The Governor and Company of the Bank of Ireland

• LiftedCentral Bank of Ireland (CBI)

  Debarment

  In this state since

  12 Sept 2026

  Designated

  27 Jul 2020

  Reason given

  ENFORCEMENT ACTION Central Bank of Ireland and The Governor and Company of the Bank of Ireland The Governor and Company of the Bank of Ireland fined €1,660,000 and reprimanded by the Central Bank of Ireland for regulatory breaches causing loss to a client and for misleading the Central Bank in the course of the investigation On 27 July 2020, the Central Bank of Ireland (the Central Bank) reprimanded and fined The Governor and Company of the Bank of Ireland (BOI) for five breaches of the European Communities (Markets in Financial Instruments) Regulations 2007 (the MiFID Regulations) committed by its former subsidiary, Bank of Ireland Private Banking Limited (BOIPB). BOI has admitted the breaches, which vary in length from one to ten years. In line with its published Sanctions Guidance, the Central Bank has determined the appropriate fine to be €2,370,000, which has been reduced by 30% in accordance with the settlement discount scheme provided for in the Central Bank’s Administrative Sanctions Procedure. The Central Bank’s investigation arose from a cyber-fraud incident that occurred in September 2014 (the Incident). Acting on instructions from a fraudster impersonating a client, BOIPB made two payments to a third party account totalling €106,430: one from a client’s personal current account, the other from BOIPB’s own funds. BOIPB immediately reimbursed the client. During a Full Risk Assessment of BOIPB in 2015, the Central Bank discovered a reference to the Incident in an operational incident log. BOIPB had not reported the cyber-fraud to An Garda Síochána, and only did so at the request of the Central Bank over one year after the Incident. The Central Bank’s investigation found serious deficiencies in respect of third party payments, including:  Inadequate systems and controls to minimise the risk of loss from fraud  Inadequate governance, oversight and ongoing review of the systems and control environment  Lack of staff training and a culture in which fulfilling clients’ instructions was given primacy over security and regulatory requirements  Lack of compliance monitoring. BOIPB’s failure to be open and transparent had the effect of misleading the Central Bank in the course of the investigation. BOIPB failed for a period of 19 months to disclose to the Central Bank an internal report, commissioned following the Incident, which identified ongoing systemic control failings in the processing of third party payments. During that same period, BOIPB strenuously denied the existence of any such failings to the Central Bank in response to the investigation. BOIPB’s conduct materially added to the time it took to investigate this case. This is one of two aggravating factors in this case;the other being the excessive amount of time it took BOIPB to fully remediate the relevant deficiencies. Remediation in relation to third party payment processes took place in February 2016, 17 months after the Incident, and then only following the Central Bank’s intervention. In August 2016, the Central Bank determined that a Risk Mitigation Programme (RMP) relating to third party payment processes was completed. More detailed information regarding this sanction is available on the Central Bank of Ireland's website.

  Document

  The publisher's document (https://registers.esma.europa.eu/publication/details?core=esma_registers_sanctions&docId=sn13424)

  Stated by

  ESMA Sanctions Register

  First recorded here

  12 Sept 2026

  Listing id

  13424

• In forceCentral Bank of Ireland (CBI)

