Fitness & Probity and the Individual Accountability Framework

What changed, and why it reaches individuals

The historic difficulty in Irish enforcement was structural. Pursuing an individual generally required establishing a firm’s breach first, which made individual accountability slow and rare. The Individual Accountability Framework removed that dependency, alongside introducing conduct standards and, for in-scope firms, the Senior Executive Accountability Regime.

The practical consequence for a senior manager is that responsibility is now written down, allocated by name, and enforceable. For everyone else, the conduct standards apply far more widely than the accountability regime does.

The framework has been introduced in phases, with different obligations commencing at different points and different populations of firm in scope. Confirm which phase applies to your firm and your role rather than assuming the whole regime landed at once.

The four parts, and when each started

• Conduct standards. In force since 29 December 2023 for every regulated firm: common standards for all controlled function holders, additional standards for PCF holders and others with significant influence, and business standards for the firm itself
• Fitness and probity certification. The Certification Regulations have applied since 8 January 2024. The firm certifies each controlled function holder in writing before they act, and every twelve months after
• SEAR. From 1 July 2024 for executive PCF roles at in-scope firms, broadly banks, most insurers and the investment firms that deal on their own account or hold client assets, around 150 firms in all. Non-executive directors came into scope on 1 July 2025
• Enforcement. The Administrative Sanctions Procedure can now be taken directly against an individual for their own breach, without first proving the firm’s

Controlled Functions and PCFs

Fitness and probity attaches to roles rather than to seniority as such. Two categories matter:

• Controlled Functions. Roles that can exercise significant influence, or that involve dealing with customers or their property. Broader than most firms assume, and it does not stop at management.
• Pre-Approval Controlled Functions. A subset requiring Central Bank approval before appointment. The firm cannot simply appoint and notify.

The first task in any F&P review is an accurate map of which roles in the firm are CFs and which are PCFs. It is common to find the map is out of date, usually because roles changed and the schedule did not.

CF1, CF2 and the customer-facing functions

CF1 is anyone able to exercise significant influence on the firm’s affairs. CF2 is anyone involved in ensuring, controlling or monitoring compliance, which is where compliance officers, MLROs, risk and internal audit staff sit. The remaining controlled functions cover customer-facing work: giving advice, arranging, dealing with customer property, and so on. The firm’s map should name every role against its category, because the conduct standards, the certification duty and the due diligence all attach to that category.

Pre-approval in practice

There are around fifty PCF roles, from the chief executive and board members to the heads of function. Two matter directly to compliance teams: PCF-15, Head of Compliance, and PCF-52, Head of Anti-Money Laundering and Counter Terrorist Financing Compliance, a separate role since April 2022. Appointment runs through the Individual Questionnaire on the Central Bank Portal, which the firm submits only after completing its own due diligence, and the Bank may interview the candidate. Following Andrea Enria’s 2024 review of the process, the Bank set up a dedicated Fitness and Probity Unit in January 2025 and replaced its guidance with a single consolidated document in November 2025. Temporary cover for a vacant PCF role has limits too: the firm has three months from the appointment of a temporary officer to apply for a permanent replacement, and successive temporary appointments are not permitted.

The three standards

1. Competent and capable. The qualifications, experience and continuing professional development the role requires.
2. Honest, ethical and acting with integrity. Reputation and past conduct, including matters that never reached a formal finding.
3. Financially sound. Assessed as relevant to the role, not as a general judgement on a person’s finances.

All three must be satisfied on appointment and on an ongoing basis. The ongoing limb is the one that gets neglected: a person who was fit and proper in 2023 is not thereby fit and proper now, and circumstances that change mid-year are supposed to surface when they change rather than at the next annual cycle.

The due diligence behind each standard

The Central Bank’s guidance sets out what a firm is expected to check before it can say it is satisfied on reasonable grounds. The file for a new appointment usually needs:

• Competent and capable. Qualifications verified with the awarding body, Minimum Competency Code status where the role needs it, employment history with gaps explained, references taken up, and the CPD record
• Honest, ethical, with integrity. Regulatory history here and abroad, Companies Registration Office searches for directorships, restrictions and disqualifications, court judgments, and the person’s own declaration. The 2025 Standards make clear that proceedings issued against a person can be material whether or not they concluded
• Financially sound. Judgment, bankruptcy and insolvency searches, assessed for relevance to the role rather than as a verdict on the person

Each individual also signs an agreement to comply with the Standards and to tell the firm without delay if that stops being true. That undertaking turns the ongoing limb from a hope into a duty, and the annual certification into a confirmation of something the person has been obliged to report all year.

Annual certification

In-scope firms must certify that individuals performing controlled functions meet the standards, annually. This is the operational heart of the regime and, for most compliance officers, the single largest recurring administrative task the framework creates.

What a certification file is expected to contain:

• Identity and qualification verification, refreshed rather than copied forward
• Employment and reference history, with gaps explained
• Regulatory, judgment and, where relevant, criminal record checks
• A record of continuing professional development for the year
• The individual’s own declaration and acknowledgement
• The firm’s decision, the evidence it rested on, and who signed it

The failure mode is a certification that certifies nothing: a signed form with no underlying file. If the evidence is not there, the certification is an assertion, and an assertion is what the regime was designed to move away from.

