NEWVenvera speaks your language: the full platform, in English, German, Spanish, Bulgarian, Arabic and Chinese.See what’s new →
Individual Accountability Framework: What Applies
Learn

Individual Accountability Framework: What Applies

·Alexander Sverdlov

If you run compliance, HR or the company secretariat at a firm the Central Bank of Ireland regulates, this guide tells you which parts of the Individual Accountability Framework bind your firm and what evidence each part needs. The Conduct Standards and the five firm duties in section 53H apply to every regulated firm. The Senior Executive Accountability Regime applies only to the banks, insurers, investment firms and branches its regulations list. Payment and e-money institutions, which sit outside that regime, get a clear account of what still applies to them, checked against the Act, the 2024 regulations and the Central Bank's own guidance.

The short answer. The Individual Accountability Framework comes from the Central Bank (Individual Accountability Framework) Act 2023. Every person in a controlled function, in every regulated firm, must meet the Common Conduct Standards, and senior people the Additional Conduct Standards, since 29 December 2023. Every firm must notify and train those people on the standards and keep policies on how they are applied (section 53H), and certify every controlled function holder each year. The Senior Executive Accountability Regime (SEAR) adds responsibility maps, statements of responsibilities and a personal duty of responsibility, but only for banks, insurers other than captives, certain investment firms and third-country branches, from 1 July 2024 for executives and 1 July 2025 for non-executive directors. The Central Bank can now sanction individuals directly for their own breaches.
ElementWho it bindsFromSource
Common Conduct StandardsEvery person in a controlled function, in every regulated firm29 December 20232010 Act ss. 53C, 53E
Additional Conduct StandardsPCF holders and anyone with significant influence (CF-1)29 December 2023ss. 53C(2), 53F
Notify, train, set policiesEvery regulated firm29 December 2023s. 53H
Certification of controlled functionsEvery regulated firm and in-scope holding company8 January 2024; first annual return in 2025s. 21; S.I. No. 2 of 2024
SEARBanks and building societies, insurers other than captives, certain investment firms, third-country branches1 July 2024; non-executives 1 July 2025S.I. No. 147 of 2024
Duty of responsibilityPCF holders in SEAR firms with inherent or allocated responsibilitiesWith SEARs. 53B
Sanctions on individualsAnyone who breaches their own obligations, including the Conduct StandardsUnder the amended administrative sanctions procedure1942 Act Part IIIC; s. 33AQ
The four parts of Ireland's Individual Accountability Framework: Conduct Standards and fitness and probity changes for every firm, SEAR for banks, insurers and certain investment firms, and administrative sanctions against individuals

What is the Individual Accountability Framework?

The Central Bank (Individual Accountability Framework) Act 2023 was signed into law on 9 March 2023, partly commenced on 19 April 2023, and fully commenced on 29 December 2023. Some parts needed Central Bank regulations before they took effect: the SEAR Regulations (S.I. No. 147 of 2024) and the Certification Regulations (S.I. No. 2 of 2024). The Central Bank's IAF page describes four elements: SEAR; the Conduct Standards; enhancements to the fitness and probity regime; and changes to the administrative sanctions procedure that allow it to act directly against individuals who breach their own legal obligations. Its April 2024 Guidance on the Individual Accountability Framework explains how it applies each one.

The framework is about clarity: who in a firm is responsible for what, and enforceable standards for how individuals behave. It works alongside the firm-level standards. The Central Bank describes the Standards for Business in the Consumer Protection Code 2025 as the counterbalance to the individual Conduct Standards, so the firm and the people in it answer to parallel duties.

What are the Common Conduct Standards?

Section 53E of the Central Bank Reform Act 2010 sets five standards for every person performing a controlled function, CF-1 to CF-11, in every regulated firm. Section 53C requires each person to take any steps that are reasonable in the circumstances to ensure the standards are met.

