Consumer Protection Code 2025: What Firms Must Do

If you run compliance at a firm the Central Bank of Ireland regulates, this guide gives you the Consumer Protection Code 2025 in the order you will use it: whether a customer counts as a consumer, which rules bind your type of firm, the complaint and error clocks your files will be tested against, the board reporting it puts on your calendar, and what changed from the 2012 Code. Payment and e-money institutions get a section of their own, because Regulation 9 switches off much of the Code for them, and none of the 14 ranking guides we read in full explains how. Every rule below is cited to its regulation number and checked against the Central Bank's consolidated text, which includes the 2026 amendment.

What is the Consumer Protection Code 2025?

The Code is the Central Bank of Ireland's rulebook for how regulated firms treat consumers in Ireland. Since 24 March 2026 it lives in two statutory instruments with different legal bases and different scopes, so the first job is knowing which one a rule comes from.

The Standards for Business Regulations, S.I. No. 80 of 2025, are made under section 17A of the Central Bank Reform Act 2010. Regulation 4(1) sets nine standards a firm must meet at all times, and Regulations 5 to 13 spell each one out as supporting standards. They reach beyond conduct into governance, resources and risk management, and most of them apply to a firm's business with every customer, large corporates included.

The Consumer Protection Regulations, S.I. No. 81 of 2025, are made under section 48 of the Central Bank (Supervision and Enforcement) Act 2013 and hold the detailed rules: 420 regulations in six Parts. Part 1 sets definitions and scope. Part 2 holds the cross-sectoral rules in 15 chapters, from knowing the consumer to complaints and records. Parts 3, 4 and 5 add rules for banking and credit, insurance and investments, and Part 6 deals with revocations and enforcement. These rules apply to business done with consumers.

The Regulations also absorbed four older instruments: the 2012 Code, the Code of Conduct on Mortgage Arrears (now Part 3, Chapter 9), the Licensed Moneylenders Regulations 2020 and the Insurance Requirements Regulations 2022. The Central Bank publishes a mapping tool that shows where each old provision went, which is the fastest way to update a policy library written against the 2012 numbering.

Three guidance documents sit alongside: the General Guidance on the Consumer Protection Code (March 2026, last updated September 2026), the Guidance on Securing Customers' Interests and the Guidance on Protecting Consumers in Vulnerable Circumstances. The Central Bank also asks firms to read them with its 2017 Guide to Consumer Protection Risk Assessment, which describes the risk framework its supervisors expect to find. Inspectors use the guidance to judge whether the Regulations are met, so treat a gap against it as a likely finding.

When did the Consumer Protection Code 2025 take effect?

The Central Bank published the Code on 24 March 2025 with a 12 month implementation period. Both regulations came into operation on 24 March 2026 (Regulation 1(2) of each), and the 2012 Code was revoked from the same day. The new Code replaced it in full. A few rules look forward only: the 12 month retention of records about offers that were not taken up does not apply to records made before commencement (Regulation 117(4)), and the consent rule for automatically renewing pet, travel, gadget and dental insurance applies to policies first entered into after commencement (Regulation 327(2)).

One amendment has followed. S.I. No. 111 of 2026 took effect on 25 March 2026 and made five targeted changes: it clarified the rules for services regulated under MiCAR, amended the definition of a working day, adjusted the rule on calling potential or former customers in Regulation 110(1)(d), added an exemption on early redemption charge information in Regulation 136, and corrected the numbering of Regulation 371(1). The Central Bank's HTML edition of the Regulations already includes them, so work from that edition; the 2025 PDF on the Irish Statute Book predates the amendment.

Guidance has kept moving as well. The General Guidance was updated in September 2026 with a note in the complaints section on the Consumer Rights Act 2022 and the Consumer Credit Act 1995 for hire-purchase and consumer hire. The Central Bank's Consumer Protection Code FAQ, which it updates as questions come in, records answers from a webinar on informing effectively held on 29 July 2026, and says new EU directives, such as the second Distance Marketing Directive and the second Consumer Credit Directive, will reach the Code through further amending regulations.

