The future of operational resilience is under scrutiny, and the Central Bank of Ireland's (CBI) recent assessment reveals a pivotal moment for MiFID investment firms.
The Evolution of Standards:
On January 12, 2026, the CBI unveiled its Thematic Assessment (https://www.centralbank.ie/docs/default-source/regulation/industry-market-sectors/investment-firms/mifid-firms/regulatory-requirements-and-guidance/thematic-assessment-operational-resilience-mifid-investment-firm-sector.pdf?sfvrsn=2cae6c1a_7), evaluating how MiFID firms have embraced the CBI's guidance on operational resilience for financial service providers. This assessment is a significant step in the CBI's supervisory strategy, outlined in its Regulatory and Supervisory Outlook 2025 (https://www.arthurcox.com/insights/central-bank-regulatory-supervisory-outlook-2025-banks-payment-and-e-money-firms-retail-credit-firms-investment-firms-and-securities-markets/).
The CBI defines operational resilience as the capacity of a firm, and the financial sector, to anticipate, respond, adapt, recover, and learn from operational disruptions that impact critical business services. The Guidance, first introduced in December 2021 and updated in July 2025 to align with the Digital Operational Resilience Act (DORA) (https://www.arthurcox.com/insights/operational-resilience-2-0-how-dora-is-reshaping-operational-resilience-in-ireland/), aims to fortify operational resilience across the sector.
Assessment Objectives:
The CBI's assessment had two primary goals: (i) to verify the existence of operational resilience frameworks that meet the Guidance's standards, and (ii) to ensure that firm boards and senior management are accountable for the design and effectiveness of these frameworks and strategies.
Findings:
The CBI's assessment revealed both strengths and areas for improvement. Many MiFID firms demonstrated operational resilience frameworks aligned with the Guidance and CBI's expectations. Boards typically held ultimate responsibility, delegating to committees and senior management. Regular management reporting and challenges at the board and senior management levels were also observed as good practices.
However, the CBI identified several areas for enhancement:
- Identification of Critical Services: Ensuring accurate identification of critical business services.
- Mapping of Service Delivery: Improving the granularity of mapping exercises to better identify vulnerabilities and prepare remediation plans.
- Scenario Testing: Enhancing the level of detail and range of scenarios considered.
- Risk Management Alignment: Aligning operational resilience with existing risk management frameworks, as an evolution of operational risk and business continuity management.
The Path Forward:
Moving forward, the CBI expects all MiFID firms and their leadership to re-evaluate their compliance with the Guidance, including the DORA updates from July 2025. The CBI emphasizes the following guidelines:
- Guideline 4: Firms must identify critical business services.
- Guideline 7: Understanding and mapping the delivery of critical services is essential.
- Guideline 8: Third-party dependencies should be captured in the mapping process.
While the assessment didn't explicitly focus on DORA or cyber/digital resilience, the CBI underscores their importance. With technology advancing rapidly and threats becoming more sophisticated, the CBI will intensify its supervisory efforts in these areas in 2026-2027. Firms are encouraged to bolster their operational resilience, especially in cyber and digital domains, to effectively recover from disruptions while minimizing customer impact.
Expert Assistance:
Arthur Cox's team is well-equipped to guide regulated firms through operational resilience and cybersecurity challenges, offering expertise in aligning with regulatory requirements. Firms seeking to enhance their operational resilience frameworks in response to the CBI's expectations are invited to reach out for tailored support.
