What the Central Bank of Ireland's Consumer Protection Code 2025 means for brokers on WhatsApp: durable medium, informing effectively, DPC and record-keeping.
Irish brokers have been handling renewals, claims photos and "can you send me my cert" requests on WhatsApp for years, usually on whichever phone was nearest. The Central Bank of Ireland's revised Consumer Protection Code, published in March 2025 and in force since 24 March 2026, does not ban that habit. It does, however, make the firm accountable for it in a more explicit way than the 2012 Code did, because the new Code was written for a market where financial services are delivered through digital channels. This guide explains what changes for a brokerage that wants to keep WhatsApp as a client channel while staying on the right side of the Central Bank and the Data Protection Commission.
The Consumer Protection Code 2025 is made up of two instruments: the Standards for Business Regulations, which set high-level obligations on every regulated firm, and the Consumer Protection Regulations, which carry the detailed cross-sector rules plus sector-specific parts, including one for insurance. Firms had a twelve-month implementation period from 24 March 2025. Among the changes that matter for an intermediary:
Brokers Ireland, the representative body for more than 1,200 insurance, financial and mortgage broker firms, publishes compliance material for members on the new Code; for a small firm it is the fastest way to get a line-by-line reading of the insurance part. The Insurance Distribution Regulations 2018, which transpose the IDD, sit alongside the Code and are unchanged by it.
The Code, like the IDD, distinguishes between information that must be provided on a durable medium and ordinary communications. A durable medium is any instrument that lets the customer store information addressed personally to them, access it later for an adequate period and reproduce it unchanged. A WhatsApp thread on the client's phone arguably stores and reproduces a message, but the firm has no control over deletion and cannot demonstrate what the client still holds. The safe reading for a broker is this:
| Communication | WhatsApp alone? | Recommended practice |
|---|---|---|
| Terms of business, regulatory disclosures, statement of suitability | No | Email, client portal or paper, with the WhatsApp message pointing to it |
| Renewal notice and quotation | No | Durable medium within the Code's renewal timelines; WhatsApp reminder that it has been sent |
| Document requests, appointment confirmations, claim updates | Yes | Keep in the firm's archive with timestamps |
| Answer to a factual question (excess, renewal date, cert copy) | Yes | Answer from the client record, log the exchange |
| Advice or a recommendation | Not alone | Discuss in chat if needed, confirm in the written statement |
Renewal timing deserves a specific mention: the Code's insurance provisions require renewal notices to be issued a set number of working days before the renewal date (20 working days under the previous Code, with the 2025 Regulations adding earlier notification requirements for some products — check Part 4 of the Regulations for your lines). A WhatsApp reminder is a useful complement to that notice, never a substitute for it.
The Data Protection Commission is the supervisory authority for GDPR in Ireland, and the Data Protection Act 2018 gives it effect. For a brokerage, three points decide whether WhatsApp is defensible:
ORIS keeps consent records and opt-outs against each customer, applies an automatic stop on STOP-type keywords and tags each campaign as service or marketing, which gives the data protection officer a clean audit trail without a separate spreadsheet. The same discipline is described for another market in our guide to compliance and regulation.
The Code requires regulated firms to keep records that demonstrate compliance, and the default retention period for consumer records is six years from the end of the relationship or transaction (the 2025 Code shortens the period for quotes and offers the customer did not take up). When a customer brings a complaint to the Financial Services and Pensions Ombudsman, the broker's file is the evidence: the renewal notice, the statement of suitability, and the conversation in which the customer asked for a change. If part of that conversation was on WhatsApp, it must be retrievable in full, with dates and authorship, not as screenshots from someone's phone. A firm-level archive, exportable on request, is the practical answer; our note on archiving WhatsApp for a complaint covers the mechanics in a UK context that transfers almost unchanged.
The Code does not list permitted channels. It sets requirements on clarity, timing, durable medium and record-keeping that the firm must meet whatever the channel. A firm-controlled WhatsApp Business setup with proper archiving can meet them; a personal phone generally cannot.
No. The renewal notice must be provided on a durable medium within the timelines in the insurance part of the Code. WhatsApp is appropriate for telling the client the notice has been sent and for reminders as the renewal date approaches.
Servicing messages about a live policy rest on the contract rather than marketing consent, but Meta's rules require the client to have opted in to WhatsApp messages from your business. Record that opt-in and keep marketing messages on a separate, consent-based footing.
Apply the same retention period as the rest of the client file, which under the Code is generally six years from the end of the relationship. Shorter periods apply to quotes the customer never took up under the 2025 Code, so align the archive with the firm's retention schedule rather than a fixed rule of thumb.
Incorporated clients with annual turnover under €5 million are now consumers under the Code. Commercial brokers should re-classify clients close to the old €3 million threshold and apply consumer-level protections to their renewals and communications.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
A marketing message sent to a segment of your book is a financial promotion. What ICOBS 2.2, the Consumer Duty and FG24/1 require inside a WhatsApp message.
PROD 4 makes your commission part of what the customer pays. What a small UK brokerage has to assess, review and be able to show — and where the proof sits.
How a UK brokerage archives client WhatsApp conversations under SYSC 9 and ICOBS, sets a retention policy, handles personal devices and exports evidence for the FOS.
