Central Bank of Ireland Individual Accountability Framework Questions from Stakeholders June 2025

Individual Accountability Framework – Questions from Stakeholders June 2025

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 2 Contents ..............................................................................................................................2 Introduction.........................................................................................3

1. The Conduct Standards.........................................................4
2. The Senior Executive Accountability Regime ...............7

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 3 Introduction This document contains answers to questions about the IAF asked by stakeholders. The Questions from Stakeholders should be read in conjunction with other Central Bank publications on the IAF, notably the Guidance on the IAF, and on the related Administrative Sanctions Procedure and the Fitness and Probity Regime. The Central Bank is continuing to engage with stakeholders to seek to enhance understanding and awareness of the impact of IAF. We encourage stakeholders to submit queries regarding the implementation of the IAF which are not addressed in the guidance or the Questions from Stakeholders below via IAF@centralbank.ie. The questions and answers will be integrated into the Guidance on the IAF when it is updated from time to time. Banking, Insurance and Payments Policy Division June 2025 Version Date Amendments 1 1 July 2024 2 27 November 2024 Addition of Questions 1.4, 1.5, 1.6 3 18 June 2025 Addition of Questions 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 4

1. The Conduct Standards 1.1. The Conduct Standards set out a single set of applicable standards of behaviour which will apply to relevant individuals in all firms, irrespective of sector. Does this extend to individuals in CF roles providing services on a freedom of services basis? The Central Bank confirms that CF role holders providing incoming services on a freedom of services basis are subject to the Conduct Standards. 1.2. To what extent are individuals in group entities considered to exercise a significant influence on the conduct of a subsidiary/related RFSP’s affairs, and accordingly be subject to the Additional Conduct Standards as CF-1 role holders of the RFSP? In the main, it is not anticipated that individuals in group entities will ordinarily exercise significant influence on the conduct of the subsidiary/related RFSP’s affairs, and as such constitute CF-1 role holders of the relevant RFSP, and be subject to the Additional Conduct Standards (as well as the Common Conduct Standards). However, where such an individual can effectively direct/exercise a significant influence on key aspects of the business of the RFSP, they will be a CF-1 and therefore they will be subject to both the Common and Additional Conduct Standards as a matter of law.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 5 1.3. There is a statutory obligation on the firm to provide training to individuals in CF roles on the Common Conduct Standards and to individuals in PCF/CF-1 roles on the Additional Conduct Standards to ensure that they have appropriate knowledge of them and how they apply to an individual performing that function. In a situation where CF and/or PCF roles are outsourced, is the firm subject to the IAF itself required to provide this training? While the firm itself is responsible for providing appropriate training, it is permissible that the delivery of such training can be facilitated by a third party. 1.4. How should suspected breaches of the conduct standards be reported to the Central Bank? Suspected breaches of the conduct standards should be reported to the relevant supervisory contact. Alternatively, where a person wishes to make a protected disclosure, they should do so by contacting the Protected Disclosures Desk directly. Details of the protected disclosures process and how to submit a protected disclosure can be found on our webpage - https://www.centralbank.ie/regulation/protected-disclosures￾whistleblowing 1.5. When should suspected breaches of the conduct standards be reported to the Central Bank? The nature of, and circumstances underpinning, suspected breaches of the conduct standards will vary and therefore the timing of submission of related reports will be dependent on the facts of each particular case.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 6 1.6. How should reports in the context of Section 53F(d) of the Central Bank Reform Act 2010 be made to the Central Bank? Under Section 53C(2) of the Central Bank Reform Act 2010 (the 2010 Act), PCFs/CF-1s are required to take reasonable steps to meet the standards that are set out in Section 53F of the 2010 Act. With regard to Section 53F(d) of the 2010 Act specifically, PCFs and CF-1s are required, in short, to take reasonable steps to ensure that “any information of which the Bank would reasonably expect notice in respect of the business of the regulated financial service provider is disclosed promptly and appropriately to the Bank”. In this regard, any such reports should be made to the relevant supervisory contact, as indicated within the Guidance on the IAF. As noted above, where an individual wishes to make a protected disclosure, they should do so by contacting the Protected Disclosures Desk directly. Details of the protected disclosures process and how to submit a protected disclosure can be found on our webpage: https://www.centralbank.ie/regulation/protected-disclosures￾whistleblowing.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 7 2. The Senior Executive Accountability Regime 2.1. Will the Central Bank provide any guidance on the allocation of Prescribed Responsibilities to specific PCF role holders? The Central Bank does not intend to be prescriptive with regard to the allocation of Prescribed Responsibilities to specific PCF role holders (except in the case of the Prescribed Responsibilities which are required to be allocated to (independent) non-executive directors from 1 July 2025). This provides firms the flexibility to allocate responsibilities in a manner that accommodates different business models and organisational structures. However, there may be sectoral guidance that may be of relevance. For example, in the context of the allocation of PR14 (Responsibility for developing and maintaining the firm’s recovery plan, the accurate and timely reporting of all information required for recovery and resolution purposes, the implementation of measures necessary to achieve the operationalisation of recovery and resolution strategies, and for overseeing the internal processes regarding their governance, including the coordination of the entity’s compliance in those respects), there is some guidance with regard to recovery planning within the Central Bank’s Recovery Plan Guidelines for (Re)Insurers which may be relevant.