1. The Fintech Landscape
1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?
Dublin's reputation as a hub for fintech businesses is rapidly expanding. Many firms are setting up in the payments, e-money and regtech space. For example, the number of e-money institutions and payment institutions has tripled since 2018.
Irish legislation giving effect to Open Banking came into force in January 2018 and has allowed the further development of a better-integrated internal market for electronic payments in Europe and Ireland. Open Banking has not yet reached its full potential and further advancements are expected. Distributed ledger technologies (DLT) are emerging but are not widely used, and cryptocurrencies are not a commonly accepted means of payment yet in Ireland.
In terms of ESG objectives, they overlap most commonly with the investment management sphere. However, ESG creates opportunities for fintechs, such as for the development of products designed to support the economy while it transitions to protecting the climate, including loans tailored for carbon reduction and renewable energy products and rural diversification projects. Retail customers are being provided with opportunities to invest their personal savings in green finance, and credit card purchases are rewarded by using the standard fees paid by merchants to buy carbon offsets.
The impact of COVID-19 is that the volume of contactless payments increased by 36% in the third quarter of 2020, compared to the same quarter in 2019, along with the value of ATM withdrawals decreasing significantly. These behaviours are not expected to fully reverse post-pandemic.
Finally, the Central Bank of Ireland's (Central Bank) Innovation Hub Update 2021 notes five innovation trends: (i) a shift to e-money and a focus on instant payments; (ii) relatively strong growth observed in KYC regtech solutions; (iii) the continued growth of institutional interest and an increase in decentralised finance (DeFi) and tokenisation enquiries; (iv) the challenges of climate data and technology; and (v) innovation is expanding the Central Bank's traditional stakeholder profile. 2021 saw a noticeable increase in enquiries from potential Virtual Asset Service Providers (VASPs) and Crowdfunding Service Providers, on foot of the new VASP and crowdfunding regulatory regimes.
1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?
There are no prohibitions or restrictions specific to fintech businesses in Ireland. While the Central Bank has issued warnings as to the risks of investing in cryptoassets, there is currently no blanket prohibition on their use in Ireland. The Central Bank has adopted a “wait and see” approach, and has no plans to introduce a bespoke financial regulatory regime, albeit it has issued warnings about the risks of investing in cryptocurrencies.
Under the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010 to 2021 (as amended) (CJA 2010 to 2021), firms that act as VASPs must register with the Central Bank to comply with anti-money laundering (AML) purposes. The CJA 2010 to 2021 captures firms providing crypto-trading and crypto-brokerage services.
2. Funding For Fintech
2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?
All common funding structures are available to Irish businesses, including ordinary shares (common stock), preference shares, loan notes, debt and convertible instruments.
2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?
Enterprise Ireland (EI) is the Government agency responsible for supporting the development of companies with the potential to trade internationally. EI provides financial support for research & development (R&D), strategic planning, and growth opportunities. More information is available at (Hyperlink) .
The Ireland Strategic Investment Fund (ISIF) is a sovereign development fund, with a mandate to invest on a commercial basis to support economic activity and employment in Ireland. ISIF has made investments in Fexco, Finance Ireland, Beech Point Capital and a range of funds supporting SMEs in the technology and financial services sector. More information is available at (Hyperlink) .
The Strategic Banking Corporation of Ireland (SBCI) was established to make low-cost credit available to Irish SMEs through on-lending partners. SBCI provides funding support across a range of sectors, including for businesses affected by the impact of Brexit or the COVID-19 pandemic. More information is available at (Hyperlink) .
More generally, Ireland is recognised as a hub for technology focused businesses, with the top-five global software companies having operations here, as well as 18/25 of the largest financial services companies. Ireland has a well-educated workforce, a tax structure that supports growth businesses (e.g. an OECD BEPS-compliance knowledge development box, 25% R&D tax credits, etc.), and a long history of entrepreneurship and innovation in the fintech space.
2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?
Euronext Dublin is the primary equity securities market in Ireland. It is suitable for larger companies with an established track record and substantial financing requirements. A prospectus prepared in accordance with the Prospectus Regulation is required to list, the expected aggregate value of all shares (excluding treasury shares) to be listed must be at least EUR1 million, applicants must have published or filed historic financial information that covers at least three years that has been audited in accordance with applicable EU law, and there is normally a 25% free float (shares in public hands) requirement.
