FSPO Ireland — complaints, time limits and binding decisions

Ireland is the one major EU market where the financial ombudsman’s decision binds the firm and can only be challenged in the High Court. The Financial Services and Pensions Ombudsman — the FSPO — operates under the Financial Services and Pensions Ombudsman Act 2017, can direct compensation of up to €500,000, and can direct rectification with no cap at all. Sitting above it, the Central Bank’s Consumer Protection Code 2025 takes effect on 24 March 2026 and carries the complaint-handling obligations that decide how most cases look by the time they reach the ombudsman. This piece sets out the two layers, the time limits that actually bite, and three worked cases.

1. Two layers, two different risks

Irish complaint exposure is not one regime but two, and firms that conflate them get the sequencing wrong.

• The Central Bank of Ireland sets the conduct rules a regulated firm must follow when handling a complaint — acknowledgement, updates, a final answer, records. Breaching them is a supervisory matter, enforceable against the firm as a firm.
• The FSPO resolves the individual dispute after the firm’s own process has run. Its formal decision is legally binding on both sides. This is a redress risk, quantified in euros, per case.

The two interact in a way that is specific to Ireland: the quality of your Consumer Protection Code compliance is the evidence base the ombudsman reads. A firm that acknowledged late, updated nobody and issued no final response letter is not merely in breach of a code — it has handed the ombudsman a documented account of its own conduct, in its own records, before the merits are even reached.

2. Legal basis

• Financial Services and Pensions Ombudsman Act 2017 — constitutes the FSPO and its powers; section 51 carries the time limits for bringing a complaint.
• Central Bank (Supervision and Enforcement) Act 2013 — the enabling statute. The Consumer Protection Code 2025 is given effect through two sets of regulations made under it: the Standards for Business Regulations 2025 (section 17A) and the Consumer Protection Regulations 2025 (section 48).
• The revised Code was published on 24 March 2025 with a twelve-month implementation period and applies from 24 March 2026, replacing the 2012 Consumer Protection Code. The Central Bank has issued accompanying general guidance, including on errors and complaints handling.

The implementation period is the operationally relevant fact. A firm entering the Irish market in 2026 is building against the new instrument from the start; a firm already there is running a migration, and complaint handling is one of the workstreams where the old and the new sit close enough together to be missed.

3. The internal stage — the clocks that produce the paper trail

The Irish complaint-handling pattern is a sequence of written milestones, and each one is a document the ombudsman can later ask for.

The quick-resolution carve-out is the provision most often misapplied. A complaint fixed within five business days does not disappear; it still has to be logged and the log maintained. Firms that treat a same-week goodwill credit as “not a complaint” end up unable to show the ombudsman — or the supervisor — how often the same defect recurred, which is precisely the question a systemic-issue review asks.

4. The FSPO time limits

Section 51 sets limits that are more generous than most firms’ record-retention instincts, which is where the operational problem lies.

• The general rule: a complaint must be made to the FSPO within six years of the date of the conduct complained of.
• For a long-term financial service, or a complaint about a pension provider, the alternative limit is three years from the date the complainant became aware, or should reasonably have become aware, of the conduct.
• For long-term financial services the conduct must have occurred on or after 1 January 2002, and the service must not have expired more than six years before the complaint. For pension providers the conduct must have occurred on or after 13 April 1996.

Read the second bullet as a records requirement. A limit running from awareness rather than from the event means the relevant evidence can be a decade old by the time it is called for, and the firm that cannot produce the original disclosure, the call recording or the screen the customer saw is arguing about the merits without the facts.

5. Who can bring a complaint

The Irish definition of a consumer is wider than the word suggests, and this is the detail that catches business-facing fintechs.

• Individuals, and a surviving dependant of a consumer, plus specified categories such as legal representatives.
• Business complainants — a limited company, sole trader, trust, club, charity or partnership — qualify where turnover in the preceding financial year was €3 million or less.

A firm whose Irish book is entirely SME accounts is therefore not outside the ombudsman’s reach; most of that book is inside it. The €3 million turnover test is a field worth carrying in the customer record, because it decides whether a dispute is a commercial negotiation or a binding-decision risk.

6. What the ombudsman can actually order

This is where Ireland diverges most sharply from its neighbours. A Dutch or Belgian outcome persuades; an Irish one compels.

