Welcome to the FIG Top 5 at 5

1. Director of Policy and International at Central Bank delivers speech on the era of on-chain finance

 

On 22 October 2026, Director of Policy and International at the Central Bank of Ireland (“Central Bank”), Mícheál O’Keeffe, delivered a speech (“Speech”) at the Blockchain Ireland Summit 2026 hosted by Blockchain Ireland and TEDx Dublin.

The Speech focused on the opportunities and challenges presented by distributed ledger technology (“DLT“), tokenisation and the development of on-chain finance, with particular emphasis on the importance of maintaining trust, financial stability and consumer protection as financial services evolve. Mr O’Keeffe outlined the Central Bank’s position on tokenisation, discussed feedback received through its recent discussion paper on DLT and tokenisation, and highlighted ongoing Eurosystem initiatives and the Central Bank’s engagement with financial innovation.

Central Bank money and the development of on-chain finance

Mr. O’Keeffe emphasised that the potential benefits of tokenisation, including faster settlement, fractional ownership of assets and automated compliance processes, depend on the availability of safe settlement assets and appropriate safeguards. He noted that central bank money provides an essential foundation of trust and stability within the financial system and that access to central bank money as a settlement asset will be important in enabling tokenised financial transactions to operate at scale.

In this regard, he highlighted two Eurosystem initiatives: Pontes, which will provide a near-term solution for settling tokenised transactions in central bank money, and Appia, a longer-term initiative aimed at shaping an integrated European tokenised financial ecosystem. Mr. O’Keeffe stressed the importance of interoperability between platforms and warned that the development of disconnected systems could increase fragmentation within financial markets and undermine the potential benefits of tokenisation.

He also referenced Central Bank research indicating that consumers prioritise security, reliability and protection against fraud over payment speed and cost. He emphasised that firms developing tokenised financial products should reflect these priorities in their design.

DLT and tokenisation – industry feedback

Mr. O’Keeffe discussed the Central Bank’s March 2026 discussion paper on DLT and tokenisation in financial services, which examined the opportunities, risks and enabling conditions associated with the adoption of these technologies across financial markets, investment funds, payments and settlement systems – for more information, see FIG Top 5 at 5 dated 12 March 2026.

He noted that responses to the discussion paper identified several interconnected requirements for the successful development of tokenised finance, including legal certainty, regulatory clarity, interoperability, governance, accountability, risk management and access to central bank money.

In particular, respondents highlighted the need for legal clarity concerning settlement finality, recognition of ownership, enforceability of smart contracts and cross-border recognition of transactions. Mr. O’Keeffe observed that uncertainty regarding the legal status of on-chain registers could require firms to maintain parallel off-chain records, thereby reducing the efficiency gains associated with tokenisation.

He further noted that industry feedback generally favoured adapting and evolving existing regulatory frameworks rather than establishing entirely new regimes, recognising that tokenised and traditional financial services are likely to coexist. The Central Bank intends to continue engaging with industry as its policy thinking in this area develops.

Innovation Hub, Sandbox and emerging technologies

Mr. O’Keeffe highlighted the Central Bank’s continued engagement with financial technology firms through its Innovation Hub and Innovation Sandbox Programme. He noted that engagements with the Innovation Hub increased by 10% in 2025, with further growth anticipated in 2026.

He referenced the Central Bank’s second Innovation Sandbox, which focused on payments innovation and brought together firms working on stablecoin infrastructure, account-to-account payments and financial inclusion. He also confirmed that the Central Bank intends to use its next Sandbox to engage with participating firms on emerging issues relating to artificial intelligence.

By way of illustration, Mr. O’Keeffe highlighted the potential for AI agents to undertake financial transactions autonomously, including holding digital wallets, interpreting smart contracts and settling payments. He emphasised that such developments raise important questions concerning accountability, explainability and consumer protection, which firms will need to address as these technologies develop.

