Cullinan warns payments firms against outgrowing risk controls
Payment firms must keep growth within their capacity to manage risk, Central Bank of Ireland (CBI) Director Domhnall Cullinan said on October 21, 2026. He set out supervisory priorities for a sector comprising 62 regulated firms.
Five priorities for 62 firms
Cullinan identified five supervisory priorities: safeguarding customer money, financial crime controls, consumer protection, resilience and governance and risk management.
Safeguarding remains non-negotiable.
The CBI will assess whether firms embed the revised Consumer Protection Code in their culture, risk processes and decisions.
Automation, cross-border transactions and instant payments create channels criminals can exploit, requiring sustained investment in controls.
An August letter to sector chief executives addressed operational and cyber resilience.
Artificial intelligence amplifies the speed and scale of cyber risks, Cullinan said.
Boards must ensure growth and innovation do not outpace governance, controls or operational and financial capacity.
Innovation meets capacity constraints
The authorisation pipeline is busier than during Brexit, with some firms seeking multiple licences.
Firms are exploring electronic money tokens and stablecoins for wider payments, including cross-border transfers; use remains largely within crypto.
The CBI supports stronger safeguarding and internal governance requirements in the Third Payment Services Directive (PSD3).
Cullinan described three foundations for resilience: prudent regulation, risk-based supervision and firms taking responsibility for managing their own risks.
Authorisation does not replace accountability
Cullinan placed responsibility for safe expansion with firms and their boards.
Regulatory rules and supervision cannot substitute for effective internal risk management, he said.
His message ties innovation to demonstrable capacity, customer safeguards and continuing investment in resilience.