Consumer Protection Code Staff Training: What the Central Bank Requires

If you work in a firm regulated by the Central Bank of Ireland, "Consumer Protection Code staff training" comes down to two questions: what do the 2025 Regulations actually say about training, and how much detail comes from guidance rather than the rules themselves? According to the Central Bank, the Consumer Protection Code 2025 took effect on 24 March 2026, after a 12-month implementation period. This guide sets out the training and competence provisions we could confirm on the Central Bank website, and says clearly where we could not confirm detail. It is not legal advice, and which provisions apply to you depends on your type of firm and activities.

How the Code 2025 is structured

The Central Bank describes the Code as having two parts: the Standards for Business Regulations 2025 and the Consumer Protection Regulations 2025. The Central Bank's General Guidance identifies them as S.I. No. 80 of 2025 and S.I. No. 81 of 2025. Part 1 of the Standards for Business Regulations says they were made on 24 March 2025 and come into operation on 24 March 2026. The Central Bank has also published supporting guidance, including General Guidance on the Consumer Protection Code (first published March 2025, with "March 2026" and "Last updated: September 2026" shown on the version we read), Guidance on Securing Customers' Interests and Guidance on Protecting Consumers in Vulnerable Circumstances. The General Guidance states that it is guidance and does not replace other applicable rules, guidance or law.

If you also need to consider other Central Bank frameworks for individuals, such as the Minimum Competency Code, see our guide to Central Bank minimum competency and CPD requirements. That is a separate regime from the Code.

What the Standards for Business Regulations say about staff

The Standards for Business Regulations contain the clearest general reference to staff training. Under Regulation 11 (Controlling and managing its affairs), a regulated entity shall control and manage its affairs and systems sustainably, responsibly and in a sound and prudent manner, including by:

• Regulation 11(1): having and employing appropriate resources and implementing effective governance of policies and procedures, systems and control checks, including compliance checks, to ensure compliance with financial services legislation.
• Regulation 11(2): "providing appropriate staff training on the legal and regulatory framework relevant to the performance of those functions, including any legal obligations or standards that are imposed by or under financial services legislation".

Regulation 7 (Acting with due skill, care and diligence) includes "ensuring that persons who are responsible for managing the activities of the regulated entity have appropriate knowledge of the activities and associated risks that apply in the conduct of its affairs". Regulation 14 requires systems and controls, processes, policies and procedures to ensure the entity, and any agent acting under an outsourcing arrangement, complies with the Regulations.

What these provisions do not say, on the pages we read: a number of hours, a set frequency, a named qualification or a requirement to use an external provider. "Appropriate" is the standard, so you need to be able to explain why your approach is appropriate for your size, products and risks.

Training on vulnerable circumstances: Regulation 35

The Consumer Protection Regulations contain a specific training duty. Regulation 35 is headed "Consumers in vulnerable circumstances - training requirements". In summary:

• A regulated entity must ensure that specified persons receive appropriate training on vulnerable circumstances, so they have the knowledge and awareness to understand and recognise consumers in vulnerable circumstances, and knowledge of the entity's own policies, procedures, systems and controls for responding to their needs.
• The persons specified cover staff in consumer-facing roles, product design, sales and marketing, oversight of those roles and any other function where they may deal with consumers in vulnerable circumstances. We read this part in summary form, so check the exact wording of paragraph (2).
• The entity must identify everyone who may require this training and ensure they receive and complete it.
• The entity must review, at least once every two years, whether the Regulation's requirements, including the training objective, are being achieved, and prepare a report of the findings for the board of directors or the persons controlling the entity.

The Central Bank's March 2025 Guidance on Protecting Consumers in Vulnerable Circumstances explains its expectations. It says training should apply to all relevant staff, including those in product development, marketing and supervisory roles, and not only customer-facing roles. It says the obligation is intended to apply proportionately, that it is not intended that formal external training need be procured at a cost to the firm, and that smaller firms can use materials from organisations representing vulnerable sectors or professional or representative bodies. It also sets out suggested content, such as types of vulnerability, how vulnerability affects behaviour and outcomes, recognising exploitation and abuse, and the supports available.

Where the detail is still unclear

• Application. Regulation 3 of the Consumer Protection Regulations says they apply to the regulated activities of regulated entities operating in Ireland, with exclusions and restrictions for certain firms and activities. Check the Regulations for your sector.
• MiFID firms. A footnote in the General Guidance says the Central Bank does not expect MiFID service providers to meet "Trusted Contact Persons requirements and training requirements". We could not see its full context, so read it before relying on it.
• Other training duties. We read Regulation 35 and the Standards for Business Regulations, but we could not read every Part of the Consumer Protection Regulations. Other sector-specific provisions may refer to staff or training.
• Individuals. The General Guidance describes the Standards for Business as "an essential counterbalance to conduct standards imposed on individuals" under the Individual Accountability Framework. Our guide to the Central Bank fitness and probity regime covers a related area.

A practical approach

Our suggestion, not a legal requirement: map each role to the parts of the Code it touches, keep a training plan with dates and attendance, and link training to complaints, product reviews and vulnerability cases. The Code is national, so Dublin-based firms face the same rules as firms elsewhere in Ireland. Record why you chose the content and frequency, since the standard is "appropriate".

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

When did the Consumer Protection Code 2025 take effect?

The Central Bank says the Code took effect on 24 March 2026, following a 12-month implementation period. The Regulations we read state that they come into operation on 24 March 2026.

Does the Code require annual staff training?

Not in the provisions we read. Regulation 11(2) requires appropriate staff training without stating a frequency. Regulation 35 includes a review at least every two years of whether the vulnerable-circumstances training objective is being achieved, which is a review, not a fixed training interval.

Must training be delivered by an external provider?

For vulnerable-circumstances training, the Central Bank guidance says it is not intended that formal external training need be procured at a cost to the firm, and smaller firms can use sector or professional body materials. We did not find a general rule on external delivery.

Is the 2012 Code still relevant?

The Central Bank page lists the 2012 Code as the "Previous Code". The General Guidance says it consolidates the 2012 Code guidance and 2012 advertising guidance. We did not confirm the transitional position for particular sectors.

The Code asks for appropriate training, and the Central Bank guidance explains what that can look like. Check current wording for your sector.