Central Bank of Ireland: Consumer Protection Outlook Report 2023
March 2023

The Central Bank of Ireland (‘CBI’) have published the Consumer Protection Outlook Report 2023. The report outlines the five key drivers of consumer risk in Ireland, in this changing and challenging economic environment.

These risk drivers reflect the feedback and engagement that the CBI has undertaken with various stakeholders over the last year which has been incorporated into their annual risk assessment. The five Key Drivers of Consumer Risks and associated CBI expectations of firms are:



1) The changing operational landscape

• Actively identify and address risks to consumers that may emerge from change in the landscape within which the firm and/or its consumers are operating

• Engage with financial innovation to address the needs and interests of consumers

• Have sufficient operational resilience to manage change

• Clearly distinguish between regulated and unregulated services for the consumer, particularly when they are being offered in the same digital space.

2) Poor business practices and weak business processes

• Place the best interests of consumers at the heard of commercial decisions

• Implement robust governance and oversight arrangements for the design, sale and delivery of the product

• Comply with suitability requirements

• Monitor products to ensure it is performing as intended and remains suitable for the target market

• Ensure proper resources are deployed to deliver a high quality service

3) Ineffective disclosures to consumers

• Provide clear information promptly, to consumers, disclosing key information upfront

• Support consumers by ensuing information is provided in a way that can be easily understood

• Ensure that statements of suitability and other disclosures are fully compliant with legislative requirements

• Ensure disclosure is as clear on digital media as with more traditional methods

• Avoid Greenwashing by producing disclosure documents that are clear and full compliant with legislative requirements

• Disclose exclusions to financial products effectively at the outset, to support consumers in making good decisions

4) Technology-driven risks to consumer protection;

• Have well defined and comprehensive IT and cybersecurity risk management frameworks, supported by sufficient resources

• Make sure that the interests of the consumer are the firm's top priorities when designing and distributing financial products digitally, and that the product will only be made available to suitable consumers

• Have effective measures to mitigate the risk of fraud and scams and be proactive in identifying and dealing with cases

• Demonstratable oversight of delegated or outsourced arrangements and evidence that associated risks are appropriately considered and managed

5) The impact of shifting business models

• Consider the impact of decisions on vulnerable customers and implement effective processes and communication plans

• Proactively assess and mitigate the risks and consumer impact of commercial decisions whilst ensuring that customers understand that changes mean for them

• Have sufficient customer service capacity and structures

• Only design and bring to market products that meet the needs of identified target market

The CBI have anchored on these risks for their work in 2023 and beyond, which means that regulated firms can focus on making long-term sustainable improvements. The report also includes a description of key bodies of work to be delivered by the CBI with respect to the Key Drivers of Consumer Risk.

The full Report can be found at:

Central Bank of Ireland Consumer Protection Outlook Report 2023

Individual Accountability Framework Consultation Paper (CP153)
March 2023

Following the enactment of the Central Bank (Individual Accountability Framework) Bill 2022 on 9th March, the CBI has launched a three-month consultation (CP153) on key aspects of the implementation of the Individual Accountability Framework (IAF). This includes the publication of draft Regulations and guidance.


The draft regulations and guidance seeks to provide clarity in terms of the Central Bank’s expectations for the implementation of three aspects of the framework: the Senior Executive Accountability Framework (SEAR), the Conduct Standards and certain aspects of the enhancements to the Fitness & Probity Regime.

The following implementation timeline is proposed:

• Conduct standards including accountability of senior individuals to apply from 31st December 2023

• Fitness & Probity Regime – Certification and inclusion of Holding Companies to apply from 31st December 2023

• Allocation of responsibilities and decision making to apply to in-scope firms from 1st July 2024

The consultation will remain open until 13th June 2023. The full Consultation Paper can be found here:

Consultation Paper 153: enhanced Governance and performance and accountability in financial services

Central Bank Dear CEO letter – MiFID Structured Retail Product Review - Supervisory Guidance
March 2023

On 3rd March 2023, the Central Bank of Ireland (the “CBI”) published further Supervisory Guidance following the “Dear CEO” of April 2022, which outlined its findings of a review identifying issues in the marketing of complex investment products - Structured Retail Products (SRPs) - manufactured and distributed by MiFID investment firms.

The Supervisory Guidance supplements this letter and provides clarification to firms on how the warnings on use of a decrement index should appear, and the presentation of back-testing.

FSPO Levy Regulations
February 2023

The Financial Services and Pensions Ombudsman (‘FSPO’) resolves complaints from consumers, small businesses and other organisations, against financial service providers and pension providers.

On 20th January 2023, the Financial Services and Pensions Ombudsman Act 2017 [Financial Services and Pensions Ombudsman Council] Financial Services Industry Levy Regulations 2023 (‘the Regulations’)were signed (here).

The Regulations came into operation on 1st February 2023.

The Regulations require that each financial service provider is liable to pay an annual levy in relation to the services provided by the FSPO to the finance industry.

The levy payable by each type of financial service provider for the year ended 31st December 2023 is to be calculated by reference to the criteria in each category under the Schedule to these Regulations.

In order to ensure an equitable distribution of the levy among financial service providers, on an annual basis an exercise is carried out to ensure that the proportion of the levy applicable to each category of financial service provider reflects the volume of complaints received by the FSPO in the previous three-year period.

The Regulations also provide for the collection and recovery of the levy and provide for certain obligations in respect of self-assessment and record keeping by financial service providers.

For more information regarding the levy, the FSPO has issued a helpful guidance which can be found at the following link:

The Financial Services and Pensions Ombudsman Levy Report 2023

Central Bank Dear CEO Letter on Financial Regulation Priorities for 2023
February 2023

On 16th February 2023, the Central Bank issued a Dear CEO Letter setting out its key regulation and supervision priorities for 2023.

The Letter first highlights the challenging macro-financial environment and the risks facing the financial system and global markets, which were also highlighted in the Central Bank’s most recent Financial Stability Review. The Central Bank expects the Irish economy will continue to experience positive (although lower) growth in 2023 and notes that it is facing increased downside risks given the size of the energy and inflation shock and the slowdown in the global economy. The Central Bank confirms that this economic context will be central to their regulatory focus in 2023 to ensure the financial system and firms operate to support the interests of consumers and users as they cope with those risks and challenges.

The Letter then identifies the Central Bank’s key 2023 regulatory and supervisory priorities as follows:

1. Authorisations 
    
   The Central Bank aims to provide a clear, open and transparent authorisation process through active and constructive engagement with industry and other stakeholders. It is focused on creating the regulatory context in which the potential benefits of innovation for consumers, investors, businesses and society can be realised, while the risks are effectively managed and mitigated.
   
