🛡️ The Central Bank Consumer Protection Code

1. The Central Bank of Ireland published the Consumer Protection Code 2025 on 24 March 2025, allowing a defined implementation period before it fully applies to regulated entities and replaces the Consumer Protection Code 2012. From what date does the Consumer Protection Code 2025 come into full effect?

1. 1 January 2026
2. 24 September 2025
3. 24 March 2026
4. 24 March 2027

The Code 2025 carries a 12-month implementation period from its 24 March 2025 publication date, so it takes full effect on 24 March 2026; the other dates reflect a shorter six-month period or an incorrect two-year period. (Central Bank of Ireland, Consumer Protection Code 2025 — 'Consumer Protection Codes and Regulations' (centralbank.ie))

2. The Consumer Protection Code 2025 is not a single rulebook but is given legal effect through two sets of statutory Regulations, together with supporting Central Bank Guidance. Which two instruments deliver the substance of the Code 2025?

1. 'Fitness and Probity' Regulations under the Central Bank Reform Act 2010 and 'Minimum Competency' Regulations under the Central Bank Act 1942
2. 'Standards for Business' Regulations under the Central Bank Reform Act 2010 and 'General Requirements' Regulations under the Central Bank (Supervision and Enforcement) Act 2013
3. 'Consumer Protection' Regulations under the Central Bank Act 1942 and 'Individual Accountability' Regulations under the Central Bank (Individual Accountability Framework) Act 2023
4. 'Standards for Business' Regulations under the Insurance Act 1936 and 'General Requirements' Regulations under the Central Bank Act 1942

The Code 2025 combines 'Standards for Business' Regulations made under the Central Bank Reform Act 2010 (as amended by the 2023 Individual Accountability Framework Act) with 'General Requirements' Consumer Protection Regulations made under section 48 of the 2013 Act; Fitness and Probity and Minimum Competency are separate, unrelated regulatory regimes. (Central Bank of Ireland, Consumer Protection Code 2025 framework; Central Bank (Supervision and Enforcement) Act 2013, s.48)

3. The Consumer Protection Code 2025 introduces a new central obligation requiring firms to place customers' interests at the heart of how they design, sell and explain financial products, supported by new safeguards against fraud and scams and protections for people in vulnerable circumstances. What is this new central obligation called?

1. Consumer Duty
2. Treating Customers Fairly
3. Securing Customers' Interests
4. Know Your Customer

The Code 2025's new central pillar is named 'Securing Customers' Interests'; 'Consumer Duty' and 'Treating Customers Fairly' are analogous UK regulatory concepts, not Irish Central Bank terminology, and 'Know Your Customer' refers to anti-money-laundering identification requirements. (Central Bank of Ireland, Consumer Protection Code 2025 / Consumer Hub 'Consumer Protection Code' (centralbank.ie))

4. The Consumer Protection Code requires a regulated entity, in all its dealings with customers, to observe a set of overarching standards (the Standards for Business). Which of the following is one of those overarching standards?

1. Acting honestly, fairly and professionally in the best interests of customers
2. Guaranteeing every customer an identical premium regardless of individual risk
3. Prioritising the entity's shareholders ahead of its customers
4. Selling only the products that earn the entity the highest commission

A core Standard for Business under the Code is that a regulated entity act honestly, fairly and professionally in the best interests of its customers; the other options contradict the Code's consumer-protection obligations. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Standards for Business)

5. Separately from the requirement to act honestly and fairly, the Consumer Protection Code requires a regulated entity to meet which further overarching standard when dealing with its customers?

1. To act only where doing so is profitable for the entity
2. To act with due skill, care and diligence in the best interests of its customers
3. To act solely on the written instructions of the customer
4. To act without regard to the customer's individual circumstances

The Code imposes a distinct standard to act with due skill, care and diligence in customers' best interests, separate from the honesty and fair-dealing standard. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Standards for Business)

6. Which standard of the Consumer Protection Code requires a regulated entity to make full disclosure of all relevant material information, including all charges, in a way that seeks to inform the customer?