Distance selling changed in the same year. Directive (EU) 2023/2673 applies from 19 June 2026, and Ireland transposed it by S.I. No. 309 of 2026, made on 30 June 2026. It inserts the distance contract rules for financial services into the Consumer Rights Act 2022, including an online cancellation function labelled "cancel contract here" or in similarly unambiguous words, and revokes the 2004 Distance Marketing Regulations. The Code's own definitions still refer to the 2004 Regulations, so check which text your procedures cite.

Which firms does the Consumer Protection Code apply to?

Regulation 3(1) applies the Consumer Protection Regulations to the regulated activities of regulated entities operating in the State. A regulated entity is any financial services provider authorised, registered or licensed by the Central Bank, or by another EU or EEA state, that provides regulated activities in Ireland, so firms passporting in by branch or on a cross-border basis are covered for their Irish consumers (General Guidance 1.2.4). The General Guidance lists the firm types: credit institutions, insurance undertakings, investment business firms and investment intermediaries under the Investment Intermediaries Act 1995, insurance and mortgage intermediaries, payment institutions, e-money institutions, retail credit and home reversion firms, debt management firms, credit servicing firms, crowdfunding service providers, credit purchasers, firms providing MiCAR services, and credit unions when acting as insurance intermediaries.

Regulation 15 takes three things out completely: services provided to persons outside the State, MiFID services listed in Schedule 1 of the MiFID Regulations 2017 (apart from firms exempt under Regulation 4(3) of those Regulations), and reinsurance business. Regulation 7 limits credit unions to their insurance intermediary activity, and the Central Bank's FAQ confirms that credit intermediaries authorised by the CCPC are not regulated entities, so the Regulations do not apply to them.

For many firms the decisive rules are Regulations 4 to 14, which restrict the Code for particular activities. Some list the only provisions that apply; others switch named provisions off.

The Standards for Business have a scope of their own. Regulation 2(2) of S.I. No. 80 of 2025 excludes MiFID services, credit union activities other than insurance intermediation, crowdfunding service providers and reinsurance business. The Central Bank still expects MiFID firms to consider its securing customers' interests and vulnerability guidance when meeting their duty to act in clients' best interests, although it does not expect them to apply the trusted contact person and training requirements (General Guidance 1.2.3 and footnote 5).

Who counts as a consumer under the Code?

Most of the Consumer Protection Regulations protect only consumers, so the definition in Regulation 2(1) decides how much of the Code applies to a given relationship. A consumer is a customer that is a natural person; a group of natural persons, such as a partnership, club, charity, trust or other unincorporated body; or an incorporated body, unless its annual turnover in the previous financial year was above €5 million or it belongs to a group with combined turnover above €5 million. The 2012 Code drew both lines at €3 million, so more small companies are now consumers.

Two narrower terms matter. A personal consumer is a natural person acting outside their business, trade or profession; rules such as the trusted contact person and the reporting of financial abuse concerns are limited to personal consumers. A consumer in vulnerable circumstances is a natural person whose personal circumstances, permanent or temporary, make them especially susceptible to harm, particularly where a firm does not act with appropriate care.

"Customer" is wider: anyone to whom a firm provides or offers financial services, including potential and former customers. That is the reach of most Standards for Business, which apply to all customers except four provisions limited to consumers: Regulation 4(1)(a) and its supporting standard in Regulation 5 (securing customers' interests), and Regulation 4(1)(f) and Regulation 10 (financial abuse). Regulation 116 requires firms to identify their consumers in their records, which is easiest if the consumer test is a field on the customer record from onboarding.

Which parts of the Code apply to payment and e-money institutions?

Regulation 9(1) says that where a regulated entity is providing payment services or issuing electronic money, only the listed provisions apply, in addition to Part 1 and Part 6. Everything else in Part 2, and nearly all of Parts 3 to 5, falls away for that business. The list, with what each provision covers:

Regulation 9(2) adds four qualifications. Regulation 10 removes Chapter 12 and Regulation 115(1)(m) for a firm that provides only account information services. Regulations 97(2) and 98(3) say the error refund duties apply without prejudice to Part 4 of the European Union (Payment Services) Regulations 2018, the rights and obligations of payment service users. And Regulation 105(5) disapplies three complaint steps for a firm providing payment services: the 20 working day updates, the 40 working day target and the notice when that target is missed. For payment service complaints, Article 101(2) of PSD2 sets the clock instead: a reply within 15 business days, or in exceptional situations a holding reply and a final reply within 35 business days. Our guide to PSD2 compliance requirements sets out the rest of that regime.