   
2. Operational Resilience
    
   The Central Bank will be assessing and managing risks to the financial and operational resilience of firms. This includes the potential decline in asset quality arising from prevailing inflationary pressures, lingering effects from the pandemic and a slowdown in the UK economy.
   
   
3. Non- Banking Sector 
   
   Actions on the systemic risks generated by non-banks will be progressed, in particular by advancing a macro-prudential framework for non-banks and improvements to legislative frameworks and investor protections in the investment fund sector.
   
   
4. Banking Sector 
   
   The Central Bank will continue to oversee the consolidation of the Irish banking sector and associated programme of account migration, implement new credit supervision mandates and continue to monitor for emerging risks in relation to distressed debt, investor protection and product governance.
   
   
5. Engagement 
   
   The Central Bank will continue to consult and engage on regulatory developments under the Consumer Protection Framework and Individual Accountability Framework leading to enhancements in existing and new regulations.
   
   
6. Credit Unions 
   
   Changes will be implemented to credit union regulations/guidance arising from the Department of Finance-led Policy Framework Review, including through engaging with sectoral stakeholders.
   
   
7. Innovation 
   
   The Central Bank will consult on its approach to innovation that will include an exploration of new ways of engagement with innovators and their products.
   
   
8. AML & Sanctions 
   
   There will be ongoing focus and vigilance around the integrity of the financial system and preventing misuse through detecting and sanctioning market abuse, supervising firms’ compliance with Anti-Money Laundering/Combating the Financing of Terrorism obligations and administering and enforcing financial sanctions (working closely with An Garda Síochána and other relevant bodies in all these areas). 
   
   The Central Bank will also be ensuring that the EU’s Anti-Money Laundering Action Plan, including the establishment of a single supervisory authority (the Anti-Money Laundering Authority (AMLA)), results in a consistent and robust EU-wide framework.
   
   
9. EU Regulation 
   
   The Central Bank will be contributing to progressing European regulation, particularly the review of the Payment Services Directive (PSD2) and the functioning of open banking, as well as implementing new EU regulations on digital operational resilience (DORA) and markets in crypto assets (MiCA).
   
   
10. ESG 
    
    The Central Bank will be aiming to strengthen the resilience of the financial system to climate change risks and its ability to support the transition to a climate-neutral economy, along with implementing the EU’s Sustainable Finance Disclosures Regulation.

If your firm has a query regarding any of the key priorities highlighted by the Central Bank above, feel free to contact us at info@regsol.ie

To read the Dear CEO Letter in full, please follow the link below:
Dear CEO Letter - Central Bank's key regulation and supervision priorities for 2023

DPC Fines Meta (Facebook, Instagram & WhatsApp) nearly €400 Million for incorrect legal basis relied upon to justify data collection under GDPR
January 2023

On 4th January 2023, the Data Protection Commissioner (the ‘DPC’) announced that it had concluded two inquiries into Meta Platforms Ireland Limited’s (‘Meta’) data processing operations in respect of its Instagram and Facebook services.

Final decisions have now been made by the DPC where it has fined Meta Ireland €210 million and €180 million for breaches of the GDPR relating to its Facebook and Instagram services, respectively. Meta has also been directed to bring its data processing operations into compliance within a period of 3 months.

Rise of the Money Mule in Ireland
January 2023

It is estimated that the most prolific fraud gang in Ireland — the Black Axe crime network - a notorious West African-based criminal organisation formed in the 1970s and now operating world-wide, has stolen or laundered €64 million in Ireland in recent years. While that gang has its origins in Nigeria, it is believed that more than 4,000 people who have used Irish addresses are laundering money for the gang.

The Garda National Economic Crime Bureau’s (GNECB) long-running probe, called Operation Skein, is an ongoing investigation into fraud being committed in Ireland that includes international business email compromise (BEC), invoice redirect fraud and romance scams. The investigation also targets the laundering of the proceeds through Irish accounts.

Central Bank Dear CEO Letter to Payment & E-Money Institutions
January 2023

On 20th January 2023, the Central Bank published a Dear CEO Letter (‘January 2023 Letter’) to payment and electronic money institutions highlighting recent supervisory weaknesses and reaffirming supervisory expectations and actions for these sectors.

The January 2023 Letter follows the December 2021 Dear CEO Letter from the Central Bank to these institutions which it provided greater clarity on its supervisory expectations for the sector. The January 2023 Letter also refers to the Consumer Protection Outlook Report 2022 published in March 2022 which sets out the key cross sectoral risks identified by the Central Bank as the primary drivers of risk for consumers of financial services in Ireland and across the EU today. The Central Bank highlights these risks are particularly relevant to the payment and e-money sector based on what it has observed over the course of 2022.

It also refers to the recent reference in the International Monetary Fund’s (IMF) Technical Note on Oversight of Fintech in Ireland of the payment and e-money sector’s growing importance within the broader fintech sector in Ireland.

The January 2023 Letter sets out actions identified by the Central Bank to remedy deficiencies in five key areas, namely:

1. Safeguarding,
   
   
2. Governance, risk management, conduct and culture,
   
   
3. Business model, strategy, and financial resilience,
   
   
4. Operational resilience, and
   
   
5. Anti-money laundering and countering terrorist financing.

Safeguarding

The main focus of the January 2023 Letter is safeguarding. In the December 2021 Dear CEO Letter, the Central Bank asked all firms to comprehensively review compliance with the safeguarding requirements set out in the E-Money Regulations or Payment Services Regulations (as appropriate) by 31st March 2022. One quarter of those firms self-identified deficiencies in their safeguarding risk management frameworks, and deficiencies were later identified in other firms.

As a result, the Central Bank sets out its expectations as follows for firms to:

• Have robust, Board approved, safeguarding risk management frameworks in place which ensure that relevant users’ funds are appropriately identified, managed and protected on an ongoing basis. This includes the clear segregation, designation and reconciliation of users’ funds held on behalf of customer.

• Be proactive in ensuring that the design and operating effectiveness of the firm’s safeguarding frameworks is tested on an ongoing basis.

• Notify the Central Bank immediately of any safeguarding issues identified.

• Take mitigating and corrective measures immediately to ensure that users’ funds are safeguarded where, in exceptional circumstances, issues are identified.

• Investigate and remediate on a timely basis the underlying root cause of the safeguarding issue(s).

The Central Bank also request all payment institutions and e-money firms who are subject to the safeguarding requirements to commission an audit of their compliance with those requirements from an audit firm which has the necessary specialist skill to audit compliance in this area. Each firm must provide that audit opinion, together with a response from its board to the outcome of that audit, to the Central Bank by 31st July 2023.