1. The standard requiring the entity to act with due skill, care and diligence
2. The standard requiring reasonable assistance for a vulnerable consumer
3. The standard requiring the entity to act honestly and fairly
4. The disclosure standard requiring full disclosure of all relevant material information, including all charges

The Code's disclosure standard requires full disclosure of all relevant material information, including all charges, in a way that seeks to inform the customer; the other options describe separate standards on competence, vulnerable-consumer assistance and fair dealing. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Standards for Business)

7. A broker is assessing whether a small incorporated company falls within the Consumer Protection Code's definition of 'consumer'. The company had annual turnover of €2.8 million in its previous financial year and is not part of any group of companies. Does this company qualify as a consumer under the Code?

1. No, because incorporated bodies are always excluded from the Code's definition of 'consumer', regardless of turnover
2. No, because the €3 million turnover threshold applies only to natural persons, not incorporated bodies
3. Yes, because its turnover is within the €3 million threshold for an incorporated body outside any group
4. Yes, but only because it also qualifies as a personal consumer under the Code

An incorporated body qualifies as a 'consumer' where its annual turnover is €3 million or less and it is not part of a group with combined turnover above that figure; a personal consumer classification is irrelevant here since the company is not a natural person. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Definitions — 'consumer')

8. An accountant takes out a private motor insurance policy in his own name, entirely unconnected with his employment. Under the Consumer Protection Code, how is he classified in respect of this transaction?

1. A vulnerable consumer, requiring special assistance
2. A corporate consumer, outside personal cover rules
3. A consumer only, distinct from a personal consumer
4. A personal consumer, acting outside his profession

A personal consumer is a natural person acting outside his or her business, trade or profession, which describes the accountant buying private motor cover in a personal capacity; he is therefore a personal consumer, a specific category of consumer, not merely 'a consumer'. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Definitions — 'personal consumer')

9. An insurance intermediary is arranging a policy for a customer who has a significant hearing impairment but is otherwise fully able to understand the product and make her own decisions about it. Under the Consumer Protection Code, how must the intermediary treat this customer?

1. As a personal consumer only, since her decision-making capacity is unaffected by the impairment
2. As a vulnerable consumer, providing reasonable arrangements and/or assistance as the Code requires
3. As a vulnerable consumer, but only once a family member is appointed to act for her
4. As a consumer requiring a mandatory referral to the Financial Services and Pensions Ombudsman

A vulnerable consumer includes a person who has capacity to make decisions but, due to individual circumstances such as a hearing impairment, may require assistance; the Code requires the entity to provide reasonable arrangements and/or assistance accordingly. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Definitions and vulnerable-consumer requirements)

10. The Consumer Protection Code requires a regulated entity to gather and record sufficient information about a consumer before offering, recommending, arranging or providing a product or service. Which of the following is NOT one of the categories of information the Code's knowing-the-consumer requirement specifies?

1. The consumer's financial situation
2. The consumer's nationality
3. The consumer's needs and objectives
4. The consumer's attitude to risk

The knowing-the-consumer requirement covers needs and objectives, personal circumstances, financial situation and, where relevant, attitude to risk; nationality is not one of the specified categories. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), knowing-the-consumer requirements)

11. A broker offers a customer a selection of three income protection policies from different insurers, without specifically recommending any single one of them. Under the Consumer Protection Code's suitability requirements, what standard must this selection meet?

1. Only the option the customer ultimately purchases needs to be suitable
2. The options need only be authorised products, since no specific recommendation has been made
3. At least one option in the selection must be suitable, though not necessarily the most suitable
4. The options offered must be the most suitable available for that consumer

The Code requires that where a regulated entity offers a selection of options, those options must be the most suitable available to the consumer, not merely that one option happens to be adequate. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), suitability requirements)

12. A regulated entity has prepared a Statement of Suitability for a customer who is purchasing a whole-of-life policy. Under the Consumer Protection Code, what must the entity do with this statement?

