This morning we will engage with the National Treasury Management Agency, NTMA, to examine its financial statements for 2024. On behalf of the committee, I welcome Mr. Frank O'Connor, chief executive; Mr. Ian Black, chief financial and operating officer; Ms Rebekah Brady, interim director of the Ireland Strategic Investment Fund and director of Future Ireland Fund; and Mr. Ciarán Breen, director of the State Claims Agency. We are also joined by officials from the Department of Finance, who are attending in a representative capacity: Mr. Pat Leahy, principal officer and Mr. Oisín Fitzgerald, administrative officer. Finally, we are joined by officials from the Office of the Comptroller and Auditor General, including the Comptroller and Auditor General, Mr. Seamus McCarthy, who is a permanent witness to the committee, and Mr. Leonard McKeown, deputy director of audit.

Before we begin, I will explain some limitations to parliamentary privilege and the practice of the Houses as regards references witnesses may make to other persons in their evidence. The evidence of witnesses physically present or who give evidence from within the parliamentary precincts is protected, pursuant to both the Constitution and statute, by absolute privilege. This means they have an absolute defence against any defamation action for anything they say at the meeting. Witnesses are, however, expected not to abuse this privilege and it is my duty as Cathaoirleach to ensure that this privilege is not abused. Therefore, if witnesses' statements are potentially defamatory in relation to an identifiable person or entity, they will be directed to discontinue their remarks. It is imperative that they comply with any such direction.

Witnesses are also reminded of the long-standing parliamentary practice that they should not criticise or make charges against any person or entity by name or in such a way as to make him, her or it identifiable, or otherwise engage in speech that might be regarded as damaging to the good name of the person or entity.

I call the Comptroller and Auditor General, Mr. Seamus McCarthy, to make his opening statement.

The National Treasury Management Agency was established in 1990 to manage Ireland's national debt. Since then, it has evolved into a complex multifunction agency managing public assets and liabilities and providing staff and business service supports to some other statutory agencies.

Reflecting its structure and remit, the agency's financial statements are also complex, with segments reflecting transactions related to individual functions. This approach to reporting aids transparency and public accountability in respect of the various functions. To save the committee's time this morning, I do not propose to itemise each of the accounts. Instead, I will draw attention to salient issues that arise from my report on the agency's 2024 accounts, which I am statutorily required to produce, and which are before the committee this morning.

The agency's operating costs are reported upon in the administration account. Net expenditure incurred by the agency in 2024 totalled €145 million. This included expenses totalling just over €51 million incurred in respect of the National Asset Management Agency, NAMA, the Strategic Banking Corporation of Ireland, SBCI, and Home Building Finance Ireland, which are supported operationally by the NTMA. Agency staffing of around 830 whole-time equivalents at the end of 2024 included staff seconded to the three supported bodies.

On the income side, the agency recovers its expenses from the supported agencies and from some of the investment funds it manages. It draws on the Central Fund of the Exchequer to cover the remainder of its costs. In 2024, the agency's Central Fund income totalled €77.2 million.

The NTMA's primary function is to borrow on behalf of the Minister for Finance and to manage Ireland's national debt. At the end of 2024, the national debt stood at €232.6 billion, down marginally from €234.5 billion at the end of 2023. Net debt service costs in 2024 were €3.1 billion. Central government bodies and funds and local authorities routinely lend funds that are not immediately required to the NTMA as a means of managing their cash balances. This constitutes a significant and growing part of the NTMA's short-term borrowing, and amounted to €19.3 billion at end 2024.

The NTMA also engages in lending operations, including of surplus Exchequer cash balances. At the end of 2024, this included €14.9 billion lent short-term to other governments and €5.3 billion in lending to support the operations of the Housing Finance Agency.

The State Claims Agency, which is part of the NTMA, manages legal claims brought against the State and designated State bodies. It also has a risk management role, advising and assisting State bodies in minimising their claims exposures. In addition, it manages legal and other costs liabilities incurred by the State arising from all categories of litigation, including tribunals of inquiry. The 2024 financial statements of the agency record expenditure totalling €534 million, which was subsequently recovered by the agency from the liable State bodies. Of this total, awards and claims settlements amounted to €292 million, while associated expenses totalled €229 million. The State Claims Agency incurred costs of €35 million in respect of its own operating costs, which are accounted for in the NTMA's administration accounts, and represent a charge on the Central Fund. The agency's estimate of the value of claims liabilities outstanding at the end of 2024 was €5.35 billion. Some €4.3 billion of this relates to healthcare claims.

The NTMA also manages a number of substantial statutory investment funds. In July 2024, the agency was assigned two new statutory investment funds to manage. At the end of 2024, the net assets of the new funds comprised €8.45 billion in the Future Ireland Fund and just over €2 billion in the Infrastructure, Climate and Nature Fund. The former National Surplus (Exceptional Contingencies) Fund was dissolved in November 2024 after the transfer of its assets to the two new funds.

Separately, the accounts of the Ireland Strategic Investment Fund indicate it held around €16.6 billion at the end of 2024, segmented into a "directed" portfolio held at the direction of the Minister for Finance, and a "discretionary" portfolio available for commercial investment. Between 2015 and 2024, the net asset value of the directed investment portfolio fell from €14 billion invested in bank shareholdings to €7.7 billion held mainly in the form of cash and cash equivalents. The drop in net asset value of the fund was due mostly to the sale of bank shareholdings and the transfer of the associated sales proceeds to the Exchequer.

In July 2025, the NTMA received a fraudulent request for an apparent €5 million tranche of investment into the account of an existing Ireland Strategic Investment Fund investee company. The existing NTMA controls intended to prevent such fraudulent requests did not prevent the payment being made. The NTMA reported the matter to An Garda Síochána and is seeking to recover the funds. The chief executive officer will be able to update the committee in that regard.

Finally, the committee may wish to note that the audits of the agency's 2025 accounts were completed two weeks ago, on 29 April 2026, and will be presented in due course.

I thank Mr. McCarthy for that. I invite the chief executive, Mr. O'Connor, to deliver the opening statement on behalf of the NTMA. As I set out in the letter of invitation, he has five minutes to make his opening address.

I thank the Chair and members of the committee for the invitation to appear today.

I would like to briefly take the committee through the agency's work, and how it has evolved from a single-function agency managing debt to an organisation of significantly increased scale and diversity that borrows, invests, advises and compensates on behalf of the State.