• Compensation of up to €500,000 for a financial service complaint, and €52,000 in the case of an annuity.
• Rectification — with no limit on the value the ombudsman can direct in order to fix or correct an issue. For a firm with a repeated pricing or interest-calculation defect, this is the larger exposure by a wide margin.
• Decisions are legally binding on both the complainant and the provider, and appealable only by way of statutory appeal to the High Court.
• The FSPO publishes decisions and can report on named providers.

Two consequences follow for governance. First, the provision a firm books against an Irish complaints pipeline is not the same calculation as elsewhere in the EU, because the outcome is enforceable rather than reputational. Second, the uncapped rectification power makes a single case about a systemic defect far more expensive than the sum of its individual claims — the remedy scales with the defect, not with the complainant.

7. Worked example — a recurring fee defect at an EMI

Facts: an electronic money institution serving Irish customers applies a monthly account fee that its terms say is waived above a balance threshold. A configuration error applies the fee to roughly 900 accounts over fourteen months. One customer, out €84, complains and is refunded within four days.

Which rule applies: the quick fix means the full internal procedure need not run — but the complaint must still be logged and the log maintained. Separately, once the firm knows the cause, this is an error affecting a population, not a customer-service event.

What the practitioner does: logs the case; then treats the log as the trigger for a root-cause review rather than a closed ticket. Quantifies the affected population, refunds it without waiting for complaints, and documents the decision. If a second customer reaches the FSPO instead, the firm wants to arrive with a completed remediation, not with a defence of the individual €84.

Outcome: the arithmetic is the argument. Nine hundred accounts at €84 is a manageable remediation; the same facts in front of an ombudsman who can direct uncapped rectification, with a published decision naming the provider, is a different order of cost for the same underlying error.

8. Worked example — the final response letter that lost the case

Facts: a customer disputes an unauthorised transaction. The firm investigates, concludes the transaction was authorised, and closes the matter with a short e-mail on day 47, having sent no acknowledgement and no updates. The customer goes to the FSPO.

Which rule applies: acknowledgement within five business days; updates during the investigation; resolution within forty business days or notification of the anticipated timeframe. Three separate milestones were missed before the merits are even in issue.

What the practitioner does: in the response to the ombudsman, does not argue that the process failures are irrelevant to the substance. They are relevant to credibility, and they are the part of the record the firm cannot improve retrospectively. What the firm can do is produce the authentication evidence, the device and session record, and the fraud-review notes, and be explicit about the process failures and what has changed since.

Outcome: the durable fix is a workflow that cannot skip a milestone — acknowledgement generated on case creation, a 40-business-day timer visible on the queue, and a final response letter that cannot be issued without the FSPO referral wording. The Irish regime rewards firms whose process runs itself and punishes firms where it depends on an individual remembering.

9. Worked example — the SME that was inside the perimeter

Facts: a payment institution declines to onboard an Irish company after screening, closes an existing account with two weeks’ notice, and treats the resulting dispute as a commercial matter between businesses. The company’s turnover is €1.6 million.

Which rule applies: a limited company with turnover of €3 million or less in the preceding financial year is a complainant the FSPO can hear. The firm’s premise — that a business customer has no ombudsman route — is simply wrong on the Irish threshold.

What the practitioner does: carries the turnover test as a field, flags business accounts under the threshold as ombudsman-eligible in the complaints workflow, and applies the same notice, reasoning and record-keeping discipline to them as to retail. Where an account is closed, records the reason in a form that can be explained to a third party without disclosing anything that must not be disclosed.

Outcome: the exposure that matters is the binding direction to rectify — in an access case, that can mean restoring a relationship the firm had decided to exit. Deciding closure policy without knowing which customers are ombudsman-eligible is deciding it blind.

FAQ

What to do, today

• Instrument the three clocks. Five business days to acknowledge, updates during investigation, forty business days to resolve or to notify an anticipated timeframe. Put them in the workflow tool, not in a procedure document.
• Rewrite the final response letter template as an adversarial exhibit: findings, evidence relied on, the decision, and the FSPO referral wording. Have someone outside the complaints team read one.
• Log the quick fixes. Same-week goodwill payments are complaints. Without them you cannot see a systemic defect, and the uncapped rectification power is what makes systemic defects expensive in Ireland.
• Add the turnover field to business customer records and flag accounts at or under €3 million as ombudsman-eligible.
• Check your retention against a six-year limit that can run from awareness rather than from the event — disclosures, call recordings and screens included.
• Close the 24 March 2026 migration with complaints handling named as its own workstream, not folded into a general conduct review.

Related: Complaints reporting compared across the EU · RBO Ireland — filing and access · Conduct complaints in Luxembourg — the CSSF route