the digital age.

In addition to updating the current Irish legislation, the Act will also transpose the following directives aligning the legislation more closely with those applying across the EU:

DPC Fines Meta €265 Million for ‘data scraping’ leak
November 2022

On 29th November 2022, the Data Protection Commission (‘DPC’) imposed a fine of €265 million and a range of corrective measures on Meta Platforms Ireland Limited (‘Meta’), data controller of the “Facebook” social media network, for failing to properly protect its data.

The fine relates to a data breach discovered in 2021 whereby personal data of EU Justice Commissioner Didier Reynders, Luxembourg Prime Minister Xavier Bettel and dozens of EU officials were included in a leak of the personal data of 533 million users across 106 countries including phone numbers, Facebook IDs, full names and birthdates that surfaced on a public forum and circulating widely on the web. Facebook subsequently fixed the vulnerability on this feature, where data could be collected by external parties through a process called scraping.

The DPC held Meta failed to comply with the GDPR obligation to ensure privacy "by design and default," meaning it had engineered its products in a way that personal data could leak.

The latest sanction brings the total amount Meta has been fined to roughly €1bn, including €225mn against its messaging service WhatsApp for failing to enforce transparency requirements under EU law, and a €405mn fine against Instagram for failing to protect children’s data.

For further details on the DPC’s decision, please go to the following link:

Data Protection Commission announces decision in Facebook “Data Scraping” Inquiry

EBA Guidelines for Remote Customer Onboarding
November 2022

The European Banking Authority (EBA) has published its final Guidelines on the application of anti-money laundering and countering the financing of terrorism (AML/CFT) rules where customers are onboarded remotely.

The EBA are aware that designed persons, as defined under the Irish Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 as amended, have been experiencing a growing demand for remote customer onboarding solutions, especially due to the restrictions on movement caused by the COVID-19 pandemic and that there is not sufficient clarity and convergence about what is, and what is not, allowed in a remote and digital context.

The Guidelines therefore set out the steps credit and financial institutions should take when choosing remote customer onboarding tools and when assessing the adequacy and reliability of such tools, in order to comply effectively with their AML/CFT obligations. The guidelines are technologically neutral and do not prioritise the use of one tool over another.

These guidelines establish common EU standards on the development and implementation of sound, risk-sensitive initial customer due diligence policies, and processes which must be followed when customers are onboarded remotely.

A list indicating considerations which the above-mentioned internal policies and procedures should set out is also provided within the Guidelines and includes:

• the types of documents that are admissible and the information and authenticity checks that are necessary to identify the customer and verify their identity;

• the level of human intervention required in the remote verification process;

• the controls in place to monitor, on an ongoing basis, the correct and appropriate functioning of each remote customer onboarding solution and the effective implementation of the remote customer onboarding policies and procedures; and

• a description of the induction and regular training programs to ensure staff awareness and up-to-date knowledge of the functioning of the remote customer onboarding solution(s), the associated risks, and of the remote customer onboarding policies and procedures aimed at mitigating such risks.

To see learn more on how RegSol can assist your firm in implementing the EBA’s Guidelines and/or provide tailored AML training relevant to your firm, please do not hesitate to contact us at info@regsol.ie

Mercer Global Investments Management Limited Fined €117,600 for Breaches of UCITS Regulations
November 2022

On 14th November 2022, the Central Bank reprimanded and fined Mercer Global Investments Management Limited (‘MGIM’) €117,600 pursuant to its Administrative Sanctions Procedure (‘ASP’) for six breaches of UCITS investment fund regulations (the ‘UCITS Regulations’).

MGIM, as a UCITS Management Company, was responsible under the UCITS Regulations for ensuring that certain information must be included in prospectuses and key investor information documents (‘KIIDs’) for funds it managed, and that this information should have been kept up to date in order to enable investors to make informed decisions about their investments.

The Central Bank found that, for varying periods between 1st July 2011 and 31st December 2018, the prospectuses and KIIDs for five sub-funds failed to disclose that the sub-funds relied upon an index-tracking strategy or provide the details of the index being tracked.

As a result, MGIM’s failure to comply with these requirements may have resulted in investors not being fully informed of the investment strategy of a particular fund or the risks associated with investment in that fund.

In addition, to ensure effective gatekeeping by the Central Bank in the authorisation of funds, the Central Bank reviews prospectuses (including any supplements to those prospectuses) before authorising a fund. The Central Bank noted the effectiveness of its gatekeeper role ultimately relies on accurate and complete information being submitted by firms seeking fund authorisation, as part of the assessment of their applications and in ongoing supervision.

