Guidance on the Standards of Fitness and Probity

November 2025 Guidance on the Standards of Fitness and Probity

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 2 Contents Contents............................................................................................. 2 Glossary of Terms ........................................................................... 6 Chapter 1 ........................................................................................... 9 Legal Framework............................................................................. 9 Irish Law ...........................................................................................10 The Central Bank Reform Act 2010 .................................................... 10 Central Bank Regulations....................................................................... 11 Standards of fitness and probity .......................................................... 12 Guidance on the Standards of Fitness and Probity......................... 14 Other Guidance......................................................................................... 15 European Legislation ...................................................................16 SSM Framework........................................................................................ 16 European Supervisory Authorities Guidelines................................. 17 The Individual Accountability Framework ..........................18 Interaction between the F&P Regime and the SEAR...................... 19 Interaction between the F&P Regime and the Conduct Standards ........................................................................................................................ 19 Corporate Governance Requirements ..................................20 Other Sectoral Codes ..................................................................22 Enforcement Powers ...................................................................22 Chapter 2 .........................................................................................24 Population of CFs and PCFs ......................................................24 Approach to identifying the CF population .........................25 Identification by the Firm....................................................................... 25 Roles Captured by CF-1: Exercising Significant Influence........ 25 Roles Captured by CF-2: Ensuring, Controlling or Monitoring Compliance............................................................................................. 26 CF-3 to CF-9: Provision of a Financial Service ............................. 27 Definition of Terms Used (CF-10 – CF-11).................................... 27

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 3 Approach to Identifying the PCF Population......................28 Identification by the Firm....................................................................... 28 Definition/Operation of Specific PCFs............................................... 29 PCF-8 Chief Executive Officer.......................................................... 29 PCF-16 Branch Manager of branches outside Ireland............... 29 PCF-42 Chief Operating Officer....................................................... 30 PCF-49 Chief Information Officer ................................................... 30 PCF-50/PCF-54/PCF-55 Head of Material Business Line ........ 31 PCF-51 Head of Market Risk............................................................. 32 PCF-52 Head of Anti-Money Laundering and Counter Terrorist Financing Compliance ......................................................................... 33 Central Bank Declaration of a PCF...................................................... 34 Temporary Officers.................................................................................. 34 Exemptions from the F&P Standards.................................................. 36 Outsourcing............................................................................................ 39 Outsourcing of a CF to an unregulated Entity.............................. 39 Outsourcing of a PCF to an Unregulated Entity .............................. 40 Exclusion of Certified Persons.......................................................... 41 Chapter 3 .........................................................................................42 Fitness and Probity Standards..................................................42 Due Diligence .................................................................................42 Standard of Fitness.......................................................................43 Standard of Probity......................................................................44 Standard of Financial Soundness.............................................44 Due Diligence .................................................................................45 Legal Obligation of a Firm ...................................................................... 45 Fitness - Due Diligence to be undertaken by a Firm....................... 48 Probity - Due Diligence to be undertaken by a Firm ...................... 52 Evidential requirements for Payment Institutions (PI), Electronic Money Institutions (EMI), and Account Information Service Providers (AISP)........................................................................................ 55 Credit Unions – Due Diligence and Elected CFs/PCFs................... 56

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 4 Elected CFs/ PCFs..................................................................................... 58 Criminal, Civil and Regulatory Actions............................................... 59 Financial soundness – Due Diligence to be undertaken by the Firm............................................................................................................... 62 Chapter 4 .........................................................................................63 Key Considerations that Form Part of an F&P Assessment .............................................................................................................63 Key Considerations of F&P Assessment...............................64 Capacity to perform a role.........................................................64 Time Commitments.................................................................................. 64 Individuals Holding Multiple PCF Roles......................................... 67 Availability and accessibility of a PCF to the Central Bank .............................................................................................................68 Sharing of PCF roles .....................................................................68 Conflicts of Interest......................................................................69 Independence of Mind and Independence...........................70 Independence of Mind............................................................................. 70 Independence ............................................................................................ 71 Requirements of a Role/Inherent Responsibilities ...........73 Responsibilities Prescribed in the Credit Union Act, 1997 .......... 73 Level of Knowledge and Experience ......................................74 Board Members......................................................................................... 76 Heads of Control Functions ................................................................... 83 Collective Suitability, Diversity and Inclusion....................91 Collective Suitability of the Board....................................................... 91 Diversity and Inclusion............................................................................ 92 Chapter 5 .........................................................................................95 Ongoing Obligation to Comply: Certification.....................95 Certification....................................................................................96 The Certification Process ....................................................................... 96 Identification of CFs................................................................................. 97

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 5 Forming the View that the Individual Meets the Standards ........ 98 Frequency of Completion of the Certification Process ................. 99 Confirmation of Agreement to Comply with the Standards of Fitness and Probity.................................................................................100 Submission of Data in Relation to Certification to the Central Bank............................................................................................................100 Retention of Data in Relation to Certification...............................101 Responsibility for and Compliance with the Certification Process ......................................................................................................................102 Material Changes or Concerns..............................................103 Appendices...................................................................................104 Appendix 1 – List of CF Functions........................................105 Appendix 2 – Existing list of PCF Functions .....................108 Appendix 3 ...................................................................................112 Appendix 4 ...................................................................................113

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 6 Glossary of Terms ASP: Administrative Sanctions Procedure CF: Controlled Function, which includes pre-approval controlled functions (PCFs). When the term “CF” is used in the text of this guidance, it refers to a CF for a firm, as relevant. In some cases, specific reference is made to CF roles for credit unions or holding companies (CUCF/CURICF or HCCF as appropriate). Where a certain CF’s number and description is equivalent to CFs for credit unions or holding companies, a CF-X is used to capture all equivalent CFs. For example, CF-1, CUCF-1, CURICF-1 and HCCF-1 together would be described as CF-1. Corporate Governance Requirements for relevant regulated firms: Corporate Governance Requirements for Credit Institutions 2015, Corporate Governance Requirements for Insurance Undertakings 2015, Corporate Governance Requirements for Investment Firms and Market Operators 2018, Corporate Governance Requirements for Captive Insurance and Captive Reinsurance Undertakings 2015 issued by the Central Bank, Part IV of the Credit Union Act, 1997 “Management of Credit Unions”, and any other domestic and international governance requirements applicable to firms, as relevant, unless specified otherwise in the text. Credit Union: Credit Union has the meaning given by the Credit Union Act 1997. Firm: Regulated Financial Service Provider within the meaning of the Central Bank Act 1942, and Holding Company. F&P Regime: The Central Bank’s Fitness and Probity Regime under Part 3 of the Central Bank Reform Act 2010. F&P Regulations: The Central Bank Reform Act 2010 (Sections 20 and 22) Regulations, 2011 (S.I. No. 437 of 2011), as amended, Central Bank Reform Act 2010 (Sections 20(1) and 22(2A)) Holding Companies Regulations, 2023 (S.I. No. 664 of 2023), as amended, and/or Central Bank Reform Act 2010 (Sections 20 and 22 - Credit Unions) Regulations 2013 (S.I. No. 171 of 2013), as amended.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 7 F&P Standards: The Fitness and Probity Standards 2025 Holding Company: Any of the following established in the State: (a) A financial holding company, within the meaning given by point (20) of Article 4(1) of the Capital Requirements Regulation; (b) A mixed financial holding company, within the meaning given by point (21) of Article 4(1) of the Capital Requirements Regulation; (c) An insurance holding company, within the meaning given by Regulation 215(1) of the European Union (Insurance and Reinsurance) Regulations 2015 (S.I. No. 485 of 2015); (d) An investment holding company, within the meaning of the European Union (Investment Firms) Regulations 2021 (S.I. No. 355 of 2021). Individual Questionnaire: Individual questionnaire, which an individual must complete to apply for a PCF role that is endorsed by the proposing firm and then submitted electronically to the Central Bank for assessment. MCC: Minimum Competency Code 2017 MCR: the Central Bank (Supervision and Enforcement) Act 2013 (Section 48 (1)) Minimum Competency Regulations 2017 MiFID II: Directive 2014/65/EU - Markets in Financial Instruments Directive II PCF: Pre-Approval Controlled Function. When the term “PCF” is used in the text of this guidance, it refers to a PCF for a firm, as relevant. In some cases, specific reference is made to PCF roles for credit unions or holding companies (CUPCF/CURIPCF or HCPCF as appropriate). Regulated Firm: Regulated Financial Service Provider. The terms “Regulated Financial Service Provider” and “Regulated Firm” are used interchangeably in this guidance. SEAR: Senior Executive Accountability Regime Standards of fitness and probity: any standard of fitness and probity set out in a code issued by the Central Bank under Section 50 of the 2010 Act. The 1942 Act: The Central Bank Act 1942, as amended

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 8 The 2010 Act: The Central Bank Reform Act 2010, as amended The 2013 Act: The Central Bank (Supervision and Enforcement) Act 2013, as amended The Central Bank: The Central Bank of Ireland The IAF Act: The Central Bank (Individual Accountability Framework) Act 2023, as amended

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 9 Chapter 1 Legal Framework

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 10 Irish Law The Central Bank Reform Act 2010 1.1. The Fitness and Probity Regime (F&P Regime) was introduced by the Central Bank Reform Act 2010 (the 2010 Act) and applies to regulated financial service providers (including credit unions) and holding companies1 established in Ireland (hereafter referred to as firms). 1.2. The primary purposes of the F&P Regime are to prevent serious damage to the financial system in the State, to support the stability of that system, and to protect users of financial services. The F&P Regime seeks to achieve its aims by ensuring that individuals in key positions, and in customer￾facing positions (referred to in the legislation as controlled functions (CFs)) within firms comply with the standards of fitness and probity, issued by the Central Bank2 . 1.3. The F&P Regime is grounded on three key “pillars”: • Firm obligations: the primary and ongoing statutory obligations of firms (and firms in the process of application for authorisation) in relation to the application of the standards of fitness and probity. • Gatekeeper role: for certain roles, which are a subset of CFs (referred to as Pre-Approval Controlled Functions (PCFs)), there is a requirement for the pre-approval of the Central Bank prior to appointment. • Investigations: the investigative and enforcement powers of the Central Bank (and the European Central Bank, where applicable) in relation to an individual's fitness and probity. 1.4. Firms perform a pivotal role in ensuring that fit and proper individuals occupy CF and PCF roles within their business. While the Central Bank has a significant role in assessing the 1 See Glossary for a definition of ‘holding company’ for this guidance. 2 Under Section 50 of the 2010 Act.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 11 fitness and probity of individuals in PCF roles, it is essential for firms to fulfil their primary responsibility in conducting a thorough due diligence in respect of all individuals both prior to appointment to CF roles, and on an on-going basis. 1.5. In this regard, firms have an obligation to undertake due diligence at the initial stage before appointing individuals to CF roles, and in the case of PCFs, before submitting the application for a PCF approval. The obligation to ensure, and to certify, that fit and proper individuals occupy CF and PCF roles applies on an ongoing basis 3 . Firms must maintain ongoing oversight of individuals in CF roles and promptly address any concerns or changes pertaining to an individual’s fitness and probity. 1.6. Firms should develop and maintain appropriately and proportionately robust internal policies and procedures for assessing the fitness and probity of individuals in CF roles. 1.7. The Central Bank has a range of powers available to it to investigate, suspend or prohibit individuals from CFs in the financial services industry where there are justified concerns about their fitness and probity. Those powers are set out in Part 3, Chapters 3 & 4, of the 2010 Act. Central Bank Regulations 1.8. The 2010 Act provides the Central Bank with a regulation making power to: • Prescribe functions that are to be CFs in relation to regulated financial service providers or in relation to holding companies, and • Prescribe a subset of CFs as functions for which the prior approval of the Central Bank is required before an individual can be appointed (i.e. PCFs). 3 Under the 2010 Act and the IAF Act.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 12 1.9. The Central Bank has published regulations prescribing CFs and PCFs4 . The Central Bank may from time to time publish subsequent amending regulations, which add and/or amend the list of CFs and/or PCFs5 . Standards of fitness and probity 1.10. Under Section 50 of the 2010 Act, the Central Bank has the power to issue a code setting out standards of fitness and probity for those individuals in CFs. 1.11. The Central Bank has issued the following codes setting out standards of fitness and probity (collectively referred to in this guidance as the standards of fitness and probity): • The Fitness & Probity Standards (F&P Standards), and • The Minimum Competency Code. 1.12. The F&P Standards require individuals in CF roles to be: • Competent and capable, • Honest, ethical and to act with integrity, and • Financially sound. 1.13. Fitness, in the context of being competent and capable, relates to the qualifications, experience, knowledge and other relevant factors that will make an individual fit for the performance of a CF or PCF. 1.14. Probity is a matter of character illuminated by an individual’s past behaviour. It means acting honestly, ethically, with integrity and being financially sound. 4 The Central Bank Reform Act 2010 (Sections 20 and 22) Regulations, 2011 (S.I. No. 437 of 2011), as amended, Central Bank Reform Act 2010 (Sections 20(1) and 22(2A)) Holding Companies Regulations, 2023 (S.I. No. 664 of 2023), as amended, and/or Central Bank Reform Act 2010 (Sections 20 and 22 - Credit Unions) Regulations 2013 (S.I. No. 171 of 2013), as amended. 5 https://www.centralbank.ie/regulation/how-we-regulate/fitness￾probity

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 13 1.15. The Minimum Competency Code 2017 (MCC) sets out minimum professional standards for staff of regulated firms when they are dealing with consumers in relation to certain retail financial products. Part 1 and Part 2 of the MCC specify certain minimum competency standards with which individuals falling within the scope of the MCC must comply when performing CFs. Part 3 of the MCC sets out details on the recognition of qualifications in respect of retail financial products for the purposes of the MCC. 1.16. The aim of the MCC is to ensure that consumers obtain a minimum acceptable level of competence from individuals acting for, or on behalf of, regulated firms in the provision of advice and information, and associated activities in connection with retail financial products. 1.17. The MCC is closely linked with the F&P Standards, in that the MCC specifies certain minimum competencies that individuals must comply with when performing certain CFs6 . Accordingly, where an individual is non-compliant with their obligations under the MCC they also risk not complying with the F&P Standards. 1.18. Similarly, even if the relevant individuals are compliant with the MCC, this does not necessarily equate to compliance with the F&P Standards. Firms must ensure that relevant CF role holders are compliant with both the MCC and the F&P Standards for all relevant roles. 1.19. The Central Bank (Supervision and Enforcement) Act 2013 (Section 48 (1)) Minimum Competency Regulations 2017 impose obligations on regulated firms under Section 48 of the 2013 Act in connection with the MCC to ensure that individuals performing relevant functions on its behalf comply with the standards set out in the MCC. 6 https://www.centralbank.ie/regulation/how-we￾regulate/authorisation/minimum-competency

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 14 Guidance on the Standards of Fitness and Probity 1.20. Since the introduction of the F&P Regime in 2011, the Central Bank has provided detailed Guidance on the F&P Standards, setting out the Central Bank’s expectations on how firms should comply with the requirements of the F&P Regime. 1.21. This new Guidance on the Standards of Fitness and Probity consolidates the existing guidance on F&P Regulations and F&P Standards for firms into one document, and therefore, replaces the Guidance on Fitness and Probity Standards 2023 and the Guidance on Fitness and Probity for Credit Unions 2024. It also replaces the existing “Fitness and Probity – Frequently Asked Questions” for firms and credit unions. 1.22. In addition, this Guidance on the Standards of Fitness and Probity details how other Central Bank requirements interlink with the F&P Regime, e.g. the Corporate Governance Requirements and the Individual Accountability Framework. 1.23. Further, this Guidance on the Standards of Fitness and Probity seeks to provide additional details with regard to a number of specific areas where greater clarity was sought, including: • The use of objective measures (such as specific qualifications, certifications or experience requirements) within the assessment process, • Expectations in terms of the number of directorships that an individual can hold and the time commitments expected, • The role of an executive, non-executive and independent non-executive director, • Identifying, managing and mitigating conflicts of interest, • Temporary Officer appointments, • The Central Bank’s expectations in relation to collective suitability and diversity within management boards, and • The approach to be adopted in relation to considering past events in the context of a PCF application. 1.24. This Guidance on the Standards of Fitness and Probity will be updated periodically as considered appropriate by the Central Bank.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 15 1.25. The Guidance on the Standards of Fitness and Probity represents the Central Bank’s expectations. It does not purport to address every aspect of, or potential issue that may arise in connection with assessments of fitness and probity. 1.26. This Guidance on the Standards of Fitness and Probity is not intended to be exhaustive nor to replace or override any legislative provisions or code. It should be read in conjunction with Part 3 of the 2010 Act and any regulation, code or other legal instrument as the Central Bank may issue from time to time. Other Guidance 1.27. The Central Bank has issued other guidance and guidelines which are relevant to the F&P Regime, which assist firms in complying with their obligations, for example: • Fitness and Probity Gatekeeper Process Manual • Individual Questionnaire, Applications and PCF Roles Guidance • Guidance on the Individual Accountability Framework, • Fund Management Companies – Guidance, • Administrative Sanctions Procedure Guidelines, • Guidance on Fitness and Probity Investigations, Suspensions and Prohibitions; and • Anti-Money Laundering and Countering the Financing of Terrorism Guidelines for the Financial Sector. 1.28. The Central Bank may from time to time issue additional, and/or amend existing guidance and guidelines, as appropriate.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 16 European Legislation 1.29. European legislation for certain industry sectors is applicable in conjunction with the Irish F&P Regime. SSM Framework 1.30. The European Central Bank (ECB) is the authority with competence for fitness and probity assessments of applicants to certain PCF roles for institutions under its direct supervision (i.e. credit institutions or (mixed) financial holding companies), and in the case of licensing or qualifying holding procedures: • The management board of significant institutions7 , • Certain key function holders in significant institutions, and • The management board of all institutions applying for authorisation. 1.31. The significance of an institution is determined by the ECB in accordance with conditions set down in the SSM Regulations8 . 1.32. Under Article 6(4) of the SSM Regulation, responsibility for assessment (and, where appropriate, reassessment) of PCF applications in less significant institutions9 (except in the case of licensing or qualifying holdings) continues to lie with the Central Bank. 1.33. The ECB has issued a Guide to fit and proper assessments with its objective being to explain in detail the policy stances, supervisory practices and processes applied by the ECB, and to specify the ECB’s main expectations as they relate to fit and proper assessments. 7 a bank or financial institution that is under the direct supervision of the ECB 8 Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions 9 a bank or financial institution that is directly supervised by its national competent authority, under the oversight of the ECB

