Welcome to the FIG Top 5 at 5

On 30 July 2026, the Central Bank of Ireland (“Central Bank”) published supplemental guidance (the “Supplemental Guidance”) on prohibition notices under the fitness and probity regime (“F&P regime”) together with a related feedback statement (the “Feedback Statement”) on prohibition notices under the fitness and probity regime.

The Central Bank consulted on the matter in January 2026 – for more information, see FIG Top 5 at 5 dated 29 January 2026.

Under the F&P regime, the Central Bank may impose a prohibition on an individual where they do not meet the required standards of fitness and probity.

The Supplemental Guidance

The Supplemental Guidance, effective 30 July 2026, is intended to provide advice on the circumstances and general principles relevant to each of the following:

• the imposition of a prohibition under the Central Bank Reform Act 2010 (the “Act”);
• requests by prohibited persons to the Central Bank for the termination of a prohibition agreement;
• the cessation of a prohibition notice; and
• the publication of a prohibition notice.

The Supplemental Guidance supplements the ‘Decision’ chapter of its Guidance on Fitness and Probity Investigations, Suspensions and Prohibitions (the “Main Guidance”), which is currently under review.

The Supplemental Guidance should be read in conjunction with the Main Guidance and will eventually be subsumed into the Main Guidance.

Some of the matters covered in the Supplemental Guidance include:

Prohibition Decision Maker

The Supplemental Guidance outlines that the prohibition decision maker is a suitably qualified individual (the “Prohibition Decision Maker”) from a Regulatory Decisions Panel (the “Panel”) comprising externally recruited experts and Central Bank staff. The Prohibition Decision Maker is appointed to decide on a prohibition where an investigation has been completed and a report has been prepared; and where facts are undisputed.

When considering whether to impose a prohibition the Prohibition Decision Maker takes into account factors including the need to prevent potential serious damage to the financial system in the State and ensure the continued stability of that system, and the need to protect users of financial services.

The Prohibition Decision Maker may only impose a prohibition where, in addition to certain other requirements:

• the subject and relevant entities have access to any material taken into account by the Prohibition Decision Maker for the purpose of ensuring that the proposed prohibition is consistent and proportionate;
• the subject and relevant entities have been afforded such a hearing in relation to the proposed decision as is necessary to do justice in the circumstances; and
• the Prohibition Decision Maker is satisfied that the imposition of the prohibition is necessary in the circumstances.

Relevant Circumstances Guidance

In addition to certain statutory objectives, the Prohibition Decision Maker shall consider the Relevant Circumstances Guidance by reference to the unique circumstances of each case. A non-exhaustive list of relevant circumstances are set out in the Supplemental Guidance and include:

• the extent to which the subject is not of such fitness and probity as is appropriate to perform the relevant Controlled Function (“CF”), a specified part of a CF, or any CF;
• the degree of risk posed to the achievement of the Section 43(4) objectives;
• the previous supervisory, disciplinary, criminal and compliance record of the subject;
• the length of time that has elapsed since the occurrence of any matters indicating a lack of appropriate fitness and probity;
• the subject’s behaviour since the occurrence of any matters indicating a lack of appropriate fitness and probity;
• whether the subject has shown an understanding of any matters indicating a lack of appropriate fitness or probity; and
• the personal circumstances of the subject.

Nature of prohibitions

The Supplemental Guidance outlines that a prohibition will vary by reference to its scope, duration and the specification of conditions. When determining the nature of a prohibition the Prohibition Decision Maker shall have regard to the statutory objectives, the relevant circumstances of the case and their duty to act proportionately. Subject to proportionality requirements the higher the degree of risk posed to the statutory objectives the more serious the nature of the prohibition will be.

Cessation of a prohibition notice

A prohibition notice will cease to have effect where a prohibition agreement is terminated by the Central Bank; a confirmed prohibition notice is subsequently revoked or varied by the High Court; or the period specified in the prohibition notice expires.

