On 5 October 2020, the Central Bank of Ireland (CBI) published new additions to the list of Pre-Approval Controlled Functions (PCFs). The new PCFs are listed in the Central Bank Reform Act 2010 (Sections 20 & 22) (Amendment) Regulations 2020, which regulations came into effect on 5 October 2020. The new additions follow the CBI’s Notice of Intention issued in February 2020 for Regulated Financial Services Providers (RFSPs).
(Re)insurers and (re)insurance intermediaries will only need to focus on the new PCF-49 role of Chief Information Officer, which we look at in more detail below.
New Pre-Approval Controlled Functions:
The CBI has prescribed the following functions as PCFs under Part 3 of the Central Bank Reform Act 2010 (2010 Act):
- PCF-49 Chief Information Officer
- PCF-50 Head of Material Business Line
- PCF-51 Head of Market Risk
PCF-49 Chief Information Officer applies to all RFSPs other than credit unions, while the PCF-50 and PCF-51 roles only apply to RFSPs that are designated as credit institutions under the European Union (Capital Requirements) Regulations 2014.
The basis for the new PCF roles includes the:
- increasing significance of and reliance on information technology in RFSPs; and
- effect of Brexit on the banking sector in Ireland, including the entry or expansion of investment banks and broker-dealer firms with significant capital markets activity.
Chief Information Officer (CIO)
PCF-49 Chief Information Officer is applicable to all RFSPs other than credit unions. This means every (re)insurer and (re)insurance intermediary should undertake a review of its current functions.
The CBI has acknowledged that the role of CIO may be shared between other controlled functions where the RFSP does not require a specific CIO or that a person in the RFSP can occupy the CIO role in addition to another PCF role that they already hold (e.g. a COO could also be the CIO).
In line with the CBI’s Guidance on Fitness and Probity, there is no CBI requirement for a CIO where the role of CIO did not exist in the RFSP previously, or where the size or complexity of the RFSP’s business does not merit it. The onus will be on each (re)insurer and (re)insurance intermediary to review its functions to decide whether any of its functions meet the CIO role in substance.
When reviewing such functions, the PCF category will be determined by the function of the role, not the job title of the person performing the role. The CBI have stated that the individual who performs the CIO role, is likely to be able to exercise considerable influence on the RFSP’s affairs. Consequently, the RFSP’s most senior individual responsible for information technology matters is most likely to hold the CIO role.
The CBI have stated that they expect the CIO role would likely apply where:
- the PRISM impact of the RFSP is rated High or Medium High; or
- information technology is a key enabler or core element of the RFSP’s business model.
Each (re)insurer and (re)insurance intermediary should apply the principle of proportionality when considering whether the CIO role is applicable to the size and complexity of its operations, the nature of its activities, types of service, as well as the corresponding information and communication technology (ICT) and security risks related to its processes and services.
The CBI expects the CIO role to be applicable, if an RFSP’s size nature and complexity merits a CIO role and failure of its ICT would result in negative consequences for:
- the provision of critical services to its customer base, taking into consideration potential
- customer detriment it may cause;
- the RFSP’s ability to meet its regulatory obligations; and
- the overall stability of the financial system in Ireland.
“In Situ” Individuals & new appointments
RFSPs were not required to seek the prior approval of the CBI to allow a person who was “in situ” on 5 October 2020 to perform the relevant PCF-49, PCF-50 and/or PCF-51 role.
The CBI allowed each RFSP a 6-week period, which expired on 16 November 2020, to conduct an assessment of the individual(s) under section 21 of the 2010 Act who were “in situ” in the RFSP on 5 October 2020 and performing the new PCF role(s). The RFSP had to submit its “in situ” confirmation for each role (if applicable) to the CBI by 16 November 2020.
Any new appointment by a RFSP of a person to a PCF-49, PCF-50 and/or PCF-51 role requires the prior approval in writing of the CBI and must be done in line with the CBI’s requirements on Fitness & Probity using the CBI’s individual questionnaire.
If you would like to know more about the services we offer or have any questions about the new additions to the PCF list, please contact the Insurance team or your usual contact at William Fry.
Contributed by Catherine Williams