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 17 European Supervisory Authorities Guidelines 1.34. The European Securities and Markets Authority (ESMA) and the European Banking Authority (EBA), both of which form part of the European Supervisory Authorities (ESA), have published guidelines relating to the assessment of the suitability/ adequate knowledge and experience of key role holders for a number of firm types (e.g. banks and investment firms10, crypto-asset service providers11, and credit servicers12). 1.35. These ESA Guidelines, and any other relevant sectoral legislation and guidelines, apply to individuals in CF roles at in￾scope firms, in addition to the standards of fitness and probity, both prior to appointment and on an on-going basis. 10 EBA/GL/2021/06 2 July 2021 11 EBA/GL/2024/09 / ESMA75-453128700-10 12 EBA/GL/2023/09

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 18 The Individual Accountability Framework 1.36. The F&P Regime and the Individual Accountability Framework (IAF) are two aspects of an overall framework that promotes sound governance and conduct and are, therefore, part of the broader corporate governance framework. 1.37. While the IAF introduced certain specific enhancements to the F&P Regime (e.g. the extension of the F&P regime to holding companies and the introduction of certification), it also includes the following elements which are of relevance to the F&P Regime: • The Senior Executive Accountability Regime (SEAR): The SEAR requires in-scope firms13 to set out clearly and fully where responsibility and decision-making lie within the firm’s senior management, and imposes a legal Duty of Responsibility on individuals carrying out PCF roles in such firms. • Conduct Standards: These include the Common Conduct Standards, which are a set of expected standards of conduct which apply to all individuals carrying out CF roles in regulated firms, and the Additional Conduct Standards, which apply to all individuals carrying out PCF roles or any other role that may exercise a significant influence on the firm’s affairs (CF-1), in regulated firms. 13Credit institutions (excluding credit unions), Insurance undertakings (excluding reinsurance undertakings, captive (re)insurance undertakings and Insurance Special Purpose Vehicles), Investment firms which underwrite on a firm commitment basis and/or deal on own account and/or are authorised to hold client assets, and Incoming third country branches ofthese categories of firms.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 19 Interaction between the F&P Regime and the SEAR 1.38. The F&P Regime addresses the suitability of individuals to fulfil relevant roles, and the SEAR focuses on their responsibilities while performing those roles. 1.39. A firm in-scope of SEAR seeking approval for an individual to perform a PCF role is required to submit a ‘Statement of Responsibilities’ with the Individual Questionnaire. The Statement of Responsibilities identifies the individual’s Inherent Responsibilities and sets out the individual’s Prescribed Responsibilities and Other Responsibilities (as defined in the Guidance on the IAF). Interaction between the F&P Regime and the Conduct Standards 1.40. Both the F&P Regime and the IAF contain certain standards that apply to individuals in all firms (referred to as the F&P Standards and the Conduct Standards respectively). Conceptually, there is overlap between the F&P Standards and the Common Conduct Standards (e.g. both sets of standards include requirements in relation to acting with honesty and integrity). However, there are also a number of key distinctions between the sets of standards which support the co-existence of these standards: • The purpose of the F&P Standards is to set a standard that staff in CF roles must meet to ensure that they are sufficiently skilled and have the requisite integrity to be trusted in their roles, while the Conduct Standards govern the conduct of individuals in CF and PCF roles, imposing positive, legal obligations on individuals to act in a particular way. • While the F&P Standards are relevant to assessing individuals prior to their appointment (and on an ongoing basis while performing a role), the Conduct Standards only apply once an individual is in a CF or PCF role.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 20 • In terms of the application of the sets of standards, there are some exemptions14 from the F&P Standards which do not apply to the Common Conduct Standards. 1.41. There are also important interactions and distinctions where a breach of the standards occurs. In this regard, it is important to set out that an individual may breach a Conduct Standard but still comply with the F&P Standards in relation to a role. However, a breach of a Conduct Standard may be relevant to an individual’s suitability for a role which is assessed both prior to appointment and as part of ongoing obligations to comply with F&P Standards. Conversely, an individual may fail to comply with the F&P Standards in relation to their role despite not having breached the Conduct Standards. Such determinations will depend on the facts and circumstances of any specific case. Corporate Governance Requirements 1.42. Corporate governance refers to the system of rules, practices and processes by which a firm is directed and controlled. It is focused on the overall management of the firm, including its structure, decision-making processes and the relationship between stakeholders. In essence, corporate governance aims to ensure that a firm is run in a responsible, transparent and accountable manner. 1.43. The Central Bank is committed to strengthening corporate governance standards and practices across the financial services industry. Sound internal governance arrangements are fundamental if firms are to operate well. Sound corporate governance increases accountability to stakeholders, improves transparency in terms of roles and responsibilities, mitigates risk, and underpins the integrity of an organisation and the market in which it operates. 14 Section 1.5 of the F&P Standards

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 21 1.44. The Central Bank promotes the adoption by industry of minimum standards of sound corporate governance practices, and has issued corporate governance requirements for credit institutions, insurance undertakings, investment firms and market operators, captive insurance and captive reinsurance undertakings (hereafter referred to as the Corporate Governance Requirements). 1.45. The Corporate Governance Requirements set out detailed provisions in relation to, for example, requirements with respect to the composition and role of the board, the role of non-executive and independent non-executive directors, establishment of committees and requirements for certain roles. 1.46. The Corporate Governance Requirements define the role of the board as well as the role of individual directors including that both the role and the responsibilities of the board must be clearly documented, and directors must have “a full understanding of their individual direct and indirect responsibilities and collective responsibilities”. 1.47. Part IV of the Credit Union Act, 1997 includes governance requirements for credit unions, and includes provisions on the composition, operation and functions of the board of directors, together with requirements for certain roles, the establishment of committees, and general governance arrangements in credit unions.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 22 Other Sectoral Codes 1.48. Irish Funds has issued the Corporate Governance Code for Fund Service Providers and the Corporate Governance Code for the Collective Investment Schemes and Management Companies. Enforcement Powers 1.49. The Central Bank has statutory enforcement powers under the F&P Regime as set out in Part 3 of the 2010 Act including the powers of investigation, suspension and prohibition. These powers are supplemented by regulations15 and described in the related guidance. 1.50. The Central Bank has the power to conduct an investigation into the fitness and probity of an individual who performs a CF (including a PCF) role, who formerly performed such a role (subject to certain statutory limitations), or who is proposed to be appointed to a CF (but not a PCF) role where: • There is reason to suspect the individual’s fitness and probity to perform the relevant function, and • An investigation into the individual’s fitness and probity is warranted. 1.51. The Central Bank has powers to gather information in relation to the individual’s fitness and probity, including by way of interview or requests for documents. 1.52. The Central Bank may issue a Suspension Notice to remove an individual from a CF (including a PCF) role for a limited period either during an investigation or following a Prohibition Notice (prior to the Prohibition Notice taking effect). 1.53. At the end of a fitness and probity investigation, the Central Bank may, if it forms the view that an individual is not of 15 Central Bank Reform Act 2010 (Procedures Governing the Conduct of Investigations) Regulations 2023 (S.I. No. 190 of 2023).

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 23 appropriate fitness and probity to carry out specified CF (including PCF) roles, prohibit an individual from performing those roles for a specified period or indefinitely. Prohibitions are imposed in a Prohibition Notice, which may be published to protect the financial system and users of financial services. 1.54. Firms have an ongoing statutory obligation to ensure they do not allow an individual to perform a CF unless the firm is satisfied that the individual complies with the standards of fitness and probity and the individual has agreed to comply with those standards. 1.55. Failure to comply may result in an investigation and the imposition of sanctions by the Central Bank under the Administrative Sanctions Procedure on a firm and/or individuals concerned.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 24 Chapter 2 Population of CFs and PCFs

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 25 Approach to identifying the CF population Identification by the Firm 2.1. It is the responsibility of the firm to determine whether an individual is performing a CF role. In doing so, firms should assess the role and functions of each individual in line with the definitions prescribed in the F&P Regulations. 2.2. Table A and Table C (in Appendix 1) set out the individual CF roles prescribed in the F&P Regulations. In summary, the CF roles in relation to a regulated financial service provider include: • Exercising significant influence on how the affairs of a firm are conducted, • Ensuring, controlling or monitoring the compliance of a firm with its relevant obligations, or • The provision of a financial service. 2.3. The relevant CF roles in relation to a holding company (Table B in Appendix 1) include: • Exercising significant influence on how the affairs of a firm are conducted, or • Ensuring, controlling or monitoring the compliance of a firm with its relevant obligations. 2.4. There are additional CF roles in relation to credit unions that are also authorised as retail intermediaries as set out in Table D in Appendix 1. Roles Captured by CF-1: Exercising Significant Influence 2.5. Any individual who is considered to exert a significant influence on the firm should be considered a CF-1. The type of roles that could be considered to exert a significant influence are wide-ranging and will vary from firm to firm. Accordingly,

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 26 the F&P Regulations are not prescriptive in this context, but the Central Bank anticipates that CF-1 roles holders are relatively senior individuals in firms. In this regard, and on the basis that PCFs are a subset of CFs, and given the nature and seniority of the roles, all PCFs are considered CF-1s. 2.6. In addition, there are other non-PCF roles which should be captured by CF-1. For example, in the context of credit unions, the board of directors, the risk management officer16 , the credit committee, the credit control committee, the membership committee, the nomination committee and the management team would fall within the scope of CUCF-1. 2.7. The roles listed above are not exhaustive. It is a matter for the firm to determine any additional roles that fall within CF-1 or CUCF-1. In this regard, the designation of a company secretary as a CF-1 should be determined on a case-by-case basis, where the functions carried out by the individual enable them to exercise a significant influence on the conduct of the affairs of the firm. Where a firm determines that the role carried out by their company secretary is purely the administration of company law matters, such individuals need not, for those activities alone, be designated as CF-1. Roles Captured by CF-2: Ensuring, Controlling or Monitoring Compliance 2.8. Noting the role of CF-2 is compliance-related, and given that PCFs are a subset of CFs, all compliance-focused PCF roles are considered CF-2 (as well as CF-1s). Examples include PCF￾12 (Head of Compliance), PCF-13 (Head of Internal Audit) and PCF-52 (Head of Anti-Money Laundering and Counter Terrorist Financing Compliance), as well as Head of Internal Audit (CUPCF-4). 2.9. In addition, there are other non-PCF compliance-related roles that the Central Bank expects to be captured by CF-2. For example, the functions commonly performed by a Money Laundering Reporting Officer would be considered to fall under the category of CF-2. In the context of credit unions, it 16 For credit unions with assets of less than €100 million

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 27 is expected that the board oversight committee, the compliance officer, the money laundering reporting officer and the internal audit function fall within CF-2. 2.10. However, as with CF-1, the above list is not definitive and there may be other roles which are relevant for inclusion as CF-2. In this regard, it should be noted that the designation as a CF is dependent on the functions performed by the individual rather than their job title or physical location in the organisation structure. Therefore, any individual who may be considered to be “ensuring, controlling or monitoring compliance” in the firm may fall under the scope of CF-2, as opposed to individuals working in the designated “compliance unit” only. CF-3 to CF-9: Provision of a Financial Service 2.11. The roles captured by CF-3 to CF-9 are those which relate to the provision of a financial service to a customer. While CF-3, CF-4 and CF-8 are broad, wide-ranging roles likely to apply across all financial services sectors, other CFs relate to specific sectors e.g. CF-5 and CF-6 relate specifically to insurance and reinsurance contracts, and CF-9 is relevant only in the context of insurance or reinsurance mediation. CF-7 specifically focuses on those roles that involve the management or supervision of individuals in roles which constitute CF-3 to CF-6. 2.12. It is worth noting that, in addition to the F&P Standards, the Central Bank has issued a MCC as set out in Chapter 1. The MCC sets out statutory minimum professional standards for staff of regulated firms when they are dealing with ‘consumers’ in relation to certain retail financial products. Definition of Terms Used (CF-10 – CF-11) 2.13. In order for a function to fall within the definition of CF-10 or CF-11, the function must relate to the provision of a financial service. 2.14. Property in CF-10 is “property of the customer”, whether the property is held in the name of the customer or some other individual.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 28 2.15. CF-11 concerns a function in relation to the provision of a financial service that is likely to involve the individual responsible for the performance of the function dealing in or with property on behalf of the regulated financial service provider or providing instructions or directions in relation to such dealing. This could include, for example, stocks/shares held by a stockbroker as principal. Approach to Identifying the PCF Population Identification by the Firm 2.16. The full list of PCF roles is set out in the F&P Regulations. A firm is not required to create a PCF for the sole purposes of complying with its obligations under the F&P Regime where the role did not previously exist. 2.17. A firm should review its roles and determine whether any of the roles would meet the PCF roles as listed in the relevant F&P Regulations. Firms should apply substance over form when reviewing such roles and be mindful that it is the function, rather than the job title of the individual performing that function, that determines which PCF category, if any, the role falls under. Thus, based on a firm’s size and/or existing governance structure, it may be the case that only one/two roles require pre-approval. 2.18. References in the F&P Regulations to a title commonly used for an individual who performs a certain function (e.g. Head of Finance, Head of Compliance etc.) should be taken to refer to the functions commonly performed by an individual with such a title. 2.19. Where an individual has been identified as a PCF and is taking formal extended leave, e.g. maternity leave, the individual does not need to resign their PCF role or reapply when they return to their role.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 29 Definition/Operation of Specific PCFs 2.20. While it is the responsibility of the firm to determine whether an individual is performing a PCF role, the following guidance has been prepared to assist relevant firms in considering whether their internal roles meet the definition for certain PCF roles, that are not clear-cut and/or in existence in all firms. Guidance has not been provided for all PCF roles on the basis that many roles are well understood and are common in many organisations. PCF-8 Chief Executive Officer 2.21. The Chief Executive Officer (CEO) is the top executive responsible for the regulated financial service provider (other than credit unions), with ultimate executive responsibility for the operations, compliance and performance of the regulated financial service provider (other than credit unions). PCF-8 applies even where a regulated financial service provider (other than credit union) is headed by a General Manager rather than a CEO. Individuals holding PCF-8 should also hold PCF-1 (Executive director) if the role holder is also a member of the board. PCF-16 Branch Manager of branches outside Ireland 2.22. PCF-16 applies where the business arising from the branch amounts to 5% or more of any of: a) The assets of the regulated financial service provider (other than credit union), or b) The revenues of the regulated financial service provider (other than credit union), or c) The gross written premium of the regulated financial service provider (other than credit union), as applicable. 2.23. The onus is on the regulated financial service provider (other than credit unions) to review the branch manager function to determine whether it meets the definition of PCF-16. The materiality threshold ensures that only managers of outgoing

