Fitness and Probity Ireland: Rules and PCF List

If you look after fitness and probity at a firm the Central Bank of Ireland regulates, as head of compliance, company secretary or the person who owns certification, this guide sets out the whole cycle in the order you run it: which roles are controlled functions, the due diligence the Central Bank expects before anyone is appointed, how a pre-approval application moves through its gatekeeping process, the yearly certification and Portal confirmation, and what to do when a concern comes up. It is written against the November 2025 Standards and Guidance and the PCF list as amended on 10 February 2026, including the new head of safeguarding role for payment and e-money institutions.

What is the fitness and probity regime?

Part 3 of the Central Bank Reform Act 2010 created the regime on 1 October 2010. It applies to regulated financial service providers, credit unions included, and, since the Individual Accountability Framework Act 2023, to holding companies established in Ireland. The Guidance describes three pillars: the firm's own obligations, the Central Bank's gatekeeping role for pre-approval controlled functions, and its powers to investigate, suspend and prohibit individuals (Guidance 1.3).

The standards themselves are a code the Central Bank issues under section 50 of the 2010 Act, now the Fitness and Probity Standards 2025, which consolidated the 2023 Standards and the 2024 Standards for credit unions. Section 2.2 requires a person in a controlled function to be competent and capable; honest, ethical and to act with integrity; and financially sound. Section 2.3 adds candour: information given to the firm or the Central Bank must be full, fair, accurate and not misleading. The Minimum Competency Code is also a standard of fitness and probity for the staff it covers (Guidance 1.11).

The firm carries the first responsibility. A firm must not permit anyone to perform a controlled function unless it is satisfied on reasonable grounds that the person complies with the Standards, the person has agreed in writing to comply, and a certificate of compliance is in force (section 21). The Central Bank has approved appointments to more than 11,000 roles under the regime since 2020, according to its December 2024 announcement of a dedicated Fitness and Probity Unit.

What changed in fitness and probity in 2025 and 2026?

The November 2025 Guidance consolidated the Central Bank's earlier guidance into one document that applies to every sector. The changes with the most practical effect are a formal temporary officer route for vacant PCF roles (sections 2.36 to 2.44), a general rule that an adverse finding more than ten years old is unlikely to matter on its own, unless a custodial sentence was imposed or aggravating circumstances keep it relevant (sections 3.39 and 3.40), clearer expectations on time commitment and multiple PCF roles (chapter 4), and simpler probity evidence for payment, e-money and account information firms (section 3.25). The Central Bank's 2026 implementation report confirms all twelve of the Enria recommendations have been implemented.

Which roles are controlled functions and which need pre-approval?

Schedule 1 of S.I. No. 437 of 2011 defines eleven controlled functions. CF-1 is any function likely to give a significant influence over the conduct of the firm's affairs, CF-2 covers ensuring, controlling or monitoring compliance, CF-3 to CF-8 are customer-facing functions such as giving advice, arranging services, handling insurance claims, supervising those staff and adjudicating complaints, CF-9 covers certain insurance mediation roles, and CF-10 and CF-11 cover dealing with customer or firm property. A subset of controlled functions are pre-approval controlled functions, listed in Schedule 2 as substituted by S.I. No. 20 of 2026 from 10 February 2026.

Some people fall outside the Standards altogether, for example staff who only follow a script for routine matters, and functions carried out under a written agreement by another regulated firm (Standards 2025, section 1.5). The Guidance recommends reviewing every job description when a vacancy arises to decide whether the role is a CF or a PCF, and expects firms to keep a register of everyone in a controlled function (Guidance 5.7).

What due diligence must a firm carry out before an appointment?

Section 21 is a continuing duty, and chapter 3 of the Guidance sets out what the Central Bank expects firms to check before appointment and on an ongoing basis, proportionately to the role and the firm. The checks fall under the three standards.

Four points are often missed. Where one person holds several controlled functions, the higher standard applies to the due diligence (3.18). If the firm cannot get enough information to conclude, particularly because the person does not cooperate, the Standards may not be met (3.19). For customer-facing roles CF-3 to CF-11, Appendix 4 shows where self-certification by the individual is enough. And the firm should draw an overall conclusion from the whole picture, recorded on file, because the Central Bank will examine the firm's analysis of what the role requires as well as the checks themselves (3.14 and 3.20).

What extra evidence do payment and e-money institutions need?

Payment institutions, e-money institutions and account information service providers must meet the EBA Guidelines on authorisation under PSD2, so their PCF applications need more evidence of reputation, honesty and integrity (Guidance 3.25). An applicant must give objective evidence that they have no criminal convictions, investigations or proceedings. Irish residents meet this through Garda vetting that the Central Bank runs as part of the PCF application; others provide an official police certificate from their country of residence, where available, or another objectively reliable source, which can include testimony from a lawyer in each jurisdiction where they have lived. An affidavit sworn by the applicant does not count, because it is not objective, and the evidence is generally valid for 6 months from issue. Anyone previously assessed by another regulator, or by a non-financial authority, must also name the authority and the date and evidence the outcome.