Where an individual seeks to perform the relevant CF again, they will need to satisfy the relevant entity as to their fitness and probity to do so. Individuals wishing to perform a Pre-Approval Controlled Function (“PCF”) must apply to the Central Bank for pre-approval to perform the PCF role.

Publication of a prohibition notice

The Governor of the Central Bank may publish a prohibition notice where such publication is necessary to achieve the purposes of Part 3 of the Act and reduce the chances that an individual may circumvent their prohibition, inform financial service users and relevant entities, and to prevent potential serious damage to the financial system.

In such circumstances the individual and firm will be notified. Submissions will be invited on the matter before a decision is made. Such submissions may include details of personal circumstances and privacy considerations.

The Feedback Statement

The Feedback Statement contains three consultation questions, the general feedback to each and the Central Bank’s response to this feedback.

The Central Bank received eight submissions: six from industry/representative bodies and two from professional individuals. These submissions were published on the Central Bank’s consultation webpage.

In July 2026, the Central Bank of Ireland (“Central Bank“) published the second edition of its Payments and E-Money Newsletter (“Newsletter“).

The Newsletter builds on the Central Bank’s Regulatory and Supervisory Outlook Report published in February 2026, sharing feedback from recent supervisory work and highlighting important upcoming requirements – for more information please see FIG Top 5 at 5 dated 5 March 2026.

The Newsletter also provides information on the Central Bank’s expectations in certain areas, and includes a spotlight piece on the changing AML/CFT supervisory framework.

Some of the matters covered in this edition include:

E-money definition

Further to its December 2005 communication to firms, the Central Bank has highlighted that it will intensify its engagement with industry in the coming months in respect of EBA Q&A 6336. The Central Bank has urged firms to prioritise their assessment of the impact of this Q&A on their business models.

Consumer protection code update

The Newsletter highlights that the Consumer Protection Code 2025 (“Code“) is applicable to firms within the payments and e-money sector. The Code took effect on 24 March 2026, following a 12-month implementation period.  Regulation 9 of the Code sets out the specific provisions of the Code that apply to firms providing payment services or issuing electronic money.

The Newsletter notes that

• There are instances whereby a firm within the sector that provides services to businesses may have business customers that are consumers, as per the Code’s definition, and are therefore subject to the Code.
• The Standards for Business Regulations apply to all firms (including those with B2B, B2C and B2B2C business models), requiring firms to secure their customers’ interests, to inform them effectively, and to counter the risks of financial abuse.
• The Central Bank expects to publish the findings from its 2025 / 2026 cross-sectoral thematic review of customer experience , with a focus on handling customer complaints, before the end of 2026.

The Newsletter also flagged in advance a Central Bank webinar on 29 July 2026 for regulated firms on “Informing Effectively” under the Code. For further information, please see the Central Bank website here.

Material changes of business model

The Newsletter reminds firms that the European Communities (Electronic Money) Regulations 2011 (“EMR”) and European Union (Payment Services) Regulation (“PSR”) require firms to notify the Central Bank, in advance, of any proposed material changes to its business model, and may not proceed with such changes unless and until it receives approval.

The Newsletter acknowledges early engagement by a number of firms on planned material changes to their business models, but notes that the Central Bank has experienced significant inconsistency in engagement by firms with respect to material changes.

The Newsletter sets out a number of the Central Bank’s observations as regards notifications of material change:

• The Central Bank continues to see evidence of firms’ strategic ambitions outpacing their internal control environment frameworks and capacity.
• Firms are not fully considering the entire suite of financial and non-financial risks arising from their ambitions, including new and emerging risks.
• Since the legislation does not specifically define the materiality criteria that warrants a material change notification, it is a responsibility of the board of each firm to clearly articulate its firm-specific approach to materiality. This should be clearly documented in a board-approved policy that is regularly reviewed.
• Examples of a material change to a firm’s business model may include, but are not limited to: a substantive change to its service or product offering; a material change to the way in which service or product offerings are provided, such as the introduction of agent, distributor or branch networks; business projections significantly in excess of those outlined at authorisation; changes to the firm’s overall risk profile; and changes to the firm’s target market or customer profile.
• The Central Bank expects that a notification of a material change is accompanied by a detailed board-signed-off risk assessment, addressing at a minimum the effect of the proposed change on the firm’s safeguarding risk, AML/CFT risk, operational and IT risk, and consumer risk. The assessment must provide evidence that the internal governance, risk management and control framework, including the availability of financial and operational resources, supports the material change.

