Conduct supervision in an evolving financial system

29th October 2026 

Key takeaways 

•    Consumer protection is a core pillar of the Central Bank of Ireland’s mission to maintain financial stability and serve the public interest. Our integrated supervisory framework brings conduct, prudential and financial crime perspectives together to identify and address underlying issues affecting consumers. 
•    The modernised Consumer Protection Code reinforces firms’ responsibility to secure customers’ interests throughout their business.
•    Our complaints and fraud supervisory work show the importance of identifying underlying weaknesses, seeking to prevent recurring harm and collaborating beyond the regulatory perimeter.
•    The continuing challenge is for firms to deliver lasting improvements in consumers’ experiences and outcomes.
 

Consumer protection in an evolving supervisory framework 

Consumer protection sits at the heart of everything we do at the Central Bank of Ireland. Our mandate combines monetary and financial stability with ensuring that the financial system operates in the best interests of consumers and the wider economy. These responsibilities are closely connected. Households need dependable payments, appropriate credit and insurance, and confidence that their savings and investments are being treated fairly. The financial system fulfils its economic purpose when it delivers these services sustainably.¹ 

From a supervisory perspective, a firm's financial resilience and its treatment of customers are interconnected. Operational failures prevent people accessing their money; repeated poor sales practices generate substantial remediation costs. But inversely, customer treatment often reveals weaknesses in governance, risk management, or business model. By examining these issues holistically, supervisors gain a more complete understanding of the firm and the risks it presents.

Digitalisation adds urgency to this task. It can make financial services easier to access and reduce costs, but it also changes how products are marketed, decisions are made and customers receive support. Our 2026 Regulatory and Supervisory Outlook identifies customer experience, digitalisation and financial crime as central areas of focus in securing consumer and investor interests.² Supervisors must understand how these developments affect people in practice, including those who find it difficult to navigate increasingly digital services.

The question is how to make those connections part of everyday supervisory work. At the Central Bank, our response has been to embed conduct supervision within a more integrated framework. This article considers that evolution and illustrates it through two areas of our work: customer complaints and frauds and scams. Both demonstrate why understanding the causes of harm is essential to preventing it from recurring.

Embedding conduct in integrated supervision

We supervise across four safeguarding outcomes: protecting consumer and investor interests, ensuring the safety and soundness of firms, protecting the integrity of the financial system, and safeguarding financial stability.³

Those outcomes are longstanding. The change is in how we organise and carry out the work to achieve them. 

From January 2025, we moved to an integrated supervisory model. By infusing conduct supervision directly into sectoral directorates covering Banking and Payments, Insurance, and Capital Markets and Funds, we brought together supervisory responsibilities that were previously organised separately. 

By integrating conduct supervision within sectoral teams, we bring together different expertise to identify and target the risks that most impact users of financial services.

Consider a firm introducing a new digital service. Conduct supervisors will be interested in whether customers understand it, whether its design supports appropriate decisions and whether assistance is available when needed. Other supervisory perspectives may identify weaknesses in change management or dependence on a third-party provider. Bringing those perspectives together can help identify the source of a problem earlier and inform a response that addresses its wider consequences.

Integration must preserve specialist knowledge and clear responsibility for consumer protection. Bringing teams together is useful only if it improves their ability to recognise and act on risks. It also requires a common understanding of priorities, so that a material conduct issue receives attention on its own merits, including where a firm appears financially sound.

Our framework is guided by five principles: outcomes focused, risk based, judgement led, forward looking, and firms’ responsibilities. These principles direct attention towards the risks that matter most, support timely intervention and place primary responsibility for managing risks with firms’ boards and management. Sectoral supervision is complemented by more intensive, close and continuous supervision of firms whose impact on our safeguarding outcomes warrants it.⁴

For conduct supervision, this means examining what customers experience and what that tells us about the business. It also means using judgement to assess emerging harm before it is fully reflected in a backward-looking measure. A small number of complaints about a new product, for example, may warrant attention if they reveal a design weakness that could affect many customers. 

Connecting regulatory requirements to customer outcomes 

The modernised Consumer Protection Code, which took effect on 24 March 2026, provides an important foundation for this approach. It strengthens expectations around securing customers’ interests and responds to changes in financial services, including digital delivery, consumer vulnerability and exposure to frauds and scams.⁵

For firms, securing customers’ interests has implications throughout the business. Product design, sales incentives, communications and customer support all shape the outcome a person receives. A policy approved by a board has limited value if the commercial decisions made elsewhere in the organisation work against it.

For supervisors, the task is to assess how requirements are reflected in those decisions. Evidence may include product reviews, customer interactions and the information reaching senior management. Where outcomes are poor, the relevant questions include who knew about the issue, what action was taken and whether the same weakness exists elsewhere in the business.

An outcomes-focused approach requires clear, enforceable rules and effective supervision. However, as my colleague Mary-Elizabeth McMunn has emphasised, regulation alone cannot deliver the outcomes we seek.⁶ Supervisory challenge is needed to establish whether a firm’s arrangements work, and remediation must address the underlying issue. Firms remain responsible for determining how to meet their obligations and for demonstrating that they have done so.

Using complaints to improve customer service

Complaints provide a direct insight into the customer experience. They can reveal weaknesses that would be difficult to identify from a review of policies alone. Our July 2026 cross-sectoral review examined complaints handling in domestic life and non-life insurance, retail intermediaries, payment institutions and electronic money firms. 

