LWEX Exchange- Central Bank of Ireland Issues Warning on Unauthorised Firm

For compliance teams this is a familiar but important reminder that public warnings are a leading indicator of supervisory focus, and that the CBI expects firms to have controls capable of detecting when clients, counterparties or staff interact with unauthorised operators. What this means in practice: Irish-authorised firms and those passporting into Ireland should treat the warning as a trigger to refresh onboarding and ongoing due diligence checks, particularly where crypto exposure, payment flows or investment referrals are involved. Firms with crypto-asset service provider relationships should confirm the authorisation status of each counterparty against the CBI register before onboarding or renewing, and should document that verification.

Actions we would prioritise: (1) screen client and counterparty lists against the latest CBI unauthorised firm notices; (2) check that marketing, distribution and introducer arrangements do not inadvertently funnel clients to unauthorised providers; (3) refresh staff awareness of impersonation and clone-firm risk; (4) ensure suspicious activity and fraud escalation routes capture crypto-related incidents; and (5) retain evidence of checks for supervisory or audit review. No new rule applies here, so implementation effort is low, but the reputational and conduct risk of an unmanaged exposure is not. Firms should also watch for secondary risk, including cloned websites, payment instructions and social media promotions referencing the named entity.

Treat public warnings as a standing intelligence feed rather than a one-off event.