Building a Resilient Payment Ecosystem and Consumer Trust— Speech by Director Domhnall Cullinan at Payments and E-Money Industry Seminar

Introduction

Good morning everyone,

You are all very welcome here today to Central Bank of Ireland’s Payments and E-Money seminar - a forum where we can reflect together on the key developments, challenges and risks facing the payments ecosystem.

I would like to say thank you to Tommy Hannafin and his team for organising today’s event and for inviting me to join you this morning. A special thanks also to all our panel members, including Federico Cabañas from the Banco de Espana, who have agreed to participate in our panel discussion on the opportunities and challenges facing the payments sector.

The payments ecosystem lies at the heart of our economy and continues to evolve at a remarkable pace. Technology has driven this transformation, shifting customer preferences from cash towards electronic payment methods.

That said, cash continues to play an important role for many people and is actively supported through the government's Access to Cash strategy, in which the Bank plays a key role.

You, the Payment and E-Money sector, have been at the forefront of these shifts, leveraging new technologies to move money faster, cheaper, and with less friction than was previously possible. In doing so, you have challenged incumbent payments service providers – effectively traditional banks – to accelerate their own offerings.

The growth and innovation in this sector show no signs of abating. We currently supervise 62 firms, and our authorisation pipeline is busier than it was even during the Brexit period. Whilst all firms operate under the same regulatory framework and can access the same EEA-wide markets, there is considerable diversity in scale and operational complexity. 

Some firms are seeking multiple licences, reflecting their ambition to expand their service offerings. Equally striking is the growing exploration of distributed ledger technology (DLT) in payments processes, for example rising interest in electronic money tokens (EMTs) or stablecoins. To date, stablecoin use has remained largely confined to the crypto ecosystem. But we are now seeing ambitions that extend well beyond that. Firms are exploring the potential of using EMTs for broader payment purposes across the economy, including for cross-border payments.

Supervisory Approach

For the Central Bank, a challenging external environment and the evolving financial services landscape reinforce the need for us to be forward looking, risk-based, outcomes-focused and proportionate.

As firms in the sector operate across the EEA, it is vital that we continue to work and harness relationships with the European Supervisory Authorities and other national competent authorities.

This allows us to collectively foster a robust financial system in Europe. We want to maintain a level playing field, where risks are identified and mitigated, while at the same time allowing consumers to benefit from the innovation and products that the sector offers.

Against this backdrop, I want to outline three foundational themes that will guide our supervisory approach, and that I believe will guide you.

Theme 1: Trust and Consumer Interest

Financial services are fundamentally built on trust. Not trust in the abstract sense, but trust earned through acting in the best interests of the consumers and businesses that you serve.

As remarked previously by Sharon Donnery, former Deputy Governor of Financial Regulation, when we consider gatekeeping, the phrase “regulated by the Central Bank of Ireland” has to mean something in terms of standards and reassurance to the people of Ireland and across Europe.¹ And it is our collective responsibility to ensure that public trust is maintained.  

Your authorisation as a regulated entity places a significant conduct responsibility on you. You have a duty to act in the interests of consumers. This is not a regulatory burden; it is the foundation upon which the entire system rests.

When consumers and businesses entrust their money to you, they are making a choice based on a level of confidence that their money is safe and that their interests will be protected.

That confidence is fragile.

It can be damaged by misconduct, by poor controls, by prioritising profit over principle. As [Wikipedia co-founder and author] James Wales says, "Trust isn't an immovable mountain, it is an edifice built brick by brick. Pull out enough bricks and it will start to wobble." ²

And once damaged, it is extraordinarily difficult to rebuild.

Theme Two: Resilience Through Shared Responsibility

Resilience in the financial system — and particularly in payments — is built on three pillars, and all three are essential.

The first pillar is a robust and prudent regulatory framework. While the majority of our legislation is designed at an EU level, we work with colleagues in the Department of Finance and the European Supervisory Authorities to keep rules focused on the outcomes we are seeking to achieve, namely: the protection of consumer and investor interests, the integrity of the financial system, the safety and soundness of firms and financial stability.

As an example, in the context of the Payment and E-Money sector the Bank has, and continues to, influence strengthened safeguarding and internal governance requirements in the Third Payment Services Directive (PSD3).

With respect to domestic legislation and requirements, our approach is the same, that is we introduce requirements to support delivery on our safeguarding outcomes.  For example, the Individual Accountability framework and the revised Consumer Protection Code are designed to support regulated firms to deliver a safe, sound, stable and trusted financial system.

The second pillar is risk-based, forward-looking supervision. We know, from experience, that rules and regulations by themselves are not enough, and that we cannot achieve our outcomes only through rules and principles. That is why regulation must be complemented by proportionate, robust, risk-based supervision – a core lesson of the financial crisis.

We take a holistic view of the risk landscape and focus our supervisory efforts accordingly. At different times, different tools and approaches are necessary, but we always have our ultimate outcome(s) in mind. We will continue to engage with firms, to challenge assumptions and to identify and require firms to mitigate emerging risks before they crystallise into crises.

