1. The Fintech Landscape
1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?
Ireland is a leading European domicile for established and start-up fintech businesses. This is unsurprising given Ireland's traditional strengths in the internationally traded technology and financial services industries. The Irish government is strongly supportive of fintech, recognising the significant benefits it can bring to consumers, economic growth, productivity and the competitiveness of the Irish economy.
Irish fintech covers a wide range of areas from payments, trading and FX, big data, risk, compliance, and business intelligence to consumer-focused currency exchanges and peer-to-peer lenders.
The COVID-19 pandemic underlined the importance of the technological transformation in financial services as consumers became increasingly dependent on fintech solutions. This is supported by the Central Bank of Ireland's ("Central Bank") credit and banking statistics, which showed a 44% increase in online spending and a 61% reduction in cash withdrawals from ATMs between November 2019 and March 2022.
The European Commission has adopted the Digital Finance Package ("DFP"), which included digital finance and retail payments strategies. Under the DFP, the Department of Finance has established a new fintech Working Group ("Working Group") in order to gain a shared understanding of market developments in fintech, technology and innovation. The Working Group will interact with external stakeholders from time to time in order to foster collaboration between policy-makers, fintech business and technological innovators.
Investment is available under IDA Ireland's ("IDA") "Go Green" initiative designed to encourage companies to adopt green business principles and to achieve international environmental best practices.
1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?
There are no prohibitions or restrictions specific to fintech businesses in Ireland. Cryptocurrency-based businesses or virtual asset service providers ("VASPs") have been a cause for increased scrutiny given the inherent anti-money laundering ("AML") risks associated with them, and under the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010 to 2021 (as amended) ("CJA 2010 to 2021"), VASPs must register with the Central Bank to comply with AML obligations.
2. Funding For Fintech
2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?
All conventional business funding is available to fintechs, including private equity, venture capital, leveraged finance, debt restructuring, etc.
2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?
Ireland's stable corporation tax on trading profits is an important element of its competitive offering to international business. Ireland also has tax legislation designed to make it attractive for holding companies and as regional headquarters, as well as other key tax benefits such as R&D credits. In addition to the potential for state funding/investment via IDA, Enterprise Ireland and the Ireland Strategic Investment Fund, the private funding sector is vibrant, though Ireland has seen relatively low levels of crowdfunding to date.
A Fintech Foresight Group, chaired by Banking and Payments Federation Ireland ("BPFI") has been convened as a special cross-sector working group tasked with driving the development of fintech in Ireland, scoping the annual action plans prepared, and informing policy under IFS 2025. This Group has identified further areas of relevancy for fintech: open banking, data and digital assets for 2022 analysis, with working groups generating position papers in relation to each of these categories. A specialised fintech industry association, the Fintech and Payments Association of Ireland, has also been established.
Enterprise Ireland, the government agency in Ireland responsible for supporting Irish business actively supports a portfolio of more than 200 fintech companies with equity investments at any time, spanning almost all sectors, including large and small businesses, and what it defines as "High Potential Start-Ups".
The Irish government actively encourages international companies to choose Ireland as a European base. Part of the incentive package offered can be state financial assistance, in the form of grants, to defray start-up or other costs. IDA is Ireland's FDI agency and has partnered with over 1,600 entities in establishing and expanding their Irish presence. A range of other supports, both financial and nonfinancial, are available from government departments, offices and agencies.
Grants are specifically tailored to meet the needs of each company. The extent of grant aid will depend on the size of the project, the proposed location, the economic impact of the business and the project's fit with IDA strategy.
Research, development and innovation grants represent the largest proportion of the IDA's grant funding programme. The IDA has signalled its willingness to support extremely large and technically ambitious projects and will not seek any rights to intellectual property ("IP") generated by R&D. Further supports are available under the IDA's "Go Green" initiative designed to encourage companies to adopt green business principles and to achieve international environmental best practices. Specific supports exist for investment outside the main population centres, and the IDA has published detailed and ambitious targets for regional investment.
If the application is approved and an incentive package is agreed, a grant agreement is then entered into between the IDA, the Irish entity and/or its promoter or parent company. This contract sets out the terms on which the grant aid is given and will vary from case to case.
2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?
Euronext Dublin is the principal equity trading market in Ireland and is an EU-regulated market. Issuers are therefore subject to relevant European regulatory regimes including the Prospectus Regulation and Transparency Directive. Listing on Euronext Dublin requires a dual submission process to Euronext Dublin and the Central Bank. There are two categories of listing available, primary and secondary.
