Welcome to the FIG Top 5 at 5

The Central Bank of Ireland (“Central Bank”) recently updated its dedicated outsourcing registers section of its website, stating that it will resume the domestic collection of outsourcing registers in February 2027. It is highlighted that domestic collection refers to the Central Bank’s direct collection, excluding European Central Bank collections from significant institutions.

This development comes in the context of the Central Bank’s acknowledgment, in its February 2026 Regulatory and Supervisory Outlook, of the heightened risk posed to the operational resilience of financial services firms due to increased operational complexity, including complex supply chains.

The Central Bank paused its domestic collection of data on the third party outsourcing arrangements of regulated financial service providers (“RFSPs”) in 2025 due to the fact that RFSPs were preparing for the first collection and submission of registers of information (“RoI”) under DORA.

In view of the two year pause and evolving third party risks, the Central Bank considers it important that it updates the data that it holds on the use of outsourcing arrangements, that are not covered in the DORA register.

2027 collection

As set out above, collection will resume in February 2027, subject to the following provisions, aimed at the minimisation of burden for RFSPs:

• early notice as to the resumption of the collection of outsourcing registers – the deadline is 28 February 2027 and the data reference date is 31 December 2026;
• the scope of RSFPs required to submit their outsourcing register in this upcoming collection is limited to those financial service providers which submitted outsourcing registers to the Central Bank in the previous 2024 cycle;
• the same template format, as used in previous collection, will be used; and
• for RFSPs also in scope of the DORA RoI collection, these RFSPs may either leave in, or remove data which has already been submitted as part of the DORA RoI submissions, with the Central Bank highlighting that RFSPs should choose the approach that minimises effort the most. For the avoidance of doubt, the Central Bank has emphasised that it is not seeking to collect DORA RoI information twice.

Next Steps

The Central Bank has stated that it will be in contact with RFSPs, that are in scope of this data collection exercise, in Q4 2026 with further details.

On 1 September 2026, the Central Bank of Ireland (“Central Bank”) published the results (“Results”) of a recently completed, desk-based, thematic assessment (“Assessment”) of key aspects of the fitness and probity (“F&P”) regime in the MiFID investment firm sector.  The Assessment included a focus on steps that firms have taken as regards embedding the Individual Accountability Framework (“IAF”) into governance frameworks.

The Results set out the Assessment’s key findings and reminds firms of the relevant guidance. The Results also highlight the Central Bank’s expectations when it comes to the operating effectiveness of F&P frameworks and emphasise the importance of effective embedding of the IAF / the Senior Executive Accountability Regime (“SEAR”), within firms’ governance frameworks.

In carrying out the Assessment, the Central Bank sought to evaluate approaches taken by firms as regards:

• policies and procedures regarding the F&P regime, including amendments made following the introduction of the IAF and SEAR, where relevant;
• due diligence and annual certification documentation to ensure the ongoing fitness and probity of individuals appointed to controlled function (“CF”) or pre-approval controlled function (“PCF”) roles;
• measures undertaken after introduction of the IAF – this included a review of statements of responsibilities (“SOR”) and management responsibility maps (“MRM”); and
• records held as regards the Minimum Competency Code (“MCC”) in terms of staff satisfying relevant requirements.

Good practices

Some of the good practices identified by the Assessment, across the areas assessed, are as follows:

• many firms assessed had policies and procedures in place that were sufficiently detailed and for a number of firms it was clear these actually were implemented in practice, ensuring that CF and PCF role holders remain suitable for their PCF / CF role;
• firms demonstrating that they had considered the outputs of the annual certification process and issuing PCF role holders with a certificate indicating that the firm is satisfied the individual complies with the F&P standards;
• an annual review of continuous professional development records;
• as regards the IAF, it was found that most firms have taken effective steps to embed the IAF via updating policies and procedures and providing training to staff. Additionally, some firms have developed a “reasonable steps framework”, aimed at assisting employees as regards understanding their roles and responsibilities. It was also found that, in some firms, the compliance function confirms, quarterly, that the MRM is up to date;
• for firms in scope of SEAR, it was found that most firms had a good standard of MRMs and SORs; and
• the Results highlight that there were no significant adverse findings as regards demonstration of compliance with requirements under the MCC.

