CBI Enforcement Actions

Key dates

2019-05-30

The Central Bank’s ASP investigation into PTSB concluded; PTSB had admitted 42 regulatory breaches and received a €21 million fine and reprimand.

2023-12-01

The Central Bank published ASP Guidelines providing further detail on its inquiry process; the exact publication day is not specified in the source, so this date denotes December 2023 only.

2025-04-23

The Central Bank Inquiry Decision concerning PTSB and David Guinane was issued.

2026-10-22

IFSAT published its decision, upheld Mr Guinane’s appeal and overturned the Inquiry Decision; the Central Bank stated that it does not propose to appeal.

Suggested considerations

• Compliance teams may wish to record the IFSAT outcome in enforcement-risk assessments and monitor the High Court confirmation process.
• Banks and mortgage lenders may wish to review open or potential individual-enforcement matters involving historic conduct to confirm that the alleged contraventions, issues for determination, evidential basis and proposed sanctions have been clearly particularised and communicated.
• Firms may wish to preserve governance records showing how customer-impact risks, escalation decisions, approvals and follow-up controls were assessed, particularly for tracker mortgage, conduct and legacy remediation matters.
• Legal and compliance teams may wish to assess whether the reasoning reported in the decision has implications for ongoing Central Bank inquiries, including fair-notice, statutory-authority, procedural-fairness and reasons requirements.
• Firms may wish to distinguish this case from the separate PTSB entity enforcement outcome: PTSB admitted 42 regulatory breaches and received a €21 million fine and reprimand in 2019, which this publication does not overturn.
• Firms may wish to track the Central Bank’s external review of wider enforcement activities and any revisions to inquiry procedures, ASP guidance or Individual Accountability Framework implementation.

What changed

No new regulatory obligation or rule has been introduced for firms. The specific inquiry decision against Mr Guinane has been overturned, and the Central Bank does not propose to appeal the IFSAT findings. Independent reporting indicates that IFSAT found the inquiry process and reasoning legally defective, including failures to give fair notice of certain issues and to provide adequate reasons. The Central Bank will apply to the High Court for confirmation of the IFSAT decision under the Central Bank Act 1942.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Suggested considerations

• Review and implement April 2023 updated F&P Regulations and Guidance to ensure investigations and prohibitions incorporate IAF Act fair procedure safeguards (https://www.centralbank.ie/news/article/press-release-central-bank-statement-on-high-court-judgment-17-april-2026).
• Conduct internal audits of F&P processes, focusing on fair procedures (e.g., notice, representation rights) for senior executives in CF/PCF roles.
• Monitor and prepare for summer 2026 final guidance from CP-166 on prohibitions; submit any late feedback if applicable.
• Train compliance and HR teams on heightened procedural standards, referencing High Court emphasis on fair procedures.
• For firms in investment funds/asset management: Assess PCF suitability assessments against consolidated F&P Standards from CP-150.

What changed

• - Legislative enhancements via IAF Act 2023: Introduced changes to strengthen CBI's investigation and prohibition powers under the F&P Regime, including additional safeguards for fair procedures in...
• Updated Regulations and Guidance (April 2023): CBI published revisions reflecting IAF Act changes, focusing on improved investigation and decision-making processes...
• CP-150 Consultation (2025): Led to updated Guidance on consolidated Fitness and Probity Standards, separate from F&P investigations...
• CP-166 Consultation on Supplemental Guidance: Public consultation on prohibitions closed 25 March 2026; final guidance expected summer 2026...

Key dates

1 February 2021

12 December 2023; Period of Buckley's admitted misconduct (diverting payments and misrepresenting qualifications)

25 February 2026

Effective date of the indefinite prohibition on Buckley performing any controlled functions

01 April 2026

Publication date of the CBI press release announcing the Prohibition Notice

Suggested considerations

• Firms employing similar roles: Immediately review invoicing processes to ensure payments direct only to firm accounts, with segregation of duties and dual approvals for client billing.
• Fitness and Probity assessments: Conduct enhanced due diligence on customer-facing staff, verifying qualifications via independent sources and monitoring for personal financial gain conflicts.
• Incident reporting: Escalate any suspected integrity breaches (e.g., qualification misrepresentation or fund diversion) to CBI under fitness and probity notification obligations.
• Training programs: Update mandatory training on Fitness and Probity Standards (available at https://www.centralbank.ie/regulation/fitness-and-probity), focusing on honesty in client interactions.
• Prohibition checks: Screen all controlled function holders against CBI's public prohibitions list before approvals or role changes.

What changed

This is not a new regulation but an enforcement outcome under the existing Fitness and Probity Regime, established by the Central Bank Reform Act 2010, which mandates high standards of competence, integrity, and honesty for individuals in controlled functions. No regulatory changes are introduced; instead, it reinforces enforcement mechanisms, including investigations and prohibitions for breaches, particularly in customer-facing roles where honesty is paramount.

