Central Bank of Ireland identifies compliance gaps across MiFID firms

The review reinforces the importance of a permanent, independent and effective compliance function as a core component of a firm’s governance framework and as a key driver of customer outcomes.

The Central Bank thematic assessment (10-page / 296KB PDF) focused on three areas:

• adequacy of compliance frameworks
• effectiveness of compliance planning and monitoring
• quality of reporting to boards and sub committees

While firms were generally found to have a sound understanding of their obligations under MiFID II and related European Securities and Markets Authority guidelines, the Central Bank identified a number of weaknesses, which in its view limit the effectiveness of the compliance function.

Adequacy of compliance and related framework

At a structural level, the Central Bank noted that compliance functions are typically well embedded within organisations and, in many cases, appropriately resourced relative to the size and complexity of the firm. However, the review highlights that these strengths are not consistently matched by effective implementation.

In particular, the Central Bank identified weaknesses in demonstrating the adequacy of succession planning and with contingency arrangements to ensure continuity in compliance coverage. This creates a risk that compliance responsibilities may not be effectively discharged in periods of absence or transition, undermining the requirement for a continuous and effective compliance function.

The Central Bank also emphasised the importance of compliance culture, noting that, while training programmes are generally in place, for some firms the Central Bank observed that the compliance function is not sufficiently involved in their delivery.

Direct engagement by compliance in training is seen as an important mechanism for embedding regulatory awareness and reinforcing organisational accountability for compliance obligations.

Effectiveness of compliance planning, monitoring and testing

In relation to monitoring and testing, the Central Bank found that most firms have established risk-based compliance monitoring programmes, supported by appropriate methodologies and, in some cases, enhanced through the use of on-site inspections to test the practical application of policies and procedures.

However, weaknesses were identified in the underlying compliance risk assessment process. At some firms, identified risks were not subject to regular review, and compliance plans lacked sufficient detail or completeness. These shortcomings were viewed as impairing the ability of boards and committees to oversee compliance activity effectively and to challenge how compliance risks are managed.

The bank also highlighted examples of good practice, including firms linking monitoring findings to targeted training programmes and carrying out follow up testing to assess the effectiveness of those interventions. This approach was viewed positively as an example of how compliance monitoring can drive measurable improvements in business processes.

A further area of focus was horizon scanning. The Central Bank observed that most firms have processes in place to identify regulatory developments and emerging risks. However, it has emphasised that this capability should be prioritised as a core element of the compliance framework, enabling firms to adapt proactively and ensuring that boards and senior management have visibility of changes in the regulatory environment.

Compliance reporting

The quality of compliance reporting to boards and sub committees was generally found to be adequate, with regular reports covering relevant business areas and key findings. However, the Central Bank identified a consistent weakness in the documentation of board oversight. In particular, board and committee minutes did not always evidence meaningful discussion or challenge of compliance issues.

This is a significant point; the Central Bank’s findings suggest that while reporting frameworks are in place, there is insufficient evidence that boards are engaging with compliance matters in a way that demonstrates effective oversight and accountability.

Firms are therefore expected to ensure that board minutes accurately capture the level of discussion and challenge, providing a clear audit trail of governance activity.

The findings confirm that while firms have established compliance frameworks, firms should enhance their focus on how those frameworks operate in practice. In particular, improvements are required in the robustness of arrangements supporting the permanence of the compliance function, the depth and effectiveness of monitoring activities, and the quality of board oversight.

What this means for you

MiFID investment firms are expected to carry out a comprehensive self-assessment of their compliance function against the findings of the thematic review and the requirements set out in the MiFID II Delegated Regulation and ESMA guidance. Where gaps are identified, firms should implement remedial measures in a proactive and timely manner.

Firms are also reminded of their obligations under the Consumer Protection Code and related guidance on securing customers’ interests, including the requirement to act honestly, fairly and professionally in the best interests of clients. The compliance function is expected to play a key role in embedding these standards across the organisation.

The Central Bank also requires that the findings of the report be discussed at the next board meeting and that this discussion be formally recorded. This underlines the importance of board engagement and ensures senior governance bodies take ownership of the issues identified.

Looking ahead, the Central Bank has indicated that it may engage directly with firms on these matters as part of its ongoing supervisory activity. This suggests that compliance effectiveness will remain a key area of regulatory focus, with firms expected to demonstrate tangible progress in addressing the issues highlighted.