Fitness and probity for a small practice: who, what, when

Fitness and probity is the Central Bank's rule that each person in a controlled function must meet three standards: competent and capable, honest and ethical, and financially sound. The firm decides who is covered and certifies them on a continuing basis. It keeps the file for at least six years after they leave the role.

What you'll learn

• The firm decides who holds a controlled function, by what the person does and not by job title.
• Giving advice to a customer is a controlled function, CF-3, and arranging a financial service for a customer is a CF-4.
• Certification is continuing: before appointment, every year, and when new facts emerge.
• The file behind each certificate is kept while the person does the role and for six years after.
• Only the 2025 Guidance is new to an adviser, and the 2026 changes add no task.

Fitness and probity rests on three standards and one duty on the firm

The Central Bank's regime was set up under the Central Bank Reform Act 2010 to protect users of financial services. It covers people in senior or customer-facing roles in regulated firms.

Each of them must be competent and capable, honest, ethical and acting with integrity, and financially sound.

The legal duty sits with the firm. The Guidance says a firm cannot let someone perform a controlled function (CF) unless three things are true:

• the firm is satisfied, on reasonable grounds, that the person meets the standards
• a certificate of compliance from the firm is in force
• the person has agreed in writing to comply

The Central Bank says its Guidance consolidates all earlier guidance for all sectors. One document now covers a practice.

The firm decides who counts, by what each person does and not by title

The Central Bank puts the decision on the firm. Guidance 2.1 says: “It is the responsibility of the firm to determine whether an individual is performing a CF role.”

The test is function, not title. Guidance 2.10 says designation depends on the functions a person performs rather than their job title.

The Central Bank's list of roles gives the wording that matters most for an advice practice:

• CF-1: “Ability to exercise a significant influence on the conduct of the affairs of a regulated financial service provider”
• CF-2: “Ensuring, controlling or monitoring compliance by a regulated financial service provider with its relevant obligations”
• CF-3: “Giving of advice to a customer of the regulated financial service provider”
• CF-4: “Arranging a financial service for a customer of the regulated financial service provider”

The Guidance calls CF-3, CF-4 and CF-8 “broad, wide-ranging roles likely to apply across all financial services sectors”.

CF-2 applies irrespective of seniority. McCann FitzGerald reads the Guidance as not reaching administrative or support staff.

Here is how that looks in practice. Take a five-person practice in Galway. This is an invented illustration, not a statement about any real practice.

Two director-owners advise and run the firm. Another adviser, a person who submits applications to providers, and an administrator make up the rest.

The owners start a list by job title and write down only the two directors. Then they redraw it by function.

The three advisers each give advice, so each is a CF-3.

The person who submits applications arranges a financial service for customers, so that is a CF-4.

Both directors are considered for CF-1 because of their influence on the firm, which is the owners' call.

The administrator does support work only, so they are not listed under CF-2. The firm still has to be satisfied of that on its own facts.

The register now shows each person's roles beside their name, built from what they do. It does not settle which pre-approval roles the directors hold, which the next section covers.

Some practices also have pre-approval roles, and legal form decides which

A pre-approval controlled function (PCF) is a CF role that needs Central Bank approval before the person starts. Which PCFs exist in a practice depends on its legal form and on who actually holds or performs the duties.

The 2026 regulations set the list by form. A body corporate has its directors and chief executive roles. In a partnership, each member except limited partners holds a pre-approval role, and so does a sole trader.

The regulations leave out certified persons under the Investment Intermediaries Act 1995. They also leave out a firm that solely carries on investment product intermediary business from the MiFID and investment business firm list.

Size matters too. The Central Bank's Guidance 2.16, in the same chapter, says a firm does not have to create a PCF role just to comply where the role did not exist before.

Guidance 2.17 adds that, depending on size or governance structure, “only one/two roles” may need pre-approval.

Approval is not certification. Guidance 5.5 says Central Bank approval of a PCF appointment “in itself, is not a certification of the individual's compliance”. The firm still has to satisfy itself and certify.

The Individual Questionnaire is a PCF form and is not part of CF certification. The regulations have to be read against a practice's own legal form, and the Galway example is only an illustration.

Fitness and probity certification is continuing, and happens at set moments

The Central Bank treats certification as a duty that never closes. The Central Bank's Guidance, at 5.13, says:

Section 21 of 2010 Act is a continuing obligation on firms. It is not a once off obligation discharged once initial due diligence has been undertaken.

The Guidance names the moments when a firm certifies:

• for all CFs, before appointment
• for a PCF, before the Individual Questionnaire is submitted
• “on an annual basis”
• where new facts emerge that may materially call fitness and probity into question
• in advance, for any new CF a person takes on

Someone with several CF roles gets one certification covering all of them. Individuals also confirm at least once a year that they know the standards and agree to keep to them.