A typical Euronext Dublin IPO process can take between four and six months, depending on the complexity and structure of the offer. A company wishing to list on Euronext Dublin must appoint a sponsor (who must be registered with Euronext Dublin) for the duration of the listing. The sponsor will be the main point of contact between the company and Euronext Dublin and is responsible for ensuring the suitability of the company for listing prior to an application being made. The company, along with their adviser, will appoint one or more investment banks as an underwriter as well as Irish legal counsel, reporting accountants and registrars. If the company intends to be dual-listed, appropriate advisers (including local legal counsel) from that jurisdiction will also be appointed. The listing requirements for primary or secondary listing on Euronext Dublin are set out in chapter 2 of the Euronext Dublin Rule Book II: Listing Rules.
The key conditions for primary listings are:
- the company must be duly incorporated and established in accordance with the relevant laws of its place of incorporation or establishment and be in compliance with its constitution;
- the company must have filed and published audited financial statements covering a period of at least three years, ending no more than six months before the date of the prospectus;
- the company must satisfy Euronext Dublin that is has sufficient working capital to cover the company's requirements for at least the next 12 months following the date of the prospectus;
- the listing prospectus must be in compliance with EU legislation and must be reviewed and approved by the Central Bank;
- the ability to carry on its business independently of any controlling shareholder (a person who either controls 30% or more of the votes in the issuer or who has the right to appoint a majority of the board of directors);
- shares must be fully paid and free from all liens and from any restriction on the right of transfer (except any restriction imposed for failure to comply with certain notices from the company investigating existing interests in its shares);
- the expected aggregate market value of securities to be admitted must be at least €1 million (Euronext Dublin may make an exception if there is an adequate market for the securities); and
- at the time of admission, 25% of shares must be in public hands, meaning free float.
Most of the key requirements listed apply equally to secondary listings. However, it must be noted that the requirement to publish accounts and the conditions related to working capital assets and business activities do not apply to secondary listings.
In contrast to Euronext Dublin, Euronext Growth is an exchange regulated equity market that is suited to small and mid-sized companies that wish to raise funds to finance growth. Listing requirements are generally simplified and reporting requirements are lighter than for the regulated market. Although a controlled market, it is not subject to regulation under a number of existing European regimes and thus offers an alternative route for organisations that are at earlier stages of their development.
Companies applying to Euronext Growth for listing are not required to submit a prospectus to the Central Bank, which can result in a significantly faster listing process. A company wishing to list on Euronext Growth must appoint a Euronext Growth Listing Sponsor approved by Euronext Dublin for the duration of the listing. Their role will be similar to that of the adviser mentioned above in relation the Euronext Dublin listing in that they must assess the appropriateness of the company for admission. Euronext Growth applicants are required to have a minimum market capitalisation of €5 million.
The ASM was established in 2015 to allow US-listed companies to have their securities dual-listed in Europe without significant additional admission or disclosure requirements to those that apply by virtue of their US listing. Consequently, its listing rules are streamlined to align with the Securities and Exchange Commission requirements and so it is primarily designed for companies already listed on the New York Stock Exchange or Nasdaq.
As at the timing of writing (March 2023), there are no companies listed on the ASM.
An ASM adviser must be appointed for the duration of its listing. The rules for listing on the ASM are set out in Atlantic Securities Market Rules for Companies. To list on the ASM, companies are required to publish an admission document. However, applicants with a prior listing on the New York Stock Exchange or Nasdaq for a period of 18 months prior to listing on the ASM are not required to publish an admission document and can benefit from a fast-track application process.
2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?
In general, only three companies have come to the market in Dublin in the past four years: Uniphar, the healthcare group that raised €150 million in an IPO in July 2019; Corre Energy, a developer of underground storage solutions for renewable energy that floated in September 2021; and medtech firm HealthBeacon, which in December 2021 became the first IPOready alumnus to take the plunge.
Some notable transactions include:
- Global Shares was sold to JP Morgan Chase in 2022 for a purchase price of $676 million, accounting for two-thirds of the value of all the deals in the sector in 2022.
- QP Games AB, a Sweden-based software-gaming platforms company, is to acquire GP Star Maker Ltd, an Ireland-based software-gaming platforms company engaged with developing games. The consideration was €2 million to be paid through issuance of common shares.
- Ergo Systems, an Ireland-based provider of IT solutions, has acquired BoatyardX Ltd, a local custom software development company.
- Mediahuis NV, a Belgium-based publishing company, has acquired Switcher Ltd, an Ireland-based software company that provides a price comparison site for broadband, energy, mobile, money and mortgages.
- AerAdvise Co Ltd, an Ireland-based technical consulting and asset management company serving high-value aircraft leasing clients, has acquired Core Financial Systems Ltd, a local financial software provider with expertise in aircraft leasing, financial services and the public sector.
3. Fintech Regulation
3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.
Whether or not a fintech business needs to hold a financial services authorisation will depend on the nature of the activities that the firm engages in. The majority of relevant regulated activities stem from EU directives, and each of the regimes below provide for a passporting regime that permits a provider authorised in one Member State to provide its services in other Member States, subject to notification requirements to the home and host state competent authorities.
