• Governance and Control: Whether its governance and control arrangements are proportionate and appropriate when examined by reference to the E-Money Regulations/the Payment Services Regulations.
• Board: Whether its Board is fully functioning; whether the Board takes responsibility for the effective and prudent oversight of the firm, its strategy, its governance, its risk management framework, and its internal controls.
• Fitness and Probity: Whether the firm is fully aware of its obligations under the Central Bank’s Fitness and Probity (F&P) regime. The importance of ongoing assessments, due diligence and strong succession planning was emphasised by the Central Bank, and it drew firms’ attention to its previous F&P-related Dear CEO letters (read our briefings on those letters here and  here).

• Culture: Ensure that it has strong internal systems, controls and standards that underpin a consumer-focused culture.
• Managing risks to consumers: Examine its standards by reference to the Central Bank’s Consumer Protection Outlook Report 2021 (the 2021 Report), which identified key risks to consumers of financial services, including:
  • the absence of a consumer-focused culture;
  • ineffective disclosure;
  • unfair practices and behavioural vulnerability;
  • risks from technology; and
  • mis-selling and inadequate suitability assessments.
• Central Bank Expectations: Ensure that, in addition to reviewing its governance and operations in light of the Dear CEO letter, it also assesses the firm’s compliance with the expectations set out in the 2021 Report.
• Disclosure and Suitability: Note the emphasis placed by the Central Bank on risk disclosure and suitability assessments, from a consumer protection perspective, in the recent Dear CEO letter.

• Frameworks: Whether it has a robust, Board-approved, safeguarding risk framework in place to ensure the identification, protection and management of client funds on a daily basis.
• Client Funds: Whether there is clear segregation, designation and reconciliation of client balances (and whether the Board seeks regular assurances on this point).
• Oversight: Whether the second and third lines of defence (risk and compliance, and internal audit) carry out independent oversight effectively.

• Models: Whether its business model is viable and sustainable.
• Resources: Whether it has sufficient financial resources to support its current and future plans.
• Funds: Whether it has sufficient regulatory capital to absorb losses and whether it meets its ‘own funds’ requirements at all times.
• Returns: Whether its regulatory returns are timely and accurate.
• Notifications: Whether it promptly and proactively notifies the Central Bank of:
  • any breaches of legal or prudential requirements, and of developments that could have a material impact on its business; and
  • likely material changes to its business model (e.g. material changes to services or product offerings, or business projections that differ from those discussed as part of the firm’s authorisation process).  The Central Bank expects a detailed risk assessment, signed off by the Board, to accompany a notification of a material change to a firm’s business model.

 
The Central Bank reiterated in the Dear CEO Letter that it does “not expect to see firms’ business ambitions running ahead of their control environment”.

• Frameworks: Its risk and control framework operates effectively.
• Expecting the unexpected: It is prepared for unforeseen operational disruptions.
• Independence: It operates “sufficiently on a stand-alone basis to ensure the primacy of the legal entity authorised [by the Central Bank]”.

 
Echoing its expectations regarding governance (see above), the Central Bank also expects responsibility for IT and cyber risk strategy, and any outsourced activities, to rest with the firm’s Board.