APPLICATION PAPER ON
APPROACHES TO CONDUCT OF BUSINESSSUPERVISIONOCTOBER 2014

About the IAISThe International Association of Insurance Supervisors (IAIS) is a voluntary membershiporganisation of insurance supervisors and regulators from more than 200 jurisdictions innearly 140 countries. The mission of the IAIS is to promote effective and globally consistentsupervision of the insurance industry in order to develop and maintain fair, safe and stable
insurance markets for the benefit and protection of policyholders and to contribute to global
financial stability.
Established in 1994, the IAIS is the international standard setting body responsible fordeveloping principles, standards and other supporting material for the supervision of theinsurance sector and assisting in their implementation. The IAIS also provides a forum forMembers to share their experiences and understanding of insurance supervision andinsurance markets. In addition to active participation of its Members, the IAIS benefits from
input in select IAIS activities from Observers representing international institutions,professional associations and insurance and reinsurance companies, as well as consultants
and other professionals.
The IAIS coordinates its work with other international financial policymakers andassociations of supervisors or regulators, and assists in shaping financial systems globally.
In particular, the IAIS is a member of the Financial Stability Board (FSB), founding member
and co-parent of the Joint Forum, along with the Basel Committee on Banking Supervision(BCBS) and the International Organization of Securities Commissions (IOSCO), member of
the Standards Advisory Council of the International Accounting Standards Board (IASB), andpartner in the Access to Insurance Initiative (A2ii). In recognition of its collective expertise,
the IAIS also is routinely called upon by the G20 leaders and other international standard
setting bodies for input on insurance issues as well as on issues related to the regulationand supervision of the global financial sector.

About IAIS Application Papers
Application Papers provide additional material related to one or more Insurance Core
Principles, including actual examples or case studies that help practical application ofsupervisory material. Application Papers could be provided in circumstances where thepractical application of principles and standards may vary or where their interpretation andimplementation may pose challenges Application Papers can provide further advice orrecommendations to supervisors on how supervisory material may be implemented.

This paper was prepared by the Market Conduct Working Group in consultation with IAIS
Members and Observers.
The publication is available free of charge on the IAIS website (www.iaisweb.org).
© International Association of insurance Supervisors [2014]. All rights reserved. Brief
excerpts may be reproduced or translated provided the source is stated.

Application paper on approaches to conduct of business supervision
Contents
1.
1.1.
1.2.
1.3.
2.
2.1.
2.2.
2.3.
2.4.
2.5.
2.6.
2.7.
3.
3.1.
3.2.
3.3.
3.4.
3.5.
3.6.
3.7.
3.8.
4.
4.1.
4.2.
4.3
4.4.
4.5.
4.6.
4.7.
4.8.
5.
5.1
5.2
5.3

Introduction ................................................................................................................ 4
Background and purpose ........................................................................................... 4
IAIS survey on approaches to COB supervision ......................................................... 4
Structure of this application paper .............................................................................. 5
Approaches to the COB supervision mandate ............................................................ 6
Defining and scoping “COB supervision” .................................................................... 6
Specific factors to consider in defining and scoping the COB mandate ...................... 6
Monitoring COB risks................................................................................................ 12
Jurisdiction specific context and conditions .............................................................. 13
Principles-based vs. rules-based approaches to COB supervision ........................... 15
Features of COB supervision.................................................................................... 16
Resourcing and capacity implications ....................................................................... 19
Aspects of COB supervision with reference to ICP 9 ................................................ 21
Risk-based supervisory framework ........................................................................... 21
Supervisory cooperation ........................................................................................... 23
Supervisory Powers.................................................................................................. 24
Sources of information.............................................................................................. 25
Supervisory reporting and off-site monitoring ........................................................... 26
On-site inspection ..................................................................................................... 29
Supervisory feedback and follow-up ......................................................................... 31
Other responses to issues identified ......................................................................... 34
ICP 19 and approaches to off-site monitoring and on-site inspection........................ 37
Fair treatment policies, procedures and culture ........................................................ 37
Product development................................................................................................ 39
Product promotion and disclosure ............................................................................ 41
Advice and conflicts of interest ................................................................................. 44
Post-sale servicing and information .......................................................................... 46
Claims ...................................................................................................................... 48
Complaints ............................................................................................................... 50
Privacy protection ..................................................................................................... 53
Other supervisory tools and approaches to COB supervision ................................... 55
Behavioural economics ............................................................................................ 55
Communication with industry and consumers ........................................................... 55
Other approaches..................................................................................................... 56

Application paper on approaches to conduct of business supervision
October 2014

Page 3 of 59

1.

Introduction

1.1. Background and purpose
1. The IAIS Insurance Core Principles (ICPs) recognise the insurance regulatory andsupervisory system’s dual purposes of protecting policyholder interests and contributing to
the stability of the financial system 1. Historically, insurance supervisors sought to protect
policyholder interests mainly by focusing on the financial soundness of individual insurers
and, in more recent times, extending this focus to the financial soundness of insurancegroups and conglomerates. Although it has also long been recognised that supervisorysystems should also protect consumers from unfair or abusive business practices, this has
typically been regarded as secondary to maintaining financial soundness.
2. The global financial crisis highlighted the importance of not only monitoring threats toindividual institutions or groups, but actively monitoring risks to the stability of the financial
system as a whole. The crisis demonstrated that systemic risks can arise not only throughfailings in individual institutions’ and groups’ financial and capital management, but also inpoor conduct of business (COB) practices. The indiscriminate marketing and poorly targeted
sales of sub-prime mortgage products is a well-documented example of how COB failings
can contribute to systemic financial instability.
3. The crisis and its aftermath have highlighted the need for financial services consumers
to have trust in the financial sector. This trust entails both confidence in the soundness ofinstitutions, and confidence that institutions will act in their customers’ best interests andtreat them fairly. Accordingly, financial sector policy makers recognised the need to ensurethat regulatory and supervisory frameworks adequately address both prudential and COB
risks. This includes risks inherent in the sectors and institutions they supervise, and the interrelationships between these risks.
4. Poor COB practices and unfair treatment of policyholders have major implications forindividuals, but these can also be indicators of underlying financial issues within an insurer.
Supervisors must have tools to detect as soon as possible any COB risks that could
negatively impact individual policyholders, insurers and, potentially, the financial system as awhole.
5.
Against this background, in 2012 the IAIS revised ICP 9 (Supervisory review andreporting) highlighting the need for insurance supervisors to focus on COB and policyholder
protection, in addition to prudential and financial soundness issues.
6.
This Application Paper documents ideas on the scope of, and approaches to, COB
supervision that IAIS members may wish to consider when implementing the related
components of ICP 9, as well as supervising compliance with the requirements of ICP 19(Conduct of business), and incorporating them into their broader supervisory frameworks.
1.2. IAIS survey on approaches to COB supervision7.
In preparation for the drafting of this paper, the IAIS Market Conduct Subcommittee(MCSC) surveyed IAIS Members in 2013 (“the COB survey”), asking questions relating totheir jurisdiction’s framework. Forty-four IAIS Member authorities participated in the survey.
Among them 39 authorities are responsible for both prudential and COB supervision, and 5
for prudential supervision only. The survey covered:•supervisors’ mandates•

cooperation between prudential and COB supervisors•

supervisory review and reporting on COB matters

1 See the introductory paragraph to the ICP’s.
Application paper on approaches to conduct of business supervision
October 2014

Page 4 of 59

•supervisory powers and information sources•

general approaches to COB supervision.

8.
Various examples of COB supervisory approaches discussed in this paper are drawn
from the survey responses. Relevant aspects of survey responses are highlighted orsummarised in text boxes headed “COB survey responses”.
1.3. Structure of this application paper
9.

This paper is structured as follows:•

Section 2 discusses different approaches to defining and determining the scope of asupervisor’s COB mandate. It also discusses how certain jurisdiction-specific context
and conditions influence the COB supervisory approach.

•

Section 3 follows the sequence of ICP 9. Subsections 3.1 to 3.7 discuss each of the
ICP 9 standards and their supporting guidance from the perspective of COB
supervision.

•

Section 4 elaborates on possible approaches to off-site monitoring and on-site
inspection from a COB perspective. These are discussed with reference tosupervising the fair treatment of customers at various stages of the insurance productlife cycle, as contemplated in ICP 19. In presenting the approaches, Section 4
distinguishes between (i) specific requirements that may be set by the supervisor; (ii)the governance processes within insurers that supervisors may monitor to determine
whether these supervisory requirements are being met; and (iii) specific insurer
activities that supervisors may monitor in determining whether the supervisory
requirements are being met.

•

Section 5 discusses some additional potential COB supervisory tools andapproaches that some jurisdictions have adopted, which may also be of interest to
jurisdictions developing or reviewing their approach to COB supervision.

•

Annex I contains references to other international standards and jurisdiction-specificmaterial applicable to COB supervision.

Application paper on approaches to conduct of business supervision
October 2014

Page 5 of 59

2.

Approaches to the COB supervision mandate

2.1. Defining and scoping “COB supervision”
10. Approaches to COB supervision differ by jurisdiction, as reflected in their insurance
supervisory frameworks and their broader financial sector supervisory frameworks.
Jurisdictions may not use the term “COB”, or where they do use the term, they may define orinterpret it in different ways. Nevertheless, typically the supervisory authority will – either
explicitly or implicitly – be required to supervise the manner in which insurers conduct theirbusiness in relation to policyholders.
11. The introductory guidance to ICP 192 describes conduct of insurance business as“primarily concerned with the fair treatment of customers”, and it is in this sense that the term
“COB” will be discussed in this paper.
COB survey responses
Respondents were asked whether their authority has a COB supervision mandate, and if so,whether and how this mandate is defined and addressed in legislation.
Responses indicated varying degrees to which COB supervision mandates are explicitly
addressed, with most describing the COB supervision mandate with reference to thesupervisor’s overall enabling or founding legislation. In a number of cases, the COB
supervision mandate appears not to be explicitly set out, but is implicit in the sense that thelegislation governing insurers sets out certain COB obligations for insurers themselves, andthe supervisor is in turn mandated to supervise compliance with those obligations.
Examples of more explicit COB mandates or definitions from the survey responses include:•

A mandate to supervise elements described as “business practices”; “recognised
principles of orderly business activities”; “fair treatment of customers”; “soundcommercial practices”; “fair dealing”; “responsible, diligent and respectful management of
the interests of clients”; “business-to-consumer commercial practices”; and similar terms.

•

Mandates entailing supervision of adherence to specific documented businessstandards, good practices or codes of conduct, and/or prohibitions of specificdocumented instances of poor practice or unfair treatment.

•

Mandates requiring supervisors to actively monitor and intervene in cases of abuse or
improper, detrimental or unfair conduct.

•

General mandates referring explicitly to policyholder or consumer protection as thesupervisor’s responsibility.

•“Twin Peaks 3” models of financial supervision where the market conduct “peak” has an
explicit COB supervision mandate.

•

The supervisor’s mandate including an obligation to supervise compliance with ageneral, overarching consumer protection law, over and above supervising compliancewith specific insurance/financial services specific COB laws.

2.2. Specific factors to consider in defining and scoping the COB mandate
12. Jurisdictions need to consider how broad a mandate it should give the supervisory
authority with respect to COB. For example, it could include:

2 See ICP 19.0.6.
3 The term “Twin Peaks” is used to describe supervisory models where prudential supervision and market
conduct or COB supervision are allocated to separate authorities.
Application paper on approaches to conduct of business supervision
October 2014

Page 6 of 59

•broader “market conduct” supervision•consumer education and/or financial literacy•

financial inclusion•

promotion of competition•

combating financial crime•

independent dispute resolution.

Each of these is discussed below.
2.2.1 Is COB supervision a sub-component of a broader “market conduct” mandate?
13. In some cases, the term “market conduct supervision” is used interchangeably with
“COB supervision”. In these cases, both the supervision of COB (in the “customer treatment”
sense) and the supervision of market efficiency and integrity are seen as sub-components ofa broader “market conduct” mandate.
14. Other jurisdictions consider “market conduct supervision” to be separate - focussed onmarket efficiency and integrity through supervising issues such as disclosures to thefinancial markets, financial market infrastructures (e.g. securities or other exchanges),
insider trading and market abuse, and related activities.
15. Regardless, the approach should reflect the scope and objectives of the supervisor’s
COB mandate. Where different supervisors are responsible for COB and market
efficiency/integrity supervision, it is important to ensure that the responsibilities areappropriately delineated and coordinated. Where the supervisor supervises bothdimensions, the framework should be structured to ensure each component enjoys
appropriate priority.
COB survey responses
Respondents were asked whether their COB supervision mandate extended to supervisingmarket efficiency and integrity (for example the supervision of disclosures to the financial
market, trades on securities exchanges, monitoring of insider trading and market abuse,etc.).
Approximately half the survey respondents answered “Yes”, in most cases because theinsurance supervisor forms part of an agency that is also responsible for the supervision offinancial markets infrastructures (such as securities exchanges and clearing and settlement
facilities). Those respondents who answered “No” to the question typically indicated that thesupervision of financial markets infrastructures falls under a separate agency or, even where
it fell under the same agency, regarded this as a separate mandate from the COB mandate.
In some cases, it appears from survey responses that, although the insurance COB
supervisor is not necessarily also the supervisor of financial markets infrastructures, the
COB supervisor sees its mandate as including the market efficiency and integrity of insurers
through supervising market disclosures by insurers and/or through its overall supervision of
insurers’ risk management processes.
2.2.2 Does the COB mandate include responsibility for consumer education and/or
financial literacy?
16. A key objective of COB supervision is to protect consumers from potential abusearising from the asymmetry of information between consumers and financial institutions. In
jurisdictions where consumers have low financial literacy levels, the risk of such abuse isexacerbated.

Application paper on approaches to conduct of business supervision
October 2014

Page 7 of 59

17. ICP 19.13.4 provides guidance on how the supervisor should promote consumers’
understanding of insurance contracts. It sets out steps consumers can take to protect
themselves and make informed decisions.
18. A number of jurisdictions confer a financial literacy mandate on the insurance
supervisor to complement its COB mandate. The supervisor may be explicitly tasked with
developing and implementing consumer education and financial literacy programmes, ormay be indirectly required to support broader sectoral or jurisdictional strategies in thisregard.
19. In a number of cases, agencies adopt multiple approaches to consumer education,
including developing and disseminating their own materials and programmes, sometimes inpartnership with other stakeholders.
COB Survey Responses
Respondents were asked whether their COB mandate includes responsibility for consumer
education and/or financial literacy. They were also asked whether they believe thatsupervisors should play a role in financial education and what their authority is currently
doing or planning in this regard.
Approximately half the survey respondents indicated that they do have a consumer
education and/or financial literacy mandate, although the mandate is expressed in different
ways. Examples of how such mandates are fulfilled include:•

operating dedicated financial consumer education services such as dedicated websites•

establishing a dedicated consumer education department/function within the agency•

making consumer education material available on the agency’s normal website•

supporting and participating in broader financial literacy strategies and joint consumer
education initiatives with the financial services industry and/or consumer representative
bodies•arranging targeted financial consumer education campaigns on specific consumer risks
or for classes of vulnerable consumers•

designing financial education programmes aimed at school pupils, university students
and/or teachers, typically together with the formal education authorities and in somecases including academic prizes or bursary offerings•

including a focus on the financial education of intermediaries.

Different approaches to the funding of the consumer education/financial literacy mandate,where applicable, are used. These include requiring the supervisor to budget for suchprogrammes through its normal sources of funds; explicit fiscal grants; a requirement toallocate some or all income from administrative fines to consumer education funding; thepower to charge regulated institutions a specific consumer education levy; or approachingindustry or other donors for voluntary contributions. In some cases the supervisor operates
or supports dedicated financial consumer education funds/trusts/similar structures to financefinancial consumer education initiatives.
Where respondents stated that they do not have a consumer education/financial literacy
mandate, this was in some cases due to the existence of a separate authority being
responsible for financial consumer education in the jurisdiction. A number of respondents
indicated that, even where they have no explicit consumer education mandate, they carryout some consumer education activities nonetheless.
2.2.3 Does the COB mandate include responsibility for financial inclusion?