At the agency's inception 35 years ago, we managed a national debt that stood at approximately €30 billion. That was seen as high then, but today it is over €200 billion, and by the 2030s will potentially be approaching €250 billion. While the population and the size of the economy have grown since then, it is still a very high level of indebtedness. That level of debt carries risk. It is not something that we, as debt managers, can afford to be complacent about. The ability to service that debt is critical.

The record low interest rates that arose from quantitative easing in recent years made servicing debt easier and cheaper. Our invitation today was to discuss our 2024 accounts. The annual cost of servicing debt in 2024 was €3.2 billion, some 60% below its peak of €8 billion in 2013. We took advantage of the low interest rate era by locking in low borrowing costs for long terms. We built a debt profile that has one of the longest average maturities in Europe. In addition, we prefunded by borrowing money early at low rates instead of waiting to borrow at higher rates, but that era is over. The benefits of borrowing at low fixed rates will recede, as these lower cost debts gradually mature and are replaced with more expensive debt. We also have to be prepared for rates potentially rising further and the additional costs that would come with that.

Funding and debt management is just one of the responsibilities entrusted to us over the NTMA's lifetime. Our multiple mandates have seen the NTMA take on a wide range of diverse activities. As part of our wider debt portfolio of over €200 billion, we manage €24 billion of retail savings through Ireland State Savings. We invest approximately €30 billion across three sovereign funds – the Irish Strategic Investment Fund, the Future Ireland Fund and the Infrastructure, Climate and Nature Fund, each with its own specialist mandate.

Through the National Development Finance Agency, we provide project delivery, advisory services and contract management services to State authorities on public infrastructure projects. Through NewERA, we provide corporate finance expertise to Ministers and Departments in relation to 24 commercial State bodies across a range of sectors.

Through the State Claims Agency, we manage over 10,000 claims, with an estimated total liability of over €5 billion, compensating people where they or their families have suffered injuries or losses arising from clinical incidents or other factors. In doing this we strive to get the balance right between managing the State's liability in accordance with our statutory mandate and managing claims in a manner that treats people fairly, ethically and sensitively.

We provide a platform for supporting three affiliates – NAMA, the Strategic Banking Corporation of Ireland and Home Building Finance Ireland, all of which have separate governance and reporting structures but rely on the NTMA for support services. In the case of NAMA, we have provided that support throughout the 16 years of its existence and are now preparing to take on its residual activity through the proposed NTMA resolution unit.

Developing this scale and diversity has required us to place a significant focus on agility and adaptability; and on being ready to take on new mandates whenever the need arises, including specialist, high-value and time-bound projects like the Apple Ireland escrow fund and the pandemic stabilisation and recovery fund.

I also want to provide an update to the committee today on the incident that took place in 2025 in which the agency received a fraudulent payment request from a third party that was designed and timed to pass as a legitimate request from an ISIF investee. Our focus since this happened has been on three things: getting money back, establishing the facts of what happened and increasing our protection against similar financial crime risks. On recovering money, we previously disclosed the recovery of an initial €1.52 million of the €5 million stolen in the incident. I can disclose today that we have since recovered more money, bringing the total net recovery to €2.5 million. We are continuing our recovery efforts.

In terms of establishing the facts of what happened, as we said at the time of the incident, there was no compromise of the NTMA's IT systems. However, we commissioned Deloitte to conduct an independent forensic investigation to establish the facts and to examine relevant internal controls. That work is now complete. We also engaged from the outset with the Comptroller and Auditor General on the issue.

To increase our protection against similar financial crime risks, as one would expect, we put in place enhanced controls immediately after the incident. Deloitte's investigation also recommended certain key measures to increase protection against similar financial crime risks, which we have implemented in full.

Finally, I would like to conclude with some comments on the long-term approach we take in carrying out our mandates. in terms of both managing the debt we issue and the assets we invest. We have a long track record of issuing debt with maturities of many decades and planning for that debt maturing over time and falling due for repayment. The Future Ireland Fund, which is being invested with a long-term horizon of 2041 and beyond, is another example of taking a long-term approach. That ability to take a long-term view, on both sides of Ireland's balance sheet, is resonating with the investors that buy Ireland's debt and with ratings agencies. Many of them cite this strong long-term approach as a major strength that demonstrates Ireland's commitment to prudently managing debt and to putting money from today aside for the future, to enhance the resilience of our economy and our public finances. This approach sends out a positive signal that adds to the confidence that investors show in Ireland. It generates a reputational return as well as a financial one. That concludes my opening remarks.

I thank Mr. O'Connor for that. I will open up the floor to members. The lead speaker is Deputy Farrelly, who has 15 minutes, while all other members have ten minutes. If time permits, we will allow members back in for a short supplementary round of questions. We will also suspend the meeting at about 12.30 p.m. for a short break of ten or 15 minutes and resume thereafter.

I thank Mr. O'Connor and his colleagues very much for being here this morning. They are most welcome. I will dive right in if that is okay because of the limited time. In 2024, the State Claims Agency paid settlements, awards and expenses totalling €521 million. What percentage of this figure was paid in out-of-court settlements?

I might pass the question to Ciarán.

Roughly 59% of the total portfolio of cases are settled outside of court – without going to court at all or any proceedings taking place.

Is that due to an internal decision being made or is it based on legal advice?

Yes. As the cases develop, we take legal advice from barristers, just like plaintiffs would. They reach a point where both sides decide that they would engage in negotiations and settle the cases, often through mediation or just generally by way of meeting, for example, at the Law Library.

Has the 59% level been a trend over the past five years or has there been an increase in that approach?

No, it is pretty much level. If we look back over the last couple of years, that kind of figure is pretty much the mean.

What was the sum for out-of-court settlements in 2024?

I have not broken it down that way. I just have the total amount of settlements from all sources. At a later stage I can get that information to the Deputy if he likes.

Yes, please. Some 59% of €521 million would probably be around €260 million or maybe €270 million. Would that be fair enough?

Yes.

Is Mr. Breen saying that has been pretty consistent over the last five years? There has not been a change in approach.

Not really, no, except that mediation is much more a feature of what we do than it used to be. Over that five years we have seen mediation increase. For example, prior to the pandemic we paid damages following mediation in about 5% of clinical cases and we are at about 46% now.

What would Mr. Breen put that change down to?

