Domestic

CBI speech: ‘Supervising for success: some themes for a time of change’

On 14 January 2026, the Central Bank of Ireland (CBI) published the transcript of a speech delivered by Gerry Cross, Director of Capital Markets and Funds, at the Compliance Institute AGM.

Mr Cross outlined the CBI’s regulatory priorities and supervisory direction, emphasising its outcomes focused, risk-based approach. He stressed key themes relevant for compliance and regulators as follows:

Securing customers’ interests – revised Consumer Protection Code

• The revised Consumer Protection Code (Code) will come into force on 24 March 2026. Central to the Code are the new standards for business, including the requirement that firms “secure customers’ interests at all times.”.
• The CBI issued updated general guidance on the Code and Code FAQs in December 2025 that provide additional clarity.

Individual Accountability Framework

• The CBI reiterates the IAF is not intended to increase enforcement in itself, it is about supporting good governance and well-run firms and it is not the focus of compliance supervision but rather supports the maturing supervisory approach and delivery of regulatory outcomes.

Simplification agenda

• An outcomes-focused approach is an essential ingredient in engagement with the simplification agenda. The focus is on removing unnecessary complexity in EU and domestic regulatory frameworks without reducing standards.
• The CBI’s publication of “Regulating & Supervising Well – A More Effective and Efficient Framework” outlines areas of actualised and potential simplification across supervision, reporting, regulation, and gatekeeping.

Operational and financial resilience

• Operational resilience
  • Firms have progressed their DORA implementation, including cyber incident and threat reporting and reporting of ICT third party registers. They must also now prepare for the second collection of ICT third party registers and the first threat led penetration testing cycles.
  • MiFID Operational Resilience Thematic Review – the CBI’s findings from its thematic assessment on operational resilience in the MiFID investment firm sector which identified areas requiring enhancement.
• Financial resilience
  • The risks posed by the non-bank sector should continue to be assessed and responded to by firms and the CBI.

AI governance

The supervisory objective is to see how AI is being used by firms and ensure that its adoption is beneficial and supporting of regulatory objectives.

CBI’s new supervisory approach

The CBI discussed its revised supervisory approach, that continues to be risk-based, is more outcomes focused, less process driven and integrated across all the CBI’s safeguarding outcomes. The implementation of the revised approach is an on-going effort and will continue to evolve.

European

MoU between ESAs and UK regulatory authorities on oversight of critical ICT third-party service providers

On 14 January 2026 the European Supervisory Authorities (ESAs) announced that they have entered into a Memorandum of Understanding (MoU) with the Bank of England, the Financial Conduct Authority and the Prudential Regulatory Authority to enhance co-operation and information sharing between the EU and UK authorities to oversee critical ICT third-party service providers under DORA, including coordination of oversight activities between the relevant authorities responsible for oversight of EU critical ICT third-party service providers and of UK critical third parties.

The MoU was prepared in accordance with Articles 36, 44, and 49 of DORA, which cover the ESAs’ oversight powers, international cooperation, and financial cross-sector exercises, communication and cooperation.

ESAs publish targeted equivalence assessment of confidentiality and professional secrecy regime

The European Supervisory Authorities (the ESAs) have published a targeted equivalence assessment of DORA confidentiality and professional secrecy regimes for the purposes of Article 55 of the Digital Operational Resilience Act. The assessment deems the confidentiality and professional secrecy regime to which the UK Financial Conduct Authority and the UK Prudential Regulation Authority are subject as equivalent to the confidentiality and professional secrecy regime under Article 55 of DORA.

EBA and AMLA complete handover of AML/CFT mandates

On 19 January 2026 the European Banking Authority (EBA) and the Anti-Money Laundering Authority (AMLA) announced the transfer of all anti-money laundering and counter-terrorist financing (AML/CFT) mandates and functions to AMLA was completed on 1 January 2026.

Key EBA tools and expertise, including the EuReCa database, supervisory insights and risk assessments, have been transferred to AMLA. All existing EBA AML/CFT technical standards and guidelines will remain in force until they are replaced by AMLA, guaranteeing regulatory continuity for industry and supervisors.

The handover concludes the EBA's stand-alone AML/CFT mandate.

Under the EU’s new AML/CFT package, AMLA will prepare mandated technical standards and guidelines under the new AML Regulation and 6th Anti-Money Laundering Directive, advance supervisory convergence and co-ordinate the work of financial intelligence units to enhance cross-border exchange of financial intelligence. AMLA will also directly supervise 40 of the most complex financial institutions or groups in the EU.  

The EBA will continue to address money laundering risks through prudential regulation, working hand in hand with AMLA to maintain a coherent framework.

Date published: 26 February 2026

This publication provides an overview of certain legal and regulatory developments that may be of interest to certain entities. It does not purport to provide analysis of law or legal advice and is strictly for information purposes only.