Ireland

The regime is distinctive in its full-scope character. The CBI does not offer a Small Payment Institution licence of the more limited kind available in some other EU member states, making Ireland's PI regime relatively full-scope; firms cannot use a lighter-touch route and must instead pursue full authorisation. As of 31 October 2021 Ireland had more than 40 authorised e-money and payment services firms, with EMIs and PIs able to passport across the EU under freedom of services and establishment. The reward for the heavier authorisation lift is EU-wide market access. This standing position carries the bank-PSP versus non-bank-PI/EMI distinction explicitly: the licensing framework here governs the non-bank PI/EMI route to market, while credit institutions follow the separate banking-authorisation track. The absence of a Small PI option is a structural feature that underpins Ireland's post-Brexit hub status, drawing firms that need a full-scope EU base rather than a constrained national footprint.

Outlook

The licensing trajectory is established and stable: the CBI's role as single competent authority and the full-scope, no-Small-PI design are durable structural features rather than moving targets. The forward pressure on licensed firms comes not from the authorisation gate itself but from the conduct, resilience and AML obligations layered on top of it, addressed in the W1b, W3 and W11 modules. Firms hubbing in Ireland should expect the authorisation bar to remain demanding and the passporting reward to remain the central commercial rationale for choosing the jurisdiction.

The dominant forward-dated item is the Consumer Protection Code 2025, which comes into effect on 24 March 2026 (published 24 March 2025), representing domestic gold-plating of consumer protection with cross-sectoral requirements against financial abuse, fraud and scams, and protections for vulnerable consumers; it is underpinned by S.I. 81/2025, and the corporate consumer threshold is raised to EUR 5m turnover from EUR 3m. All regulated firms, including payments firms, must implement the enhanced conduct, vulnerability and fraud requirements by that date. Because the Code applies cross-sectorally, it reaches both bank PSPs and non-bank PIs/EMIs, distinguishing it from the safeguarding obligation that is specific to the non-bank population.

Outlook

The conduct trajectory is escalating. The Consumer Protection Code 2025 is the defining near-term implementation deadline, with a hard in-force date of 24 March 2026 that requires firms to have remediated conduct, vulnerability and anti-fraud processes ahead of supervision. Safeguarding will remain a stated CBI priority, keeping the segregation-or-insurance model and its cost implications under active supervisory attention for non-bank firms. The combination signals a jurisdiction intensifying its conduct expectations even as the underlying licensing architecture stays stable.

The national discretion exercised in Ireland is stricter than in several peer member states. Ireland reduced the MiCA CASP transition to 12 months and did not grant existing VASPs a simplified-authorisation route, deeming the VASP regime not comparable to MiCA; the CBI applies a high authorisation threshold and is highly sceptical of CASP models marketing unbacked crypto-assets to retail for speculation. The shorter transition compresses the runway for incumbent VASPs and signals a high CBI authorisation bar relative to other EU NCAs.

As a dated illustration of hub status, Kraken secured a MiCA licence via the Central Bank of Ireland, with passporting activating once the CBI uploads the authorisation to ESMA's central register — a concrete demonstration of Ireland attracting major CASP authorisations.

Outlook

The stablecoin trajectory is established but escalating in supervisory intensity. The combination of a 12-month transition, no VASP grandfathering and overt CBI scepticism of speculative retail crypto models points to a continuing high authorisation bar. Dublin's attraction of major CASP authorisations such as Kraken suggests the hub positioning will persist, but firms should expect the authorisation process itself to remain rigorous, with EMT issuers held to credit-institution or EMI reserve and redemption standards.

The domestic guidance landscape has been reorganised around DORA. The CBI revised its 2021 Cross-Industry Operational Resilience Guidance in 2025 to align with DORA and withdrew its 2016 cross-industry IT and cybersecurity guidance, as DORA now sets the harmonised good-practice minimum; operational resilience and DORA implementation is a key CBI supervisory priority for 2025/26. The effect is that CBI domestic guidance is now subordinated to the EU regime, with the supervisor treating resilience as an active focus area rather than a settled baseline.

Outlook

The resilience trajectory is established. With DORA live and the CBI having realigned its own guidance, the framework is in steady-state application, but resilience remains a stated 2025/26 supervisory priority, meaning firms should expect continued supervisory engagement on ICT risk management, incident reporting and critical third-party oversight. The principal forward dimension is enforcement and testing intensity rather than further rule change.

Scheme-global compliance pressure is tightening on Irish acquirers. Visa's consolidated Acquirer Monitoring Program (VAMP) carries new thresholds taking effect across 2025-2026, and PCI DSS v4.0.1 future-dated requirements became effective on 31 March 2025. Ireland's acquiring market is dominated by fintech acquirers such as Stripe and Adyen alongside traditional banks, with high contactless adoption; these scheme rules bear most directly on the non-bank acquirer population that intermediates merchant card acceptance. VAMP and PCI v4.0.1 together raise the compliance burden on Irish acquirers and pass downstream to merchants.