Euronext Growth is designed for smaller companies that may not be able or wish to satisfy all of the requirements of a Euronext Dublin listing. Euronext Growth has a reduced admission criteria where there is no requirement for a prior trading record and no minimum free float (shares in public hands) requirement. However, all Euronext Growth applicants are required to have securities worth a minimum of EUR2.5 million available for trading, and the aggregate value of all listed securities must equal at least EUR5 million. Generally speaking, a prospectus will not be required to list on Euronext Growth, and companies instead prepare an admission document giving potential investors information about the company, its operations and prospects.
2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?
Most recently, Global Shares was sold to J.P. Morgan – the terms have not been disclosed, but the consideration is reported to be approximately EUR730 million. Global Shares is a cloud-based provider of share plan management software with nearly USD200 billion in assets under administration across 650,000 corporate employee participants, and employees headquartered in Cork, Ireland and 16 further locations across Europe, the Middle East & Africa, North America and Asia Pacific.
Earlier in 2022, Concord Acquisition Corp, a publicly traded special purpose acquisition company, acquired Circle Internet Financial Limited, the issuer of the USDC stablecoin, to take Circle public in a transaction valuing Circle at USD9 billion.
Other notable recent transactions include:
- A group of investors led by DST Global Ltd, a venture capital firm, acquired 9.37% of Wayflyer Ltd, the Ireland-based software-fintech company engaged with providing revenue-based financing to e-commerce brands. The consideration was USD150 million. The round values Wayflyer Ltd at USD1.6 billion.
- Scalapay Limited, an Ireland-based payment solutions provider, has raised USD155 million in a Series A funding round led by Tiger Global Management, LLC at a valuation of USD700 million.
- Paysafe [NYSE:PSFE], a UK-based specialised payments platform, acquired SafetyPay, a leading payments platform, for USD441 million in an all-cash transaction.
- Stripe raised USD600 million in funding from a group of new and existing investors, including Allianz X, Axa, Baillie Gifford, Fidelity Management & Research Company, Sequoia Capital, and ISIF. Stripe has plans to use the funds for investing in its European operations and its Dublin headquarters and further expanding its Global Payments and Treasury Network.
3. Fintech Regulation
3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.
Many fintech businesses fall within the perimeter of the existing traditional financial regulation framework if they carry out regulated activities such as banking, provision of payment services, e-money, lending, credit servicing and crowdfunding.
A firm or business seeking to participate in regulated activities in Ireland must seek and obtain authorisation from the Central Bank. The Irish system requires authorisation specific to the activity, as there are a number of authorisation regimes.
3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?
Firms that act as VASPs must register with the Central Bank, as outlined in question 1.2 above.
The European Markets in Crypto Assets Regulation (MiCA) is in draft form with a view to establishing a European licensing regime, and Ireland will be required to implement MiCA once it comes into force. This new regime will be tied into the existing European and Irish e-money regulations and will establish a uniform set of rules applicable to cryptoasset service providers and issuers at the European level. The Central Bank has stated its support for MiCA.
3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox' options for fintechs in your jurisdiction?
The Central Bank is generally receptive to fintech innovation, which is evidenced by the rapid growth of the sector in Ireland in the last three years. re are currently no “sandbox” options for fintechs.
However, the Central Bank established an Innovation Hub in 2018, which is designed to facilitate an open and active engagement with the fintech sector. The areas of focus are (i) regtech, (ii) payments, and (iii) markets & exchanges. The hub reports that fintech innovators are gearing towards individual core functions of financial services to create a “more tailored and user-friendly digital experience largely through developing cloud-based platforms that provide an extra layer between back-end systems and front-end mobile/web applications, facilitating communication and sharing of data across the value chain”.
The Irish Government issued a paper in December 2019 entitled “International Financial Services Strategy 2025” (IFS2025), where it stated its commitment to developing Ireland as a global leader in the financial services sector. The Irish Government announced measures to demonstrate Ireland's credentials as an EU centre of excellence for DLT. Under IFS2025, an action plan was announced to include the establishment of the Department of Finance Fintech Working Group to develop Ireland's policy positions.
3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?
If a fintech firm wants to carry out regulated activities in Ireland, it must either have authorisation from the Central Bank, or a licence from another EEA Member State in order to “passport” into Ireland. The process for obtaining authorisation can be lengthy and costly, which is a significant barrier to entry.
4. Other Regulatory Regimes / Non-Financial Regulation
4.1 Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?