What we have learned from these exercises is that effective customer engagement requires three critical elements: accessible and reliable communication channels; high-quality direct engagement; and robust complaint identification and handling. Where firms take corrective action to address consumer complaints, the benefits are clear. Quicker complaints resolution. Improved staff engagement. Enhanced operational efficiency. Stronger customer satisfaction and loyalty. This is what the Central Bank expects from the firms we supervise.⁷

Our review highlighted the need for firms to look beyond individual complaints and understand why problems were occurring. Resolving an individual complaint does not necessarily address the underlying problem in the firms’ processes. Firms need to consider whether the same issue could affect other customers and what changes are needed to prevent it happening again.

This is where integrated supervision can help. A problem first identified through complaints may also raise questions about how a firm manages its operations or introduces changes. Bringing these perspectives together helps supervisors assess what needs to improve across the business.

The expectation is that firms resolve individual cases and use what they learn to prevent further harm. This is a question of governance and accountability as well as service quality. The board and senior management need information that allows them to distinguish an isolated error from a recurring weakness. Responsibility for corrective action must be clear, and its effectiveness should be assessed after implementation.

For supervisors, complaints data also needs careful interpretation. A low complaint count may reflect good service, but it may reflect difficulty accessing the complaints process. An increase could indicate deteriorating service or better recognition of dissatisfaction. Numbers therefore need to be considered alongside case evidence and an understanding of the firm’s business. This is where data and supervisory judgement reinforce each other.

Tackling fraud within and beyond the regulatory perimeter 

Complaints illustrate why supervisors need to look across a firm’s activities. Frauds and scams show why consumer protection also requires action beyond the individual firm. The harm to an individual may involve several organisations and cross-national borders. A criminal can advertise through an online platform, impersonate a legitimate provider and move the victim’s money through payment accounts. Each organisation may see only part of the activity.

Within the regulatory perimeter, firms must manage the risks arising from their activities and support affected customers. Our 2026 Regulatory and Supervisory Outlook sets out our focus assessing fraud controls in banking and payments, firms’ responses to incidents and their treatment of customers.² The Consumer Protection Code also introduces requirements for firms to counter fraud risks, inform consumers and support those who fall victim.⁵

Examining prevention and the response to harm together is valuable. Transaction monitoring and customer support involve different capabilities, but both affect the customer’s outcome. A technically sophisticated control framework can still leave a victim struggling to reach someone who can act. Supervisory assessment needs to consider how the arrangements function across the customer’s experience.

Protecting consumers also requires action against unauthorised providers and the channels through which they reach people. In April 2025, the Central Bank was granted Trusted Flagger status under the Digital Services Act. Within our designated expertise in financial frauds, scams and unauthorised financial services, this enables us to submit notices of suspected illegal content that relevant online platforms must prioritise and address promptly.⁸

Our first activities report, published in April 2026, records 333 URLs reported between 2 April and 31 December 2025. That total includes notices submitted through the Trusted Flagger regime and other Digital Services Act reporting channels. The report also explains why removing content after it appears must be complemented by effective measures to prevent unauthorised financial advertising reaching consumers in the first place.⁹

This work illustrates how consumer protection and the integrity of the financial system meet. It also shows the limits of a response confined to regulated financial firms. Online platforms and telecommunications providers have distinct roles, as do law enforcement agencies. Cooperation can make those roles more effective, while responsibility for each organisation’s own controls remains clear.

Clear ownership of responsibilities and coordinated action are essential to this response. The same is true of conduct supervision. Information about a threat needs to reach those able to act on it, through appropriate legal channels and safeguards. The public benefit comes from preventing further loss and disrupting the activity, rather than from any one institution completing its part of a process in isolation.

Assessing whether the new approach is effective

An integrated structure creates the opportunity for better supervision. Demonstrating that it produces better outcomes is the continuing task. The OECD’s 2024 review found our financial consumer protection supervisory functions well aligned with international principles, while recommending further improvements in areas including effectiveness measurement, consumer engagement and the use of data.¹⁰

That assessment needs to extend beyond completion of an action plan. We need to establish whether corrective measures work in practice and whether improvements are sustained over time.

Consumer experience should inform the evidence we use. Management information can show processing times and error rates, while examination of individual cases can reveal whether a customer understood the response or received appropriate help. Different sources may point in different directions. Understanding those differences is necessary to reach a sound judgement.

Success should be visible in consumers’ everyday dealings with financial firms, particularly when something goes wrong. That is where the benefits of integrated supervision must be felt. ¹¹

Endnotes

1. Colm Kincaid 24 March 2026 Consumer Protection at the Heart of Our Mission. Source
2. Central Bank of Ireland Regulatory and Supervisory Outlook 2026 especially pages 7 and 31. Source
3. Central Bank of Ireland Transforming Regulation and Supervision. Source
4. Central Bank of Ireland May 2026 Our Approach to Supervision especially pages 7 to 9. Source
5. Central Bank of Ireland 24 March 2026 How the Consumer Protection Code Secures Your Interests. Source
6. Mary-Elizabeth McMunn 9 March 2026 Regulating with purpose. Source
7. Central Bank of Ireland July 2026 Customer Experience through the Lens of Customer Complaints especially pages 4 to 6 and 15. Source
8. Central Bank of Ireland Trusted Flagger Frauds and Scams. Source
9. Central Bank of Ireland April 2026 Report on activities under the Digital Services Act especially pages 4 to 7. Source
10. OECD 2024 Financial Consumer Protection in Ireland A Review of the Central Bank of Ireland Supervisory Functions. Source
11. My thanks to Kayla Collins for her help in preparing this article. 

To comment, please go to the discussion forum