New Consumer Protection Code – Recommended Steps for Firms to Comply

What You Need to Know

The new CPC comprises:

• Central Bank Reform Act 2010 (Section 17A) (Standards for Business) Regulations 2025 (“Standards for Business Regulations”)¹; and
• Central Bank (Supervision and Enforcement) Act 2013 (Section 48) (Consumer Protection) Regulations 2025 (“Consumer Protection Regulations”)².

The CPC applies to regulated entities operating in Ireland or providing services to persons in Ireland. However, there are certain exemptions, including for firms providing MiFID services.

Nonetheless, the Central Bank has noted in its guidance that it expects firms providing MiFID services to apply the guidance, on the basis that this is consistent with those firms’ obligation to act honestly, fairly and professionally in accordance with the best interests of their clients.

The New Regulation

The Standards for Business Regulations set out governance, resource and risk management requirements. The regulations also prescribe conduct standards for firms.

The Consumer Protection Regulations cover matters such as customer suitability assessment requirements, customer sustainability preferences, remuneration conflicts of interest, requirements for firms using digital technology, advertising and errors/complaints.

The CPC is further complemented by various pieces of guidance issued by the Central Bank designed to support firms to effectively implement their consumer protection obligations.

The CPC will take effect on 24 March 2026 and will replace the existing 2012 consumer protection code from that date.

It is significant that the revised CPC is issued through statutory instruments. This ensures that the regulations are enforceable by law and means that non-compliance can result in legal penalties, fines, or other regulatory actions.

Key Changes

In addition to some sector-specific changes, the new CPC introduces several significant cross-sectoral/thematic changes aimed at enhancing consumer protection and ensuring that financial service providers adhere to higher standards of conduct. Below are some of the key changes:

Enhanced Disclosure Requirements

Firms are required to effectively inform their customers about their products and services through clear and comprehensive disclosures and communications.

There is an emphasis on the duty to ensure that all information given to customers is clear, accurate, up-to-date and written in plain and accessible language, avoiding unnecessary technical jargon.

Digitalisation

Firms must design user-friendly platforms and test associated technology to ensure consistent, objective outcomes. Additionally, firms must ensure that their products and services, including technology, do not exploit customer behaviours, habits, preferences or biases, to maintain consumer trust and confidence.

Sustainability

Firms must consider customers’ sustainability preferences during suitability assessments and will be required to ensure that their advertising does not mislead customers regarding a product’s or service’s sustainability or the firm’s sustainability approach.

Expanded Definition of a Consumer

In addition to continuing to apply to customers who are natural persons, the CPC’s scope has been expanded to include small businesses with a turnover of less than €5 million annual turnover (increased from €3 million under the existing regime), extending crucial protections to these entities.

Unregulated activities

Where a regulated firm offers unregulated products or engages in unregulated activities, it must be clear to its customers that they are purchasing unregulated products and services.

Key Steps for Firms

The introduction of the new CPC marks a significant step forward in consumer protection in Ireland and Irish consumers can expect greater transparency, fairness, and protection in their financial dealings as a result of these changes.

In-scope firms will need to take proactive steps to ensure compliance with the new regulations by the effective date.

Some preparatory steps firms should consider taking now, in advance of the new regulations coming into effect, include:

• conducting a thorough review of existing policies and procedures to ensure they align with the new requirements of the CPC;
• updating internal documentation to reflect changes in consumer rights and disclosure requirements;
• developing strategies to improve the clarity, accuracy and accessibility of information provided to customers;
• strengthening governance and risk management frameworks to meet the new Standards for Business Regulations;
• providing comprehensive training to all staff members on the new CPC and its implications;
• developing materials to inform consumers about the new protections and their rights under the revised CPC;
• conducting thorough testing of digital platforms and technologies to ensure they are user-friendly and produce consistent, objective outcomes; and
• reviewing all advertising materials to ensure they do not mislead customers about the sustainability of products, services or the firm’s business model.

By taking these proactive steps, firms can ensure they are well prepared for the implementation of the new CPC and can continue to build trust and confidence with their customers.

How we Can Help

Our dedicated Irish Financial Services Regulatory Group regularly advises clients across all regulated sectors on incorporating applicable consumer protection rules into their internal frameworks, including updates to policies and procedures, terms and conditions, product documentation, website content and advertising materials.

Further information on our Irish Financial Services Regulatory Group and the services we provide is available on our website³ and in our FSR⁴ and FinTech⁵ brochures. If you would like further information, please liaise with your usual Maples Group contact or the persons listed above.