StandardWhat it includes
(a) Honesty and integrityRegard for the legitimate interests of the firm, its staff and customers; operating without bias and managing conflicts; no pressure that limits a customer's informed choice; no misuse of assets or information; reporting suspected breaches and other matters adversely affecting customers or the firm to management, and not impeding others from reporting
(b) Due skill, care and diligenceKnowing the business, its risks and the rules relevant to the role; following the firm's systems and controls; acting without detriment to customers, the firm or the financial system; clear and accurate communications; sound, informed decision-making; monitoring delegated tasks
(c) Cooperation with the Central BankResponding openly and on time, disclosing information when required, attending meetings and interviews, giving no false or misleading information, not hiding or destroying records, no evasive or obstructive conduct; the same towards comparable authorities abroad
(d) Customers' best interestsInforming customers clearly and in time, assessing their needs and circumstances, giving suitable advice, not misleading them, seeking to resolve complaints, resolving and disclosing errors, and not acting unfairly
(e) Market conductComplying with the standards of market conduct and trading venue rules that apply to the firm

What are the Additional Conduct Standards?

Section 53F adds four standards for anyone performing a pre-approval controlled function, and for anyone else whose function lets them exercise significant influence on the conduct of the firm's affairs (CF-1). They must take reasonable steps to ensure that:

  1. the business is controlled effectively;
  2. the business is conducted in line with the firm's obligations under financial services legislation;
  3. delegated tasks are assigned to an appropriate person, with effective oversight; and
  4. information the Central Bank would reasonably expect to receive is disclosed to it promptly and appropriately, including anything suggesting an offence or a prescribed contravention, concealment or destruction of evidence, false information given to the Central Bank, obstruction of an investigation, legal proceedings arising from the firm's obligations or threatening its ability to trade, anything that may interfere significantly with its operation or compliance, and a decision to stop providing a type of financial service.

PCF holders carry a further, older duty. Under section 38(2) of the Central Bank (Supervision and Enforcement) Act 2013, a person in a pre-approval controlled function must, as soon as practicable, disclose to the Central Bank information about a suspected offence or breach of financial services legislation, or concealment of evidence of one, that they believe will materially assist it, unless they have a reasonable excuse such as self-incrimination or the information having already been disclosed by someone else.

The five Common Conduct Standards in section 53E for every controlled function and the four Additional Conduct Standards in section 53F for PCF holders and CF-1s, with the reasonable steps test in sections 53C and 53D

What does reasonable steps mean?

Both the Conduct Standards and the duty of responsibility are framed as duties to take "any steps that it is reasonable in the circumstances" to take. Section 53D lists the matters that decide what was reasonable: the nature, scale and complexity of the firm; the person's functions and the knowledge and experience someone in that role could be expected to have; the person's own knowledge and experience; whether appropriate systems, oversight of delegation and procedures for identifying and fixing problems existed and were applied; how far those matters were within the person's control or influence; and, for the Conduct Standards, the Central Bank's guidelines under section 53G.

In practice that turns into evidence. A senior manager who can show the management information they received, the questions they asked, the escalations they made and the actions minuted is in a far stronger position than one who can only point to a policy. The concept applies to individuals only: the Central Bank deliberately did not carry it into the firm-level securing customers' interests standard in the Consumer Protection Code.

What must every firm do under section 53H?

Section 53H puts five duties on every regulated firm, whether or not it is in SEAR, so these are the parts of the framework a payment institution, an e-money institution, a credit union or an intermediary must evidence:

  1. notify every controlled function holder of the Common Conduct Standards and how they apply to that function;
  2. train them so they have appropriate knowledge of those standards;
  3. notify PCF holders and CF-1s of the Additional Conduct Standards and how they apply;
  4. train them on the Additional Conduct Standards; and
  5. establish, maintain and give effect to policies on how the Common Conduct Standards are integrated into the conduct of the firm's affairs.