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 30 branches where the branch meets or exceeds the threshold will require pre-approval. 2.24. In considering the applicability of PCF-16, regulated financial service providers (other than credit unions) should take a practical approach in determining the appropriate frequency of any related assessment. The Central Bank understands that branches can use different booking models; however, the use of specific booking models should not affect the application of the definition. The definition should be applied in the spirit it is intended, i.e. to capture managers of branches where the branch meets or exceeds the threshold. Regulated financial service providers (other than credit unions) should document any related assessment, which must be made available to the Central Bank on request. After an individual has been approved and is performing the role, that individual remains a PCF until such time as they leave their role, even if there are fluctuations above and below the threshold post-approval. PCF-42 Chief Operating Officer 2.25. The Inherent Responsibility of the Chief Operating Officer (COO) is defined in the SEAR Regulations as ‘Overall responsibility for managing the internal operations of the firm’. Accordingly, the Central Bank recognises that the role of the COO could encompass a wide range of duties and responsibilities. It is also anticipated that this role would be held by a senior individual with a direct reporting line to the CEO. PCF-49 Chief Information Officer 2.26. The Chief Information Officer (CIO) role is a function that is likely to enable the individual responsible for its performance to exercise a significant influence on the conduct of the affairs of a regulated financial service provider (other than credit unions) and will typically apply to the most senior individual at the regulated financial service provider (other than credit unions) with responsibility for IT matters. This may be referred to as ‘Chief Technology Officer’ or other similar role titles in some instances.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 31 2.27. While not limited to the following circumstances, the Central Bank expects that the CIO role would likely apply where: a) It is warranted based on the risk profile of the entity, or b) Information and communication technology is a key enabler or core element of the regulated financial service provider’s (other than credit unions) business model. The criterion “Information Technology is a key enabler or core element of the regulated financial service provider’s business model” is not intended to refer to all regulated financial service providers (other than credit unions) solely based on the use of technology within the regulated financial service provider (other than credit unions). In the context of this criterion, the CIO role is applicable where the size, nature and complexity of the regulated financial service provider (other than credit unions) warrants such a role and where failure of the regulated financial service provider’s (other than credit unions) ICT would have an adverse effect on one or more of the following: • The provision of critical services to their customer base, taking into consideration potential customer detriment it may cause, • The ability of the regulated financial service provider (other than credit unions) to meet its regulatory obligations, or • The overall stability of the financial system in Ireland. PCF-50/PCF-54/PCF-55 Head of Material Business Line 2.28. In line with the approach to PCF-16, the existence of the Head of Material Business Line role is determined by the use of quantitative criteria. The Head of Material Business Line applies in the case of credit institutions, (re)insurance undertakings and investment firms. The Head of Material Business Line for credit institutions is an individual who has significant influence over the performance of a material business line, e.g. oversees the performance of that business, and the business in question satisfies either of the following quantitative criteria:

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 32 a) Has gross total assets equal to or in excess of €10 billion, or b) Accounts for 10 per cent or more of the credit institution’s gross revenue. Similarly, the Head of Material Business Line for investment firms is an individual who has significant influence over the performance of a material business line, e.g. oversees the performance of that business, and the business in question satisfies either of the following quantitative criteria: a) Has gross total assets equal to or in excess of €5 billion, or b) Accounts for 10 per cent or more of the investment firm’s gross revenue. The Head of Material Business Line for insurance undertakings is an individual who has significant influence over the performance of a material business line, e.g. oversees the performance of that business, and the business in question satisfies either of the following quantitative criteria: a) Has gross total technical provisions (whether positive or negative) equal to, or in excess of €10 billion, or b) Accounts for 25 per cent or more of the insurance undertaking’s gross earned premium, if that gross earned premium is above €1 billion per annum. PCF-51 Head of Market Risk 2.29. A risk-based approach will be adopted whereby the Head of Market Risk role will only apply where the level of market risk is deemed to be material by the Central Bank. 2.30. The role will only apply in credit institutions whereby the market risk of the credit institution satisfies either of the following quantitative criteria17: a) €500m of market risk (including Credit Valuation Adjustment) risk weighted assets, or b) €100bn of notional derivatives traded. 17 As reported in quarterly COREP and FINREP regulatory reporting.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 33 PCF-52 Head of Anti-Money Laundering and Counter Terrorist Financing Compliance 2.31. The Central Bank expects firms to appoint a Member of Senior Management with primary responsibility for implementing, managing and overseeing compliance with AML/CFT measures, where such an appointment is proportionate to the nature, scale and complexity of a firm’s activities. 2.32. This is a key measure in order to protect the financial system by ensuring that firms do not attach low priority to AML/CFT issues. A lack of buy-in or understanding of AML/CFT matters at Senior Management level can result in a corporate culture that pursues profits at the expense of a robust compliance framework that is backed by sufficient resources and training. Accordingly, the Central Bank expects that where a firm is exposed to a significant degree of inherent ML/TF risk, the firm should consider if it is appropriate for the Member of Senior Management to be a member of the Board. 2.33. Where no such appointment has been made by a firm, the Central Bank may, under Section 54 (8) of the CJA 2010, direct the firm to do so. In considering whether such a direction is necessary, the Central Bank will have regard to the nature, scale and complexity of the firm’s activities, and in particular the inherent ML/TF risks to which the firm is exposed. The obligation set out in Section 54(8) does not apply to an individual that carries on business alone as a designated person. 2.34. Where a firm has decided that it is not necessary to appoint a Member of Senior Management, having regard to the nature, scale and complexities of the firm’s activities, it should record in detail its rationale for such decision. In such circumstances, the firm must ensure that it remains in compliance with all obligations under the CJA2010. This includes ensuring that all matters requiring approval by senior management are approved at the appropriate level.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 34 Central Bank Declaration of a PCF 2.35. While typically it is the responsibility of the firm to determine whether an individual is performing a PCF role, the Central Bank may declare in writing18 to a regulated firm that a function performed by, for, or on behalf of the regulated firm is a PCF if: (a) The individual who performs the function is concerned in the management of the regulated firm, (b) The function is not prescribed as a PCF in the F&P Regulations, and (c) No other individual in the regulated firm performs a PCF. Temporary Officers 2.36. Firms should have adequate succession/contingency plans in place for all of their PCF roles. The Central Bank recognises that there may be circumstances where a PCF role becomes vacant and the firm may wish to appoint a person to fulfil that role, on a temporary basis. In such circumstances, the firm may appoint a suitable individual as a ‘Temporary Officer’ to perform that role for a period of no more than six months, subject to the prior written agreement from the Central Bank and the firm meeting the requirements, as set out in paragraph 2.41. The Central Bank will contact the firm to confirm agreement or should the Central Bank have any concerns with the proposed temporary officer appointment. 2.37. Where a Temporary Officer is appointed to fill a role that had been permanently vacated, a firm must submit a PCF application in respect of the role to the Central Bank within three months from the date of the appointment. Such a PCF application may be in respect of the Temporary Officer fulfilling the role on a permanent basis, or it may be in respect of another person. If no PCF application is submitted in respect of the role within this period, the agreement of the Central Bank will lapse three months after the date of the 18 Under Section 22(8) of the Central Bank Reform Act 2010.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 35 agreement, and the Temporary Officer will no longer be permitted to fill the role, save in exceptional circumstances. 2.38. Where a PCF application in respect of the role filled by the Temporary Officer is submitted within three months, the Temporary Officer may continue to hold the role until such time as a decision has been made by the Central Bank on the PCF application for that role within the six-month period. 2.39. Where the previous PCF role holder returns to the role following a temporary absence, their PCF approval remains valid and another application will not be required in this case. 2.40. Temporary Officers are CF1s and are subject to the F&P Standards and the Common and Additional Conduct Standards. 2.41. In order to make a Temporary Officer appointment, a firm must notify the Central Bank in writing. Such notification must include the following: a) information on the circumstances which have given rise to the need for the Temporary Officer appointment, b) confirmation that the proposed Temporary Officer has agreed to comply with the F&P Standards and will continue to do so whilst performing the PCF role, c) for how long the appointment of the Temporary Officer is requested, d) confirmation of the succession plans for the role where appropriate , noting there may be circumstances whereby the original PCF resumes the role within the permitted period e) confirmation that the firm has satisfied itself that the person proposed to perform a role as Temporary Officer is suitable to perform that role for the temporary period, f) confirmation that the firm has satisfied itself on reasonable grounds that the person complies with the F&P Standards and is in a position to certify same. 2.42. A notification for the appointment of a Temporary Officer will not be accepted as part of an authorisation application where PCF IQ applications must be submitted.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 36 2.43. Where a person is accepted by the Central Bank as being suitable to fill a role on a temporary basis, it does not imply that they are fit and proper to perform the PCF role on a permanent basis, or that they are competent to perform all aspects of that role. 2.44. Consecutive or cumulative Temporary Officer appointments to a specific PCF role for a period of over 6 months will not be permitted, save for in exceptional circumstances. Should a vacancy not be filled within the six-month period, firms must then engage directly with the Central Bank. Exemptions from the F&P Standards 2.45. The Central Bank has deemed it appropriate to exempt some CFs from the application of the F&P Standards, as set out in section 1.5 of the F&P Standards. The application of the exemptions, and the related criteria for the use of each exemption, is summarised in Table 1. Table 1 Exemption Purpose/Criteria for use For regulated financial service providers (other than credit unions) A function which is solely concerned with acting in accordance with a written set of instructions in the form of a script Exempts call centre staff acting under the instruction of managers/supervisors at the call centre who are responsible for ensuring proper process and information to customers. Outsourced CFs, and PCFs (and related Central Bank pre￾approval), when those functions have been outsourced to a regulated entity Exempts CFs and PCFs where:

1. There is in place a written agreement between the regulated financial service provider (other than credit union) and a separate financial service provider for the carrying on of that function by that other individual on behalf of the regulated financial service provider (other than a credit union); and (2) That other financial service provider (other than a certified person within the meaning of Section 55 of the Investment Intermediaries Act

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 37 1995) is regulated for a similar business to that conducted by the regulated financial service provider (other than credit union), either: i) by the Central Bank, or ii) by an authority that performs functions in an EEA country that are comparable to the functions performed by the Central Bank, or iii) by an authority that performs functions in a non-EEA country that are comparable to the functions performed by the Central Bank. (P)CFs benefitting from this exemption from the F&P Standards will remain subject to the provisions of Part 3 of the Act and thus can be investigated, suspended or prohibited where they do not meet the requirements of the 2010 Act itself. Inward freedom of services providers Exempts inward cross-border providers as passporting allows a regulated firm registered in the EEA to conduct business in any other EEA state without the need for further authorisation from each host state. EEA branches established in the State Exempts inward EEA branches as passporting allows a regulated firm registered in the EEA to conduct business in any other EEA state without the need for further authorisation from each host state. An individual in a group entity who may be able to exert a significant influence over the performance of CFs or PCFs in the regulated financial service provider (other than credit unions) by virtue of a reporting line Provides an exemption intended for use in relation to specific matrix management structures. However, in the main, it is not anticipated that individuals in group entities will ordinarily exercise significant influence on the conduct of the subsidiary/related regulated financial service provider’s (other than credit unions) affairs and as such constitute CF-1 role holders of the relevant regulated financial service provider (other than a credit union).

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 38 For credit unions: Outsourced CFs and PCFs when those functions have been outsourced to a regulated entity Exempts CFs and PCFs where:

1. There is in place a written agreement between the credit union and a separate financial service provider for the carrying on of that function by that other individual on behalf of the credit union, and (2) That other financial service provider (other than a certified person within the meaning of Section 55 of the Investment Intermediaries Act
2. is regulated for a similar business to that conducted by the credit union, either: i) by the Central Bank, or ii) by an authority that performs functions in an EEA country that are comparable to the functions performed by the Central Bank, or iii) by an authority that performs functions in a non-EEA country that are comparable to the functions performed by the Central Bank. (P)CFs benefitting from this exemption from the F&P Standards will remain subject to the provisions of Part 3 of the Act and thus can be investigated, suspended or prohibited where they do not meet the requirements of the 2010 Act itself. 2.46. The exemptions from the F&P Standards as outlined above do not equate to an exemption from the F&P Regime in full. It is important to note that where a CF or a PCF benefits from one of the exemptions from the application of the F&P Standards, they will, nevertheless, remain subject to Part 3 of the 2010 Act (e.g. the powers of investigation, suspension and prohibition) and any code or order issued thereunder, including the MCC. In addition, it should be noted that equivalent exemptions have not been introduced in the context of the Conduct Standards and accordingly, these apply to all CFs.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 39 Outsourcing 2.47. In this guidance, outsourcing19 means a written arrangement of any kind between a regulated financial service provider and a service provider who is a natural or legal person (whether regulated or unregulated) whereby the service provider performs a CF or PCF which would otherwise be performed by the regulated financial service provider itself. Outsourcing of a CF to an unregulated Entity 2.48. Where the CF(s) is outsourced to an ‘unregulated entity’, the unregulated entity performing the outsourced activities must: • Identify the individuals who will perform the CF, and assess whether those individuals are compliant with the F&P Standards, • Obtain the written agreement of those individuals to comply with the F&P Standards, • Provide written confirmation to the regulated financial service provider that those individuals performing CFs are compliant with the F&P Standards, and that those individuals have agreed in writing to comply with them, • Furnish the regulated financial service provider with sample documentation as to how compliance with the F&P Standards is adhered to. 2.49. In this subsection “unregulated entity” means an entity (including a certified person within the meaning of Section 55 of the Investment Intermediaries Act, 1995) that is not regulated either: i) By the Central Bank, or ii) By an authority that performs functions in an EEA country that are comparable to the functions performed by the Central Bank, or iii) By an authority that performs functions in a non￾EEA country that are comparable to the functions performed by the Central Bank. 19 The term ‘outsourcing’ and ‘delegation’ may be used interchangeably consistent with the Central Bank of Ireland’s Cross Industry Guidance

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 40 2.50. Notwithstanding that a regulated firm has entered into an outsourcing arrangement with an unregulated entity for the performance of a CF, the regulated firm: • Remains responsible for compliance with its obligations under Section 21 of the 2010 Act, including in relation to certification, and • Must satisfy itself on “reasonable grounds”, and certify, that individuals performing CFs comply with the standards of fitness and probity and that those individuals have agreed to comply with the standards of fitness and probity. 2.51. If a CF is outsourced to an unregulated entity, the unregulated entity must be able to identify the individuals who will perform the CFs and assess whether those persons are compliant with the standards of fitness and probity. In such cases, the outsourced service provider should be able to provide written confirmation to the regulated firm that the individuals performing CFs are compliant with the standards of fitness and probity and that the individuals have agreed to be bound by them. 2.52. Firms are required to maintain an up-to-date register of individuals in CF roles and the specific CF role performed by those individuals. Outsourcing of a PCF to an Unregulated Entity 2.53. Where the performance of a PCF is outsourced to an unregulated entity, the firm concerned must ensure the individual is fit and proper and obtain the approval of the Central Bank before appointing the unregulated entity to perform the PCF on its behalf. The written outsourcing arrangement must also name the individual within the unregulated entity who will be responsible for performing the PCF and individuals performing a PCF under such an outsourcing arrangement must comply with the standards of fitness and probity.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 41 2.54. Notwithstanding that a regulated firm has entered into an outsourcing arrangement with an unregulated entity for the performance of a PCF, the regulated firm: • Remains responsible for compliance with its obligations under Section 21 of the 2010 Act, including in relation to certification, and • Must satisfy itself on “reasonable grounds”, and certify, that individuals performing CFs comply with the standards of fitness and probity and that those individuals have agreed to comply with the standards of fitness and probity. Exclusion of Certified Persons 2.55. Regulated financial service providers cannot avail of the outsourcing exemption when outsourcing PCFs or CFs to certified persons20 . 2.56. Part 3 of the 2010 Act and MCC apply to certified persons. Performing a (P)CF Outside the State 2.57. The F&P Regulations do not limit (P)CFs to functions performed in the State. Accordingly, a person performing a (P)CF at a location outside of the State on behalf of a regulated financial service provider will be subject to Part 3 of the 2010 Act. 2.58. While (P)CF roles performed outside the State are captured by the F&P Regime, regulated firms are expected to demonstrate a sufficient degree of substantive presence in the State. For example, this should include the management of key risks from within the entity and the making of key decisions by those within the entity and not elsewhere in the group. 20Within the meaning of Section 55 of the Investment Intermediaries Act 1995

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 42 Chapter 3 Fitness and Probity Standards Due Diligence