Pre-pandemic, there was probably a lack of willingness on the part of plaintiffs to engage with mediation. It just was not popular. During the pandemic, when people could not meet, we organised remote mediations because we felt the system should not stop and that people should be compensated. We offered it as an alternative. Very quickly that caught on with plaintiffs' solicitors, so post-pandemic it has become much more a feature of what we do.

Is it seen as a more attractive approach for plaintiffs or potentially a more lucrative approach? Is settling ultimately altering the sum of the mean?

No, definitely not. The settlements agreed at mediation are similar to settlements agreed under any other guise. What it does offer is an environment in which both sides can work through a mediator.

If an apology has to be given, an apology is given in that process. It is a gentler, easier process. It is not as fraught as, for example, the steps of the court.

Sure. I thank Mr. Breen. I will ask specifically with regard to current and serving and also former Air Corps members. How many outstanding cases are open within the State Claims Agency regarding current or former Air Corps members?

Originally, we had 11 of those claims. We settled one claim. Following that claim, we received 13 more. Therefore, we have 24 cases now.

Are they at various stages of process? When would the earliest of those 20 have been opened?

In the case we settled, for example, my recollection is that proceedings were served in 2014 and the case was settled in 2025. The other cases are at different levels of engagement and readiness and so on.

Would there be others from that 2014 era?

I guess many of them would probably date back to that date and maybe dates after that.

In Mr. Breen's expertise, why would a case to be ongoing that long?

When I answer this, I am not being critical at all of, obviously, when I say this but sometimes a plaintiff is in a very complex action like that because we are dealing with exposure to chemicals and generally an environment that alleges toxicity. Therefore, there are complex issues of liability and causation for both sides. If we add in discovery to that as well, we can see why we would get delays of, certainly, a good number of years. In the particular case that we settled, there were periods of relative inactivity. When I say that, I just mean legally. I am quite sure there was a lot of work being done in the background.

Maybe it is not as simple as asking in whose court the ball lies for those cases, but does Mr. Breen think that would be with the State Claims Agency right now or would it be with the plaintiffs?

When a plaintiff sues, really, the ball lies largely with the plaintiff, but we do not rely on that. What we try to do, wherever we can, if we acknowledge that the State has a liability, is try to make an approach ourselves and ask, if both sides are ready, whether we can settle this case on terms that are acceptable to both parties.

What is the figure then for settlements expenses for 2025?

The Deputy might bear with me for one second. For both schemes, that is, the clinical indemnity scheme and general indemnity scheme, it was €445 million.

That is a significant reduction from €521 million from 2024. Is that correct?

In 2024, the similar sum was €461 million, so it has come down slightly for 2025. That is updating the Deputy with the 2025 figures.

Are we similar in terms of that 59% settlement? Is Mr. Breen saying we are on track for a similar case?

Exactly.

For both of those years, is that figure totally inclusive of all legal fees?

That is inclusive of all costs, including legal fees and expert costs. That is transactional. When I give the Deputy those figures, that means that in that particular year, it is not only in relation to damages that we paid in individual cases and legal costs. It is also costs associated with the ongoing management of cases.

I thank Mr. Breen. I have a question with regard to ISIF. It was announced in December 2025 that ISIF was committing €150 million to Avenue Capital Group. Who is Avenue Capital Group?

Avenue Capital Group is a UK-based fund manager that is at the minute one of the primary suppliers of funding to Castlehaven. The original rationale for ISIF's investment was to provide a source of funding into the Irish market for homebuilding.

Could Ms Brady take me through it in very basic terms? We commit €150 million - is that a loan or an investment? What is that in simple terms?

From ISIF's perspective in general, we commit in lots of different ways but predominantly via funds as the way to bring external capital into it as well and amplify the capital available in the Irish market. With respect to homebuilding, we have had a number of significant initiatives over the last while. There have been well-discussed issues, particularly on the equity side and the debt side as well for Irish homebuilders. We have worked with a number of different partners to find ways to get money into the Irish market on a commercial basis for ISIF that will have both that commercial return plus the economic impact and, in this case, it is to do with house building.

What would Ms Brady be expecting to return for that €150 million?

I am sorry; for each individual fund, there are expected returns that on a risk-adjusted basis determine whether we are comfortable making the investment or not. Given that this is a private entity and there are other investors involved, from our perspective, we take positions that are commensurate with the risks to which the funds are exposed.

So, what does ISIF expect to-----

We do not give out expected return numbers for any of our investments, but it is part of our due diligence process. The returns come through on an annual basis in the financial accounts. Our returns are then published when they all return back.

ISIF gives €150 million to Avenue Capital Group and then, with that money, it is telling Avenue Capital Group to go and build houses and apartments in Ireland.

In this particular case, the funding is provided on into homebuilders, so they are not actually building the houses themselves.

Correct. Then, the question that I ask is, are we running into state aid problems here whereby we are using State money to go towards homebuilders when we also have Home Building Finance Ireland, which is an entity owned solely by the Minister for Finance? Are we potentially in breach or putting question marks over state aid investment in the private market?

How ISIF approaches investing for every single investment that we make is that we get a state aid view and analysis so that we do not breach our legislation from a state aid perspective. There are numerous sources and providers of funding into homebuilding in Ireland, most or all of which are needed at this point in time. ISIF's role is as a commercial investor, so it is slightly different. The second part of our role is to crowd in third-party capital as well to amplify what is available but to the state aid point, in particular, to every investment we make-----

Ms Brady is confident there is no-----

-----we have a state aid analysis conducted.

If I am being too simplistic Ms Brady should please tell me, but is Avenue Capital Group simply not just a middleman we do not need in this kind of environment where that €150 million could go directly towards building schemes in Ireland through the other entity?

The way that ISIF has approached investment, again, to bring in that third-party capital as well is through this fund structure. We do it across all them. Homebuilding is one example but for credit and private equity, we tend to take this approach in that it kind of brings in the expertise that is needed to oversee whether it is loans or investments that are being made where we would be constrained from a resource perspective and the deployment of the level of capital that we have. Therefore, by using fund managers who are expert in whatever field it is that they are investing into, it is the most efficient way to get the capital out and get third-party capital in.

I thank Ms Brady very much. In the time that I have, with the €5 million that was fraudulently taken from the organisation last year, how much of that does Mr. O'Connor expect to ultimately recoup?