Deficiencies

Some of deficiencies highlighted by the Results, across the areas assessed, include:

• as regards due diligence, some firms were unable to provide sufficient evidence of due diligence completed at the time of on-boarding a PCF role holder and / or for the annual certification process. The Results highlight that, for these firms, it was evident that their policies and procedures did not provide sufficient detail on how the firm would meet their obligation to satisfy themselves that a CF or PCF role holder meets the F&P standards. Some common gaps that were identified are as follows:
  • failure to obtain a signed copy of the PCF role holder’s agreement to comply with the F&P standards;
  • lack of evidence of self-certification of potential conflicts of interests; and
  • failure to provide documents evidencing the firm’s assessment of the individuals’ competence and capability, for example, by way of interview notes.
• in terms of the IAF, it was found that some firms have more work to do to reach the expected level of maturity when it comes to embedding of the framework, in that the IAF was not adequately reflected in their policies and procedures. Specifically, it was found that policy documents lacked specific details regarding how the firms tailored their approach to the IAF or the actions firms had taken to embed the IAF framework;
• regarding SEAR requirements, key information was missing from some MRMs, such as the omission of ‘inherent’ or ‘other’ responsibilities. In some cases, there was an absence of clear reporting lines to management and / or committees of the board; and
• as regards SORs, the Results highlight one instance where there were shared responsibilities across two PCF role holders, which were not aligned with the limited permitted circumstances set out in the IAF guidance.

Next steps for firms

All firms that were in scope of the Assessment have already received firm-specific feedback from the Central Bank, including actions for them to take to address any deficiencies identified. However, the Results set out the areas that all MiFID investment firms should prioritise for review, as follows:

• as regards policies and procedures, the Results state that F&P policies should be reviewed and updated to make sure they are sufficiently detailed and current. Firms are advised to ensure that the F&P polices are implemented in practice and that they reflect how the IAF applies to the firm’s specific business model;
• in terms of due diligence and annual certification, it is advised that relevant processes are strengthened to make sure that there is comprehensive documentation and evidence retention;
• regarding the IAF, the Results highlight that there must be full embedding of the IAF in firms’ governance frameworks, including clear documentation as to how the framework applies to the firm’s specific business model. Training should be provided to relevant staff; and
• as regards SEAR, firms are required to verify that all prescribed responsibilities are allocated to individual PCF role holders. The potential need for “other responsibilities” to be defined and allocated should be examined and actioned if necessary. Firms should also make sure that MRMs and SORs are current and comprehensive.

Engagement

It is highlighted, by the Central Bank, that any firms requiring clarification as to any of the findings or details contained in the Results should engage with their supervisors.

On 24 August 2026, the Insurance (Disregard of Certain Medical History and Miscellaneous Provisions) Act 2026 (Commencement) Order 2026 (“Order”) was signed by Tánaiste and Minister for Finance, Mr Simon Harris.

The Insurance (Disregard of Certain Medical History and Miscellaneous Provisions) Act 2026 (“Act”) was signed into law by the President on 15 July 2026 – for more information on the Act, see FIG Top 5 at 5 dated 26 March 2026.

The Order sets out that parts 1 and 3 of the Act came into operation on 26 August 2026. Part 1 of the Act deals, amongst other matters, with definitions, while part 3 addresses the amendment of the Insurance Act 1936 and the Insurance Act 1964.

Additionally, the Order provides that part 2 of the Act, which deal with the disregard of certain medical  history, shall come into operation on 15 October 2026.

On 26 August 2026, the European Banking Authority (“EBA”) published a consultation (“Consultation”) on draft regulatory technical standards (“RTS”) on a harmonised minimum framework for the management of operational risk across institutions in the EU.

Article 323(1) of regulation (EU) 575/2013 (“CRR”), as amended by CRR III, requires institutions to have sound arrangements for the management of operational risk. The EBA is required to develop draft RTS, setting out such arrangements, under article 323(2) CRR, and in so doing, must take the size and complexity of the institution into account.

The draft RTS build on the revised prudential framework for operational risk under CRR, the Basel Committee’s Principles for the Sound Management of Operational Risk, the EBA Guidelines on internal governance, and the framework on digital operational resilience established by DORA.