Given the 31st July 2023 deadline, the January 2023 Letter should promptly be brought to the attention of the board of any payment institution or electronic money institution and if your particular entity has a query regarding any of the issues highlighted by the Central Bank above, feel free to contact us at info@regsol.ie

To read the January 2023 Letter in full, please follow the link below:

Dear CEO Letter - Supervisory Findings and Expectations for Payment and Electronic Money (E-Money) Firms (centralbank.ie)

RegSol’s Vulnerable Customers Seminar 24th March 2023
January 2023



Are you missing out on engaging with potential clients because your website isn’t fully accessible or your meeting space isn’t physically accessible?

Are you fearful of engaging with clients who have identified vulnerabilities because you don’t know how to navigate those needs or know what reasonable accommodations should be offered?

This half day in-person event is designed to inform, encourage and support Financial Advisors in embracing a thitherto under-served market.

You will learn what the legal and regulatory requirements are but more importantly, how best to support individuals that do require some assistance to ensure your services are truly accessible.

Cost: €100 p/p

* CPD accreditation for this event is sought from the Insurance Institute, Institute of Bankers, LIA and ILCU

AXA Life Europe DAC fined €3,640,000 for failures in Corporate Governance and Risk Management
December 2022

On 8th December 2022, the Central Bank reprimanded and fined AXA Life Europe DAC (AXA) €3.64 million for failures in corporate governance, risk management and handling of conflicts of interest.

The fine relates to three breaches of European insurance regulations by AXA, authorised by the Central Bank in Ireland to carry out life insurance business and who set up a German branch in 2006 on a freedom of establishment basis where it started selling an insurance product known as TwinStar.

The German Federal Financial Supervisory Authority (BaFin) regulated the German branch for conduct of business.

Between 2006 and 2012, AXA sold around 350,000 TwinStar policies, of which approximately 203,000 remain in place.

When the policies first went on sale between 2006 and 2007, there was a reference in the documentation to a Parental Claims Guarantee (PCG) provided by AXA’s parent, AXA SA, to provide AXA with the necessary resources to pay all outstanding German policyholder claim liabilities, if AXA became unable to do so itself. The PCG was provided because AXA, as an Irish-based insurer, could not participate in the insolvency protection scheme for German life insurance companies.

In 2006, BaFin, wrote to AXA’s German branch and told it that the references to the guarantee in some of the documentation inferred a higher level of security than had actually been provided. This was because some policy documentation failed to make clear that the PCG was conditional and could terminate automatically if certain conditions were met.

In early 2018, the sale of AXA was being considered by its parent and as part of this consideration, the Central Bank became aware that policies sold in 2006 and 2007 may not have been updated to disclose the conditional nature of the PCG, despite the letter from BaFin. As a result, the Central Bank commenced an investigation.

Central Bank Publishes Research on Insurance Engagement and Switching
December 2022

On 1st December 2022 the Central Bank published an Economic Letter, “Engagement, switching, and digital usage in consumer and insurance markets: who does it and why it matters” examining engagement and switching patterns among car and home insurance consumers.

The Letter examines the traits of consumers who find it difficult to look for and buy financial products, including insurance, online.

The Letter highlights factors that may prevent policyholder participation and switching from a comprehensive survey of Irish policyholders as well as behavioural economics. Among its main conclusions are:

Central Bank FAQs re Ireland Safe Deposit Box, Bank and Payment Accounts Register
December 2022

FAQs - Ireland Safe Deposit Box, Bank and Payment Accounts Register

On 15th December 2022, the Central Bank updated its frequently asked questions (FAQs) in relation to Ireland Safe Deposit Box, Bank and Payment Accounts Register (ISBAR).

ISBAR was recently established and will be administered by the Central Bank to hold information on accounts identifiable by IBAN (including account holders, beneficial owners and signatories), and information on safe deposit box services. The register is established in line with 5th EU AML Directive requirements and is designed to enable Financial Intelligence Unit within An Garda Síochána to search and retrieve information as part of criminal investigations.

Any credit institution established in Ireland, which issues Irish IBAN identifiable accounts, or holds Safe Deposit Boxes on behalf of its customers, is required to provide Bank Account and Safe Deposit Information to ISBAR.

The obligation for credit institutions to provide information will commence once formally notified by the Central Bank to do so in Q1 2023.

Legislation will be enacted at a later date to extend the scope of the reporting obligation to other financial service providers who issue Irish IBANs.

The FAQs cover What is ISBAR, General Reporting Requirements, File Generation and Technical Questions. 

Consumer Rights Act 2022 Soon to be Commenced
November 2022

The Consumer Rights Act 2022 (the Act’), which has been signed into law on 7th November 2022 and is expected to be commenced soon, is the biggest overhaul of consumer protection in Ireland, strengthening consumer rights, protections and remedies in a range of key areas.

The Act consolidates and modernises Irish consumer rights legislation for the sale of goods and supply of services, ensuring that the updated legislation is more in keeping with the digital age.

In addition to updating the current Irish legislation, the Act will also transpose the following directives aligning the legislation more closely with those applying across the EU:

DPC Fines Meta €265 Million for ‘data scraping’ leak
November 2022

On 29th November 2022, the Data Protection Commission (‘DPC’) imposed a fine of €265 million and a range of corrective measures on Meta Platforms Ireland Limited (‘Meta’), data controller of the “Facebook” social media network, for failing to properly protect its data.

The fine relates to a data breach discovered in 2021 whereby personal data of EU Justice Commissioner Didier Reynders, Luxembourg Prime Minister Xavier Bettel and dozens of EU officials were included in a leak of the personal data of 533 million users across 106 countries including phone numbers, Facebook IDs, full names and birthdates that surfaced on a public forum and circulating widely on the web. Facebook subsequently fixed the vulnerability on this feature, where data could be collected by external parties through a process called scraping.

The DPC held Meta failed to comply with the GDPR obligation to ensure privacy "by design and default," meaning it had engineered its products in a way that personal data could leak.

The latest sanction brings the total amount Meta has been fined to roughly €1bn, including €225mn against its messaging service WhatsApp for failing to enforce transparency requirements under EU law, and a €405mn fine against Instagram for failing to protect children’s data.

For further details on the DPC’s decision, please go to the following link:

Data Protection Commission announces decision in Facebook “Data Scraping” Inquiry

EBA Guidelines for Remote Customer Onboarding
November 2022

The European Banking Authority (EBA) has published its final Guidelines on the application of anti-money laundering and countering the financing of terrorism (AML/CFT) rules where customers are onboarded remotely.