Directive (EU) 2015/2366 ("PSD II") was transposed into Irish law by the European Union (Payment Services) Regulations 2018 and regulates the provision of payment services. Fintech businesses engaged in regulated payment services (such as money remittance or operating payment accounts) are required to be authorised under PSD II. PSD II also introduced two new "open banking" types of payment service: account information services; and payment initiation services.
Directive 2009/110/EC ("EMD") was transposed into Irish law by the European Communities (Electronic Money) Regulations 2011, which regulates the issue and redemption of "electronic money".
Directive 2014/65/EU ("MiFID II") was transposed into Irish law by the European Union (Markets in Financial Instruments) Regulations 2017 ("Irish MiFID II Regulations") and aims to create a single market for investment services and activities and to ensure a high degree of harmonised protection for investors in "financial instruments" in the EU. In the case of digital assets (whether in the form of tokens, coins or otherwise), where the coin, token or other asset qualifies as a "transferable security" or other "financial instrument", the process by which the digital asset is created, distributed or traded is likely to involve some MiFID II investment services such as placing, dealing in or advising on "financial instruments", requiring authorisation from the Central Bank (or the supervisory authority of another Member State of the EU). The operation of a trading platform for "transferable securities" and other "financial instruments" is a regulated investment service that requires authorisation under the Irish MiFID II Regulations. Accordingly, if the digital assets to be traded comprise "transferable securities" or other "financial instruments", a MiFID II authorisation will be required. If the digital assets to be traded are not "transferable securities" or other "financial instruments", as is likely the case with pure utility tokens and payment tokens based on current law and practice, no MiFID II authorisation will be required. Prospectus regulation, deriving from EU law, may also be relevant where the digital asset constitutes a financial instrument and is either offered to the public in a Member State or is listed on a regulated market.
The EU's Fifth AML Directive created a new registration obligation for all firms acting as VASPs in Ireland in April 2021. Notably, because the legal framework is based on the EU's AML directives (and not the PSD II), firms registered under this framework will not be able to passport their licences across the EEA.
Many crypto-assets currently fall outside the scope of European financial services regulation and, although some individual EU Member States have implemented national frameworks to try to address this gap, the divergence in these frameworks has hindered the ability of crypto-asset issuers and service providers to scale up their business activity to an EU level. The Markets in Crypto Assets Regulation ("MiCA") is the European response to this – a dedicated and harmonised regulatory framework intended to ensure that the EU makes the most of the opportunities created by crypto-assets whilst also mitigating the risks that they pose, with many viewing MiCA as a "mini-MiFID" regime. The enactment of MiCA will develop a more suitable regulatory framework for VASPs across Europe, including passporting rights for those firms. MiCA implementation is anticipated either late 2023 or early-mid 2024.
In addition to sector-specific requirements, fintech businesses may need to comply with consumer protection legislation (depending on the nature of the customers), Central Bank conduct rules, AML requirements and data protection legislation.
In light of the lack of a common EU legislative framework in respect of crowdfunding, Regulation (EU) 2020/1503 ("Crowdfunding Regulation") and Directive (EU) 2020/1504 ("MiFID II Amending Directive") were published. The Crowdfunding Regulation became directly effective in November 2021 and Member States were required to implement the MiFID II Amending Directive into national law by 10 May 2021 and to apply those measures from 10 November 2021. European Crowdfunding Service Providers ("ECSPs") are excluded from MiFID II by the MiFID II Amending Directive, and ECSPs are instead covered by the Crowdfunding Regulation.
The Crowdfunding Regulation applies to peer-to-peer crowdfunding platforms facilitating "business funding" (lending to consumers is excluded) and investment-based crowdfunding platforms in relation to transferable securities up to a threshold of $5,000,000, whereas MiFID II continues to apply to larger crowdfunding platforms. Prospective ECSPs must apply for authorisation under the Crowdfunding Regulation and may avail of the ability to passport its licence into each of the EEA Member States once approved. The Crowdfunding Regulation also places tailored operational and conduct of business requirements on ECSPs in their interactions with investors.
3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?
As mentioned at question 1.2 above, VASPs are subjected to the CJA 2010 to 2021.
With the imminent vote on MiCA by the European Parliament, it is expected that the regulatory landscape for these companies will soon be further bolstered at domestic and European level.
Many Irish firms already providing virtual asset services will need to ensure that their operating models and compliance frameworks are robust enough to be able to obtain authorisation as a VASP when MiCA is enacted.
3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory 'sandbox' options for fintechs in your jurisdiction?
Accelerator programmes are expanding their activities in Ireland, with Dublin being added as one of two accelerator locations by the NadiFin Fintech accelerator programme, and the National Digital Research Centre ("NDRC") expanding its activities outside Dublin to Waterford and Galway. Dublin remains the hub for fintech activities in Ireland, but other centres are seeing growth. Regional growth is a key element of national policy, and this is reflected in IFS 2025. Regionalisation is to be applied horizontally across all four pillars of the strategy.
