The Central Bank of Ireland Says Changes to the Maintenance of an Electronic Money Institution's Data Tables Had an Unintended Consequence That Left Its Safeguarding Account Underfunded

The Central Bank of Ireland published a settlement notice dated October 21, 2026, under its Administrative Sanctions Procedure. It concerns an electronic money institution, a wholly owned subsidiary of a United States group, and contraventions of the European Communities (Electronic Money) Regulations 2011 between November 1, 2020 and August 19, 2025. The firm agreed the facts and admitted the contraventions. The sanctions, a reprimand and a monetary penalty, "will not take effect unless they are confirmed by the High Court." Among other things, the notice covers outsourcing, the mixing of customers' money and failures to notify the regulator. Parts of it follow, not the whole.

A Daily Calculation

Users' funds, in the notice's definition, are "funds that have been received from the EMI's customers in exchange for electronic money." Safeguarding, the notice says, includes separating users' funds every day from all other funds, including the firm's own, and the notice calls a daily reconciliation "A key control for EMIs." This firm relied on a daily reconciliation process to identify which funds were users' funds and to move money into or out of its designated safeguarding account, so that the account matched its total safeguarding obligation each day.

To determine that obligation, the notice says, the firm used a software system to generate a safeguarding obligations report. The report extracted data from various sources, including customer transaction data taken directly from the group's ledgering system and records of which group legal entity each customer was contracted to.

The Timing Mismatch Issue

In July 2022, the notice says, the firm made changes to the maintenance of the data tables that report relied on. "An unintended consequence of these changes was that the records on which the" report relied "presented incomplete information, thus undermining the completeness and accuracy" of the report. The notice calls this the Timing Mismatch Issue, and says that as a result the safeguarding account was underfunded.

The notice says the firm identified the issue in January 2024, and at that time took the view that it affected only currencies its users did not use. The Central Bank's on-site inspection, which began in May 2024, later identified that the issue "affected all currencies and related to both retail and institutional customers." The firm consistently underfunded the account from July 2022 until October 2024, "a period of over two years," and the notice says it identified underfunding of safeguarded balances on every day from January 1, 2023 to June 27, 2024. The largest daily underfunding was €3.4 million in 2023 and €5.2 million in 2024, and the average daily shortfall was 0.54% of its safeguarding obligations in that period.

Had the firm become insolvent during that time, the notice says, the account would not have held enough to meet its safeguarding obligations. When the issue was identified in late June 2024, the firm remedied the shortfall at once, and a solution to the underlying issue was put in place in October 2024.

The firm found the fault and judged it narrower than it was. That it touched every currency came from the inspection.

The Unallocated Funds Issue

Between September 2023 and June 2024, the notice says, certain unallocated users' funds "were not appearing in" the report "and were therefore not included in the reconciliation calculations." Funds can be unallocated, a footnote explains, "if an incoming deposit cannot be matched to a User." The notice gives the cause as the firm's "failure to complete appropriate control checks at the point of implementation for a new banking provider," and says it "also failed to implement periodic testing of the unallocated funds files to ensure that all transactions were included in the rebalancing calculation." That issue was remedied in October 2024.

When a report that drives a daily transfer comes up short, what check would see it?