The update today was to confirm the €2.5 million net. Obviously, it is getting trickier the more time passes by because of action taken in the early days. When I appeared before the committee the first time, we had €1.52 million back. The Deputy might ask whether we would get any more but, in fact, we continue to chase and we can confirm that some came in this year through that process, so we are not giving up on it. However, through the passage of time, it will get trickier. The work we have done has helped get that return. It may take longer for the criminal investigation to go on and on and maybe it could be later that something comes in at the tail end. I do not want to set expectations too high, but we will continue to-----

Is Mr. O'Connor not expecting to see that figure rising in the short-term?

Not in the next short while, but we have not given up yet.

Had the audit and risk committee flagged this as a potential concern in advance of this activity happening? Have there ever been worries that this could take place?

There are always worries, I suppose, given the nature of what we do and the volume. As we said at the committee last summer, in some years, we do more than half a trillion in payments, so we are very active and we are also a target. The approach to risk is to first identify the risk, then try to mitigate it and put the controls in place. There are many controls between resources, systems and so on. We then test those through a third line of defence and audit that. We have regular audits across the organisation to try to test for that.

Potential fraud would be in all our risk registers, and we are always trying to keep pace with what is happening. Unfortunately, the controls at this juncture did not stand up to the threat actors, who managed to gather non-public information - quite a bit. That is a struggle, but yes, it would be on the risk registers. We try to mitigate that and make sure it does not happen, but, of course, it has on this occasion.

I am not going to ask Mr. O'Connor to spell out the detail of it, because we do not want to put that out there. Is it an isolated incident, from Mr. O’Connor's perspective? Has this happened in the last five years, or is this the only time it has happened?

No, not in terms of a fraud. The agency is 35 years old. I have been in the agency for 16 years. Events happen, but as to a fraud of this significance, no, not in the last five years. I am not even aware of any particular monetary fraud, thankfully. We hope to keep it that way. The intention is to design our systems and try to keep pace with what threat actors can do.

Does the NTMA accept all of the recommendations from the Deloitte report? Does it intend to action those?

To give a short description, yes, we accepted them, and we have implemented them all. To be perfectly honest, it will not surprise the Deputy that the controls we put in immediately after an incident were very similar to some of the recommendations, and then it is about bottoming out the two suites of it. We probably went beyond that. You have to get into a state where you can get on with the business. As I said, we have many payments. We are now back into the steady state, but we have to stay vigilant.

I thank the witnesses for being here. I am very conscious of the work the NTMA does and the level of complexity that it involves. Managing the country's national debt, ISIF and the State Claims Agency are three really important, difficult jobs. I appreciate the work that the NTMA is doing because it is a very important job. It is behind the scenes, it is not seen, and it probably does not get celebrated enough for the serious importance that it has.

With that, I want to start by talking about the national debt. Mr. O’Connor can correct me if I am wrong, but it is currently sitting at approximately €230 billion.

Yes, we can call it national debt or gross debt, but that is approximately it.

The biggest risk facing our country in terms of unexpected expenditure is the management of interest rate risk. Can Mr. O’Connor tell me the debt profile that the NTMA is currently carrying? How much of the debt is on a fixed interest rate or on a floating rate? Can Mr. O’Connor explain what would happen if rates went up 1% or 2%? How much would that cost the country? How much of a runway does the NTMA have in front of it? I understand that it did very well to reduce the debt cost from €8 billion to €3.4 billion. That is fantastic because it allows us to spend the money on public services for people. How much runway does the NTMA have here?

I thank the Deputy for his comments. As a debt manager, not surprisingly, I want to say that we never want to become complacent, but there is some good news in the statistics, and then there is the cautionary tale. The good news is that Ireland's debt has fallen in the last few years, and from a debt ratio point of view, we are in good shape. To give an example, Ireland went from low 20% debt to GDP to 120% at the time of the crisis, and it is back in the mid-30s. However, we all know that GDP flatters Ireland, so we need to use GNI*. That went to 163% at the top of the crisis, but it is back to 60%. From a debt ratio perspective, there are many countries in Europe that would like to be in our position. That is the first point.

Second, in terms of exposure to interest rates, the good news is that the entire portfolio is effectively fixed, like a fixed-rate mortgage. When we borrow, we borrow fixed.

How long are those notes?

The average life of our debt is about ten years, which is one of the longest in Europe - that is the average. Yesterday, we tapped an old 20-year bond at 17 years - the green bond - and we raised €2 billion. We issued debt in 30-year bonds last year during the low rates. We issued our first 30-year bond in 2015. We went to the market again during Covid, when rates were even lower for 30-year bonds. We issued some 100-year notes in the background, probably over €2 billion, which people did not see when we were asked in those times for €100 million or €200 million. The good news is that it is fixed. If you borrow on short-term markets for short-term cash buffers and so on, that means repricing more often, but predominantly, we are not even doing that at the moment because we took a cautionary approach. The majority of the debt is fixed, just to tell the Deputy that.

What does that mean? I will come to the Deputy's example. It means that while our interest bill continues to climb, it is only going to go up gradually, and we have said this for many years. By the time it comes to 2030-----

Unless the State were to borrow a huge amount of money at a high rate to handle some sort of a crisis, we are not going to see the national debt cost, and the service cost of that, rising any time soon.

Yes, what we have bought is time. We will see a gradual increase. For example, the average rate on the debt at the moment is 1.5%.

From Mr. O’Connor's perspective, does he believe that we still have too much debt, or is he happy with the level of debt that is currently there?

The Oireachtas decides the level of debt in terms of running a budget surplus or a budget deficit. There are two messages. One is that we are in a very good position. We have bought the State time. During Covid, we were in a better position, and the State was able to borrow to respond. What I would say to the Deputy is that it buys time. The rates will gradually increase. Even though we borrowed at 3.64% yesterday, that is the highest we have borrowed at for that amount of money since 2013. That is a reminder that rates are going up, but that will only move the interest dial a little bit over the next while because we have more than €200 billion. That is very important.

I want to move on to the next issue. This really shocked me. It concerns the €5 million payment that was made by the NTMA to somebody who was a potential investment recipient. Can Mr. O’Connor explain whether the NTMA has established the facts of what happened there?

Yes.

Okay. Can Mr. O’Connor share any of the detail with us?