The Central Bank’s investigation found that MGIM failed in its obligations to both investors and to the Central Bank by not including required information regarding index-tracking strategy in the prospectuses and KIIDs of five investment funds managed by MGIM.

Central Bank Dear CEO Letter on Protecting Consumers in a Changing Economic Landscape
November 2022

The Dear CEO Letter issued on 17th November 2022 by the Central Bank expands on the Consumer Protection Outlook Report 2022 and provides further guidance to firms on its expectations in a challenging economic landscape characterised by energy-driven inflation and uncertainty and the responsibility of firms to navigate these challenges in a manner that places the best interests of consumers at the heart of their commercial decision-making.

The Report highlighted five cross-sectoral risk areas facing financial services and set out specific actions to be taken by firms to address these potential risks, namely:

• Actively identify and address risks to consumers that may potentially emerge from changes in the landscape within which the firm and/or its consumers are operating.

• Have sufficient operational resilience to manage change without creating risks to consumers.

• Proactively assess the risks and consumer impact a commercial decision may pose to new and existing customers, and develop comprehensive action plans to mitigate these risks whilst ensuring that customers understand what changes mean for them.

• Have the customer service capacity and structures in place to meet expected service levels to provide a timely and customer focused service through all channels.

• Consider the impact of their decisions on vulnerable customers and provide the assistance necessary. This should include specific and effective processes and communication plans to support vulnerable customers.

• Only design and bring to market products with features, charges, and risks that meet the needs of consumers identified for the product.

Furthermore, the Appendix to the letter the Central Bank highlights a number of items for particular attention which should be incorporated into a firm’s work programme, senior management and board considerations, respective to the financial services that the firm provides.

Cyber-security Awareness e-Learning
November 2022

We are delighted to have partnered with BHConsulting on an innovative cyber-security e-learning course with an Irish perspective, hosted exclusively on the RegSol e-Learning platform (https://training.regsol.ie).

At RegSol, our core competency is compliance and in particular regulatory compliance. So when our clients asked us to provide self-paced cyber-security e-learning alongside our compliance modules, we initially declined. However, it makes a lot of sense for employees to have a single portal where they can complete and review all of their e-learning modules in the same place. 

Central Bank Highlights Under-Insurance in Home Insurance Market
November 2022

On 22nd September 2022, the Central Bank of Ireland (“Central Bank”) wrote to insurers telling them they must do more to warn customers of the risk of under-insurance in the home insurance market, in light of the impact of inflation on construction costs.

This follows a Thematic Review carried out by the Central Bank, which found that under-insurance in the home insurance market had been steadily increasing over the last five years – from an average of 6.5% of paid claims being under-insured in 2017, up to 16.5% in 2021.

The Central Bank's review of the home insurance market identified shortcomings in two areas:

• clarity, consistency and timeliness of communication with consumers, and

• the effectiveness of risk management tools in identifying and assessing risk to consumers.

The Central Bank also outlined its supervisory expectations for all firms that provide home insurance products to consumers to:

1. Send a clear communication of the risks and examples of the consequences of under-insurance to policyholders, the reasons why this is currently a heightened risk and how policyholders can better estimate an adequate sums insured value, in a stand-alone, written form;
   
   
2. Act honestly, fairly and professionally in the best interests of its customers and the integrity of the market.
   
   
3. Put in place a clear plan to address the points raised in the Dear CEO Letter. The plan must include clear and reasonable timelines for implementation of mitigating actions, with appropriate governance and sign-off. The plan should be submitted to the Central Bank cpnonlife@centralbank.ie by 28 October 2022;
   
   
4. Ensure the board has appropriate oversight of the plan to address the gaps identified, or the actions required.

The Dear CEO Letter can be found here and if you have any queries in how to apply the above Central Bank supervisory expectations to your firm, please contact us at info@regsol.ie

Whistleblowing in Financial Services Webinar 2022
November 2022

Broker’s Ireland will be hosting RegSol’s CEO AnneMarie Whelan to present at their webinar on whistleblowing in the Financial Services sector on Thursday 17th November 2022.

Webinar Details:

“All financial service providers are required to have a policy or channel in place that allows employees to raise issues of concern with respect to non-compliance with financial services legislation without fear of retaliation from their employer. In addition, the Protected Disclosures Act 2014, which applies to all employing entities, was recently amended to transpose the European Whistleblowing Directive into Irish law. This webinar looks at the recent key changes to the legislation, the key obligations on employers and their increasing nature relative to the size of employing entity.”

For more details on the webinar and to sign up to attend, please go to the following link:

Whistleblowing in Financial Services Webinar 2022 | Brokers Ireland