Authorisation update

The Newsletter mentions that a growing feature in recent times has been the increase in the number of firms seeking multiple licences within a single legal entity, encompassing Payment Institutions, E-Money Institutions, Crypto Asset Service Providers and MiFID firms.

The Newsletter notes that,  to address the challenges arising from multi-licence applications, the Central Bank has implemented an approach based on four key principles:

• cross-team coordination (through designated single points of contact and ongoing sharing of information between authorisation teams);
• holistic assessment (using single Key Facts Documents addressing multiple regulatory requirements simultaneously);
• reliance on previous assessments (placing considerable reliance on prior authorisation assessments where information remains current and accurate); and
• proportionate burden reduction (requesting attestations from firms in lieu of resubmission and minimising duplication of documentation requests).

AMLA and the EU AML/CFT Single Rulebook

The Newsletter provides a spotlight piece on the EU AML Package, published in the Official Journal of the European Union in June 2024.

The Newsletter emphasises that significant work is required now for obliged entities to make effective preparations, encouraging firms to familiarise themselves with the AML Regulation (“AMLR“) and to regularly check the EU Anti-Money Laundering Authority’s (“AMLA”) public consultations and hearings to avail of the opportunity to influence the development of regulatory technical standards, implementing standards and guidelines.

New AML/CFT Risk Evaluation Questionnaires

The Newsletter provides an update on the Central Bank’s rollout of new sector-specific enhanced Risk Evaluation Questionnaires (“REQs“) to the Payments and E-Money sector, which are being used to assess risk using the AMLA-mandated methodology, inform supervisory strategy and decision-making at firm and sector level, and assist in identifying emerging and thematic trends.

In 2026, the Central Bank is staggering submission dates for sectors submitting REQs. The first submissions of Payments and E-Money Institutions REQs, relating to 2024 data, were received in February 2026. The deadline for the second REQ submission, relating to 2025 data, is 9 September 2026.

From 2027 onwards, the Central Bank will standardise submission dates to align with AMLA reporting requirements, with REQs relating to 2026 data due in March 2027, and from 2028 onwards an annual submission in March based on the preceding calendar year’s data.

Key dates

The Newsletter sets out a Regulatory Returns Calendar for H2 2026, with key dates including:

• Quarterly returns due 31 July 2026;
• Accounts and Supplementary returns due 31 October 2026 (for firms with a 31 December year-end);
• Annual Audited Accounts due six months after the financial year end; and the AML REQ Return (2025 data) due 9 September 2026.

Payments and E-Money industry seminar

The Newsletter also reminds firms that the Central Bank is hosting a Payments and E-Money industry seminar on 21 October 2026 at its North Wall Quay office. Agenda details and invitations are to follow.

In July 2026, the Central Bank of Ireland (“Central Bank“) published the second edition of its Financial Crime Bulletin (the “Bulletin“).

The Bulletin provides an update on key regulatory developments in the areas of anti-money laundering (“AML“), combatting the financing of terrorism (“CFT“), financial sanctions (“FS“), fraud and market abuse.

The Bulletin highlights that financial crime continues to be an area of focus in policy, regulatory and law enforcement spheres in Ireland and Europe, with financial crime risks and priorities having been identified in the National Risk Assessment (“NRA“), which was updated by the Department of Finance in June 2026, alongside the Central Bank’s Regulatory & Supervisory Outlook Report 2026 – for more information please see FIG Top 5 at 5 dated 5 March 2026.

Some of the areas covered in the Bulletin are as follows:

National Risk Assessment and Priority Actions Implementation Plan

The NRA is Ireland’s third comprehensive analysis of money laundering (“ML“) and terrorist financing (“TF“) risks, and its first formal assessment of proliferation financing (“PF“) risk. Together with the NRA, a new Priority Actions Implementation Plan has been published by the Department of Finance, with the aim of strengthening the State’s response to financial crime.