I will share some of the detail, notwithstanding a criminal investigation and our efforts at recovery, plus we do not want to give threat actors every step of our process. However, I will explain. Obviously, on this occasion, the standard of our controls did not meet this, and the payment was released. The additional information from the last time is that our investee company had a breach of its email systems. It had a breach. It was compromised. It is called business email compromise. That allowed a threat actor to be in that email for a period of time and then send, from a valid email to us, a valid instruction for capital. At each step of our process, as people asked questions, naturally, they had enough information to persuade us.

How did the NTMA uncover that the money had gone to the wrong person?

Here is another very important part. The people involved in the payment process, and one of the employees - I do not want to identify anybody because we all know who is in payments and in ISIF - discovered the next day, in conversation, that the capital had not gone to the investee company. The important thing is that the minute they saw that, they told us, because if they did not, our ability to go and follow the money - the Deputy can imagine how fast the money got moved - would have been reduced.

How does the NTMA even go about recovering 50% of the money? I know it has recovered €2.5 million and is hoping to recover more. This is a really scary incident. While this was €5 million, which is a huge sum of money, the NTMA, ISIF and other entities are dealing in much bigger sums. What would happen if something bigger were to go wrong? Is Mr. O’Connor confident that something like this will not happen again? My concern, when I heard this story, was that it had to be an inside job. Somebody had to have known. How did they intercept this? I would be curious as to how the hell this happened. Is Mr. O’Connor confident that something like this will not happen again? How did the NTMA recover the €2.5 million, and how does it plan to recover the next €2.5 million?

The Deputy has asked a few questions there. First, in terms of being confident about anything in life and giving a guarantee that nothing could ever happen again, that is nigh on impossible. What I can do is highlight our response to it, the controls we have and the controls we have implemented, but we have to stay vigilant. That is on the first piece.

On the ability to recover it, the staff spotting the mistake and saying "There is a problem here" was sufficient. Obviously, the Deputy will respect that I cannot get into a lot of detail on the recovery. As to what we did, we make a lot of payments around the world. We have a lot of counterparts. We have a lot of people we can-----

I am going to finish on this topic. Can Mr. O’Connor confirm that it was the case that the NTMA got scammed, and it was not that the NTMA was complicit in this?

I was going to come to that. It will not surprise anybody here that, when we got Deloitte in to look at the facts of what happened and the controls and process we had, they had to check - not that we suspected it - but they had to check forensically whether anybody in the NTMA colluded in it or did something deliberate or whatever. I can categorically say that is not the case, and we-----

It is vitally important that it comes out of here today that it was not somebody internally who caused this. However, it is critically important that the NTMA ensures it does not get caught by something like this again. Regarding the controls procedure to verify, if a payment request was received from a person to whom a payment had never been made before, surely somebody would have rung the investee to confirm the payment request or to check the details for such a large payment. If I got an email looking for an invoice for €5 million out of my entity, I would not just pay it to a new person. Had that investee received money previously?

Yes, the year before.

So there were different bank details?

That is right.

How did that not get picked up?

Because the request came from a legitimate email. It is not unusual, when there is a relationship over years with an investee, that they would look for different bank details.

For large amounts of money, if I want to send money to somebody, I have to use the card reader and I have to verify the account I am sending it to. How did the money get sent to an account that was not verified within the NTMA's system?

Because of the process over and back to the investing company. We had what they call a man in the middle that had a valid email coming over and back. One of the failures is a further independent check of that process.

No, that is a sickener because to have got done like that is just unfortunate. My last question is to the State Claims Agency. In 2024, it spent €229 million on legal fees and witnesses. Is that correct?

The €229 million was in respect of damages, legal costs and associated costs.

Okay. I was under the impression that the €229 million was on legal fees and expert witnesses. Is that correct, C and AG?

Sorry?

Do I have that wrong? What was the total bill for legal expenses and witness expenses for 2024 in the State Claims Agency?

I think the figure I gave was €229 million. Yes, €229 million is the associated expenses-----

Okay. Can I just ask-----

-----and €292 million are the compensation payments.

How much did the legal advice paid for by the State Claims Agency reduce the liability to the State? If €229 million was spent on legal advice, how much did the outstanding liability to the State go down?

We must bear in mind that the amounts we are paying are paid not just in respect of our own legal costs, but also in respect of the plaintiff's legal costs. It is extremely hard to judge exactly and to be able to give the Deputy a figure and say it is 20% or 30%. The reality is that cases are complex, large sums are sought and there are agreements. Ultimately, what we are there to do is to ensure that claims are settled at the lowest achievable level. That is what we endeavour to do every day in all the claims work we transact, and I hope we are doing that. Very often, we get, for example, requests for €30 million or €35 million that we settle for probably €10 million and so on.

I thank the witnesses for coming in to answer our questions. I intended today to talk about the State Claims Agency, but I just want to touch on the invoice supplier fraud. We know that this, like as has been described, is really common across the SME industry. I am a solicitor and it is something that I am very familiar with in any organisation making and receiving payments. A simple step for anyone who has a small business, or any business, is to verbally confirm new bank details, if possible. I know it is an old-fashioned step, and earlier we were discussing that sometimes going back to an old-fashioned way is actually the best way, especially when huge sums of money, like €5 million, are involved. It is a matter of picking up the phone to someone you know to check bank details. That is really a message to business owners around the country and it is to be hoped people will be more aware of invoice supplier fraud. It is shocking that our national treasury was a victim. It is a rookie mistake. It is something small organisations have been on the ball with, definitely in the past decade. For anyone making or receiving payments, it has been on our radar. I am shocked but it is a lesson for everyone who is interested and watching it to beware of invoice supplier fraud, especially in an organisation making or receiving payments.

Today I want to talk about the State Claims Agency. I want to raise concerns regarding the handling and sharing of highly sensitive personal and medical information in the context of anticipated litigation involving vulnerable children and families. Following the findings of the Data Protection Commission, DPC, against the Department of Health arising from the autism dossiers controversy, there remains considerable public concern about how information is gathered, shared and retained across the State system. Given the enormous level of State exposure in catastrophic maternity and cerebral palsy claims, it is important to establish clearly what role the State Claims Agency plays in the requesting, receipt and use of such information and whether lessons arising from the DPC findings against the Department of Health have been learned. Did the State Claims Agency request any of the information that later became the subject of the Data Protection Commission findings against the Department of Health in relation to these maternal cases?

No.

Did the agency provide guidance, templates or categories of information sought from the Department of Health, HSE or hospitals in relation to anticipated litigation?