Outlook

The scheme-compliance trajectory is broadly stable at the regulatory layer — IFR caps and SEPA rulebooks are durable — but escalating at the scheme-rule layer, where VAMP thresholds tighten through 2026 and PCI DSS v4.0.1 raises the technical bar. With no national card scheme to provide an alternative, Irish card economics will continue to track Visa, Mastercard and SEPA rule evolution, concentrating compliance attention on the fintech acquirers that dominate the market. The detailed enforcement mechanics of VAMP are carried in W8.

The principal non-euro corridor is the UK link. The Ireland-UK payment corridor requires FX and faces Brexit-related cross-border friction; Ireland is in the SEPA euro zone but its strong ties to the UK in sterling, post-Brexit, require frequent currency conversion — in 2021 the UK accounted for 11% of Irish exports and 19% of imports. This makes the UK FX corridor Ireland's most material non-euro flow and a structural source of conversion cost and friction.

Outlook

The corridor trajectory is escalating, driven by the now-live IPR send-mandate that universalises instant euro capability and embeds Verification of Payee and sanctions screening as standing operational requirements. The intra-EEA SEPA corridor settling on RT1 and TIPS is the principal euro flow, while the UK FX corridor remains the material non-euro vector with persistent post-Brexit conversion friction. Firms should expect instant-payment economics and VoP obligations to be the dominant corridor-level pressure going forward.

The market is being actively steered by policy. The National Payments Strategy launched on 15 October 2024, addressing cash, payment resilience, fraud and the future of payments; the Department of Finance was to provide the CBI with orderly-wind-down and liquidation powers for payment firms, with recommendations by end-June 2025. The CBI is also increasing scrutiny of point-of-sale BNPL lending and is expected to bring BNPL under formal credit rules. The new liquidation powers change firm-exit dynamics, and the looming BNPL formalisation signals tighter treatment of embedded-credit models. The structural M&A and investment events themselves are carried in W13; this module covers the market-structure frame within which they occur.

Outlook

The industry-structure trajectory is stable in its concentration of EU infrastructure in Dublin but active at the policy layer. The National Payments Strategy will continue to steer market development, the new CBI liquidation powers reshape how distressed payment firms exit, and BNPL formalisation under formal credit rules looms as a discrete tightening. The hub's competitive depth — incumbents alongside global infrastructure and homegrown firms — is a durable structural feature.

The enforcement firepower behind that action is substantial. The CBI's Administrative Sanctions Procedure empowers fines up to EUR 10 million or 10% of turnover for firms and EUR 1 million for individuals; notable historic fines include Bank of Ireland's EUR 24.5 million in November 2021 for IT service-continuity and internal-control breaches. The CBI issued its first Financial Crime Bulletin in late 2025, flagging weak sanctions-screening — just under half of 40 assessed firms lacked transaction-screening — and sanctioned non-EU bank cards at EU ATMs. This quantifies the supervisory firepower and the sanctions-screening focus relevant to payments firms across both bank and non-bank populations.

Outlook

The litigation and enforcement trajectory is escalating. The Coinbase Europe fine, pending High Court confirmation, sets a precedent for CASP AML enforcement and signals the CBI's willingness to deploy its full ASP firepower. The first Financial Crime Bulletin's findings on sanctions-screening weakness suggest further supervisory attention on transaction-screening adequacy. Payments firms should anticipate continued, well-resourced enforcement activity and treat the EUR 10m / 10%-of-turnover ceiling as a live exposure.

The cardholder-recourse framework operates through voluntary scheme procedures. The Irish cardholder chargeback framework operates via voluntary Visa and Mastercard scheme procedures in card operating contracts allowing chargebacks for non-delivery and lack of conformity, with filing windows typically 120 to 180 days and a 14-day merchant response window before automatic refund; acquirers apply higher due diligence to high-risk verticals such as travel, gaming, forex, crypto and international e-commerce. This defines cardholder recourse windows and acquirer high-risk underwriting practice in Ireland. Quantitative operational metrics — chargeback ratios by merchant category, acquirer reserve and stress data, and high-risk-MCC volume share — are not evidenced beyond these qualitative scheme-rule descriptions, an acknowledged under-indexed area for the jurisdiction.

Outlook

The merchant-acquiring trajectory is escalating. The October 2025 VAMP enforcement start and the threshold drop from 220 to 150 basis points, combined with Mastercard's Excessive Chargeback Program, raise the compliance and chargeback-management burden on the fintech acquirers that dominate Irish acquiring. High-risk verticals will continue to attract heightened underwriting scrutiny. The principal intelligence gap is quantitative operational depth, which remains under-indexed for Ireland.

The most consequential long-run product-access development is the digital euro. The digital euro project moved to its next phase on 30 October 2025, following an ECB Governing Council decision, with a possible pilot exercise from 2027 and possible first issuance in 2029, assuming co-legislators adopt the digital euro Regulation; the CBI participates as part of the Eurosystem. Digital euro progression carries long-run distribution and intermediation implications for Irish PSPs and banks, even though issuance remains several years out and contingent on the legislative process.