What goes to the Central Bank is short. The Ongoing Compliance page asks for an Annual PCF Confirmation and CF Certification through the Portal, for each active CF and PCF holder.

Guidance 5.20 sets out what is sent: the firm confirms per PCF role holder, and confirms the overall process is complete for everyone else. Individual certificates are not sent in.

The submission window is not stated in what we read. The Central Bank's December 2024 news item says windows align with previous years and tells firms to ask their supervisory team, so we give no dates.

Under Guidance 5.4, a firm that cannot certify someone cannot let them perform the CF, and “must notify the Central Bank without delay”.

Sometimes a firm cannot fully confirm something, for example CPD hours not yet done but scheduled. Where it judges the gap does not affect the person's certification, it records the reason and a timeframe to fix it.

Notifiable material changes have no exhaustive list. The examples include a formal written warning or a suspension.

The file behind each certificate holds six items and is kept for at least six years

The starting point is a register. Guidance 5.7 says firms “are required to maintain a register of individuals in CF roles and the specific CF role performed by them”. It is not submitted unless the Central Bank asks, but it must be produced on request.

For each CF holder, the Guidance asks the firm to document six things:

• confirmation that the firm is satisfied the person meets the standards
• confirmation that the person has agreed to comply
• the CF role or roles held
• an outline of the parts of the firm's affairs the person will be involved in
• the steps taken in forming that view
• whether the role is outsourced to an unregulated entity

The firm also obtains a signed copy of the Appendix 3 template agreement for each person. Where a CF role is outsourced to an unregulated entity, the firm still certifies the individual.

Then there is retention. The firm keeps the information for as long as the person performs the role. The Central Bank's Guidance adds “a minimum of six years after that individual has ceased to perform the CF on behalf of the firm”.

The Central Bank can ask to see any of these records.

Only the 2025 Guidance is new to an adviser, and the 2026 changes add no task

Here is each recent change, with its date and whether it touches an adviser:

• Consolidated Standards and Guidance, Central Bank pages dated 25 November 2025. This is the current rulebook. It applies to any practice with controlled function holders.
• Annual certification of CF holders. The Certification Regulations have applied since 8 January 2024. It touches an adviser, but it is not a new task.
• The two new Head of Safeguarding roles, in operation from 10 February 2026. No effect, as they apply only to payment institutions, e-money institutions and crypto-asset service providers.
• Supplemental Guidance on prohibition notices. It took effect on 30 July 2026, according to Arthur Cox. It concerns the Central Bank's own process and adds no task for a practice.

Law firms report 20 November 2025 as the effective date, so we cite the Central Bank's own page date.

A substantive review of the PCF list is announced and pending, and McCann FitzGerald reports a new list for mid-2027. It has no effect yet. The loosened temporary officer arrangements apply to PCFs only.

Seven checks against the Central Bank's text before a practice signs off certification

Before you sign off this year's certification, check:

• Each person is listed by what they do, not job title.
• A register names every CF holder and their specific CF.
• Anyone with several CF roles has one certification covering all.
• A signed Appendix 3 agreement is on each person's file.
• Each file holds the six items, including the steps taken.
• Any outsourced CF role has still been certified by the firm.
• Records are kept while the person does the role, and six years after.

The Central Bank's text asks for a register and a file per person. Whether a practice has both is a check it can make against its own list.

We're building Kaitel with Irish advice practices, ahead of a private launch, and you can join the waitlist.

Sources

• Central Bank of Ireland, Fitness and Probity, undated page, accessed 30 October 2026
• Central Bank of Ireland, Guidance on the Standards of Fitness and Probity, Chapter 2: Population of CFs and PCFs, 25 November 2025
• Central Bank of Ireland, Guidance on the Standards of Fitness and Probity, Chapter 5: Ongoing Obligation to Comply: Certification, 25 November 2025
• Central Bank of Ireland, Guidance on the Standards of Fitness and Probity (PDF), paragraph 5.23, November 2025
• Central Bank of Ireland, Guidance on the Standards of Fitness and Probity, Appendix (CF and PCF lists), 25 November 2025
• Central Bank of Ireland, Ongoing Compliance for Regulated Financial Service Providers, undated page, accessed 30 October 2026
• Central Bank of Ireland, Fitness & Probity: News, Events and Updates, undated page with items dated September 2024, December 2024, 28 January 2026 and February 2026, accessed 30 October 2026
• Irish Statute Book, Central Bank Reform Act 2010 (Sections 20 and 22) (Amendment) Regulations 2026, S.I. No. 20 of 2026, 28 January 2026
• McCann FitzGerald, CBI reforms to Fitness & Probity: Guidance Consolidated, Expectations Clarified, 15 December 2025
• William Fry, Fitness and Probity: CP160 Central Bank publishes Feedback Statement and Revised Guidance, 26 November 2025
• Arthur Cox, Central Bank publishes Supplemental Guidance on Prohibition Notices under the Fitness and Probity Regime, 4 August 2026