The General Data Protection Regulation ((EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) (GDPR) is directly applicable in Ireland, as an EU Member State. Regulation of the processing of personal is also covered by the Data Protection Act 2018 (DPA 2018), which implements parts of the GDPR, and S.I. No. 336/2011 – European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (ePrivacy Regulations), which transposes Directive 2002/58/EC. Data Protection Commission (DPC) is the Irish Supervisory Authority under the GDPR, and it works within the EU harmonisation and cooperation structures of the GDPR with other national Supervisory Authorities and the European Data Protection Board.
The GDPR and DPA 2018 govern the processing of personal data by “controllers” and “processors”. The nature of the role played by a fintech business from a GDPR perspective depends on the nature of the processing activities being undertaken.
4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?
The GDPR has broad application. In addition to its application across EU Member States, it also applies to any processing of personal data where an entity is established in the EU, whether or not the processing actually takes place within the EU. Establishment under the GDPR is defined as having a branch, office, subsidiary or some other form of carrying out activities in a stable arrangement. GDPR also applies to entities that are not established in the EU but offer goods or services to individuals in the EU, or monitor the behaviour of EU-based individuals.
Transfers of personal data outside the EEA are prohibited under the GDPR unless the transfer is made under a mechanism that will afford a level of protection to the transferred data and the affected data subjects that is essentially equivalent to the level of protection afforded by the GDPR.
4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.
The DPC has powers to investigate compliance with data protection laws either following a complaint from a data subject or of its own volition. DPC can issue warnings to entities that an intended processing activity is likely to infringe data protection law.
On findings of non-compliance, the DPC can also: (i) issue an enforcement notice requiring the entity to take action to rectify the non-compliance; (ii) issue a formal reprimand to the entity declaring their practices to be non-compliant with data protection laws; (iii) order the entity to communicate a personal data breach to a data subject; (iv) impose a temporary or permanent ban or limitation on an entity's activities, including a ban on all processing of personal data; (v) order that the entity rectify or erase personal data; (vi) order the suspension of international data transfers; and (vii) impose an administrative fine in addition to or instead of another corrective power.
The administrative fines that can be levied against an entity for infringements range from a maximum of EUR10 million or EUR20 million, or 2% or 4% of the undertaking's total worldwide annual turnover for the preceding financial year (whichever amount is greater), depending on the type of infringement.
4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?
The GDPR contains requirements about appropriate security, which apply to fintech businesses that process personal data.
S.I. No. 360/2018 – European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 transposes the Network and Information Security Directive (Directive (EU) 2016/1148) into Irish law. These impose binding security obligations on critical infrastructure operators, both State and private entities, which include operators in the energy, healthcare, financial services, transport, drinking water supply and digital infrastructure and telecommunications sectors. This may include fintech businesses if they operate essential banking and financial market infrastructure.
S.I. No. 6/2018 – European Union (Payment Services) Regulations 2018 transposes the second EU Payment Services Directive (PSD2), which expands the scope of the first EU Payment Services Directive (PSD1), which entered into force in 2009. Businesses engaged in offering payment services must ensure strong customer authentication, must inform regulators in instances of major operational or security incidents, and may be obliged to inform customers of incidents that impact users' financial interests.
The Central Bank Cross-Industry Guidance on Outsourcing applies to firms that are regulated by the Central Bank that outsource services and/or functions. The guidance places specific responsibilities on the board, senior management or management body of regulated firms to ensure effective governance of outsourcing arrangements, in addition to requirements on record-keeping and policy requirements in relation to outsourcing. The guidance also requires comprehensive, ongoing monitoring of outsourced services/functions, including internal audits and independent third-party reviews.
4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.
Firms that act as VASPs must register with the Central Bank, as outlined in question 1.2 above. VASPs are “designated persons” under the CJA 2010 to 2021 and are therefore required to comply with the AML/Combatting the Financing of Terrorism (CFT) obligations contained therein. Registration with the Central Bank as a VASP is for AML/CFT purposes only.
4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?
Fintech businesses offering products and services to consumers in Ireland must comply with Irish consumer protection law. The national regulator for consumer law is the Competition and Consumer Protection Commission.
The Broadcasting Authority of Ireland regulates advertising, sponsorship, product placement and other forms of commercial communication on Irish broadcasting services, which may apply to any commercial communication undertaken by fintech businesses in Ireland. Broadcast and print advertising of financial services and products also falls within the scope of the Advertising Standards Authority of Ireland Code of Standards, which is published by the Advertising Standards Authority of Ireland (ASAI), an independent self-regulatory body established and financed by the advertising industry and to which members of the ASAI must adhere.
5. Accessing Talent
5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?