The PCF list now includes a role aimed squarely at these firms. Since 10 February 2026 a head of safeguarding (PCF-56) needs pre-approval through the usual Individual Questionnaire; a person who was already performing the role before that date did not need to apply, but the firm had to carry out the due diligence the Guidance requires before completing the in-situ submission on the Portal. Our guide to PSD2 compliance requirements explains the safeguarding duties that role oversees, and the Consumer Protection Code 2025 guide sets out which conduct rules bind the same firms.

How does PCF pre-approval work?

Section 23 of the 2010 Act forbids a firm to appoint anyone to a PCF until the Central Bank has approved the appointment in writing. The firm completes its own due diligence first and must be in a position to certify the person before it submits the Individual Questionnaire, which the proposed appointee completes and the firm endorses on the Central Bank Portal (Guidance 5.13). The Central Bank's Gatekeeper Process sets out what happens next.

1. Completeness check. Within 5 working days the Central Bank decides whether the application is complete. An incomplete one is returned and a new questionnaire must be submitted; the assessment starts from the date a complete questionnaire is received.
2. Assessment. The application is assessed against the Standards, with checks with third parties and supervisors, requests for more information where needed and, in some cases, an interview. Interviews come with at least 5 working days' notice and are scheduled for 90 minutes; minutes follow within 5 working days, and the interviewee has a further 5 working days to correct factual errors.
3. Decision. The Central Bank aims to conclude within 90 days, while saying the target will not always be met. Where material concerns remain, it issues a minded to refuse letter, the firm and the individual typically get 10 working days to respond, and a committee of senior officials decides.
4. Appeal. A refusal can be appealed to the Irish Financial Services Appeals Tribunal.

When a PCF falls vacant suddenly, the Guidance now allows a temporary officer. The firm notifies the Central Bank in writing, with the reasons, the person's agreement to the Standards, the intended duration, the succession plan and confirmation that the firm can certify the person, and the appointment takes effect only when the Central Bank agrees in writing. A PCF application for the role must follow within three months, and temporary appointments to the same role cannot run beyond six months in total except in exceptional circumstances (sections 2.36 to 2.44). Since May 2025, the name, date and place of birth of PCF applicants are also recorded on the information sharing system the European Supervisory Authorities use to see whether another supervisor has assessed someone.

What is certification and the Annual PCF Confirmation?

Certification is the firm's own sign-off, and it applies to every controlled function, PCF or not. Under section 21 and the Certification Regulations (S.I. No. 2 of 2024), a firm issues a certificate of compliance for each controlled function a person performs, before the appointment, once it is satisfied on reasonable grounds that the person meets the Standards and the person has agreed in writing to comply and to tell the firm without delay if that stops being true. The certificate is valid for 12 months (Regulation 5(f)), so the cycle repeats at least every year, and again whenever new facts call the person's fitness or probity into question or they take on a new controlled function (Guidance 5.13).

For each person the firm records the controlled functions held, the parts of the business they will be involved in, the basis on which it is satisfied they meet the Standards, and whether the role is outsourced to an unregulated entity (Regulation 6; Guidance 5.3). The signed agreement uses the template in Appendix 3 of the Guidance, and individuals confirm at least annually that they know the Standards and will keep to them. Everything relied on is kept for at least 6 years after the person stops performing the role (Regulation 7).

Every year, from 1 January, the firm confirms to the Central Bank through the Portal that it has completed certification for each PCF holder and for its other controlled function holders as a whole (Regulation 8; Guidance 5.20). Individual certificates are not submitted. Where a gap will not affect certification, such as continuing professional development hours that are scheduled but not yet done, the firm records the instance, the reason and a remediation date, and confirms that certification is otherwise complete (5.21). Where a firm revokes a certificate or decides not to renew it because the person no longer meets the Standards, it must notify the Central Bank (Regulation 9).

Two points of ownership matter. Central Bank approval of a PCF is not itself a certification: the firm must still certify the person under section 21 (Guidance 5.5). And one individual must own certification: in a firm within the Senior Executive Accountability Regime, the holder of prescribed responsibility PR-2; in other firms, the chief executive or equivalent (5.29). How the wider accountability rules work is in our guide to the Individual Accountability Framework.

What happens when a concern about fitness or probity arises?

Individuals should tell the firm without delay if they no longer meet the Standards. When a firm becomes aware of a possible concern, the Central Bank expects it to investigate and act without delay, and to notify the Central Bank of material changes and of any action taken, such as a formal written warning, a suspension or dismissal, or a reduction or recovery of remuneration. If the person stays in the role, the firm must give the rationale for being satisfied that they still meet the Standards (Guidance 5.30 to 5.33).

The Central Bank has its own powers under Chapters 3 and 4 of Part 3. It can investigate the fitness and probity of a person in a controlled function, a proposed appointee, or anyone who performed a controlled function in the 6 years before the investigation began (section 25), issue a suspension notice while it investigates (section 26), and impose a prohibition notice (section 43), which can bar someone from a role, part of a role, one firm, a class of firms or all regulated firms, for a set period or indefinitely. After consultation CP166, the Central Bank published final Supplemental Guidance on prohibition notices on 30 July 2026, covering how the scope and duration of a prohibition are set, publication, and when a prohibition ends; it is read with the 2023 guidance on investigations, suspensions and prohibitions.