No.

At what stage does the State Claims Agency become aware of potential catastrophic maternity or asphyxiation claims? A lot of the time, it might be known a claim may be in the offing if a family puts in, for example, a subject access request for a file for a child or for a mother. At that stage does the State Claims Agency become aware?

No, not necessarily. There have been many occasions where a mother, in relation to an infant who has suffered, for example, a medical negligence injury, would request her records and they would be supplied directly by the hospital to the person, so we would not know.

In cases where there is no solicitor and no pre-litigation correspondence and a family submits a subject access request, is there any case where the hospital might inform the State Claims Agency?

Mostly they do not because, for example, a person could be looking for the records for many different reasons unrelated to litigation. When we would get involved, normally it would be a letter of claim.

Okay. Has the agency ever received information before proceedings were formally issued in any case?

We have what is called the national incident management system. I do not know if the Deputy is aware of it but effectively it allows every State authority - the HSE, An Garda Síochána, the Prison Service, etc. - to notify us of adverse events. Therefore, on the clinical side, we would be notified by a hospital of adverse events. One of those adverse events might be, for example, suspected cerebral palsy or catastrophic injury or whatever. State authorities are under an obligation to tell us about their adverse events.

Can the State Claims agency look into this register of adverse events at any stage? Is that how it would work?

We have to examine it and that is part of all that we do. For example, our risk management teams look at incident surveillance to inform what they are going to do on the risk side in terms of risk prevention.

Has there ever been a request from the State Claims Agency to ensure that better information is submitted from the Department of Health into this register?

It is the HSE largely; it is not the Department. We are working with all of the hospitals, and one of the things we done recently is the electronic point of entry. This allows somebody in a ward to advise of an adverse event so that we become aware of it. As I say, this goes back to the Act, that they are statutorily obliged to do that.

A lot of information, I presume, can be recorded, not just the adverse event, or does it just stick to the adverse event?

Yes, it is very much the adverse event. We get notified of something serious that may have happened. If we feel there is a requirement to do so, it allows us to follow up with the hospital or State authority concerned.

Is there ever any information submitted on the portal that is over and above what is required?

No, it follows a particular format. If someone is notifying an adverse event, there are preset screens which have to be filled out.

Do families know that their event has been put onto the portal?

I honestly do not know. I guess that in many instances hospitals say it under open disclosure. We also have to notify this to the State Claims Agency.

I have never heard of a family being told that.

They may not be. I do not know, factually, what happens in hospitals.

Has Mr. Breen's agency had any involvement with the DPC on the sharing of information from the Department of Health in relation to those?

No.

On prize bonds and State savings, I will address Mr. O'Connor. When people are administering estates, for instance, there may be historic prize bonds or State savings accounts. There is sometimes difficulty finding out exactly how much is involved, particularly when the certificates are missing or the holdings are historical. Many of us, when we were born, would have received a prize bond worth £5 or whatever. What system does the NTMA currently use to maintain records of prize bond and State savings holders? Is that system fully digitised?

Prize bonds date back to 1957. Since 1989, An Post and Fexco in Killorglin have looked after prize bonds for the State. In recent years, we have tried to digitise the entire State savings platform. If you sign up for it, you can see your fixed-rate products and prize bonds, check for winnings, etc. The Deputy is right about cases involved the deceased. Many people write in following the loss of a parent, etc. I had personal experience of this. It is a regular occurrence that they write in through solicitors or whatever to say where the person lived their entire life, their name and maiden name, and the guys will go through that to try to discover details on the person.

Is that a digitalised system they are going through or are they going through paper files?

I want to be careful here. It is a while since I was involved in managing State savings, even before we went digital. All the prize bond numbers, etc., have been digitised, but whether people have signed up, perhaps there are some of those-----

I am talking about old ones where people have not signed up and they are just waving around-----

All the records are there, and they do not go dormant. If you write to the prize bond company-----

As a solicitor, I find that if you do not have the documents, it is sometimes more difficult. They seem to be struggling to get information back to people.

That is fair. One of the tricky things there, as I am sure the Deputy knows, is to establish the accuracy of who is writing. If people have not interacted in ten or 20 years, they probably have no anti-money laundering document that is up to date. They must get accuracy. People have similar names in Ireland. Over the years, when people send out information on prize bonds or State savings and a family member gets it or it goes to another address, that is never an easy-----

With dormant accounts or dormant prize bonds, what happens to the funds?

Prize bonds do not become dormant. Bank accounts over 15 years-----

There might be some prize bonds from the foundation of the State that have not been activated. What happens in that situation after, say, 100 years?

They are in the funding of the State but they are an obligation of the State any time anybody claims them.

Is it realistic that we have a dormant prize bond after 100 years?

I can come back to the Deputy with the exact detail. Dormant accounts go dormant after 15 years. You can go to your bank. Many dormant accounts are claimed quite quickly afterwards. For prize bonds, there are even winnings that have not been claimed. When somebody wins, we write to them and then write again six months later and put articles in the newspapers to say that there are winnings. The easiest thing, if anybody wants to write in and give all their details and please-----

Should the State recoup them after a certain period? Would that be sensible to put in legislation?

It is people's money; it is not the State's money. It is the same with dormant accounts. People can come for dormant-----

Should we have a period after which the money is-----

There will be lots of opinions, but I do not think so. It is citizens' money rather than the State's money. It is on our balance sheet and we need to mind it.

I wanted to ask about AIB but I will leave it till the end. Thank you very much.

Thank you, Deputy.

I thank the witnesses for coming in. Will someone explain what is the NTMA's direct link with NAMA? NAMA is coming in here in a few weeks. What is the witnesses' link with or responsibility for NAMA now?

NAMA is one of our affiliates. It was set up many years ago. We call it an affiliate because NAMA has its own board. It has its own chair, CEO and board members. The chair of the NTMA sits as an ex officio on the NAMA board, which I do and my predecessor did. NAMA staff are NTMA staff. That is the support we provide to it. That includes all staff that have been through NAMA and the number that are left.

Will some of the key NAMA staff be coming back into the NTMA?

Once NAMA has been dissolved, the NTMA resolution unit has been established. I might get Mr. Black to comment, because it is going in under his area. He was recently at the committee for the pre-legislative scrutiny. There will be eight people from NAMA coming to run the resolution unit.

What is the salary of the CEO of NAMA?

