The requirements page lists all 295 rows of the framework. Each carries an implementation status, an owner, implementation notes, evidence and a review date, and each has authored guidance describing the artefacts a Central Bank reviewer asks for, what gets rejected, the gaps that occur in practice and what is proportionate for a small firm and for a group.
Status values
The same four values used across every Venvera framework: Not Implemented, Partial, Implemented and Not Applicable. Unlike most frameworks, Not Applicable is a normal and expected status here, because the instruments reach different firms in different measures.
The "Applies to" sentence
Every requirement whose scope is narrower than all regulated financial service providers ends with a sentence that starts "Applies to:", copied from the instrument. For the Consumer Protection Regulations it states whether the regulation binds the provision of payment services and the issuance of e-money under Reg. 9(1). For the SEAR rows it reads "SEAR firms only (not payment or e-money institutions in phase 1)". For the Minimum Competency rows it names the retail products in Appendix 1 of the Code. For the intermediary and product producer rows it says which of the two the duty binds.
| Your firm | Rows you will usually scope out |
|---|---|
| Payment or e-money institution | The Consumer Protection Regulations outside Reg. 9(1) (knowing the consumer, Regs 20, 21 and 30 to 33, Chapters 5 and 6, Regs 75, 76, 116 and 121 to 128), the eight SEAR rows, the Minimum Competency rows unless staff work on retail products, the intermediary rows |
| Credit institution or insurer | The intermediary and deposit agent rows, the payment and e-money probity evidence row, the e-money derogation row, the digital age of consent row if no information society service is offered to children |
| Retail intermediary | The product producer rows, the SEAR rows unless in scope, the AML overlay rows that bind credit and financial institutions only |
| Credit union | The Standards for Business outside insurance intermediation (Reg. 2(2)), the product producer rows, the SEAR rows |
The duties that catch firms at the commencement dates
The Consumer Protection Code 2025 commenced on 24 March 2026 and the distance marketing rules on 19 June 2026. The rows most firms are still working on are the ones a reviewer opens first.
| Requirement | Duty |
|---|---|
| IECPC-38.A, 38.C and 38.D | Digital platform designed and tested for ease of use, algorithms documented and tested, a pause before the consumer commits |
| IECPC-34 to 36 | Assistance to consumers in vulnerable circumstances, training, the trusted contact person with both consents recorded |
| IECPC-96 to 98 | Errors governance, resolution within six months of discovery including every affected consumer, prompt refunds |
| IECPC-105.4A to 105.4G | The complaints clocks: five working days to acknowledge, updates every twenty, resolution within forty, final response within five |
| IECPC-72 and 73 | Separate webpages and controls for unregulated activities, with the warning statement |
| IEDM-11A, 16A.5 and 16B | The online cancellation function, the withdrawal reminder after a rapid sale, the fourteen day right of withdrawal |
| IEFP-22 and IEFP-PIEMI | The PCF list reconciled to Schedule 2 as substituted in February 2026, including Head of Safeguarding, and the probity evidence the Central Bank expects from a payment or e-money institution |
Evidence
Attach evidence to the requirement it supports. The authored guidance on each requirement lists the artefacts a reviewer asks for and states what gets rejected, so use it as the acceptance test before you attach a document: a complaints log without the acknowledgement dates, a certification register without the decision record, a Management Responsibilities Map without a version history. The Irish requirements are not on the crosswalk: each is a Central Bank of Ireland or Irish statutory duty with its own evidence, and linking it to a similar-sounding control in MiCA, Solvency II, ISO 27001, SOC 2 or the GDPR would claim coverage a Central Bank reviewer would not accept. Where one document genuinely answers both, such as a conflicts of interest policy written for both regimes, attach it to each requirement.
Event clocks
Fifty-four event-driven deadlines sit on the requirements that start them, from the five working day complaint acknowledgement to the six year retention of consumer records, the twelve month expiry of a certificate of compliance, the seven day whistleblowing acknowledgement and the twenty-eight day Data Protection Commission notice period. They are not calendar entries, because they start with an event rather than a date; record the trigger date in the implementation notes when one starts.