The EBA are aware that designed persons, as defined under the Irish Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 as amended, have been experiencing a growing demand for remote customer onboarding solutions, especially due to the restrictions on movement caused by the COVID-19 pandemic and that there is not sufficient clarity and convergence about what is, and what is not, allowed in a remote and digital context.

The Guidelines therefore set out the steps credit and financial institutions should take when choosing remote customer onboarding tools and when assessing the adequacy and reliability of such tools, in order to comply effectively with their AML/CFT obligations. The guidelines are technologically neutral and do not prioritise the use of one tool over another.

These guidelines establish common EU standards on the development and implementation of sound, risk-sensitive initial customer due diligence policies, and processes which must be followed when customers are onboarded remotely.

A list indicating considerations which the above-mentioned internal policies and procedures should set out is also provided within the Guidelines and includes:

• the types of documents that are admissible and the information and authenticity checks that are necessary to identify the customer and verify their identity;

• the level of human intervention required in the remote verification process;

• the controls in place to monitor, on an ongoing basis, the correct and appropriate functioning of each remote customer onboarding solution and the effective implementation of the remote customer onboarding policies and procedures; and

• a description of the induction and regular training programs to ensure staff awareness and up-to-date knowledge of the functioning of the remote customer onboarding solution(s), the associated risks, and of the remote customer onboarding policies and procedures aimed at mitigating such risks.

To see learn more on how RegSol can assist your firm in implementing the EBA’s Guidelines and/or provide tailored AML training relevant to your firm, please do not hesitate to contact us at info@regsol.ie

Mercer Global Investments Management Limited Fined €117,600 for Breaches of UCITS Regulations
November 2022

On 14th November 2022, the Central Bank reprimanded and fined Mercer Global Investments Management Limited (‘MGIM’) €117,600 pursuant to its Administrative Sanctions Procedure (‘ASP’) for six breaches of UCITS investment fund regulations (the ‘UCITS Regulations’).

MGIM, as a UCITS Management Company, was responsible under the UCITS Regulations for ensuring that certain information must be included in prospectuses and key investor information documents (‘KIIDs’) for funds it managed, and that this information should have been kept up to date in order to enable investors to make informed decisions about their investments.

The Central Bank found that, for varying periods between 1st July 2011 and 31st December 2018, the prospectuses and KIIDs for five sub-funds failed to disclose that the sub-funds relied upon an index-tracking strategy or provide the details of the index being tracked.

As a result, MGIM’s failure to comply with these requirements may have resulted in investors not being fully informed of the investment strategy of a particular fund or the risks associated with investment in that fund.

In addition, to ensure effective gatekeeping by the Central Bank in the authorisation of funds, the Central Bank reviews prospectuses (including any supplements to those prospectuses) before authorising a fund. The Central Bank noted the effectiveness of its gatekeeper role ultimately relies on accurate and complete information being submitted by firms seeking fund authorisation, as part of the assessment of their applications and in ongoing supervision.

The Central Bank’s investigation found that MGIM failed in its obligations to both investors and to the Central Bank by not including required information regarding index-tracking strategy in the prospectuses and KIIDs of five investment funds managed by MGIM.

Central Bank Dear CEO Letter on Protecting Consumers in a Changing Economic Landscape
November 2022

The Dear CEO Letter issued on 17th November 2022 by the Central Bank expands on the Consumer Protection Outlook Report 2022 and provides further guidance to firms on its expectations in a challenging economic landscape characterised by energy-driven inflation and uncertainty and the responsibility of firms to navigate these challenges in a manner that places the best interests of consumers at the heart of their commercial decision-making.

The Report highlighted five cross-sectoral risk areas facing financial services and set out specific actions to be taken by firms to address these potential risks, namely:

• Actively identify and address risks to consumers that may potentially emerge from changes in the landscape within which the firm and/or its consumers are operating.

• Have sufficient operational resilience to manage change without creating risks to consumers.

• Proactively assess the risks and consumer impact a commercial decision may pose to new and existing customers, and develop comprehensive action plans to mitigate these risks whilst ensuring that customers understand what changes mean for them.

• Have the customer service capacity and structures in place to meet expected service levels to provide a timely and customer focused service through all channels.

• Consider the impact of their decisions on vulnerable customers and provide the assistance necessary. This should include specific and effective processes and communication plans to support vulnerable customers.

• Only design and bring to market products with features, charges, and risks that meet the needs of consumers identified for the product.

Furthermore, the Appendix to the letter the Central Bank highlights a number of items for particular attention which should be incorporated into a firm’s work programme, senior management and board considerations, respective to the financial services that the firm provides.

Cyber-security Awareness e-Learning
November 2022

We are delighted to have partnered with BHConsulting on an innovative cyber-security e-learning course with an Irish perspective, hosted exclusively on the RegSol e-Learning platform (https://training.regsol.ie).

At RegSol, our core competency is compliance and in particular regulatory compliance. So when our clients asked us to provide self-paced cyber-security e-learning alongside our compliance modules, we initially declined. However, it makes a lot of sense for employees to have a single portal where they can complete and review all of their e-learning modules in the same place. 

Central Bank Highlights Under-Insurance in Home Insurance Market
November 2022

On 22nd September 2022, the Central Bank of Ireland (“Central Bank”) wrote to insurers telling them they must do more to warn customers of the risk of under-insurance in the home insurance market, in light of the impact of inflation on construction costs.

This follows a Thematic Review carried out by the Central Bank, which found that under-insurance in the home insurance market had been steadily increasing over the last five years – from an average of 6.5% of paid claims being under-insured in 2017, up to 16.5% in 2021.

The Central Bank's review of the home insurance market identified shortcomings in two areas:

• clarity, consistency and timeliness of communication with consumers, and

• the effectiveness of risk management tools in identifying and assessing risk to consumers.

The Central Bank also outlined its supervisory expectations for all firms that provide home insurance products to consumers to:

1. Send a clear communication of the risks and examples of the consequences of under-insurance to policyholders, the reasons why this is currently a heightened risk and how policyholders can better estimate an adequate sums insured value, in a stand-alone, written form;
   
   
2. Act honestly, fairly and professionally in the best interests of its customers and the integrity of the market.
   
   
3. Put in place a clear plan to address the points raised in the Dear CEO Letter. The plan must include clear and reasonable timelines for implementation of mitigating actions, with appropriate governance and sign-off. The plan should be submitted to the Central Bank cpnonlife@centralbank.ie by 28 October 2022;
   
   
4. Ensure the board has appropriate oversight of the plan to address the gaps identified, or the actions required.

The Dear CEO Letter can be found here and if you have any queries in how to apply the above Central Bank supervisory expectations to your firm, please contact us at info@regsol.ie

Whistleblowing in Financial Services Webinar 2022
November 2022

Broker’s Ireland will be hosting RegSol’s CEO AnneMarie Whelan to present at their webinar on whistleblowing in the Financial Services sector on Thursday 17th November 2022.