Ireland has won an outsized share of investment in corporate innovation labs, including Citi, Mastercard, Aon, Fidelity and First Data. In artificial intelligence ("AI") and regtech, Enterprise Ireland and IDA have supported CeADAR, IC4 and GR3C, Ireland's research centres for AI, cloud computing and commerce and governance risk/compliance.
3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?
The main restriction on fintech businesses seeking to operate in Ireland would be the requirement for authorisation if the proposed activities fall within the scope of one or more of the regulatory regimes listed above.
The Central Bank has had an Innovation Hub since 2018 for fintechs operating in Ireland. This is a direct and dedicated point of contact for firms developing or implementing innovations in financial services based on new technologies. This intends to accommodate greater interaction by the Central Bank with the growing number of fintech businesses looking to set up operations in Dublin, or expand their existing operations both in the regulated and unregulated space. A number of initiatives have been undertaken by different financial institutions applying distributed ledger technology, AI and robotics, and the Central Bank is keen to engage with innovators who are operating as regulated and unregulated entities in the financial services space.
4. Other Regulatory Regimes / Non-Financial Regulation
4.1 Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?
Since 25 May 2018, the principal data protection legislation in the EU has been Regulation (EU) 2016/679 ("GDPR"), as supplemented by the Data Protection Acts 1988 to 2018 (collectively, the "DPA").
The GDPR repealed Directive 95/46/EC and has led to increased (though not total) harmonisation of data protection law across the EU Member States. Irish law-specific nuances, as permitted under the GDPR, are set out in the DPA, which also implements Directive (EU) 2016/680 ("Law Enforcement Directive").
If a fintech business is processing data, certain conditions must be met in order for that data processing to be lawful, including compliance with the data quality principles. This means that personal data may only be obtained and processed (including disclosures) for specified, explicit and legitimate purposes, must be relevant and limited to what is necessary for those purposes, and must be processed in a transparent manner and for no longer than necessary, subject to confidentiality and security obligations. There must also be a lawful basis for the processing, which will depend on whether or not the personal data in question is "special category" (which equates to personal data which is sensitive in nature).
The European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 ("ePrivacy Regulations", which implemented the EU "ePrivacy Directive") contain a further set of rules applicable to certain types of data processing, including electronic direct marketing and cookies. The ePrivacy Regulations detail the data protection standards that apply in the case of electronic communications networks (including telecommunications, internet and email networks) and address in particular, issues of security, privacy and direct marketing. Breach of the ePrivacy Regulations can result in prosecution by the Data Protection Commission. A proposed EU regulation on ePrivacy has been delayed but remains on the EU agenda.
4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?
The GDPR applies to businesses that are established in any EU Member State, and that process personal data (either as a controller or processor, and regardless of whether or not the processing takes place in the EU) in the context of that establishment.
A business that is not established in any Member State but is subject to the laws of a Member State by virtue of public international law is also subject to the GDPR.
The GDPR applies to businesses outside the EU if they (either as controller or processor) process the personal data of EU residents in relation to: (i) the offering of goods or services (whether or not in return for payment) to EU residents; or (ii) the monitoring of the behaviour of EU residents (to the extent that such behaviour takes place in the EU).
Yes, transfers of personal data outside the EEA are prohibited under the GDPR unless the transfer is made with an equivalent protection as the GDPR provides.
4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.
The data protection controller (“DPC”) (and its authorised officers) has broad powers under the DPA to enter business premises, including the right to: (i) access, search and inspect any premises where processing of personal data takes place and the documents, records, statements or other information found there; (ii) require any employees to produce any documents, records, statements or other information relating to the processing of personal data (or direct the authorised officers to where they might be located); (iii) secure for later inspection any documents, records, equipment or place in which records may be held; (iv) inspect, take extracts, make copies or remove and retain such documents and records as considered necessary; and (v) require any person referred to in (iii) above to give the authorised officer any information relating to the processing of personal data that the officer may reasonably require for performing his or her functions.
The DPC may also conduct investigations in the form of data protection audits, issue information and enforcement notices (and require the controller/processor to take certain steps specified in the enforcement notice), require the controller/processor to provide a report on any matter, and, where it considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, apply to the High Court for an order suspending, restricting or prohibiting processing.
Where a controller or processor (or any person) fails to comply with an information or enforcement notice, or obstructs or impedes, or refuses to comply with a request from, an authorised officer, it shall be guilty of an offence and liable:
(a) on summary conviction, to a fine of up to €5,000 and/or imprisonment for up to 12 months; and
(b) on indictment, to a fine of up to €250,000 and/or imprisonment for up to five years.
The DPC has a wide range of powers, including to issue warnings or reprimands for non-compliance, to order the controller to disclose a personal data breach to the data subject, to impose a permanent or temporary ban on processing, to withdraw a certification, and to impose an administrative fine (as below).