The IAF Guidance (sections 4.26 to 4.33) describes what that looks like. One person owns it: the holder of prescribed responsibility PR3 in a SEAR firm, and the chief executive or equivalent elsewhere. Firms keep up to date records of every notification and of completed training, available to the Central Bank on request. New controlled function holders get induction training in good time, followed by ongoing training tied to what is expected in their role, and senior management receives management information on training and acts on gaps. The standards also bind temporary officers appointed to vacant PCF roles, as our guide to fitness and probity at the Central Bank of Ireland explains.

The five firm duties in section 53H, to notify and train controlled function holders on the Common and Additional Conduct Standards and to set policies, with the evidence the Central Bank expects under the IAF Guidance

Which firms are in SEAR, and from when?

Regulation 2 of the SEAR Regulations applies them to relevant credit institutions, relevant insurance undertakings and relevant investment firms. The definitions in Regulation 3 make that: banks licensed in Ireland, building societies, branches of non-EEA banks and Class 1 investment firms authorised under the Central Bank Act 1971; insurance undertakings other than captives, and branches of third-country insurers; and investment firms that deal on own account, underwrite or place on a firm commitment basis, or are permitted to hold client assets, including the equivalent third-country branches. Most of the Regulations came into operation on 1 July 2024; the provisions covering non-executive directors (Regulations 5, 6(3), 6(5) and 10(2)) followed on 1 July 2025.

Everyone else is outside SEAR, including payment institutions, e-money institutions, credit unions, captive insurers, intermediaries and fund service providers. Those firms still carry the Conduct Standards, the section 53H duties and the fitness and probity changes. The Central Bank has said it will review the PCF list to coincide with its review of SEAR in 2027 (Feedback Statement to CP160), so check the scope again then.

What does SEAR require of the firms it covers?

Building blockWhat the firm must doRegulation
Inherent responsibilitiesAccept the responsibilities that come with each PCF role, such as the chief executive's overall responsibility for managing and steering the business; for non-executive roles since 1 July 20254, 5; Schedules 1 and 1A
Prescribed responsibilitiesAllocate each of PR1 to PR24, plus the sector items, to a single PCF holder; PR4, PR6, PR8 to PR12 go to a non-executive. PR2 is fitness and probity, PR3 the conduct standards, PR12 whistleblowing6; Schedule 2
Other responsibilitiesDesignate any activity or function not otherwise covered and allocate it to a PCF holder; the Central Bank can also designate one8
Management responsibilities mapOne up to date document describing the business, reporting lines, matters reserved to the board, group links, each PCF holder's responsibilities, any joint allocation and who oversees each outsourcing7
Statements of responsibilitiesOne for each PCF holder listed in Schedules 1 and 1A, kept up to date, and sent with every application for PCF approval10
On request and on fileSubmit the map or statements when the Central Bank asks; keep every version for 10 years after it is superseded, and a former PCF holder's statement for 10 years after they leave11, 12
What SEAR asks of the firms it covers: inherent, prescribed and other responsibilities, the management responsibilities map and statements of responsibilities, and the duty of responsibility in section 53B

What is the duty of responsibility?

Section 53B applies to a PCF holder in a SEAR firm who has inherent responsibility for an aspect of the firm's affairs under the SEAR Regulations, or allocated responsibility under the firm's arrangements. While they hold that responsibility, they must take any steps reasonable in the circumstances to ensure that part of the business is run so as to avoid the firm contravening its obligations under financial services legislation, which includes avoiding the continuation of a contravention. The reasonable steps factors in section 53D apply, which is why statements of responsibilities, maps and minuted challenge matter: they are the record of what each person was responsible for and what they did about it.

How has enforcement changed for individuals?