Industry expectations and next steps

Looking ahead, Mr. O’Keeffe identified three priorities for firms developing on-chain financial services. First, firms should prioritise interoperability by ensuring tokenised assets can move and settle across different platforms, including through engagement with initiatives such as Pontes. Second, firms should use trustworthy settlement assets and ensure customers understand the nature of their holdings, their ability to access them and their rights to recover funds. Third, firms should engage with the Central Bank at an early stage of product development, when regulatory and consumer protection considerations can be addressed before launch.

Mr. O’Keeffe confirmed that the Central Bank has further work planned on DLT and tokenisation and expects to publish feedback on responses to its discussion paper in the coming weeks, together with an indication of its next steps.

He concluded by emphasising that the successful development of on-chain finance will depend on an appropriate legal and regulatory framework, continued public-private collaboration and industry efforts to prevent fragmentation while maintaining trust in the financial system.

 

2. Director Domhnall Cullinan delivers speech on building a resilient payment ecosystem and consumer trust

 

On 21 October 2026, Director of Banking and Payments at the Central Bank of Ireland (“Central Bank“), Domhnall Cullinan, delivered a speech (“Speech”) at the Payments and E-Money Industry Seminar. The Speech focuses on the key developments, challenges and risks facing the payments ecosystem with the central themes being trust and consumer interest, resilience through shared responsibility, and innovation tempered by capacity.

Supervisory agenda

The Speech clearly sets out the supervisory agenda for payment institutions (“PIs”) and electronic money institutions (“EMIs”) where growth and innovation must be matched by strong governance, resilience, safeguarding and consumer-focused outcomes. The Speech makes it clear that while innovation remains welcome, PIs and EMIs will be expected to demonstrate that growth is supported by effective governance, resilient safeguards, robust financial crime controls, operational resilience and a consistent focus on the interests of consumers. The Director noted that this is of particular importance as firms in the sector operate across the European Economic Area (“EEA”) within the evolving financial services landscape and as such, a collaborative and cooperative approach with the European Supervisory Authorities is vital.

Trust and consumer interest

The Speech reinforces the idea that financial services are fundamentally built on trust earned through acting in the best interests of the consumers and businesses that one serves. The Director notes that the view of the Central Bank is that the authorisation of PIs and EMIs are regulated entities places a significant conduct responsibility to act in the consumers’ best interests. The Speech highlights that the level of confidence and trust by consumers and businesses in the sector can be damaged by misconduct, by poor controls and by prioritising commercial objectives over principles and customer outcomes. The Speech emphasises that this level of trust is not merely a regulatory burden, it is a foundational duty to act in the interests of consumers upon which the entire financial system rests.

Resilience through shared responsibility

The Speech outlines three essential pillars that resilience in the financial system is built upon

The first of these is a robust and prudent regulatory framework (“First Pillar”). The First Pillar involves both compliance with EU and domestic legislation and requirements. These requirements are introduced to support the delivery by the Central Bank on its safeguarding outcomes. The Speech highlights the Central Bank’s involvement in influencing safeguarding and internal governance requirements in the Third Payment Services Directive and its design of the revised Consumer Protection Code.

The second pillar is risk-based, forward-looking supervision (“Second Pillar”). The Central Bank notes that the Second Pillar comprises of a holistic view of the risk landscape. While the Central Bank uses contextual tools and approaches, they keep the ultimate outcome in mind when carrying out supervisory efforts. The Central Bank will continue to engage with firms to identify and require firms to mitigate emerging risks before they become crises.

The third pillar is the responsibility of firms themselves (“Third Pillar”). The Third Pillar emphasises that the threat landscape is dynamic and regulated entities cannot become complacent about the risks they face. Regulation and supervision does not replace genuine commitment by regulated entities to manage their own risks effectively. The Central Bank stresses that sustained attention, investment, and a culture of continuous improvement is necessary.