Application paper on approaches to conduct of business supervision
October 2014

Page 8 of 59

20. Some COB supervisory mandates include a level of responsibility for ensuring
increased access to insurance products or services for consumers. This mandate issometimes related to the consumer education and financial literacy responsibility. The
supervisor’s role may be set out in an explicit mandate, or may be less direct requiring thesupervisor to support broader financial inclusion policy objectives.
21. Without compromising the level of protection provided to consumers, supporting
financial inclusion could include:•

taking steps to enhance inclusion (for example creating micro-insurance products
and frameworks, or even setting specific inclusion targets)•ensuring that supervisory and regulatory frameworks do not present barriers toinclusion (for example creating customised, less burdensome licensing andsupervisory frameworks for insurers and intermediaries operating in markets
focussed on inclusion)•

allowing sufficient flexibility for the use of innovative approaches in the provision offinancial services.

COB Survey responses
Respondents were asked whether their COB mandate includes responsibility for financial
inclusion.
Only a minority of respondents indicated that they have an explicit financial inclusion
mandate, albeit expressed in different ways. In a number of these cases, the financial
inclusion activities were closely aligned with the consumer education mandates andinitiatives discussed above. In some cases, financial inclusion was seen as being achieved
through measures to prevent discriminatory or exclusionary underwriting practices. Somejurisdictions indicated that a dedicated micro-insurance policy was in place to address
inclusion objectives.
Cases where this question was answered “No” were supported by explanations that thejurisdiction is primarily a wholesale market, or that access to insurance is already at a highlevel in the jurisdiction so there is less need for a specific inclusion objective. Some
respondents indicated that, although they have no explicit consumer education mandate, theagency promotes inclusive practices nonetheless, while others indicated that explicit
financial inclusion objectives are to be implemented shortly.
2.2.4 Does the COB mandate include promotion of competition in the industry?
22. COB approaches vary from conferring an explicit mandate on the supervisor topromote competition (i.e. on price and quality that benefits consumers), to requiring thesupervisor to have due regard to competition.
23. Supervisors may need to find a balance between conduct supervisory and regulatory
requirements and competition that promotes consumer protection objectives. For example,
an insurance supervisor, who has the authority to approve product structures or to prescribe
product features, needs to balance this authority against the risk of stifling innovation andcompetition. Where the supervisor has the authority to prescribe standardised productdisclosures (such as standardised “key information” templates), care may need to be taken
to ensure that the level of standardisation is aimed at improving comparability for consumers(a pro-competitive aim), without unduly dictating product design.
24. Where a separate authority is responsible for competition regulation, the insurance
COB supervisor should ensure that effective coordination mechanisms are in place to alignpolicy priorities.
COB Survey responses
Application paper on approaches to conduct of business supervision
October 2014

Page 9 of 59

Respondents were asked whether their COB mandate includes promotion of competition in
the industry.
Responses to this survey question were fairly evenly split, although the concept of acompetition mandate was evidently interpreted in different ways. “Yes” responses included
examples of explicit mandates to promote competition; cases where the primary competition
mandate is held by a separate agency, but the insurance supervisor also sees its mandate inrelation to financial markets efficiency and integrity and/or fair practices generally as
including a competition related responsibility; cases where the authority sees its role inenabling foreign entrants into the industry as promoting competition; and cases where theauthority indicated that the fact that insurers are largely free to design products, policy
conditions and set charges without material regulatory intervention is supportive ofcompetition.
Where the question was answered in the negative, this was mainly based on the existenceof a separate competition authority in the jurisdiction. In one case, although the supervisor
does not have an explicit competition mandate, the supervisor is obliged to take into
consideration, as a guiding principle, the “desirability of minimising the adverse effects of[the supervisor’s] activities on competition in the financial services sector.”
2.2.5 What is the COB supervisor’s responsibility in relation to combating financial
crime?
25. ICPs 21 and 22 deal with the insurance supervisor’s responsibilities in relation tocountering insurance fraud and to combating money laundering and terrorist financing.
26. Requirements and other measures that seek to combat financial crime (such as
insurance fraud) can sometimes impact the fair treatment of policyholders. For example,
requiring insurers to have effective processes in place to detect and avoid fraudulent claims,
could potentially conflict with the requirement that insurers have policies in place to handle
claims in a timely and fair manner. 4 Similarly, rigorous AML/CFT control processes could beseen as unreasonable or unfair restrictions on entering into or servicing policies, or as
potential barriers to financial inclusion. The COB supervisor needs to balance its objectives
in relation to combating financial crime and promoting fair treatment, for example throughensuring that appropriate and sufficiently rigorous procedures are in place to meet bothobjectives as well as the applicable legal requirements.
27. Mitigating crime has both a prudential and COB supervision component. Where COB
and prudential supervision are carried out by separate authorities, the roles andresponsibilities of each authority should be clear.
COB Survey responses
Respondents were asked what the COB supervisor’s responsibility is in relation tocombating financial crime.
The majority of respondents indicated that they do have an AML/CFT supervision mandate.
Examples of how this mandate is structured include an explicit mandate held directly by the
COB supervisor concerned; cases where the primary AML/CFT mandate is held by aseparate agency, but the insurance COB supervisor has an explicit responsibility to cooperate with and/or carry out AML/CFT supervision on behalf of that agency; cases where
AML/CFT supervision is conducted by a specific division or unit within the supervisor; andcases where in addition to its own AML/CFT activities, the supervisor oversees indirectsupervision by self-regulatory organisations.
Where the question was answered in the negative, this was mainly based on the existenceof a separate AML/CFT supervision authority in the jurisdiction. However, some of these4 See ICP 19.9.
Application paper on approaches to conduct of business supervision
October 2014

Page 10 of 59

respondents indicated that they nevertheless have an obligation to co-operate with or report
AML/CFT issues to the relevant separate authority.
Examples approaches to combating financial crime, over and above AML/CFT measures,
included defining claims fraud as a specific crime; reviewing insurer controls in this regard asa specific on-site focus area; and issuing guidance to the industry on managing financial
crime risk.
2.2.6 What is the COB supervisor’s responsibility in relation to independent dispute
resolution or redress mechanisms?
28. The guidance in ICP 19 5 includes recommendations for effective dispute resolution
mechanisms.
29. Different jurisdictions use different approaches to the scope and establishment of“independent” (or “alternative”) dispute resolution (IDR) mechanisms, and in doing so aim toensure that the objectives and practice of the IDR align with those of the regulatory
framework. For example, jurisdictions can differ in:•

structure and number of IDR mechanisms•

methods they consider most effective to ensure accessibility of the IDR structure•

ways they ensure independence of the IDR structure (including, for example, whether
it is government or industry funded, and the process used to appoint its officials)•

extent to which they use purely legal/contractual approaches to resolving disputes
rather than an equity or fairness-based approach that may go beyond the strict termsof the contract and take into account the broader circumstances•

extent to which their decisions are binding and/or subject to appeal or review, and bywhich parties•

relationship between the IDR structures and the formal legal system•

types of disputes and parties over which IDR structures have jurisdiction•

types of resolution and redress they are empowered to grant.

30.

Legal structures of IDR mechanisms vary. Options include:•

one or more IDR structure(s) created by statute•structures created voluntarily by industry but subject to supervisory standards andoversight•

wholly voluntary structures.

31. In some jurisdictions, in order to be licensed, insurers or other entities must subscribe
to a recognised IDR structure. Jurisdictions may favour:•

having a single IDR structure for consumer matters generally•

having a single structure for all financial services disputes, or•

having different IDR structures for different industry sub-sectors or product types.

32. Usually supervisors do not take the role of adjudicating or arbitrating disputes, but they
may monitor and analyse relevant data and take this into account in assessing conduct risks
and determining their supervisory approach.
33.

Supervisors may create, or recommend the creation of, IDR channels, such as:

5 See ICP 19.10.7 to 19.10.9.
Application paper on approaches to conduct of business supervision
October 2014

Page 11 of 59

•

ombudsman•arbitration•

conciliation•

other quasi-judicial approaches.

COB Survey responses
Respondents were asked what the COB supervisor’s responsibility is in relation to
independent dispute resolution or redress mechanisms.
Although more than half of the respondents stated that they do have responsibilities in thisregard, the responses indicated a broad range of approaches. Examples from supervisors
surveyed are as follows:•

licensed entities are required to be members of an IDR scheme, as a condition oflicensing•

the supervisor itself operates and/or supervises the IDR scheme•

the supervisor acts as secretariat for an independent body tasked with the recognitionand oversight of industry-based IDR schemes•

the supervisor requires insurers to maintain their own dispute resolution policies andprocesses, often subject to standards prescribed by the supervisor, and the supervisor
monitors adherence to such policies and processes•

the supervisor itself carries out a mediation/conciliation function in relation to disputes•

the supervisor is empowered to order insurers to compensate consumers (among otherremedies) in cases of breach of consumer protection obligations.

Where supervisors replied that they do not have a mandate in relation to alternative dispute
resolution or redress, this was in some cases due to the existence of a separate alternative
dispute resolution framework, not linked to the COB supervisor. Some respondents indicatedthat, although no dispute resolution mandate exists, the supervisor does from time to time
mediate in resolving disputes.
2.3. Monitoring COB risks
34. In accordance with ICP 9.3, the supervisory framework should provide the supervisor
with a holistic view of all risks to which the insurer is exposed, as well as risks which are
posed by the insurer. This includes COB risks.
35. COB risks require focus not only on risks to which the insurer itself is exposed, butalso risks to which the insurer’s conduct exposes its customers. COB supervisors need touse risk indicators that are different from, or additional to, those relied on for prudential
supervision. For example, COB supervisors need to consider the extent to which the risk
management frameworks and risk categorisation tools used by insurers are effective in
identifying COB risks.
36. As COB risks may not constitute immediate or direct threats to the insurer’s
sustainability or soundness, and, consequently, may draw the attention of COB supervisors
but not that of prudential supervisors, there is a need for COB and prudential supervisors tocommunicate and collaborate. While there should not be a conflict between managing COB
risks and financial soundness/prudential risks, there may be, in the short or medium term,
trade-offs in managing these two types of risks.

Application paper on approaches to conduct of business supervision
October 2014

Page 12 of 59

37. Material and persistent failure to manage COB risks can increase an insurer’s
exposure to reputational, legal and regulatory risks 6 and ultimately threaten an insurer’s
soundness and sustainability. As mentioned above, failure to manage COB risks may create
systemic risk. Also, systematic, or market-wide, risks can threaten the reputation of thebroader insurance market and financial system. In this regard, COB risks and considerationof their potential financial impact require close communication and cooperation between
conduct and prudential supervisors.
38. Different “lines of defence” may exist to identify, manage and mitigate COB risks.
These “lines of defence” usually comprise a range of governance structures and people inrisk management roles, operating at different levels both within the insurer and externally.
The COB supervisor should consider the range of “lines of defence” and the interrelationships between them, when assessing the risk exposure of an insurer.
Structures that play a role in this regard include: 7

39.
•

the insurer’s Board and Senior Management, supported by its internal governancestructures 8•

external governance structures of the insurer, such as external auditors 9•

industry and professional bodies (e.g. industry associations, self-regulatoryorganisations, and professional standards bodies 10 for accountants, auditors,
actuaries, and compliance officers)•

the supervisor or other supervisors with jurisdiction over the entity concerned•

ombudsmen or other dispute resolution schemes 11•

international standard-setting bodies including, but not limited to, the IAIS.

COB Survey responses
As part of the response to a more general question regarding recent and pending changes intheir approach to COB supervision, a number of supervisors mentioned an increased focus
on risk-based supervision and enhanced requirements in relation to corporate governanceand risk management frameworks for insurers.
2.4. Jurisdiction specific context and conditions
40. As noted in ICP 19, COB, including business practices, is closely linked with ajurisdiction’s tradition, culture, legal regime and the degree of development of the insurance
sector. For this reason, regulatory and supervisory approaches to COB tend to vary. 12
41. The extent to which COB supervisors protect individual customers may be influenced
by the availability of consumer recourse mechanisms. Some of the consumer support
structures set out in sections 2.4.1 to 2.4.4 below will be more prevalent in developed
insurance markets than in emerging markets. Where no, or only some, consumer support
structures exist, or where they are not well developed, particularly where consumers’ level of

6 Risk of breach of regulation resulting in regulatory action.
7 See also various references in 9.4 and 9.8 to governance and risk structures
8 See also ICP7
9 See also ICP7
10 See also references in ICP18
11 See also ICP18
12 ICP 19.0.2
Application paper on approaches to conduct of business supervision
October 2014

Page 13 of 59

financial education is also low, a jurisdiction may place greater responsibility on the
supervisor to protect individual rights of consumers and/or provide financial education.
42. Conversely, if consumers’ financial education is high and they have access to all or
many of the support structures mentioned, the need for additional supervisory intervention
may be correspondingly lower. This is not to say, however, that supervisors in suchjurisdictions should not remain vigilant to the risks of financial information asymmetry. Even
relatively well educated consumers may nevertheless be at a knowledge and bargaining
disadvantage in relation to the more technical aspects of financial products. In thesejurisdictions, the supervisor may take a “collective” approach to consumer protection. Thismeans that the supervisor will not usually become involved in conduct related incidents
affecting individual policyholders, but rather monitors insurer compliance with laws and othersupervisory requirements which protect and ensure fair outcomes for policyholders
collectively.
43. Even in jurisdictions where the consumer support structures are relatively advanced,
COB supervision is still required, but the approach may be tailored taking these additional
support structures into account.
44. Elements of a jurisdiction’s tradition, culture, and legal regime that support consumers
and are therefore likely to influence the approach to COB supervision include:•

the level of consumers’ financial education•

the role of consumer protection associations•

the role of industry associations•

the role and accessibility of the court system.

2.4.1 Level of consumer financial education
45. The supervisory approach necessary to encourage appropriate COB practices and faircustomer outcomes varies considerably depending on the level of financial education. In
jurisdictions or sectors where consumers have high financial education standards, theapproach to COB supervision could allow the supervisor to place less emphasis on specificconsumer protection measures. This approach would be less suitable where a highproportion of consumers are vulnerable to abuse because of low financial, or even general,
literacy levels and in such cases a more intensive focus on specific COB practices could beappropriate.
2.4.2 Role of consumer protection associations and other emerging players
46. In some jurisdictions, strong consumer protection associations exist. Such institutions
can play a valuable consumer protection role by, for example:•

reviewing and comparing the quality of insurance products and contracts•

carrying out mystery shopping 13•

offering training and educational services on consumer topics•

generally challenging insurers who are seen to treat consumers unfairly.