Authorisation and Advisory Powers
The DPC has a wide range of powers to advise the controller, accredit certification bodies and to authorise certificates, contractual clauses, administrative arrangements and binding corporate rules, as outlined in the GDPR.
Imposition of administrative fines for infringements of specified GDPR provisions
The GDPR provides for administrative fines, which can be up to €20 million or up to 4% of the business' worldwide annual turnover of the preceding financial year.
Non-compliance with a data protection authority
The GDPR provides for administrative fines, which can be up to €20 million or up to 4% of the business' worldwide annual turnover of the preceding financial year, whichever is higher.
4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?
The principal governing statutes in the area of cyber crime are:
- the Criminal Justice (Offences Relating to Information Systems) Act 2017;
- the Criminal Justice (Theft and Fraud Offences Act 2001;
- the DPA; and
- the ePrivacy Regulations.
These statutes create a range of criminal offences that may apply to fintech businesses operating in Ireland and, in that context, Ireland is subject to the European Arrest Warrant Framework Decision governing extradition procedures between EU Member States. An aggrieved party may seek redress through the Irish courts by way of civil remedies such as an injunction against unknown persons. In the area of payment services, the European Banking Authority introduced regulatory technical standards to protect customers and require robust customer authentication measures. These requirements are set out in the European Union (Payment Services) Regulations 2018.
Ireland's second National Cyber Security Strategy 2019-2024 aims to protect Ireland, its people and its critical infrastructure from cyber crimes and provides a mandate for the National Cyber Security Centre ("NCSC") to engage in activities to protect critical information infrastructure. In this strategy document, the government recognises the extreme dynamism in the technology sector with fresh waves of developments around virtualised networks using advanced communications protocols (such as 5G), AI and the Internet of Things. The NCSC, specifically its National Computer Security and Incident Response Team, is designated as the National Competent Authority single point of contact for the purposes of the European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018.
In December 2020, the Commission published a new EU Cybersecurity Strategy intended to bolster Europe's collective resilience against cyber threats and help ensure that all citizens and businesses fully benefit from trustworthy and reliable services and digital tools. The EU Strategy will likely influence future Irish government policy.
On 28 November 2022, the Council of the European Union adopted the Digital Operational Resilience Act ("DORA"), the final step in the legislative approval process, having been adopted by the European Parliament on 10 November 2022. DORA came into force on 16 January 2023 and will be applicable as of 17 January 2025.
DORA creates a regulatory framework on digital operational resilience whereby all EU financial entities are required to ensure they can withstand, respond to and recover from all types of ICT-related disruptions and threats. In particular, DORA:
- enhances and streamlines the financial entities' conduct of ICT risk management;
- establishes a thorough testing of ICT systems, increases supervisors' awareness of cyber risks and ICT-related incidents faced by financial entities;
- introduces powers for financial supervisors to oversee risks stemming from financial entities' dependency on ICT third-party service providers;
- creates a consistent incident reporting mechanism that will help reduce administrative burdens for financial entities; and
- strengthens supervisory effectiveness.
4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.
The AML obligations include the requirements to: carry out a business risk assessment to identify and assess the risks of money laundering and terrorist financing; carry out due diligence on customers to verify their identity; report suspicious transactions and transactions involving certain places; refrain from disclosing information that is likely to prejudice an investigation ("tipping off"); adopt internal policies, controls and procedures, including training, to prevent and detect the commission of money laundering and terrorist financing; and keep records evidencing the procedures applied.
There are also a number of special provisions applying to credit and financial institutions, including requirements to: have systems in place for the retrieval of information relating to business relationships; implement group-wide AML policies and procedures; refrain from setting up anonymous accounts for customers; and refrain from entering into a correspondent relationship with a shell bank.
The requirement to perform a customer risk assessment (distinct from the business risk assessment) applies in respect of all customers. The customer risk assessment must have regard to the business risk assessment, as well as the purpose of an account or relationship, the level of assets to be deposited, the size of transactions, the regularity of transactions or duration of the business relationship. Firms must identify customers and persons acting (or purporting to act) on behalf of the customer. This identification must be based on documents or information that it has reasonable grounds to believe are reliable. This exercise must also be carried out in relation to the beneficial owners of the customer.
Simplified customer due diligence ("CDD") may be applied where the customer presents a low risk. The basis for the decision to apply simplified CDD must be retained, and the relationship must be subject to ongoing monitoring to enable the detection of unusual or suspicious transactions.
Enhanced CDD must be applied where the customer presents a high money laundering risk. This includes customers established or residing in a high-risk third country. However, enhanced CDD does not apply to a customer that is a branch or majority-owned subsidiary of an EU-established entity that is compliant with that entity's group-wide policies and procedures. Enhanced CDD must also be applied to politically exposed persons.
The definition of "monitoring" now includes a requirement to keep customers' due diligence up to date. There is also a requirement to conduct CDD at any time where the AML risk warrants its application, including a situation where the customer's circumstances have changed.