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 43 Standard of Fitness 3.1. Section 3 of the F&P Standards relates to fitness and requires an individual to be competent and capable. An individual shall have the qualifications, experience, competence and capacity, including sufficient time commitment, appropriate to the relevant function, and taking into account matters such as nature, scale, complexity, risk profile, organisation structure, target market etc. Similar functions in different firms will entail different responsibilities and different levels of required knowledge, expertise and time commitment. 3.2. A firm should fully understand what qualifications, experience, knowledge, time commitment and other relevant factors will make an individual fit for the performance of a particular function. 3.3. The requirements of the CF may also be dictated by the roles undertaken by individuals in other CF roles in an organisation. An individual considered fit for a particular CF role within a firm may not be considered fit for another CF role with different responsibilities, or for a similar CF within another firm. Conversely, an individual considered unfit for a particular CF in a particular firm may be considered fit in different circumstances, e.g. in a different CF role. 3.4. Fitness also includes ensuring that individuals shall not allow the conduct of concurrent responsibilities to impair their ability to discharge the duties of the relevant function or otherwise allow conflicts of interest to arise in carrying out their role.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 44 Standard of Probity 3.5. Individuals proposed for CF or PCF roles must be honest, diligent and independent-minded and must act ethically and with integrity. 3.6. Probity is a matter of character illuminated by an individual’s behaviour. In general, where an individual is found not to be an individual of probity due to a lack of honesty, integrity or ethical judgement, that individual may not be suitable for any CF or PCF. 3.7. The principle of proportionality cannot be applied in relation to probity, and the assessment shall be conducted for all firms in an equal manner. Standard of Financial Soundness 3.8. In assessing an individual’s financial soundness, the following factors which could compromise an individual’s ability to carry out the role should be considered: • The individual has defaulted on any payment due arising from a compromise or scheme of arrangement with their creditors or made an assignment for the benefit of their creditors, • The individual is subject to a judgment debt which is unsatisfied, either in whole or in part, whether in the State or elsewhere, • The individual is or has been the subject of a bankruptcy petition, whether in the State or elsewhere, • The individual has been adjudicated a bankrupt and the bankruptcy is undischarged, whether in the State or elsewhere, or • The individual was a director of an entity that has been the subject of insolvency. 3.9. The Central Bank considers that the existence of these factors may have an impact on an individual’s reputation, integrity

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 45 and honesty. It is not the case that firms are required to prove that an individual is financially sound, rather firms should perform checks to establish that none of the above factors impact an individual’s ability to perform the role, e.g. a judgement check/search of publicly available information that could call into question the financial soundness of an individual. 3.10. In accordance with Section 72 of the Credit Union Act, 1997, any person who has been declared bankrupt and whose bankruptcy still subsists, or who, in the previous 10 years, has been convicted of an offence in relation to a credit union or an offence involving fraud or dishonesty may not hold a CF within a credit union. Due Diligence Legal Obligation of a Firm 3.11. The 2010 Act prescribes a continuing obligation on firms in relation to fitness and probity due diligence. Firms are responsible for ensuring that individuals performing CFs meet the standards of fitness and probity, both prior to appointment and on an on-going basis. 3.12. This obligation includes the following key steps: • Due Diligence/Screening: firms should conduct initial assessments of individuals to determine their suitability for a specific role. This will include, for example, reviewing CVs, conducting interviews and verifying qualifications. • Background checks: firms should perform comprehensive background checks, which include criminal record checks, where possible, credit checks and reference checks. The depth and scope of these checks depend on the seniority of the roles and the nature scale and complexity of the firm.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 46 • Documentation and record keeping: firms should maintain detailed records of their due diligence processes, including the information collected, assessments conducted, and decisions made. • On-going monitoring: firms should establish mechanisms for monitoring individuals’ ongoing fitness and probity, such as regular performance reviews, mandatory training and self-declaration of any changes in personal circumstances that may affect their suitability for the role. In some circumstances, self-certification will be sufficient and further detail on applicable circumstances is provided in Appendix 4. 3.13. In complying with Section 21 of the 2010 Act, the Central Bank expects firms to consider the responsibilities of the specific function and to determine the specific competencies, and appropriate standard of fitness and probity that should be expected of an individual performing that specific CF in the firm. 3.14. Firms should holistically consider the outcome of a due diligence assessment and draw an overall conclusion on the individual’s suitability on the basis of this assessment. 3.15. For illustration purposes, a table at Appendix 4 sets out examples of due diligence required. The table is not intended to be exhaustive and does not supersede the due diligence requirements set out in this guidance. 3.16. While this guidance sets out the Central Bank’s expectations in relation to due diligence, it does not purport to address every possible check and, as such, firms should apply an approach consistent with the nature, scale and complexity of the firm and the roles therein. 3.17. Matters such as scale, complexity, risk profile, organisation structure, target market and so on, are unlikely to be the same within any two organisations. Different functions will entail different responsibilities and different levels of knowledge and expertise. For this reason, this guidance cannot point to

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 47 conclusive knowledge or expertise that is required for a particular function. The firm, using its own unique knowledge of the CF, and taking into account all relevant matters (including those listed above), can make the assessment as to what makes an individual fit and proper to perform, or continue to perform, the specific CF in that firm. This guidance sets out due diligence that the Central Bank expects would be undertaken by firms when assessing compliance with the standards of Fitness and Probity. In all cases, it is for the firm itself to assess the information and exercise judgment to determine whether an individual is fit and proper to carry out a particular CF. 3.18. Where an individual performs more than one CF, and more than one set of specific competencies and the appropriate Standard of Fitness and Probity applies in respect of the exercise of those multiple CFs, the higher standard is the relevant standard, for the purposes of due diligence. 3.19. If a firm has insufficient information available to enable it to conclude on reasonable grounds that the standards of fitness and probity are being complied with, particularly if due to lack of co-operation by the individual, the standards of fitness and probity may not be met. The firm should bring this to the attention of the individual and allow them an opportunity to provide the required information. 3.20. When considering compliance with Section 21 of the 2010 Act, the Central Bank will assess the firm’s analysis of what specific competencies and appropriate standards of fitness and probity are required for the performance of a relevant function or functions. In addition, the Central Bank will consider the steps that the firm has taken to satisfy itself and certify that the individual performing the relevant CF is competent, and has the appropriate standard of fitness and probity to perform that CF.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 48 Fitness - Due Diligence to be undertaken by a Firm 3.21. The Central Bank expects firms to undertake due diligence when assessing an individual’s fitness to perform, or continue to perform, a particular CF role, as set out below. 21 In carrying out the due diligence, where relevant, firms should also consider the objective measures in Chapter 4. i) Evidence of professional qualification(s): Where the CF requires a specific professional qualification, the firm should satisfy itself that the individual has that specific qualification(s) (e.g. actuary, accountant, lawyer, etc.) by obtaining a copy of the certificate/transcript/record evidencing the qualification. Where the individual is required to be registered with a professional body, the firm should require and maintain a copy of the individual’s licence or certificate to practise (howsoever described), and where that licence/certificate is renewed on an annual (or more or less frequent) basis, the firm should require a copy of the most recent renewal. The Central Bank expects firms to obtain copies of qualifications only where the firm has determined that those qualifications are relevant to the exercise of the CF, e.g. where a job specification requires that an individual has five years’ post-qualification experience as a lawyer, for example, the Central Bank expects the firm to obtain evidence of the professional legal qualification and post-qualification experience. ii) Record of previous experience: Where an individual demonstrates skills and experience gained through a previous role (for example, through the individual’s CV, or the firm’s interview process), the firm 21 For credit unions the functions of certain CFs are set out in legislation, e.g. the functions of the board of directors are set out in Section 55 of the Credit Union Act, 1997, and where this is the case the individual’s competence to perform these functions should be included in the assessment of competence.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 49 should assess and document how the individual’s performance in that role equips that individual with the expertise and experience necessary for the performance of the current function. Similarly, the firm should maintain a record of the skills/competencies they expect the individual role holder to possess for that role. The Central Bank’s Individual Questionnaire requests details of the individual’s professional and other experience within the last 10 years, qualifications held and professional memberships, along with other experience prior to the last 10 years, which is relevant to the application and suitability of the individual. iii) Record of experience gained outside the State: Where some or all of the experience is gained outside the State, the firm should consider the extent to which the individual can demonstrate competency that relates specifically to the function within the State, i.e. does the individual have a clear full understanding of the regulatory and legal environment, and has the market knowledge appropriate to the relevant function? The firm should maintain a record of this consideration. iv) Record of interview and application: Where the firm uses an interview process to assess competence and capability (such as skills and experience), it should maintain a record of the interview to evidence this. Similarly, where a written application was submitted for the particular CF, this should be maintained on file22 . v) References: The Central Bank expects firms to make all reasonable efforts to obtain references from former employers or other relevant individuals. The Central Bank expects firms to maintain evidence of this correspondence. 22 Please also see Chapter 5 on the retention of data in relation to certification.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 50 Where the firm is unable to obtain a reference(s) for whatever reason, it must record the steps that it has taken to obtain the reference(s). The firm must also record how, in the absence of the reference, it has satisfied itself that the individual is competent and suitable to perform the CF. vi) Concurrent Responsibilities, Conflict of Interest and Time Commitment: (a) Directorships: in relation to individuals performing roles designated as PCF, CF-1 or CF-2 in the F&P Regulations, the firm should require the individual to confirm whether or not they have any other directorships. Where the individual performing the CF or PCF has other directorships, the firm should seek confirmation from that individual that the performance of their responsibilities in other directorships will not adversely affect their ability to perform the CF or the PCF, prior to appointment and as part of the certification process. (b) Conflict of interest: firms should identify actual or potential conflicts of interest in accordance with the firm’s conflict of interest policy and assess their materiality. The firm should ensure that any existing or potential conflicts of interest are adequately mitigated or managed and will not adversely affect on the individual’s ability to perform the CF, prior to appointment and as part of the certification process. (c) Directors (Credit Unions): Section 53(5) of the Credit Union Act, 1997 requires that each director of a credit union shall ensure that they have sufficient time to devote to the role of director and the responsibilities associated with that role. (d) Other employment: the firm should ensure that the individual performing the CF does not have other employment which interferes with, or create conflicts in relation to, the exercise of the CF. The firm should require the individual to self-certify in writing that the individual is capable of conducting the relevant function, including that the individual has adequate

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 51 time to perform those functions having regard to those other potential concurrent responsibilities, prior to appointment and as part of the certification process. vii) Evidence of compliance with the MCC, where relevant: Where an individual is performing or proposes to perform a CF role the performance of which is subject to the MCC, that individual can be assessed as having the appropriate qualifications or competence to conduct that CF where compliant with the MCC. The regulated firm should satisfy itself that the individual has the recognised qualification(s) by obtaining a copy of the certificate/transcript/records evidencing the qualification. The records to be retained in relation to grandfathered individuals are set out in the MCC. The MCC also contains requirements concerning the monitoring of compliance with ongoing Continuing Professional Development (CPD) requirements. viii) Evidence of CPD, where relevant: Where maintenance of a qualification is dependent on completing CPD, the firm should satisfy itself that the individual is compliant with the particular CPD requirements. Where an individual must maintain up-to-date CPD in order to renew their practising certificate, evidence of the renewal of that practising certification will be regarded as sufficient to evidence CPD for the purposes of these Standards of Fitness and Probity.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 52 Probity - Due Diligence to be undertaken by a Firm 3.22. In accordance with Section 21 of the 2010 Act, firms are required to undertake the appropriate due diligence when assessing an individual’s probity, both prior to appointment and as part of the certification process, including, but not limited to, the following actions: i) Seek and obtain signed written confirmation from the individual performing or proposing to perform a CF as to whether or not any of the circumstances set out in Section 4.1 and Section 5.2 of the F&P Standards, apply to that individual; ii) In relation to Section 4.1(c) of the F&P Standards, refer to the Central Bank’s website and those of other regulatory authorities (where available) to confirm for their own records that the individual has not been the subject of sanction or other regulatory action; iii) In relation to 4(1)(f) of the F&P Standards, check the Companies Registration Office records for restrictions or disqualifications from acting as a Company Director; iv) In relation to Section 4.1(j) of the F&P Standards, seek confirmation from those performing CFs as to whether, to the best of their knowledge, any of the matters set out in Section 4.1(j) have arisen in relation to that person; v) In relation to Section 5.2(b) of the F&P Standards, check against publicly available sources whether a judgment debt has been registered against an individual. Publicly available resources may include, for example, Experian, All Ireland Gazette or Stubbs Gazette. Where the individual has lived outside the State for more than six months in the previous five years, the firm should request that the individual provide a check from a publicly available source in relation to judgment debts from that other jurisdiction(s). 3.23. Where it is confirmed that one or more of the circumstances set out in Section 4.1 or Section 5.2 apply:

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 53 i) The individual must be in a position to demonstrate that their ability to perform the CF (s) is not adversely affected to a material degree by that matter(s). ii)The firm should require, from the individual concerned, underlying documents relevant to the matter (for example, a final decision or report and/or key correspondence). The firm should inform the individual concerned that failure to provide information requested by the firm and which is relevant to the matter may result in the firm being unable to satisfy itself, and therefore certify, that the individual complies with, or continues to comply with, the standards of fitness and probity. iii) The firm should make an assessment based on all of the information received as to whether the matter is material to the performance of the CF. In making its assessment, a firm should also take into account the matters referred to in the section below entitled “Criminal, Civil, and Regulatory Actions.” A firm may decide that it is not material, and may conclude that, in the opinion of the firm, the individual complies with, or continues to, comply with the standards of fitness and probity. The firm should document this assessment. iv) If it is considered that the matter is material, the firm should make all reasonable enquiries arising on foot of the information provided by the individual, such as, where relevant, contacting third parties for further information, e.g. former employers, regulatory authorities, etc. v)A firm is not required to remove or suspend an individual from acting in a CF solely on the basis that one or more of the matters listed in Section 4.1 or Section 5.2 of the F&P Standards may have occurred. For example, in 4.1 (c) of the F&P Standards, the fact that an individual has been the subject of disciplinary proceedings will not automatically mean that the individual fails to meet the probity required for the (continued) performance of the CF. In assessing the impact of the proceedings on that individual’s probity, issues for consideration include the subject matter of the proceedings, the circumstances surrounding the

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 54 disciplinary proceedings, the length of time passed since the proceedings, the explanation offered by the individual and the relevance of the proceedings to the proposed role. vi) It is for the individual who is subject to Sections 4.1 and 5.2 of the F&P Standards to demonstrate that their ability to perform, or continue to perform, the relevant function is not adversely affected to a material degree by any of the factors in Section 4.1, or Section 5.2. vii) If there is evidence to suggest that the individual may not be able to comply with the standard of probity, a firm must investigate thoroughly. Where a matter may be relevant (for example, where the disciplinary proceedings are in respect of a serious matter), the firm should consider it in conjunction with other relevant matters in assessing whether the individual is fit and proper to perform the current or proposed function including: a) The seriousness of, and surrounding circumstances of the particular set of facts and the role of the individual in those set of facts, b) The relevance of those to the duties that are, or are to be, performed and the responsibilities that are, or are to be, assumed by that individual, c) Repetition and duration of the behaviour, d) The passage of time since the matter under consideration, and e) Evidence of rehabilitation, including the individual’s self-reflection/learnings. viii) When assessing an individual’s fitness and probity, a firm may decide that it is not necessary to make enquiries about a matter that is unlikely to be material. The firm should document why they consider that the issue is not likely to be material. ix) A series of matters used to assess fitness and probity may be significant when taken together, even if each matter in isolation might not be significant. The cumulative effect of such matters might determine whether the individual is fit and proper to perform, or continue to perform, the CF.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 55 x) Where the firm has made reasonable efforts to contact third parties and has received no response, or a response which is insufficiently detailed to allow the firm to make a decision, the firm should revert to the individual concerned in an effort to identify other possible avenues of inquiry. xi) If the firm is unable to obtain information which is sufficiently detailed to allow the firm to make a decision, the firm may, as a result, be unable to satisfy itself, and therefore, certify that the individual complies with the standards of fitness and probity and the individual should not take up or continue to perform the CF role. 3.24. If there is evidence to suggest that the individual is not complying with the standard of probity, a firm must investigate thoroughly. Evidential requirements for Payment Institutions (PI), Electronic Money Institutions (EMI), and Account Information Service Providers (AISP) 3.25. For PI, EMI and AISP, applications for PCF roles must provide certain additional evidence of the individual’s reputation, honesty and integrity in order to be in compliance with the EBA Guidelines under the Payment Services Directive (EU) 2015/2366 (PSD2): i) applications must provide objective evidence of an absence of criminal convictions, investigations and proceedings by the individual to satisfy Guideline 16.1(d)(i) (PIs/EMIs) or Guideline 11.1(d)(i) (AISPs): a) Irish resident individuals can fulfil this requirement through a Garda Vetting process managed by the Central Bank as part of the PCF application b) Non-Irish residents, may fulfil the requirement through provision of an official police certificate from their country of residence, where available, or through other objectively reliable sources of

