Key takeaways
- The Central Bank of Ireland's Safeguarding Notice of 25 May 2023 required payment and e-money institutions authorised in Ireland to obtain a specific safeguarding audit.
- Each firm described its safeguarding arrangements across 15 areas, and its board asserted that the description was fairly presented and the controls operated as described.
- The auditor gave reasonable assurance under ISAE 3000 at a reference date of 31 December 2022, or the firm's year end between 1 July 2022 and 30 June 2023, with reports due by 31 October 2023.
- The underlying duties are Regulation 17 of the Payment Services Regulations 2018 and Regulation 29 of the Electronic Money Regulations 2011.
- Since 10 February 2026 a Head of Safeguarding, PCF-56, is a pre-approval controlled function for payment and e-money institutions.
What are the key facts on the Irish safeguarding audit?
The safeguarding audit was the Central Bank of Ireland's structured test of whether each firm's safeguarding arrangements were as described and operating.
| Item | Position |
|---|---|
| Rule | S.I. 6 of 2018, Regulation 17; S.I. 183 of 2011, Regulations 29 and 30; Safeguarding Notice of 25 May 2023 |
| Regulator | Central Bank of Ireland |
| Applies to | Payment institutions and e-money institutions authorised in Ireland |
| Standard | ISAE 3000 reasonable assurance, plus a review engagement with a long-form report |
| Deadline | 31 October 2023, extended from 31 July 2023 |
| Last checked | 11 October 2026, against Central Bank of Ireland publications and the Irish Statute Book |
Why did the Central Bank require it?
Because supervisory work had found weaknesses in how firms safeguarded users' funds.
A Dear CEO letter of 20 January 2023 set out supervisory findings for payment and e-money firms and required a specific safeguarding audit by 31 July 2023. The Central Bank later extended the deadline for the audit and board response to 31 October 2023, and on 25 May 2023 issued the Safeguarding Notice setting out the format, agreed with Chartered Accountants Ireland. The Central Bank's electronic money institutions page lists the letter, the notice and the extension together.
The audit was designed to be comparable across firms. Every firm described the same 15 areas, every board made the same form of assertion, and every auditor applied the same assurance standard at a common reference date. That let the Central Bank see, sector-wide, which controls firms had and which they lacked, rather than relying on each firm's own account of its arrangements.
Which rules does the audit test?
It tests compliance with the safeguarding regulations that implement PSD2 and the E-Money Directive in Ireland.
Regulation 17 of the European Union (Payment Services) Regulations 2018 requires a payment institution to segregate users' funds, placing any still held at the end of the business day after receipt in a separate account at a credit institution or in secure, liquid, low-risk assets the Central Bank approves, or to cover them with an insurance policy or comparable guarantee from an unconnected insurer or credit institution. Regulation 29 of the Electronic Money Regulations 2011 applies the same model to funds received for e-money, with card receipts safeguarded once credited and within 5 business days of issue; Regulation 30 covers unrelated payment services. In both, liquidators and other creditors have no claim on the safeguarded funds until users' claims are met in full.
What did firms have to prepare?
A detailed description of their safeguarding arrangements and a board-approved assertion about it.
The board asserted, in all material respects, that the description fairly presented the arrangements as designed and implemented at the reference date, and that the controls and processes described were operating as described at that date. Firms also had to consider and formally document any gaps in their processes and controls that could affect compliance with the regulations.
The auditor then performed a reasonable assurance attestation engagement under ISAE 3000 over the assertion, giving a positive conclusion. The notice states that this engagement does not give assurance on whether the arrangements are appropriately designed to comply with the regulations. The same auditor also performed a review engagement, producing a long-form narrative report without an opinion.
What did the description have to cover?
Appendix 1 of the notice lists 15 areas, from governance to investment of users' funds.
| Area | What it covers |
|---|---|
| 1. Governance and oversight | Board oversight, the person responsible for safeguarding, reporting lines, second and third line roles, resourcing |
| 2. Safeguarding universe | Every service across the entity that could create users' funds |
| 3. Identifying users' funds | When funds become and stop being users' funds, and meeting timeframes |
| 4 and 5. Systems and IT controls | Systems used, hosting, IT dependencies, outsourced IT and general controls |
| 6 and 7. Safeguarding accounts | Bank due diligence, account terms, designation and restricted access |
| 8. No commingling | Keeping users' funds apart, and handling fees that affect them |
| 9. Daily reconciliations | Reconciliation process, segregation of duties and staff involved |
| 10. Insurance or guarantees | Underwriter due diligence, adequacy, renewal and proceeds |
| 11. Breaches | Identifying and escalating breaches to the board and the Central Bank |
| 12. Outsourcing | Inventory and oversight of outsourced safeguarding services |
| 13. Liquidity | Redemption at par and timely execution of payments |
| 14 and 15. Investments | No investment in non-cash assets without approval; valuation and liquidation where approved |
Which date did the audit cover?
A single reference date: 31 December 2022, or the firm's most recent year end between 1 July 2022 and 30 June 2023.
Because the opinion covered one date, it showed whether controls were in place then, not whether they operated throughout a period. Firms that treated the reference date as a one-off clean-up found the gaps returned. The daily reconciliation in area 9 is the control that proves arrangements work on every other day of the year. Supervisors reviewing a firm later can sample any day, and will expect the same controls described in 2023 to have operated on it, with any exceptions recorded and resolved.
What has happened since the 2023 audit?
Enforcement, a new controlled function and continuing annual auditor duties.
