Irish Consumer Protection Code 2025: What Changed

Ireland's consumer protection rules for regulated financial firms changed in March 2026. The Central Bank of Ireland published a revised Consumer Protection Code on 24 March 2025, and the new Code took effect on 24 March 2026 after a 12-month implementation period, according to the Central Bank. This guide explains how the Code is structured and what changed, using the Central Bank's own page for the dates and a law firm summary for the detail. It complements our guide to staff training under the Consumer Protection Code.

The structure of the 2025 Code

The Central Bank says the Code comprises the Standards for Business Regulations 2025 and the Consumer Protection Regulations 2025, and that the 2012 Code applied until the new one took effect. A summary by A&L Goodbody gives the instruments as S.I. 80/2025, the Standards for Business Regulations, made under section 17A of the Central Bank Reform Act 2010, and S.I. 81/2025, the Consumer Protection Regulations, made under section 48 of the Central Bank (Supervision and Enforcement) Act 2013. It adds that there are three guidance documents: Securing Customers' Interests, Protecting Consumers in Vulnerable Circumstances, and a General Guidance on the Code.

What the Central Bank says it is for

The Central Bank describes the aims of the revised Code as modernising consumer protection for digital delivery, encouraging firms to build customers' interests into their strategy and decision-making, offering protections that reflect how consumers now access financial services, giving firms clearer and more predictable obligations, and helping consumers and firms find and understand the Code.

The main changes, according to law firm summaries

• Standards for Business: A&L Goodbody says these are substantively unchanged, with scope and application clarified.
• Consumer Protection Regulations: refinements include a new obligation for mortgage providers to supply title deeds to a borrower or their representative within 10 working days of a request, subject to exceptions.
• Securing customers' interests: the guidance adds examples and clarity on digital delivery, execution-only dealings, customers who make poor decisions, proportionality and sustainable products.
• Vulnerable consumers: the definition now makes clear that vulnerability can be temporary or permanent, recording is more flexible, and the trusted contact person rule has been adjusted to fit the Assisted Decision-Making (Capacity) Act 2015. Our guide to vulnerable customers under FCA and Irish rules goes into this.
• Digital: William Fry reports that online-transaction requirements were narrowed to avoid unnecessary friction, that pause statements are required where the risk of unsuitable purchases is high, and that a mandatory filtering requirement was replaced by guidance.
• Complaints and errors: William Fry reports that complaints analysis remains every six months, applied proportionately, that web-form complaints require immediate acknowledgment, and that the guidance clarifies what a significant error is.

Firm-specific points reported

William Fry's summary notes a number of narrower points. Reinsurance business is excluded from the conduct regulations. The six-month notice period for ceasing, merging or transferring business applies only to credit institutions leaving the Irish market. Health insurers must notify all affected adults, not only the policyholder, when cover ceases. Written consent requirements were reduced and consent can be given digitally. These details vary by sector, so firms should check the regulations for their own business.

Timeline for firms

The dates are the simplest part to remember. The revised Code was published on 24 March 2025 and applies from 24 March 2026, so any firm still working from the 2012 Code after that date should treat its procedures as out of date. The Central Bank notes that the previous Code stays available on its site as the earlier version. Because the commencement date has now passed, the practical task for most firms has moved from planning to evidencing: showing that policies, training records and customer journeys reflect the new text, and that gaps found during implementation have been closed or are being tracked.

What this means for complaints handling

The reported complaints changes are modest but practical: acknowledge web-form complaints at once, keep the six-monthly analysis proportionate, and be clear on what counts as a significant error. They fit with the root-cause approach we cover in our complaints, root cause and redress course overview, where the point is to use complaints to improve products and controls rather than only to close cases.

Practical steps: our suggestions

These steps are our suggestions, not requirements. Map each provision that applies to your business to a named owner. Check customer-facing journeys and wording against the new guidance, especially online flows. Update vulnerability procedures and staff training. Keep evidence of how decisions were taken in the customer's interest. For structured learning, browse our CPD courses.

What we could not confirm

We did not read the regulations or the three guidance documents themselves. The Central Bank page we read gave only the headline dates and structure, so details on vulnerability, digital and complaints come from law firm summaries by A&L Goodbody and William Fry. We did not review how the Code applies to MiFID firms, which another law firm has addressed separately, or the Central Bank's inspection and enforcement approach. This post is general information, not legal advice.