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 56 information23, including through lawyer testimony (from any jurisdiction in which the applicant has resided). 24 Evidence produced to fulfil this requirement is generally considered valid for 6 months from the date of issue. ii) For individuals who have previously undergone an assessment of their reputation, as an acquirer or as a person who directs the business of an institution, by a different financial regulator; and for individuals who have previously been assessed by an authority from a non-financial sector, in accordance with Guideline 16.1(d)(iii) (PIs/EMIs) or Guideline 11.1(d)(iii) (AISPs), applications must provide: a) the identity of that authority; b) the date of the assessment; and c) evidence25 of the outcome of this assessment. Credit Unions – Due Diligence and Elected CFs/PCFs 3.26. Under Section 56B (4) (e) of the Credit Union Act, 1997, the nomination committee is responsible for assisting the credit 23 Note: Affidavits sworn by the individual attesting to an absence of criminal convictions, investigations and proceedings are not objective, and therefore, do not satisfy the requirement under the EBA Guidelines. 24 To satisfy EBA Guideline 16.1(d)(i) by lawyer testimony, such testimony must provide objective evidence independent of the PCF applicant and must declare that to the best of the lawyer’s knowledge the applicant has not been subject to criminal convictions, investigations, or proceedings. 25 Evidence should include one of the following for each such assessment: a) a copy of the letter issued by the regulatory authority to the person confirming their approval; b) a copy of the register which the person appeared on (if applicable); or c) a letter from the relevant regulatory authority confirming that the applicant was assessed by the regulatory authority and details of the outcome of the assessment.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 57 union in performing any obligations of the credit union under Section 23 of the 2010 Act in relation to any candidates proposed to perform PCFs. Furthermore, under Section 56B (4) (f) of the Credit Union Act, 1997 the nomination committee is responsible for assisting the credit union in carrying out any checks which the credit union is undertaking to enable it to comply with its obligations under Section 21 of the 2010 Act. 3.27. Table 2 below (where relevant) refers to specific provision(s) within the Credit Union Act, 1997 which outline who in the credit union is responsible for conducting due diligence. Table 2 CF/PCFs roles Credit Union Act, 1997 Who is expected to conduct due diligence? Board of Directors Refer to Section 56B, and specifically Sections 56B (4) (f) and 56B (5) The nomination committee. Board Oversight Committee N/A The nomination committee and the Board Oversight Committee. Manager Refer to Section 63A (5) The board of directors or a sub￾committee of the board of directors, such as the nomination committee. Risk Management Officer Refer to Section 76C (1) While the credit union management team is likely to provide input it is expected that the board of directors or a sub-committee of the board of directors, such as the nomination committee should have responsibility. Head of Internal Audit Refer to Section 76K (1), see also Section 76K (4) The board of directors or a sub￾committee of the board of directors, such as the nomination committee.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 58 3.28. For other CFs (including PCFs) it is a matter for the credit union to determine who should conduct due diligence, while ensuring that any potential conflicts of interest are managed. 3.29. When carrying out due diligence for proposed directors (CUCF-1), including proposed chairs, or proposed members of the board oversight committee (CUCF-2), credit unions should ensure that the proposed candidate does not fall within the list of ineligible persons as set out in the Credit Union Act, 199726. Furthermore, for the proposed chair (CUPCF-1), credit unions should ensure that the proposed candidate is eligible to seek election for the role of chair27 . Elected CFs/ PCFs 3.30. Where a CF is subject to an election process, credit unions need to allow sufficient time in advance of the election at AGM for the credit union to conduct due diligence on a person that is proposed to hold that CF. 3.31. Under Section 63 of the Credit Union Act, 1997, the chair of the board of directors is elected at a meeting of the board of directors which is held immediately after an AGM that was held to elect the board of directors. 3.32. Any person, other than an existing chair that has previously been pre-approved, that must stand for election to the position of chair of the board of directors should be pre￾approved by the Central Bank before they can be elected to the role of chair. A person who has not been pre-approved by the Central Bank is not eligible to be elected to the role of chair by the board, until such time as they have received pre￾approval from the Central Bank. 26 Section 53 (10) of the Credit Union Act, 1997 sets out the categories of persons who are not eligible to become a director of a credit union. Section 76N (4) of the Credit Union Act, 1997 sets out the categories of persons who are not eligible to become a member of the board oversight committee of a credit union. 27 Sections 55A (4) and 55A (6) of the Credit Union Act, 1997 for persons ineligible for the role of chair of a credit union.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 59 3.33. If the person pre-approved for a particular PCF role in a credit union is not subsequently elected at the AGM, then they are no longer pre-approved and will have to re-apply for pre￾approval for any future PCF roles. Criminal, Civil and Regulatory Actions 3.34. It is imperative that individuals exercise a high degree of candour when completing the Individual Questionnaire, and that full and complete information is disclosed in response to each question, including in Section 5 of the Individual Questionnaire. All information must be disclosed in Section 5 of the Individual Questionnaire, regardless of when or where the relevant matter occurred. 3.35. The firm must conduct appropriate due diligence of all disclosed on-going and past events, including in relation to criminal,28 civil29 and regulatory30 actions. Appropriate due diligence should take into account the same factors as listed below in the Central Bank’s approach to the assessment of these matters, as set out in paragraphs 3.7 – 3.40 below.31 Ongoing Actions 3.36. Where a criminal, civil or regulatory action is on-going concerning the individual or a business or legal entity where the person holds or held a position of responsibility or 28 ‘Criminal actions’ include criminal investigations that are conducted by the Gardaí, or other law enforcement officers, with a view to determining whether a person should be charged with an offence. ‘Criminal actions’ also includes criminal prosecutions. 29 ‘Civil actions’ include civil proceedings before a Court relevant to the performance of the relevant function(s). 30 ‘Regulatory actions’ include investigations by disciplinary or regulatory bodies, including by bodies responsible for supervising and regulating financial service providers and financial services, and any sanction that may be imposed by the regulatory body, following its investigation. For the avoidance of doubt, this also includes investigations by the Central Bank under its ASP and any administrative sanction(s) which may be imposed following the conclusion of the investigation. 31 Both, prior to appointment to a CF role and as part of annual certification.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 60 influence, but has not yet concluded, the Central Bank will take into account the following factors: i) What stage the action is at;32 ii) The type of action e.g. criminal, civil or regulatory; iii) Any further information which is available in respect of the action; iv) Whether the individual is being investigated personally, or whether the action relate(s) to a business or legal entity where the person holds or held a position of responsibility or influence; v) The explanation offered by the individual and the lessons learned by them; and vi) The relevance of the action to the relevant function(s), including if it is a criminal action and relates to one of the matters referred to below. Concluded Actions 3.37. The following matters may raise issues with an individual’s fitness and probity: i) Where the individual has been convicted33 of a criminal offence, in particular, where they received a custodial sentence, or where a business or legal entity in which the individual holds or held a position of responsibility or influence34, has been convicted of a criminal offence; ii) Where the individual has had a regulatory sanction imposed on them, or where a regulatory sanction has been imposed on a business or legal entity in which the 32 If it relates to a criminal action, the individual must disclose whether they have been formally charged or received a Court summons. 33 In this section, references to a conviction also apply to cases where an individual was prosecuted and the Court applied the Probation of Offenders Act 1907 (Section 1(1) or 1(2), meaning the offence was proven but no formal conviction was recorded. While not a conviction, such disposals must still be disclosed. 34Where matters as described in paragraph 3.38 (i)-(iii) arise as a result of the individual holding a position of responsibility or influence in a legal entity as described in that paragraph, the matters will only be considered relevant to the individual’s fitness and probity if they held the position during the relevant time period when the circumstances occurred.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 61 individual holds or held a position of responsibility or influence; iii) Where a decision or finding has been made in civil proceedings in respect of the individual, or in respect of a business or legal entity in which the individual holds or held a position of responsibility or influence, and where the decision or finding is relevant to the performance of the relevant function(s). 3.38. In assessing the potential impact of the above matters, the Central Bank will take into account the following: (i) The time elapsed since the matters occurred, (ii) Whether the action was in respect of the individual personally, or whether it relates to a business or legal entity where the individual holds or held a position of responsibility or influence, (iii) The explanation offered by the individual, (iv) The relevance of the action to the relevant function(s), (v) The individual’s conduct since the action, (vi) The individual’s current perspective on the action and their lessons learned (vii) Whether the action is criminal, civil or regulatory in nature, and if criminal, whether a custodial sentence was imposed, (viii) Any mitigating factors. Time elapsed 3.39. In respect of 3.38(i), the greater the period of time that has elapsed, the less impactful the issue is likely to be on the individual’s fitness and probity. As a general rule, if ten years have passed since the date of the final decision or finding in respect of the relevant action (save where a custodial sentence may have been imposed) and there are no other facts that raise material concerns regarding the individual’s fitness and probity, the individual is likely to meet the F&P Standards. 3.40. The exception to this general rule is if there are aggravating circumstances that make the decision or finding still relevant and material to that individual’s fitness and probity for the

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 62 particular role. For example, a significant financial fraud conducted by or with the knowledge of the individual fifteen years ago would still be a relevant consideration for their PCF assessment, compared to a less serious matter committed seven years ago. 3.41. To properly weigh these considerations, the individual’s involvement in matters that led to a criminal, civil or regulatory action must be disclosed in the IQ, regardless of the time elapsed since the conclusion of the matter. This is because the underlying facts may still be relevant to an assessment of fitness and probity. It is for the Central Bank to assess on a case-by-case basis in the context of a particular assessment. 3.42. In terms of criminal actions, certain types of conviction may be considered particularly relevant. This includes, but is not limited to, convictions for offences involving dishonesty, fraud, breach of trust, misrepresentation, financial crime or offences under company or financial services law. The conviction may be relevant whether the individual was convicted in the State or in some other jurisdiction. Financial soundness – Due Diligence to be undertaken by the Firm 3.43. The firm must be satisfied that the relevant individual complies with the standard of financial soundness both prior to appointment and as part of the certification process. 3.44. Any previous bankruptcy or insolvency should be investigated to ensure the individual and the firm is not vulnerable to external pressures or financial compromise.35 3.45. Conduct such as tax evasion, financial fraud or legal action should be investigated by firms to ensure the individual is not subject to regulatory actions or misconduct due to financial decision-making. 35Credit unions are referred to Section 72 of the Credit Union Act, 1997.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 63 Chapter 4 Key Considerations that Form Part of an F&P Assessment

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 64 Key Considerations of F&P Assessment 4.1. In addition to requirements outlined in other chapters of this guidance, the Central Bank has set out below its high-level expectations, which are relevant both for firms when performing F&P assessments36 and for PCF assessments performed by the Central Bank, with regard to: • Capacity to perform a role o Time commitments o Individuals Holding Multiple PCF Roles o Availability and accessibility of a PCF to the Central Bank, • Conflicts of interest, • Independence of mind and independence, • Inherent responsibilities of PCFs37 , • Level of experience required for certain PCFs, • Level of knowledge/qualifications required for certain PCFs, and • Collective suitability, including diversity. 4.2. Noting the range of sectors supervised by the Central Bank and the number and variety of PCF roles assessed, it is not possible to provide an exhaustive list of objective criteria for use in fitness and probity assessments. Any criteria to be used in assessments carried out by the Central Bank will be applied in a proportionate manner, taking into accountthe varying nature, scale and complexity of firms and the potential risks posed to consumers and the financial system. Capacity to perform a role Time Commitments 4.3. The standard of fitness includes a requirement that individuals have sufficient time to carry out the functions of 36 Both, prior to appointment to a CF role and as part of certification. 37 Including responsibilities for certain credit union CF and PCF role holders as prescribed in the Credit Union Act, 1997.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 65 the CF and PCF roles they occupy.38 It is important to consider the appropriateness of time commitment in proportion to the specific CF role. Firms should set out all relevant and necessary details to show that the individual has sufficient time to commit to the role. 4.4. Time commitments must form part of the assessment of an individual’s suitability for a PCF role. In this regard, a number of factors should be taken into account, including the nature, scale and complexity of the firm, other mandates requiring time commitment, such as other directorships, other CF/PCF roles held by the individual and the responsibilities attached to those mandates. 4.5. Existing Central Bank Corporate Governance Requirements and certain legislation set out requirements and expectations in relation to time commitments. Where specific requirements, guidance or legislation on time commitments do not exist for a given sector, firms should consider best practice in line with the requirements and guidance set out below. 4.6. Corporate Governance Requirements for Credit Institutions In accordance with the Corporate Governance Requirements for Credit Institutions, credit institutions should consider an individual’s time commitment in the context of the following requirements: • Credit institutions must consider whether individuals proposed as board/committee members have the ability to commit sufficient time to the role; • Directorship limits39 based on the number of financial directorships and non-financial directorships and the risk profile of the credit institution; • Restriction on the Chair of the Board and the CEO in taking up other Chair/CEO roles; and • Certain credit institutions, based on their risk profile, are required to have a dedicated CRO. 38 Section 3.2(f) of the Fitness and Probity Standards state that a person “…shall not allow the conduct of concurrent responsibilities to impair his or her ability to discharge the duties of the relevant function…” 39 European legislation also set out directorship limits

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 66 4.7. Corporate Governance Requirements for Insurance Undertakings In accordance with the Corporate Governance Requirements for Insurance Undertakings, insurance undertakings should consider an individual’s time commitment in the context of the following requirements: • Insurance undertakings must consider whether individuals proposed as board/committee members have the ability to commit sufficient time to the role; • Directorship limits40 based on the number of financial directorships and non-financial directorships and the risk profile of the insurance undertaking; • Restriction on the Chair of the Board and the CEO in taking up other Chair/CEO roles; and • Certain insurance undertakings, based on their risk profile, are required to have a dedicated CRO. 4.8. Corporate Governance Requirements for Investment Firms and Market Operators The Corporate Governance Requirements for Investment Firms and Market Operators require investment firms and market operators to assess whether individuals proposed as board/committee members have the ability to commit sufficient time to the role. 4.9. Corporate Governance Requirements for Captive Insurance and Captive Reinsurance Undertakings (Captives) In accordance with the Corporate Governance Requirements for captives, board members are required to: • Have sufficient time to devote to the role of director and associated responsibilities, and • Indicate a time commitment expected from non-group directors in letter of appointment and on an annual basis. The Corporate Governance Requirements for captives also set out directorship limits. 4.10. Fund Management Companies - Guidance 40 European legislation also set out directorship limits

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 67 The Central Bank has set a risk indicator in terms of time commitment of fund management companies in the form of a joint test of: (a) having more than 20 directorships; and (b) having an aggregate professional time commitment in excess of 2000 hours. The Fund Management Companies - Guidance also sets out useful information on what individuals should take into account when considering their time commitments. 4.11. Credit Union Act Pursuant to Section 53(5) of the Credit Union Act, 1997 a director of a credit union is required to ensure that they have sufficient time to devote to the role and responsibilities of a director. 4.12. European Legislation and Guidance Certain firms are also required to comply with European legislation and guidance that address time commitments of members of the management body and impose limits on the number of directorships that individuals may occupy. For example, ESA Guidelines set a framework for assessing time commitments. Firms in scope of the EBA and ESMA Guidelines should take into consideration the expectations set out therein. The ESA Guidelines require firms to set out all relevant and necessary details to show that the applicant has sufficient time to commit to the role. Individuals Holding Multiple PCF Roles 4.13. Notwithstanding that there may be sectoral legislation which prohibits one individual from holding certain roles concurrently41, it is possible that an individual can hold more than one PCF role. However, where approval is sought for an individual to perform more than one PCF role it should be 41 For example, under the Corporate Governance Requirements for Insurance Undertakings, certain insurance firms must have a dedicated exclusive CRO function i.e. the CRO cannot hold any other PCF roles.Credit unions are referred to the Credit Union Act, 1997 for restrictions on concurrent roles and responsibilities.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 68 noted that the individual must display competency for each role. Specifically, it must be demonstrated that the individual is fit for the role from a time commitment perspective and that the holding of such roles does not provide for conflict of interest. The individual must be approved by the Central Bank in respect of the performance of each PCF role. Availability and accessibility of a PCF to the Central Bank 4.14. Requests for persons performing PCF roles to reside outside the State will be assessed on a case-by-case basis taking into consideration the nature, scale and complexity both of the firm and of the PCF role in question. In the overall assessment of fitness of a proposed PCF role-holder, the capacity of an individual to meet the Central Bank’s expectations while residing outside the State will be taken into account, as will the residence of other PCF role holders in the firm. Sharing of PCF roles 4.15. The Central Bank acknowledges that the title of certain PCF roles42 by their nature can be held by several individuals, for example: directors, branch managers and Heads of Material Business Lines, given that each individual would be holding a distinct role. 4.16. However, otherwise, in the Central Bank’s view, the sharing of a single PCF role in any form amongst several individuals is not permitted other than: • In a job-sharing arrangement43 , or • Where the role consists of more than one distinct business line, i.e. PCF-18 Head of Underwriting taking into consideration retail and corporate business lines; and PCF￾19 Chief Investment Officer and PCF-29 Head of Trading 42 PCF-1, PCF-2A, PCF-2B, PCF-16, PCF-28, PCF-50 43 Job-sharing for the purposes of this paragraph represents an employment arrangement where two people are employed on a part￾time or reduced-time basis to perform a job normally fulfilled by one person.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 69 taking into consideration different investment types, i.e. equity and bonds. 4.17. In such cases, in determining if the situation is permissible, the arrangements should be assessed on a case-by-case basis by the firm taking into consideration the type of PCF role, the business model of the firm, common business practice in the industry, the rationale and the details of the role shared. 4.18. The sharing of PCF roles in firms is not permitted in any other cases, and it is expected that there will be an individual PCF role holder for each respective PCF role in existence in the firm. Conflicts of Interest 4.19. Conflicts of interest may affect an individual’s ability and suitability to carry out the functions of the CF & PCF roles in the best interests of the firm and its customers. Accordingly, it is necessary to identify, disclose, and manage or mitigate all existing and potential conflicts of interest. 4.20. When assessing the existence of conflicts of interest, firms should identify actual or potential conflicts of interest in accordance with the firm’s conflict of interest policy and assess their materiality. The firm should ensure that any existing or potential conflicts of interest are adequately mitigated or managed and will not adversely affect on the individual’s ability to perform the CF. 4.21. All actual and potential conflicts of interest have to be considered, including but not limited to, conflicts arising due to other roles, personal and professional relationships, remuneration structure, and other responsibilities within the organisational structure. For example, an individual who has been the CEO, executive director or a member of senior management of a firm during the previous 5 years should not advance to the role of Chairperson of that firm. 4.22. The Credit Union Act, 1997 also contains requirements on managing conflicts of interest and sets out certain