1. Sign and date it, provide it to the consumer, and retain a copy
2. Retain it on file and provide it to the consumer only if requested
3. Read its contents aloud to the consumer, without providing a written copy
4. Email it to the consumer within 40 business days of completing the sale

The Code requires the Statement of Suitability to be signed and dated and given to the consumer, with a copy retained by the entity; the 40 business day figure instead relates to the maximum period for resolving a complaint, not to suitability statements. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), suitability requirements)

13. A regulated entity took 45 business days to investigate and resolve a customer's complaint, and provided the customer with a single progress update after 25 business days had elapsed. Under the Consumer Protection Code's complaints-handling requirements, which of these actions breached the prescribed timelines?

1. Neither breached the Code, since both actions occurred within the six-year record-retention period
2. Only the progress update breached the Code, as there is no maximum period for resolving a complaint
3. Both the 45 business day resolution and the progress update at 25 business days breached the 40 and 20 business day limits respectively
4. Only the 45 business day resolution breached the Code; a progress update at 25 business days is compliant

The Code caps investigation/resolution at 40 business days and requires progress updates at intervals of not greater than 20 business days, so both the 45-day resolution and the 25-day update exceed the prescribed limits. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), complaints-handling requirements)

14. Under the Consumer Protection Code, if a regulated entity has not resolved a customer's complaint within 40 business days, what must it do?

1. Automatically refer the complaint to the Financial Services and Pensions Ombudsman on the consumer's behalf
2. Close the complaint file and cease further correspondence with the consumer
3. Advise the consumer of the right to refer the matter to the Financial Services and Pensions Ombudsman
4. Escalate the complaint directly to the Central Bank of Ireland for adjudication

The Code requires the entity to advise the consumer of the right to refer an unresolved complaint to the Financial Services and Pensions Ombudsman; the entity does not refer the matter itself, and the Central Bank does not adjudicate individual complaints. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), complaints-handling requirements)

15. Under the Consumer Protection Code, for how long must a regulated entity retain records of an individual transaction after that transaction has been discontinued or completed?

1. Three years
2. Five years
3. Seven years
4. Six years

The Code sets a six-year retention period for records of individual transactions, running from discontinuance or completion of the transaction. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), record-retention requirements)

16. A personal consumer enters into a distance contract for a personal pension product over the phone. Under the European Communities (Distance Marketing of Consumer Financial Services) Regulations 2004, within how many calendar days of the contract may the consumer withdraw without penalty?

1. 21 calendar days
2. 10 business days
3. 14 calendar days
4. 30 calendar days

The standard cooling-off period for distance financial-services contracts is 14 calendar days, but this is extended to 30 calendar days for life assurance and personal pension contracts. (European Communities (Distance Marketing of Consumer Financial Services) Regulations 2004 (S.I. No. 853 of 2004))

17. An insurance intermediary holds a shareholding in one of the insurers whose products it sells, and separately is approached by two customers who both want to buy the last available unit of a unique property cover. Which two types of conflicts of interest must the intermediary's conflict of interest arrangements be designed to identify?

1. Conflicts between the firm and the Central Bank of Ireland, and conflicts between shareholders
2. Conflicts between employees only, not between the firm and its customers
3. Conflicts between the firm and its customers, and conflicts between one customer and another
4. Conflicts between competing insurers only, not between the firm and its customers

A regulated entity's conflict of interest arrangements must identify conflicts between itself and its customers (such as the shareholding) and conflicts between different customers (such as two customers competing for the same cover). (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), conflicts of interest requirements)

18. Under the Consumer Protection Code's requirements on conflicts of interest, once a regulated entity has identified a conflict of interest, what is its first obligation?

