Ireland: Operational Resilience & Critical Infra

Operational Resilience & Critical Infrastructure

Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied since 17 January 2025 to payment institutions and electronic-money institutions established in Ireland, and its intersection with the safeguarding-reconciliation expectations the Central Bank has set out separately is the specific operational-resilience development worth surfacing this cycle. Where a firm uses a third-party platform to perform the daily safeguarding reconciliation now expected as a core control, that platform is likely to qualify as an ICT service supporting a critical or important function under DORA's classification test, given the central role daily reconciliation plays in detecting the kind of fund-mixing and account-designation failures that have previously resulted in enforcement action in the Irish payments sector. A critical-or-important classification carries concrete consequences: the Article 28(3) obligation to maintain and keep current a register of information covering the arrangement, and the Article 30 requirement that the underlying contract contain specific terms addressing matters such as service levels, data location, and exit arrangements.

This sits alongside, rather than replaces, the European Banking Authority's outsourcing guidelines, which have applied since 30 September 2019, and the Central Bank of Ireland's own notification expectations requiring firms to inform the Central Bank of material changes to critical or important outsourcing arrangements. The practical effect for an Irish PI or EMI is a layered set of obligations attaching to the same underlying arrangement: an outsourcing-notification duty to the Central Bank under existing guidance, and a DORA-specific register-of-information and contract-term duty running in parallel once the reconciliation platform is classified as supporting a critical or important function.

The classification exercise itself, namely whether a given reconciliation platform meets the critical-or-important threshold, is a judgment the firm must make and document, and it is one that connects directly back to the conduct-side safeguarding expectations: a firm that has not performed or documented this classification exercise for its reconciliation platform is exposed on two fronts simultaneously, a potential DORA compliance gap and an unresolved question about the robustness of the very control, daily reconciliation, that the Central Bank treats as central to safeguarding adequacy.

Outlook

Firms that have not yet formally classified their safeguarding-reconciliation outsourcing arrangements against the DORA critical-or-important-function test should expect this question to surface in supervisory engagement, given how closely the Central Bank's safeguarding expectations and the DORA critical-function test now overlap in practice for the specific case of reconciliation platforms. The register-of-information and contract-term obligations that follow from a critical-or-important classification are not one-off exercises; they require ongoing maintenance as the underlying arrangement evolves, which adds a recurring operational-resilience compliance burden on top of the existing Central Bank outsourcing-notification duty.