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 70 circumstances where individuals are excluded from membership of the board of directors. 4.23. The firm is responsible for identification and assessment of existing and potential conflicts of interest as part of the due diligence. In assessing conflicts of interest, the Central Bank expects firms to take into account at least the following: • Any personal relationship with the firm • Any professional relationship with the firm • Any financial interest in the firm • Any affiliations to other firms • Any political influence that may affect the firm 4.24. The existence of a conflict of interest does not mean that an applicant is not suitable for the role. It will depend on the materiality of the conflict and whether the conflict of interest can be adequately mitigated or managed. Independence of Mind and Independence 4.25. The assessment of independence of members of the board, should differentiate between the notion of “independence of mind”, applicable to all members of a firms’ board, and the principle of “being independent”, required for certain members of the board. Both concepts are relevant to the assessment of the individual’s ability to act with integrity and competence, capacity and conduct of concurrent responsibilities. Independence of Mind 4.26. Independence of mind ensures that independent judgement is exercised. All members of the board should have independence of mind regardless of the firm’s size, internal organisation and the nature, scale and complexity of its activities, and the duties and responsibilities of the specific position.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 71 4.27. In considering the independence of mind of members of the board, firms should take into account whether board members have the necessary behavioural skills, including: (a) strength, judgement and resilience to effectively assess and challenge the proposed decisions of other members of the board; (b) being able to ask questions of members of the board; and (c) being able to resist “group-think”, to be able to effectively assess, challenge, oversee and monitor management decision-making. 4.28. Acting with independence of mind is a pattern of behaviour, shown, in particular, during discussions and decision-making at the board. When considering the required behavioural skills of a member of the board, or of a proposed member of the board, past and ongoing behaviour, in particular within the firm itself, should be taken into account. To act with independence of mind in a position becomes more evident once a board member has assumed their role. 4.29. For example, as outlined in the ECB Guide to fit and proper assessments (2021), a person’s inaction with regard to supervisory findings “may indicate a pattern of behaviour of failing to engage actively in their duties, failing to assess and actively challenge proposed decisions or an inability to take sound, objective and independent decisions and display judgement when performing functions and tasks”. This can raise concerns as to a person’s ability to demonstrate courage, conviction and the ability to resist and question groupthink. Independence 4.30. The independence of individuals applying for the role of PCF￾2B – Independent Non-Executive Director shall form part of the assessment for that role. 4.31. Independence is defined in the Central Bank’s Corporate Governance Requirements. Independence is also defined in sectoral Codes and European legislation. 4.32. The fact that a member is considered as “being independent” does not mean that the member of the board should

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 72 automatically be deemed to be “independent of mind” as the member might lack the required character and behavioural skills mentioned above. The Central Bank’s Corporate Governance Requirements 4.33. The Central Bank’s Corporate Governance Requirements for Credit Institutions, Insurance Undertakings, Investment Firms and Market Operators respectively define independence as the ability to exercise sound judgement and decision making independent of the views of management, political interests or inappropriate outside interests. 4.34. The following criteria shall be considered and given reasonable weight when determining if a director is independent: i. Any financial or other obligation the individual may have to the relevant firm or its directors, ii. Whether the individual is or has been employed by the relevant firm or a group entity in the past and the post(s) so held, iii. Whether the individual is or has been a provider of professional services to the relevant firm in the recent past, iv. Whether the individual represents a significant shareholder v. Circumstances where the individual has acted as an independent non-executive director of the relevant firm for extended periods, vi. Any additional remuneration received in addition to the director’s fee, related directorships or shareholdings in the relevant firm, and vii. Any close business or personal relationship with any of the relevant firm’s directors or senior employees. 4.35. Where corporate governance requirements do not exist for a particular sector, the definition of independence as set out in the Central Bank’s Corporate Governance Requirements above in assessing the independence of individuals proposed for PCF-2B should be applied.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 73 4.36. In addition, other relevant requirements and guidance on independence issued by European legislators or European Supervisory Authorities should be taken into consideration. Requirements of a Role/Inherent Responsibilities 4.37. In the first instance, the assessment of whether or not an individual is competent and capable to carry out a particular PCF role will be focused on the requirements of the role. In this regard, the inherent responsibilities of specific PCF roles, predominantly board members and the heads of control functions, have been defined in Table 3 to Table 8 (below). Responsibilities Prescribed in the Credit Union Act, 1997 4.38. For certain CUPCF roles in credit unions, further detailed responsibilities are prescribed in the Credit Union Act, 1997. Detail on these specific CUPCF roles is set out below, and credit unions should refer also to the Credit Union Act, 1997 in this regard. 4.39. Chair of the Board: Section 55A of the Credit Union Act, 1997 Act refers to the Chair of the board of directors and prescribes certain functions for which the Chair is responsible, such as: ensuring that meetings of the board of directors operate in an efficient and effective manner, encouraging constructive discussions and debate, promoting effective communication between members of the board of directors and between the board of directors and the executive, and ensuring that conflicts of interest are appropriately managed by the board of directors. 4.40. Manager: Section 63A of the Credit Union Act, 1997 refers to the Manager and prescribes that the Manager of a credit union has responsibility for the day-to-day management of the credit union’s operations, compliance and performance of the credit union. Section 63A (4) of the Credit Union Act, 1997

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 74 prescribes some of the functions for which a Manager of a credit union is responsible. In addition, the manager serves as the main link between the board of directors and the executive. 4.41. Risk Management Officer: Section 76C of the Credit Union Act, 1997 refers to the Risk Management Officer (RMO). The board of directors is required to appoint a person with the necessary authority and resources to manage the risk management function within the credit union. The RMO is responsible for identifying, assessing, reporting and monitoring all internal and external risks that could affect the credit union including risks to its employees, members, reputation and assets, and assisting the Manager with managing and mitigating those risks. 4.42. Head of Internal Audit: Section 76K of the Credit Union Act, 1997 Act requires that the board of directors of a credit union appoints a person to provide independent internal oversight, and to evaluate and improve the effectiveness of the credit union’s risk management, internal controls and governance processes. The internal audit function is required to report the results of its evaluations and recommendations to the board of directors (or the audit committee, where one exists). Level of Knowledge and Experience 4.43. The assessment of whether or not an individual is competent and capable to carry out a particular PCF role will also focus on the individual’s level of knowledge and experience. 4.44. It is the Central Bank’s expectation that individuals should possess sufficient knowledge and experience commensurate with the requirements of the role and the nature, scale and complexity of the firm. 4.45. The focus is on whether the individual has appropriate financial services expertise and relevant experience of the specific sector, as well as an appropriate qualification where relevant.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 75 4.46. There are a number of factors which are relevant in an assessment as to whether an individual has an appropriate level of experience for a role. For example, in addition to length of service, there are a number of considerations to be taken into account, including in relation to the individual’s previous roles: • The nature, scale and complexity of the firm(s) in which the individual held the role(s); • Their actual responsibilities; • The span of their control/number of subordinates; • The nature of activities of the firm; and • The actual relevance of the recent experience gained to the role being applied for. 4.47. Given there are numerous factors to be considered as set out above, it is not possible to be definitive regarding minimum years of experience required for all specific roles 44. However, there are some high-level expectations which will be taken into account in this regard. For example, the ECB have set thresholds for the presumption of sufficient experience for the CEO, Chair and board members (executive and non￾executive) which have been set out in Table 3 to Table 8. 4.48. These thresholds for the presumption of sufficient experience currently apply to credit institutions for which the ECB is the competent authority and can be considered a benchmark for other Central Bank regulated firms which could be deemed to have a similar risk profile or are similar in terms of their nature, scale and complexity. 4.49. For smaller, less complex firms, shorter timeframes may be considered appropriate. In this regard, high-level expectations which will be taken into account are set out in Table 3 to Table 8. 4.50. In assessing an individual’s level of experience, the general approach is that where the individual’s level of experience is in line with or in excess of the number of years set out above, the 44 Except in the case of the Head of Actuarial Function as specified in Table 8.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 76 individual is generally deemed to have sufficient experience, except in situations where there are concerns regarding same45 . 4.51. It is also acknowledged that there may be sectoral or firm specific circumstances where an individual does not hold the years of experience set out in Table 3 to Table 8 below, but may be considered suitable for the role due to, for example, firm or role specific factors that should be taken into account. Accordingly, an individual who does not hold the years of experience set out could still be considered fit and proper where there is an appropriate justification46 . Board Members 4.52. Noting the importance of the roles played by board members, and that the majority of PCF approvals relates to director roles, the Central Bank considers it appropriate to provide additional clarity with regard to its minimum expectations of these roles. 45 This is aligned with the ECB approach which can be summarised as follows: If the thresholds are met, the appointee is ordinarily presumed to have sufficient experience, unless there is an indication to the contrary. 46 This is also aligned with the ECB approach, which is that if the thresholds are not met, the individual can still be considered suitable if the firm can justify this. The ECB specifically acknowledge that specific circumstances with regard to the institution (such as the nature, size and complexity of its business or its market situation) or the function (such as specific responsibility for complex topics, e.g. risk, IT, or climate-related and environmental risks) might require specialised expertise, which is not taken into account by the indicated thresholds.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 77 Table 3 Executive director Inherent Responsibility Summary of role Level of experience Level of knowledge Directing the business of the firm Propose strategies to the board and, following challenging board scrutiny, to execute the agreed strategies to the highest possible standards. For firms subject to ECB assessment/ firms (other than credit unions) which are similar in terms of their nature, scale and complexity: Five years of recent practical experience in areas related to banking or financial services at senior level managerial positions. For smaller, less complex firms (other than credit unions): Four years of recent practical experience in areas related to financial services that are relevant to the role and proportionate to nature, scale and complexity of the (proposed) regulated entity. Knowledge and understanding of relevant financial services legislation, as well as of the business, risks and material activities of the relevant firm to enable them to contribute effectively, and that they should have relevant skills, experience and knowledge (such as accounting, auditing, risk management knowledge and/or specialist business knowledge that complements the firm’s strategy, where appropriate). Table 4 Non-executive director Inherent Responsibility Summary of role Level of experience Level of knowledge Overseeing and monitoring the strategy and management of the firm • To ensure that there is an effective executive team in place; Three years of (recent) relevant practical experience. Such experience could be gained at, for example, high-level managerial Knowledge and understanding of the business, risks, material activities and/or specialist knowledge that

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 78 • To participate actively in constructively challenging and developing strategies proposed by the executive team; • To participate actively in the board’s decision￾making process; • To participate actively in board committees (where established); and • To exercise appropriate oversight over execution by the executive team of the agreed strategies, goals and objectives and to monitor reporting of performance. positions (or in administrative or academic positions, amongst others, depending on the position held.) complements the firm’s strategy to enable them to contribute effectively. Knowledge and understanding of relevant financial services legislation. Capabilities and knowledge to provide an independent challenge to the executive directors of the board. Table 5 Independent non-executive director Inherent Responsibility Summary of role Level of experience Level of knowledge Overseeing and monitoring the strategy and • To ensure that there is an effective executive team in place; Three years of (recent) relevant practical experience. Such experience could be gained at, for example, Knowledge and understanding of the business, risks, material activities and/or specialist

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 79 management of the firm • To participate actively in constructively challenging and developing strategies proposed by the executive team; • To participate actively in the board’s decision￾making process; • To participate actively in board committees (where established); and • To exercise appropriate oversight over execution by the executive team of the agreed strategies, goals and objectives and to monitor reporting of performance; • Bring an independent viewpoint to the deliberations of the board that is objective and independent of the activities of the management and of the firm. high-level managerial positions or in administrative or academic positions, amongst others, depending on the position held. knowledge that complements the firm’s strategy to enable them to contribute effectively. Knowledge and understanding of relevant financial services legislation. Capabilities and knowledge to provide an independent challenge to the executive directors of the board.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 80 Table 6 Chair of the board Inherent Responsibility Summary of role Level of experience Level of knowledge Overseeing meetings of the Board, leading and overseeing its performance • Attend and chair board meetings; • Lead the board, encourage critical discussions and challenge mind￾sets; • Promote effective communication between executive and non-executive directors. For firms subject to the ECB assessment/ firms (other than credit unions) which are or similar in terms of their nature, scale and complexity: Ten years of (recent) relevant practical experience. Such experience could be gained at, for example, at senior level managerial positions or in administrative or academic positions, amongst others, depending on the position held. For smaller, less complex firms other than credit unions: Eight years of (recent) relevant practical experience. Such experience could be gained at, for example, at senior level managerial positions or in administrative or academic positions, amongst others, depending on the position held. Relevant financial services expertise, qualifications and experience to ensure that the Chair has the necessary knowledge, skills and experience to comprehend each of the following: • The nature of the firm’s business, activities and related risks; • Their individual direct and indirect responsibilities and the board’s responsibilities; and • The firm’s financial statements. In addition, for credit unions: A qualification as a Credit Union Advisor or an Advanced Certificate in Credit Union Practice (ACCUP) would be very beneficial

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 81 For credit unions: A minimum of two years’ experience as a director of the credit union along with experience gained from sitting on the various Credit Union committees. Table 7 Chief Executive Officer/Credit Union Manager Inherent Responsibility Summary of role Level of experience Level of knowledge Overall responsibility for managing and steering the business activities of the firm • Top executive responsible for the firm with ultimate executive responsibility for the firm’s operations, compliance and performance; • Serve as the main link between the board and the executive. • The Credit Union Manager is responsible for the administration and efficient daily operation of the Credit Union office, including operations, For firms subject to the ECB assessment/ firms (other than credit unions) which are or similar in terms of their nature, scale and complexity: Ten years of recent practical experience in areas related to banking or financial services. This should include a significant proportion at senior level managerial positions. For smaller, less complex firms (other than credit unions): Eight years of recent relevant practical experience in areas related to financial services and the Relevant financial services expertise and relevant experience of the specific sector, as well as appropriate, qualifications, transferable skills and experience to ensure that the CEO/Credit Union Manager has the necessary knowledge, skills and experience to comprehend fully each of the following: • The nature of the firm’s business, activities and related risks; • Their individual direct and indirect responsibilities and the board’s

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 82 lending, product sales, customer service, security and safety in accordance with the CU's objectives. specific sector, as appropriate. This should include a significant proportion at senior level managerial positions. For credit unions: At least five years’ experience in a similar role. responsibilities; and • The firm’s financial statements. Personal qualities, professionalism and integrity to carry out their obligations. Table 8 Sole Trader/Single Director Inherent Responsibility Summary of role Level of experience Level of knowledge Overall responsibility for managing and steering the business activities of the firm/ Directing the business of the firm • Executive responsible for the firm with ultimate responsibility for the firm’s operations, compliance and performance. Sole traders and executive directors within a single director company seeking PCF approval need to possess sufficient practical experience commensurate to perform the role. Applicants should have four years of recent practical experience, in areas related to the relevant financial services, as is proportionate to the nature, scale and complexity of the entity, and be able to demonstrate the skills and ability to run the Individuals seeking approval as PCF-9, Sole Traders or as PCF-1, Executive Director in a single director firm need to possess the necessary: Qualifications commensurate to perform the role. Knowledge and understanding of relevant financial services legislation. Knowledge of the regulatory requirements, risks, business strategy and material activities of the firm; of the services and/or