The Central Bank can now take action under its administrative sanctions procedure directly against individuals who breach their own legal obligations, including the Conduct Standards, without first having to show they participated in a breach by the firm, and it published consolidated Administrative Sanctions Procedure Guidelines in December 2023. Under section 33AQ of the Central Bank Act 1942, the maximum monetary penalty for an individual is €1 million. On the fitness and probity side, the Central Bank can investigate anyone who performed a controlled function in the 6 years before an investigation begins, and prohibit a person found unfit, including a PCF holder who failed to make a required disclosure under section 38(2) of the 2013 Act (2010 Act section 43(2)(ca)).

What do the other guides get wrong?

Most of the pages that rank for this query were written before the framework took effect, and several have not been updated. We checked their claims against the Act, the regulations and the Central Bank's pages.

  1. The wrong start date. A Big Four consultancy's IAF page lists the Conduct Standards, and firm certification, as applying "From 31 December 2023", and another firm's explainer says the Conduct Standards were "effectively to apply from 31 December 2023". The Central Bank's page says the Conduct Standards have applied since 29 December 2023, and the revised Act records sections 53A to 53H as inserted by section 6 of the 2023 Act and commenced on 29 December 2023 by S.I. No. 349 of 2023.
  2. Who the Conduct Standards cover. One consultancy factsheet says the conduct standards "apply to all individuals employed by an RFSP except ancillary staff" and that "all employees will need to be trained". Sections 53C and 53E apply to people performing controlled functions, and the section 53H training duty is owed to controlled function holders, so the population to notify and train is the firm's register of controlled function holders.
  3. SEAR's reach. A compliance vendor's 2025 explainer says "SEAR applies to individuals in pre-approval controlled functions (PCFs) within regulated firms", and in September 2025 still says it "will extend" to non-executive directors from 1 July 2025. SEAR applies only in the firms listed in Regulation 2 of S.I. No. 147 of 2024, and the non-executive provisions have applied since 1 July 2025. A payment or e-money institution reading the first sentence would wrongly prepare SEAR maps it does not need.
  4. Timelines that never happened. Pages written in 2021 and 2022 still rank with SEAR expected "by the end of 2022" or "from a date in Q3 or Q4 2022". The Regulations were made in 2024 and applied from 1 July 2024.

Where do you stand?

Fill this in for your firm. Each blank is evidence the Central Bank can ask to see.

QuestionYour answerRequirement
Has every controlled function holder been notified of the Common Conduct Standards, with a dated record?s. 53H(1)(a); Guidance 4.28
Have PCF holders and CF-1s been notified of the Additional Conduct Standards?s. 53H(1)(c)
Did every new CF holder get induction training on the standards, and is completion recorded?s. 53H(1)(b), (d); Guidance 4.29, 4.30
Is there a written policy on how the Common Conduct Standards are integrated into the business?s. 53H(1)(e)
Who owns the conduct standards: the PR3 holder or the chief executive?Guidance 4.27
Are you in SEAR under Regulation 2, and if so are the map and every statement of responsibilities current?S.I. No. 147 of 2024 Regs 2, 7, 10
Do your PCF holders know their duty to report suspected breaches to the Central Bank?2013 Act s. 38(2)

Venvera keeps the evidence for each of these in one place: the Ireland framework carries the Individual Accountability Framework duties as requirements with owners, due dates and evidence, including the SEAR requirements marked for SEAR firms only, so a payment or e-money institution can record them as not applicable with the reason. Training assignments and policy approvals sit alongside them. Venvera records and tracks; it does not decide what your firm's responsibilities map should say.

Venvera Ireland framework requirements list with each reference, readiness score, evidence count and a request for evidence
The Ireland framework requirements in a demo workspace, ordered by what moves the score most. The Conduct Standards and SEAR duties are rows in the same list, each with its readiness score, evidence count and a request for evidence.
Venvera training page showing training modules, a completion overview with passed, failed and in progress counts, and assignments
Training in Venvera, shown here with security awareness modules. Conduct Standards induction and refresher training can be assigned and tracked the same way, with completion records for the Central Bank.