1. To disclose the conflict of interest to the consumer in writing
2. To refer the matter immediately to the Central Bank of Ireland
3. To avoid the conflict of interest where possible
4. To terminate the business relationship with the affected consumer

The Code's approach prioritises avoiding a conflict of interest where possible; disclosure is the fallback step used only where avoidance is not achievable, not the first response. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), conflicts of interest requirements)

19. An intermediary has a material conflict of interest arising from a commission arrangement with a particular insurer. It discloses this conflict to each affected customer in writing before giving advice but takes no further steps. Does this disclosure, by itself, discharge the intermediary's obligations under the Consumer Protection Code's conflicts of interest requirements?

1. Yes, disclosure in writing is always sufficient once the customer has been informed of a conflict of interest
2. Yes, provided the written disclosure is repeated again at the point of sale
3. No, because the Code prohibits regulated entities from ever accepting commission-based arrangements
4. Not necessarily, since disclosure does not itself discharge the duty to act in the customer's best interests

Disclosure is a required safeguard but does not by itself satisfy the entity's broader duty to manage the conflict and to act honestly, fairly and in the customer's best interests; commission arrangements are not outright prohibited. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), conflicts of interest requirements and Standards for Business)

20. Where a regulated entity cannot avoid a conflict of interest, the Consumer Protection Code requires it to disclose the conflict to the affected consumer in what manner?

1. Verbally at the point of sale, with no need to record any further detail
2. In writing, but only if the consumer specifically asks for such disclosure
3. After completion of the transaction, within the entity's annual customer statement
4. In writing, in good time before the service is provided, and in sufficient detail

The Code requires disclosure of an unavoidable conflict of interest to be made in writing, in good time before the product or service is provided, and in sufficient detail for the consumer to make an informed decision; it is not conditional on the consumer requesting it, nor deferred until after completion. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), conflicts of interest requirements)

21. A regulated entity allows an unmanaged conflict of interest to influence a recommendation made to a consumer, resulting in a product that favours the entity's own interests over the consumer's. Which requirement of the Consumer Protection Code does this most directly breach?

1. The knowing-the-consumer information-gathering requirement
2. The complaints-handling requirement
3. The disclosure-of-charges requirement
4. The overarching standard to act honestly, fairly and in the best interests of customers

Allowing an unmanaged conflict to override the consumer's interests most directly breaches the overarching standard requiring the entity to act honestly, fairly and professionally in the best interests of its customers; the other options address information-gathering, complaints handling and disclosure. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Standards for Business)

22. A tied insurance agent, contractually restricted to selling one insurer's products, recommends that insurer's policy to a customer even though a competitor's product would better suit the customer's needs, because the agent earns a higher commission on the recommended product. What has occurred here?

1. A breach of the six-year record-retention requirement rather than a conflict of interest issue
2. An unmanaged conflict of interest that has been allowed to override the customer's best interests
3. A vulnerable consumer issue requiring reasonable arrangements and/or assistance
4. A permitted exercise of the agent's tied status, which is not itself a conflict of interest

Letting a higher commission determine a recommendation, to the detriment of a more suitable competitor product, is a conflict of interest that has not been properly managed; being tied is not itself the problem, but allowing that commission incentive to override suitability is. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), conflicts of interest and suitability requirements)

23. Under the Consumer Protection Code, how must a regulated entity's arrangements for identifying and managing conflicts of interest be documented?

1. In the entity's marketing material provided to customers
2. Verbally, communicated to staff at induction only, with no written record required
3. In a written conflict of interest policy, maintained and operated by the entity
4. In the Statement of Suitability given to the consumer

The Code requires a regulated entity to maintain and operate a written conflict of interest policy; this is a distinct document from customer-facing marketing material or the Statement of Suitability. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), conflicts of interest requirements)

24. A broker earns significantly higher commission for selling Insurer A's income protection policy than for selling Insurer B's more suitable policy. The customer has a mild intellectual disability but is capable of making the decision with some assistance. Applying both the Code's conflicts of interest requirements and its provisions on suitability and vulnerable consumers, what must the broker do?