The third pillar is the responsibility of firms themselves. Regulation and supervision can set the boundaries and challenge complacency/ineffectiveness, but they are no  substitute for, genuine commitment from regulated entities to manage their own risks effectively.

I want to be emphatic on this point: regulated entities cannot become complacent about the risks they face. The threat landscape is dynamic. What was an adequate control framework six months ago may not be adequate today. This requires sustained attention, investment, and a culture of continuous improvement.

Theme Three: Innovation, Tempered by Capacity

We recognise and welcome the benefits that technological innovation brings to the payments sector. Innovation done correctly can drive efficiency, improve consumer experience, and create value. The Central Bank supports and encourages innovation for these reasons; however it recognises that innovation done badly or for the wrong reasons can cause more issues than benefits it provides. Innovation that fails to include security, reliability, trust and fraud safeguards will not earn durable public trust, however frictionless it may be.³

Technological advances must be tempered by firms' operational and financial capacities. Not every innovation is appropriate for every firm. Not every opportunity should be pursued. The question is not simply "can we do this?" but "should we do this, given our capacity to manage the associated risks?" This is where the boards of firms must take ownership and responsibility for reviewing and contributing to the firm’s strategic ambitions. 

This is particularly important as we see new technologies — artificial intelligence (AI), DLT, advanced automation — entering the payments space. These technologies are powerful. They can enhance resilience and improve outcomes. But they can also introduce new vulnerabilities if they are deployed without adequate understanding of the risks, without robust controls, and without the capacity to manage them effectively.

Supervisory Priorities

Now, let me turn to our specific supervisory priorities for the payments sector. 

1.  Safeguarding

   We expect firms to prioritise safeguarding customer monies. That is a non-negotiable for us. This has been, and will continue to be, a key supervisory focus of ours for the Payment and E-Money Sector.

2. Financial Crime

   Many of the successes delivered by the payments sector have been achieved by speed, agility and usability. Unfortunately, these same avenues can be manipulated by criminals with automation, cross-border transactions, and instant payments all adding to exploitable channels used to launder money and generally exploit the financial system. As said recently by Deputy Governor Colm Kincaid, economic crimes cause harm to real people. Whilst the crime may take place behind a screen, the consequences do not. ⁴

   We expect regulated entities to have robust financial crime controls in place and our supervisory engagements will focus on this. Firms cannot approach this as merely a compliance exercise. It requires unwavering commitment and sustained investment to adapt to this most dynamic of threats.

3. Consumer Protection

   The revised Consumer Protection Code is the cornerstone of our consumer protection framework. However, for it to be effective it needs to be implemented by firms. We will continue to assess how firms have done this throughout our supervisory work, consistent with our integrated supervisory approach. We will be looking to evidence how firms have embedded the principles of the Code in their culture, in their risk management processes and in their decision making.

4. Resilience

   The changing risk landscape demands a continued focus on resilience, in its broadest sense. We wrote to all of the CEOs in the sector back in August with regard to two aspects of resilience – operational and cyber resilience. As stated in the letter rapid advancements in emerging technologies, namely AI systems, represent pivotal changes to the cybersecurity landscape.

   While these developments do not introduce entirely new risks, they significantly amplify the speed and scale at which such risks materialise. We will be looking closely at how firms are approaching technological change. We expect rigorous governance, clear accountability, and assessment of whether new technologies align with your risk appetite, your firms’ capacity to manage them and your legal and regulatory obligations.

   And finally

5. Governance and Risk Management

Good governance and effective risk management frameworks form the foundations of successful firms. As Deputy Governor Mary Elizabeth McMunn has emphasised, we learn a great deal about governance when conditions become difficult.⁵ Governance and risk management frameworks cannot remain static – they need to evolve to reflect how your business and the operating environment changes.

One thing remains a constant from our perspective - we do not want to see firms’ strategic ambitions or growth outpacing your governance and risk management frameworks.

Closing

Let me conclude.

People tend to take payments processes for granted. They just work, and they are not worried about how they work until something goes wrong.

The payments sector is vital to the economy and to the public interest. It is built on trust — trust that consumers place in financial service providers, and trust that those providers will act with integrity and in the interests of their customers.

The Central Bank's mission is to maintain financial stability and to foster a financial system operates in the best interests of consumers and the wider economy. We take that mission seriously.

We will continue to influence the development of robust regulatory frameworks, to supervise firms actively and fairly, and to challenge complacency and misconduct wherever we find it.

But we cannot do this alone. We need firms to consistently take their responsibilities seriously.

We need you to internalise the principles of trust, and consumer interest.

We need you to invest in maintaining and enhancing your resilience and financial crime controls.

We need you to safeguard consumer funds as if they were your own.

And we need you to approach innovation and growth with robust and effective governance and risk management frameworks.

These are not unduly onerous asks. They are the foundation of a financial system that works for everyone.

I look forward to continuing our dialogue and our partnership as we navigate the challenges and opportunities ahead.

Thank you

With thanks to Lorraine Nolan, Marcus Sweeney, Melissa McCahey, David Burke and Tommy Hannafin for their help preparing these remarks.