Innovation, tempered by capacity

In the Speech, Director Domhnall Cullinan welcomes the benefits that technological innovation brings to the payment sector such as artificial intelligence (“AI”), distributed-ledger technology and advanced automation. However, the Speech cautions firms against pursuing innovation without appropriate security, reliability, trust and fraud safeguards. Innovative technologies can introduced new vulnerabilities to businesses and the financial sector as a whole if they are deployed without adequate understanding of the risks, robust controls and sufficient management capacity. The Central Bank expects boards of firms to take ownership and responsibility for reviewing and contributing to the firm’s strategic ambitions.

Supervisory priorities

The Speech sets out five specific supervisory priorities for the payment sector. These are:

1. safeguarding: the Central Bank expects firms to prioritise safeguarding customer monies;
2. financial crime: the Central Bank notes that the speed and cross-border nature of payment services creates potential opportunities for money laundering, fraud and other financial crimes. The Central Bank expects firms have robust financial crime controls in place;
3. consumer protection: the revised Consumer Protection Code is identified as a core feature of its consumer protection framework. The Central Bank will continue to assess how firms have embedded the principles of the Consumer Protection Code in their culture, risk management processes and decision-making;
4. resilience: the Speech highlights the increasing concerns surrounding cyber risk and the impact of rapid advancements in emerging technology, namely AI systems. The Central Bank expects rigorous governance, clear accountability and an assessment of whether new technologies align with firms’ risk appetite, management capacity and legal and regulatory obligations; and
5. governance and risk management: appropriate governance and effective risk management frameworks remain a foundational and overarching expectation of the Central Bank. The Central Bank expects governance and risk management frameworks to evolve in a proportionate reflection of how the business and operating environment changes.

Conclusion

Director Domhnall Cullinan concluded by emphasising the vital role of the payments sector to the economy and to the public interest and once again placing significant value in trust. The Central Bank will continue to influence the development of robust regulatory frameworks, to supervise firms actively and fairly, and to challenge complacency and misconduct. The Speech stresses that firms need to consistently take their responsibilities seriously and to actively approach innovation and growth with robust and effective governance and risk frameworks.

On 22 October 2026, Deputy Governor of Financial Regulation at the Central Bank of Ireland (“Central Bank”), Mary-Elizabeth McMunn, delivered a speech (“Speech”) at Insurance Ireland. The Speech focused on a stronger Europe and was framed at addressing the question on the minds of policymakers, regulators and industry as Europe looks to respond to the challenges of the financial environment it is operating in. The Deputy Governor also outlined the Central Bank’s ongoing supervisory transformation, regulatory simplification initiatives and work to support the competitiveness of the European insurance sector.

Operational resilience, artificial intelligence and climate-related risks

Deputy Governor McMunn set out the four supervisory priorities for the year focusing on responding in the face of change. The first focuses on maintaining resilience both financially and operational, the second centres around securing consumer interests in a rapidly changing world, the third priority hinges on responding to technological driven transformations, and the fourth priority involves responding to structural transitions such as climate change.

The Speech goes on to discuss how these priorities are interconnected, particularly in the context of technology and climate change. In the current environment of increasing reliance on digital infrastructure, cloud services and third-party providers, the Deputy Governor emphasises the need for operational and cyber resilience from insurers. Managing these rapid technological changes in a digital world is critical to the safety and soundness of firms and their ability to serve customers. The Deputy Governor goes on to note her concern about an insurer’s dependency on a small number of technology providers for services it cannot easily replace. Where this is the case, an insurer needs to know which activities are critical, who provides them and what would do if a provider failed. The Speech highlights the Digital Operational Resilience Act (“DORA”) as an important framework for managing these risks and designates it as a vital tool for navigating the technological risk landscape.

Turning to artificial intelligence (“AI”), the Deputy Governor acknowledged its potential benefits for underwriting, risk assessment, fraud detection and claims processing, while emphasising that boards and senior management remain accountable for its deployment and outcomes. She stressed that insurers must understand the data and models underpinning AI-assisted decisions, maintain appropriate human oversight and monitor outcomes to ensure fair treatment of customers. She also referenced the EU AI Act and its specific requirements for certain high-risk AI systems, including those used for risk assessment and pricing in life and health insurance.