Webinar Details:

“All financial service providers are required to have a policy or channel in place that allows employees to raise issues of concern with respect to non-compliance with financial services legislation without fear of retaliation from their employer. In addition, the Protected Disclosures Act 2014, which applies to all employing entities, was recently amended to transpose the European Whistleblowing Directive into Irish law. This webinar looks at the recent key changes to the legislation, the key obligations on employers and their increasing nature relative to the size of employing entity.”

For more details on the webinar and to sign up to attend, please go to the following link:

Whistleblowing in Financial Services Webinar 2022 | Brokers Ireland

Protected Disclosures (Amendment) Act 2021 comes into force on 1st January 2023
October 2022

The Protected Disclosures (Amendment) Act 2022 (the “Amendment Act”) will commence in its entirety on 1st January 2023.

The Act updates the Irish Protected Disclosures Act 2014 (‘2014 Act’) and transposes the EU Whistleblowing Directive into Irish law.

By 1st January 2023, the Amendment Act will have the following effect:

Central Bank Intermediary Times – October 2022
October 2022

In this latest edition of the Central Bank’s newsletter the following items are covered of interest to retail intermediaries:

• Recent developments 
• Changes to the Fitness & Probity application process and Central Bank Portal
• Issuing of the 2021 industry funding levy

• Central Bank publications relevant for retail intermediaries
• An update on the Consumer Protection Code Review
• Risk of under-insurance in the home insurance market and the role of insurance intermediaries (see RegSol’s article here)
• The impact of Covid-19 on operational resilience and implications for customer service

• Upcoming changes to the voluntary revocation process

• Reminders on obligations relating to:
• Changes in qualifying shareholdings
• Legal Entity Identifiers for passporting retail intermediaries (see RegSol’s article here)

1. Changes to the Fitness & Probity application process

IQs for PCFs

For the submission of all applications to become a holder of a Pre-Approval Controlled Function (PCF) in 2023, Individual Questionnaires (IQs) will no longer be submitted through the Online Reporting System (ONR), but will instead be submitted through the Central Bank Portal (Portal). These changes will go live in Q1 2023 and aim to provide applicants with an enhanced process for submitting applications.


Changes to the Portal

Since 27th June 2022, Portal users have had the ability to link their ONR accounts to their Portal accounts, which allows users to access the returns service via the Portal platform. For those that have not yet taken this action, the Central Bank are requesting those to link their account as soon as possible, as access to the ONR via the old login screen will be removed for all users in 2023.


2. Changes to the Voluntary Revocation Process & Form

The Central Bank is introducing a number of changes to the voluntary revocation form (where a retail intermediary no longer wishes to retain its authorisation/registration) to ensure the firm assesses the impact of revocation on a its customers.


Complaints and Customer Awareness

The Central Bank expects all retail intermediaries applying for voluntary revocation to ensure their clients are not adversely affected by the action, and seek to address any outstanding complaints, where possible, ahead of making an application. Clients should be made aware of the fact that any complaint or claim made after the revocation of an authorisation/registration may not be covered by the firm’s Professional Indemnity Insurance (PII).


PII Cover

The Central Bank’s expectation remains that adequate PII cover is in place and will remain in place at least until the revocation has been granted. Firms also need to ensure that they make adequate provisions for liabilities that may fall due post-revocation, and should consider the use of run-off PII cover, where appropriate. From November 2022, in addition to the pre-existing conditions of revocation, the application form will also seek attestations from the applicant that:

• PII is in place and will remain in place until the revocation is granted;

• Where there are unresolved, unsatisfied or undischarged complaints against the applicant, that these have been notified to the applicant’s PII insurer;

• The applicant will inform its PII insurer of any further complaints and/or potential claims that it is aware of up to the point of revocation; and

• Where there is a complaint under assessment with the Financial Services and Pensions Ombudsman (FSPO) that the applicant has liaised with the FSPO in respect of the complaint and made adequate provisions for any potential liabilities that may arise from any settlement.

3. Changes to Qualifying Shareholdings – Obligations for Retail Intermediaries

The Central Bank reminds retail intermediaries of their regulatory requirements when engaging in transactions that involve a change in shareholding of the firm.

All Regulated Entities

BOI Fined Record €100.5m for Tracker Mortgage Failures
October 2022

On 27th September 2022, the Central Bank of Ireland (“Central Bank”) reprimanded and fined The Governor and Company of the Bank of Ireland (“BOI”) €100,520,000 pursuant to its Administrative Sanctions Procedure for a series of significant and long-running failings in respect of almost 16,000 tracker mortgage customer accounts which were impacted between August 2004 and June 2022.

This is the largest fine imposed to date by the Central Bank and is in addition to the more than €186.4m BOI has already paid to impacted customers identified prior to and as part of the Central Bank’s Tracker Mortgage Examination.

BOI admitted in full to 81 separate regulatory breaches.

The Central Bank’s investigation found that BOI failed in its obligations towards its customers under the European Communities (Unfair Terms in Consumer Contracts) Regulations, 1995, the Code of Practice for Credit Institutions, 2001 and the Consumer Protection Codes 2006 and 2012.

BOI’s failures resulted in the loss of 50 properties, including 25 family homes, which the Central Bank believed would have been avoided if BOI had complied with the most basic and fundamental of its consumer protection obligations.

The main findings from the Central Bank’s investigation were that BOI:

Protected Disclosures (Amendment) Act 2021 to commence on 1st January 2023!
October 2022

The Minister for Public Expenditure and Reform yesterday (12th October 2022) signed the commencement order for the Protected Disclosures (Amendment) Act 2022 (the “Amendment Act”) confirming on 1st January 2023 the Amendment Act will commence in its entirety.

By 1st January 2023, the Amendment Act will have the following effect:

Climate Change Risk highlighted in CBI Insurance Newsletter September 2022
September 2022

On 20th September 2022, the Central Bank of Ireland (“CBI”) published its regular Insurance Newsletter for September 2022.

While the Newsletter is directed at (re)insurers, the CBI’s observations in relation to climate change risk (following a thematic review of a sample of (re)insurer’s Own Risk and Solvency Assessments (“ORSAs”)), the Central Bank has helpfully included a collated list of all CBI publications on Climate Risk to date.

The relevant article also sets out guidance on how any regulated entity can implement climate change risk considerations into business strategies.

The CBI’s three main observations were:

1. Take a holistic approach to climate change risk to better understand risks to the business, secondary impacts, materiality and areas of further focus;
   
   
2. Consider impacts of climate change to the business model beyond the short term; and
   
   
3. Link climate change risk assessments to strategy, in order to manage or mitigate risks rather than simply monitoring them.