Two consequences are easy to miss. First, Chapter 5 (informing effectively) is not on the list, yet the Standards for Business apply to payment and e-money firms in full, so Regulation 4(1)(e) and the informing effectively supporting standard in Regulation 9 of S.I. No. 80 still bind every customer communication. Second, the joint account warnings in Regulation 127 technically do not reach payment accounts, but the Central Bank "strongly encourages" the same disclosure for joint current accounts (General Guidance 3.11.3 and 3.11.4). The operational resilience duties that sit beside these conduct rules are covered in DORA for payment institutions, and the 2026 Head of Safeguarding role for payment and e-money institutions in our guide to fitness and probity at the Central Bank of Ireland.

What are the nine Standards for Business?

Regulation 4(1) of S.I. No. 80 of 2025 sets the standards. A regulated entity must at all times:

Regulation 14 then requires systems and controls, processes, policies and procedures to ensure the firm, and any agent acting for it under an outsourcing arrangement, complies. Regulation 13 deserves a careful read by whoever owns regulatory correspondence: it requires prompt disclosure to the Central Bank of any matter it would reasonably expect notice of, including a suspected offence or prescribed contravention, legal proceedings arising from financial services obligations, anything that may interfere significantly with the firm's operation or compliance, and a decision to stop providing a type of financial service.

The General Guidance (section 1.5) describes the Standards for Business as the counterbalance to the Conduct Standards that the Individual Accountability Framework imposes on individuals. It also notes that the reasonable steps concept, which applies to individuals' conduct standards, was deliberately left out of the securing customers' interests standard. A firm's duty is judged on what it achieved for customers, and the people who run it answer separately under the Individual Accountability Framework.

What does securing customers' interests mean in practice?

Regulation 5 lists the ways a firm secures its customers' interests. In summary, it must:

• make sure its culture, strategy, business model, decision-making, systems, controls, policies and procedures take customers' interests into account;
• act in line with customers' reasonable expectations;
• consider customers' interests when it designs services and the ways they are delivered;
• not design services to exploit customers' behaviours, habits, preferences or biases unfairly to their detriment;
• resolve complaints, and errors and mistakes, efficiently, fairly and in time, and tell affected customers about errors promptly;
• resolve an error found for one customer for every other customer it may reasonably have affected;
• distinguish clearly between regulated and unregulated activities; and
• deliver fair outcomes for customers.

The Guidance on Securing Customers' Interests frames this with two counterweights: proportionality and customer autonomy (section 1.1.5). Firms are expected to secure customers' interests, while customers keep the right to make their own decisions. The guidance is specific about digital design: dark patterns that steer, deceive, coerce or manipulate consumers are "not in line with the Code obligation to secure customers' interests" (section 2.4.8), and choice architecture must not covertly push customers toward a more expensive or ill-suited product (section 2.4.11). On outcomes, it expects firms to build products that are fit for purpose, use delivery channels that work for their customers, support those in vulnerable circumstances and communicate in a way that lets customers decide in their own interests (section 2.9.2).

In practice this standard becomes evidence: product approval papers that record the customer interest test, outcome metrics in the management information that reaches the board, and a log of design decisions for digital journeys. The risk register is where those consumer protection risks should be scored and owned.

What must firms do for consumers in vulnerable circumstances?

Chapter 3 holds four duties, all of which bind payment and e-money firms too.

1. Assist (Regulation 34). Once a firm identifies that a consumer who is a natural person is in vulnerable circumstances, it must give ongoing reasonable assistance, and make the relevant records available to the staff providing it, where appropriate and lawful.
2. Train (Regulation 35). Staff in consumer-facing roles, in product design and development, in sales and marketing, those overseeing them, and anyone else who may deal with consumers in vulnerable circumstances must be trained to recognise vulnerability and to know the firm's policies for responding to it. The firm identifies who needs training, makes sure they complete it, and at least every 2 years reviews whether the training objective is being achieved and reports its findings to the board.
3. Trusted contact person (Regulation 36). At a personal consumer's request the firm records a trusted contact it may call about possible financial abuse, to confirm contact details, health status or the identity of a guardian, executor or trustee, or when it cannot reach the consumer. Confidential information may be shared only with the written consent of both the consumer and the trusted contact, who gains no authority over the consumer's affairs. The rule gives way where a decision-making representative, an attorney, a decision-making assistant or a co-decision maker under the Assisted Decision-Making (Capacity) Act 2015 is in place.
4. Report concerns (Regulation 37). Employees need clear internal policies and procedures for reporting a concern that a personal consumer is at risk of financial abuse by any person.