Outlook

The product-innovation trajectory is established and engaged. The Innovation-in-Payments sandbox running from January 2026 provides an active channel for supervisory engagement with new payment products. The digital euro is the dominant horizon item, with its phased path — possible pilot from 2027 and possible first issuance in 2029 — making it a long-run strategic variable for Irish PSPs rather than a near-term operational change. Firms should track the co-legislative process on the digital euro Regulation as the gating factor for that timeline.

Rather than imposing a reimbursement liability on PSPs, Ireland's model leans on system-wide coordination and a shared fraud database, drawing in non-financial actors such as platforms and telecommunications providers. This is a structurally lighter cardholder-recourse posture than the UK PSR regime, placing the emphasis on prevention and cross-sectoral data-sharing rather than on a backstop reimbursement guarantee.

Outlook

The consumer-protection and APP-fraud trajectory is escalating in policy activity even without a mandatory reimbursement scheme. The legislated BPFI-developed shared fraud database and the whole-of-system National Payments Strategy approach are the principal developments to watch, alongside the cross-sectoral extension to platforms and telcos. Ireland's continued divergence from the UK mandatory-reimbursement model is itself a standing feature that materially shapes liability exposure for Irish PSPs, and the Consumer Protection Code 2025's anti-fraud requirements (W1b) reinforce the prevention-led posture.

The forward shift is the EU AML package. Per the Sentinel feed, the directly-applicable AML Regulation (AMLR) applies in all member states from 10 July 2027 with no national opt-outs, largely replacing the CJA 2010 for payments and crypto firms; AMLA in Frankfurt commenced operations on 1 July 2025, and former CBI Deputy Governor Derville Rowland was appointed to AMLA's Executive Board in May 2025. The AMLR harmonisation and AMLA central supervision will reshape AML compliance for Irish payments firms, with an Irish presence on the AMLA board. Source: Sentinel (sentinel://kpmg.ie/aml-amla-readiness).

Outlook

The AML/CFT trajectory is escalating. The CJA 2010 base plus the S.I. 389/2025 travel rule are the current standing position, while the AMLR binding Irish obliged entities from 10 July 2027 and AMLA's central supervision from 1 July 2025 are the major forward changes. Because this module is Sentinel-fed, original illicit-finance analysis — including FATF mutual-evaluation depth and bank-versus-non-bank supervision detail — is out of World Payments scope and routed to FIM; the record here is provenance-limited to the payments context.

That asymmetry has been structurally narrowed. Non-bank PSPs (PIs and EMIs) in Ireland gained TARGET access from October 2025, under the IPR's amendments to PSD2 and the Settlement Finality Directive making non-bank PSPs eligible to participate in designated payment systems; those meeting TARGET Guideline requirements can access TARGET Services including T2, broadening settlement access for Irish non-bank PSPs. Direct TARGET and T2 access for non-bank PSPs reduces dependency on bank sponsorship and reshapes settlement economics — the core analytical development for the module this cycle.

Outlook

The settlement-access trajectory is escalating. The October 2025 grant of direct TARGET and T2 access to qualifying non-bank PSPs is a structural change that narrows the long-standing bank versus non-bank asymmetry and reduces dependence on bank sponsorship. Ireland's reliance on Eurosystem central-bank-money settlement and the SIPS-designated EURO1 net-settlement layer remains the durable backbone. The forward question is how many Irish non-bank PSPs meet the TARGET Guideline requirements and convert eligibility into direct participation.

The flagship M&A and valuation event is Stripe. Stripe was valued at more than $159 billion following a February 2026 tender offer, up from approximately $91.5bn in 2025; it acquired Privy, with more than 110 million programmable wallets, and Metronome, and expanded stablecoin integration having acquired Bridge in 2025, focusing on stablecoins and agentic AI in commerce. The Privy and Metronome acquisitions, whose transaction values are not publicly disclosed, build out programmable-wallet and billing capability as part of a stablecoin and agentic-AI commerce expansion. Stripe's valuation and stablecoin and wallet M&A signal the commercial heft of Ireland's flagship payments firm and the sector's stablecoin direction of travel. The stablecoin illicit-finance dimension of the Bridge integration is routed to FIM, and the agentic-AI angle may warrant AI-governance routing; the World Payments record carries the commercial event only.

Outlook

The commercial-intelligence trajectory is established and, at the firm level, escalating. The recovering deal market — $259.38m across 2025 with seven acquisitions — and Stripe's $159bn February-2026 valuation point to a strengthening commercial centre of gravity around Dublin's flagship firms. Stablecoin and programmable-wallet M&A signal the strategic direction. A standing limitation is private-company signal opacity: several events, including the Stripe acquisitions of Privy and Metronome, have undisclosed transaction values, constraining the precision of commercial-significance assessment.