#
MiCA Title V conduct-of-business rules - complaints-handling, custody-outsourcing prohibition, ESMA register-verification guidance, and ESMA's marketing-accuracy expectation - are fully in force with active ESMA supervisory reinforcement.
ESMA has reinforced these baseline obligations with consumer-facing guidance advising that consumers verify a firm's authorisation status via the ESMA Interim MiCA Register before investing or transferring funds, and clarifying that MiCA protections attach only to the specific authorised legal entity rather than to an affiliated group as a whole - a distinction with practical significance given that several large crypto groups operate multiple entities across EEA jurisdictions. ESMA has also, at lower Probable confidence and resting on a single trade-press source, voiced concern about forum-shopping and about CASPs' marketing of their regulatory status being potentially misleading; this reflects a general supervisory expectation of accuracy in how authorisation status is portrayed, though it has not yet crystallised into enforcement action documented in this cycle's sourcing.
All four claims in this module carry an 'in force' status, and the module's trajectory is assessed as stable, with no Irish-specific carve-out or gap identified this cycle. The general pattern here mirrors the licensing and stablecoin modules: consumer protection substance is set almost entirely at EU level, with the Central Bank of Ireland's role being one of applying rather than varying the underlying rules.
Outlook
Continued stability is expected for this module absent a change to MiCA Title V text or a new ESMA guideline. The area most likely to generate a dated finding in a future cycle is enforcement: a specific supervisory or enforcement action addressing marketing-accuracy or complaints-handling failures at an Irish-authorised CASP would elevate the currently Probable-confidence marketing-accuracy finding to a Confirmed one and would be a natural focus for the next research pass.
Consumer Protection
The Central Bank of Ireland confirmed on 12 October 2026 that it implements the European Securities and Markets Authority's guidelines specifying the supervisory practices that national competent authorities must apply to prevent and detect insider dealing, unlawful disclosure and market manipulation involving crypto-assets, under the Markets in Crypto-Assets Regulation. This is a direct, primary publication from the Central Bank itself, confirming the highest available confidence level for the consumer-protection finding, and it extends Ireland's crypto-asset supervisory framework beyond authorisation and prudential requirements into the market-conduct and market-integrity dimension.
Separately, this cycle also confirms the operation of the Markets in Crypto-Assets Regulation's client-fund-protection requirement: where a crypto-asset service provider receives client funds, the Regulation requires those funds to be placed with a central bank or credit institution by the end of the next business day, unless the funds are used for the relevant crypto-asset transaction itself. This custody and segregation requirement is a direct-effect, European Union-wide obligation under Article 70 of the Regulation, applying to all authorised crypto-asset service providers operating in or from Ireland, and it sits alongside the market-abuse guidelines as a second pillar of consumer and client protection within the crypto-asset licensing regime.
These two findings together describe a consumer-protection architecture built on two distinct mechanisms: a market-integrity mechanism, aimed at preventing insider dealing, unlawful disclosure and market manipulation, now reinforced by confirmed national implementation of European Securities and Markets Authority supervisory guidelines; and a client-asset-protection mechanism, aimed at ensuring client funds received by crypto-asset service providers are not left exposed to undue risk, through the next-business-day placement requirement. Both mechanisms derive directly from the Markets in Crypto-Assets Regulation rather than from any Ireland-specific supplementary statute, consistent with the Regulation's status as a directly applicable European Union instrument.
No specific consumer complaint, market-abuse case, or client-fund-protection breach involving a named Irish-authorised crypto-asset service provider was identified; the findings here concern the confirmed state of the supervisory and regulatory framework itself rather than any individual case arising under it.
Outlook
The practical test of the Central Bank's confirmed market-abuse guideline implementation will come when it is next applied to an identified case involving an Irish-authorised crypto-asset service provider; no such case was identified. The client-fund custody and segregation requirement under Article 70 of the Markets in Crypto-Assets Regulation remains a standing obligation for all authorised firms, and any future breach of the next-business-day placement requirement would be a clear candidate for future consumer-protection findings in this jurisdiction.