Key NRA findings include:

• Ireland’s overall ML threat is rated as Moderate, with the highest risks generated by drug offences and fraud, whilst TF and PF threats are assessed as Low. Criminal networks are increasingly combining traditional cash-based methods with digital innovations, including use of crypto-assets and money mule networks.
• The NRA assesses fraud as a significant predicate offence for ML, with payment fraud reported by Irish payment service providers rising from €102 million in 2022 to €160 million in 2024, whilst fraudulent transactions more than doubled to 815,000. Investment fraud has surged dramatically, with reported losses exceeding €25 million in 2023, representing a four-fold increase in incidents since 2019. Notably, 44% of investment fraud reports reference cryptocurrency.
• Traditional retail banks, digital banks, e-money institutions, payment institutions and crypto-asset service providers (“CASPs“) are all rated as Very Significant for ML and TF risks.

Sector-specific supervisory priorities

Banking: Newer entrants must continue to build and strengthen their frameworks, boards and senior management must demonstrate understanding of key ML and TF risks, and banks must do more to strengthen fraud controls and provide appropriate support to affected customers.

Payment and e-money: Much deeper work is required across the sector, with AI-driven social engineering becoming a primary threat.

Investment funds: The Central Bank is currently undertaking a thematic review of suspicious transaction report (“STR“) reporting in this sector.

Crypto assets: AML/CFT remains a key supervisory focus due to the opaque and rapidly evolving nature of market structures, fast onboarding, complex cross-border flows and fragmented transaction monitoring.

Key supervisory expectations

The Bulletin also sets out the Central Bank’s key supervisory expectations of firms, including that firms should: understand their specific risks; invest in and enhance controls, recognising that systems and models rely on good quality data and appropriate calibration; where systems failures occur, handle and report promptly; report suspicious activity promptly and effectively; and embrace technology with care, managing the risks to consumers, investors and to the firm itself.

AML data collection update

The enhanced sector-specific Risk Evaluation Questionnaire (“REQ“) serves three key purposes: meeting European AML/CFT requirements; informing supervisory strategy and decision-making; and identifying emerging and thematic trends. Each REQ will be published on the Central Bank’s website, with firms contacted individually regarding their submission obligations.

REQs have already been published for credit institutions; payment institutions and electronic money institutions; investment firms; CASPs; life insurance companies; and credit unions, with further REQs to be rolled out in H2 2026.

In 2026, the Central Bank is staggering submission dates, with REQs relating to 2026 data due in March 2027, and from 2028 onwards, an annual submission in March based on the preceding calendar year’s data.

AMLA developments

In February 2026, AMLA published its Single Programming Document for 2026 to 2028, aligning with its strategic objectives across three core deliverables: completing the Single Rulebook; advancing supervisory convergence; and strengthening cooperation among Financial Intelligence Units (“FIUs“) – for more information please see FIG Top 5 at 5 dated 5 February 2026.

The Bulletin emphasises that it is critical that firms remain alert to, and engage with, AMLA’s public consultations on draft regulatory technical standards, implementing standards and guidelines.

Tackling fraud and scams

The Bulletin highlights a significant increase in the frequency and complexity of financial scams and frauds targeting consumers, due to the rapid development and adoption of digital financial products, services and distribution channels.

Central Bank Deputy Governor for Consumer and Investor Protection, Colm Kincaid, emphasised that comprehensive action is needed from all actors in the system, including the Central Bank, ensuring key insights inform its regulatory and supervisory responses and regulated firms continuing to enhance their safeguards against fraud.

The Central Bank is currently carrying out a thematic review of authorised push payment (“APP“) fraud in the banking and payment sectors, on foot of which it expects to issue updated supervisory expectations for firms. The Bulletin also highlights an increase in fraud loss recovery scams, whereby fraudsters contact victims of fraud claiming they can help recover lost funds for an upfront fee, with the real objective of stealing more of the victims’ money.

