Irish Vulnerable Customer and Digital Rules Explained

Customers who are vulnerable, or who find digital services hard to use, need more than a standard process. The Central Bank of Ireland's 2025 consumer protection regulations include chapters on consumers in vulnerable circumstances and on digitalisation. This guide summarises Regulations 34 to 43 as published on the Central Bank's website. It supports our Supporting Customers in Vulnerable Circumstances course overview, and builds on our guides to vulnerable customers and to the 2025 Code changes.

Ongoing assistance: Regulation 34

Regulation 34 requires regulated entities to provide ongoing reasonable assistance to consumers they have identified as vulnerable. It also says the records relating to those consumers must be accessible to the staff who need them. In practice this means a vulnerability flag that nobody can see when a customer calls is of little use.

Training and review: Regulation 35

Regulation 35 requires relevant staff to receive training on vulnerability. It also requires the regulated entity to review its compliance at least once every two years and to report the findings to the board. The two-year review cycle is a specific, checkable obligation.

Trusted contact person: Regulation 36

Regulation 36 deals with recording a trusted contact person at the consumer's request. It requires written consent from both the consumer and the contact. The page makes clear that the trusted contact has no authority to act for the consumer, which distinguishes the role from a power of attorney.

Financial abuse: Regulation 37

Regulation 37 requires clear policies for staff to report concerns about financial abuse. Firms therefore need a route for front-line staff to raise concerns and a clear owner for receiving them.

Digital services: Regulations 38 to 43

The next chapter applies similar thinking to digital platforms:

• Regulation 38: digital platforms must be easy to use and tested, and must use documented, tested algorithms. Consumers must have sufficient time to consider before contracting.
• Regulation 39: no preselected options confirming that the consumer has read or understood information.
• Regulation 40: clear step-by-step guidance on platform use, prominently displayed at all times.
• Regulation 41: prominently display how to get help with platform queries or service information.
• Regulation 42: give at least 15 working days' notice before withdrawing access to systems that provide required information, and advise consumers that they may save the information.
• Regulation 43: remind consumers of cooling-off rights between three and seven working days before they expire.

How the two chapters fit together

Reading the two chapters together, the regulations expect firms to design digital services with a wide range of users in mind and to keep a human route to assistance for those who need it. Regulation 41, on prominent help, and Regulation 34, on ongoing assistance, work together in that way. This is our reading of how the provisions interact, not the Central Bank's own statement.

Knowing the consumer: Regulation 16

Vulnerability is easier to spot where firms collect good information in the first place. Regulation 16 requires firms to gather and record sufficient information before offering a service, covering needs, personal circumstances, financial situation and attitude to risk. The information must be refreshed before any further service, and the firm should endeavour to ask the consumer to certify its accuracy. Taken together with Regulation 34, this suggests vulnerability is something firms are expected to look for as part of normal fact-finding, not only when a customer discloses it.

When firms make mistakes: Regulations 96 and 97

Errors affect vulnerable customers hard. Regulation 96 requires written governance arrangements for handling errors that affect consumers. These cover identifying the cause and impact, identifying affected consumers, escalating significant errors to the board, and controlling correction. They also require oversight, analysis of error patterns at least once every six months, and reporting to compliance or risk functions and the board. Regulation 97 requires firms to resolve errors speedily and no later than six months after the date the error is identified, though the page text we read was cut off mid-sentence, so check the full trigger wording.

Using this in a customer role: our suggestions

These steps are our suggestions, not requirements in the regulations.

• Check that vulnerability records are visible to every team that speaks to customers.
• Diarise the two-year compliance review and the board report.
• Test the journey with a screen reader and with a customer who is not confident online.
• Remove any preselected tick-boxes that confirm a customer has read terms.

For structured learning, browse our CPD courses.

What we could not confirm

We read the Central Bank page's text, which marks some regulations with a "(G)" label that we did not interpret, so check which entity types each regulation applies to. We did not read the Central Bank's general guidance on the regulations, which may add detail on identifying vulnerability. This post covers Ireland only. It is general information, not legal advice.