13 The supervisor may consider gathering information directly from insurers by using representatives or
appointees (which may include individuals engaged by a consumer protection association or a market researchfirm) to approach insurers, their agents or their appointed representatives in the role of potential retail consumers.
This is known as “mystery shopping”. Supervisors use mystery shopping to help protect consumers by seeking
information about a particular practice across a range of insurers, or the practices of a particular insurer. One risk
consumers face is being sold inappropriate financial products, and it can be very difficult to establish what theinsurer said to the “genuine” consumer in the sales discussions. By recording what the insurer says indiscussions with a “mystery shopper”, however, the supervisor can establish the insurer's normal practices in a
way which would not be possible by other means.
Application paper on approaches to conduct of business supervision
October 2014

Page 14 of 59

47. Typically, these associations ensure that their materials and views are publicised andaccessible to consumers. Some jurisdictional legislative frameworks permit them to sue
insurers in model cases or “class actions” on behalf of customers or groups of customers.
48. With the expanding role of the internet, other players have emerged that, while not
identifying themselves as consumer protection associations, can be helpful in providing theconsumer with comparative information on-line. They compare the insurance providers andinsurance products available in the marketplace. Particularly when these services are insurer
or product neutral and independent, website platforms can complement information available
from other sources, thus helping the consumer make a more informed decision on price,product features, and disclosures. 14 Whilst comparison websites may provide helpful
information to consumers, COB supervisors should be mindful of whether such websites
may take on an intermediary function and therefore potentially require appropriate
supervision.
2.4.3 Role of industry associations
49. Effective and sufficiently representative industry associations can play a useful role insupporting the COB supervision objectives of the insurance supervisor. For example, injurisdictions where product approval by the supervisor is not required, certain industry
associations issue “model contracts”. These provide their members with guidance on fair
and appropriate contractual terms.
50. Industry associations typically play a role in co-ordinating industry input into regulatory
developments, keeping members informed of such developments and ensuring there is ashared understanding of the supervisor’s expectations. Sometimes they provide public
information that is useful for consumers. Industry associations may also issue guidelines on
specific COB matters that support their members.
51. In some jurisdictions industry associations provide insurers and policyholders with IDR
options to resolve conflicts arising out of insurance transactions.
2.4.4 Role and accessibility of the court system
52. Courts serve as a last resort for consumers when disputes with an insurer cannot be
resolved elsewhere. This approach entails legal costs which may not be fully recoverable,
even if the consumer wins. To improve accessibility to the court system, many jurisdictions
provide legal aid if the consumer cannot afford the costs but has a reasonable case.
2.5. Principles-based vs. rules-based approaches to COB supervision
53. As pointed out in ICP 19.2.3, balancing principles-based and rules-based supervisory
approaches depends to a large degree on the jurisdiction’s legal framework and supervisory
approach, as well as taking into account factors such as the protection needs of vulnerable
consumers and benefits to consumers that arise through product innovation. While varying
from jurisdiction to jurisdiction, most supervisory approaches use a spectrum of principlesbased and rules-based provisions. In some cases, the approach is described as “outcomesbased”, with the supervisor determining the most appropriate mix of principles and rules toachieve the desired supervisory outcomes.
54. COB supervision, in particular, requires a considerable focus on principles, outcomesand governance frameworks over and above compliance with specific rules. This is because
it encompasses:•a broad range of insurer activities throughout the insurance product life cycle 15

14 See EIOPA report on comparison websites (as listed in annex I).
15 The structure of section 4 of this paper follows the product life cycle sequence of ICP 19.
Application paper on approaches to conduct of business supervision
October 2014

Page 15 of 59

•a broad range of insurer activities across the insurance value chain 16•

assessment of the insurer’s customer treatment culture.

55. Factors that supervisors may consider in determining the optimal balance between
rules-based and principles-based requirements, include the following:•rules-based provisions support regulatory certainty and predictability, but can also
result in insurers and supervisors adopting a “tick box” approach to ensuring
compliance with specific rules rather than designing their business practices orsupervisory frameworks to achieve broader or fairer outcomes. Rules-based
provisions could be at risk of becoming outdated and no longer “fit for purpose” ifmarket innovation occurs or new conduct risks emerge.

•

Principles-based provisions allow greater flexibility for insurers to design businessprocesses that suit their business models and strategies. They also allow greater
flexibility for supervisors to tailor their supervisory approach to a range of businessmodels. On the other hand, principles-based provisions may raise concerns that thesupervisor’s expectations are unclear. Principles-based provisions provide greater
scope for innovation in product and process design, and for regulatory andsupervisory frameworks to respond to potential new risks from these innovations,
without necessarily having to introduce new rules.

COB Survey responses
Respondents were asked whether they would describe their approach to COB requirements
imposed on insurers as mainly rules-based, mainly principles-based, or a fairly balanced mixof rules-based and principles-based requirements.
The largest proportion of responses indicated a fairly balanced mix, albeit with aconsiderable number of respondents indicating that their approach is mainly rules-based.
Very few respondents indicated a mainly principles-based approach. Some respondents
explained that the balance between rules and principles differed for different regulated
activities. For example, one supervisor adopts a mainly rules-based approach tointermediary supervision but a more principles-based approach to insurers, while anotheradopts a rules-based approach to product design but a more principles-based approach toother phases of the product life cycle. Some survey respondents indicated that although theircurrent approach is largely rules-based, they are in the process of shifting to a moreprinciples-based approach.
2.6. Features of COB supervision
56. Subject to the jurisdiction-specific context and supervisory approach, COB supervisory
frameworks will typically include some or all of the following underlying features:•comprehensive and consistent supervision•

intensive and intrusive supervision•risk-based and proportional supervision•pre-emptive and proactive supervision•credible deterrence.

16 The insurance value chain includes the relationship between the insurer itself and the various parties and processes
involved in providing and servicing the insurance product, such as reinsurers, investment or underwriting managers, otheroutsourced service providers, intermediaries, etc.
Application paper on approaches to conduct of business supervision
October 2014

Page 16 of 59

57. These features are inter-related, and in some cases the COB supervisor will need tofind the right balance between them. For example, comprehensive and consistentsupervision needs to be balanced against risk-based and proportional supervision to ensurethat minimising the scope for arbitrage does not result in an inflexible “one size fits all”
approach. Similarly, a remedial approach to mitigating risk through pre-emptive supervision
should not compromise the application of credible deterrence where misconduct has
occurred, or vice versa.
2.6.1 Comprehensive and consistent supervision
58. The regulatory and supervisory framework should aim to close gaps in the coverage of
COB activities of insurers and, where relevant, other entities forming part of the insurance
value chain. The framework should also limit opportunities for regulatory arbitrage between
insurers and other supervised financial entities.
59. The supervisory approach should also aim for consistent coverage and intensity, with
due regard to relevant COB risks. 17
60. In principles-based frameworks, principles for fair treatment of customers should apply
to all relevant supervised entities. Similarly in rules-based frameworks, rules-based elementsof the framework should be as consistent as possible across comparable activities.
2.6.2 Intensive and intrusive supervision
61. To enable the supervisor to make fair and informed judgments regarding COB risks ina particular insurer, the COB supervisor will need a clear and deep insight into the insurer’s
culture, governance structures, business model and business practices. This may require
more intensive on-site inspection and off-site monitoring than would be the case if a “lighter
touch” approach was adopted.
62. Once risks have been identified, the COB supervisor may require a more intrusive
form of engagement with the insurer to rectify the situation and pre-empt consumer harm, orseek redress where harm has occurred.
2.6.3 Risk-based and proportional supervision
63. As is emphasised throughout the ICPs, 18 the supervisor should conduct its activities
taking into account:•nature, scale and complexity of the insurer and its business model•

nature of the customer•

type of insurance provided•

potential risks posed to customers.

64. This is equally true of COB supervision and the assessment of COB risks. As a result,
those insurers who satisfy the supervisor that they consistently treat customers fairly andcomply with other COB obligations set out in ICP 19 will typically attract proportionally lesssupervisory scrutiny. Jurisdictions where the focus of insurance supervision has been
primarily on prudential risks, will need to review the current risk-based models (used by thesupervisor and/or insurers) to determine if they are appropriate for identifying and managing
COB risks. 19
COB Survey responses
17 See also the ICP standard 2.5 which provides, inter alia, that the supervisor should apply regulatory
requirements and supervisory procedures “consistently and equitably”.
18 See in particular paragraph 8 of the Introduction to the ICP’s and ICP standard 2.5.
19 See also section 2.3 above.
Application paper on approaches to conduct of business supervision
October 2014

Page 17 of 59

Respondents were asked whether they would describe their approach to COB supervision
as risk-based (i.e. taking into account the nature, scale and complexity of the risks posed byinsurers and to which insurers may be exposed).
Almost all survey respondents answered ‘Yes’ to this question, which is unsurprising given
the risk-based emphasis of the ICPs and other international standards and best practices.
2.6.4 Pre-emptive and proactive supervision
65. Any supervisory framework has reactive elements, requiring the supervisor to respondto risks or events that have already crystallised. Preferably, however, the supervisor will
identify COB risks early enough to intervene and prevent negative customer outcomes
before material damage is done, or at least to mitigate further damage. The supervisor
should develop processes to identify COB risks early, including by obtaining access tosuitable insurer and third party information sources that will help identify emerging trends
affecting financial consumers and insurers.
66. The ability to identify proactively potential COB issues with a view to pre-empting
negative customer outcomes is an important goal of supervision. This proactive approachshould cover emerging risks within specific insurers, as well as concerns at industry, market,
or business model levels.
67. With a pre-emptive approach to supervision, the COB supervisor takes proactive
steps, where appropriate. Where industry-wide COB risks are concerned, the supervisor’s
response should achieve a consistent, industry-wide change in conduct. Where COB risks
are identified in specific insurers or groups, the supervisor would need to take pre-emptive
action to prevent or minimise harm to the particular insurer’s policyholders. 20
68. The supervisor needs to strike a balance between corrective action and enforcement
action, adopting a consistent approach in this regard (for example by dealing consistently
with similar offences by different insurers).
69. Supervisors who take a proactive and pre-emptive approach to conduct risks
increasingly need to make forward-looking judgements regarding the likelihood of conduct
risks crystallising and the most effective supervisory response to pre-empt consumer
prejudice. There are risks attached to this judgement-based supervisory approach. It
requires supervisors to strike a careful balance between the need for certainty in the market
and the need to use their discretion to address identified risks. The risk of a supervisor
getting a prediction of potential future prejudice wrong is greater than the risk of incorrectly
assessing the impact of prejudice that has already crystallised. However, the risk of areactive approach is that it will often not be possible to secure adequate redress forcustomers that have already suffered harm once misconduct is proved. The benefits ofproactive supervisory action are typically not visible to the market, so it can expose
supervisors to criticisms of overreaction or inconsistency. On the other hand, a more visible
but reactive approach exposes supervisors to accusations of lack of foresight and of having
done “too little too late”.
COB Survey responses
Respondents were asked whether they would describe their approach to COB supervision
as mainly proactive, mainly reactive, or a fairly balanced mix.
The majority of survey respondents described their approach as “a fairly balanced mix”, witha relatively small minority seeing themselves as mainly reactive and a still smaller group as
mainly proactive.

20 See also ICP Standards 9.2.4, 9.3.3 and 9.7.1.
Application paper on approaches to conduct of business supervision
October 2014

Page 18 of 59

Various respondents cited the following as proactive supervisory tools: On-site inspections(including the process of prioritising these); examining the industry environment; testing
concerns, issues and practices; product approval requirements; the process of developing
rules and regulations; monitoring financial innovation, press releases and contracts; issuing
regulatory guidance and recommendations; mystery shopping; data collection and analysis
to identify potential trends; financial education.
The following were viewed as reactive tools: Responding to complaints or other intelligence;
breach handling.
Some respondents pointed out that, although the approach is mainly reactive, the findings ofa reactive supervisory intervention are used proactively to assess whether a similar problem
could or has occurred. Some jurisdictions indicated that although their current approach ismainly reactive, they are in the process of moving to a more proactive approach.
2.6.5 Credible deterrence
70. Effective COB supervision requires both insurers and consumers to have a highdegree of confidence that the supervisor will detect and take meaningful action against
misconduct and unfair consumer treatment. Supervisory frameworks will need to take into
account jurisdiction specific rules in relation to enforcement powers and confidentiality.
However, to have a deterrent effect (as opposed to merely a punitive effect), meaningfulconsequences of material misconduct should be visible to consumers and other industry
participants.
2.7. Resourcing and capacity implications
71. The legal authority with respect to COB needs to be clear and well understood bysupervisory staff and market participants. Staff need to be properly trained and haveappropriate levels of experience and seniority. COB supervision requires a different set ofknowledge, skills and abilities to prudential supervision, including a strong understanding of:•insurance law and regulations•

general consumer protection practices•

insurance business models, products and practices•

best practices and risks related to fair treatment of consumers.

72. Care should be taken to ensure that both on-site inspection and off-site monitoring
programs are adequately resourced from a COB perspective and that COB supervision is
given equal priority to other supervisory work.
73. Resourcing the COB supervisory function will depend on the approach taken. For
example, an “intensive and intrusive” approach will require supervisory staff with significant
insurance industry, product and business model knowledge, over and above legal andregulatory knowledge. A “pre-emptive and proactive” approach may require economic andmarket analysis skills to identify emerging industry-wide risks.
74. COB supervisors need the skills necessary to “follow the money”. They should notunderestimate the level of quantitative financial expertise (such as actuarial, auditing, andaccounting expertise) required. It is not only a skill set required by prudential supervision. In
order to understand the drivers of culture and behaviour in organisations, it is important tounderstand drivers of profit and cost.
75. COB supervisors may wish to consider supplementary sources of expertise. Options
include:•expert “wise person” advisory panels

Application paper on approaches to conduct of business supervision
October 2014

Page 19 of 59•partnerships with academics, economists, relevant non-governmental organisations,professional associations and the media•

the use of “think tanks”•

inviting expert input to discussion documents•

temporary secondments of relevant insurer staff to the supervisor or vice versa.

Application paper on approaches to conduct of business supervision
October 2014

Page 20 of 59

3.

Aspects of COB supervision with reference to ICP 9

3.1. Risk-based supervisory framework 21
76. One of the key features of ICP 9 is the requirement that the supervisor should take a“risk-based approach to supervision”. From a COB supervision perspective, this means thatthe supervisor is required to have insight into COB risks and how they interact with other(particularly prudential) risks, in order to form a holistic view of the risks faced by and posedby insurers.
77. As with prudential supervision, COB supervision should be systematic, risk-based andproactive, and conducted within a documented framework. The framework should not be
overly burdensome on the regulated industry and will usually employ a mix of tools.
78. In establishing a COB supervisory framework, supervisors need to recognise the fullrange and scale of COB risks, focusing particularly on risks to the fair treatment ofcustomers at all stages of the insurance product life cycle. The indicators supervisors
consider to determine these risks may therefore differ from those used to assess prudential
or financial risks.
79. Supervisors, taking a risk-based approach, usually assess each insurer to determine
its risk profile and/or allocate it to a risk category. The extent of supervision, the supervisory
instruments used and the interaction between supervisor and insurers can then be
determined based on the insurer’s risk profile or category.
80. Supervisors use different methodologies to ensure that their supervisory frameworks
are proportionate to the nature, scale and complexity of the risks posed by insurers and ofrisks to which insurers may be exposed. Examples include:•

developing a set of risk categories (for example high risk, moderate risk, low risk) andallocating each insurer to a risk category•

developing a risk scorecard or “points” system and allocating a risk rating or “score”
to each insurer•

combinations of the above

81. When assessing risk profiles and developing risk profiling methodologies, supervisors
may consider COB risk factors such as size of market, customer base, insurance lines,
ownership structure, and number of consumer complaints. For example, companies typicallyprioritised for more intensive COB supervision (for example more frequent on-site inspection
or more detailed off-site reporting) may:•

have the greatest number of customers•

be involved in personal lines of business (versus commercial lines)•

be active in the small business market (versus commercial markets)•

have an unsophisticated or vulnerable customer base•offer complex or high risk products•

be in a difficult financial position•

have products or business practices that the supervisor has previously identified as
posing a risk to customers. 22

21 Other relevant ICP’s are ICP 8 and 9 (which discuss models and assessment), ICP 7 (governance) ICP 21(fraud), ICP 22 (AML/CFT) and ICP 23 (group supervision).
22 ICP 9, Guidance 9.8.6.
Application paper on approaches to conduct of business supervision
October 2014

Page 21 of 59

82. Where the supervisor has assessed an insurer as lower risk, for instance as a result of
having demonstrated a lower risk business model, a good business and governance culture,and good customer outcomes in respect of COB matters, it may determine that the insurer
merits a less intensive supervisory approach than an insurer assessed as higher risk.
83. Similarly, the supervisor recognises that the incidence of unlawful or harmful market
practices may vary by line of business, class of risk, marketing approach and geographicalarea.
84. In order that COB supervision reflects the evolving nature, scale and complexity of risk
which may be posed by insurers and of risks to which insurers may be exposed, the COB
supervisory framework should not only take account of the risk profile of the individual
insurer concerned, but also reflect the nature, scale and complexity of the market andbroader environment in which insurers operate. Therefore, when developing COB
supervisory frameworks and plans, supervisors can benefit from regular market analysis.
85.