On climate change, Ms. McMunn highlighted increasing catastrophe losses, flood exposure, reinsurance costs and climate-related litigation risks. She noted that Central Bank research in 2024 estimated that approximately one in 20 buildings experienced difficulty accessing flood insurance. She confirmed that the Central Bank is supporting the Department of Finance in assessing options to address this protection gap and will contribute to the Flood Insurance Working Group.

Supervisory transformation and regulatory simplification

The Deputy Governor outlined the Central Bank’s ongoing implementation of its integrated, risk-based and outcomes-focused supervisory approach, which seeks to improve the effectiveness, proportionality and consistency of supervision in addition to what was set out in their annual Regulatory & Supervisory Outlook report – for more information, see FIG Top 5 at 5 dated 5 March 2026.

Ms. McMunn welcomed regulatory simplification initiatives but emphasised that these should improve efficiency without weakening consumer protections or regulatory standards. In particular, she highlighted the revised Solvency II framework, which is due to apply from 30 January 2027 and introduces a more proportionate approach for eligible smaller and non-complex insurers. She confirmed that the Central Bank has offered a voluntary pre-application process for firms seeking to avail of proportionality measures, published frequently asked questions and held industry workshops, with further guidance on formal applications expected in the final quarter of 2026.

She also confirmed that the Central Bank is reviewing more than 25 domestic insurance regulatory instruments, with a view to amending, consolidating or removing requirements where appropriate to reduce duplication and streamline processes. This includes removing the existing requirement for pre-emptive recovery plans following implementation of the Insurance Recovery and Resolution Directive in January 2027, under which recovery planning requirements will apply to a smaller number of firms representing approximately 60% of the market.

Competitiveness, accountability and international cooperation

Ms. McMunn emphasised that effective regulation and supervision support competitiveness by maintaining confidence, financial stability and trust in the insurance sector. She noted that Ireland has the fourth-largest life and non-life insurance sector in the EU, with more than 170 authorised insurance and reinsurance firms, many of which operate internationally.

The Deputy Governor stressed that boards and senior management of Irish-authorised insurers must understand the risks associated with their cross-border activities and ensure that firms can meet their obligations to policyholders across the jurisdictions in which they operate. She also highlighted the Central Bank’s cooperation with the European Insurance and Occupational Pensions Authority (“EIOPA”) and the International Association of Insurance Supervisors, noting that EIOPA’s supervisory priorities for 2027 to 2029 focus on insurer resilience, conduct risks and digital operational resilience.

Insurance reform and next steps

The Deputy Governor also discussed the Central Bank’s engagement with Government and industry on the Action Plan for Insurance Reform, particularly measures to improve transparency in the insurance market. She referenced the Motor Insurance Transparency Code published in March 2026 and the Central Bank’s recent publication of its annual Private Motor Insurance Report and additional research intended to improve consumers’ understanding of insurance costs and the allocation of premiums.

Looking ahead, Ms. McMunn confirmed that the Central Bank will continue implementing its supervisory transformation and regulatory simplification programme, while maintaining robust consumer protection and financial stability standards. The Speech concluded by noting that the insurance sector has the opportunity to help strengthen Europe for the future through insurer’s remaining resilient, adapting responsibly and maintaining the trust of their customers and through the Central Bank delivering effective supervision and pursuing clear, simplified regulation while maintaining the fundamental protections which people and the system depend on.

On 22 October 2026, the Central Bank of Ireland (“Central Bank”) released a public statement on the Irish Financial Services Appeals Tribunal decision (“Statement”). The Statement arises in response to the Irish Financial Services Appeals Tribunal’s (“IFSAT”) decision to uphold the appeal of Mr David Guinane to the Central Bank Inquiry Decision dated 23 April 2025 concerning Permanent TSB plc (“PTSB”) and Mr David Guinane.