What the Certification Regulations require

The mechanics come from section 21 of the Central Bank Reform Act 2010, as rewritten by the 2023 Act, and the Certification Regulations made under it:

• No one performs a controlled function unless a certificate of compliance is in force for them
• A certificate may be given only where the firm is satisfied on reasonable grounds that the person meets the Standards and the person has agreed in writing to comply with them
• A certificate is valid for twelve months from the date of issue
• The firm must record which controlled functions each person performs, which aspects of the business they are involved in, the basis on which it is satisfied, and any outsourcing of a controlled function
• All documentation relied on must be retained
• The certificate must be revoked if the firm ceases to be satisfied, and the Central Bank must be told where a certificate is revoked or not renewed because the person no longer meets the requirements

The Bank has not prescribed a form. What it will ask for is the register that shows every certificate, its date, its expiry, who approved it and the file it rests on. A spreadsheet with those columns, kept current, is the whole system for a small firm.

SEAR and statements of responsibility

For firms in scope of the Senior Executive Accountability Regime, each senior executive has a statement setting out what they are responsible for, and the firm maintains a management responsibilities map showing how those statements fit together.

The discipline is that the set has to be complete and unambiguous. Two properties are tested:

• No gaps. Every prescribed responsibility is allocated to somebody
• No unintended overlaps. Where two people share, the split is explicit rather than assumed

Writing these is the easy part. Keeping them accurate through reorganisations, departures and interim cover is where they decay, and a statement that describes an arrangement the firm abandoned six months ago is worse than useless in an investigation.

Inherent, prescribed and allocated responsibilities

A statement has three layers. Inherent responsibilities come with the PCF role itself, by regulation. Prescribed responsibilities are a fixed list that the firm must allocate among its senior executives, and it includes responsibility for the anti-money laundering and counter terrorist financing compliance function, which sits with the PCF-52 holder where there is one. Allocated responsibilities are whatever else the firm chooses to assign. The map ties all three to named people and to the committees and reporting lines around them.

The duty of responsibility and reasonable steps

Each senior executive is under a legal duty to take any steps that it is reasonable in the circumstances to take to avoid a breach in their area. The Act lists what counts as the circumstances: the nature, scale and complexity of the business, the person’s functions and the knowledge and experience someone in that role could be expected to have, and whether appropriate systems, controls and oversight of delegation existed and were used. The defence, in other words, is a record. Decisions taken, information received, questions asked, escalations made and the dates of each are what an executive will need to produce, and a diary that shows them is the most practical protection the regime offers.

Keeping the map current

• A change log: every appointment, departure, reorganisation and period of interim cover, with the date the statements and map were updated
• Handover notes when a responsibility moves, signed by both sides
• Submission through the Central Bank Portal, following the Bank’s SEAR system guide, whenever a statement or the map changes
• An annual read-through by each executive of their own statement, confirmed in writing

The Conduct Standards

The conduct standards are the part of the framework with the widest reach, and the part most firms under-communicate. Common standards apply to a broad population of staff. Additional standards apply to those in senior positions, and business standards apply to the firm itself.

Because the common standards reach so far into the organisation, the enforcement risk is not confined to the executive floor. Breaches are reportable, and firms that have never told their staff the standards exist tend to under-report — which is itself a finding, and a more damaging one than the breach would have been.

The five common standards

1. Honesty and integrity, including managing conflicts of interest, not pressuring customers, not misusing the firm’s or customers’ assets or information, and reporting wrongdoing internally rather than impeding others who do
2. Due skill, care and diligence, including knowing the business, its risks and the rules that apply to the role
3. Cooperating in good faith and without delay with the Central Bank and with comparable authorities abroad
4. Acting in the best interests of customers and treating them fairly and professionally
5. Complying with standards of market conduct and trading venue rules

The four additional standards

PCF holders and anyone else with significant influence must also take reasonable steps to ensure that the business is controlled effectively, that it complies with its regulatory obligations, that delegated tasks go to appropriate people with effective oversight, and that anything the Central Bank would reasonably expect to be told is disclosed promptly.

What the firm owes its people

The Act is explicit that the firm must notify each controlled function holder of the standards and how they apply to that person’s role, and must train them so they have appropriate knowledge of both. The same applies to the additional standards for PCF holders. A generic all-staff email meets neither limb. The record that does is a notification tied to the role, a training record tied to the person, and a date on each.

What an inspection asks for

The Central Bank’s questions are predictable, and a compliance officer who keeps these eight things current can answer them the same day:

1. The map of roles to controlled function categories, and the PCF list with approval dates
2. The due diligence file for each appointment, and the signed agreement to comply with the Standards
3. The certification register: issue date, expiry, approver, and the evidence relied on
4. Revocations and non-renewals, with the notification sent to the Bank
5. The notification and training records for the conduct standards, by person and by role
6. For SEAR firms, the current statements of responsibilities and the map, with the change log
7. The handover notes behind every change of responsibility
8. The annual PCF confirmation return and the correspondence around it

None of it is difficult. All of it is tedious, which is why it is where firms fall down, and why a firm that can produce it without a scramble has told the inspector most of what they came to find out.