Employers are obliged, under the Employment Equality Acts 1998 to 2021, not to discriminate on any of the discriminatory grounds listed under the Acts (gender, marital status, family status, sexual orientation, religion, age, disability, race or membership of the Traveller community) concerning access to employment.
An employer must have cause to dismiss an employee. Under the Unfair Dismissals Acts 1977 to 2015, the dismissal of an employee is deemed not to be unfair if it is for reasons of capability, conduct, capacity, redundancy, contravening the law (i.e., the employee's continued employment would be illegal) or some other substantial reason.
Employers must give employees the following minimum statutory periods of notice.
Duration of employment
|Thirteen weeks to two years||
|Two to five years||
|Five to 10 years||
|Ten to 15 years||
|Fifteen years or more||
If the employee's contract of employment provides for notice in excess of the statutory period, the contractual notice must be given. Payment in lieu of notice may be given if it is provided for in the contract of employment.
An employer may dismiss an employee without notice for gross misconduct (i.e., summary dismissal). This is conduct that is so serious that immediate dismissal of the employee is warranted; for example, assault, stealing or serious breach of employment policies. Employment contracts may contain further examples of gross misconduct.
The Redundancy Payments Acts 1967 to 2014 provide for statutory redundancy payments for employees with at least two years' continuous service.
Employees are entitled to two weeks' pay for each year of continuous service (capped at EUR600 per week) plus one additional week's pay (capped at EUR600 per week).
Employees with 12 months' service have statutory protection from unfair dismissal.
5.2 What, if any, mandatory employment benefits must be provided to staff?
There is no obligation on an employer to set up or contribute to a pension scheme or to provide health insurance. If an employer does not have a pension scheme, or an employee is excluded from joining a pension scheme, the employer must provide access to a personal retirement savings account within six months of the employee starting employment.
5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?
Persons without a legal right to work in Ireland (e.g. non-EEA/Swiss nationals) require an employment permit to work in Ireland. The Irish Naturalisation and Immigration Service provides a list of non-EEA nationalities that must have an entry visa issued to them before arriving in Ireland. Visas set out an individual's immigration permission, which is usually separate from his or her permission to work.
The general employment permit is the main vehicle used to attract non-EEA nationals into roles where there is a labour or skills shortage. General employment permits are issued for those occupations with a minimum annual remuneration of EUR30,000 where skill shortages exist in the labour market and an Irish/EEA or Swiss national cannot be found to fill the vacancy. General employment permits are available for all roles except for those contained on the Ineligible Categories of Employment list (issued by the Department of Business, Enterprise and Innovation (DBEI)). Generally, a labour market test is required before a general employment permit will be granted.
Alternatively, employees may apply for a critical skills employment permit if the role falls within specific criteria (i.e., occupations that are critically important to growing Ireland's economy, are highly demanded and highly skilled and are in a significant shortage of supply in Ireland's labour market). The employee must receive a minimum level of remuneration to qualify. Certain roles for ICT professionals, information technology and telecommunications professionals and business, research and administrative professionals are catered for under this permit. The permit is issued for job offers of two years or more. There is no special route for individuals who wish to work for fintech businesses.
6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.
Patents: Innovations and inventions are formally protected in Ireland through patents and patent registration. A patent is an intellectual property (IP) right that grants its owner exclusive territorial rights to exploit a patentable invention for a specified period. To be patentable under the Patents Act 1992 an invention must be: (i) susceptible of industrial application; (ii) new; and (iii) involve an inventive step.
Patents can be registered with the Intellectual Property Office of Ireland (IPOI). Ireland is a party to the Paris Convention, and the IPOI recognises priority of patent applications made in other party countries up to 12 months previously. As an EU Member State, Ireland is a party to the European Patent Convention and recognises priority of patent applications to the European Patent Office and in other party countries filed up to 12 months before an application to the IPOI.
Designs: Rights in registered designs for products is governed by the Industrial Designs Act 2001. A design means “the appearance of the whole or part of a product resulting from the features of, in particular, the lines, contours, colour, shape, texture or materials of the product itself or its ornamentation”. A product is “any industrial or handicraft item” including parts but does not include computer programs. To be registered, a design must be new and have individual character and the applicant must be the proprietor of the design.
Fintech products and services can also be protected in Ireland by several other IP rights.
Copyright: Copyright protects the computer program (both object code and source code) as well as screen displays, graphics, sound effects and other elements that are produced when the program is running. Copyright is not registered in Ireland.