1. Recommend Insurer B's policy, but only after obtaining written authorisation from a family member
2. Recommend Insurer A's policy but disclose the higher commission earned, which satisfies all of the broker's obligations
3. Decline to provide any recommendation, since a customer with an intellectual disability cannot be advised under the Code
4. Manage the conflict by recommending the most suitable policy while providing reasonable assistance suited to the customer's circumstances

The broker must manage the commission-driven conflict so that the most suitable policy is recommended under the Code's suitability requirements, while also providing reasonable arrangements and/or assistance to the vulnerable consumer; disclosure of commission alone would not satisfy the suitability obligation. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), conflicts of interest, suitability and vulnerable-consumer requirements)

25. Under the Consumer Protection Code, an incorporated body qualifies as a 'consumer' for the purposes of the Code's consumer protections only where its annual turnover in the previous financial year does not exceed which threshold?

1. €1 million
2. €3 million
3. €5 million
4. €10 million

The Code defines an incorporated-body 'consumer' as one with annual turnover of €3 million or less in the previous financial year, provided it is not part of a group with combined turnover above that figure. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Definitions — 'consumer'.)

26. A sole trader takes out a professional indemnity policy to cover his consultancy business. For the purposes of the Consumer Protection Code, is he a 'personal consumer' in respect of that policy?

1. Yes, because he is a natural person and the Code treats every natural person as a personal consumer.
2. No, because a personal consumer must be a natural person acting outside his business, trade or profession.
3. Yes, because his business turnover falls below the €3 million consumer threshold.
4. No, because sole traders cannot be classified as personal consumers under the Code.

A 'personal consumer' is a natural person acting outside his business, trade or profession; since the policy relates to his consultancy business, he is not a personal consumer in respect of it. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Definitions — 'personal consumer'.)

27. A long-standing customer tells his broker that he has a significant hearing impairment but is otherwise well able to understand and decide on insurance matters unaided. Under the Consumer Protection Code, how should this customer be classified and treated?

1. He is not a vulnerable consumer, as the definition is limited to persons with restricted decision-making capacity.
2. He is a vulnerable consumer, and the broker must provide reasonable arrangements and/or assistance to facilitate him.
3. He is a vulnerable consumer, and the broker must decline to deal with him directly going forward.
4. He is not a vulnerable consumer, because he retains full capacity to make his own decisions.

The definition covers a person who has capacity to decide but, due to individual circumstances such as a hearing impairment, may require assistance; the Code obliges the broker to make reasonable arrangements. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Definitions and vulnerable-consumer requirements.)

28. An adviser is arranging private health insurance for a client with a moderate intellectual disability who needs a family member present to help him understand and finalise decisions. Which statement correctly reflects the adviser's obligations under the Consumer Protection Code?

1. The client falls outside the 'vulnerable consumer' definition, as intellectual disability does not affect decision-making capacity.
2. The client is a vulnerable consumer under the limited-capacity limb of the definition, and the adviser must provide reasonable arrangements and/or assistance.
3. The client is a vulnerable consumer only if, in addition, his annual turnover falls below the €3 million consumer threshold.
4. The client is a vulnerable consumer, but the Code imposes no additional obligation on the adviser beyond standard disclosure.

A person with limited capacity who requires assistance, such as someone with an intellectual disability, meets the second limb of the 'vulnerable consumer' definition, triggering the duty to provide reasonable arrangements and/or assistance. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), Definitions and vulnerable-consumer requirements.)

29. Before offering, recommending, arranging or providing a product or service, the Consumer Protection Code's knowing-the-consumer requirement obliges a regulated entity to gather and record sufficient information from the consumer covering which of the following?

1. Needs and objectives, personal circumstances, financial situation and attitude to risk where relevant.
2. Needs and objectives, marital status, employment history and country of residence.
3. Financial situation, credit history, tax residency and next of kin details.
4. Needs and objectives, previous claims history, occupation and preferred payment method.