Background to the inquiry

The Central Bank explained that the statutory inquiry arose from investigations conducted as part of its tracker mortgage examination. Its Administrative Sanctions Procedure (“ASP”) investigation into PTSB, which commenced in 2014, concluded on 30 May 2019, with PTSB admitting 42 regulatory breaches and receiving a €21 million fine and reprimand.

Following that investigation, the Central Bank examined whether Mr Guinane had participated in PTSB’s breach of the Consumer Protection Code 2006. Having determined that there were reasonable grounds to suspect his participation, the Central Bank established a statutory inquiry chaired by independent appointee Mr Peter Hinchliffe. The inquiry was conducted over a four-year period, with its substantive hearing taking place in early 2024 and its decision delivered in April 2025.

Mr Guinane subsequently appealed the inquiry decision to IFSAT, an independent statutory tribunal responsible for hearing and determining appeals against certain Central Bank decisions.

IFSAT decision and next steps

The Central Bank will apply to the High Court for confirmation of the IFSAT decision in accordance with the Central Bank Act 1942. The conclusion of this case marks the last inquiry conducted under the previous Administrative Sanctions Procedure regime and an external review of the Central Bank’s wider enforcement activities is under way – for more information, see FIG Top 5 at 5 dated 30 July 2026.

On 21 October 2026, the Central Bank of Ireland (“Central Bank”) published a settlement notice (“Settlement Notice”) announcing that it has fined Coinbase Ireland Limited (“Coinbase Ireland”) €3,252,618 for breaching its safeguarding and outsourcing obligations under the Electronic Money Regulations 2011 (“EMR 2011”) between November 2020 and August 2025.

This is the second enforcement outcome in the crypto-assets sector and the fifth settlement under the Administrative Sanctions Procedure (“ASP”) following the changes introduced by the enactment of the Central Bank (Individual Accountability Framework) Act, 2023. It follows a previous enforcement action taken against Coinbase Group Inc (“Coinbase Group”) for anti-money laundering breaches last year – for more information, see FIG Top 5 at 5 dated 13 November 2025.

Findings

Coinbase Ireland is an e-money institutions and is part of the global Coinbase Group. As an e-money institution Coinbase Ireland issues and redeems e-money in exchange for fiat currency. Coinbase Ireland is subject to the safeguarding and outsourcing requirements set out in the EMR 2011 and did not meet these requirements in the following respects:

• Coinbase Ireland failed to have in place an adequate outsourcing governance framework, in particular with regard to placing excessive reliance on the US-based Coinbase Group as an outsourced service provider to implement safeguarding processes and controls to meet Irish / EU regulatory compliance requirements and failed to have sufficient local skill and expertise available within Coinbase Ireland;
• Coinbase Ireland failed to safeguard customers’ funds adequately, both through system design and insufficient control testing. Its designated safeguarding account was allowed to be underfunded for significant periods of time; and
• Coinbase Ireland failed to have sufficient internal control and escalation procedures, and adequate governance processes to identify and report material changes concerning safeguarding to the Central Bank.

Sanction

The Settlement Notice states that Coinbase Ireland has admitted the prescribed breaches and has agreed to the undisputed facts set out within. The Central Bank have imposed the following sanctions:

• a reprimand; and
• a monetary penalty in the amount of €4,646,597 reduced to €3,252,618 after application of a 30% settlement scheme.

Next steps

The sanctions have been accepted by Coinbase Ireland and are subject to confirmation by the High Court. The sanctions will not take effect until such confirmation takes place. The Central Bank used this case as an opportunity to highlight the importance of firms’ fundamental obligation to fully safeguard customers’ funds and to make it clear they have no tolerance for weaknesses in safeguarding and outsourcing arrangements. The Central Bank’s focus is on ensuring that customers are at all times protected and that the integrity of the financial system is maintained.