Items considered in an analysis of the market typically include:•

general economic conditions•

rate of market growth•

the size, structure, product mix of the insurance sector•

distribution models•

types of consumer complaints•

types of customers•

changes in laws or regulations•

other underlying trends in the sector, including consumer trends.

86. Supervisors can enhance the use of market conduct data analysing as a supervisory
tool. Collected data can be used to review market activity of the entire insurance
marketplace in a consistent manner and to compare the performance of insurers and identify
those whose practices are outside normal ranges. 23
87. Data elements collected can include claims, premiums, policies in force, new policies
written, non-renewals and cancellations, replacement-related activity, lawsuits andcomplaints on an industry-wide basis. If a company's performance appears to be unusual ascompared to the industry, this can prompt the supervisor to undertake further review of that
insurer. The additional review may be as simple as calling the company for further
information or clarification or conducting further analysis.
COB Survey responses
Respondents were asked whether they analyse market or consumer trends.
A majority of respondents indicated that they analyse trends. Respondents analyse a variety
of information, such as:•

industry reports and analysis•

consumer organisations•

financial reports•

media monitoring

23 In the United States, the state insurance supervisors, through the NAIC, have implemented a Market Conduct
Annual Statement (MCAS) to collect and analyse market conduct data from insurers. The MCAS was initiallydesigned as an aid in targeting inspections, as well as an alternative to on-site COB inspections.
Application paper on approaches to conduct of business supervision
October 2014

Page 22 of 59

•consumer complaints•

sales volume of specific lines of insurance.

88. Information learned from market analysis or consumer trends can help a jurisdiction
shape a COB supervisory approach that is appropriate for its circumstances. For example, amarket characterised largely by complex retail products provided by many insurers is likely
to require a different supervisory approach from one characterised by standard retailproducts provided by a few insurers. The supervisory approach is also likely to differ
depending on economic factors, with a different approach being adopted in markets where
the economy is strong and consumers are, in general, relatively financially secure, as
opposed to markets with a weak economy where many consumers are financiallyconstrained.
89. In addition supervisors try to find the appropriate balance between assessing COB
related risk at an insurer specific level and at an industry or sub-sector level (sometimes
referred to as micro conduct supervision vs. macro conduct supervision). The COB work
may therefore include a combination of:•

insurer specific supervision, involving reviews of codes of conduct, strategic plans,
policies and procedures and internal controls with respect to COB risks to ascertain
whether the insurer’s policy and internal controls effectively mitigate COB risks and to
determine whether or not supervisory requirements are being adhered to•thematic reviews and investigations, relating to the examination of specific types of
insurers, insurance business, or business functions to ascertain potential COB risks.
An example might include the examination of the sale of specific types of credit
insurance products•

product review and approval processes•

individual case reviews and complaint investigations.

90. Importantly, the supervisor should ensure that the risk profile or risk categorisation of
an insurer is kept up to date. All pertinent findings from off-site monitoring, on-site
inspections, market analyses and other relevant information sources should therefore beused to inform and update the insurer’s risk profile on an ongoing basis.
91. Regardless of the structure of the COB framework, it is important that the framework is
well documented for internal and external users.
3.2. Supervisory cooperation
92. In some jurisdictions responsibility for supervision of insurers is shared between morethan one authority. Where this is the case, the relevant authorities should co-operate when
applying ICP 9 to ensure an understanding of all risks that might be relevant to supervisory
review and reporting. 24
93. From the COB supervision perspective, co-ordination and information sharing
mechanisms need to be structured to enable an understanding of all relevant COB relatedrisks where:•

COB supervision and prudential supervision are split between two authorities (suchas in “twin peaks” regulatory models) or within a jurisdiction (such as between federal
and provincial levels)

24 See paragraph 10 of introduction to the ICPs.
Application paper on approaches to conduct of business supervision
October 2014

Page 23 of 59•

more than one supervisor, or more than one department within the same supervisor,
is responsible for COB supervision (either for different parts of a group or for different
activities carried out by the same entity)•

a general consumer protection authority also has some degree of oversight over the
insurer•a separate authority is responsible for oversight of systemic stability of the financial
sector.

94. Different forms of inter-agency cooperation and information sharing 25 mechanisms
could be considered, including:•prescriptive and/or principles-based legislated mechanisms•

formal memorandums of understanding (MOUs)•

informal mechanisms.

95. In addition to cooperating with related authorities within the jurisdiction, supervisors
need to take into consideration how to cooperate with supervisory authorities, both COB andprudential supervisors, in other jurisdictions, where similar COB issues may arise orotherwise have impact across one or more entities of a group across jurisdictions.
Cooperation on COB matters at international level needs to be fully explored given that themarket in one jurisdiction can have an impact on the market in another from a COB
perspective as well as a prudential perspective.
96. Supervisors also need to take steps to put in place adequate coordination
arrangements to deal with COB issues arising in cross-border business conducted by groups
or other means, such as passporting. For example, involved supervisors could establish amemorandum of understanding (MOU), or use supervisory colleges to raise and address
COB cross-border issues.26
3.3. Supervisory Powers
97. The powers supervisors have to perform off-site monitoring and conduct on-site
inspections are usually not confined to the insurer itself, but are broad based and extend toservices and activities outsourced by the insurer. Subject to applicable legal andconfidentiality constraints, the supervisor may have powers to conduct inspections of andcollect information from outsource parties such as:•intermediaries•

third party administrators•

investment managers•

pension fund administrators•

banks (in respect of bancassurance activities)•

joint venture partners•

other service providers to the insurer.

COB Survey responses
Respondents were asked whether they have access to COB related information from noninsurer third parties to whom the insurer has outsourced any customer facing activities.
25 Primarily addressed in ICPs 3 (info exchange and confidentiality) and 25 (cross border).
26 See ICP 25.1 and 25.1.2
Application paper on approaches to conduct of business supervision
October 2014

Page 24 of 59

Almost all survey respondents indicated that they had the authority to access this type of
information directly. One jurisdiction indicated that while it did not have the power to accessthe information directly, it could access the information through the insurer.
98. Agreements between the insurer and entities providing outsourced activities – inparticular, non-insurer third parties to whom the insurer has outsourced any customer facing
activities – should ideally recognise the role of the supervisor in COB supervision and ensurethat the supervisor’s ability to collect, analyse and rely on information is facilitated. Clear
recognition in such agreements assists supervisory oversight, ensuring that the standards
that apply to these entities are no less rigorous than those that would apply to the insurer if
the activities had not been outsourced.
99. As with outsourced activities, the supervisor should have the ability to accessinformation relevant to COB activities within corporate groups, either directly or indirectly. 27
3.4. Sources of information
100. When supervisors seek information or request documents, they expect insurers to beopen and cooperative. Sources of information relevant to COB supervision tend to bebroader than those used in other insurance supervisory work and include insurer COB data
and data from sources other than the insurer itself, such as:•

consumer complaints•

ombudsman services or other alternative dispute resolution structures•

consumer bodies•

industry associations•industry or consumer media•

other COB/consumer protection regulatory or supervisory agencies•

intermediaries•

whistle-blowers•

court cases•

data on general economic and environmental factors impacting on consumer
behaviour and expectations.

101. Depending on the nature, scale and complexity of the market, other information
sources could be used such as consumer surveys and “mystery shopping”, or similar
techniques.
102. At all times supervisors need to be aware of any legal or confidentiality constraints andappropriately address them. 28
COB Survey responses
Respondents were asked whether they obtain information regarding the COB of insurers
from sources other than the insurer itself, and if so, what type and on what basis. Information
sources include:
27 In accordance with ICP 9.1.2 “Services or activities that are outsourced by the insurer should be subject to thesame level of supervisory review and reporting as the services or activities that are not outsourced and are
performed by the insurer itself. The supervisor can do this through the insurer itself but should also have theability to obtain information from, and conduct on-site inspections of, entities engaged in providing outsourced
services or activities to the insurer, where necessary.”

28 Subject to relevant laws, supervisors may consider reporting any data security breaches to the affected parties.
Application paper on approaches to conduct of business supervision
October 2014

Page 25 of 59

•

ombudsman schemes or other alternative dispute resolution structures: many
jurisdictions responded that they receive information from ombudsman schemes oralternative dispute resolution structures. Some jurisdictions responded that they do not
obtain information from such bodies, a few noting that no such bodies exist in theirjurisdiction currently.

•

consumer or industry associations: many jurisdictions indicated that they receive
information either informally or formally from consumer or industry associations including
self-regulatory organisations. The frequency and range of information exchange varies
considerably between jurisdictions.

•consumer media: many jurisdictions indicated that they receive information either
informally or formally from consumer media. Some jurisdictions indicated they maintainsystematic media monitoring while others did so on an ad hoc, informal basis.

•other COB regulatory or supervisory agencies: many jurisdictions indicated that theyobtain information from other COB regulatory or supervisory authorities. The otheragencies providing information appeared to be quite broad, ranging from other insurance
supervisors to securities and pensions regulators to other agencies engaged in finance,
fair trade and consumer affairs.

•

intermediaries: many jurisdictions indicated that they receive information either informallyor formally from intermediaries.

•

whistle-blowers: some jurisdictions indicated that they receive information from
whistleblowers. Several of these jurisdictions noted, however, receipt of such information
as an infrequent occurrence.

•

Any others (e.g. investment managers, third party administrators): some jurisdictions
indicated that they receive information either informally or formally from other groups.
Some of the sources mentioned include actuaries, investment managers, third party
administrators, arbitration courts, judges and elected officials.

•

mystery shopping: some jurisdictions indicated that they conduct mystery shopping
techniques to test treatment of consumers by insurers and/or intermediaries. The form
and frequency of mystery shopping varies between jurisdictions.

3.5. Supervisory reporting and off-site monitoring
103. Off-site monitoring is generally based on review of a combination of routine or regularsupervisory reports required to be submitted by insurers, and other ad hoc or thematic
information obtained from insurers or third party information sources.
104. The frequency, type and level of detail of regular reports should be consistent with therisk profile assessment discussed in paragraph 75. Regular reports should be more frequent
and/or require greater levels of detail in higher risk situations such as those outlined inparagraph 78.
105. Jurisdictions have different systems in place for collecting COB information throughregular reports. Supervisory reporting requirements should be designed to provide indicatorsof fair treatment of customers at various stages of the product life cycle and otherinformation on COB related risks. Regular reporting enables the supervisor to build up overtime a picture of insurers' circumstances and behaviour, in order to inform and update theinsurer’s risk profile on an ongoing basis.
106. When considering what information should routinely be reported, supervisors normallyconsider known COB risks as well as recent developments in the insurance markets and set
reporting requirements in an anticipatory manner, focusing on market conduct issues that
could affect the insurers and policyholders now and at some future time.
Application paper on approaches to conduct of business supervision
October 2014

Page 26 of 59

107. The supervisor may also consider requiring a mix of qualitative and quantitative
information. Qualitative information may be helpful in assessing compliance with moreprinciples based requirements such as the extent to which a fair treatment culture isembedded or the effectiveness of governance processes, whereas quantitative statistics
may not provide full insight.
108. Section 4 of this paper discusses in more detail some possible fair treatment and COB
risk indicators that may be monitored through regular reporting. Broadly speaking,information included in regular reporting will typically cover:•corporate governance arrangements, and any significant changes to them•material outsourced functions and activities•

organisational structures including whether an insurer has close links with otherentities, and the nature of the relationship•a wide range of compliance and other statistical and operational reports in regard to
the insurer’s products and services, to help the supervisor to determine whether aninsurer is complying with relevant supervisory requirements and fair treatment
standards.

109. The above regular reports should include trend analysis, where feasible, overprescribed periods to enable the supervisor to identify and query noticeable trends ordeviations in customer treatment indicators. These analyses should supplement prudential
or financial data to inform the overall risk profile of the insurer.
110. In addition to regular supervisory reporting, the supervisor may request insurers or asample of insurers, on a market-wide or sector-specific basis, to provide ad hoc information
relating to existing COB practices or new developments. Examples of events triggering suchthematic information requests could include: 29•

a particular serious complaint or an increase in complaints of a specific type•a shift in consumer or intermediary behaviour•

economic or regulatory developments affecting consumer or insurer behaviour•

emergence of a new type of product or service•

at individual insurer level, changes in an insurer’s governance or management
structures or changes in product, service, target market or distribution strategies•

a significant change or trend, either at insurer or industry level.

111. By analysing information in a timely manner, supervisors can deepen theirunderstanding of developing trends. By reviewing information on a “horizontal” basis – i.e.
comparing information from different insurers - the supervisor can identify companies that
may require additional attention.
112. Over and above regular or thematic off-site reports, the supervisor usually has thepower to approach an individual insurer on an ad hoc basis with specific information
requests (sometimes referred to as an “interrogatory”). Such a request typically takes theform of a set of questions used to evaluate an insurer’s handling of compliance orprocessing issues. These can be tailored to a very specific need for information and are auseful option to determine compliance with a particular rule or law. This type of information
request is also a tool that can be used by the supervisor in preparing for an on-site
inspection. Examples include:

29 See ICP 9.5.
Application paper on approaches to conduct of business supervision
October 2014

Page 27 of 59

•sending a questionnaire to an insurer, asking about a specific business practice, e.g.
specific aspects of claim handling practices•

sending a questionnaire to an insurer about its plan of action to comply with aparticular new statute•sending a questionnaire to an insurer about compliance with product suitability
requirements.

113. Financial statement data is also used in COB off-site monitoring. For example, thesupervisor will be concerned when the financial statements indicate financial stress because
financial problems are often accompanied by COB problems, such as delayed claims
payments and neglect of customer service. Claims-related information is of particular
relevance to market performance and spikes in claim reserves might signal COB problems.
The supervisor should investigate the reason for such spikes within an insurer and checkcomplaints made against the insurer, trends over time and reserving levels for comparable
companies in the market.
114. A review of financial data is also important to enable the COB supervisor to “follow themoney” in order to identify: sources of profit and loss to the insurer; incentives payable tomanagement, intermediaries and other parties; general spending priorities; and/or intragroup cash flows – all of which may be valuable indicators of COB risks in an organisation.
115. In addition to regular and ad hoc information requested by the supervisor, thesupervisor may also consider requiring insurers themselves to proactively report to thesupervisor (i.e. not only at the supervisor’s request) on matters that may be of interest to thesupervisor. Possible matters insurers could be required to report as they arise include:•changes or new strategies for target markets, product or service design, distribution
models or other business changes that could materially impact on customers•

material litigation, complaints, adverse ombudsman rulings, or negative publicity•

identified legislative or regulatory contraventions.

COB Survey responses
Respondents were asked what type of information they require insurers to report.
Information required includes:•

Changes/new strategies for target markets, product or service design, distribution
models or other business changes that could impact customers: many jurisdictions
indicated that there are general requirements for insurers to notify the regulator ofsignificant/material events. Some jurisdictions enumerate the notification duties of
insurers (such as changes in or amendments to the actuarial bases used for the
calculation of premiums, acquisition or transfer of insurance business, engaging in noninsurance business etc.). In some jurisdictions insurers are required to get prior approval
from the supervisor for some or any changes to or introduction of new products/services
and distribution channels. In some jurisdictions there are no formal, general reporting
obligations, however in many cases material changes would be evident from financial,statistical and risk information submitted as part of prudential reporting requirements.

•

Material litigation: there was an even split amongst those jurisdictions which have arequirement to report material litigation and those who do not. The extent of information
required by the supervisor varies between jurisdictions; reports may be required on aregular basis or on the supervisor’s instigation. Several of the jurisdictions which
reported no requirement indicated that such information might be captured throughbroader requirements (e.g. a requirement to report significant events). Others indicatedsuch information could be obtained through special request, regular on-site inspection oris required to be included in the insurer’s annual report.