On 21 November 2024 the Central Bank fined BlueSnap Payment Services Ireland Limited EUR 324,240, after a 30% settlement discount, for breaching Regulations 17(2) and 27 of the 2018 Regulations between January 2021 and December 2022: customer funds were not placed in the designated safeguarding account and were commingled with other funds. From 10 February 2026, Head of Safeguarding became pre-approval controlled function PCF-56 for payment institutions, e-money institutions and small e-money institutions. Firm auditors continue to provide an annual Statutory Duty Confirmation under section 27B of the Central Bank Act 1997 and copies of management letters under section 27C, as the Central Bank's reporting requirements page sets out.
How should a firm prepare for the next safeguarding review?
By keeping the 2023 description as a living document and testing it against daily evidence.
The Central Bank has said it has no tolerance for weaknesses in safeguarding arrangements, and firms should expect future inspections and reviews to start from the arrangements they described and asserted in 2023. A practical approach is to treat the description as a controlled document with an owner, normally the Head of Safeguarding, and to update it whenever a product, bank, system or outsourcing arrangement changes. Each of the 15 areas should map to evidence produced in the ordinary course of business: board minutes for area 1, a product inventory for area 2, account letters for area 6, access reviews for area 7 and reconciliation records for area 9.
The gap log should stay open too. A gap closed in 2023 can reopen if a new payment flow lands funds in an operating account, or if a new bank is added without due diligence. Recording each gap, its owner and its closure date gives the board the basis for any future assertion.
What gap would a safeguarding audit find?
A typical finding is a reconciliation that balances in total but hides items that show users' funds were not safeguarded on the day.
Worked example. An Irish payment institution's daily reconciliation at the reference date shows the following.
| Line | EUR m |
|---|---|
| Users' funds per client ledger | 85.20 |
| Balance in designated safeguarding accounts | 84.62 |
| Card settlements received into the operating account, not yet transferred | 0.41 |
| Fees deducted from the safeguarding account before they were due | 0.17 |
| Difference before adjustments | (0.58) |
| Explained by settlements in transit and early fee deduction | 0.58 |
The totals reconcile once both items are explained, but each is a gap the description and the board assertion must disclose. Users' funds sat in an operating account past the deadline, and fees left the safeguarding account before they were owed, so EUR 0.58 million of users' funds was not safeguarded on the day. An auditor testing area 8, no commingling, and area 9, reconciliations, would report both.
What should an Irish firm check now?
These checks keep the arrangements described in 2023 true today.
- Keep the safeguarding description current as products, banks and systems change.
- Confirm the Head of Safeguarding holds PCF-56 approval or an in-situ notification.
- Reconcile users' funds to designated safeguarding accounts every business day.
- Move funds received into operating accounts to safeguarding accounts within the deadline.
- Deduct fees from safeguarded funds only when they are due.
- Review insurance or guarantee cover against the peak amount of users' funds.
- Tell the Central Bank promptly if arrangements described at authorisation change.
Our guides to Lithuanian safeguarding, the PSD3 timeline and the UK safeguarding audit cover related regimes.
How does Safeheld help?
Safeheld reconciles users' funds to safeguarding accounts every day for each entity and currency, and raises funds left in operating accounts as breaks.
Each break and its resolution is kept as evidence for the board and the auditor. See audit and regulatory evidence.
Frequently asked questions
What is the Central Bank of Ireland safeguarding audit?
A specific audit required of payment and e-money institutions authorised in Ireland, set out in the Safeguarding Notice of 25 May 2023: a board assertion over a description of safeguarding arrangements, with ISAE 3000 reasonable assurance from the auditor.
When was the safeguarding audit due?
By 31 October 2023, after the Central Bank extended the original 31 July 2023 deadline.
What reference date did the audit use?
31 December 2022, or the firm's most recent financial year end between 1 July 2022 and 30 June 2023.
Which Irish regulations require safeguarding?
Regulation 17 of the European Union (Payment Services) Regulations 2018 for payment institutions, and Regulations 29 and 30 of the Electronic Money Regulations 2011 for e-money institutions.
Is there a Head of Safeguarding role in Ireland?
Yes. From 10 February 2026, Head of Safeguarding is PCF-56 for payment institutions, e-money institutions and small e-money institutions.
Who in the firm owns safeguarding in Ireland?
The board is responsible for the arrangements and made the 2023 assertion. Since 10 February 2026 a Head of Safeguarding, approved as PCF-56, is the individual responsible for safeguarding in payment and e-money institutions.
Is the safeguarding audit an annual requirement?
The 2023 notice described a specific audit at a single reference date. Firm auditors separately provide an annual Statutory Duty Confirmation under section 27B of the Central Bank Act 1997, and firms should keep their safeguarding description current for future reviews.
Has the Central Bank fined firms for safeguarding failures?
Yes. On 21 November 2024 it fined BlueSnap Payment Services Ireland Limited EUR 324,240 for breaches of Regulations 17(2) and 27 of the 2018 Regulations.
References
- Central Bank of Ireland, Safeguarding Notice to payment and e-money institutions (25 May 2023, PDF)
- Central Bank of Ireland, Electronic Money Institutions
- S.I. No. 6 of 2018, European Union (Payment Services) Regulations 2018
- S.I. No. 183 of 2011, European Communities (Electronic Money) Regulations 2011
- Central Bank of Ireland, Fitness and Probity news: Head of Safeguarding PCF roles (February 2026)
- Central Bank of Ireland, Enforcement action against BlueSnap Payment Services Ireland Limited (21 November 2024)
- Central Bank of Ireland, Reporting requirements for electronic money institutions
About Safeheld
Safeheld is reconciliation and regulatory financial control software for regulated firms that hold client money. For Irish payment and e-money institutions it reconciles users' funds to designated accounts daily and keeps the break history a board assertion and an auditor rely on. To discuss your safeguarding operations, contact us at safeheld.com/contact.
This article is general information on EU safeguarding rules and is not legal or regulatory advice.