Agenda Articles

Following a consultation process on amendments to the Fitness and Probity (“F&P”) regime (“CP160”) which concluded in July 2025, the Central Bank of Ireland (the “CBI”) has published three further key documents in relation to the F&P review: • a Feedback Statement on CP160 (the “Feedback Statement”) (here); • revised Guidance on the Standards of Fitness and Probity (the “F&P Standards”) (here) (effective from 20 November 2025) (the “Finalised Guidance”); and • consolidated Fitness and Probity Standards - Code issued under Section 50 of the Central Bank Reform Act 2010 (here).

Don’t panic if you are called for interview by the Central Bank of Ireland (the “CBI”) as part of your application for approval for a pre-approval controlled function role (a “PCF role”). The CBI has clarified that “an interview by the Central Bank should not be viewed as a negative indicator.”

The Government Legislation Programme for the Spring 2025 session has been published. The Cabinet has approved 21 bills for priority publication and 29 bills for priority drafting. Priority legislation includes the EU Data Regulation Bill, the Media Regulation Bill and the Protection of Employees (Employers’ Insolvency) (Amendment) Bill.

On 30 August 2024, the Department of the Environment, Climate and Communications published the General Scheme for the National Cyber Security Bill 2024 (CSB).

The Irish Screening of Third Country Transactions Act 2023 (the Act) entered into force on 6 January 2025, introducing mandatory notification and pre-clearance for in scope transactions.

In November 2024, The Central Bank of Ireland (Central Bank) published Guidance on its expectations for applicants seeking authorisation from the Central Bank to operate as a regulated firm (Cross Sectoral Guidance).

DORA introduces various requirements for the management of ICT third-party risk and financial entities should start reviewing their contractual arrangements and documentation in preparation for its application.

The CRO have restored the status of the companies effected and have ceased the involuntary strike-off process, pending a full review.

The Data Protection Commission (“DPC”) recently published its 2022 annual report (the “Report”) covering its regulatory activities between 1 January 2022 and 31 December 2022.