Firms are required to examine complex or unusually large transactions or unusual patterns and to apply enhanced monitoring accordingly.
Payment service providers are required to ensure that a transfer of funds is accompanied by the following information on the payer: name of the payer; payer's payment account number; and the payer's address, official personal document number, customer identification number or date and place of birth. Payment service providers must ensure that a transfer of funds is also accompanied by the following information on the payee: name of the payee; and the payee's payment account number.
4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction (for example, AI)?
Please refer to question 3.1 above for a description of the regulatory regimes applicable to fintech businesses.
5. Accessing Talent
5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?
The primary legislation regulating employment relationships include the:
- Unfair Dismissals Acts 1977 to 2015 ("UDA");
- Employment Equality Acts 1998 to 2015;
- Redundancy Payments Acts 1967 to 2014;
- National Minimum Wage Act 2000 and the Payment of Wages Act 1991;
- Terms of Employment (Information) Acts 1994 to 2014;
- Maternity Protection Acts 1994 to 2004 and other protective leave legislation;
- Minimum Notice and Terms of Employment Acts 1973 to 2005;
- Fixed Term Workers, Part Time Employees and Agency Workers Protection Legislation;
- Organisation of Working Time Act 1997;
- European Communities (Protection of Employees on Transfer of Undertakings) Regulations 2003;
- Industrial Relations Act 1946 to 2018;
- Data Protection Acts 1988 to 2018;
- Workplace Relations Act 2015; and
- Safety, Health and Welfare at Work Acts 2005 to 2014.
An employer can, under common law, terminate an employment contract without cause, provided this is done in accordance with the terms of the contract. Notwithstanding any express contractual right to terminate, employees are afforded statutory protection against unfair or discriminatory dismissal. Under the UDA, an employer cannot lawfully dismiss an employee unless substantial grounds exist to justify termination. Also, it is essential for an employer to be able to establish that fair procedures have been followed before making a decision to dismiss. Subject to certain exceptions, employees must have at least 12 months' continuous service to qualify for protection under the UDA.
Generally, a dismissal will only be justified if it is based on one of the following grounds:
- the capability, competence or qualifications of the employee for the work concerned;
- the conduct of the employee;
- the redundancy of the employee; or
- the employee being prohibited by law from working or continuing to work (e.g. not holding a valid work permit where one is required).
If one of the above cannot be established, there must be some other substantial grounds to justify the dismissal.
Where an employee or an employer wishes to end a contract of employment, minimum periods of notice apply where an employee has been in continuous service for at least 13 weeks. The notice period to be given by an employer depends on the employee's length of service. It varies from one week, applicable where an employee has been employed for up to two years, to eight weeks' notice, applicable where an employee has been employed for 15 years and upwards. Employees, on the other hand, are only obliged to give notice of one week, irrespective of their length of service. These are, however, only the minimum periods. A contract of employment may specify a longer notice period on either side, and it generally does, with notice periods typically ranging from one to six months depending on the seniority of the role. There is no requirement to pay an employee severance in the event of a dismissal, unless it arises by reason of redundancy.
5.2 What, if any, mandatory employment benefits must be provided to staff?
All female employees have a basic entitlement to take maternity leave of 26 consecutive weeks, regardless of their length of service. This period may be extended in circumstances of premature births. There is no obligation on an employer to pay an employee on maternity leave. The employee may, however, be entitled to social welfare payments, provided she has accrued sufficient pay-related social insurance contributions. An employee is also entitled to 16 additional weeks of unpaid maternity leave. This additional leave carries no entitlement to social welfare payment.
Employees who are fathers, or partners in same-sex relationships who have newly adopted a child, are statutorily entitled to take two consecutive weeks' paternity leave. Such leave must be taken in a single block within 26 weeks of the date of birth of the child (or the date of placement in the case of adoption).
An adopting mother or sole adopting father is entitled to 24 weeks' adoptive leave. Employees availing of this leave may be entitled to receive social welfare payments, provided sufficient social insurance contributions have been paid. Employees are also entitled to additional unpaid adoptive leave for a further 16 weeks.
Parents are entitled to 18 weeks' parental leave in respect of a natural child, adopted child or child in respect of whom the employee acts in loco parentis. This leave must be taken before the child reaches eight years of age.
An employee may leave work when his or her immediate presence is indispensable due to the injury or illness of certain close relatives, including a person with whom the employee is in a relationship of domestic dependency. A person residing with the employee is taken to be in a relationship of domestic dependency with the employee if, in the event of injury or illness, one reasonably relies on the other to make arrangements for the provision of care and includes same-sex partners.
Employees are entitled to leave from their job for a period of 104 weeks in order to care for someone in need of full-time care and attention.