Application paper on approaches to conduct of business supervision
October 2014

Page 28 of 59

•Serious complaints or an increase in specific complaints: some jurisdictions indicatedthat there have or will have in the near future a requirement to report such complaints.
Some respondents indicated such information might be captured through broader
requirements (e.g. a requirement to report an increase in risk). Others indicated suchinformation could be obtained through special request, regular on-site inspection or was
required to be included in the insurer’s annual report.

•

Adverse ombudsman rulings: a small number of jurisdictions indicated that they havesuch a requirement. Several of the jurisdictions with no such requirement indicated thatan ombudsman service did not exist or had only recently been introduced. In jurisdictions
with a requirement, either insurers notify the supervisor of adverse ombudsman’s rulingsor the supervisor directly interacts with the ombudsman and exchanges information. In
jurisdictions with no specific reporting obligation, insurers may be required to report on
their most significant risks, including operational risks and legal & regulatory risks –material adverse ombudsman rulings could therefore be reported, if applicable, throughthis mechanism.

•

Negative publicity: a small number of jurisdictions indicated that they have a requirement
to report negative publicity. Some of the jurisdictions with no such requirement indicatedthat this type of information could be obtained through special request or through general
information from the market. Some jurisdictions require insurers to report on a variety ofmatters which arise out of their general reporting obligations. Even if there is no specificreporting obligation in relation to negative publicity, insurers may be required to report on
their most significant risks, including operational risks and legal & regulatory risks.
Reputation risk is typically classified under one of these headings. Material negative
publicity could therefore be reported, if applicable, through such mechanism.

•

Risk and compliance reports that include COB matters: many jurisdictions indicated that
there was such a requirement. Some of the jurisdictions without such a requirement
indicated that this type of information could be obtained through special request. Others
indicated that it may be required as part of new COB requirements being developed. In
some jurisdictions insurers are required, as part of their regular prudential reporting
requirements, to report on their risk management processes in general as well as on
identified material risks outside of their risk appetite.

•

Any other COB-related matters: some jurisdictions indicated that they have some
additional reporting requirements. Some of these included: licensing information(including records of disciplinary actions or terminations), development of new products,
internal audit reports relating to COB, general legislative disclosure requirements, annual
questionnaires on business practices, information on outsourced activities, and anannual market conduct statement that provides information on key market performancedata.

3.6. On-site inspection 30
116. On-site inspections provide information that supplements the analysis from off-sitemonitoring and gives the supervisor the opportunity to verify information it has received. Onsite inspection may also help detect problems that may not be apparent through off-sitemonitoring. 31 On-site inspections, enabling face-to-face engagement with senior
management and other levels of an insurer’s staff, are also generally better suited toassessing qualitative aspects of the insurer’s culture than off-site monitoring tools

30 Other relevant ICP’s include ICPs 1 and 2 (which deal with supervisory powers and the mandate), ICP 7(which addresses corporate governance), and ICP 18 (Intermediaries).
31 ICP 9, Guidance 9.8.1.
Application paper on approaches to conduct of business supervision
October 2014

Page 29 of 59

117. Normally on-site inspections are tailored to the particular insurer and its risk profile. 32
The frequency, scope and depth of on-site inspections are likely to take account of theinsurer’s business model, the nature, size and sophistication of its customer base and its
relative importance in the market.
118. On-site inspections should be more frequent and more in-depth in higher risk
situations such as those outlined in paragraph 78.
119. COB focused on-site inspections assess the insurer’s fair treatment of customers,
including observance of COB requirements and consumer protection regulations. 33 They canbe either full-scale or limited/thematic, and can involve investigations, no-knock inspections 34
or scheduled targeted inspections.
120. Full-scale inspections involve a review of all or most of the insurer’s lines of businessand operation. In some jurisdictions, comprehensive inspections, unless statutorily required,
are only conducted if deemed necessary as a result of the off-site analysis.
121. Limited or thematic inspections often occur when the off-site monitoring or broader
market analysis work has identified the need to review either a specific line of business or
specific business practices. Examples of areas that may be targeted through such thematic
reviews are:•underwriting and rating•product development processes•

marketing and sales•

complaint handling•

operations/management•

advertising materials•

compliance with any licensing conditions•

policyholder services•

claims handling•compliance with a particular legislative or regulatory requirement (for example a newrequirement)•

form filings.

122. Where feasible, the supervisor should aim to co-ordinate on-site inspections(particularly full-scale inspections) of the same insurer by different supervisors or different
departments within the supervisor.
123. The supervisor typically gives the insurer notice of an on-site inspection and its scope,although most jurisdictions also allow for “no-knock” inspections, without advance notice, incertain circumstances. The type and extent of notice provided will usually depend on thenature of the supervisor’s specific concerns (if any) regarding the insurer’s conduct, and theneed to strike an appropriate balance between allowing the insurer a reasonable opportunity
to prepare meaningful input and the risk of “rehearsed” responses or opportunities to hide ormanipulate information.

32 ICP 9, Guidance 9.8.2.
33 ICP 9, Guidance 9.8.7.
34 Inspections conducted without advance notice.
Application paper on approaches to conduct of business supervision
October 2014

Page 30 of 59

124. Supervisory staff participating in an on-site inspection need to have appropriatecompetence and seniority to effectively engage members of the Board and Senior
Management so as to:•assess organisational culture, leadership and governance quality and commitment tofair treatment of customers, as opposed to focussing on rules-based compliancemonitoring•

appreciate the COB risks arising from “big picture” elements of the insurer’s businessmodel, group structure, overall value chain and inter-relationships with suppliers,
intermediaries and other third parties•

challenge or query the rationale for decisions, strategies or company policies•

discuss identified weaknesses in the insurer’s governance or control functions from a
COB perspective•

persuade the Board or senior management to take action regarding current or
emerging problems, and engage in meaningful dialogue regarding possible
acceptable solutions•

provide management with forward looking insight and guidance and respond
appropriately to questions on the supervisor’s expectations, planned future focus
areas, and the impact of pending legislation.

125. The supervisor should have appropriate confidentiality and competency safeguards inplace if it delegates any aspect of on-site inspection to independent experts.
3.7. Supervisory feedback and follow-up
3.7.1 Forms of feedback and follow-up
126. Following an on-site inspection, supervisors provide feedback to insurers, including
following up to clarify matters, request additional information, or verify information provided
by the insurer. This can take several forms and often depends on the seriousness of theissue and the level of insurer cooperation.
••

Correspondence - this can be focused upon a potential or fully identified problem tobe addressed quickly by the insurer. It also serves as a record of an insurer’s
intentions regarding regulatory compliance, in the event the problem is not
subsequently corrected. Examples include:-

sending a letter to an insurer reminding it of a specific regulatory requirement
after the supervisor has noted cases of noncompliance-sending a letter to an insurer advising of increasing complaint ratios noted during
the supervisory review process-

following up with the insurer to ensure that required actions have been taken by
the insurer.

Interviews with the insurer - in the form of a face-to-face meeting or conference call,interviews with the insurer are useful when there is a need for open dialogue,
discussion or clarification. It provides both the supervisor and the supervised entity
an opportunity to ask questions, provide clarification and verbalise each other’s pointof view about compliance matters. Interviews with the insurer’s personnel can be
useful for obtaining information about specific divisions or functions, and confirm
findings from the on-site inspection. Examples include:-

making a phone call to an insurer’s management to discuss concerns relating to
the insurer’s change in marketing strategy

Application paper on approaches to conduct of business supervision
October 2014

Page 31 of 59

•-requesting a meeting with an underwriting manager to learn first-hand how theinsurer uses loss history information-

setting up a recorded statement to ask a claims examiner about policies andprocedures relating to the handling of problematic claims.

Follow-up contact with other stakeholders – at times the supervisor feels that input isnecessary beyond what is gained from the insurer’s officers, and decides to contact
specified members of the public, such as current or past policyholders and claimants,
independent experts or the insurer’s intermediaries to verify information provided by
the insurer. Typically these contacts are intended to uncover very specific information
about the insurer and potentially harmful behaviour under investigation. Examples
include:-contacting intermediaries to ask for their perspective about training provided by
the insurer-

contacting consumers who purchased a specific insurance product to ask how
the product was presented and sold to them-consulting independent experts to obtain their views on opinions expressed orconcerns raised by the insurer.

COB Survey responses
Respondents were asked to describe how they verify information received from insurers,
through follow-up with the insurer or through independent experts?
All respondents indicated that they follow up directly to verify information received frominsurers. This includes a wide range of supervisory practices including off-site monitoringand on-site inspections, special inspections and meetings, through general follow-up with theinsurer and communications with Board and Senior Management. Some jurisdictions
indicated that they use outside experts to follow up, but many do not.
3.7.2 Preventive or corrective action
127. Depending on the jurisdiction’s legal regime there is a range of possibilities when
preventive or corrective action is needed. Typically, a supervisor will opt for a moreinterventionist response the more severe the breach or contravention by the insurer is. The
following are examples of preventive or corrective action in order from less to more severe;such actions are not necessarily mutually exclusive and could be applied in combination with
one another where appropriate:•

Informal agreements - An informal agreement to change practices or implement
procedures can be either written or verbal. Such an agreement would be mostappropriate for situations involving non-compliance with technical regulatory issues
and where no significant harm has occurred to consumers or other stakeholders. It
could include amendment of business practices, promotional material or otherdocuments, for example.

•

Negotiated settlement agreements/consent orders/enforceable undertakings - A
negotiated settlement may be used to arrive at a mutually agreeable conclusion to amatter of concern. Such a settlement is typically negotiated and recorded in the formof a written consent order. The agreed-upon settlement may include suchcomponents as remediation/restitution, voluntary forfeitures (fines), agreements tocease and desist, agreements to implement action plans, self-reviews and possibly
reporting back to the supervisor after an agreed-upon period of time. The settlementagreement may or may not lack an administrative determination that a specificviolation has occurred and may or may not also indicate that the supervised entity

Application paper on approaches to conduct of business supervision
October 2014

Page 32 of 59

neither affirms nor denies the specific allegations. The agreement is made as ameans to resolve the conflict.
•

Administrative complaints and hearings - An administrative complaint is filed when
the supervisor has reason to believe that a supervised entity is engaging in noncompliant behaviour. The complaint document will allege that a violation of insurance
law has occurred or may occur, and provide for an administrative hearing where bothparties are allowed to present evidence and testimony about the allegations.
Typically, an administrative hearing would follow the filing of a formal administrativecomplaint against the supervised entity, starting with setting a time and place for an
administrative hearing. The supervised entity would be provided an opportunity tooffer testimony and evidence before a hearing officer, who would decide the outcomeof the action. Likewise, the supervisory representative would present evidence andrequest a finding or determination along with a request for resolution. Sometimes, avoluntary compliance plan or consent agreement may be entered into prior to an
administrative hearing. The nature of the finding of the administrative hearing or
sanction imposed will depend on the legal and supervisory regime concerned, but
may include one or more of the types of interventions described in this section.

•

Administrative fines or penalties – A supervised entity could be required to pay an
administrative fine or penalty as “punishment” for a breach of legislation or othermisconduct. In some cases such a fine or penalty may only be imposed after anadministrative hearing, whereas in other cases the supervisor has the power toimpose fines or penalties at its own instance. The imposition of a fine or penalty willoften be combined with a remediation or restitution order, or other forms of action
discussed in this section.

•

Cease and desist or “undesirable business practice” orders - An order can be issued
by the supervisor to an insurer to prohibit a person or business from continuing all
operations or certain targeted operations or violations of law. Such an order would be
issued when harm to consumers is considered imminent and quick action isperceived to be necessary. The supervisor may then set up an administrative hearing
to determine future action.

•

Ongoing monitoring/internal audit - If a systematic compliance error has been
identified, the supervisor may request that the insurer conduct a targeted COB
internal audit. This permits an insurer to take corrective action and to report its
findings to the supervisor. Additionally, as part of settlement agreements or after final
inspection reports, an insurer may be required to submit regular audits covering theareas of concern. The audits would be submitted to the supervisor over a period of
one or more years to help demonstrate continued compliance in the area of concern.

•

Remediation or Restitution Plans - In cases where harm can be measured andcorrected, remediation may take such forms as premium refunds, supplemental claim
payments, removal of unapproved or incorrectly administered restrictive
endorsements or policy change options. The goal is to obtain remediation or
restitution for policyholders, claimants and parties affected by an adverse situation,
aiming to put them in the position they would have been in had the error or
misconduct concerned not occurred.

•

Compensation - When an insurer’s actions or omissions have done harm topolicyholders or claimants, the jurisdiction may require that compensation is made forthat harm. Compensation is made for actual loss or damage that was sustained. It
differs from remediation or restitution, which usually require some form of reversal ofan error, but not necessarily full compensation for the consequences of the error or
misconduct.

Application paper on approaches to conduct of business supervision
October 2014

Page 33 of 59•Post-investigation or follow-up examinations - There may be instances when asupervised entity modifies procedures in response to a finding. In some cases, thesupervisor may schedule a series of targeted investigation to monitor the procedures
over an extended period of time to satisfy itself that the changes stay in effect.

•

Probation, suspension, revocation of licence - Depending on the severity andfrequency of specific violations, or the variety of violations, the supervisor may
revoke, suspend or limit an insurer’s authorisation to operate in the jurisdiction.
Probation is often ordered for entities guilty of more minor violations or first offences,which allows them to continue the business of insurance under surveillance. For
more serious charges, the license may be suspended usually for a specified period oftime. If the violations are severe or pervasive in nature, or if probation or suspension
has not resulted in a remedy to the issues, the license or authority to conduct thebusiness of insurance may be revoked.

3.7.3 Communicating the supervisor’s position
128. Supervisory concerns are generally recorded in a report following the on-site
inspection. In some cases a closing letter to management may be appropriate.
129. Where the issue may be of wider concern than a specific insurer, the supervisor may
want to convey its position more broadly. The use of targeted mailings, newsletter articles,
bulletins and website notices allow supervisors to address a concern or provide information
relative to new issues, interpretations, relevant case law, implementation policies for newlaws, or discussion of new industry practices or technologies. Sometimes education (in theform of supervisor communication or proactive outreach) can be used to provide information
to the insurance industry.
130. Practical examples of supervisory communications include:•issuing warning notices to consumers•

issuing a formal communication to clarify the supervisory authority’s interpretation ofa specific law and supervisory expectations•

posting an advisory communication letter to respond to multiple requests for
information about a specific compliance issue•

providing access to insurance laws and regulations through the supervisory
authority’s website•

providing answers to “frequently asked questions” from insurers on the supervisory
authority’s website•

discussing specific supervisory concerns in a supervisory authority’s quarterly
newsletter or similar communication.

3.8.

Other responses to issues identified

131. The supervisory process may result in lessons learned or prompt other responses
and/or actions which are not limited to insurers or the supervisor itself. The ability to takeother responsive actions based on issues identified may depend on the supervisor’s
mandate and/or authority.
3.8.1 Providing information to intermediaries
132. The supervisor may wish to convey information to intermediaries. In addition to thepossible use of mailings and notices, the supervisor may choose a more proactive type ofoutreach. Outreach mediums include speaking engagements, supervisor-sponsoredseminars and training events, press releases, interviews with the media, articles for
publication, billboards and advertisements, brochures and radio spots. Identifying the target
Application paper on approaches to conduct of business supervision
October 2014

Page 34 of 59

audience and tailoring the delivery to that audience are keys to a successful outreachcampaign.
133. Practical examples of proactive outreach to intermediaries include:•

hosting or sponsoring a seminar aimed at insurance compliance professionals to
discuss changes to specific laws or regulations•

participating in an industry or supervisor-sponsored trade organisation seminar toshare information about a new rule affecting COB supervision•

requesting that trade organisations place periodic reminders in their publications
about the importance of specific lines of insurance for consumers.