The knowing-the-consumer requirement covers the consumer's needs and objectives, personal circumstances, financial situation and, where relevant, attitude to risk; the distractors substitute plausible but non-mandated categories. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), knowing-the-consumer requirements.)

30. A broker sells a with-profits investment-linked life policy to a customer without ever recording the customer's attitude to investment risk, relying only on the customer's stated needs and objectives. Which requirement of the Consumer Protection Code has most likely been breached?

1. The disclosure-of-charges requirement
2. The requirement to assist a vulnerable consumer
3. The knowing-the-consumer requirement
4. The complaints-handling requirement

The knowing-the-consumer requirement obliges the entity to gather and record the consumer's attitude to risk where relevant; for an investment-linked policy this is plainly relevant, so omitting it breaches that requirement, not the disclosure, vulnerability or complaints obligations. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), knowing-the-consumer requirements.)

31. Under the Consumer Protection Code, where a regulated entity offers a consumer a selection of product options rather than a single recommendation, the suitability requirement provides that:

1. Each option offered must be suitable, though not necessarily the most suitable available.
2. The options offered must be the most suitable available from the products the entity offers.
3. The options offered must simply be the cheapest products the entity has available.
4. The entity must inform the consumer that cheaper alternatives may exist elsewhere in the market.

Where a selection is offered, the options must be the most suitable available from the entity's own range, not merely 'suitable', cheapest, or accompanied by a market-wide disclosure. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), suitability requirements.)

32. A financial broker recommends one specific pension product to a client after assessing her needs. Under the Consumer Protection Code's suitability requirement, what standard must this recommended product meet?

1. It must be suitable for the client, even though other more suitable products may exist elsewhere in the market.
2. It must be the most suitable product for that client among those the broker offers.
3. It must be the cheapest suitable product available from the broker's panel of insurers.
4. It must simply not be demonstrably unsuitable for the client's stated objectives.

Where a single product is recommended, the Code requires it to be the most suitable for that particular consumer, a higher standard than merely 'suitable', cheapest, or 'not unsuitable'. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), suitability requirements.)

33. Prior to providing or arranging a product or service, the Consumer Protection Code requires a regulated entity to give the consumer a written statement of suitability that must be:

1. Signed and dated by the regulated entity, with a copy retained by the entity.
2. Verbally communicated and then confirmed by email within 20 business days.
3. Prepared after the consumer requests it in writing, rather than automatically for every sale.
4. Reviewed and pre-approved by the Central Bank of Ireland before it is issued.

The Code requires a signed and dated written statement of suitability, given to the consumer, with a copy retained by the entity — an automatic obligation, not one triggered by request or subject to prior regulatory approval. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), suitability requirements.)

34. An insurance broker arranges serious illness cover for a client but never issues a written statement of suitability, despite having gathered all the relevant information. Under the Consumer Protection Code, has the broker complied with the Code?

1. Yes, provided the information gathered under the knowing-the-consumer requirement is retained on the client file.
2. No, because the Code requires a signed and dated statement of suitability to be given to the consumer.
3. Yes, because suitability statements apply to investment products, not to insurance products.
4. No, because the policy must be cancelled and re-issued on revised terms.

The suitability requirement applies to insurance as well as investment products and requires a signed, dated statement of suitability to be given to the consumer; gathering information alone does not satisfy this separate obligation. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), suitability requirements.)

35. In addition to giving the consumer a signed and dated statement of suitability, the Consumer Protection Code requires the regulated entity to:

1. Retain a copy of the signed statement of suitability on the consumer's file.
2. Submit a copy of the statement to the Central Bank of Ireland within 5 business days.
3. Publish a summary of the statement on the entity's website.
4. Forward a copy of the statement to the Financial Services and Pensions Ombudsman.

The Code requires the entity to retain a copy of the statement of suitability; there is no requirement to file it with the Central Bank, publish it, or send it to the Ombudsman. (Central Bank of Ireland, Consumer Protection Code 2025 (in force from 24 March 2026), suitability requirements.)