PCF-56 Head of Safeguarding: Ireland’s new PI/EMI role

Since 10 February 2026, every Irish payment and e-money institution needs a Head of Safeguarding approved by the Central Bank: PCF-56. The role was created by S.I. No. 20 of 2026 and follows a thematic inspection in which the Central Bank of Ireland found unclear reconciliations, blurred lines of defence and insurance policies that would not pay the Irish entity. PCF-56 puts one named person on the hook for all of it. This piece covers the legal text, who is caught, how the transition works for people already doing the job, what the Central Bank expects the role holder to own, and three cases from practice.

1. The legal basis: S.I. No. 20 of 2026

The Central Bank made the Central Bank Reform Act 2010 (Sections 20 and 22) (Amendment) Regulations 2026 on 28 January 2026, under sections 20(1) and 22(2) of the Central Bank Reform Act 2010. Notice appeared in Iris Oifigiúil on 30 January 2026 and the regulations came into operation on 10 February 2026. They replace in full Schedule 2 of the Central Bank Reform Act 2010 (Sections 20 and 22) Regulations 2011 (S.I. No. 437 of 2011), the list of pre-approval controlled functions (PCFs).

The new Schedule 2, Part 2, paragraph 7 lists two PCFs for payment institutions and e-money institutions: Branch Managers within the State (PCF-40), and the new Head of Safeguarding (PCF-56). Paragraph 9 adds a parallel role, PCF-57 Head of Safeguarding, for crypto-asset service providers under Regulation (EU) 2023/1114 (MiCAR).

Two drafting points are worth knowing. The Schedule still describes payment institutions by reference to the 2009 Payment Services Regulations, carried over from the earlier list. The Central Bank’s own notice describes the scope as payment institutions, e-money institutions and small e-money institutions. And Part 2 applies to providers established in the State: the role attaches to Irish-authorised firms, not to an EEA firm passporting into Ireland, whose safeguarding stays a home-state matter.

2. Why the role exists: the safeguarding rules and the inspection

The underlying duty is unchanged. For payment institutions it sits in Regulation 17 of the European Union (Payment Services) Regulations 2018 (S.I. No. 6 of 2018), which transposes Article 10 of PSD2: segregate users’ funds or cover them with an insurance policy or comparable guarantee. Funds safeguarded by segregation are put beyond the reach of other creditors and of the Official Assignee until users’ claims are met. For e-money institutions the duty sits in the European Communities (Electronic Money) Regulations 2011 (S.I. No. 183 of 2011).

What changed is the Central Bank’s tolerance. In January 2023 a Dear CEO letter required every safeguarding firm to commission a specific safeguarding audit. A May 2023 notice narrowed it to a description of arrangements as at 31 December 2022 with a Board-approved assertion, reviewed without an assurance opinion and filed by 31 October 2023. In December 2025 the first Payment and E-Money Newsletter published the results of a thematic inspection, stated that the Central Bank has no tolerance for weaknesses in safeguarding, and announced PCF-56.

3. What the inspection found

The newsletter listed deficiencies seen in some firms. They are, in effect, the PCF-56 holder’s job description:

• reconciliation processes not written down in the safeguarding policy;
• no segregation between doing and overseeing the reconciliation, with second-line teams performing operational safeguarding tasks;
• no documented thresholds for escalating safeguarding incidents, and incomplete incident logs;
• large shares of safeguarded funds at single credit institutions, no documented credit risk appetite and no counterparty limits;
• local staff who did not understand the insurance or guarantee covering their funds;
• policies silent on how a claim is made and when it pays;
• reliance on group due diligence of insurers with no local oversight;
• policies in a group entity’s name, so a payout would go to the group rather than the Irish firm;
• negative customer balances netted into the reconciliation, understating what must be safeguarded.

4. What the Central Bank expects the role to own

Alongside the findings, the Central Bank set out its expectations. Read together with PCF-56, they define what the Head of Safeguarding answers for:

• a Board-approved safeguarding risk framework covering day-to-day identification, management and protection of users’ funds;
• regular Board reporting, including safeguarding KRIs, incidents and counterparty reviews, and an incident framework with defined escalation thresholds;
• annual compliance testing of the safeguarding calculation, the account designation letters and the insurance cover;
• annual safeguarding training for the Board and staff;
• concentration limits calibrated to risk appetite and ongoing counterparty monitoring, with second-line oversight at the Irish entity;
• insurance written in trust for users, with no conditions on prompt payout and a clear claims process and payment timeline, covering the full obligation where several insurers are used;
• a wind-down plan that explains how users’ funds are returned in solvent and insolvent scenarios, including how the insurance is called.