The Guidance on Protecting Consumers in Vulnerable Circumstances names health issues, life events and lack of capability as the usual drivers, notes that people move in and out of vulnerable circumstances, and warns firms against labelling some customers vulnerable and assuming the rest are not (sections 2.1.3 to 2.1.5). It sets a minimum training syllabus of 11 topics, from the types and signs of vulnerability to the trusted contact procedure, obligations under the 2015 Act and the GDPR, and adult safeguarding (section 2.3.8), and expects frontline staff to be able to escalate a concern to someone senior and authorised to act (section 2.3.11).

What are the digitalisation requirements in the Code?

Chapter 4 is new and applies wherever a firm engages with a consumer through a digital platform: an online system through which contracts for financial services can be concluded, or a website or app that gives consumers access to conclude them. The Code is technology neutral (General Guidance 3.5.2), so the rules follow the channel whatever the technology behind it.

The guidance adds the practical layer. Where speed invites an unsuitable choice, such as a buy now pay later option at checkout or add-on insurance, it expects pause features with a warning (Box 3). Every consent the Code requires must be recorded; written consent can come on paper, by email or in another electronic format (section 3.5.22). A digital format counts as a durable medium only if it meets every part of the definition, so an app or portal must let the customer retrieve last year's information unchanged (section 3.5.24). Regulation 42 applies to any platform used as the durable medium (section 3.5.5).

How must firms handle disclosure, unregulated activities, advertising and fraud?

The regulatory disclosure statement (Regulation 71). A firm must state its regulatory status on business stationery used for regulated activities, on every webpage about regulated activities, and in electronic communications with consumers about them, excluding SMS messages that do not discuss the details of a service. The format is prescribed, with no other text: "[full legal name], trading as [trading names], is regulated by the Central Bank of Ireland" for a firm authorised in Ireland, or, for an EEA firm, that it is authorised, licensed or registered by its home authority in its home state "and is regulated by the Central Bank of Ireland for consumer protection rules". Regulation 71(6) extends the statement to advertisements for regulated activities, and Regulation 71(5) forbids presenting it as an endorsement.

Unregulated activities (Chapter 8). Information about regulated activities must sit on a separate webpage from unregulated ones (Regulation 72). Regulation 73 requires systems and controls so that communications covering both make clear which is which, the protections that do not apply to the unregulated activity are pointed out, and any written communication about an unregulated activity carries this warning: "Warning: The provision of this service does not require licensing, registration or authorisation by the Central Bank of Ireland, and as a result is not covered by Central Bank of Ireland rules designed to protect consumers or by a statutory compensation scheme."

Advertising (Chapter 9). Advertisements must be clear, fair, accurate and not misleading (Regulation 77), name the firm (Regulation 78) and identify themselves as advertisements (Regulation 79). Wherever an advertisement states benefits it must state the risks, in type at least as large as its main text (Regulation 80(c)). The General Guidance applies the labelling rule to finfluencer content and social media posts (sections 3.7.20 to 3.7.22), and the Central Bank's FAQ says product risks must be shown prominently before a consumer decides, with equal prominence to benefits. Regulation 75 requires advertisements to be reviewed and updated regularly; it is one of the advertising rules Regulation 9 does not apply to payment and e-money business.

Financial abuse (Standards for Business Regulations 4(1)(f) and 10). Firms must put reasonable systems and controls in place to reduce the risk of fraud, scams and other financial abuse, monitor abuse trends and weak points in their services and channels, escalate when risk rises, tell customers clearly and promptly about digital frauds connected to the firm or its sector, and explain the supports and actions available to victims. With Regulation 37 inside the firm, this is the scam prevention duty most firms will be asked to evidence first.

What are the complaints handling timelines under the Code?