Run the free compliance check, book a demo, or start a 14-day Professional trial with no credit card. Plans are on the pricing page.

Frequently asked questions

What is the Individual Accountability Framework?

Ireland's framework for individual accountability in regulated financial firms, introduced by the Central Bank (Individual Accountability Framework) Act 2023. It has four parts: Conduct Standards, changes to fitness and probity, the Senior Executive Accountability Regime and sanctions against individuals.

When did the Conduct Standards come into force?

On 29 December 2023, for every person in a controlled function in every regulated firm. Sections 53A to 53H, inserted into the Central Bank Reform Act 2010 by section 6 of the 2023 Act, were commenced on that date by S.I. No. 349 of 2023.

Does SEAR apply to payment institutions and e-money institutions?

No. SEAR applies to the banks, building societies, insurers other than captives, certain investment firms and third-country branches listed in Regulation 2 of S.I. No. 147 of 2024. Payment and e-money institutions still carry the Conduct Standards, the section 53H duties and certification.

What are the Common Conduct Standards?

Five standards in section 53E: act with honesty and integrity; act with due skill, care and diligence; cooperate with the Central Bank; act in customers' best interests and treat them fairly; and comply with market conduct standards and trading venue rules.

Who must meet the Additional Conduct Standards?

Anyone performing a pre-approval controlled function and anyone else whose function lets them exercise significant influence on the firm's affairs (CF-1). They must take reasonable steps to ensure the business is controlled effectively, meets its obligations, delegates properly and keeps the Central Bank informed.

What must firms do under section 53H?

Notify controlled function holders of the Common Conduct Standards and PCF holders and CF-1s of the Additional Conduct Standards, train both groups, and keep policies on how the Common Conduct Standards are integrated into the business.

What is a statement of responsibilities?

A standalone document for each PCF holder in a SEAR firm listed in Schedules 1 and 1A, setting out their inherent, prescribed and other responsibilities. It must be kept up to date, sent with any PCF application and retained for 10 years after it is superseded.

What is the duty of responsibility?

The section 53B duty on a PCF holder in a SEAR firm to take reasonable steps to avoid the firm breaching its obligations in the areas they are responsible for, including stopping a breach continuing.

What is the maximum fine for an individual?

Under section 33AQ of the Central Bank Act 1942, the maximum monetary penalty the Central Bank can impose on an individual through the administrative sanctions procedure is €1 million.

Who in the firm owns the Conduct Standards?

In a SEAR firm, the holder of prescribed responsibility PR3, responsibility for embedding the conduct standards throughout the firm. In other firms the Central Bank treats the chief executive or equivalent as responsible.

Primary sources

Duties and dates are taken from Part 3A of the Central Bank Reform Act 2010 (sections 53B to 53H) as inserted by the Central Bank (Individual Accountability Framework) Act 2023, the SEAR Regulations (S.I. No. 147 of 2024), the Certification Regulations (S.I. No. 2 of 2024), section 38 of the Central Bank (Supervision and Enforcement) Act 2013, section 33AQ of the Central Bank Act 1942, the Central Bank's Individual Accountability Framework page and its Guidance on the Individual Accountability Framework (April 2024). Requirements are summarised; read the full text before relying on a specific provision.

Alexander Sverdlov

Alexander Sverdlov

CEO & Founder

Alexander is the founder of Venvera and a 20+ year veteran of European cybersecurity and compliance. He has led security and risk programmes for regulated financial institutions, fintechs and SaaS companies operating under DORA, NIS2, GDPR, ISO 27001 and the EU AI Act. Before Venvera, he founded Atlant Security, an offensive security consultancy that ran penetration tests, red-team exercises and ISO 27001 readiness programmes for clients across the EU and the Middle East. He writes on the cross-framework realities of running modern compliance: how to map one control to many obligations, where the spreadsheets fall apart, and what regulators are actually asking for once the auditor sits down.

More articles by Alexander →

CONTINUE READING