Database right: Compilations of data can be protected in Ireland by copyright, in the selection or arrangement of the contents in a database (regardless of whether or not the contents of the database themselves are protected by copyright), purchase order systems and websites. Under the Database Directive (96/9/EC), there is also a right, distinct from copyright, to prevent unauthorised extraction or utilisation of the contents of a database, known as the sui generis right, to protect investment in the obtaining, verification or presentation of the contents of the database.
Know-how and trade secrets: Industry knowledge and work product, including software source code, could be protected as a trade secret or subject to confidentiality considerations. Trade secrets are protected under the Trade Secrets Directive (2016/943), which has been transposed into Ireland under the European Union (Protection of Trade Secrets) Regulations 2018.
Confidential information may also be protected under the common law duty of confidence.
There is no system for registration of trade secrets or confidential information in Ireland.
Trademarks and passing off: Trademarks are a registered IP right over signs capable of distinguishing the goods or services of one undertaking/business from those of other undertakings/businesses, such as brand names, trading names, and logos. The common law tort of passing off may also afford protection to unregistered branding.
6.2 Please briefly describe how ownership of IP operates in your jurisdiction.
Ownership of IP rights depends upon the context in which they are created. IP ownership may be registered or unregistered. IP rights created by an employee during the course of their employment will belong to the employer unless the contract of employment states otherwise. In addition, third-party contractors will own the IP rights in commissioned works unless the copyright has been assigned by written agreement to the commissioning entity.
Patents: A patent for an invention is generally owned by the inventor but may be owned by any other natural or legal person designated as the owner on the patent application or to whom the patent right is assigned. The European Patent Office has found that that the inventor designated in a patent application must be a natural person and as such artificial intelligence (AI) programmes do not qualify.
Design rights: Registered design rights are owned by the registered owner. Unregistered design rights are owned by the natural or legal personal responsible for making the products incorporating the designs available to the public.
Copyright: Ownership in copyright automatically vests in the author of the copyrighted work (i.e., the author of the software); and for computer-generated works, the author is the person who undertakes the arrangements necessary for the creation of the work. There is no settled provision in Ireland on the ownership of copyright created by the use of AI technologies.
Database rights: Database rights are owned by the maker of the database.
Know-how and trade secrets: These unregistered IP rights may be owned by the legal or natural person who has developed their subject matter.
Trademarks and passing off: The owner of a trademark will be identified on the registration of the trademark. The right to sue in tort for passing off will belong to the entity who can establish that they are the owner of the goodwill established in a brand through trade.
6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?
Ireland is a party to the following treaties under which owners of foreign IP rights may enforce their rights:
- The Patent Cooperation Treaty 1970 (PCT) (Hyperlink) .
- The European Patent Convention of the European Patent Office (Hyperlink) .
- The WIPO Madrid Agreement Concerning the International Registration of Marks 1891 and the Protocol relating to that Agreement (1989) (Hyperlink) .
- Paris Convention for the Protection of Industrial Property 1883 (Hyperlink) .
- The Berne Convention for the Protection of Literary and Artistic Works (Hyperlink) .
- The Hague Agreement Concerning the International Registration of Industrial Designs 1925 (Hyperlink) .
EU trademarks and Community design rights registered by the European Union Intellectual Property Office (EUIPO) can be enforced in Ireland.
6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?
IP is usually monetised by assignment (transfer) or by licensing. It is also possible to take and grant security over assets. Security is most commonly taken over registered rights. The security interest is then recorded on the relevant registry to put third parties on notice of the interest. It is also equally possible to take security over most forms of unregistered .
Assignment: An assignment of an IP right must either be subject to sufficient consideration or executed as a deed. The assignment of a patent is not required under the Patents Act to be in writing, but, as a matter of good practice, should be effected by a written assignment. To be effective, an assignment of a registered trademark must be in writing and signed by and on behalf of the assignor. The assignment of rights in copyright must be in writing, signed by or on behalf of the assignor. A trademark application can also be assigned. An assignment of an IP right must either be subject to sufficient consideration or executed as a deed. Assignments of Irish patents and trademarks should be registered as soon as practicable with the IPOI.
Licence: The same formalities apply to licensing of IP rights as assignment of those rights. It is recommended that the IPOI is informed of licensing arrangements of patents and registered trademarks and the details recorded on the Patent Register or Trademark Register, particularly exclusive licences.
The authors would like to acknowledge the invaluable contribution of their colleague, Bláithín Sheil, in the writing of this chapter.
Originally Published by International Comparative Legal Guide
This article contains a general summary of developments and is not a complete or definitive statement of the law. Specific legal advice should be obtained where appropriate.