Chapter 12 applies to every complaint from a consumer: an expression of grievance or dissatisfaction, oral or written, about providing or offering a financial service, or refusing to provide one. A firm must take all reasonable steps to resolve complaints (Regulation 101), offer an oral complainant its complaints process (Regulation 102), accept complaints in writing by post and electronically (Regulation 103), track progress in a system (Regulation 104), and publish its procedure prominently on every website, with a paper copy within 5 working days of a request (Regulation 105(2)). The procedure must provide for the following.

A complaint resolved to the consumer's satisfaction within 5 working days can skip the procedure, but it must still be logged (Regulation 105(3)) and it still counts in the analysis. The log in Regulation 106 records the core reason, so complaints can be analysed by category, the date received, a summary of the response and its date, other correspondence, the steps taken, the resolution date and the status of any ombudsman referral or appeal. Regulation 107 then requires governance: oversight of complaints handling, an analysis at least every 6 months of rates and patterns, including complaints closed within 5 working days, and aggregated reporting to the compliance or risk function and the board.

The General Guidance adds two expectations that inspectors test. Firms must categorise complaints on a substance over form basis, so a grievance does not disappear because it was logged as a query, and dissatisfaction about price must be judged case by case to decide whether it is negotiation or a complaint (sections 3.9.5 to 3.9.7). For a firm providing payment services, remember that Regulation 105(5) switches off the 20 and 40 working day steps and PSD2 Article 101(2) applies to payment service complaints: 15 business days, or 35 in exceptional cases with a holding reply.

How must errors be resolved, logged and escalated?

Chapter 11 covers errors that affect consumers. Regulation 96 requires robust governance and written procedures that, at a minimum, identify the cause and potential impact of an error and every potentially affected consumer, detect and classify errors in time, escalate significant errors urgently to the board, and control the correction process. It adds oversight of error handling, an analysis of the rate, patterns and causes of errors at least every 6 months, and aggregated reporting to the compliance or risk function and the board.

Regulation 97 then sets the deadline: resolve every error speedily and no later than 6 months after the date it was first discovered, by fixing the systems failure, putting controls in place to stop it recurring, refunding affected consumers with appropriate interest, and telling current and former consumers in good time about any error that has affected or may affect the cost of a service or the value of a product. Where a refund cannot be paid after all reasonable steps, the firm must not benefit from the money and must pay it with interest when claimed (Regulation 98). The error log in Regulation 99 has 12 fields, two more than in 2012: details of any charitable donations of refund amounts, and other remediation steps. Regulation 100 requires a record of the steps taken, including where consumers were dissatisfied, could not be contacted, or could not be repaid.

What counts as significant is for the firm to decide, but the General Guidance lists ten factors to weigh, among them the number of customers affected relative to the product's customer base, the remediation amounts, whether the error is systemic, the risk of reputational damage, how long it ran and how long it will take to fix, whether it breaches a regulatory obligation that may need disclosing to the Central Bank, and whether several small errors together amount to a significant one (section 3.8.3). One 2012 rule is gone: provision 10.3, which required firms to notify the Central Bank of any error still unresolved after 40 business days, was deleted. Disclosure now rests on Regulation 13(a) of the Standards for Business, which asks for prompt disclosure of anything the Central Bank would reasonably expect to hear about. That is a judgement call your escalation procedure has to document every time.

What records does the Code require, and for how long?

Regulation 115(1) lists the records a firm must keep up to date, starting with "records evidencing compliance with the applicable requirements" of the Regulations. It goes on to the consumer's identification and profile documents, contact details, documents prepared under the Regulations, information on the service provided, all correspondence, instructions and the dates they were received and acted on, conditions attached to instructions, discretionary decisions and their reasons, signed documents and applications, supporting documents, required consents in the required form, comprehensive records of each complaint, and all other relevant information. Consent records must be written where written consent is required; otherwise written or an audio recording (Regulation 115(2)).

Regulation 117 sets the periods. Records of consumer transactions are kept for 6 years after the transaction is completed or discontinued, and other records for 6 years after the firm stopped providing any service to the consumer. Records of a request or offer that did not become a sale are kept for 12 months, subject to the consumer's consent; if consent is refused or withdrawn the Code does not require them to be kept. The General Guidance points out that data protection law still applies, including storage limitation and the GDPR transparency duties, and that such records must not be used for direct marketing without explicit consent (sections 3.10.1 to 3.10.8). The Data Protection Commission enforces that side, and our guide to GDPR fines and penalties shows what it has imposed. Records must be complete, orderly, accurate and readily accessible, and produced to the Central Bank in the time and format it specifies (Regulation 118).