The proposed harmonised framework set out in the RTS consists of three overarching components, which are intended to be mutually reinforcing, operating as an integrated whole within an institution’s boarder governance, risk management and operational resilience requirements. Those components are as follows:

• governance – this includes the responsibilities of the management body, the senior management, and the internal control functions, including the operational risk management function;
• the operational risk management process – this refers to the policies and procedures used to identify, assess, monitor, control, mitigate and report operational risk. The Consultation highlights that operational risk management should not be treated as a stand-alone compliance exercise, rather, it should be integrated into ordinary management processes and should inform decisions concerning strategy, organisation, processes, systems, controls, third-party services and remediation measures; and
• the operational risk assessment system – this includes the methods, data, taxonomy, indicators, and analyses that support the assessment of the institution’s operational risk profile. The Consultation highlights that institutions should be able to identify and classify operational risk events consistently, distinguish relevant events from immaterial ones, analyse drivers and root causes, aggregate information across business lines and legal entities, and understand how operational risk exposures evolve over time.

DORA

In the interests of coherence and the avoidance of duplication, the draft RTS require institutions to integrate ICT risk management into the broader risk management framework by allowing them to rely on policies, procedures, processes and controls already established under DORA.

Proportionality

The Consultation highlights the importance of proportionality in relation to the draft RTS to ensure their effectiveness, given the wide range of institutions subject to CRR.

The Consultation states that the draft RTS are applicable to all institutions, but as mentioned above, the size and complexity of the business model are considered via the following provisions:

• the frequency of the effectiveness review;
• the expression of the operational risk appetite;
• the extent of the data collected;
• the alignment of the operational risk taxonomy; and
• the reporting frequency to the management body.

The draft RTS also provide that institutions with a business indicator below €750 million are not required to collect the extended data set or report more often than annually.

Next Steps

The Consultation is open for feedback until 31 December 2026. The EBA will hold a virtual public hearing on 29 September 2026 – interested parties can register here.

On 1 September 2026, the European Insurance and Occupational Pensions Authority (“EIOPA”) published its technical advice (“Advice”) to the European Commission (“Commission”) on minimum common standards for insurance guarantee schemes (“IGS”) in the EU.

Call for advice

The Advice comes on foot of a call for advice from the Commission in August 2025 regarding an assessment of the appropriateness of minimum common standards for IGS in the EU under article 98 of the Insurance Recovery and Resolution Directive (“IRRD”) – for more information, see FIG Top 5 at 5 dated 16 October 2025.

The Commission is required to submit a report to the European Parliament and the Council assessing the appropriateness of minimum common standards for IGS in the EU, following consultation with EIOPA, by January 2027.

Consultation

EIOPA consulted on a draft version of the Advice in May 2026 – for more information on the consultation and the content of the Advice, see FIG Top 5 at 5 dated 7 May 2026.

Approach and implementation

EIOPA is of the view that the approach taken in the Advice is balanced, proportionate and effective. Additionally, EIOPA maintains that the Advice is consistent with regulatory simplification and burden reduction. Implementation of the Advice, EIOPA explains, would strengthen policyholders’ protection across the EU, support the single market and the savings and investment union and ensure operational readiness under the IRRD framework.

Some of the matters highlighted in the Advice are as follows:

• as regards eligible insurance policies, the Advice recommends targeted harmonisation of the scope of policies to be covered by IGS, with a focus on those life and non-life products that could cause the greatest financial hardship for policyholders if there was a failure. EIOPA has stated that the Advice also takes account of situations where cross border business is more prevalent and where harmonisation could support the single market;
• when it comes to operational matters, the Advice advocates for the harmonisation of trigger factors for activation of an IGS – aimed at simplifying frameworks. The introduction of a common timeframe for submitting claims and a maximum time limit for payouts to policyholders is also proposed, while allowing member states the option to define a shorter payout period; and
• in terms of funding arrangements, the Advice recommends minimum requirements for the establishment of adequate liquidity safeguards for IGS, also preserving sufficient flexibility for member states to choose the most suitable form and scale of funding based on national specificities.

Next Steps

The Advice, EIOPA explains, is a preliminary step before the legislative proposal, the development of which is in the mandate of the Commission.