On 21 November 2024, the Central Bank of Ireland (Central Bank) announced that it had fined BlueSnap Payment Services Ireland Limited (the Firm) €324,240 for breaching requirements of the European Union (Payment Services) Regulations 2018 (Payment Services Regulations).

Background

The Central Bank granted authorisation to the Firm as a payment institution in December 2020.

The Central Bank found that the Firm breached requirements of the Payment Services Regulations between January 2021 and December 2022 by:

• not depositing its customers’ funds in a designated safeguarding account;
• mixing its customers’ funds with other funds; and
• delaying informing the Central Bank once the Firm became aware that it was not following the safeguarding procedures that it had set out to the Central Bank in its application for authorisation.

This announcement follows a settlement reached between the Central Bank and the Firm on 19 November 2024. The sanctions, which the Firm has accepted, are subject to confirmation by the High Court and will not take effect unless they are confirmed.

The importance of safeguarding

The Payment Services Regulations contain safeguarding requirements for firms that provide regulated payment services. The purpose of safeguarding is to protect customers’ funds pending a payment being made and to ensure that if a firm becomes insolvent, customer funds are available to be returned fully and promptly to its customers. The Central Bank emphasises safeguarding in the context of regulatory authorisation and supervision as there is no compensation or deposit protection scheme applicable to payment institutions and electronic money institutions.

A payment institution’s business model is focused on enabling customers to make and receive payments. It must hold customers’ funds securely for the duration of those transactions in a segregated bank account established for the sole purpose of holding customer funds or have an insurance policy or comparable guarantee in place for an amount equal to the value of customer funds held.

Safeguarded customer funds which are held in a segregated bank account must not be mixed with the firm’s own funds or the funds of other group entities and their customers. Customer funds must always be identified, managed, and protected in this manner. Regulatory requirements include the clear segregation, designation, and reconciliation of any customer funds held.

Safeguarding is not a new area of focus for the Central Bank, which has in the past highlighted that weaknesses in safeguarding arrangements across the sector heighten the risk that users’ funds are not appropriately identified, managed, and protected on a day-to-day basis. For further information please see our article on the Payments and E-Money Sector Central Bank report here and the January 2023 Dear CEO letter from the Central Bank to the sector here.

Commenting on this matter, the Central Bank Director of Enforcement and Anti-Money Laundering said that “safeguarding of customer funds has been, and will continue to be, a key area of supervisory focus for the Central Bank“. This is also evident from the Central Bank’s approach of requiring payment institutions and electronic money institutions to conduct a safeguarding audit and from the conduct of thematic inspections on safeguarding by the Central Bank on payment institutions and electronic money institutions on an ongoing basis since H2 2024.

Information provided before and during authorisation

The Central Bank has reiterated that information provided to it by a firm in its application for authorisation is fundamental to whether the Central Bank will authorise the firm to provide regulated financial services. The integrity and accuracy of information provided to the Central Bank underpins the Central Bank’s decision to authorise a firm. The Central Bank expects firms to be able to demonstrate on an ongoing basis that they meet the assurances and commitments they have given at authorisation. For further information on the Central Bank’s approach to authorising payment institutions and e-money institutions please see here.

Reasons for breaches by the Firm

In this instance, the Firm’s failings are reported to have arisen due to deficiencies in regulatory awareness and understanding of reporting requirements, as well as inadequate oversight and monitoring by the firm of safeguarding operations provided by the firm’s wider group.

Contact us

Our Financial Regulation team has extensive experience advising regulated FinTechs, including payment institutions and electronic money institutions pre- and post-authorisation including authorisation, supervision and enforcement. For example, William Fry has acted for one-third of the electronic money institutions granted authorisation in Ireland to date on their successful applications. For more information, please contact Shane Kelleher, Louise McNabola or your usual William Fry contact.

Contributed by Jane Balfe.