  MiFID

  In this state since

  12 Sept 2026

  Designated

  27 Jul 2020

  Reason given

  ENFORCEMENT ACTION Central Bank of Ireland and The Governor and Company of the Bank of Ireland The Governor and Company of the Bank of Ireland fined €1,660,000 and reprimanded by the Central Bank of Ireland for regulatory breaches causing loss to a client and for misleading the Central Bank in the course of the investigation On 27 July 2020, the Central Bank of Ireland (the Central Bank) reprimanded and fined The Governor and Company of the Bank of Ireland (BOI) for five breaches of the European Communities (Markets in Financial Instruments) Regulations 2007 (the MiFID Regulations) committed by its former subsidiary, Bank of Ireland Private Banking Limited (BOIPB). BOI has admitted the breaches, which vary in length from one to ten years. In line with its published Sanctions Guidance, the Central Bank has determined the appropriate fine to be €2,370,000, which has been reduced by 30% in accordance with the settlement discount scheme provided for in the Central Bank’s Administrative Sanctions Procedure. The Central Bank’s investigation arose from a cyber-fraud incident that occurred in September 2014 (the Incident). Acting on instructions from a fraudster impersonating a client, BOIPB made two payments to a third party account totalling €106,430: one from a client’s personal current account, the other from BOIPB’s own funds. BOIPB immediately reimbursed the client. During a Full Risk Assessment of BOIPB in 2015, the Central Bank discovered a reference to the Incident in an operational incident log. BOIPB had not reported the cyber-fraud to An Garda Síochána, and only did so at the request of the Central Bank over one year after the Incident. The Central Bank’s investigation found serious deficiencies in respect of third party payments, including:  Inadequate systems and controls to minimise the risk of loss from fraud  Inadequate governance, oversight and ongoing review of the systems and control environment  Lack of staff training and a culture in which fulfilling clients’ instructions was given primacy over security and regulatory requirements  Lack of compliance monitoring. BOIPB’s failure to be open and transparent had the effect of misleading the Central Bank in the course of the investigation. BOIPB failed for a period of 19 months to disclose to the Central Bank an internal report, commissioned following the Incident, which identified ongoing systemic control failings in the processing of third party payments. During that same period, BOIPB strenuously denied the existence of any such failings to the Central Bank in response to the investigation. BOIPB’s conduct materially added to the time it took to investigate this case. This is one of two aggravating factors in this case;the other being the excessive amount of time it took BOIPB to fully remediate the relevant deficiencies. Remediation in relation to third party payment processes took place in February 2016, 17 months after the Incident, and then only following the Central Bank’s intervention. In August 2016, the Central Bank determined that a Risk Mitigation Programme (RMP) relating to third party payment processes was completed. More detailed information regarding this sanction is available on the Central Bank of Ireland's website.

  Document

  The publisher's document (https://registers.esma.europa.eu/publication/details?core=esma_registers_sanctions&docId=sn13424)

  Stated by

  ESMA Sanctions Register

  First recorded here

  12 Sept 2026

  Listing id

  13424

No ownership verdict was on file for this company on 26 October 2026.

As recorded by the assessment reading taken on 12 September 2026, 19:14 UTC, the newest on or before the date. Only “checked, not found” means a source was read in full and held nothing for the company.

Where the company is registered or connected

• IE: registered here

  Registers read here: Ireland CRO Open Data. No register here states who owns its companies.

• Whether each listing was in force is rebuilt from what was recorded here: when it was first read, when a source stopped or resumed carrying it, and when its published term ended. A listing in force at an authority before this system first read it is shown from that first read.
• No ownership verdict is kept for this company. Verdicts are kept for companies registered where shareholders are read here: Estonia, Latvia and Poland.

For each source behind this file, the newest read made on or before the date: the version of it that stood.

• ESMA Sanctions Register

  Read on 23 October 2026. No date from the publisher is read for this file, so its age is not known here. 845 records read.

Taken

12 September 2026, 19:14 UTC

Methodology

Version 4

Level

Medium

Score recorded

65 of 100

Digest

04b041c8bfa08e2ff8f25fc6e9bdb4f521658c5dA fingerprint of everything the reading says. The same reading always has this digest, and any change in it gives another.

Reading id

f0b17cf7-f374-47c3-9458-3125bab708a9

Address

https://apolika.com/entities/f9e708a1-d326-4788-9f86-5ad0b87b7723/evidence?as_of=2026-10-26The same address gives the same day's file tomorrow. What was recorded after the date is not in it.

As data

https://apolika.com/api/entities/f9e708a1-d326-4788-9f86-5ad0b87b7723/evidence?as_of=2026-10-26T09%3A44%3A21.747Z

Made

26 October 2026, 09:44 UTC