The Central Bank's July 2026 Financial Crime Bulletin knits together Ireland's third National Risk Assessment, the REQ data programme, AMLA's build-out and three live thematic reviews. Payment firms, EMIs and CASPs are rated Very Significant for ML/TF risk. Refresh the BWRA before the CBI asks whether you have.

The Central Bank's July 2026 newsletter documents its expectations on material business model change, EBA Q&A 6336, CPC 2025 and AML data before it starts testing firms against them. Firms without a Board-approved materiality policy or a completed Q&A 6336 analysis will start that conversation on the back foot.

PSD2 asked whether a payment was authenticated. The Payment Services Regulation asks something harder: who carries the loss when a customer is manipulated into paying? Article 59 puts the reimbursement burden, and the burden of proof, on the PSP. Here is what the final text requires and what PSPs should be doing now.

On 20 August 2026 the Central Bank of Ireland wrote to payment and e-money firms on ICT governance, risk management and controls. The letter names six gaps found on inspection, ties each back to DORA, and expects evidence that fixes work. The read-across to CASPs is direct.

In a significant move to combat financial crimes across Europe, the European Parliament and Council have adopted amendments to Directive (EU) 2019/1153, aimed at granting law enforcement authorities direct access to centralized bank account registries.