Two short rules close Chapter 15 for every firm, payment and e-money institutions included. Regulation 119 makes the firm answerable for any outsourced activity complying with the Regulations; how the Central Bank expects outsourcing to be governed is in our guide to Central Bank of Ireland outsourcing guidance. Regulation 120 requires every policy or procedure the Regulations call for to be in writing and readily accessible to the employees who need it.

What recurring work does the Code put on your calendar?

Most of the Code is event driven, which is why it is easy to lose track of. Four kinds of date need an owner.

Put the six-monthly analyses on the board calendar first. They are the two duties whose evidence is a dated board paper, and both depend on the logs being complete in between.

What changed from the 2012 Code?

The Central Bank's mapping tool shows where every 2012 provision went. These are the changes with the most practical weight, checked against the 2012 text the tool reproduces.

Sector changes sit in Parts 3 to 5: mortgage switching, with title deeds released to the borrower's solicitor within 10 working days (Regulation 175), the mortgage arrears rules folded into Part 3, Chapter 9, and in insurance, notice within 10 working days to each insured adult whose health insurance cover ends, and no automatic renewal of pet, travel, gadget or dental insurance without the consumer's consent (Regulation 327).

How does the Central Bank supervise and enforce the Code?

The Central Bank supervises under its PRISM framework, using thematic inspections across sectors and firm-specific consumer protection risk assessments. Its 2017 Guide to Consumer Protection Risk Assessment says firm-specific assessments form a key part of supervision for credit institutions, non-bank lenders, insurers, investment firms, large retail intermediaries, payment institutions and e-money institutions. The guide expects a consumer protection risk framework embedded in the firm's wider risk management, covering five modules (governance and controls; people and culture; product development; sales and transactions; post-sales handling) and built in six steps: identify the risks, set a risk appetite, document governance and controls, make the risks known, assign ownership, and monitor with metrics and management information. It then expects proof that controls work, through key risk indicators, monitoring of consumer outcomes, and testing by compliance, risk or internal audit.

Enforcement is direct. Regulation 420 makes any failure to comply with the Consumer Protection Regulations a prescribed contravention under the administrative sanctions procedure in Part IIIC of the Central Bank Act 1942. Section 33AQ caps a monetary penalty at the greater of €10 million or 10% of turnover for a firm, and €1 million for an individual. The people who run the firm carry their own exposure: Conduct Standards for anyone in a controlled function, and for senior executives in firms within the Senior Executive Accountability Regime, a duty of responsibility. Our guides to the Individual Accountability Framework and fitness and probity cover those duties, and how to collect audit evidence explains what an inspection will ask to see.

What do the other guides get wrong?

We read the 14 pages that rank for "Consumer Protection Code 2025" and its variants, mostly law firm and consultancy briefings, and checked their claims against the Regulations. Most were written when the Code was published in March 2025, and half still describe it in the future tense. These are the points that would mislead a compliance team.

1. "Applies to all regulated firms." A governance body's article says: "The Code applies to all regulated financial service providers in Ireland, including, for example, banks, insurance companies, investment firms and brokers." Regulation 15 excludes MiFID services and reinsurance, Regulation 7 limits credit unions to insurance intermediation, and Regulations 9, 13 and 14 restrict payment, e-money, crowdfunding and MiCAR business to short lists. A law firm summary makes the same leap for the Standards for Business, "that will apply to all regulated firms", when Regulation 2(2) of S.I. No. 80 of 2025 excludes MiFID services, crowdfunding providers, reinsurance and most credit union business.
2. The immediate acknowledgement. A consultancy summary says firms must "immediately acknowledge complaints submitted electronically, using the same medium through which the complaint was made", before narrowing it to cases such as web forms. Regulation 105(4)(b) asks for the acknowledgement on a durable medium, which need not be the channel the complaint arrived through, and it covers complaints entered on the firm's website. A complaint sent by email is acknowledged within 5 working days under Regulation 105(4)(a).
3. Five days. Two summaries give "five days" notice of a material change to terms of business. Regulation 62(2) says at least 5 working days, a full working week, and the rule sits in Chapter 5, which Regulation 9 does not apply to payment and e-money business.
4. The turnover line. Four pages describe consumers as businesses with turnover "of less than €5 million". The definition excludes bodies with turnover in excess of €5 million, so a company at exactly €5 million is a consumer, and group turnover counts as well.
5. What none of them covers. None of the 14 mentions Regulation 9 or how the Code applies to payment and e-money institutions, the switch to the PSD2 complaint clock in Regulation 105(5), the 2026 amendment in S.I. No. 111 of 2026, the deletion of the 2012 rule on notifying the Central Bank about errors open after 40 business days, or the September 2026 update to the General Guidance.