Under the Terms of Employment (Information) Act 1994, all employers are obliged, within two months of commencement of employment, to provide their employees with a written statement setting out certain fundamental terms of their employment, such as the date of commencement, place of employment, employer and employee details, job title and a description of the nature of the work, expiry date (if relevant), breakdown of wage calculations, annual leave and sick pay entitlements and notice requirements. The statement must be signed by both the employee and the employer. Any change to the statutory particulars must be notified to the employee, in writing, within one month.
An employer may not permit any employee to work for more than an average of 48 hours per week, over a particular reference period (usually four months). This reference period varies depending on the type of employment in question. Working time should only take account of time spent working (i.e., it should exclude rest and meal breaks). Employees cannot opt out of the 48-hour average working week. However, there is a particular exemption for senior or specialist employees, who can determine their own working time, such that they are not subject to the restriction. The contracts of such employees should expressly provide that they are exempt from the 48-hour average working week.
Generally speaking, there is no statutory entitlement to overtime under Irish law, or to payment for overtime. Employees will only be entitled to overtime pay if such an entitlement is contained in their employment contract or has been established by custom and practice in the employment concerned. However, employers that require employees to work on Sundays are required to compensate them for doing so, whether in terms of paying a "Sunday premium" or specifically taking into account the fact that they may be required to work on a Sunday in calculating the rate of pay.
Any employee has the right to join a trade union, although trade unions may not legally compel employers to recognise and negotiate with them. The degree to which trade unions may embark upon industrial action is regulated principally by the Industrial Relations Act 1990. Employee representatives are appointed by way of secret ballot.
5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?
Any EEA (i.e., the EU plus Norway, Iceland and Liechtenstein) or Swiss national may work in Ireland without the need to first obtain authorisation from the Department of Business, Enterprise and Innovation ("DBEI") or the Irish Naturalisation and Immigration Service ("INIS"). In respect of non-EEA or Swiss nationals, there are various means by which the individual may lawfully work in Ireland.
The main categories of employment permit are:
- Critical Skills Employment Permit;
- General Employment Permit; and
- Intra-Company Transfer Permit.
An employment permit will not, generally, be issued where a consequence of granting the permit would be that more than 50% of the employees in a company would be non-EEA nationals ("50:50 Rule"). IDA-supported companies may potentially avail themselves of an exception whereby the 50:50 Rule is disapplied for the first two years of that company's operation in Ireland.
Ireland is innovative among EU Member States in piloting a scheme that allows for short-term employment without requiring a formal employment permit.
The Atypical Working Scheme, which commenced in September 2013, applies to non-EEA nationals who, in certain circumstances, are required by an organisation based in the state to: undertake short-term contract work (up to 90 days) where a skill shortage has been identified; provide a specialised or high skill to an industry, business or academic institution or a researcher (in certain circumstances); and facilitate paid or funded short-term employment/internships where beneficial or necessary to the course being studied in respect of third-level students studying outside the state in approved institutions. Permit applications under the scheme are made to INIS rather than the DBEI, which processes the standard employment permits outlined above.
There is currently no indication as to how long the scheme will run or whether it will be an indefinite programme.
6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.
The main protections of innovations and inventions are described below:
Any inventive product/process is patentable under Irish law if it:
- is susceptible to industrial application;
- is new; and
- involves an inventive step.
Certain inventions are specifically excluded under Irish law, including a discovery or scientific theory, computer programs and methods of doing business. Patent protection lasts for up to 20 years from the date of the application, subject to the payment of renewal fees. Irish law also provides for the extension of full-term patents for pharmaceuticals for human or animal use for up to five years.
Irish law also provides for short-term patents, which have a 10-year duration. The test of inventiveness for a short-term patent is lower than for a full-term patent. Short-term patents may be converted to a full-term patent where they meet the requirements for a full-term patent.
A trade mark under Irish law is any sign capable of both:
- being represented graphically; and
- distinguishing the goods or services of one undertaking from those of other undertakings.
Unregistered trade marks have a limited protection in Ireland through the law of passing off, in a manner similar to that applying in other common law jurisdictions. Registered trade marks (be they national Irish marks, Madrid Protocol marks or EU trade marks) are registered initially for a 10-year period but, uniquely among IP rights, this term can be renewed indefinitely for successive 10-year terms on payment of a renewal fee. A trade mark registration will only remain valid to the extent that the mark is used by the owner in respect of the goods/services for which it was registered.
Under Irish law, a "design" is defined as the appearance of the whole or a part of a product resulting from the features of a product or its ornamentation, including the lines, contours, colour, shape, texture or materials of the product itself or its ornamentation. In order to be registerable, a design must be "new" and have "individual character". Unregistered designs are also granted a level of protection under Irish law.
The total term of protection for designs under Irish law is 25 years, renewable at five-year intervals.
An unregistered design exists for a period of three years from the date the design is first made available to the public within the EU where the disclosure could reasonably have become known to those in the sector concerned, operating within the EU.
