The Central Bank of Ireland (CBI) recently reported the results of a desk-based thematic assessment of key aspects of the fitness and probity (F&P) regime within the MiFID investment firm sector. The assessment also considered implementation of the Individual Accountability Framework (IAF) and compliance with the Minimum Competency Code 2017 (MCC). In the report, the CBI also sets out the steps it expects all MiFID investment firms to take in consideration of the findings.
Scope of the thematic assessment
At the time of the thematic assessment, the Fitness and Probity Standards 2023 (Standards) and the Guidance on the Fitness and Probity Standards 2023 applied. These were subsequently replaced by the Fitness and Probity Standards 2025 and the Guidance on the Fitness and Probity Standards 2025, although there were no material changes to the Standards.
The assessment involved a sample of MiFID investment firms, and reviewed:
- responses to a questionnaire
- information and documentation relating to F&P and IAF processes, including policies and procedures
- steps taken to embed the IAF into governance frameworks, including a review of statements of responsibility (SORs) and management responsibility maps (MRMs)
- due diligence carried out prior to the appointment of pre-approval controlled function (PCF) role holders and as part of the annual certification process
- documentation relating to MCC processes, including staff-related records
Key findings of the thematic assessment
Policies, procedures and due diligence
- Several firms did not have sufficiently detailed F&P policies and procedures in place or did not effectively apply their policies and procedures in practice. This was particularly evident in relation to the due diligence required for PCF role holders at on-boarding and annually thereafter. Common gaps included failure to obtain a signed copy of the PCF role holder’s agreement to comply with the Standards, lack of evidence of self-certification of potential conflicts of interests, and failure to provide documents evidencing the firm’s assessment of individuals’ competence and capability (e.g. interview notes).
IAF implementation
- Most firms have taken effective steps to fully embed the IAF into their business. Several good practices observed include development of a ‘reasonable steps framework’ to assist employees in understanding their roles and responsibilities, and the compliance function confirming, on a quarterly basis, that the MRM is up to date.
- Some firms need to undertake additional work to fully embed the IAF, including adequately reflecting the framework in their policies and procedures. While the content of the documents aligned with the Guidance on the IAF, they lacked specific detail on how firms tailored their approach to the IAF or the actions taken to embed the framework.
- Of the firms in-scope of the Senior Executive Accountability Regime (SEAR), the majority had a good standard of MRMs and SORs. However, a small number had MRMs that did not meet the prescribed standards. Key information was missing, such as ‘inherent’ or ‘other’ responsibilities, and clear reporting lines to management and/or committees of the board.
- In relation to SORs, in one instance, shared responsibilities across two PCF role holders were not aligned with the limited permitted circumstances set out in the Guidance on the IAF.
MCC
- There were no significant adverse findings on firms’ compliance with the MCC having regard to their MCC registers and continuing professional development logs.
Next steps for all firms
In its report, the CBI states that all MiFID investment firms should review their F&P arrangements, practices, policies and procedures against the findings, feedback and identified good practices.
Firms are expected to undertake the following actions:
- review and update F&P policies and procedures to ensure they are sufficiently detailed and current, and that the policies clearly reflect how the IAF applies to the firm's specific business model
- ensure F&P policies and procedures are implemented in practice
- strengthen due diligence and annual certification processes to ensure comprehensive documentation and evidence retention
- ensure that due diligence and annual certification processes are consistently applied
- ensure the IAF is fully embedded within the firm's governance framework, with clear documentation of how the framework applies to the firm's specific business model
- provide training on the IAF to relevant staff
- in relation to SEAR, verify that all ‘prescribed responsibilities’ are allocated to individual PCF role holders and that the potential need for ‘other responsibilities’ to be defined, and allocated, has been thoroughly assessed and actioned
- ensure that MRMs and SORs are current and comprehensive
Comment
The CBI’s findings underline the importance of firms being able to demonstrate that their F&P, IAF, SEAR and MCC arrangements are not only documented, but are also implemented and operating effectively in practice. All MiFID investment firms should use the report as an opportunity to assess whether their due diligence policies and procedures, annual certification procedures, SORs and MRMs are sufficiently tailored, current and supported by appropriate evidence. They should also action the other specific steps identified in the CBI’s report (see above).
ALG can assist firms with reviewing and updating F&P and IAF policies and procedures, assessing due diligence and annual certification processes, reviewing SORs and MRMs, delivering targeted training to boards, senior management and relevant staff, and supporting remediation plans arising from the CBI’s findings.
For further information, please contact Dario Dagostino, Partner, Eoin O’Connor, Partner Patrick Brandt, Partner, Mark Devane, Partner, Chloe Culleton, Partner, Eimear O’Brien, Partner, Louise Hogan, Partner or Sarah Lee, Senior Practice Development Lawyer.
Date published: 4 September 2026