EU financial sanctions and trusts

The Bulletin highlights three landmark judgments delivered by the European Court of Justice on 21 May 2026, clarifying how EU asset-freeze sanctions apply to assets held in trust structures. The Court established that EU sanctions extend to trust assets if a sanctioned individual exercises substantive control or influence over them, rather than merely holding formal legal title.

Reporting market misconduct

The Bulletin addresses market abuse as a category of financial crime that undermines the integrity, transparency and fairness of financial markets, noting that Suspicious Transaction and Order Reports (“STORs“) are critical intelligence tools, with the majority of live enforcement investigations having begun life with a STOR. The Central Bank is currently conducting a thematic assessment of market abuse frameworks in a cross-section of firms, the findings of which will provide insight on where firms and the Central Bank can do more.

1. ESAs call for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI models in the EU financial sector

On 31 July 2026, the European Supervisory Authorities (EBA, EIOPA and ESMA – the “ESAs”) published a statement calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigate the ICT risks stemming from frontier AI models.

The statement takes into account existing regulatory requirements, the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, as well as recent publications by the European Systemic Risk Board (“ESRB”), the European Union Agency for Cybersecurity (“ENISA”), the Single Supervisory Mechanism (“SSM”) and other competent authorities.

The ESAs outline measures to help financial entities strengthen their operational resilience against cyber risks linked to frontier AI models emphasising the prevention, detection and management of these risks.

The statement underlines that financial entities should have robust governance and risk management frameworks in place to support the effective management and mitigation of cyber risks associated with frontier AI models. It also updates on ongoing and planned DORA oversight activities for critical ICT third-party providers (“CTPPs”) to address this risk.

The ESAs encourage both financial entities and competent authorities to use the statement as a basis for supervisory dialogue, taking into account existing supervisory expectations. Such an approach would help ensuring that the EU financial system remains resilient against the risks driven by frontier AI technologies.

2. EBA-ECB-EIOPA “Data Point Model Alliance” consults on improvements to their data dictionary metamodel to better support statistical and supervisory reporting

The Data Point Model Alliance, a joint initiative of the  EBA, ECB and EIOPA, is committed  to making financial sector statistical  and supervisory reporting across the EU simpler, smarter and more proportionate. To facilitate the integration of reporting, on 31 July 2026, these European institutions launched, by way of press release, a public consultation on enhancements to their DPM metamodel. They also published naming conventions for a consistent approach to metadata.

Documents include:

• Factsheet on DPM standard 2.1
• Naming conventions Guidelines for naming metadata used in reporting.

Next steps

The deadline for submitting comments is 30 September 2026.

3. ESAs propose amendments to bilateral margin requirements

On 3 August 2026, the European Supervisory Authorities (EBA, EIOPA and ESMA – the “ESAs”) published a final report on draft Regulatory Technical Standards (“RTS”), proposing to simplify the bilateral margin requirements of the European Commission’s Delegated Regulation (EU) 2016/2251.

The proposed amendments aim to simplify the bilateral margin framework for counterparties that are subject to initial margin requirements and that are below the €8 billion threshold for exchanging initial margin foreseen by the European Market Infrastructure Regulation (“EMIR”).

The changes are intended to facilitate the phase-out of initial margin requirements for these counterparties and support greater consistency with the treatment applied in other jurisdictions.

Next steps

The final report has been submitted to the European Commission together with the draft RTS for endorsement. Following the Commission’s review and adoption process, the RTS will be subject to scrutiny by the European Parliament and the Council before being published in the Official Journal of the European Union.

4. EBA publishes no-action letter and technical considerations on implementing EU bank market risk framework

On 3 August 2026, the ​ European Banking Authority (EBA) announced by way of press release, a no-action letter on the boundary between the banking book and the trading book and shared technical clarifications on issues linked to the European Commission’s Delegated Act modifying the calculation of own funds requirements for market risk based on the Fundamental Review of the Trading Book (FRTB) framework.

​The European Commission’s Delegated Act is currently under scrutiny by the European Parliament and Council. The EBA’s no-action letter and technical considerations will become relevant once the Delegated Act enters into force.