1. ESMA publishes its third consolidated report on sanctions imposed by national competent authorities

 

On 15 October 2026, the European Securities and Markets Authority (“ESMA”), published its third consolidated report on sanctions and measures imposed by national competent authorities (“NCA”) in the EU (“Report”). The Report details that more than 955 administrative sanctions and measures were imposed across EU member states in financial sectors under ESMA’s remit in 2025. This Report states that, as in previous years, the highest amount of fines were imposed under the Market Abuse Regulation (“MAR”), the Markets in Financial Instruments Directive (“MiFID II”) and the Markets in Financial Instruments Regulation (“MiFIR”). For more information on last year and the previous year’s reports, see FIG Top 5 at 5 dated 17 October 2024 and FIG Top 5 at 5 dated 23 October 2025 respectively.

MAR

In 2025, 350 administrative sanctions were issued under MAR in 24 Member States. Italy imposed the highest number of administrative sanctions at 63, followed by Hungary at 51 and Germany at 33. The Report notes that the total number of sanctions and measures imposed by natural persons has increased compared to previous years. The Report notes that these sanctions against natural persons have a significant deterrence effect and support investor protection.

MiFID II and MiFIR

In 2025, 264 administrative sanctions and measures were issued in 24 member states under MiFID II and MiFIR. Hungary imposed the highest number of administrative sanctions and measures at 43, followed by Italy at 40 and Cyprus at 34.

As with previous years, the Report notes that Ireland did not impose any measures or sanctions under MiFID and MiFIR in 2025. The Report further notes that that Ireland has not imposed any such sanctions since 2018. In this respect, looking at market size, the Report highlights that Ireland has a mid-sized market in terms of number of investment firms located in the State.

The Report also notes that according to the information provided by the Central Bank of Ireland, it has undertaken noteworthy sanctioning activity under MiFID I, including in respect of obligations which continue under MiFID II, which is outside the scope of this Report.

PR

In 2025, six administrative sanctions and measures were imposed under the Prospectus Regulation (“PR”). The highest aggregate administrative fines were imposed in Austria, followed by Czechia and Germany. The Report notes that in 2025, Ireland, alongside Sweden and Luxembourg, are the member states approving the highest number of prospectuses and that no administrative sanctions and measures have been issued in these Member States since 2020.

Next steps

Following on from the Report, ESMA has stated that it will continue to work to foster exchanges among national securities and market authorities on the effective and consistent implementation of capital market rules. The objective is to ensure supervisory effectiveness and convergence where similar breaches result in similar enforcement outcomes across the EU, irrespective of where they have been committed.

 

2. European Payments Council launches SCARLET initiative to support a standardised framework for accepting EU Digital Identity Wallets in payment authentication

 

On 19 October 2026, the European Payments Council (“EPC”) published a press release on the launch of the Strong Customer Authentication Acceptance Rulebook and Liability Framework for EUDIW Transactions (“SCARLET”) initiative, following approval by the EPC Board on 24 September 2026. SCARLET is a new standardisation framework intended to support the consistent acceptance of EU Digital Identity Wallets (“EUDI Wallets”) by payment service providers (“PSPs”) for strong customer authentication (“SCA”). The initiative aims to facilitate compliance with forthcoming obligations under Regulation (EU) 2024/1183 (“eIDAS 2.0”) while promoting interoperability and avoiding fragmentation across the European payments market.

SCARLET framework and regulatory requirements

The EPC explained that EUDI Wallets will enable individuals across the EU to identify themselves and provide verified information digitally, including when accessing payment accounts or initiating electronic payments. Under eIDAS 2.0, PSPs will be required to accept EUDI Wallets for SCA where customers choose to use them.

SCARLET is intended to establish a common framework for more than 3,000 PSPs and over 27 EUDI Wallet providers expected to operate across the EU and European Economic Area. The framework will comprise a business and contractual structure defining participants’ eligibility, rights and obligations, common functional and operational rules, and technical specifications building on the European Commission’s existing digital identity architecture and technical standards.

The EPC noted that the framework is intended to prevent the emergence of multiple, potentially incompatible approaches to digital identity authentication, while establishing clear responsibilities between PSPs and wallet providers.

