Fitness And Probity Thematic Assessment: What MiFID Firms Need To Know

Following the Central Bank of Ireland’s publication of the findings from its thematic assessment of the Fitness and Probity (“F&P”) regime within the MiFID industry, as outlined below, one message is clear: firms must be able to demonstrate, through appropriate governance, documentation and evidence, that the F&P framework is fully embedded within the organisation. The Central Bank’s findings therefore serve as an important reminder that governance frameworks must be capable of being evidenced, not simply described.

On 1 September 2026, the Central Bank of Ireland (the “Central Bank”) published the findings of its thematic assessment of the implementation of key aspects of the Fitness and Probity (“F&P”) Regime across the MiFID investment firm sector. This update presents the Central Bank’s key findings and considerations for investment firms.

Key Findings

PCF due diligence and annual certification:

The Central Bank found a number of firms could not evidence sufficient due diligence when onboarding a pre-approved controlled function (“PCF”) role holder and on an annual basis. A number of recurring gaps were noted including the absence of signed copies of PCFs’ agreement to comply with the F&P Standards, a lack of evidence of self-certification of potential conflicts of interest and missing documentation, such as interview notes, evidencing firms’ compliance with the assessment of a PCF’s competence and capability.

Gaps in policy and practice:

It was observed in some firms that while their policies accurately documented their responsibilities under the IAF, the policies lacked sufficient detail as to how the firm had tailored the IAF to its own business model and the actions taken to embed the principles.

Management Responsibility Maps:

The Central Bank found a number of issues with firms’ Management Responsibility Maps (“MRMs”) which include: the omission of inherent or other responsibilities and failure to set out clear reporting lines to management or board committees. In one example, the Central Bank found responsibilities shared across two PCFs that did not fall within the limited permitted circumstances set out in the IAF Guidance.

What firms should consider

All investment firms that were subject to the thematic assessment received firm-specific feedback and required actions from the Central Bank. In addition, all investment firms, whether they were directly included in the thematic assessment or not, should have regard to the Central Bank’s key findings and assess the Central Bank’s findings against their firm’s own arrangements.

Firms should consider the following questions:

• Can we evidence our initial and ongoing due diligence process for every PCF upon request from the Central Bank?
• Do our IAF policies and procedures go into sufficient practical detail as to how the IAF applies to our business model?
• Is our MRM up-to-date and does it provide for inherent and other responsibilities as well as clear reporting lines?
• Is our document retention practice sufficiently robust to withstand future inspections or ad hoc requests from a regulator?

Matheson’s Financial Institution Group has advised many of our clients on the implementation of and the ongoing supervisory engagement relating to the IAF and SEAR. In answering the above questions, it is advisable for firms to consult their existing F&P practices in light of the CBI findings, to consider any enhancements including for example:

• conducting gap analyses of relevant policies and procedures as against the Central Bank’s findings in this thematic assessment, regulatory obligations and Central Bank guidance;
• reviewing and enhancing due diligence and annual certification processes and documentation for PCFs;
• reviewing and updating MRMs and statement of responsibility, ensuring compliance with statutory obligations and regulatory expectations; and
• the allocation of prescribed and other responsibilities.