What do the other guides get wrong?

The pages that rank for this query are the Central Bank's own pages and law firm briefings, each written when one part of the regime changed. We checked them against the instruments and found these points worth knowing.

1. Two effective dates. Three law firm notes say the revised Guidance took effect on 20 November 2025, and one calls that retrospective. The Feedback Statement to CP160, in the version on the Central Bank's website, says the Guidance takes effect from the date the Feedback Statement was published, 25 November 2025. If a policy or board paper cites a date, use the Central Bank's.
2. The signing date of the new PCF list. One briefing says the Governor signed S.I. No. 20 of 2026 on 29 January 2026; the instrument itself records 28 January 2026. It came into operation on 10 February 2026.
3. Pages that predate the current texts. A February 2024 briefing that still ranks points readers to the December 2023 Standards and Guidance, both replaced in November 2025. A 2017 article on the Annual PCF Confirmation also still ranks; it predates the Certification Regulations, under which the yearly return now also confirms certification for all other controlled function holders (Regulation 8(b)).
4. What the pages leave out. None of the ten pages we read says who must own certification inside the firm, PR-2 or the chief executive, or that Central Bank approval of a PCF does not replace the firm's own certificate. Only one gives the 12 month life of a certificate, the 6 year retention period and the 1 January return.

Where do you stand?

Fill this in for your firm. Each blank is a question the Central Bank can ask at the next inspection.

In Venvera the fitness and probity work sits in the Ireland framework as requirements with owners, due dates and evidence: certification before appointment, the yearly re-certification, the Annual PCF Confirmation, notification of revoked certificates and record retention, with the recurring dates on the compliance calendar. It holds the evidence your team gathers; it does not submit Individual Questionnaires, run Garda vetting or file anything on the Central Bank Portal.

Start with the free compliance check, book a demo, or start a 14-day Professional trial with no credit card.

Frequently asked questions

What is fitness and probity in Ireland?

It is the Central Bank of Ireland's regime under Part 3 of the Central Bank Reform Act 2010 that requires people in controlled functions at regulated firms to be competent and capable, honest, ethical and of integrity, and financially sound, and requires firms to check and certify this.

What is the difference between a CF and a PCF?

A controlled function (CF-1 to CF-11) is a role the firm itself must vet and certify. A pre-approval controlled function is a senior subset, listed in Schedule 2 of S.I. No. 437 of 2011, that also needs the Central Bank's written approval before the person is appointed.

How long does PCF approval take?

The Central Bank checks completeness within 5 working days and aims to conclude its assessment within 90 days, while noting that the target is not achievable in every case. Interviews, requests for information and a minded to refuse process can add time.

What is PCF-56?

Head of safeguarding for payment institutions, electronic money institutions and small e-money institutions, added to the PCF list by S.I. No. 20 of 2026 from 10 February 2026. Crypto-asset service providers have the equivalent PCF-57.

How often must controlled functions be certified?

Before appointment, then at least once a year because a certificate lasts 12 months, and again when new facts call a person's fitness or probity into question or they take on another controlled function.

What is the Annual PCF Confirmation?

A yearly Portal return, available from 1 January, in which the firm confirms it has completed certification for each PCF holder and for its other controlled function holders as a whole. Individual certificates are kept on file and not submitted.

Does Central Bank approval of a PCF count as certification?

No. The Guidance says approval is not a certification of the person's compliance; the firm must still satisfy itself on reasonable grounds and certify under section 21 of the 2010 Act.

How long must fitness and probity records be kept?

For at least 6 years after the person stops performing the controlled function, covering the due diligence, the certificates and the signed agreements to comply.

Can a firm appoint someone temporarily to a vacant PCF role?

Yes, as a temporary officer, by written notification and with the Central Bank's written agreement. A PCF application must follow within three months, and temporary appointments to the same role are capped at six months except in exceptional circumstances.

What evidence do payment and e-money PCF applicants need?

Objective evidence of no criminal convictions, investigations or proceedings: Garda vetting for Irish residents, or a police certificate or other objectively reliable source such as lawyer testimony for others, generally valid for 6 months. A sworn affidavit from the applicant is not accepted.

Who in the firm is responsible for certification?

In a firm within the Senior Executive Accountability Regime, the holder of prescribed responsibility PR-2; in other firms, the chief executive or equivalent. Day-to-day work can be delegated.

Primary sources

Rules and dates are taken from Part 3 of the Central Bank Reform Act 2010 (sections 21, 23, 25, 26 and 43), S.I. No. 437 of 2011 with the PCF list substituted by S.I. No. 20 of 2026, the Certification Regulations (S.I. No. 2 of 2024), the Fitness and Probity Standards 2025, the Guidance on the Standards of Fitness and Probity (November 2025), the Feedback Statement to CP160, the Fitness and Probity Gatekeeper Process (April 2025), the Central Bank's fitness and probity news page, its CP166 page and its announcement of the Fitness and Probity Unit. Requirements are summarised; read the full text before relying on a specific provision.