The Payment and E-Money sector in Ireland has seen significant growth over the last seven years. There are now 51 firms regulated by the Central Bank of Ireland (CBI), with many more applications in the pipeline.
As of December 2023, there is approximately €8bn held in safeguarded funds, protecting consumers against the crystallisation of unacceptable risks in the eyes of the CBI. As outlined by Elizabeth McMunn, Director of Banking, Payments, and Credit Union Supervision, in her speech to the industry on the 29th of February 20241, the stability and reliance of the sector is a key focus of the CBI.
With this growth of the sector also comes the need for an increased focus from the CBI, with an acknowledgement that the regulator must evolve and adapt its approach to regulating and supervising the sector. Innovative firms can develop new technologies giving substantial advantages to consumers and the broader marketplace. However, these new innovations also bring new risks to consumers and the wider economy as a result. One of the key priorities for the CBI is to create a regulatory environment that is suitable, “remains risk-based,” and “is led by judgement and focussed on the outcomes we are seeking to achieve”.
In order to achieve this outcome, the CBI mentions the following four principles as key priorities:
1. Safeguarding
The safeguarding of customer funds is a key focus of the CBI, as demonstrated by the “Dear CEO” letter issued in January 20232. The letter was sent with the purpose of reaffirming their supervisory expectations, both firm-specific and sector-wide, and to enhance transparency around the CBI’s approach to, and judgements around regulation and supervision. The letter sent to all Payment and E-Money firms requested the firms to obtain a specific audit of compliance with the safeguarding requirements under the European Union (Payment Services) Regulations 2018 (“PSR”) and/or European Communities (Electronic Money) Regulations 2011 (“EMR”). The audits of their compliance with safeguarding requirements were to be submitted to the CBI by the end of October 2023, along with a Board response to the outcome of the audit.
The focus on safeguarding funds is not just a key priority of the CBI. In the UK, the Financial Conduct Authority (FCA) has told payment firms that their “top priority” should be ensuring that their customers’ money is safe. The FCA is due to consult on tightening the rules around how payment firms manage safeguarded funds. As it stands, the UK legislator is responsible for the rules that govern how Payment and E-Money institutions hold their customers’ money. The UK government now intends to move these rules off the statute books and, instead, give the responsibility to the regulators so they can determine the rules that apply to financial services firms with greater agility.
2. Operational Resilience and Outsourcing
We have seen from other instances across the banking section that when key infrastructure to a firm is impacted it can have detrimental impacts on customers and the sector as a whole. As the industry has a high reliance on technology, the CBI expects that firms have the ability to respond to, adapt to, and be able to recover quickly from disruptions. They also expect that firms demonstrate that they have learnt from the operational disruptions and put measures in place that will prevent similar outages.
Operation resilience should be front of mind for a firm’s Board and Executive team. It is critical that they have full oversight of their outsourced agreements and have comprehensive contingency planning in the event of an outage.
With the vast majority of the Payment and E-Money firms operating in Ireland being part of larger international groups, the CBI expects that firms do not place a reliance on group structures to such an extent that it compromises their requirements as an Irish-regulated entity. The CBI expects that the Boards and Executive teams of all firms operating here can demonstrate that they:
All are expected to be conducted in compliance with its regulatory and legislative obligations as an Irish-authorised firm.
3. Governance, Risk Management, and Anti-Money Laundering and Countering the Financing of Terrorism
Given the industry's fast-paced growth, the CBI believes that firms with strong governance and risk management foundations are best placed to reap the benefits of growth and innovation in the sector. As the sector expands at a rapid pace, so do the potential risks to customers and the sector.
A functioning payments sector is one in which governance, risk and control frameworks are well-designed, embedded and overseen by suitably experienced and accountable personnel. Firms that have embedded strong governance and risk and control frameworks into their business are best placed to capture the opportunities that come with the new innovations as they have a holistic understanding of their risk and control environment.
The inherent risks of money laundering (ML) and terrorist financing (TF) associated with the sector are high and the CBI has noted shortcomings in the industry in understanding the risk of ML and TF. Firms that have robust controls in place and understand their requirements under Anti Money Laundering requirements when onboarding new clients, along with well embedded governance frameworks will mitigate these risks.
4. Business Model and Financial Resilience
This period of rapid change within the Payments & E-Money sector is driven by innovation, evolving regulations, and emerging technologies. As CBI Deputy Governor Sharon Donnery remarked at the Milano Hub a short time back, “regulating in the interests of us all”3 is high on the list of priorities. Firms and boards are ultimately responsible for managing the risks to which they are exposed. And while the CBI will “serve the public interest by maintaining monetary and financial stability, while ensuring that the financial system operates in the best interests of consumers and the wider economy”4, the responsibility of staying agile, diverse, and resilient remains with the individual firms. There are a number of safeguarding strategies and aspects to consider in this regard.
Diversity & Inclusion
The CBI outlines that, according to their supervisory insights, companies embracing diverse perspectives demonstrate effective management, financial resilience, and strategic acumen. While each organisation is responsible for cultivating its unique culture, the CBI advocates for regulated firms to foster diversity and inclusivity, especially at senior levels. This approach aims to mitigate groupthink, prevent overconfidence, and encourage internal challenges.
Research underscores that diversity at senior levels within regulated entities not only enhances decision-making and elevates the level of scrutiny but, crucially, from the CBI’s supervisory experience, highlights that a lack of diversity can signify heightened risks in behaviour and organisational culture.
Future Regulatory Evolution
How will upcoming legislative proposals further shape the regulatory landscape for Payment and E-Money firms?
Technological Advancements and Risks
As the sector continues to innovate, what new technological risks might emerge, and how should firms prepare to mitigate these effectively?
In the face of continuous technological innovation within the Payments & E-money sector, a new wave of potential risks emerges. One such concern lies in the potential for bias within Artificial Intelligence (AI) systems. Algorithmic bias can lead to unfair treatment of customers, necessitating robust testing and monitoring procedures to mitigate such issues. In terms of the vulnerability to cyberattacks, firms must prioritise robust cybersecurity measures, including data encryption, multi-factor authentication, and regular penetration testing, to safeguard their systems and customer data. Payments & E-money firms should conduct thorough due diligence on Third-Party Providers (TPPs) and implement comprehensive risk management frameworks to address potential vulnerabilities within the third-party ecosystem. Finally, the ever-expanding volume of customer data necessitates heightened vigilance regarding data privacy. Firms must ensure unwavering compliance with regulations like GDPR and implement robust data governance practices to maintain customer trust and mitigate associated risks. By proactively addressing these emerging challenges, Payments & E-money firms can navigate the exciting world of technological innovation while safeguarding their operations and customers.
How can BDO help?
From the CBI’s communications, we have seen that they expect Payment and E-Money firms to have a deep understanding of their business and its risks, not only to the business itself but also to its customers and the sector as a whole, so that trust is maintained in the industry.
Our team in BDO includes industry experts who collaborate with firms, helping to advise and support them to develop and embed comprehensive risk governance frameworks, ensuring they meet the expectations of the CBI. We use our industry knowledge and experience of completing safeguarding reviews to guide on best practices, positioning firms to be robust, resilient, and ready to adapt as the regulatory environment evolves to innovations in the industry.
Our team of industry experts will:
References:
[6] Markets in Crypto-Assets Regulations (MiCAR), CBI regulatory framework.
[7] Individual Accountability Framework, CBI Act 2023.
Brían Gartlan
Ciara Hanrahan
Eoghan Daly