The Ireland (CBI) module tracks the conduct and governance requirements a firm regulated by the Central Bank of Ireland carries: payment and e-money institutions, credit institutions, insurers, investment firms, retail intermediaries, credit unions and crypto-asset service providers, in different measures that each requirement states.
The centrepiece is the Consumer Protection Code 2025, in operation since 24 March 2026: the Standards for Business (S.I. 80/2025, nine standards every regulated firm must meet at all times) and the Consumer Protection Regulations (S.I. 81/2025 as amended by S.I. 111/2026, the detailed duties). Around it sit the Guide to Consumer Protection Risk Assessment, which is how the Central Bank inspects a firm against the Code, the Consumer Protection Act 2007, the distance marketing rules in force since 19 June 2026, fitness and probity under Part 3 of the Central Bank Reform Act 2010 with the Certification Regulations and the Minimum Competency Code, the Individual Accountability Framework with the Conduct Standards and SEAR, the Protected Disclosures Act 2014, the Irish specifics of the Data Protection Act 2018 and the Criminal Justice Act 2010 with the Central Bank AML/CFT Guidelines.
What Venvera tracks
The framework ships 295 requirements, each cited by the regulation, section, article or guide element it comes from and grouped into nineteen areas that follow the instruments and the chapters of the Code. A requirement reference tells you where it comes from: IESFB is the Standards for Business, IECPC the Consumer Protection Regulations, IECPRA the CPRA Guide, IECPA the Consumer Protection Act, IEDM distance marketing, IEFP fitness and probity, IEIAF the Individual Accountability Framework and SEAR, IEPDA protected disclosures, IEDPA the Data Protection Act, and IECJA and IECBI the Criminal Justice Act and the Central Bank AML/CFT Guidelines.
| Area | Provisions | What it covers |
|---|---|---|
| Standards for Business | SFB 2025 Regs 4 to 14 | The nine standards, securing customers' interests, financial abuse, financial resources, disclosure to and cooperation with the Central Bank, systems and controls |
| Knowing the consumer, conflicts and remuneration | CPC 2025 Regs 16 to 33 | Suitability, conflicts of interest, fees, commissions and incentives, intermediary remuneration disclosure |
| Vulnerable circumstances and financial abuse | Regs 34 to 37 | Assistance, training and its biennial review, the trusted contact person, employee reporting |
| Digital platforms | Regs 38 to 43 | Usability testing, documented algorithms, pacing, no preselected confirmations, guidance, notice and reminders |
| Informing effectively and terms of business | Regs 44 to 53 | Product names, warnings, plain language, legibility, electronic security, terms of business |
| Disclosure, charges and regulated status | Regs 54 to 73 | Independent and broker, key information, charges, the regulatory disclosure statement, separation of unregulated activities |
| Advertising | Regs 75 to 88, 155 and 156 | Review, clarity, identification as advertising, warnings, comparisons, interest rate advertising |
| Bundling and contingent selling | Regs 90 to 95 | No contingent selling, cost saving, switching and exiting, optional extras |
| Errors and complaints | Regs 96 to 107 | Errors governance, six month resolution, logs, the complaints clocks, six-monthly analyses |
| Unsolicited contact | Regs 108 to 114 | Visits, calls, permitted hours, opening disclosures, do-not-contact instructions |
| Records, outsourcing and operations | Regs 115 to 128 | Required records, six year retention, outsourcing, policies, instructions, ceasing or transferring business |
| Consumer protection risk assessment | CPRA Guide Modules 1 to 5 | The framework and the thirty elements the Central Bank inspects: governance, people and culture, products, sales, post-sales |
| Consumer Protection Act 2007 | CPA 2007 ss. 41 to 75 | Unfair, misleading and aggressive practices, surcharges, the blacklist, compliance notices |
| Distance marketing | CRA 2022 Part 5A and s. 115A | Pre-contractual information, the withdrawal right, the online cancellation function, human intervention, no manipulative interfaces |
| Fitness and probity | CBRA 2010 Part 3, S.I. 2/2024, MCC 2017 | Controlled function mapping, due diligence, certification, PCF approvals, notifications, the annual confirmation, Minimum Competency |
| Individual Accountability Framework and SEAR | CBRA 2010 Part 3A, S.I. 147/2024 | Conduct Standards notification, training and policies, reasonable steps, the responsibilities map and statements |
| Protected disclosures | PDA 2014 ss. 6 to 23 | The internal channel, acknowledgement, the designated person, feedback, confidentiality, records, non-penalisation |
| Data Protection Act 2018 | DPA 2018 ss. 31 to 133 | The Irish additions to the GDPR: age of consent, suitable and specific measures, national conditions, s. 60 restrictions, the DPC |
| AML overlay | CJA 2010 Part 4, CBI AML/CFT Guidelines 2021 | The Irish sharpening of the AML duties and the Central Bank's expectations, in force until the EU AML Regulation applies in July 2027 |
Who each requirement applies to
Applicability matters more in this framework than in any other. Reg. 9(1) of the Consumer Protection Regulations lists exactly which provisions bind the provision of payment services and the issuance of e-money, so roughly fifty rows do not bind a payment or e-money institution. The eight SEAR rows bind SEAR firms only, not payment or e-money institutions in phase one. The Minimum Competency rows bind firms whose staff work on retail products, and the intermediary rows bind intermediaries. Every requirement whose scope is narrower than all regulated firms ends with an "Applies to" sentence copied from the instrument.
Dashboard
The dashboard shows implementation coverage across the 295 requirements, a breakdown by the nineteen areas above, and the maturity score from the gap assessment if one has been completed. Coverage says whether a requirement is implemented or legitimately scoped out; maturity says how well the firm discharges the judgement calls a Central Bank reviewer tests. The scope banner restates what is not tracked: Part 3 of the Regulations (credit, mortgages and arrears, other than Regs 155 and 156), Part 4 (insurance) and Part 5 (investments), while the ePrivacy duties on cookies and electronic marketing live in the GDPR framework.
Recurring duties
Thirty-five obligations land on the compliance calendar with owners, lead times and reminders. The Regulations fix some in the text; the rest are the cadences a Central Bank reviewer expects.
Six-monthly, Regs 107(2) and 96(2). Rates, patterns and root causes reported to the compliance or risk function and the board.
Annual training under Reg. 35, and a review of its effectiveness with a board report every two years under Reg. 35(4).
Annual re-certification of every controlled function holder, the due diligence refresh, the register review, the Annual PCF Confirmation to the Central Bank and a biennial independent review of the process.
Annual refresher training, review of the policies that embed the Conduct Standards, and review of the Management Responsibilities Map and Statements of Responsibilities for SEAR firms.
Board approval of the business risk assessment, the Compliance Officer Report, the annual policy review, training for all staff, half-yearly transaction monitoring rules review and quarterly PEP rescreening.
Event-driven clocks are not calendar entries. The five working day complaint acknowledgement, the forty working day resolution, the six month error resolution, the seven day whistleblowing acknowledgement, the fourteen day withdrawal right and the twenty-eight day Data Protection Commission notice period are recorded on the requirements that start them.