In the ORSAs reviewed, the CBI observed some examples where climate change risk had been integrated into a (re)insurer’s business planning and strategic thinking and identified examples of good practices observed including:

• Embedding the consideration of climate change risk into risk management processes, e.g. updating risk management policies based on conclusions of assessments carried out;
  
  
• Developing a sustainability strategy to define the (re)insurer’s objectives in respect of climate change; and
  
  
• Identifying potential opportunities that arise and ways to develop business models in the future as a result of climate change. The CBI expects (re)insurers to integrate findings and conclusions from risk and scenario analysis into their future strategy to ensure a sustainable business model, e.g. by updating their risk appetite, setting key performance indicators in respect of climate change risk, etc.

To read the Newsletter in full, please go to the following link:

Insurance Newsletter - September 2022  (centralbank.ie)

New Financial Services and Pensions Ombudsman Appointed
September 2022

The new appointment of Liam Sloyan as the Financial Services and Pensions Ombudsman (FSPO) for a five-year term has been announced, which appointment is effective from 1st December 2022.

The FSPO objective is to act as an independent, impartial, fair and free service that helps resolve complaints from consumers, including small businesses and other organisations, against financial service providers and pension providers.

Mr. Sloyan previous led a number of public bodies such as the Health Insurance Authority, the National Treatment Purchase Fund, and as Regulator of the National Lottery.

Mr. Sloyan’s appointment follows the appointment of former FSPO, Ger Deering, as the Ombudsman and Information Commissioner in February 2022.

Mr. Deering was appointed as Financial Services Ombudsman in April 2015 and subsequently, as Pensions Ombudsman in May 2016. He led the establishment of the Office of the FSPO in January 2018, following the amalgamation of the Financial Services Ombudsman Bureau and the Office of the Pensions Ombudsman.

To read the announcement in full, please go to the following link:

Minister Donohoe appoints Financial Services and Pensions Ombudsman  (www.gov.ie)

Instagram Fined record €405 million for Breach of Children's Data Rights
September 2022

On the 2nd September 2022, Instagram (owned by Meta, formerly known as Facebook), was fined €405 million by the Data Protection Commission (“DPC”) for breaches of the GDPR after a two-year investigation into how the social media platform handles children’s data.

It is the largest fine ever imposed by the DPC and once it has been paid, the money will go to the Irish exchequer. It is also the third fine for a Meta-owned company handed down by the DPC.

The fine, which is the second largest GDPR penalty to ever be handed down (Luxembourg’s data protection authority (CNPD) fined Amazon a record €746 million for non-compliance in July), covers alleged violations stemming from Instagram's default account settings for children ages 13-17.

Recital 38 of the GDPR highlights that where children’s data is used to create user profiles, specific protections should apply since children may be less aware of the risk, consequences and safeguards and their rights in relation to the processing of data.

The breaches concerning Instagram related to:

1. Teenage users aged 13-17 being allowed to operate ‘business accounts’ on Instagram, which resulted in the publication of their phone numbers and email addresses.
   
   
2. All accounts, including the accounts of teenage users, were set to public by default, unless the user affirmatively changed the privacy settings.

The investigation into the allegations began in October 2020 and the preliminary decision by the DPC was subject to a dispute resolution procedure under Article 65 of the GDPR. After submitting a draft decision for consideration by its peer regulators in the EU, also known as Concerned Supervisory Authorities (“CSAs”), in December 2021, six of them raised objections. The DPC was unable to reach consensus with the CSAs on the subject matter of the objections and it therefore referred the case to the European Data Protection Board (“EDPB”), in line with the Article 65 dispute resolution process of the GDPR.

The EDPB rejected some of the concerns, but upheld objections requiring the DPC to amend its draft decision to include an additional finding of infringement. The DPC's original draft decision had recommended a fine of up to €405m. The final penalty of €405m included a fine of €20m for an additional infringement that the DPC was asked to include.

In addition to these administrative fines, the DPC has also imposed a reprimand and an order requiring Meta Platforms Ireland Limited to bring its processing into compliance by taking a range of specified remedial actions.

EDPB Chair Andrea Jelinek said: “This is a historic decision. Not just because of the height of the fine - this is the second highest fine since the entry into application of the GDPR - it is also the first EU-wide decision on children’s data protection rights. With this binding decision, the EDPB makes it extra clear that companies targeting children have to be extra careful. Children merit specific protection with regard to their personal data.”

Instagram has indicated it intends to appeal the decision.

For further details on the DPC’s decision, you can click on the following link:

Data Protection Commission announces decision in Instagram Inquiry

Central Bank of Ireland Enforcement Action – Danske Bank reprimanded and fined €1.82m for AML/CFT transaction monitoring failures
September 2022

On 13th September 2022, the Central Bank of Ireland (the “Central Bank”) reprimanded and fined Danske Bank A/S, trading in Ireland as Danske Bank, €1,820,000 pursuant to its Administrative Sanctions Procedure for three breaches of the Criminal Justice (Money Laundering & Terrorist Financing) Act 2010, as amended (the “CJA 2010”).

This is the first penalty that the Central Bank has imposed on a financial institution which is incorporated and authorised outside of Ireland, but which operates here as a branch on a passport basis.

DPC Guidance on Data Transfers to 3rd Countries
August 2022

The Data Protection Commissioner (‘DPC’) reminds entities that the transfer of personal data from the EU to controllers and processors located outside the EU in third countries (i.e. any country outside the European Economic Area (‘EEA’)), while necessary for international trade and international co-operation, should not undermine the level of protection of the individuals concerned.

Such transfers to third countries or international organisations should be done in full compliance with Chapter 5 (Articles 44 – 50) of the General Data Protection Regulation (the ‘GDPR’).

Central Bank (Individual Accountability Framework) Bill 2022
August 2022

The Central Bank (Individual Accountability Framework) Bill 2022 (‘the Bill’) was published on 28th July 2022. Its principal purpose is to confer powers on the Central Bank of Ireland (the ‘CBI”) and provide greater detail on the four pillars of the individual accountability framework (‘IAF’), namely the Senior Executive Accountability Regime; the Conduct Standards; the Fitness and Probity Regime; and the Administrative Sanctions Procedure.

As noted by Gerry Cross, Director of Financial Regulation, on 21st February 2022 in an address to the Compliance Institute: “The Framework is fundamentally about underpinning good conduct and high quality governance and culture within firms. It is about being clear who is responsible for what and ensuring that reasonable steps are taken to fulfil those responsibilities. It is aligned with what will already be sound practices at well-governed and organised firms. The framework is, and our approach to implementation of it will be, firmly founded in proportionality and what is reasonable.”