The salary of the CEO of NAMA is published in its accounts because he is an Accounting Officer. I think it is €430,000.

What job will he have?

Mr. McDonagh, as he said at one of the committees, will return to the NTMA. He will not be part of the resolution unit. He is an NTMA employee and has been since way before NAMA. He will return, obviously not as chief executive, but as a senior experienced executive.

That is a lot of money to be paying someone who is not going to be a senior executive.

When he is not the Accounting Officer, Mr. McDonagh will come back to an individual contract in the NTMA.

So will he have a lower salary.

I will not talk about individual staff members - not Mr. McDonagh or any of the other 800.

They are all paid State employees. Mr. O'Connor just referenced the salary.

Yes.

So he does not know, is the answer. It is not fully clear.

I am not in a position to comment. We have obligations as an employer to individuals.

Mr. O'Connor referenced his salary, so he has no problem referencing the salary. It is public information, no doubt. Just for clarity, we do not know the position. We do not know what salary he will be coming back in on, is what Mr. O'Connor is saying. That is fine. I do not mind. We are not clear on that. How many salaries will be above that of a Cabinet Minister? What is the salary of a Cabinet Minister? Is it €250,000? How many salaries would be above that?

We can get the Deputy the figures from the 2024 annual report. In line with the code of practice for Government bodies, we publish a table of the ranges of all salaries in the annual report. It is on page 76, if the Deputy has the 2024 report, or we can confirm it. The table is there. Over €400,000, there is only myself, the chief executive.

I said over €250,000

Eight.

Eight people earn more than that amount. Okay. That is a lot of people. Are they paid bonuses?

If there is any performance-related pay, it is in that number. It is included on top of the salary in that number. There is also information on the total amount paid in bonuses, the highest bonus, the lowest, the average and the gender split.

Do most staff receive bonuses?

About 33%.

That is fine. To change pace, does the NTMA have oversight of individual ISIF investments?

Yes.

How many of those ISIF investments are underperforming?

We have a red-amber-green approach to every individual investment. We have over 250 individual line items and each has its own expected returns and risk parameters and economic-----

So that is 250 different investments, is it?

Different line items, yes. Some of them could be funds and some could be direct investments.

How many of them are in the red?

The benchmark we use is when less than 15% of them are in the red. At the minute, it is under 15%. That is the benchmark we use internally.

What does orange denote?

For each investment, prior to investment, we have an expected return. Orange is if they are at any point at less than 50% of that expected return. They are not necessarily in the red, under water or worth less than the money we put in.

Orange is still not performing in line with expectations. How many are at orange?

Sorry, it is orange and red that are at less than 15%.

Okay. So the NTMA is happy enough that 85% are in line with expectations.

We would prefer them all to be in line with expectations.

I know but 85% is not a bad hit rate. Has the NTMA ever questioned any of ISIF's individual investments?

Yes, all of them all the time.

No, I mean from a morality point of view or as to whether it should invest. Does the NTMA have a role in checking what its funds are investing in?

We do.

If it is investing in an area or country the NTMA is not happy with, does the NTMA have a role in that?

If it is with a product or company it is not happy with, does the NTMA have oversight of that?

Before we go into every investment, we run a role-----

I know, but I am talking about the NTMA into ISIF.

From the perspective of ISIF, yes, the investment-----

I know ISIF does, but what about from the NTMA into ISIF? I just want to clarity.

That is no problem. In terms of the governance structure, ISIF is part of the NTMA; it is one of the mandates of the NTMA. Under Statute, there is an investment committee for ISIF. It is a subcommittee of the board that reports to the agency board, and certain decisions have a scale that can go beyond the investment committee and up to the board. ISIF sits within the NTMA; it is part of the NTMA structure.

Mr. O'Connor is saying it is in NTMA oversight.

Yes.

That is fine; I just wanted to check. I want to jump into the payments. There was one question I did not hear being answered. Who authorised the payment of the €5 million?

It will not surprise the Deputy that there are obviously several people involved in the process and a segregation of duties, but I will not go into any individual person, or name or identify any person.

Is there even a role?

There are several people.

Even just the physical payment.

The payment was done through SWIFT. It was an electronic payment, so it would have gone through several individuals.

How many individuals? I have authorised tonnes of payments myself.

It would have gone through around six people.

Six different people authorised the payment.

Yes, at various stages.

Was it done as part of a batch of payments or was it a one-off payment?

No, that was an individual payment.

One individual payment of €5 million was authorised by six individual people at different times.

There are different control checks doing different jobs.

It failed six controls. It went through six individual checkpoints.

It went through the process and, yes, it was not stopped. As I said, we have enhanced our controls-----

No, I get that. I am just asking about the process, that is all. There were six different people, where the payment would have been put up, authorised and gone through six different times, but nobody went in and checked if it was right.

People checked it, but again, it was not effective.

They did not check it properly.

There are many steps, and I suppose the Deputy is right and that is part of the problem. We did not stop it, and that is on us, but one of the problems was the compromise of the investee in having substantial non-public information to be able to answer questions and make everything look like a legitimate capital call. However, it did go through our process, and we failed to stop it.

Has this happened before?

No.

No.

It has never happened before. What do the witnesses think made this one so different? I am sure they have had similar situations.

Mr. Black might be able to talk on that in a minute. There may have been a payment in another part of the business, for example, to a solicitor. I am not trying to say there has not been anything, but there has been nothing on the scale of a fraud or payment like this. What was different this time was the amount of information the threat actor had in order to be able to persuade and get past each of the steps.

Is that because he had been involved with the NTMA before?

No, I do not know who the threat actor is. The investee was compromised, so whoever the threat actor was got non-public information and sent instruction to us from a valid email account.

Essentially, the NTMA was compromised because someone else was compromised.

Exactly.

The NTMA is obviously at risk then from people who have access to all its clients.

We all face cyber risk in different jurisdictions, but the onus is on us and our side because you can try managing it and everything else-----

You can control your staff, but you cannot control somebody else's.

Absolutely.

Obviously, it is an external risk that becomes very internal.

Yes, exactly.

Changing things again, and going back to corporation tax, on the management of our national funds, how does the NTMA feel about the corporation tax and the money we are getting in, and how would it model into the future in the short-term, if there was a variance with that?