3.8.2 Initiating consumer outreach or education
134. The supervisor has a unique opportunity for determining which insurance related
issues are confusing or unclear to consumers. Newspaper and magazine articles, press
releases, outreach at public events and speaking engagements can help provide consumers
with tips on how to be more “savvy” about insurance and can help prevent abusive sales
techniques and unsuitable sales.
135. Practical examples of consumer outreach or education initiatives include:•

initiating a campaign to inform consumers about the danger of fraudulent andunauthorised insurers•

publishing a brochure explaining a certain confusing insurance product and requiring
its distribution at point of sale•developing media news releases to teach consumers how to best file insurance
claims after a natural disaster•using billboards to remind the public that insurance fraud is a crime.

3.8.3 Referral to other agencies
136. Occasionally, issues or concerns cross boundaries between authorities within ajurisdiction. Supervisory agencies may wish to establish channels of communication withother applicable agencies, and understand the functions of those agencies and how theymight apply to insurance.
3.8.4 Requesting legislative or regulatory changes 35
137. A COB issue may be discovered for which no regulatory or supervisory authority exists
to address the concern, or where the law has not kept pace with changing market conditions.
Sometimes a practice is identified that is technically legal, but is causing harm to consumers
or disrupting the marketplace. In other cases, supervisory work may highlight differences ininterpretation of legislation or unclear provisions. Although in some cases insurers may bewilling to change the practice voluntarily as long as they can be assured of a level playing
field, at other times problems need to be addressed on a broader and more certain basis
through rulemaking, legislative changes, etc.
138. Practical examples of requesting legislative or regulatory rule changes include:•

addressing COB risks arising from new technologies, such as the need foradvertising regulations in relation to internet sales, “crowd funding”, virtual
currencies, etc.

35 When it comes to legislative or regulatory changes, supervisors need to consider which approaches –principles-based,
rules-based or a combination – are most appropriate in enhancing consumer protection (refer to the Section 2.5).

Application paper on approaches to conduct of business supervision
October 2014

Page 35 of 59

•addressing the need to amend existing insurance statutes to capture new types of
insurance or marketing arrangements or clarify unclear provisions.

Application paper on approaches to conduct of business supervision
October 2014

Page 36 of 59

4. ICP 19 and approaches to off-site monitoring and on-site inspection
139. This section discusses possible approaches to both off-site monitoring and on-site
inspections that supervisors could consider when supervising an insurer’s conduct in relation
to the way it treats its customers. The section broadly follows the structure of ICP19,
considering supervisory approaches to insurer conduct at various stages of the insurance
product life cycle. For each product life cycle stage, the discussion distinguishes between
the following (where applicable):•Supervisory requirements: Specific requirements that may be set by the supervisor;•

Governance monitoring: The governance processes within insurers that supervisors
may monitor to determine whether their supervisory requirements are being met;•

Activity monitoring: Specific insurer activities that supervisors may monitor in
determining whether their supervisory requirements are being met.

4.1. Fair treatment policies, procedures and culture
Supervisory requirements
140. In accordance with ICP 19, the supervisor sets requirements for the conduct of thebusiness of insurance to ensure customers are treated fairly, both before a contract isentered into and through to the point at which all obligations under a contract have beensatisfied. 36
141. The supervisor should require insurers to act with due skill, care and diligence when
dealing with customers, and also to establish and implement policies and procedures on thefair treatment of customers that are an integral part of their business culture. 37
142. The requirements reflect the jurisdiction’s tradition, culture, legal regime and thedegree of development of the insurance sector. 38 For example, the needs of customers indeveloping countries, with regard to fair treatment and especially in the field of microinsurance, may be substantially different from the needs of customers in developed
countries. See also the discussion in section 2.4.
Governance monitoring
143. The supervisor may review whether insurers have a “fair treatment of customers” orsimilar policy that incorporates a culture of fair treatment at each stage of the life cycle of a
product, from its design to after-sales service and from the moment obligations arise until
they expire. In reviewing the adherence to and effectiveness of such a policy, the supervisor
would assess whether the policy is adequately embedded in the insurer’s structure andprocesses from strategic planning to decision-making and from governance structures tooperations.
144. The supervisor may review the extent to which fair treatment of customers is
implemented in relevant areas of the insurer’s operations, including performance
management and reward processes, by concerted action, a firm commitment and strong
leadership at decision-making levels.
145. When the insurer is part of a group, it is important for the insurance supervisor tounderstand the dynamics between policies and procedures applied at the group and entity
levels. In some instances, group-level governance, risk management and internal control

36 ICP 19.
37 ICP 19.1 and ICP 19.2.
38 See ICP 19.0.2.
Application paper on approaches to conduct of business supervision
October 2014

Page 37 of 59

functions can promote a group-wide policy for the fair treatment of customers. 39 However,
the insurance supervisor would wish to be satisfied that responsibility for handling insurance
COB matters is appropriate allocated within the insurance entity.
146. In evaluating an insurer’s approach to COB, the supervisor typically assesses:•

the extent to which policyholder interests are included in the insurer’s strategy. In
particular, do the insurer’s risk strategy, appetite and enterprise risk management(ERM) frameworks 40 take into account COB related risks, and not solely solvency
risks? 41•

how accountability for COB matters is assigned within the insurer’s Board and Senior
Management. In particular, who is accountable, how is this accountability reflected in
the insurer’s performance management and incentive and reward structures, and towhat extent is commitment to fair treatment of customers reflected in the insurer’s
strategic planning process and any applicable codes of ethics or corporate
policies? 42•

what controls are in place to identify, address and mitigate conflicts of interest? In
particular, the board of directors should be under an obligation to establish code of
conduct and ethical rules in order to manage conflicts of interest.

•

the extent to which management information systems and other control structures
enable insight into customer experience and conduct related risks. This includes areview of:

risk management and internal controlcomplianceinternal audit

any specific customer related governance structures such as a “policyholder
protection committee” or “customer affairs committee” of the boardcontrols in place to ensure fair treatment of customers where any functions
impacting on customers are outsourced

any other measures, controls and management information the insurer has
put in place to monitor COB matters – including the quality of reporting onthese matters to the Board and Senior Management

controls in place to ensure fairness of advice and distribution models.

COB Survey responses
Respondents were asked whether they assess the organisational culture, governance andcommitment to fair treatment of customers.
More than half the respondents indicated that they assess these factors and the assessment
appears to range from informal approaches to more systematic approaches involving
general risk assessment, and evaluation of governance and internal controls in relation to

39 ICP 19.0.6 “Where insurers participate in an insurance group or financial conglomerate, the application of
appropriate policies and procedures on conduct of business across the group should result in the fair treatment ofcustomers on a group-wide basis, even if legal provisions in some jurisdictions set requirements that arepotentially lower than those used by the group”.
40 ICP 16 and 17 discuss ERM from a solvency capital perspective.
41 Refer to ICP 16.
42 See also ICP 9.2.6.
Application paper on approaches to conduct of business supervision
October 2014

Page 38 of 59

COB. The respondents also stated that they challenge the rationale for COB related
decisions, strategies and policies of insurers.
Respondents were asked about the ranges of supervisory monitoring on COB matters.
Many respondents indicated that they monitor the following areas:•

How responsibility for COB matters is assigned within the Board and Senior
Management; these are assessed by on-site inspection and/or off-site reporting. In some
respondents this monitoring is undertaken within the overall risk assessment•

How fair treatment of customers is reflected in strategic planning and codes of conduct;
however, in most cases respondents indicated that this is a part of the overall risk
assessment rather than focusing specifically on COB matters•

The quality of control measures and management information regarding COB matters ingeneral; monitoring, usually as a part of the internal control framework review, isconducted by on-site and/or off-site inspection.

Activity monitoring
147. In addition to monitoring the insurer’s governance structures in relation to fair customer
treatment, the COB supervisor may review evidence-based indicators of the effectiveness ofthese structures, such as any self-assessments, reports or survey results in relation tocustomer satisfaction or customer treatment. Such a review should include a review of theextent to which any findings have been acted upon to improve identified weaknesses.
4.2. Product development
Supervisory requirements
148. The supervisors should require insurers to take customer interests into account in thedevelopment of products and marketing of insurance products. 43 Jurisdictions use different
approaches to accomplish this, ranging from pre-approving products, monitoring theinsurer’s own product governance, and intervening when they are not satisfied.
149. Product standards: Many supervisors put requirements on terms of insurance
contracts to ensure information given to the consumer is clear, correct, and not likely to
mislead the consumer. Also in many jurisdictions the law and/or regulation establishes
standards that insurance products shall meet. Such requirements can set mandatory clauses
or guarantees for some products and/or prohibit undesirable or unfair contractual clauses,
for instance clauses restricting the rights of the consumer, clauses written in foreign
language, clauses not specifying the terms of payment or the interest rate, etc.
150. Product development governance: In some cases supervisors will prescribe productdevelopment procedures and policies which insurers must have in place to ensure customer
needs are taken into account. For example, the procedures and policies may require
insurers to:•establish a formal approval process that takes into account the interests of different
types of customers•

establish clear approval procedures for marketing materials associated with new
products•

train marketing personnel and/or intermediaries so they understand for whom theproduct is suitable and all the product’s features, especially in respect of legal
requirements

43 ICP 19.3.
Application paper on approaches to conduct of business supervision
October 2014

Page 39 of 59

•

if the development or marketing of a product is outsourced, conclude an outsourcing
agreement that has regard to customers’ rights.

151. Product pre-approval: Some supervisors may pre-approve some or all products.
Practices range with respect to pre-approval from:•requiring pre-approval of all new (or substantially modified) insurance products
before they are issued•

requiring pre-approval depending on the product type•preferring not to pre-approve products•

explicitly prohibiting pre-approval of products.

152. Product intervention: In the event that product features or product disclosure material
do not comply with supervisory requirements, or are generally considered undesirable, somesupervisors have powers to order the withdrawal or temporary suspension of the product.
This allows the supervisor to ascertain whether insurers have taken into account theinterests of different types of customers. In some countries, the supervisor’s decisions may
be published.
Governance monitoring
153. Even where the supervisor does not specifically prescribe product development
governance requirements as discussed in paragraph 143 the COB supervisor will usuallyreview the effectiveness of the insurer’s product approval processes from the perspective ofensuring fair treatment of customers. Such a review will typically consider the extent to which
the insurer’s product approval processes address the factors set out in paragraph 143.
Activity monitoring
154. The supervisor can monitor a variety of indicators to determine whether insurers
adequately take into account consumer interests in their product development andmarketing, for instance by receiving and assessing:•detailed information on new or modified products including the terms and conditionsof contracts•

statistics/reports on new product development, including any consumer producttesting carried out•

sales volumes/market share data•target market/customer demographic information•

policy lapse, termination, and retention data•

product-related complaints data.

155. Even when there is no product prior approval, supervisors typically keep an eye on
new product launches, particularly for products involving financial innovation, so that they
can assess whether the product could potentially be detrimental to the customer.
COB Survey responses
Respondents were asked whether they monitor insurers in relation to how customer interests
are taken into account in the development of products and services.
A majority of respondents indicated that they do consider this factor through various
approaches. Some jurisdictions require insurers to have a product development process
which takes into account the interests of different types of customers and clear approval
procedures for any marketing materials for insurance products. Other jurisdictions review thetariffs and general insurance conditions which will be used for the insurance of specific lines
Application paper on approaches to conduct of business supervision
October 2014

Page 40 of 59

of business such as occupational pension plans for employed persons and forsupplementary insurance to mandatory health care insurance. Some respondents stated that
insurers define their product target in order to help ensure that the product is distributed to
the right population, and that it is reviewed on a regular basis to make sure it continues toreach the target market.
4.3

Product promotion and disclosure156. In accordance with ICP 19 the supervisor requires insurers to promote products andservices in a manner that is clear, fair and not misleading and to set requirements for
insurers with regard to the timing, delivery, and content of information provided to customers
at point of sale. 44
157. The supervisor should make sure that the insurer’s quality control over productpromotion and disclosure to customers, including both pre-publication controls and controls
to rectify incorrect information, can allow customers to make informed decisions regarding
products, before, during and after their purchase. In its supervisory review of insurers thesupervisor will assess whether insurers have adequate policies and procedures in place
regarding product promotion and disclosure to customers, and that these policies andprocedures are implemented in an effective and on-going manner.
158. The supervisor may look at samples of insurer documentation to assess the fairness,clarity and quality of insurance product promotion and disclosure of information, to determine
whether that this is sufficient to enable customers to understand the characteristics of the
product they are buying and help them understand whether and why it meets theirrequirements. 45 This would include reviewing samples of advertising material, precontractual information, product information provided to customers and sales-supporting
documents provided to intermediaries by insurers. The supervisor might also evaluate
consumer understanding of disclosures and other documents, for example through testing
and focus groups.
4.3.1 Advertising
Supervisory requirements
159. Given that advertisements are often the first, and sometimes the only, document theconsumer will look at before making a decision, the supervisor may seek to set principlebased requirements that advertisements are:•fair and do not provide any dishonest and misleading information•

verifiable (in respect of technical information or data provided)•

identifiable as advertising, by a clear mention of its nature and as separate material
with their own features•

distinguished from pre-contractual and contractual information•

clear so that the reader can readily understand the meaning of the information
provided.

160. The supervisor may also set specific requirements regarding the content ofadvertisements, usually taking into account the nature and complexity of the product sold.
Subject to the type of product, requirements may include:•

clearly displaying the name of the institution

44 ICP 19.4 and ICP 19.5.
45 ICP 19.5.9.
Application paper on approaches to conduct of business supervision
October 2014

Page 41 of 59•stating the nature of the product that is promoted, its potential advantages with thecorresponding potential risks•

when there is a mention of past performance (particularly for life insurance
investment products), including a disclaimer that past performance of this product is
not necessarily an indicator of future performance. Past performance should not be
the central argument in advertising material 46•

specific requirements relating to providing investment performance data andinvestment management fees•

specific requirements relating to disclosing information on various types ofguarantees.

Governance monitoring
161. The supervisor will usually monitor the effectiveness of an insurer’s formal processes
for reviewing advertising material before its publication to make sure that it fulfils consumer
protection requirements and that staff working in this area (or relevant people in thecompliance function) are properly trained, especially in respect of relevant legal
requirements. The supervisor may review, amongst other things, controls aimed at ensuring
that:•prior to being disseminated, advertising material regarding the insurer’s products isreviewed independently of the person that prepared or designed it for the insurer•

any product advertising that is misleading, unclear or inaccurate is immediately
modified and/or withdrawn•

adequate and appropriate product information is provided to intermediaries
marketing the insurer’s products•

information concerning issues such as consumers’ rights granted by the law is notpresented in such a way as to appear to be an offer from the insurer or insurance
professional.

Activity monitoring
162. Monitoring advertising of insurance products by the supervisor is of paramountimportance. For the supervisor, this monitoring has three main objectives:•to detect and seek remedies for infringements of legislation or supervisory
requirements•

to identify changes in business practices and spot new products, and to ensure
these comply with the legislative and regulatory rules•

to highlight good practices.

163. Usually the supervisor monitors advertising on a regular basis and carries out
inspections on a sample basis. Optimally monitoring would apply to all media, including
television, radio, press, billboards, and on-line advertising. It should also encompass nonmedia promotion such as street marketing activities, communication campaigns or events.
Monitoring may also include monitoring the insurer’s advertising and marketing expenditure,
to identify trends and focus areas.
164. The supervisor may choose to focus on specific themes (e.g. rates of return) or on
specific categories (e.g. types of product, types of insurer). Other factors that could impact
the scope of the supervisor’s work include:

46 ICP 19.5.2.
Application paper on approaches to conduct of business supervision
October 2014

Page 42 of 59

•the number of market players•

the duration, volume or recurrence of the advertisement•

the identity of the advertiser•

the seriousness of any infringements (and the risks they represent for the consumer)•

the consumer population targeted (especially in the case of vulnerable consumers)•

consumer complaints relating to the advertising material or other product information
concerned.