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 83 regulated entity appropriately. products provided by the firm. Knowledge of the consumer protection risks and necessary mitigants related to those services and/or products, to enable them to run the regulated entity effectively. Heads of Control Functions 4.53. In addition, noting the significance of the roles of the heads of the control functions, the Central Bank also considers it important to set out its expectations in the context of this cohort of PCF roles. Table 9 Heads of Control Functions Inherent Responsibility Summary of role Level of knowledge Chief Risk Officer/Risk Management Officer Overall responsibility for managing the firm’s risk function and reporting directly to the Board or relevant subcommittee, or both, on risk management matters. • Ensuring that the firm has effective processes in place to identify and manage the risks to which the firm is or might be exposed; • Maintaining effective processes to monitor and report the risks to which the firm is or might be exposed; • Promoting sound and effective risk management both on a solo and consolidated basis; Relevant expertise, qualifications and experience.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 84 • Ensuring the system of risk management shall promote an appropriate risk culture at all levels of the firm and shall be subject to regular internal review; • Facilitating the setting of the risk appetite by the board; and • Providing comprehensive and timely information on firm’s material risks which enables the board to understand the overall risk profile of the insurance undertaking. • The risk management officer in a credit union is responsible for identifying, assessing, reporting and monitoring all internal and external risks that could affect the credit union. They assist the manager with managing and mitigating identified risks and have a reporting line to the board of directors. Head of Compliance Overall responsibility for managing the operation of the compliance function and reporting directly to the board or relevant subcommittee, • Advising the board on measures to be taken to ensure compliance with applicable laws, rules, regulations and standards, and assessing the possible impact of any changes in the legal or regulatory environment on the institution’s activities and compliance framework; Sufficient knowledge, skills and experience in relation to compliance and relevant procedures; and should have access to regular training.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 85 or both, on compliance matters. • Ensuring that compliance monitoring is carried out through a structured and well-defined compliance monitoring programme and that the compliance policy is observed; • Ensuring that the compliance function verifies, in close cooperation with the risk management function and the legal unit, that new products and new procedures comply with the current legal framework and, where appropriate, with any known forthcoming changes to legislation, regulations and supervisory requirements; and • Reporting to the board/relevant sub￾committee and communicating as appropriate with the risk management function on the firm’s compliance risk and its management, to ensure that the findings of the compliance function are taken into account by the board and the risk management function in decision￾making processes. Head of Anti￾Money Laundering and Overall responsibility for managing the firm’s anti- • Advising the board on measures to be taken to ensure compliance with applicable laws, rules, regulations and Sufficient knowledge, skills and experience in relation to AML/

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 86 Countering the Financing of Terrorism Compliance money laundering and countering the financing of terrorism compliance functions, and reporting directly to the board on anti￾money laundering and countering the financing of terrorism compliance matters. standards, and assessing the possible impact of any changes in the legal or regulatory environment on the institution’s activities and AML/CFT compliance framework; • Oversight of the firm’s AML/CFT business wide risk assessment and customer risk assessment and development of the AML/CFT framework to mitigate those risks identified; • Ensuring that AML/CFT compliance monitoring is carried out through a structured and well￾defined monitoring programme and that the AML/CFT compliance policy is observed; • Ensuring that the AML/CFT compliance function verifies, in close cooperation with the risk management function and the legal unit, that new products and new procedures comply with the current legal framework and, where appropriate, with any known forthcoming changes to legislation, regulations and supervisory requirements; and • Reporting to the board/relevant sub￾committee and CFT compliance and relevant policies, controls and procedures; and should have access to regular training. Knowledge and understanding of the firm’s business model and the sector in which the firm is operating, and the extent to which this business model exposes the firm to ML/TF risks.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 87 communicating as appropriate with the risk management function on the firm’s AML/CFT compliance risk and its management, to ensure that relevant findings are taken into account by the board and the risk management function in decision-making processes. Head of Internal Audit Overall responsibility for managing the operation of the firm’s internal audit function and reporting directly to the board or relevant subcommittee, or both, on internal audit matters. Responsible for assessing: • The appropriateness of the firm’s governance framework; • Whether existing policies and procedures remain adequate and comply with legal and regulatory requirements and with the risk strategy and risk appetite of the institution; • The compliance of the procedures with the applicable laws and regulations and with decisions of the board; • Whether the procedures are correctly and effectively implemented (e.g. compliance of transactions, the level of risk effectively incurred, etc.); and • The adequacy, quality and effectiveness of the controls performed, and the reporting done by the defence business units and the risk management Relevant expertise, qualifications and experience.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 88 and compliance functions. For credit unions: The internal audit function has a responsibility to provide internal oversight and to evaluate and improve the effectiveness of the credit union’s risk management, internal controls and governance processes. The internal audit function is required to be capable of operating independently to management and without undue influence over its activities. Head of Actuarial Function (HoAF) Overall responsibility for managing the operation of the firm’s actuarial function. Responsible for: • The tasks of the actuarial function under Regulation 50 of Solvency II S.I. No. 485 of 2015. The tasks of the actuarial function are further expanded in Article 272 of Commission Delegated Regulation 2015/35 and various guidelines published by the European Insurance and Occupational Pensions Authority. • The tasks of the Head of Actuarial Function outlined in the Central Bank’s Domestic Actuarial Regime and Related Governance Requirements under Prerequisite level of experience commensurate with the requirements of the HoAF role with a minimum of: • Five years (within the last ten years) relevant actuarial experience. • One year’s recent experience of reserving relevant to the market in which the majority of business is written.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 89 Solvency II. These tasks (and how the Central Bank expect HoAFs to meet them) are further expanded upon in the Central Bank’s Guidance for (Re)insurance undertakings on the Head of Actuarial Function Role. • One year’s experience of any exotic or specialised type of business written. The HoAF must be a member of a recognised actuarial association. The Central Bank’s expectation is that the role should be carried out by a qualified actuary. In exceptional circumstances, a non-qualified actuary may be considered. The HoAF should be capable of influencing Board decisions in key areas of actuarial expertise and of contributing to the effective implementation of the Risk Management System. Head of Finance Overall responsibility for managing the financial resources, financial planning and financial • Overseeing the financial activities of an entire firm; • Financial planning and monitoring cash flow; • Analysing the firm's financial strengths and weaknesses and suggests Sufficient level of experience commensurate with the requirements of the role. The Central Bank’s expectation is that the Head of

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 90 reporting of the firm and reporting directly to the board or relevant subcommittee, or both, on financial affairs plans for improvement; and • Overseeing the accounting and finance departments and for ensuring that the firm's financial reports are accurate and completed on time. • The Head of Finance within a credit union has overall responsibility for compilation, analysis and presentation to the board/management team of the credit union's financial position. This would include analysis of past financial performance including completion of Central Bank required financial returns (e.g. Prudential Return, Annual Financial Statements) and financial assessment of the credit union's future business plans as reflected in the strategic plan. The Head of Finance is also likely to be the key liaison in the credit union with the external audit function. Finance of a firm (other than credit unions) must have an appropriate accounting qualification however it is acknowledged that in some circumstances (e.g. where an individual has an appropriate alternative qualification, such as an actuarial qualification) a non-qualified accountant may be considered. For credit unions: Whilst this will be considered on a case-by-case basis – the Central Bank’s expectation is that the Head of Finance of a credit union would have an appropriate financial qualification and / or previous relevant experience in a similar role.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 91 Collective Suitability, Diversity and Inclusion Collective Suitability of the Board 4.54. In order to provide efficient and effective oversight, the board needs to possess adequate collective knowledge, and diversity of skills and experiences to be able to understand the firm’s activities, including the main risks and the broader financial context. Where European and domestic legislation imposes a requirement for a firm to ensure that the board is collectively suitable, the Central Bank has the following expectations in line with the Corporate Governance Requirements for relevant firms and relevant ESA Guidelines. 4.55. The Corporate Governance Requirements47 set out detailed provisions on the role of the board as well as the role of individual directors including that both the role and the responsibilities of the board must be clearly documented, and directors must have “a full understanding of their individual direct and indirect responsibilities and collective responsibilities”. 4.56. Boards need to have the right composition of members, having regard to the need for diverse perspectives, experience and knowledge. The composition of the board should reflect the knowledge, skills and experience necessary to fulfil its responsibilities. The completion of a board skills matrix48 is required under Appendix 1 of the Central Bank’s Corporate Governance Requirements for some credit institutions and insurance undertakings. However, all firms may consider using this tool as good practice to help assess the initial and ongoing suitability of the board, and to identify any skills gaps at present or in the future. 47 Part IV of the Credit Union Act, 1997 ‘Management of Credit Unions’ includes requirements on the board of directors (Section 53), the operation of the board of directors and general governance arrangements in credit unions (Section 66A) 48 A board skills matrix is a tool used to assess the collective skills and expertise of their board members. It helps identify strengths, gaps and areas for improvement to ensure the board has the right mix of competencies to effectively govern the organisation.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 92 4.57. The members of the board should be able to take appropriate decisions collectively. 4.58. All areas of knowledge required for the firm’s business activities should be covered by the board collectively with sufficient expertise among members of the board. The board should have sufficient knowledge in each area to allow a discussion of decisions to be made. The members of the board should collectively have the skills to present their views and to influence the decision-making process within the board. 4.59. Members of the board must have sufficient knowledge, skills and experience to fulfil their functions and should ensure that they are up to date. This also includes an appropriate understanding of those areas for which an individual member is not directly responsible, but still is collectively accountable for together with the other members of the board. This requires understanding the firm’s governance arrangements and structure which may require the member to commit time to undertake continuous learning and development. Firms should have in place internal policies that ensure that these requirements are met. 4.60. The relevant collective knowledge, skills and experience of the board will depend on the key characteristics of the firm. 4.61. The assessment of the initial and ongoing collective suitability of the board is the responsibility of the firm. While the assessment of the collective suitability of the board is also carried out by the Central Bank, for supervisory purposes, the responsibility to assess and ensure the ongoing collective suitability of the board continues to remain with the firm. Diversity and Inclusion 4.62. The Central Bank considers that diversity and inclusion in all their forms are important components of well-managed, financially resilient, strategically-minded firms. 4.63. Diversity means the situation, whereby, the characteristics of the members of the board, including their age, gender, geographical provenance and educational and professional

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 93 backgrounds that allow a variety of views49 . This is not an exhaustive list of all types of diversity. 4.64. Diversity and inclusion, in all their forms, are core to fostering an effective culture in a firm. To facilitate independent opinions and critical challenge, the members of the board should be sufficiently diverse. 4.65. Diversity must be supported by an inclusive culture, which facilitates and supports members of the board contributing so that diverse views are shared. 4.66. In order to achieve diversity, firms should respect the principle of equity and equality of opportunities. 50 This would assist firms in taking measures to ensure a more diverse pool of candidates for positions within the board. In this respect, a gender-balanced composition of the board is also of particular importance51 . While data limitations can mean that there is a particular focus on diversity from a gender perspective, the Central Bank does not see this as the only element of diversity. 4.67. While the diversity of the board is not a criterion for the assessment of the members’ individual suitability, diversity should be taken into account by firms when selecting and assessing members of the board in the context of collective suitability. 49 Joint ESMA and EBA Guidelines on the assessment of the suitability of the members of the management body and key function holders https://www.eba.europa.eu/activities/single-rulebook/regulatory￾activities/internal-governance/joint-esma-and-eba-guidelines 50 Equity can be understood as seeking to achieve fairness for all through allocating resources and opportunities in a way that recognises the different circumstances and needs of different groups of people, particularly where there is evidence of disadvantage amongst certain groups and/or individuals. Equity is different from equality: equality offers the same resources and opportunities to everyone, while equity helps remove the barriers that some people may face in accessing resources and opportunities. 51 As referred to in Directive 2013/36/EU, in Directive 2014/65/EU and in other initiatives at EU level that aim to improve gender diversity.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 94 4.68. The Central Bank’s Corporate Governance Requirements for credit institutions and insurance undertakings, and certain sector specific legislation, require firms to establish a written policy on diversity with regard to selection of individuals for nomination to become members of the board. The Central Bank supports establishment of a diversity policy in all firms as good practice. 4.69. In the case of sectors where there are no formal diversity requirements, firms are encouraged, as good practice, to have diversity and inclusion internal policies in place for the board of the firm.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 95 Chapter 5 Ongoing Obligation to Comply: Certification

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 96 Certification The Certification Process 5.1. Section 21 of the 2010 Act provides that a firm shall not permit an individual to perform a CF unless: i. The firm is satisfied on reasonable grounds that the individual complies with any Standard of Fitness and Probity issued pursuant to Section 50 of the 2010 Act, ii. A certificate of compliance with the standards of fitness and probity, given by the firm in accordance with Section 21 of the 2010 Act, is in force in relation to the individual, and iii. The individual has agreed in writing to comply with any such standard. 5.2. Therefore, a firm cannot appoint an individual to a CF, or allow them to continue in such a role, if it is not satisfied that the individual meets the above standards (and any of the relevant codes, as applicable). The same prohibition applies to the firm if the individual in the CF role has not agreed in writing to comply with the above standards (or any of the codes that may be applicable to them). 5.3. Accordingly, firms are required to document the following in respect of each individual in a CF role as part of the certification process: a) Confirmation that the firm is satisfied that the individual meets any standards of fitness and probity applicable to the CF role(s), b) Confirmation that the individual has agreed to comply with those standards, c) Identification of the CF role(s) held, d) An outline of the aspects of the firm’s affairs in which the individual will be involved in performing the CF role(s),

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 97 e) Details of the steps taken by the firm in forming the view that the individual meets any standards of fitness and probity applicable to the CF role(s) and f) Whether the role is outsourced to an unregulated entity. 5.4. Where an individual performing a CF does not comply, or continue to comply, with the standards of fitness and probity and therefore cannot be certified, the firm cannot permit that individual to perform, or continue to perform, the CF and must notify the Central Bank without delay. 5.5. It should be noted that where the Central Bank approves a proposed appointment to a PCF, that in itself, is not a certification of the individual’s compliance with the standards of fitness and probity. The firm is obliged pursuant to Section 21 of the 2010 Act to satisfy itself on reasonable grounds, and certify that, that the individual is compliant with the standards of fitness and probity. Identification of CFs 5.6. Section 21 of the 2010 Act applies to all firms subject to the F&P Regime. Accordingly, the certification requirements will apply to all firms and are relevant to all individuals in CF roles within them, with the exception of those individuals in CF roles to whom the exemptions from the F&P Standards apply (see Chapter 2). 5.7. Firms are required to maintain a register of individuals in CF roles and the specific CF role performed by them as defined in the F&P Regulations, which is reflective of the Certification process as outlined in this Chapter. The Central Bank recommends that job descriptions are reviewed when a vacancy arises to determine if the role is CF or PCF in nature. The guidelines setting out the key principles and rationale for the general interpretation of the CFs across the firm set out in Chapter 2 should also be reviewed. The Central Bank encourages the use of such practices in respect of all CF or PCF roles performed within the firm or outsourced to an unregulated Outsourced Service Provider.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 98 5.8. As set out in Chapter 2 of this guidance, where a CF role is outsourced to an “unregulated entity”, the regulated firm remains responsible for its obligations under Section 21 of the 2010 Act, including the certification process in respect of each individual in the CF role. 5.9. Firms are not required to submit the register to the Central Bank unless requested to do so. However, the list of individuals performing CF roles must be made available to the Central Bank on request. Details in respect of the information to be submitted to the Central Bank with regard to Section 21 of the 2010 Act are set out below. 5.10. In accordance with Regulation 261(3) of the Solvency II Regulations52, an insurance holding company must notify the Central Bank when a new individual is appointed to manage the holding company. In this regard, the Central Bank requires this notification to be provided no later than five working days from the date of the appointment of an individual to a CF role. Forming the View that the Individual Meets the Standards 5.11. The firm must undertake appropriate due diligence to satisfy itself that each individual performing a CF is fit and proper to perform that CF and to be in a position to certify same. 5.12. All due diligence is applicable to the CF population to which the certification requirement applies. All due diligence must be performed prior to appointment and on an ongoing basis, except where specific due diligence is relevant prior to appointment only (e.g. reference checks, interview or application, or record of previous experience) or which are applicable only in certain circumstances. 52 European Union (Insurance and Reinsurance) Regulations 2015 (S.I. No. 485 of 2015).