Obviously, there has been much written about the corporation tax - the size of it, the growth of it and the concentration. The economics unit of the Department of Finance - I know there are colleagues here - does a lot of modelling. They often talk about some of it being transitory, hence the reason why the Government has decided to put some of that surplus away for the future.

The message I was given is to remember not to lose the corporate memory of the past, and make sure we do not leave ourselves exposed. I do not know if the Department wants to comment, but much of that analysis is done by the Department.

I have one last question. The witness said there is a national debt of €250 billion. Who is the majority of that owed to? Is it independent funds? Where are those funds based, in broad strokes, and is there any national government that has any significant part of that?

That is a great question, Deputy. To clarify, the current debt is just over €200 billion and has been declining. If you look at the forecast, in the 2030s it may reach a quarter of a trillion. The vocabulary changes from billion to trillion, which is an important checkpoint for everybody to remember, but it is not €250 billion at present. That is the first piece. In fact, our net debt position is stronger, because we have several assets that qualify there.

As regards who owns it, the only time you get sight of who buys your debt, generally, is around syndications. We had a syndicate tap a €2 billion yesterday, and you get to see broadly who buys it, bar when they publicly declare. Yesterday's deal is a very good example of who buys. Almost 40% of yesterday's transaction was bought by bank treasuries, mostly around Europe. We had official institutions like central banks around the world buying about 13% or 15%. You also had asset managers and pension funds around the world buying our debt, so that is the kind of broad swathe. Hedge funds are another participant in the market. They might have got two or three. They might bid for lots, but they got 2% or 3% of the transaction. It is that broad swathe of where there are pockets of capital, such as central banks, bank treasuries, pension funds, asset managers, fund managers, etc.

By the way, to the Deputy's first question he asked regarding where all the money comes from, over 90% of our debt is funded from people around the world, which is why that very open economy of Ireland-----

Is there any risk that China, for example, could control a significant amount of debt? Would the NTMA even know?

It would be very hard to establish, but-----

Basically, you would not know.

-----I can tell the Deputy that from what I have seen through all the transactions, and I have been in the NTMA for 16 years, when we do get to see, it is a broad swathe. We are very highly regarded. We borrow 20 basis points, 0.2% over Germany, and are double A-rated, so there is a very strong universe of holders of Irish debt.

I welcome everybody here today. Following on from Deputy Neville's questioning on wages and staffing, it seems to be a fantastic place to work when there are so many staff on such high salaries. Would I be correct in saying the salaries the witnesses are paid are much higher than civil servants in most other parts of Government?

Looking at the data, the NTMA was set up 35 years ago and was designed to be a market-based private sector model to get people in to manage the asset liabilities of the State, so, yes, you would say that.

Does Mr. O'Connor think that is fair?

I do, and the reason is other people set up the agency on that basis. When you look at the scale of what is managed in the NTMA, in going to the market, funding that over €200 billion, doing it in a prudent way and managing the assets of the State, you need the talent in the room. When you are talking to asset and fund managers, you need to have people on both sides of the table who know what they are doing.

We have people doing payments - and we failed on this one payment - and we have people doing derivative transactions who need to know which side of the button to press on the FX, which currency we are trading in and all those different aspects. We need to have people of the appropriate skill and experience to do those jobs. The second thing is to get those people who are competing against the banks, law firms and engineering firms, etc., so, yes, I do.

It sounds like a very good salary to me. In that regard, there were 270 personnel within the company who also received €2.5 million last year in State-related bonuses. Am I correct in saying that is all coming from Government funding?

Absolutely. Regarding performance-related pay, again, that is another aspect of the pay models and other tools. It is non-pensionable performance-related pay and is common in the marketplace. We are probably a little different in that we publish the amounts and, generally, the average would be about €9,000 or €10,000 to about a third of the staff.

The one thing is we tend to disperse to more staff because all parts - the front and middle office - are important. Rather than pay large amounts to some people who might appear big, as the industry does, because it might incentivise the wrong risk-taking behaviour, we tend to disperse to between 30% and 40% of staff.

I am interested in the State Claims Agency and the duty of care to those who have been wounded by Government policy, such as thalidomide sufferers, those with hepatitis C and now the Air Corps.

Is it the policy that staff get pay-related bonuses to help ensure that the State Claims Agency fights these cases every single step of the way and to try to break down plaintiffs and get them to withdraw their claims?

Before I ask Ciarán to comment on the cases and the management of claims, to be very clear, performance-related pay is set on an agency-wide basis. It is not set for one business unit over another. The approach would never be to pay performance-related pay for a specific item to incentivise somebody to do a particular-----

What do they get the pay-related bonus for?

The pay-related bonus depends on the performance of the individual in their overall duties and the performance of their business area in the wider NTMA.

Is Mr. O'Connor telling me it has nothing to do with claims?

People in the State Claims Agency are one cohort, who also get-----

They are getting pay-related bonuses for ensuring claims do not go through. Is that not the case?

No, not that. It is for the performance of their duty overall to fulfil their mandate. They are not incentivised to do one specific thing over another. They must always do the job to the best of their ability.

The State Claims Agency failed to spot chemical exposure of Air Corps personnel, even though it did health and safety audits from 2006 until 2026. Am I correct in saying that? It failed to see that, and that there was no adequate PPE.

Maybe I can answer that because I am the director of the State Claims Agency. Our risk management team, comprising scientists, engineers and people qualified in environmental and fire safety, did carry out audits in Baldonnel in 2006 and 2007-----

They failed to see, however, that the staff were not wearing PPE.

I ask the Deputy to just bear with me for a minute as I want to explain. The particular area that is the impugned area was called the old engine repair flight workshop. By the time we carried out our audits in Baldonnel, that had been demolished or it was disused. I think it was disused in 2006 and demolished in 2007 so it was never, in fact, inspected by our risk management people. They could not have been aware of any issues with that particular workshop at the time.

Were there no certificates of compliance from 2006?

I might just explain to the Deputy what we do. Our risk management is to advise and assist State authorities. One of the things that we are most conscious about doing is to ensure that somewhere like the Air Corps, Navy or Army – just looking at them as a group – has in place safety performance management. That is what we do. We do some audits.

When the team investigated this, however, was there safety performance management in place?

Yes.

It was in place.

Yes, when we went there in 2006 and 2007, we absolutely made sure that such performance management systems were in place, and they were. By the way, we did carry out spot audits of various parts of Baldonnel. Very often we commented negatively on things that we found.