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 8 2.2. PR20 relates to managing the anti-money laundering and countering the financing of terrorism (‘AML/CFT’) compliance function (Responsibility for managing the anti-money laundering and countering the financing of terrorism (‘AML/CFT’) compliance function in order to address the firm’s money laundering and terrorist financing risks including:  the development and oversight of a robust AML/CFT framework; and  overseeing the implementation and effective application of AML/CFT systems and controls). What are the Central Bank’s expectations with regard to the allocation of PR20 where a firm does not have a PCF-52 (Head of Anti-Money Laundering and Counter Terrorist Financing Compliance) and/or where a firm is not deemed a designated person under the Criminal Justice Act 2010? Firms are not required to appoint a PCF-52 in order to allocate PR20. The expectation is that PR20 should be allocated to the most senior individual, with the appropriate authority, responsible for such matters, taking into account the governance structures of the firm. Firms that are not designated persons under the Criminal Justice Act 2010 are not legally obliged to have an AML/CFT control framework in place. However, such firms are not immune to ML/TF risk, therefore, it would be prudent for these firms to assess their exposure to ML/TF risk as part of their overall risk identification and management framework. Such firms should assign PR20 to the appropriate person, as set out above. That person should consider the responsibilities of PR20 and document the extent to which an AML/CFT framework is required together with the rationale for such decision.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 9 2.3. What are the Central Bank’s expectations with regard to the extent of the application, and the allocation, of PR34 (Where the firm has established a specific steering committee to address regulatory matters, responsibility for managing the operation of the committee and for providing comprehensive and timely reporting to senior management and to the board)? Noting that Prescribed Responsibilities cannot be shared (other than in the specific scenarios outlined in the Guidance of the IAF), PR34 should be allocated to the most senior individual, with the appropriate authority, responsible for such matters, taking into account the governance structures of the firm. PR34 is intended to apply in relation to specific, non-standard regulatory events (such as implementation projects or actions required from the firm on foot of engagement with the Central Bank). 2.4. The SEAR Regulations apply to (independent) non-executive directors from 1 July 2025. What does this mean in practice? Regulation 5, Regulation 6(3), Regulation 6(5) and Regulation 10(2) of the SEAR Regulations take effect on 1 July 2025, thereby applying the SEAR to (I)NEDs by requiring firms to:  allocate all of the Prescribed Responsibilities set out overleaf to (I)NEDs, and  to ensure that each (I)NED has a documented Statement of Responsibilities. Statements of Responsibilities must be submitted to the Central Bank for new PCF-2A and PCF2-B applications, along with the Individual Questionnaire (IQ), from 1 July 2025.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 10 Non-Executive Prescribed Responsibilities PR4 Responsibility for leading the development of the firm’s culture, including on matters relating to diversity and inclusion, by the Board. PR6 Responsibility for overseeing the development of the firm’s remuneration policies and practices PR8 Responsibility for safeguarding the independence of the internal audit function and for oversight of the function and the Head of Internal Audit. PR9 Responsibility for safeguarding the independence of the compliance function and for oversight of the function and the Head of Compliance. PR10 Responsibility for safeguarding the independence of the risk function and for oversight of the function and the Chief Risk Officer. PR11 Responsibility for leading the development and monitoring effective implementation of policies and procedures for succession planning, induction, training and professional development of all members of the Board. PR12 Responsibility for ensuring the independence, autonomy and effectiveness of the firm’s policies and procedures on whistleblowing.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 11 2.5. The purpose of the deferral of the application of the SEAR to (I)NEDs was to allow both industry and the Central Bank to learn from the application of the regime to executives in the first instance. What have the learnings of the initial implementation period been? Overall, feedback in relation to the implementation of the SEAR has been consistently positive, with industry representatives in all three in-scope sectors acknowledging the benefits of the regime. With regard to the application of the regime to (I)NEDs, discussions have predominantly focused on the allocation of the Prescribed Responsibilities. Accordingly, in order to ensure a fuller understanding of the distinction between executive and non-executive Prescribed Responsibilities, and to provide comfort to (I)NEDs that the responsibilities for which they are accountable are limited to non-executive responsibilities (i.e. relating to their role in respect of governance, oversight and challenge), greater context regarding the non-executive Prescribed Responsibilities has been provided below. 2.6. What are the Central Bank’s expectations in relation to the role of an (I)NED in the context of PR4, in particular noting the existence of PR5 (Responsibility for overseeing the adoption of the firm’s culture, including on matters relating to diversity and inclusion, in the day-to-day operation of the firm)? PR4 specifically references the role of the board in ‘leading the development of the firm’s culture’. Therefore, it is expected that PR4 would include responsibility for ensuring that culture and diversity is discussed by the board on a regular basis, and for leading such discussions, to ensure that the board can give direction to the executive on culture and diversity related