2 earlier distinct update(s)
Consumer Protection
The Central Bank of Ireland has published consumer warning notices concerning unauthorised crypto-asset service providers operating in or targeting the Irish market. These notices sit alongside the CBI's role as sole MiCA National Competent Authority and its live CASP register, giving Irish consumers and counterparties a way to distinguish authorised from unauthorised providers, and giving the CBI a public enforcement-adjacent tool short of formal enforcement action.
The practical significance of these warnings is tied directly to the licensing architecture: with twelve firms holding MiCA CASP authorisation as of 21 August 2026 and a hard transitional cutoff of 30 December 2025 for prior VASP-registered firms, any provider still operating in Ireland without CASP authorisation or a valid EEA passport falls outside the authorised perimeter and is a candidate for the kind of warning notice the CBI has issued. This is a general MiCA consumer-protection scaffold combined with a confirmed, active CBI warning-notice practice, rather than a novel Irish-specific consumer-protection regime.
Outlook
Watch for whether the CBI's warning-notice practice escalates toward named enforcement action against specific unauthorised providers, which would be the next evidentiary step beyond a general warning notice, and would sharpen the picture of how actively the CBI polices the boundary between authorised and unauthorised crypto-asset activity in the Irish market.
Consumer Protection
The Central Bank of Ireland has amended the Minimum Competency Code 2017 to incorporate ESMA's MiCA knowledge-and-competence guidelines for CASP staff, with the amendments having taken effect on 28 July 2026 — confirmed, high-confidence intelligence from a Tier-2 legal-commentary source describing a binding domestic supervisory instrument. Critically, no grandfathering relief is available for staff newly providing crypto-asset information or advice after that date; only staff already active in such roles as of 28 July 2026 benefit from a one-year, FTE-experience-based transitional arrangement. This creates a hard compliance requirement for CASPs staffing crypto-advisory functions in Ireland, with no exemption pathway for new hires into those roles after the effective date.
Outlook
CASPs operating in Ireland should track their staffing plans against the now-passed 28 July 2026 effective date, since any new crypto-advisory hire made after that date needs to meet the full ESMA MiCA knowledge-and-competence standard with no transitional relief available.
Sources and findings (10)
- Unsourcedsource not recorded — CBI Minimum Competency Code amendments effective 28 July 2026.
- Unsourcedsource not recorded — No grandfathering for staff newly entering crypto-advisory roles after 28 July 2026.
- Unsourcedsource not recorded — CBI Minimum Competency Code amendments effective 28 July 2026.
- Unsourcedsource not recorded — No grandfathering for staff newly entering crypto-advisory roles after 28 July 2026.
- T1 · Official Journal of the European Union / EUR-LexMiCA Article 71 complaints-handling requirement — MiCA-authorised CASPs in Ireland must establish and maintain effective complaints-handling procedures for clients.retrieved M3bindingin force
- T1 · ESMAMiCA custody-outsourcing prohibition — CASPs from outsourcing or delegating custody services to entities that are not themselves authorised as CASPs, reinforcing client-asset segregation and safeguarding expectations.retrieved M4bindingin force
- T1 · ESMAESMA consumer-protection guidance (MiCA register verification) — the ESMA Interim MiCA Register before investing or transferring funds; MiCA protections apply only to the specific authorised legal entity, not affiliated group companies.retrieved M3bindingin force
- T4 · The BlockESMA marketing-accuracy supervisory expectation — forum-shopping and misleading portrayals of MiCA authorisation status, reflecting a supervisory expectation that CASPs' marketing of their regulatory status be accurate and not misleading.retrieved M3bindingin force
- T1CASPs providing custody — MiCA Art 75 requires segregation of client crypto-assets, a custody policy and register of positions; sub-custody delegation limited to CASPs authorised for custody (Art 75(9)).retrieved M4bindingin force
- T1MiCA Title VI — Crypto-specific market-abuse regime (insider dealing, unlawful disclosure, market manipulation) applicable EU-wide, including crypto-assets admitted to trading via Irish-authorised CASPs.retrieved M3bindingin force