Implementation and next steps

The EPC confirmed that SCARLET version 1.0 will focus on the acceptance of EUDI Wallets under the existing revised Payment Services Directive (“PSD2”), the European Banking Authority’s Regulatory Technical Standards on SCA and related regulatory requirements. A subsequent version, SCARLET 1.1, will extend the framework to the forthcoming Payment Services Regulation (“PSR”), supporting PSP compliance with the new requirements from 2028/2029 while preserving investments made under the initial framework.

Development of SCARLET will be undertaken by an EPC Taskforce in cooperation with the European Commission and the European Banking Authority, with representatives of the EUDI Wallet ecosystem and other industry stakeholders participating through a multi-stakeholder group.

The EPC intends to conduct an open consultation in summer 2027 and publish the first SCARLET 1.0 rulebook in December 2027. The scheme is expected to take effect following an implementation period covering development, testing, onboarding and certification, aligned with the relevant eIDAS 2.0 compliance deadline.

 

3. Court of Justice of the European Union rules that payment service providers must immediately refund unauthorised transactions despite customer gross negligence

 

On 15 October 2026, the Court of Justice of the European Union (“CJEU”) published a press release on its judgment (“Judgement“) in Case C-70/25, Tukowiecka, concerning the obligation of payment service providers (“PSPs”) to refund unauthorised payment transactions under Directive (EU) 2015/2366 (“PSD2”). The CJEU held that PSPs must, in principle, immediately refund unauthorised transactions, even where they consider that the customer acted with gross negligence. However, PSPs may subsequently seek reimbursement from customers where they establish that the losses resulted from intentional or grossly negligent failures to comply with their obligations.

Background to the proceedings

The case arose following a phishing attack involving a customer of a Polish bank who was selling an item through an online sales platform. The customer received a fraudulent link from a purported buyer, which redirected her to a website impersonating her bank. After entering her online banking credentials, approximately €700 was transferred from her account without authorisation.

The customer notified her bank of the transaction the following day. However, the bank refused to refund the amount on the basis that the customer had acted with gross negligence by failing to safeguard her personalised security credentials.

The customer subsequently brought proceedings before a Polish court, which referred a question to the CJEU concerning whether a PSP is required to refund an unauthorised transaction immediately, notwithstanding its assessment that the customer had acted with gross negligence.

CJEU judgment and immediate refund obligations

The CJEU confirmed that, under Article 73(1) of PSD2, PSPs are generally required to refund unauthorised payment transactions immediately and, in any event, no later than the end of the following business day after becoming aware of or being notified of the transaction, provided the customer has notified the PSP without undue delay.

The CJEU clarified that the only exception to this immediate refund obligation arises where the PSP has reasonable grounds to suspect fraud committed by the customer and communicates those grounds to the competent national authority.

In particular, the CJEU held that a PSP cannot refuse an immediate refund solely because it considers that the customer acted with gross negligence, including by failing to adequately protect their personalised security credentials.

Customer liability and recovery of losses

The CJEU distinguished between the PSP’s initial obligation to refund an unauthorised transaction and the question of who must ultimately bear the resulting financial loss.

It confirmed that, although a PSP must initially refund the customer, it may subsequently seek reimbursement where it establishes that the loss resulted from the customer’s intentional or grossly negligent failure to fulfil their obligations, including the obligation to safeguard personalised security credentials.

The CJEU emphasised that the burden of proving gross negligence rests with the PSP. Accordingly, a PSP’s assessment of customer negligence does not, in itself, justify withholding the initial refund.

Conclusion and next steps

The CJEU emphasised that its interpretation is consistent with PSD2’s objective of ensuring a high level of consumer protection. It noted that permitting PSPs to refuse refunds at the outset based on alleged gross negligence would undermine the effectiveness of the immediate refund obligation and require customers to initiate legal proceedings to enforce their rights.

The matter will return to the referring Polish court for determination in accordance with the CJEU’s interpretation of EU law, which is also binding on other national courts dealing with similar questions.