165. Moreover, the supervisor may need to pay special attention to specific issues in ashort period of time. Indeed, the temporary nature of advertising requires the supervisor to
respond quickly in terms of monitoring, intervention and sanctions.
4.3.2 Understandable pre-contractual information
Supervisory requirements
166. The supervisor may consider setting specific standards or issuing guidelines regarding
pre-contractual information.
167. Pre-contractual information should be provided to the consumer prior to the purchaseof the insurance product. The supervisor may set requirements regarding the specific timingof pre-contractual information and requirements that pre-contractual information (as well as
final policy documentation) should be:•provided to consumers free of charge•

prepared in written format or, at least, in a durable and accessible medium(electronic for instance)•

written in plain language, so that the consumer can easily understand the productfeatures•in prescribed language(s).

168. The supervisor could require insurers to disclose defined pre-contractual information topotential policyholders, such as:•

the insurer’s contact details•

the product’s main features•

the risks covered•

complaint handling policies•

the insurance cover’s limitations•

the term of the contract.

Governance monitoring
169. Similar to approaches used in respect of product promotion and disclosure (seesection 4.3), the supervisor may monitor the effectiveness of the quality and controls theinsurer has in place regarding the production and dissemination of contractual and precontractual information. This may include a review of controls the insurer uses to ensure that
information is in “plain language” and appropriate to its target market.
Activity monitoring
170. To prevent inappropriate sales, the supervisor may consider reviewing the quality of
information provided to the customer either before a contract is concluded or on a sample
basis thereafter.
Application paper on approaches to conduct of business supervision
October 2014

Page 43 of 59

4.3.3 Mandatory contract forms and standardised disclosure documents
Supervisory requirements
171. In some jurisdictions, the supervisor adopts specific mandatory contract formats. The
objectives of a mandatory format are threefold: to standardise the drafting, to simplify the
information given to the customer, and to make it easier for the customer to compare
products. They can be mandatory either because of the needs of the target population or
because of the nature of the contract.
172. Many insurance products are complex, making it difficult for consumers to understandthe product characteristics. This has led some supervisors to introduce standardised
disclosure documents (sometimes called a “Key Information Document”, or “KID”), or to callfor such templates to be developed. A KID contains information such as the key features ofthe product, its risks, costs and benefits.
COB Survey responses
Respondents were asked whether they monitor insurers in relation to the fairness, clarity andquality of product promotions and disclosures.
A vast majority of respondents indicated that they actively monitor the fairness and quality of
product promotions and disclosures. Different approaches applied from jurisdiction tojurisdiction, including the following:• using an on-site inspection to verify that insurers give sufficient information to thecustomers in the prescribed form, if any. Other jurisdictions prefer to use only an off-sitemonitoring, for example, using periodic reporting by insurers. However, it is noted thatmany jurisdictions combine both approaches to cover as much potential source ofconsumer detriment as possible• carrying out mystery shopping programmes in this regard• relevant legislation stipulating that all advertising, promotion and offering services
provided by insurers must be based on good faith and truthful facts, that is, advertisingmust be consistent with what is being offered to users• the supervisor issuing guidelines regarding pre-contractual information to insurers.
4.4.

Advice and conflicts of interest

Supervisory requirements
173. The supervisor requires that insurers have controls in place to ensure that, where
customers receive advice before concluding an insurance contract, such advice isappropriate, taking into account the customer’s disclosed circumstances, and that any
potential conflicts of interest are properly managed. 47
174. Moreover, the supervisor usually requires insurers and intermediaries to haveappropriate knowledge of the legal environment applicable to the insurance market,
including legal provisions applying to insurance products, market participants, and consumer
protection. Insurers and intermediaries should act ethically and professionally and theirprofessional knowledge has to be appropriate and current. The supervisor may set
principles-based requirements and / or specific rules in this regard.
175. In some jurisdictions, the supervisor prescribes specific governance requirements
regarding the management and disclosure of conflicts of interest between intermediaries,
insurers and customers – for example, by requiring insurers to have a “conflict of interest
management policy” in place, meeting certain minimum standards. In some cases this may
47 ICP 19.6 and ICP 19.7.
Application paper on approaches to conduct of business supervision
October 2014

Page 44 of 59

include prohibitions of particular types of incentives or benefits which the supervisor regards
as an unacceptable conflict.
176. Some jurisdictions may prescribe the amount, type or frequency of commission orother remuneration or incentives that insurers may provide to intermediaries.
177. Additional requirements imposed by some supervisors in relation to advice andconflicts of interest include requiring insurers to:•have processes to verify whether the intermediary has gathered the necessary
information on the consumer before the sale of an insurance product. One way of
doing this is to have the intermediary use a standard form detailed questionnaire.
Again, requirements may differ depending on the intermediary’s status•provide training or accreditation in relation to the insurer’s products to intermediaries
before allowing the intermediary to market the insurer’s products.

•

disclose to policyholders the status of the intermediary•

have processes to ensure that the distribution model used in a particular case isappropriate to the type of product and / or customer group concerned. For example,
insurers may be required to determine whether it is appropriate to market particular
types of products without advice, and to put appropriate controls in place to ensure
fair treatment of customers.

COB Survey responses
Respondents were asked whether they monitor insurers in relation to the controls in place toensure fairness of advice and distribution models.
The majority of respondents indicated that they monitor this through a diverse range of tools
including sophisticated ones utilising thematic reviews, mystery shopping and on-site
inspections that are largely driven by complaints.
In some jurisdictions all distributors have to give comprehensive and key information on theinsurance policy, to identify the requirements and needs of the consumer, to formalise inwriting the advice given, and to maintain a client file.
Other respondents stated that they make sure, through COB reviews, that controls are inplace to ensure fairness of advice and distribution models.
Respondents were asked whether they monitor insurers in relation to the controls in place tomitigate conflicts of interest
A vast majority of respondents indicated that they require insurers and intermediaries to set
principles and establish internal mechanisms to identify, prevent and manage conflicts ofinterests, ensuring that when a conflict of interest does arise, the customer is treated fairly.
Some respondents stated that they require insurers to put in place a fire-wall between
operational activities and compliance functions. They encourage or require insurance entities
to adopt codes of conduct or ethical rules (in addition to more formal legislation/regulation).
These rules vary depending on the complexity of the product sold. For example, codes ofconduct may be more rigorous with regards to sales of investment-linked insurance
products.
Some jurisdictions approve codes of conduct which are proposed by industry associations. A
number of supervisors assess the internal control framework in respect of fair treatment ofcustomers. On the other hand, some jurisdictions follow a more indirect approach becauseof varying business structures and resources, supervisors apply general principles ofconduct but do not dictate specific management decisions within insurance companies. For
example, supervisors can require the fair treatment of customers but do not explicitly require
such standards be reflected in a company’s strategic plan or code of conduct.
Application paper on approaches to conduct of business supervision
October 2014

Page 45 of 59

Some respondents pointed out that they also set rules on intermediaries’ training to ensurethat intermediaries are well aware of rules concerning the prevention of conflicts of interest.
Governance monitoring
178. Even where the supervisor does not specifically prescribe controls in relation to advice
and conflicts of interest as discussed above, the supervisor will usually review theeffectiveness of the insurer’s own controls and processes from the perspective of ensuring
suitable advice to customers. Typically, the supervisor will review mechanisms to identify,
prevent, disclose and manage conflicts of interest. Such a review may also consider theextent to which the insurer’s processes address the factors set out in paragraphs 166 to 170
under “supervisory requirements” above, even where these factors are not specificallyprescribed.
179. Supervisors may review the manner of remuneration for those selling or providing
advice to customers to ensure it does not jeopardise customer interests. The supervisor may
determine the extent of disclosure (e.g. the manner and/or detail) that is required. Even
where not specifically prescribed, remuneration and sales incentives should not influence theadvice given to the customer.
Activity monitoring180. The supervisor can monitor a variety of indicators to assess the fairness of theinsurer’s distribution and advice practices, such as:•

sales, termination and lapse data per type of distribution channel•

the types and amounts of remuneration paid to intermediaries•

distribution force data such as number of intermediaries recruited/contracted,
retention of intermediaries, etc.

•

advice related complaints data.

181. Additionally, the supervisor may require the insurer to notify it of any significant
changes in distribution models or intermediary remuneration practices
4.5. Post-sale servicing and information
Supervisory requirements
182. The supervisor requires insurers to service policies appropriately through to the point
at which all obligations under the policy have been satisfied. The supervisor also requires
insurers to disclose to the policyholder information on any contractual changes during the lifeof the contract, as well as other relevant information depending on the type of insurance
product. 48
183. Supervisors may require insurers to inform policyholders after a contract has beenconcluded about various specific matters, such as:•

any changes in the contract’s supporting data or terms•

additional requirements•in the case of savings or investment related contracts, details of investment
performance from time to time (e.g. portfolio performance, profits, bonus amounts,
the value of the units allocated to the policyholder, substantial modification of theassessment of an investment fund’s risk).

48 ICP 19.8.
Application paper on approaches to conduct of business supervision
October 2014

Page 46 of 59

184. Supervisors may also prescribe the timing of ongoing disclosures, for example
requiring insurers to provide an updated benefit statement at least annually.
185. In some jurisdictions, supervisors require insurers to have controls in place regarding
any outsourced services, to ensure that customer service is not compromised and that theoutsourced service provider meets relevant service standards.
Governance monitoring
186. Supervisors may monitor the effectiveness of the controls an insurer has in place tomonitor the quality of ongoing post-sale policy servicing and information, including services
or information provided by outsourced service providers. In particular, the supervisor may
monitor the insurer’s disclosure systems that allow consumers to determine whether the
product continues to suit their needs and expectations. Items typically reviewed include
disclosures relating to:•after-sales transactions•

performance•

contract amendments during the term of the contract•

if applicable, the rights and obligations of customers in connection with the changes•

substitution or replacement of a product•portfolio transfers•changes in the environment, such as legislative amendments that have an impact on
the products customers hold•organisational or operational changes involving the insurer that have an impact on
customers, products or related services.

Activity monitoring
187. Most supervisor assess the quality of insurers’ post-sale policies and procedures todetermine whether these promote the fair treatment of the policyholder, insured, beneficiaryor injured third party. They may also assess whether the insurer is acting responsibly incases where information provided by a customer prior to the conclusion of the contract
subsequently changes. The supervisor may also assess the insurer’s procedures to support
customers wishing to replace or substitute a product or change suppliers and the associatedrisks.
188. Other indicators of the quality of post-sale servicing that supervisors may review
include:•samples of post-sale servicing documentation, such as standard letters, annual
benefit statements, etc.

•

reports on adherence to/deviations from internal service standards and service levelsof outsourced service providers•

service related complaints data•

customer satisfaction survey data.

Application paper on approaches to conduct of business supervision
October 2014

Page 47 of 59

COB Survey responses
Respondents were asked whether they monitor the quality of on-going post sale policy
servicing and information.
More than half of respondents indicated that this is included in the COB monitoring process
and in general through on-site inspections. Monitoring approaches include:• off-site monitoring• via complaints handling• COB thematic reviews• post sale calls to policyholders (for investment-linked products)• indications of large impact• regular (random) testing to identify whether the information given by the insurer is correct.
Some respondents pointed out they also use mystery shopping techniques or programs tomonitor the fair treatment of customers by insurers.
4.6. Claims
Supervisory requirements
189. Supervisors require insurers to handle claims efficiently and fairly, and have claims
handling procedures that are simple, transparent and accessible. 49 When purchasing an
insurance product (i.e. in arranging the contract), and again later if a claim is made,supervisors usually require insurers to make the customer aware of:•what is covered and what is not•what the claims process involves, including what documentation is required, who tocontact, etc.

•

turnaround times for claims processing•

who to contact in the event of a claims dispute.

190. In some jurisdictions, specific timelines are prescribed for claims handling, such as
maximum periods within which a claim decision must be communicated to the claimant,
periods within which the claimant may dispute a decision, etc.
191. Supervisors may also prescribe various aspects of the governance processes insurers
should have in place in relation to claims handling, such as requiring insurers to:•develop and maintain a claims procedure manual•

have a dedicated claims handling function with adequate resources and suitably
qualified/trained staff•

on receipt of a claim, provide the claimant with full details of all claim requirements
and next steps. This should include details of the role of third party service providers
such as surveyors, loss adjusters, repair services, etc. It should also include detailsof any relevant excesses, co-payments, subrogation or averaging processes•

keep the claimant informed of the progress of a claim (including reasons for any
delay) and/or advise them how to track such progress•provide adequate reasons for any rejection of a claim, including partial rejections

49 ICP 19.9.
Application paper on approaches to conduct of business supervision
October 2014

Page 48 of 59

•provide contact and process details regarding how to appeal or dispute a claim
decision (including any relevant alternative dispute resolution mechanisms)•

maintain certain minimum claims related records•

establish controls for combating fraud and money laundering appropriate to their
exposure and vulnerabilities. These may include: making the policyholder / claimantaware of the consequences of submitting a false statement or incomplete statement;
providing claims department staff with adequate training on fraud indicators; carryingout public awareness programmes on claims management and documentation;
where legally possible, participating in relevant databases where claims susceptible
to fraud would be reported.

192. In addition to claims handling governance requirements, supervisors may also set
requirements or provide guidance in relation to fair claims handling standards. These mayfor example include prohibiting the insurer from:•concealing any provisions of an insurance policy when they are pertinent to a claim•

dissuading policyholders, claimants, or beneficiaries from obtaining the services of an
attorney or surveyor•

attempting to settle claims for less than the amount the claimant would be entitled toreceive according to any written or printed advertising material accompanying theapplication forms•

denying a claim without reasonable investigation•transferring responsibility for a claim to others (for e.g. third party service providers
such as surveyors, loss adjusters, repair services, etc.), except as may be expressly
provided for in the policy conditions.

Governance monitoring
193. Even where the supervisor does not specifically prescribe governance processes inrelation to claims handling as discussed above, the supervisor will usually review theeffectiveness of the insurer’s own controls and processes from the perspective of ensuring
fair claims handling practices. Such a review may consider the extent to which the insurer’s
processes address the factors set out in paragraphs 182 to 185, even where these factors
are not specifically prescribed.
194. Supervisors usually analyse insurers’ claim reserves. A spike in reserves can occur fora number of reasons, some of which might signal COB problems. A spike in reserves withouta corresponding change in losses paid should be investigated.
Activity monitoring
195. Supervisors monitor, and in some jurisdictions make public, claims handling statistics,
such as:•claims/loss ratios•

average (median) turnaround times for disposal of claims•

settlements•

number and value of rejected claims, including reasons for rejections•

number and value of claims resulting in litigation•

number and cause of complaints relating to claims•

number, age and value of outstanding claims.

Application paper on approaches to conduct of business supervision
October 2014

Page 49 of 59

196. Loss ratio information identifies companies with greater claims. Significant deviations
from the norm could indicate financial stress if the loss ratio is too high—or highlight thepotential concerns about claim-handling or underwriting practices, if the loss ratio is
unusually low. It must be kept in mind, however, that what is a “normal” loss ratio, consistent
with profitable operations, may vary significantly depending on the line of business and,especially for “long-tail” lines of business, on changes in general economic conditions.
197. Supervisors usually also review (typically through an on-site inspection) the
operational effectiveness of the claims handling function, including adherence to internal andoutsource service standards and the competency of claims handling staff.
COB Survey responses
Respondents were asked whether they monitor claims handling processes and whether
complaints data and claims ratios indicators are included in supervisory review.
The majority of respondents indicated that the monitoring of claims/complaints handlingprocesses within insurers is a high priority area in the supervisory review process throughvarious means including on-site inspection, reporting requirements through regulations or
guidelines; quantitative and qualitative assessment of corporate governance; COB-focusedrisk assessment; or in the course of performance evaluation of insurers.
In the same vein, most respondents stated that complaints data and claims ratios arereviewed and analysed on a regular basis in the course of off-site monitoring as COB related
indicators and further investigated, where necessary, through on-site inspection in specificareas.
4.7. Complaints
Supervisory requirements
198. The supervisor requires insurers and intermediaries to have policies and processes inplace to handle complaints in a timely and fair manner. 50 Complaints are a product of any
normally functioning insurance market and insurers are generally required to have systems
for handling them. Supervisors track trends in complaints, as they could point to broader
problems.
199. In some jurisdictions the supervisor plays a role in relation to the establishment oroperation of alternative dispute resolution structures. In other cases, supervisors themselves
have a direct complaints handling role. See discussion in paragraph 2.2.6.
200. In some jurisdictions, specific timelines are prescribed for complaints handling byinsurers, such as maximum periods within which a complaint must be resolved or responded
to.
201. It is common for supervisors to prescribe various aspects of the governance processes
insurers should have in place in relation to complaints handling, such as requiring insurers
to:•implement and maintain a complaints management policy that is usually required tobe approved by the Board or Senior Management. The supervisor may alsoprescribe minimum matters to be addressed in the complaints management policy,
including: that customers should be able to lodge a complaint through various
channels free of charge; acknowledging and handling complaints received; theturnaround times involved in the various processes from acknowledgement to final
disposal; when a complaint is considered finally disposed of; proper treatment of

50 ICP 19.10.
Application paper on approaches to conduct of business supervision
October 2014

Page 50 of 59

complainant’s information and personal data, according to applicable legal
frameworks.
•

have a dedicated complaints management function headed by a senior manager or
Senior Management structure who reports at a senior executive level. The supervisor
may also require the function to be protected from conflicts of interest (for example
by having control over its own budget).