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 99 Frequency of Completion of the Certification Process 5.13. Section 21 of 2010 Act is a continuing obligation on firms. It is not a once off obligation discharged once initial due diligence has been undertaken. Accordingly, firms are required to carry out the certification process in respect of all CFs: • Prior to appointment • In the case of a PCF, prior to the submission of an Individual Questionnaire to the Central Bank, • On an annual basis, • Where new facts emerge which may materially call into question a person’s fitness and probity and/or • In respect of any new CF(s) assumed, in advance of appointment to same. 5.14. In respect of individuals holding more than one CF role concurrently, one single certification process that is reflective of all CF roles held, completed prior to appointment, on an annual basis and/or in respect of any new CF(s) assumed in advance of appointment to same, is required. 5.15. An entity which becomes a regulated financial service provider or a holding company, must certify individuals in CF roles within five days of becoming a regulated financial service provider/holding company or as otherwise agreed with the Central Bank. In this regard, it should be noted that the steps required to certify individuals in CF roles will be completed as part of the authorisation process.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 100 Confirmation of Agreement to Comply with the Standards of Fitness and Probity 5.16. A firm shall not permit an individual to perform a CF unless the individual has agreed to comply with the standards of fitness and probity53 . 5.17. Firms must bring the standards of fitness and probity to the attention of every individual performing a CF on its behalf, and obtain a signed copy of the template agreement at Appendix 3 for each such individual. 5.18. As part of the certification process, the firm is required to ask individuals performing CFs to confirm that they are aware of the standards of fitness and probity and agree to continue to comply with those standards of fitness and probity at least on an annual basis. Please also refer to Sections 5.30 - 5.33 on Material Changes or Concerns. Submission of Data in Relation to Certification to the Central Bank 5.19. It is not the Central Bank’s expectation that firms provide individual certificates to each CF, nor is it intended that an individual confirmation of the completion of the certification process in respect of each CF is submitted to the Central Bank. Further details regarding the retention and submission of data in relation to certification are set out below. 5.20. As part of the Annual PCF Confirmation process firms are required to: a) Submit confirmation of the completion of the certification process for each PCF role holder to the Central Bank on an annual basis via the Annual Confirmation on the F&P section of the portal, and b) Submit confirmation of the completion of the overall certification process in respect of all other CF role 53Any standard of fitness and probity outlined in a code issued under Section 50 of the 2010 Act.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 101 holders on an annual basis via the Annual Confirmation on the F&P section of the portal. 5.21. While it is expected that the majority of firms should be in a position to confirm the completion of the overall certification process annually, the Central Bank notes that there may be circumstances whereby a firm cannot confirm same (for example, where an individual in a CF role has yet to complete the CPD hours but is scheduled to do so within a reasonable timeframe). In such circumstances, firms should assess the materiality of the situation and, where it is determined that it will not affect the certification of the individual, firms are required to record any such instance and the reason for same, as well as an appropriate timeframe within which it will be remedied, and to confirm that the overall certification process has otherwise been completed. Information regarding such instances must be made available to Central Bank on request. Retention of Data in Relation to Certification 5.22. Firms are required to maintain all information collected in compliance with their obligations under Section 21 of the 2010 Act for the duration during which the individual performs the CF role. This includes the documentation of, and records in relation to, the certification of each CF, and the due diligence and the agreements to comply with the standards of fitness and probity. 5.23. Firms are required to maintain the information collected in compliance with Section 21 of the 2010 Act for a minimum of six years after that individual has ceased to perform the CF on behalf of the firm. 5.24. The Central Bank may require to see any such records or due diligence either in the context of an investigation of a firm’s compliance with Section 21 of the 2010 Act, or an investigation in relation to an individual’s fitness and probity to perform a CF role.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 102 5.25. Firms should have regard to their obligations under General Data Protection Regulation54 in holding the information referred to in this Chapter, including ensuring that the information is held securely and in an appropriate manner. Responsibility for and Compliance with the Certification Process 5.26. Firms should implement procedures to manage the firm’s compliance obligations with Section 21 of the 2010 Act. 5.27. In this regard, the Central Bank recognises that firms may wish to incorporate the certification process within existing processes and, as such, the Central Bank has not prescribed a format for certification. For example, some firms may wish to incorporate the certification process as part of their ongoing performance monitoring. 5.28. The Central Bank will engage in periodic follow-up with firms regarding the appropriateness of and compliance with the certification process through ongoing supervisory engagement and/or thematic inspections. 5.29. Further, there should be one individual within a firm with overall responsibility for certification. Accordingly, for those firms subject to the SEAR, an individual must be assigned PR 2 ‘Responsibility for the firm’s performance of its obligations under the Fitness and Probity Regime under Part 3 of the 2010 Act’ 55 . Whilst the day-to-day operation and management may be delegated to the relevant department(s), one individual must be assigned PR-2. For those firms outside the scope of the SEAR, in line with the existing approach to due diligence for PCFs and the Annual Confirmation, the Central Bank 54 Regulation (EU) 2016/679 of The European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 55 Please refer to the Central Bank Guidance on the IAF.

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 103 considers the CEO or equivalent56 to be responsible and accountable for certification. Material Changes or Concerns 5.30. In addition to the requirement for firms to obtain confirmation that a CF role holder has agreed to comply with the standards of fitness and probity under Section 21 of the 2010 Act, a firm should require individuals performing CF roles to notify the firm without delay if for any reason the individual no longer complies with the standards of fitness and probity. Suggested wording in this regard is included in the agreement to comply with the standards of fitness and probity at Appendix 3. 5.31. Where a firm becomes aware that there may be concerns regarding the fitness and probity of an individual performing a CF role, the Central Bank expects the firm to investigate such concerns and take action as appropriate without delay. 5.32. The firm should also notify the Central Bank without delay of material changes in relation to the fitness and probity of an individual and of any action taken. Where the individual continues in a CF role at the firm, the firm must provide the rationale on which it is satisfied that the individual continues to comply with the standards of fitness and probity. 5.33. While there is no exhaustive list of the types of action that must be notified to the Central Bank in the context of fitness and/or probity, examples would include issuing a formal written warning, suspending/dismissing an individual or reducing/recovering some of their remuneration as a result of issues relating to fitness and/or probity. 56 For credit unions the Central Bank considers the Manager to be responsible and accountable for certification

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 104 Appendices

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 105 Appendix 1 – List of CF Functions Table A: Controlled Functions applicable to Regulated Financial Service Providers (other than Credit Unions) CF-1 Ability to exercise a significant influence on the conduct of the affairs of a regulated financial service provider CF-2 Ensuring, controlling or monitoring compliance by a regulated financial service provider with its relevant obligations CF-3 Giving of advice to a customer of the regulated financial service provider CF-4 Arranging a financial service for a customer of the regulated financial service provider CF-5 Assisting a customer in the making of a claim under a contract of insurance or reinsurance CF-6 Determining the outcome of a claim arising under a contract of insurance or reinsurance CF-7 Management or supervision of those persons undertaking CF3 to CF6 roles CF-8 Adjudicating on any complaint communicated to a regulated financial service provider by a customer CF-9 Insurance and reinsurance intermediaries who direction and manage the undertaking or are directly involved in insurance or reinsurance mediation CF-10 Dealing in or having control over property of a customer of the regulated financial service provider CF-11 Dealing in or with property on behalf of the regulated financial service provider Table B: Controlled Functions applicable to Holding Companies HCCF-1 A function which is likely to enable the person responsible for its performance to exercise a significant influence on the conduct of the affairs of the Holding Company HCCF-2 A function which is related to ensuring, controlling or monitoring compliance by a Holding Company with its relevant obligations

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 106 Table C: Controlled Functions applicable to Credit Unions CUCF-1 A function in relation to the provision of a financial service which is likely to enable the person responsible for its performance to exercise a significant influence on the conduct of the affairs of a credit union CUCF-2 A function in relation to the provision of a financial service which is related to ensuring controlling or monitoring compliance by a credit union with its relevant obligations CUCF-3 Giving of advice to a member of a credit union, in the course of providing, or in relation to the provision of, the financial service CUCF-4 Arranging, or offering to arrange, a financial service for a member of a credit union CUCF-5 Assisting a member of a credit union in the making of a claim under a contract of insurance or reinsurance CUCF-6 Determining the outcome of a claim arising under a contract of insurance or reinsurance CUCF-7 Acting in the direct management or supervision of those persons who act for a credit union in providing the services referred to in subparagraphs CUCF-3 to CUCF￾6 CUCF-8 Adjudicating on any complaint communicated to a credit union by a member in relation to the provision of a financial service Table D: Controlled Functions applicable to credit unions that are also authorised as retail intermediaries CURICF-1 A function in relation to the provision of a financial service which is likely to enable the person responsible for its performance to exercise a significant influence on the conduct of the affairs of a credit union that is also authorised as a retail intermediary CURICF-2 A function in relation to the provision of a financial service which is related to ensuring, controlling or monitoring compliance by a credit union that is also authorised as a retail intermediary with its relevant obligations CURICF-3 Giving of advice to a member, in the course of providing, or in relation to the provision of, the financial service

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 107 CURICF-4 Arranging, or offering to arrange, a financial service for a member of the credit union that is also authorised as a retail intermediary CURICF-5 Assisting a member in the making of a claim under a contract of insurance or reinsurance CURICF-6 Determining the outcome of a claim arising under a contract of insurance or reinsurance CURICF-7 Acting in the direct management or supervision of those persons who act for a credit union that is also authorised as a retail intermediary in providing the services referred to in CURICF-3 to CURICF-6 CURICF-8 Adjudicating on any complaint communicated to a credit union that is also authorised as a retail intermediary by a member in relation to the provision of a financial service CURICF-9 In respect of a person involved in insurance or reinsurance distribution as defined in the European Union (Insurance Distribution) Regulations 2018, the function of being involved in insurance or reinsurance distribution activities CURICF-10 Dealing in or having control over property of a member of the credit union that is also authorised as a retail intermediary to whom a financial service is provided or to be provided, whether that property is held in the name of the member or some other person CURICF-11 Dealing in or with property on behalf of the credit union that is also authorised as a retail intermediary, or providing instructions or directions in relation to such dealing

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 108 Appendix 2 – Existing list of PCF Functions Table E: Pre-Approval Controlled functions (PCFs) for Regulated Financial Service Providers other than Credit Unions General PCF-1 Executive director PCF-2A Non-executive director PCF-2B Independent non-executive director PCF-3 Chair of the board PCF-4 Chair of the audit committee PCF-5 Chair of the risk committee PCF-6 Chair of the remuneration committee PCF-7 Chair of the nomination committee PCF-8 Chief executive PCF-9 Member of partnership PCF-10 Sole Trader PCF-11 Head of Finance PCF-12 Head of Compliance PCF-13 Head of Internal Audit PCF-14 Chief Risk Officer PCF-16 Branch Manager of branches outside Ireland but only where the business arising from the branch amounts to 5% or more of, as applicable, the assets or revenues or gross written premiums of the regulated financial service provider PCF-17 Head of Retail Sales PCF-42 Chief Operating Officer PCF-49 Chief Information Officer PCF-52 Head of Anti-Money Laundering and Counter Terrorist Financing Compliance Insurance PCF-18 Head of Underwriting

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 109 57 As reported in quarterly COREP and FINREP regulatory reporting. PCF-19 Head of Investment PCF-43 Head of Claims PCF-48 Head of Actuarial Function PCF-54 Head of Material Business Line where such a material business line satisfies either of the following quantitative criteria: i. has gross total technical provisions (whether positive or negative) equal to or in excess of €10 billion; or ii. accounts for 25 per cent or more of the insurance undertaking’s gross earned premium, if that gross earned premium is above €1 billion per annum Banking PCF-21 Head of Treasury PCF-22 Head of Credit PCF-23 Head of Asset and Liability Management PCF-50 Head of Material Business Line where such a material business line satisfies either of the following quantitative criteria: i. has gross total assets equal to or in excess of €10 billion; or ii. accounts for 10 per cent or more of the firm’s gross revenue PCF-51 Head of Market Risk in credit institutions which exceed either of the following metrics57: i. €500m of market risk (including Credit Valuation Adjustment ) Risk Weighted Assets; or ii. €100bn of notional derivatives traded PCF-53 Head of Client Asset Oversight Stock Exchange PCF-26 Head of Regulation PCF-27 Head of Operations Investment firms PCF-28 Branch Managers within the State PCF-29 Head of Trading PCF-30 Chief Investment Officer PCF-45 Head of Client Asset Oversight

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 110 PCF-55 Head of Material Business Line where such a material business line satisfies either of the following quantitative criteria: a. has gross total assets equal to or in excess of €5 billion; or b. accounts for 10 per cent or more of the investment firm’s gross revenue Investment Intermediaries / Collective Investment Schemes PCF-32 Branch Managers within the State PCF-33 Head of Transfer Agency PCF-34 Head of Accounting (Valuations) PCF-35 Head of Trustee Services PCF-36 Head of Custody Services UCITS Self-Managed Investment Company / Management Company PCF-37 Head of Transfer Agency PCF-38 Head of Accounting Valuations PCF-39A Designated Person with responsibility for Capital and Financial Management PCF-39B Designated Person with responsibility for Operational Risk Management PCF-39C Designated Person with responsibility for Fund Risk Management PCF-39D Designated Person with responsibility for Investment Management PCF-39E Designated Person with responsibility for Distribution PCF-39F Designated Person with responsibility for Regulatory Compliance PCF-46 Head of Investor Money Oversight Retail Credit Firms PCF-47 Head of Credit Payment Institutions / Electronic Money Institutions / Account Information Service Providers / Small Electronic Money Institutions PCF-40 Branch Managers within the State PCF-56 Head of Safeguarding Crypto-Asset Service Providers PCF-57 Head of Safeguarding

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 111 Financial Service Providers established outside Ireland PCF-41 Manager of a branch in Ireland of a regulated financial service provider established in a country that is not an EEA country Table F: Pre-Approval Controlled Functions for Holding Companies HCPCF-1 Chair of the board HCPCF-2 Director Table G: Pre-Approval Controlled Functions for all Credit Unions CUPCF-1 Chair of the board CUPCF-2 Manager Table H: Pre-Approval Controlled Functions for Credit Unions also authorised as Retail Intermediaries CURIPCF-1 Chair of the board CURIPCF-2 Manager Table I: Pre-Approval Controlled Functions for Credit Unions with total assets of at least €100 million CUPCF-3 Risk Management Officer CUPCF-4 Head of Internal Audit CUPCF-5 Head of Finance

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 112 Appendix 3 Agreement of employee pursuant to section 21 of the Central Bank Reform Act 2010 (the 2010 Act) Section 21 of the 2010 Act provides as follows: “(1) A regulated financial service provider shall not permit a person to perform a controlled function in relation to it unless a certificate of compliance with standards of fitness and probity, given by the regulated financial service provider in accordance with this section, is in force in relation to the person. (2) A holding company shall not permit a person to perform a controlled function in relation to it unless a certificate of compliance with standards of fitness and probity, given by the holding company in accordance with this section, is in force in relation to the person. (3) A certificate may be given for the purposes of subsection (1) or (2) only if— (a) the regulated financial service provider or holding company giving the certificate is satisfied on reasonable grounds that the person concerned complies with any standard of fitness and probity in a code issued under section 50, and (b) the person has agreed in writing to comply with any such standard.” I confirm that I have read the code setting out standards of fitness and probity and the guidance issued by the Central Bank of Ireland pursuant to Section 50 of the 2010 Act (the “Standards”) and I confirm that I comply with those Standards. I agree to comply with the Standards. I agree to notify the regulated financial service provider / holding company, as applicable, without delay if for any reason I no longer comply with the Standards.

---

Employee Signature

---

Date

Guidance on the Standards of Fitness and Probity Central Bank of Ireland Page 113 Appendix 4 Examples of due diligence to be undertaken by firms for assessing an individual’s compliance with the standards of fitness and probity (note: this table is not exhaustive and firms should refer to the relevant section of the Guidance in this regard for further details): Y = Checks undertaken by the regulated financial service provider / holding company SC = Self Certify I/A = If Applicable Standard Supporting documents obtained from a third party Frequency PCF CF1-CF2 CUCF1 - CUCF2 and CURICF1- CURICF2 CF3-CF11 CUCF3- CUCF8 and CURICF3- CURICF11 Competent and Capable Provision of a copy of the relevant transcripts Initial (and ongoing if applicable) Y Professional Body Check Initial (and ongoing if subject to renewal) Y Employer’s References Initial Y Minimum Competency Code and Minimum Competency Regulations 2017 Initial and ongoing I/A I/A SC/Y Conflicts Initial and ongoing SC Honest, ethical and with Integrity Garda Check/Convictions Initial and ongoing SC Regulator Check Initial and ongoing Y Y SC Financial Soundness Judgements Search Initial and ongoing Y Y SC

T: +353 (0)1 224 5800 E: publications@centralbank.ie www.centralbank.ie