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 12 matters. In contrast, PR5 is an executive responsibility for culture, which therefore includes the responsibility for ensuring that appropriate policies and procedures that address culture and diversity are in place and are being implemented across the firm. 2.7. Where audit, risk, nomination and/or remuneration committees are in existence within a firm, are there any specific expectations in relation to the allocation of PR6, PR8, PR10 and PR11? PR6, PR8, PR10 and PR11 are closely aligned with the Inherent Responsibility of the Chairs of the Audit, Risk, Nomination and Remuneration Committees. Where such committees exist within a firm, these responsibilities must be allocated to the appropriate non-executive Chair. It is acknowledged that these committees may not be in existence in all firms, and in such cases, these PRs, as well as PR9, should be allocated to the most appropriate (I)NED. 2.8. What are the Central Bank’s expectations in relation to the role of an (I)NED in the context of PR11, in particular noting the existence of PR13 (Responsibility for monitoring implementation of effective policies and procedures for succession planning, induction, training and professional development of staff)? PR11 is specifically focused on the succession planning, induction, training and professional development of the members of the Board itself, in contrast to PR13 which relates to the succession planning, induction, training and professional development of all staff within a firm. As noted, PR11 is closely aligned with the Inherent Responsibility of the Chair of the Nomination Committee. Where such a committee does not exist within a firm, PR11 must be allocated to the most appropriate (I)NED.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 13 2.9. Given the scope of the SEAR is at this point extended to include (I)NEDs, can any of the Prescribed Responsibilities other than PR4, PR6, PR8, PR9, PR10, PR11 and PR12 be allocated to an (I)NED? For example, can PR16 (Responsibility for the board’s development and maintenance of the firm’s business model) or PR33 (Where the firm outsources its internal audit function, responsibility for taking reasonable steps to ensure that every person involved in the performance of that function is independent from the persons who perform external audit’) be allocated to an (I)NED? Only the Prescribed Responsibilities identified as being non￾executive in nature (i.e. PR4, PR6, PR8, PR9, PR10, PR11 and PR12) are appropriate for allocation to (I)NEDs. Otherwise, the Prescribed Responsibilities must be allocated to individuals in executive PCF roles. While PR16 refers to the “board’s” development and maintenance of the business model, this is intended for allocation to the appropriate executive PCF role holder responsible for ensuring there is appropriate board involvement in, and contribution to, the development and maintenance of the firm’s business model. Similarly, in the case of PR33 (which is a “circumstance specific Prescribed Responsibility” i.e. it applies only where a firm outsources its internal audit function) the use of the term "independent” is not a reference to allocation to an (I)NED, but to protecting the independence of the external audit. This role constitutes a management role and therefore is appropriate for allocation to an executive PCF role holder only.

Individual Accountability Framework – Questions from Stakeholders Central Bank of Ireland Page 14 2.10. The Central Bank’s Consultation Paper on Amendments to the Fitness and Probity Regime (CP160) includes proposed revisions to the PCF list. Will these revisions have any impact on the allocation of Prescribed Responsibilities? Given the linkages between the roles identified as PCFs and the allocation of Prescribed Responsibilities to individuals occupying PCF roles, the Central Bank will coordinate its substantive review of the PCF list with the planned three-year review of the SEAR in 2027.

T: +353 (0)1 224 6000 E: IAF@centralbank.ie www.centralbank.ie