How do you evidence compliance with the Code in 90 days?

The Code has applied since 24 March 2026, so the question for most firms is whether the evidence would satisfy an inspection today. This plan works for a firm building the programme and as a health check for one already live.

1. Weeks 1 and 2: map what applies. Run the consumer test across customer types, apply the restricted application rules in Regulations 4 to 14 to each product, and mark every rule that does not bind you as not applicable, with the regulation that switches it off.
2. Weeks 3 to 6: assign owners and write policies. One owner per requirement and per clock. The Regulations call for written policies or procedures on complaints, errors, conflicts of interest, vulnerability and financial abuse reporting, plus systems for digital design, advertising and unregulated activities; put board approval dates on the calendar.
3. Weeks 7 to 10: run the logs and clocks. A complaints log with every Regulation 106 field, an errors log with all 12 Regulation 99 fields, training records against the Regulation 35 objective, and consent and trusted contact records.
4. Weeks 11 to 13: report and test. Take the first six-monthly complaints and errors analyses to the board, test controls against the evidence, and self-assess against the five modules of the risk assessment guide.

Where do you stand?

Fill this in for your firm. A blank cell is a gap to close before the next board meeting.

Venvera keeps that work in one place: every requirement, owner, task, deadline and piece of evidence in one dashboard, in place of a spreadsheet of regulations, a shared drive of logs and a chain of emails before each board meeting. The Ireland framework carries 295 requirements, covering the Consumer Protection Code, the Central Bank's risk assessment guide, the Consumer Protection Act 2007, the distance contract rules, fitness and probity, the Individual Accountability Framework, protected disclosures, the Irish data protection rules and an Irish anti-money laundering overlay. It comes with a 94-question gap assessment, 35 recurring obligations on the compliance calendar and 21 policy templates. Requirements that do not bind your firm type are marked not applicable with the reason recorded. Venvera tracks the programme and its evidence; it does not handle your complaints, run your customer communications or submit anything to the Central Bank.

Run the free compliance check for a baseline, book a demo to see the Ireland framework, or start a 14-day Professional trial with no credit card. Plans are on the pricing page.

Frequently asked questions

What is the Consumer Protection Code 2025?

It is two Central Bank of Ireland regulations: the Standards for Business Regulations (S.I. No. 80 of 2025) and the Consumer Protection Regulations (S.I. No. 81 of 2025), amended by S.I. No. 111 of 2026. Together they set how regulated firms must treat consumers in Ireland, and they replaced the 2012 Code from 24 March 2026.

When did the Consumer Protection Code 2025 come into effect?

On 24 March 2026, after a 12 month implementation period that began when the Central Bank published it on 24 March 2025. The only amendment so far, S.I. No. 111 of 2026, took effect on 25 March 2026.

Does the 2025 Code replace the Consumer Protection Code 2012?

Yes, in full. It also consolidates the Code of Conduct on Mortgage Arrears, the Licensed Moneylenders Regulations 2020 and the Insurance Requirements Regulations 2022. The Central Bank's mapping tool shows where each old provision now sits.

Who does the Consumer Protection Code apply to?

Regulated entities providing regulated activities to consumers in Ireland, including firms authorised elsewhere in the EEA that operate by branch or cross-border. It does not apply to MiFID services in Schedule 1 of the MiFID Regulations 2017, reinsurance, services to persons outside the State, or credit union business other than insurance intermediation.

What is a consumer under the Consumer Protection Code 2025?

A natural person; a group of natural persons such as a partnership, club, charity or trust; or an incorporated body, unless its own turnover or its group's combined turnover was above €5 million in the previous financial year. The 2012 Code used €3 million.