SEAR

Under the Senior Executive Accountability Regime (‘SEAR’) regulated financial service providers (‘firms’) will be required to set out clearly where the responsibility and decision-making of the firm lies.

The Bill proposes to extend the regulation-making power of the CBI to give effect to SEAR. This will enable the CBI to make regulations in relation to inherent responsibilities and prescribed responsibilities, which relate to pre-approval controlled function (‘PCF’) holders.

This includes a new legal “duty of responsibility” on PCF holders who fall within the scope of SEAR to take “any steps that it is reasonable in the circumstances for the person to take” to ensure the firm does not breach its obligations under financial services legislation. When considering if the relevant individual has discharged their “duty of responsibility”, the CBI will consider all relevant circumstances, examples of which are set out in the Bill include the function of the person and the level of knowledge and experience that a person with such function could reasonably be expected to have. If a contravention of the duty occurs, the individual may be held directly accountable for the breach and be subject to the CBI’s Administrative Sanctions Procedure.

Initially, SEAR is expected to extend only to credit institutions, insurance undertakings (except reinsurance, captive (re)insurance and insurance special purpose vehicles), certain investment firms and any third country branches of those companies.


Conduct Standards

The Bill provides for the introduction of three types of conduct standards for firms and their staff as follows:

• Business Standards (for firms);

• Common Conduct Standards (for individuals); and

• Additional Conduct Standards (for individuals in the most senior roles).


1. Business standards for firms

The Bill (Section 5) provides for a new regulation-making power for the CBI to prescribe business standards within which firms will be obliged to comply to ensure they act in the best interests of customers and of the integrity of the market; act honestly, fairly and professionally; and act with due skill, care and diligence. The business standards will apply to all firms and a breach will be considered a prescribed contravention for purposes of enabling the CBI to enforcement action.


2. Common conduct standards for individuals

The Bill (Section 6) provides for the following individual conduct standards:

1. Common Conduct Standards: these standards will apply to all persons performing controlled functions (i.e. CF or PCF roles).
   
   
2. Additional Conduct Standards: these standards will apply to more senior persons performing PCF roles or who exercise a significant influence on the conduct of the firm’s affairs, for example, chief executives, executive or non-executive directors, heads of functions. Such persons will need to comply with both the Common Conduct Standards and the Additional Conduct Standards, regardless of whether their role is within the scope of SEAR.

Firms must ensure that they notify any relevant persons of the conduct standards that will be expected of them and that they provide training on these standards. The Bill also provides that the CBI will provide guidelines relating to the notification and training obligations of firms.


Certificate of Compliance with Standards of Fitness and Probity

Part 3 of the Bill strengthens the existing obligations on firms in relation to the fitness and probity of their key personnel. The Bill provides that firms will only allow an individual to perform a CF role if a certificate of compliance with standards of fitness and probity is in force in relation to the person. A certificate can be given only if the firm “is satisfied on reasonable grounds” that the person concerned complies with any standard of fitness and probity in a code issued under Section 50 of the Central Bank Reform Act 2010 Act 2010 Act and the person has agreed in writing to comply with any such standard.

The CBI will have the power to make regulations in relation to the form and content of these certificates, the validity period of a certificate and the firm’s procedures in relation to the giving or revoking of a certificate.


Administrative Sanctions Procedure (‘ASP’)

The Bill also makes a number of amendments to the Central Bank Act 1942 which underpins the ASP:

1. High Court oversight for the ‘settlement process’ under section 33AR of the 1942 Act (where the firm or individual acknowledges the commission of the prescribed contravention). Therefore, any sanction imposed by the CBI will only have effect if confirmed by the High Court.
   
   
2. The High Court will confirm the decision unless it is satisfied that the CBI “made an error of law” in its decision or that a sanction is manifestly disproportionate.
   
   
3. The Bill provides a list of relevant considerations that the CBI must take into account when determining whether to impose a sanction, what sanction to impose and the level of any monetary penalty to impose including the person’s seniority and level of responsibility in the firm and whether the person’s conduct was intentional, negligent or dishonest.
   
   
4. The Bill replaces the concept of a ‘person concerned in the management of an RFSP’ with the concept of a ‘person performing a controlled function’ with a view to facilitating individual accountability of the relevant individual.

Next steps

The Bill is yet to be enacted and once the legislative process is completed, the CBI will prepare relevant guidelines and regulations to be issued under the Bill. Relevant firms and senior executives should note that the framework will require significant training and having the appropriate processes in place.

RegSol will keep our clients updated on progress of the Bill and any draft guidelines and regulations once published. If you require assistance in planning for SEAR and IAF or assessing your current framework, contact us at info@regsol.ie

New EBA Guidelines on ML/TF risk factors
August 2022

The European Banking Authority (‘EBA’) published revised Guidelines (updated on 8th August 2022) on customer due diligence (‘CDD’) and the factors to be considered when assessing the risk of money laundering (‘ML’) and terrorist financing (‘TF’) under the 4th and 5th Money Laundering Directives (repealing and replacing the 2017 guidelines).

The Guidelines set out the factors to be taken into account by credit and financial institutions when assessing the ML /TF risks associated with their activities and business relationships or with an occasional transaction with a natural or legal person.

The Guidelines also feature guidance on:

• how financial institutions can adjust their CDD measures to mitigate the ML/TF risk they have identified so as to make them more appropriate and proportionate;

• the identification of beneficial owners;

• the use of innovative solutions to identify and verify customers’ identities;

• how financial institutions should comply with enhanced CDD (‘EDD’) requirements relating to high-risk third countries;

• new sectoral guidelines for crowdfunding platforms, corporate finance advisory firms, account information service providers, payment initiation services providers, and firms providing currency exchange services;

• more details on TF risk factors;

The guidance highlights that there is no requirement for financial institutions to discontinue services to entire categories of customers that they associate with higher ML/TF risk (so-called ‘de-risking’). Instead, financial institutions should take steps to effectively manage the ML/TF risks associated with individual business relationships.

To read the EBA Guidelines in their entirety, please see the following link:

Final Report on Guidelines on revised ML TF Risk Factors.pdf (europa.eu)

Protected Disclosures (Amendment) Act 2021
August 2022

On 21st July 2022, the Protected Disclosures (Amendment) Act 2022 (‘Amendment Act’) was signed into law. It has yet to be commenced or ‘take effect’.

The Act updates the Irish Protected Disclosures Act 2014 (‘2014 Act’) and transposes the EU Whistleblowing Directive into Irish law.