Key dates

2014

- CBI enforcement investigation into Mr Smith and RSAII commences

December 2018

- CBI reprimands and fines RSAII €3.5m for related breaches, including reserve failures

November 2022

- CBI decides to hold an Inquiry into Mr Smith's participation under Part IIIC of the Central Bank Act 1942

1 December 2025

- Reprimand and 13-year disqualification imposed on Mr Smith, effective immediately under IAF Act transitional provisions (no High Court confirmation needed)

12 December 2025

- CBI publishes public statement on the enforcement action

Suggested considerations

• Conduct internal audits of large loss claim reserving processes to verify compliance with Article 13(1)(a) of the 1994 Regulations, ensuring estimates are accurately recorded in databases without undocumented overrides.
• Review senior management oversight of claims handling; document all approvals and prohibit informal (e.g., in-person or hard-copy only) processes that bypass controls.
• Enhance governance training for executives on personal liability under ASP, including simulations of reserving decisions and policyholder risk scenarios.
• Assess historical exposures for under-reserving; remediate if needed, and prepare for potential CBI inquiries (noting 10+ year investigation timelines).
• Update conduct and culture frameworks to align with CBI expectations for CEOs to drive compliance, as per Deputy Governor Colm Kincaid's comments.

What changed

This is not a regulatory change or new requirement but an enforcement precedent reinforcing existing obligations under the 1994 Regulations for insurers to maintain adequate technical reserves reflecting true liabilities. It highlights CBI's focus on senior executive accountability for deliberate policy circumvention, such as undocumented processes overriding claims handlers' estimates, which inflated reported profits and understated liabilities.

Key dates

23 April 2021

19 March 2025; Period of breaches, including 12-month window of unmonitored €176 billion transactions

5 November 2025

Settlement reached between CBI and Coinbase Europe

6 November 2025

CBI public announcement and Settlement Notice published

12 January 2026

High Court confirmed sanctions, making them final and effective

Suggested considerations

• Conduct Gap Analysis: Review transaction monitoring systems for configuration errors, back-testing historical data, and ensuring 100% coverage of high-risk transactions.
• Enhance Controls: Implement robust internal policies, automated alerts, and governance to detect/prevent ML/TF; test systems regularly for faults affecting >1% of volume.
• Accelerate STR Processes: Ensure real-time suspicion flagging and filing; remediate delays via prioritized back-monitoring with FIU coordination.
• Board/Compliance Reporting: Document remediation plans, as Coinbase did, and prepare for audits/enforcement; train staff on VASP-specific risks under MiCA/AMLA.
• Third-Party Review: Engage independent auditors to validate fixes, mirroring Coinbase's post-error cooperation.

What changed

This is an enforcement action, not new legislation, but it reinforces existing CJA 2010 requirements for VASPs: ongoing transaction monitoring, immediate STR filing to the Financial Intelligence Unit (FIU) and Revenue Commissioners upon suspicion of money laundering or terrorist financing, and adoption of internal policies/controls to prevent/detect financial crime.

Key dates

2009

October 2013; Period of under-reserving breaches and manipulation of large loss claims

30 September 2013

Date of €78.2 million technical reserves understatement

October 2013

CBI identifies issues during scheduled supervisory engagement

2014

CBI investigation into RSAII and individuals (e.g., Philip Smith) begins

December 2018

RSAII admits four breaches; enforcement against firm concludes

Suggested considerations

• Conduct reserving process reviews: Ensure claims handlers' recommended estimates are recorded without delay or manipulation; implement independent validation for large loss claims.
• Strengthen internal controls: Develop sound administrative/accounting procedures and mechanisms to detect irregularities (e.g., unearned premium adjustments, claims expenses).
• Enhance governance: Robustify internal reporting structures per Corporate Governance Code 2010 (Section 6.3); promote ethical culture to prevent individual overrides.
• Senior accountability: Boards and executives must oversee compliance; remediate via capital injections if needed, as RSAII did.
• Supervisory engagement: Cooperate fully with CBI probes; apply lessons to Solvency II reserving under Article 101 (post-2016).

What changed

This is an enforcement action, not a new regulation, but it reinforces core pre-Solvency II requirements under the European Communities (Non-Life Insurance) Framework Regulations 1994, specifically Article 13(1)(a), mandating firms to establish and maintain technical reserves for all underwriting liabilities. It highlights breaches of the Corporate Governance Code for Credit Institutions and Insurance Undertakings 2010 (Section 6.3), requiring robust governance, internal reporting, and reliable information flows to decision-makers.

Key dates

1 December 2011

- Fitness and Probity regime effective; Merrion's breach period begins

Late 2014 Deadline

- Management buy-out and new Board appointed; initial compliance improvements start

24 April 2015

- Merrion implements first written F&P policies and procedures

2016

- CBI inspection identifies breaches

12 December 2017

- CBI imposes €200,000 fine and reprimand via settlement agreement; investigation closed

Suggested considerations

• Develop/improve written policies and procedures for initial and ongoing due diligence on CFs/PCFs, including centralized records per individual.
• Conduct thorough due diligence at appointment and continuously monitor compliance with F&P Standards; maintain demonstrable records.
• Ensure accurate CF/PCF classification for all relevant roles (e.g., executive directors, finance heads, client advisors).
• Implement monitoring systems to detect changes in fitness/probity and report to CBI if Standards are breached.
• Board-level oversight: Review and remediate gaps, as post-2016 Merrion Board did.

What changed

• This 2017 enforcement does not introduce new regulatory changes but enforces existing requirements under the F&P regime, established via the Central Bank Reform Act 2010 and effective from 1 December...
• Firms must maintain adequate systems and procedures for initial and ongoing due diligence to ensure CFs/PCFs meet F&P Standards (fitness: competence, integrity; probity: honesty).
• Ongoing monitoring beyond initial checks, with written records and centralized documentation for each individual.
• Accurate classification of roles as CFs/PCFs; failure here constituted a breach. No subsequent statutory changes are noted in the publication, but it reinforces that firms bear ultimate...