Does the Consumer Protection Code apply to payment institutions and e-money institutions?

Partly. Regulation 9 applies a listed set of provisions to payment services and e-money issuance: conflicts of interest, vulnerability, digitalisation, the regulatory disclosure statement, unregulated activities, most advertising rules, bundling, errors, complaints, unsolicited contact, records, outsourcing and a few Part 3 rules. Every Standard for Business applies in full.

What are the complaint handling timelines under the Code?

An immediate automatic acknowledgement for complaints entered on the firm's website, a written acknowledgement within 5 working days, updates at least every 20 working days, reasonable efforts to resolve within 40 working days, and the decision within 5 working days of completing the investigation. Payment service complaints follow PSD2 Article 101: a reply within 15 business days, 35 at most.

How quickly must errors be resolved under the Code?

Speedily and no later than 6 months after the date the error was first discovered, including refunds with appropriate interest and timely notice to affected current and former consumers (Regulation 97).

Do firms still have to notify the Central Bank about errors open after 40 business days?

That 2012 rule, provision 10.3, was deleted. Firms must escalate significant errors urgently to their board and disclose promptly to the Central Bank any matter it would reasonably expect notice of, under Regulation 13(a) of the Standards for Business.

What is a trusted contact person?

Someone a personal consumer nominates whom the firm may contact about possible financial abuse, to confirm contact details, health status or the identity of a guardian, executor or trustee, or when it cannot reach the consumer. Both must consent in writing before confidential information is shared, and the trusted contact gains no authority over the consumer's affairs.

How often must vulnerability training be reviewed?

At least every 2 years. The firm reviews whether the training objective in Regulation 35 is being achieved and reports the findings to its board.

What did S.I. No. 111 of 2026 change?

Five things, from 25 March 2026: clarifications for MiCAR services, the definition of a working day, calls to potential or former customers under Regulation 110(1)(d), an exemption on early redemption charge information in Regulation 136, and the numbering of Regulation 371(1).

Does the Code apply to MiFID investment firms?

The Consumer Protection Regulations and the Standards for Business exclude MiFID services in Schedule 1 of the MiFID Regulations 2017. The Central Bank still expects MiFID firms to consider its securing customers' interests and vulnerability guidance, without the trusted contact and training requirements.

What is the regulatory disclosure statement?

The prescribed sentence stating a firm's regulatory status. It must appear on stationery, webpages and electronic communications about regulated activities, and in advertisements for them, with no added text (Regulation 71).

How long must records be kept under the Consumer Protection Code?

Six years after a transaction is completed or discontinued, six years after the relationship ends for other consumer records, and 12 months for requests or offers that were not taken up, if the consumer consents (Regulation 117).

What are the penalties for breaching the Consumer Protection Code?

Any breach is a prescribed contravention (Regulation 420). Under section 33AQ of the Central Bank Act 1942 the Central Bank can impose a monetary penalty of up to the greater of €10 million or 10% of turnover on a firm, and up to €1 million on an individual, alongside other sanctions.

Where do the new distance contract rules for financial services sit?

In the Consumer Rights Act 2022, as amended by S.I. No. 309 of 2026 to transpose Directive (EU) 2023/2673, which applies from 19 June 2026. They include an online cancellation function for contracts concluded through an online interface.

Primary sources

Rules, dates and numbers are taken from the Central Bank of Ireland's consolidated editions of the Consumer Protection Regulations (S.I. No. 81 of 2025, Part 2 and Part 6) and the Standards for Business and Supporting Standards for Business (S.I. No. 80 of 2025), checked against the Irish Statute Book copies of S.I. No. 81 of 2025, S.I. No. 80 of 2025 and S.I. No. 111 of 2026. The amendment date and the revocations are from the Central Bank's About page; guidance from the General Guidance on the Consumer Protection Code (last updated September 2026), the guidance on securing customers' interests and on vulnerable circumstances, the Consumer Protection Code FAQ, the mapping tool and the Guide to Consumer Protection Risk Assessment. The payment services complaint clock is from Article 101 of Directive (EU) 2015/2366, distance contracts from Directive (EU) 2023/2673 and S.I. No. 309 of 2026, and penalties from section 33AQ of the Central Bank Act 1942. Regulations are summarised; read the full text before relying on a specific provision.