Central Bank of Ireland establishes dedicated Fitness and Probity Unit

On 19 December 2024, the Central Bank of Ireland (CBI) announced the establishment of a dedicated Fitness and Probity Unit consisting of existing experienced CBI staff.

The new unit is part of a range of measures the CBI is undertaking following a "Fitness and Probity Review" by Andrea Enria, former Chair of the Supervisory Board of the European Central Bank. This was an independent review following a decision of the Financial Services Appeals Tribunal which found there was a lack of fair procedures in the fitness and probity approval process (see our separate briefing on this here). The Enria report was published in July 2024 and identified a number of key areas for improvement:

• clarity of supervisory expectations;
• internal governance of the process; and
• fairness, efficiency and transparency of the process.

Governor of the CBI, Gabriel Makhlouf, accepted the findings of the report and committed the CBI to implementing the reforms as early as possible.

It is expected that the new unit and focus on fitness and probity will result in:

• more streamlined and consistent approvals for key financial roles;
• greater transparency in the approval process;
• a single point of accountability for fitness and probity applications with the CBI; and
• faster processing of applications.

Insider trading

Ireland saw its first-ever criminal conviction for insider dealing recently where a shareholder in a pharmaceutical company used market-sensitive information to offload shares days before buying them at a discounted price. He was convicted after pleading guilty to an offence under the European Union (Market Abuse) Regulations 2016. The shareholder received an 18-month suspended prison sentence and was fined €69,000. It was also recently reported that the Gardaí who were investigating insider trading had arrested an "extremely wealthy" stock market specialist.

A Stockbrokers firm was fined over breach of insider trading rules

The CBI has fined a Dublin-based stockbrokers firm €452,790 for failing to report suspicious transactions to regulators in breach of insider trading rules.

An investigation by the bank identified six occasions from September 2017 to May 2022 where the stockbrokers' surveillance system spotted suspicious deals and did not report them.

The CBI found that the company failed to make the reports in compliance with market abuse regulations which cover "insider dealing, unlawful disclosure of inside information and market manipulation".

These events reflect more proactive investigation and enforcement of insider trading law in Ireland, which historically has been an area which saw very few prosecutions. Going forward, it is likely that there will be further investigations and convictions.

EU sanctions against Russia: latest developments

Since February 2022, the EU has significantly expanded its sanctions regime against Russia in response to the deliberate Russian destabilisation of Ukraine. The purpose of the sanctions regime is to target key sectors of the Russian economy and limit Russia's ability to finance its war efforts.

December 2024 sanctions

In December 2024, the EU adopted its 15th package of sanctions, focusing on combatting the Russian "shadow fleet" and sanctions circumvention. For the first time, it imposes fully-fledged sanctions (travel ban, asset freeze, prohibition to make economic resources available) on various Chinese actors supplying both drone and microelectronic components in support of Russia's war of aggression against Ukraine.

Key takeaways from the package

• EU Central Security Depositaries (CSDs):
• can request national authorities to unfreeze cash balances to meet their legal obligations with clients; and
• will not be liable to pay interest or compensation to the Central Bank of Russia, beyond what is contractually due.
• Further, EU CSDs and their directors/employees are protected from liability when managing immobilised assets under EU sanctions, provided their actions comply with Restrictive Measures. Liability arises only in cases of proven negligence. This aligns with existing protections under EU Regulation 269/2014.
• The package extends existing derogations that allow EU businesses to divest from Russia.
• Additional entities have been added to Annex IV, including entities from third countries outside Russia. These entities are accused of circumventing export restrictions to support Russia's military and technological capabilities.
• Additional shadow fleet vessels have been added to Annex XVI of Decision 2014/512/CFSP, subjecting them to an EU port and dock access ban and prohibiting a wide range of maritime transport services.

The EU will continue monitoring oil trade dynamics and sanction evasion attempts, particularly involving G7 operators and "dark fleet" practices.

Markets in Crypto-Assets Regulation

The introduction of the Markets in Crypto-Assets Regulation (MiCAR) institutes uniform EU market rules for crypto-assets. It aims to harmonise rules across the EU, enhance consumer protection, ensure financial stability and prevent market abuse in the crypto sector.

Firms currently operating under Ireland's Virtual Asset Service Provider (VASP) regime must transition to MiCAR-compliant authorisation. Firms currently operating under VASP can continue to do so until 30 December 2025, unless their MiCAR application is approved or rejected.

Key features of MiCAR

• MiCAR covers crypto-assets not already regulated under existing EU financial laws.
• Crypto-Asset Service Providers (CASPs) must register and obtain authorisation from national regulators before operating in the EU.
• Strengthened transparency requirements, including mandatory white papers for crypto-asset offerings and new rules to prevent misleading marketing.
• CASPs must comply with strict operational, governance and prudential standards, as well as measures to prevent market manipulation.
• The European Securities and Markets Authority (ESMA) and national regulators will oversee CASP compliance.

Companies (Corporate Governance, Enforcement and Regulatory Provisions) Act 2024

The Companies (Corporate Governance, Enforcement and Regulatory Provisions) Act 2024 (the 2024 Act) came into effect on 3 December 2024. It has enhanced the enforcement powers of the Corporate Enforcement Authority (CEA) and has introduced provisions to facilitate greater information-gathering powers of the CEA in relation to its investigations.

This includes the power to seek additional information from auditors in relation to an indictable offence report and direct access to court orders restricting or disqualifying a director of an insolvent company. The 2024 Act has also introduced the new criminal offence relating to obstruction or interference with an officer of the CEA in the exercise of their powers under the Companies Act 2014.

The cohort of statutory bodies permitted to disclose information to the CEA has been expanded under the 2024 Act. These additional bodies include the Registrar of Beneficial Ownership, the Charities Regulator, the Minister for Social Protection, the Pensions Authority, the Financial Services and Pensions Ombudsman, the Data Protection Commission and the Protected Disclosures Commission. Additionally, the CEA is now authorised to share information with these bodies which would otherwise be confidential.

Dawn raids

Over the last two years, there has been an increase in the number of dawn raids carried out by Irish and EU regulators. A dawn raid is an inspection by a regulatory or law enforcement authority to investigate suspected breaches of the law by arriving at a business unannounced to conduct searches for documents, computers or other relevant records.

In the recent High Court decision of Commission for Communications Regulation (ComReg) v. Eircom Limited [2024] IEHC 49, Twomey J considered the effect of the statutory requirement on a regulator to maintain the confidentiality of legally privileged material seized in a dawn raid.

ComReg brought an application to the court seeking approval of a step plan to deal with the seized data. The step plan proposed that electronic word searches would be carried out to identify material relevant to the investigation, as well as to eliminate irrelevant and privileged information. Following the word searches, ComReg would commence its analysis of the data. The question before the court was which party would carry out the searches.

The court held that the regulator should conduct the searches while seeking to maintain confidentiality. Otherwise, the purpose of search and seizure by a regulator would be undermined. Separately, the court noted on several occasions that it would be preferable if Eircom had engaged with ComReg to identify the word searches.

The judgment highlights the importance of ensuring proper safeguards when privileged documents are involved in a regulatory investigation. Significantly for businesses, the judgment reinforces the necessity for firms to engage proactively with regulators to avoid procedural disputes.