​In its no-action letter, the EBA recommends that competent authorities do not prioritise supervisory or enforcement action in relation to the provisions of the FRTB framework governing the boundary between the banking book and the trading book and internal risk transfers between these books, as well as certain related reporting requirements.

​​To support a consistent application of the revised framework, the EBA is also providing technical considerations on material implementation issues for the application of the market risk framework as modified by the Delegated Act.

​The EBA also clarifies the treatment of institutions for the purposes of the supervisory benchmarking exercise.​

Documents include:

• No action letter on the boundary between trading book and banking book, and on the internal risk transfer between books
• EBA considerations on the application of the FRTB from 1 January 2027.

5. EBA consults on reporting framework for validation and monitoring of ISDA Standard Initial Margin Model

On 5 August 2026, the European Banking Authority (“EBA”) launched a consultation on a new reporting framework to support the validation and ongoing monitoring of initial margin models based on the ‘Standard Initial Margin Model’ (“SIMM”) developed by the International Swaps and Derivatives Association (“ISDA”).  The proposed reporting requirements will provide the EBA with information necessary to effectively perform its role as central validator of pro forma models under EMIR, while ensuring a proportionate approach for reporting entities.

Documents which can be found on the EBA website include:

• Consultation paper on Reporting for the purposes of the validation and monitoring of ISDA SIMM
• IMMV reporting – Instructions
• IMMV reporting – Templates.

1. EIOPA insurance risk dashboard shows broadly stable risk environment even as cyber and geopolitical risk intensify

On 30 July 2026, EIOPA published its July 2026 Insurance Risk Dashboard (the “Dashboard”).

The main findings in the Dashboard show that although risks in the European insurance sector remain stable at a medium level, the outlook is worsening as recent geopolitical tensions pile downside risks on already weakened growth and higher inflation expectations. Some other observations include:

Insurers’ portfolio of high-quality assets and broadly unchanged fundamentals keep credit risks steady, although financing costs and private credit vulnerabilities warrant monitoring.

Market risks moderated through end-June, but renewed geopolitical tensions and commodity market volatility have darkened the outlook, while concerns about elevated valuations and the potential for a broader market correction persist.

Strong premium growth supports a medium assessment for insurance risks, despite some deterioration in loss ratios and uncertainty around war- and trade-related coverages.

Digitalisation and cyber risks are reported to have increased to a high level, reflecting frontier AI developments, geopolitical tensions and elevated cyber underwriting exposures.

EIOPA’s announcement and summary of the Dashboard is available here and the full Dashboard can be found here.

2.  EIOPA’s risk dashboard for occupational pension funds highlights persistent market risks amid geopolitically complex environment

On 30 July 2026, EIOPA published its July 2026 Risk Dashboard for institutions for occupational retirement provision (the “IORPs Dashboard”),

The main findings in the IORPs Dashboard show that persistent geopolitical uncertainty and evolving global market conditions continue to shape the risk landscape for the European occupational pensions sector, with market risks remaining a key concern.

In early July, heightened geopolitical risks weighed on confidence and economic activity, while also putting upward pressure on inflation through higher energy and transport costs.

Debt financing costs and private credit quality should be closely monitored, as higher borrowing costs could increase default risk for highly leveraged entities, while publicly observed credit spreads may not fully capture emerging risks in private credit markets.

Looking ahead, the 12-month risk outlook is worsening amid concerns over a potential broader market correction, elevated valuations and a possible reassessment of risk premia linked to renewed geopolitical tensions.

Digitalisation and cyber risks show a worsening outlook, with supervisors assessing that the materiality of these risks for IORPs is rising, reflecting both persistent geopolitical uncertainty and growing systemic cyber risks associated with frontier AI models.

Despite adverse macroeconomic and geopolitical developments, Europe’s IORP sector remains resilient, supported by robust financial position for Defined Benefit (DB) schemes, and positive portfolio performance.

EIOPA’s announcement and summary of the Dashboard is available here and the full Dashboard can be found here.