Copyright is an IP right which features mainly in, but is not exclusive to, the cultural, arts and IT sectors. It is the legal form of protection used by the creators or authors of such works to protect the tangible form of all or part of their individual works. Irish law specifically recognises copyright in computer software as a literary work.
The duration of copyright protection varies according to the format of the work.
Irish law provides protection for both original databases and "non-original" databases where substantial investment has been incurred in obtaining, verifying or presenting the contents of the database. Original databases are those in which the contents constitute the original intellectual content of the author. The protections for databases under Irish law prevent the unlawful extraction or re-utilisation of a substantial part of the database.
Where a copyright work is included in a database, copyright shall continue in that work as well as the separate database protections.
The protection of databases under Irish law expires 15 years from the end of the calendar year in which the making of the database was completed.
Irish law provides for the protection of trade secrets. Trade secret protection is afforded without registration and can last without limitation in time, generally as long as confidentiality is maintained. In order for something to qualify as a trade secret, it must satisfy three requirements:
- the information must not generally be known or readily accessible in the relevant industry;
- the information must have commercial value because it is secret; and
- the information must be subject to reasonable steps, under the circumstances, to keep it secret.
6.2 Please briefly describe how ownership of IP operates in your jurisdiction.
Ownership of IP rights depends upon the context in which they are created. IP ownership may be registered or unregistered. IP rights created by an employee during the course of their employment will belong to the employer unless the contract of employment states otherwise. In addition, third-party contractors will own the IP rights in commissioned works unless the copyright has been assigned by written agreement to the commissioning entity.
A patent for an invention is generally owned by the inventor but may be owned by any other natural or legal person designated as the owner on the patent application or to whom the patent right is assigned. An application to record a security interest is made to the Controller, at the Intellectual Property Office of Ireland ("IPOI"), on the relevant Form of Application, which is downloadable from the IPOI website. The prescribed fee for the registration is €50 for the first patent and €6 for each additional patent on the application. This fee can be paid using a credit card by phoning the IPOI directly or by way of electronic funds transfer ("ETF").
Trade mark ownership is based on registration with the IPOI. Generally, filings of applications, notices or documents with the IPOI should be addressed to "The Controller of Patents, Designs and Trade Marks". When making a specific filing with the IPOI, the relevant legislation and IPOI guidance should be consulted to determine:
- the appropriate addressee;
- whether original documentation is required or an email is sufficient;
- the number of copies of documentation required;
- details of any fees payable; and
- any other procedural requirements that may be relevant to the particular filing.
Registered design rights are owned by the registered owner. Unregistered design rights are owned by the natural or legal personal responsible for making the products incorporating the designs available to the public.
Ownership in copyright automatically vests in the author of the copyrighted work (i.e., the author of the software); and for computer-generated works, the author is the person who undertakes the arrangements necessary for the creation of the work. There is no settled provision in Ireland on the ownership of copyright created by the use of AI technologies.
Database rights are owned by the maker of the database.
These unregistered IP rights may be owned by the legal or natural person who has developed their subject matter.
6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?
Ireland is a party to the following treaties under which owners of foreign IP rights may enforce their rights:
Patents: The Patent Cooperation Treaty 1970 ("PCT") ([Hyperlink]
The European Patent Convention ([Hyperlink] of the European Patent Office.
Trade marks: The WIPO Madrid Agreement Concerning the International Registration of Marks 1891 ([Hyperlink] and the Protocol relating to that Agreement (1989).
Paris Convention for the Protection of Industrial Property 1883 ([Hyperlink]
Design rights: The Hague Agreement Concerning the International Registration of Industrial Designs 1925 ([Hyperlink]
EU trade marks and Community design rights registered by the European Union Intellectual Property Office ("EUIPO") can be enforced in Ireland.
Copyright: The Berne Convention for the Protection of Literary and Artistic Works ([Hyperlink]
6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?
IP rights can be assigned and licensed and it is also possible for security to be taken over IP assets. Registered security generally provides the strongest rights when assigned, licensed or secured but it is also possible to take security over most forms of unregistered IP. Most secured interests would be registered with the appropriate registry in order to put third parties on notice.
Patents can be licensed, assigned and transferred under Irish law.
Trade markregistration lasts for 10 years and can be renewed indefinitely for further 10-year periods once the renewal fee is paid. Registration allows the owner, subject to certain conditions, the exclusive right to use the trade mark for the goods and/or services for which the trade mark is registered and to license its use to third parties.
Subject to certain exceptions, copyright allows the owner the exclusive right to exploit the work. Copyright may be licensed or assigned under Irish law.
The EU (Protection of Trade Secrets) Regulations 2018 transposed the EU Trade Secrets Directive into Irish law, introducing civil remedies for the unlawful use of a trade secret and restrictions on access to court hearings and documents to safeguard trade secrets in legal proceedings.
Originally published by ICLG.com
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.