The newsletter also recorded good practice: daily reconciliation with sign-off at firm level, users’ funds received straight into safeguarding accounts with fees and interest stripped out, and outsourcing frameworks with service levels and local oversight of outsourced teams.

5. The transition: who files what

The Central Bank’s February 2026 notice set two paths:

1. New appointment from 10 February 2026. The firm submits an Individual Questionnaire through the Central Bank Portal. As for any PCF, the person cannot take up the role until the Central Bank approves it.
2. Someone already doing the job before 10 February 2026. No IQ is needed. The firm must complete the due diligence required by the Guidance on the Standards of Fitness and Probity (November 2025), then make an in-situ submission through the Fitness and Probity section of the Portal.

The firm decides who is performing a PCF, but the Central Bank’s guidance lets it declare in writing that a function is a PCF. A firm that names nobody for PCF-56 should expect that question.

6. Worked example: the CFO who already runs safeguarding

Facts: An Irish e-money institution’s CFO, approved as PCF-11 Head of Finance, has run the daily safeguarding reconciliation and the bank relationships since 2024. Compliance tests safeguarding once a year.

What the rule says: The CFO was performing the function before 10 February 2026, so no IQ is required. The firm must complete F&P due diligence and an in-situ submission.

What the practitioner does: Before filing, asks whether one person should both run the reconciliation and be accountable for overseeing it, the segregation weakness the inspection named. Keeps the CFO as PCF-56 but moves day-to-day reconciliation to a treasury analyst with documented CFO sign-off, keeps compliance as the second line, and records the reasoning in the due-diligence file.

Outcome: An in-situ submission backed by a structure that answers the Central Bank’s segregation finding, rather than one that simply renames the status quo.

7. Worked example: hiring a Head of Safeguarding in March 2026

Facts: A payment institution with no obvious incumbent recruits an external Head of Safeguarding who starts in March 2026.

What the rule says: This is a new appointment, so an IQ is required and the individual cannot perform the PCF until the Central Bank approves.

What the practitioner does: Files the IQ as soon as the offer is accepted. During the gap, keeps accountability with an existing approved PCF holder, minuted by the Board, while the new hire works in a preparatory capacity: mapping reconciliations, reading insurance policies and drafting the incident thresholds.

Outcome: No unapproved person performs the role, and the new holder starts with an inventory of the gaps rather than a blank page.

8. Worked example: the group insurance policy

Facts: An Irish payment institution safeguards part of its funds through an insurance policy bought by its parent in another member state. The policy is in the parent’s name, and the Irish team has never read the claims clause.

What the rule says: The Central Bank expects safeguarding insurance written in trust for users, payable without conditions, with a clear claims process and timeline, and understood by the local team. A policy in the group’s name was listed as a deficiency.

What the practitioner does: As PCF-56, obtains the full policy, maps the claim trigger against the Irish insolvency scenario in the wind-down plan, and asks the parent to reissue or endorse the policy so that it names the Irish entity and is held in trust for users. Until that happens, reports the gap to the Board as a safeguarding risk.

Outcome: A payout would reach Irish users instead of a parent company’s creditors, and the Board has a record of when the gap was found and fixed.

FAQ

What to do, today

• Company secretary: confirm a PCF-56 holder is named and either approved or recorded through an in-situ submission. If neither, fix it now.
• Head of Safeguarding: check the reconciliation for netted negative balances, and write down who performs it and who oversees it.
• Risk: set counterparty concentration limits for safeguarding banks and tie them to a documented credit risk appetite.
• Legal: confirm every safeguarding policy names the Irish entity, is held in trust for users and states how and when it pays.
• Board: add safeguarding KRIs and incidents to the standing agenda, and diarise the annual testing and training.

Related: Safeguarding compared across the EU · Safeguarding reporting and attestations · Central Bank of Ireland Portal returns