Once commenced, the Amendment Act will:

Roles & Responsibilities of the AML Compliance Officer – EBA Guidance
July 2022

On 14th June 2022 the EBA published guidance on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer.

Frequently we have seen references to a European wide approach to AML/CFT (Anti Money Laundering / Countering the Financing of Terrorism). The aim of these guidelines is to “….create a common understanding, by competent authorities and credit or financial institutions, of credit or financial institutions’ AML/CFT governance arrangements. A common understanding, which is applied consistently and enforced as necessary, is key to strengthening the EU’s AML/CFT defences.”

The guidelines come into effect from 1st December 2022.

They are very comprehensive, running to 54 pages and they examine in detail the following:

Intermediary Times June 2022 Issued by the Central Bank
July 2022

The 'Intermediary Times', the Central Bank’s newsletter published twice a year, includes regulatory issues that retail intermediary firms need to be aware of in improving their standards of compliance.

In this latest edition the Central Bank of Ireland covers many items including:

Q&A - Price Walking & Differential Pricing Regulations Commencing 1st July 2022
July 2022

Further to our article in May’s edition of the RegSol newsletter (HERE) on the new Central Bank (Supervision and Enforcement) Act 2013 (Section 48(1) (Insurance Requirements) Regulations 20221 (the Regulations) which came into effect on 1st July 2022, the Central Bank have published the Insurance Regulations Q&A which our intermediary clients might find useful to further explain the implications to their business.

As our readers will note, the Regulations, applicable to insurance undertakings and insurance intermediaries, were introduced to benefit consumers and enhance the consumer protection framework. The new requirements impact three key areas:

1. Pricing: A ban of price walking in home and motor insurance markets - from 1st July 2022, insurance providers cannot charge consumers who are on their second or subsequent renewals a premium that is higher than they would have charged a year one consumer renewing their policy.
2. Annual Review of pricing practices and policies: Insurance providers are required to review pricing practices and policies for all customers.
3. Disclosure of additional information to policyholders in relation to automatic renewal arrangements: Insurance providers must notify the customer that the policy will automatically renew if the consumer does not cancel the automatic renewal before a specified date.

The link to the Insurance Q&As can be found here:

Insurance Regulations 2022 - Q+A updated May 2022 (centralbank.ie)

Establishment of the Corporate Enforcement Authority
July 2022

The Corporate Enforcement Authority ("CEA") has been established with effect from 7th July 2022, following the commencement of the Companies (Corporate Enforcement Authority) Act 2021 (the “2021 Act”) on 6th July 2022. 

Compliance Institute of Ireland Survey Results on Third Party Cookie Ban
July 2022

Google has announced it proposes to stop the use of third-party cookies in Chrome by the end of 2023, joining a growing list of browsers ditching the notorious tracking technology.

However, a recent survey from Compliance Institute of 144 compliance professionals within Irish organisations throughout the country, has found that although the oncoming changes from Google around the use of third-party cookie data will have implications for almost 9 in 10 businesses, there’s a widespread lack of awareness, with 74% of respondents saying there’s little to no awareness of the issue within their organisation. (See Compliance Institute press release HERE).

Central Bank highlights weaknesses in Virtual Asset Service Providers’ AML/CFT Frameworks
July 2022

On 11th July 2022, the Central Bank issued a bulletin to VASPs outlining its regulatory expectations and highlighting recurring weaknesses it has observed in VASP registration applications to date and their Anti-Money Laundering and Countering the Financing of Terrorism (‘AML/CFT’) Frameworks.

In the vast majority of applications, the Central Bank noted a lack of understanding and compliance with key AML/CFT obligations, in addition to significant control weaknesses, thereby increasing the risk of criminals using their products or services to launder money or finance terrorism.

The VASP’s AML/CFT risk assessment must focus on specific risks arising from a VASP firm's business model and drive that firm's AML/CFT control framework. Robust controls must be implemented to mitigate and manage the identified risks.

The VASP should maintain a documented suite of AML/CFT policies and procedures, which are supplemented by guidance and accurately reflect operational practices. The policies and procedures should also demonstrate consideration of and compliance with Irish legal and regulatory requirements.

The VASP is required to know their customers, persons purporting to act on behalf of customers and beneficial owners. VASP firms must also have enhanced due diligence procedures for dealing with politically exposed persons (PEPs).

The Central bank expects VASPs to have an effective screening system appropriate to the nature, size and risk of their business. VASP firms must follow clear escalation procedures in the event of a positive match.

Where an Irish registered VASP outsources its AML/CFT functions, a documented agreement (for example, a service level agreement), must clearly define the outsourcing service provider's obligations. The VASP should also maintain evidence of sufficient oversight or be able to provide evidence of assurance testing.

The Central Bank expects a physical presence located in Ireland and for there to be at least one employee in a senior management role located physically in Ireland, to act as the contact person for engagement with the Central Bank.

Individual Questionnaires (IQs) for each proposed PCF role holder to be submitted as soon as practical.

EBA issues guidance on the Role & Responsibilities of the AML Compliance Officer
June 2022

On 14th June 2022 the EBA published guidance on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer.

Frequently we have seen references to a European wide approach to AML/CFT (Anti Money Laundering / Countering the Financing of Terrorism). The aim of these guidelines is to “….create a common understanding, by competent authorities and credit or financial institutions, of credit or financial institutions’ AML/CFT governance arrangements. A common understanding, which is applied consistently and enforced as necessary, is key to strengthening the EU’s AML/CFT defences.”

The guidelines come into effect from 1st December 2022.

They are very comprehensive, running to 54 pages and they examine in detail the following:

• The role of the management body in its supervisory function and management function in the AML/CFT framework.

• Identification of the member of the management body responsible for AML/CFT.

• Identification of a senior manager responsible for AML/CFT where no management body is in place.

• Tasks and role of the member of the management body or senior manager responsible for AML/CFT.

Section 4.2 looks at the role and responsibilities of the AML/CFT compliance officer from their appointment, the skills and experience they should have in addition to the tasks they must complete and includes reference to outsourcing.

Section 5 has a list of additional documents, a summary of the Views of the Banking Stakeholder Group (‘BSG’) and Feedback on the public consultation and on the opinion of the BSG.

While reference is made to credit and financial institutions in the document, it provides useful information and guidance. As many of our readers will be aware, there is a positive obligation on Designated Persons to have a business wide risk assessment in place which covers all the AML/CFT and financial sanctions which their business may be exposed to. Included in the requirement is a specific reference to publications from the ESAs – European Supervisory Authorities. The EBA European Banking authority is one of these.

While we have provided an overview above, the link to the full document is here:

Guidelines on AMLCFT compliance officers.pdf (europa.eu)