•maintain a register of complaints, containing minimum details such as: the subject of
the complaint; data on the complainant; date of receiving and answering thecomplaint; result/outcome of the complaints; category of complaint e.g. class of
insurance concerned, subject matter of the complaint, etc.

•

keep complainants informed of progress of a complaint and reasons for any delays or
decisions, including possible appeals.

•

communicate details of and co-operate with relevant alternative dispute resolution
forums.

•categorise and analyse complaints to identify and address any recurring or systemic
problems and potential legal and operational risks.

•

submit prescribed complaints data to the supervisor, including details of identified
trends or recurring or systemic problems. In some jurisdictions public reporting ofcomplaints data is also prescribed.

COB Survey responses
Respondents were asked whether they require insurers to report on serious complaints or an
increase in specific complaints.
Some respondents indicated that they require insurers to report on serious
complaints/claims or an increase in specific complaints on a regular basis to identify themost common or potential problems in the marketplace. In addition, some jurisdictions
require insurers to maintain a complaints registry to track all consumer complaints and makesuch registry available to supervisors upon request. Other jurisdictions, although they
currently have no explicit requirement, also indicated that granular complaints/claims
reporting requirements would be developed and implemented in the near future.
Governance monitoring
202. Even where the supervisor does not specifically prescribe governance processes inrelation to complaints handling as discussed above, the supervisor will usually review theeffectiveness of the insurer’s own controls and processes from the perspective of ensuring
fair complaints handling practices. Such a review may consider the extent to which theinsurer’s processes address the factors set out in paragraphs 1911 to 194 above, even
where these factors are not specifically prescribed.
203. The supervisor may also review the complaints handling culture of the insurer as anindicator of its general fair treatment culture. For example, the supervisor may assess
whether complaints are handled strictly with reference to the terms of the insurance contract
concerned, or whether the insurer also considers the general reasonable expectations of thecomplainant and the complainant’s particular circumstances to arrive at a fair outcome.
COB Survey responses
Respondents were asked whether they handle complaints from policyholders andbeneficiaries.
The vast majority of respondents indicated that they handle complaints from policyholders
and beneficiaries directly and indirectly with expectation of the following supervisory benefits:
Application paper on approaches to conduct of business supervision
October 2014

Page 51 of 59• being able to identify and monitor abusive market practices or signals about COB related
breaches of insurance regulation• considering whether to take proactive supervisory action for consumer protection• providing the public with a general recommendation based on deep analysis ofcomplaints collected• carrying out on-site inspection with respect to COB in a more effective and efficientmanner.
Even in cases where the complaints against insurers are handled by self-regulatory bodies,supervisory authorities maintain a monitoring role to ensure that the complaints are properly
managed in accordance with the rules and regulations within the self-regulatory framework
established.
In some jurisdictions insurers publish details of their complaints handling process including:• how to complain (the type of information to be provided by the complainant)• the identity and contact details of the person or department to whom the complaint should
be directed• the process that will be followed when handling a complaint (e.g. when it will beacknowledged, indicative handling timelines)• the availability of a competent authority, an ombudsman or alternative dispute resolution
scheme.
Activity monitoring
204. Supervisors should review complaint information. This can include both quantitative
data (such as complaints volumes, resolution rates, escalations, etc.) and qualitativecomplaints related information (such as samples of complaints related correspondence andreviews of the insurer’s complaints analysis findings). From an efficient complaints analysis
the supervisor can detect potential problems on both individual company and industry-widelevels. Complaint information can serve as an early warning system to detect problems(including potential risk mitigation problems) and to provide a basis for further COB review.
205. Despite the obvious correlations between consumer complaints and COB concerns,
supervisors should be careful not to jump to conclusions purely on the basis of complaints
data, nor should they conclude that the absence of complaints means an absence of COB
problems. An exclusive focus on consumer complaints cannot be used as a substitute for amore thorough inquiry into an insurer’s activities.
206. Nevertheless, complaint information is typically the single most useful source of data
for COB supervisory review purposes. Complaints provide a great deal of information about
the industry, individual insurers and real-time consumer concerns, including emerging issues
in the marketplace.
207. Complaint information is one of the factors that should be considered in determining an
insurer’s risk categorisation, in the selection of insurers for further review and in determining
the nature and scope of that review. Identifying insurers with consistently high levels ofcomplaint activity can be a first step toward corrective action.
208. Complaints data should be reviewed as frequently as possible, such as quarterly ormonthly, to spot trends in a timely manner. The supervisor can readily detect problems bycomparing past statistical information on an industry-wide level, by product line or type ofcomplaints, or on an individual company level.
209. Although the focus of analysis is on patterns and trends, some individual complaints by
their nature will raise serious questions about an insurer’s conduct, which call for follow-up
even if the insurer’s complaint trends are otherwise unremarkable. The supervisor usually
Application paper on approaches to conduct of business supervision
October 2014

Page 52 of 59

establishes criteria for complaint analysts to identify complaints which should be reviewed
further. These could include inquiries from intermediaries or consumers about particularbusiness practices.
210. Typically supervisors monitor the resolution of complaints off-site, using indicatorssuch as:•number of complaints•

number escalated to the supervisor, alternative dispute resolution forums, or otherchannels•turnaround times for resolution•

number of complaints that have resulted in litigation.

211. The supervisor carries out on-site inspection, as required, of the effectiveness of theinsurer’s complaint handling procedures, and of specific complaints or thematic issues
through a focused approach. Other approaches include:•

mystery shopping•

surveys of customers and intermediaries•

input from alternative dispute resolution schemes, other regulators, consumer
organisations and the media.

4.8. Privacy protection
Supervisory requirements
212. Supervisors require insurers and intermediaries to have policies and procedures forthe protection of private information on customers, including policies and procedures in place
to prevent the theft, loss or inappropriate use of private customer information. 51 This isrequired because of the risk to customers and the threat to the reputation of insurers.
213. Even when outsourced, all activities related to receipt, storage and the processing of
personal information remain the ultimate responsibility of the insurer. Supervisors therefore
typically require insurers to have sufficient safeguards in place, in the outsourcing contractand in the insurer’s internal processes, to prevent the misuse or inappropriate use of
personal information through appropriate measures to protect the confidentiality and securityof personal information.
214. Legislation identifies provisions relating to privacy protection under which insurers andintermediaries are allowed to collect, hold, use or communicate personal information ofcustomers to third parties. 52.
215. Where the insurance supervisor is not the sole agency responsible for the protection of
personal information, there should be clear channels of communication, through MOUs or
administrative means, for the appropriate exchange of information on topics such as:•

misuse or the inappropriate communication of personal information•

breaches of laws, regulations, rules or guidelines•

sanctions, penal or criminal procedures or decisions, etc.

Governance monitoring

51 ICP 19.12.

52 ICP 19.11.
Application paper on approaches to conduct of business supervision
October 2014

Page 53 of 59

216. The supervisor will usually review the effectiveness of the insurer’s measures toprotect consumer privacy such as:•policies and procedures relating to privacy protection in order to ensure compliancewith legal provisions and industry best practices•

quality of necessary training of employees at all levels of the organisation, in order topromote awareness of privacy protection requirements•internal control mechanisms that meet the objectives of privacy protection andsupport the achievement of those objectives•

whether the appropriate technology is available and in place to manage adequately
the financial, medical and personal information an insurer is holding on a customer•

policies and procedures relating to managing risks pertaining to security breaches•

ensuring that group structures are not used to circumvent prohibitions on the sharingof personal information.

217. In addition, the supervisor may review controls aimed at ensuring that:•

consumers are notified, on a timely basis, of any breach in confidentiality liable tojeopardise their interests or rights•

supervisors are notified of any violation of the protection of private information liable
to jeopardise the interests or rights of consumers and the insurer’s reputation•

responsible individuals within the insurer are informed of any breach in confidentiality
on a timely basis.

Activity monitoring
218. Supervisors assess insurers’ procedures and safeguards, and their observance of dataprotection laws, by on-site inspection or off-site monitoring. This should include dataprotection procedures and controls where aspects of the business are outsourced.
COB Survey responses
Respondents were asked whether they monitor controls to ensure the protection ofconfidential customer information.
In many jurisdictions, the protection of personal information is dealt with in legislation otherthan the insurance legislation. A different authority might therefore be solely responsible forcompliance by insurers with obligations on the protection of personal information. This
responsibility may also be shared with the insurance supervisor.
However, even if another authority is involved, some insurance supervisors neverthelessrequire insurers to have appropriate controls, safeguards and procedures for protecting thepersonal information of policyholders.
Most supervisors monitor this through on-site inspection. However, in some jurisdictions, it ismonitored through off-site monitoring, disclosure by the insurer via its annual reporting
requirements, or in connection with the handling of customer complaints.

Application paper on approaches to conduct of business supervision
October 2014

Page 54 of 59

5. Other supervisory tools and approaches to COB supervision
5.1

Behavioural economics

219. The use of “nudges” to influence consumer behaviour and gently push them towards apurchasing decision has become a familiar concept – for example, supermarkets are not laidout as they are by accident. In some sectors, including financial services, however, suchinfluences are not so easy to spot. As a consequence, some supervisors are turning tobehavioural economics to help them understand consumers’ choices. For various reasonspeople may make errors when choosing and using financial products, and can sufferconsiderable losses as a result. By using behavioural economics, supervisors have anadditional tool to help them understand how these errors arise and why they persist. This inturn may help inform decisions on what can be done to mitigate them.
220. The growing literature on behavioural economics shows that some errors made by
consumers are persistent and predictable. This raises the prospect of firms designingbusiness models to exploit these behaviours, rather than competing on price and quality.
Understanding behavioural economics enables supervisors to determine how best to countersuch business models and secure better outcomes for consumers.
221. While it is common sense that people make mistakes, behavioural economics goesbeyond intuition and aids in detecting, understanding, and remedying problems that arise
from consumer mistakes. Supervisors can take a closer look at the biases that have themost harmful effects on the decisions that consumers make, and what can be done tomitigate these effects. The findings can be incorporated into supervisory strategy, including
integrating behavioural economics into conduct of business regulation and supervision toenhance regulatory and supervisory effectiveness.

5.2

Communication with industry and consumers

Publication of forward-looking risk assessments
222. Some supervisors are taking a more forward-looking approach to COB risks. This
involves setting out an assessment of the risks foreseen as developing in the near future,
typically over the next 12 or 18 months, together with the likely supervisory action shouldthose risks crystallise. The assessment may also include an explicit message concerning thesupervisor’s expectations of how firms should engage with and react to the analysis
contained in such a risk assessment. 53 Such risk assessments could include both risks
arising from the business models and practices of insurers and other financial institutions, aswell as risks arising from broader economic, regulatory or other external developments.
223. Communicating such risk assessments can encourage insurers to be mindful of midto long-term risk, and to take these risks into account in their current and future businessplans and strategies and product development. In addition, where there are issues thatsupervisors are unable to tackle alone when it comes to the root cause of some of the COB
risks identified, proactively highlighting such issues of concern can help to stop the issues
from becoming major problems.
Dialogue
224. Supervisors can utilise regular communication events that are designed to discuss
topics related to customer fair treatment. Through such dialogue the supervisor can take theopportunity of sharing a clear and common understanding of what is meant by this principle,
as well as of promoting and discussing ways in which the industry can reach the goal oftreating customers fairly. Such dialogues can take place through various forums, including

53 See for example the UK Financial Conduct Authority’s Risk Outlook 2014.
Application paper on approaches to conduct of business supervision
October 2014

Page 55 of 59

events hosted by the supervisor itself, industry or professional association events, consumer
events or, where appropriate, events hosted by specific institutions.
Public disclosure225. Some supervisors publish data related to business conduct, which could include
information such as•

warnings•

performance by the industry in relation to conduct indicators or against conductrelated benchmarks (for example data reflecting performance in respect of customer
complaints or insurance claims data)•

progress by the industry or individual firms in addressing particular weaknesses or inundertaking specific remedial action•

supervisory action taken (including enforcement action).

226. Public reporting of such data by the supervisor can:•contribute significantly in encouraging progress by the industry in addressing
potential market conduct issues, in a proactive and transparent manner•

influence market conduct behaviour by the industry in dealing with consumers andcustomers•

influence the culture and financial awareness of consumers in purchasing insurance•

reinforce and enhance the awareness on market conduct issues by providing multichannel feedback from broad range of stakeholders.

227. Some supervisors also publish, or require insurers themselves to publish, data on
individual insurers’ performance in relation to appropriate conduct indicators or benchmarks– such as complaints or claims related data. The reputational impact of such public
disclosure can act as a deterrent to unfair customer treatment, and an incentive for insurers
to compete over the quality of the customer experiences they deliver.
Regulatory guidance
228. Some supervisors publish guidance to the industry regarding conduct of business
requirements, to supplement formal conduct of business requirements. The legal status ofsuch guidance will depend on the jurisdiction's legal regime, varying from non-binding
guidance in some cases to other cases where the guidance is binding but not necessarily
subject to the same enforcement processes as explicit rules-based requirements. Guidance
can take the form of setting out the supervisor’s expectations on particular conduct
requirements; an indication of how the supervisor interprets or intends to supervise aparticular conduct requirement; or examples of what the supervisor considers good or poor
conduct practices. Such guidance, even where it is non-binding, can be a useful tool foravoiding disputes as to the regulator’s expectations in the event that formal enforcement
action is required, particularly in the case of principles-based requirements. Where asupervisor raises concerns with an insurer regarding its compliance with a principles-based
requirement, it is more difficult for the insurer to argue that the supervisor’s expectations
regarding compliance with the principle were unclear, where guidance has been provided.
5.3

Other approaches

Complementary risk identification
229. Some supervisors have in place a central system for collecting indicators related tofinancial consumer protection. All such indicators come in to a central point for analysis that

Application paper on approaches to conduct of business supervision
October 2014

Page 56 of 59

takes into account other relevant internal and public information and are then referred foraction, where relevant.
230. The sources of such indicators can include:•

consumers•

insurers•

other government and consumer agencies•

cross-border and international supervisory authorities.

231. The supervisor could also share the results of such analysis with these organisations
when it concerns risks to consumer protection outside their own remit.
232. The findings of such analysis would also typically be used to inform the content ofpublished risk assessments, as discussed in section 5.2 above, where these are produced.
Internal changes to enhance consumer protection
233. Supervisors sometimes require insurers to make internal structural changes in seeking
to ensure that they give sufficient attention to the interests of customers. Where this takes
place, the supervisors can assess the impact of such plans on customer treatment. Such anassessment can focus on both the scope and structure of the change plans as well as on the
speed of their implementation. The supervisor can consider how organisations are steered in
a comprehensive way, including whether top management leads by example, how the
principle of the fair treatment of customers is communicated to staff, and how a culture isembedded within the insurer that promotes relevant factors such as customer involvement,
conduciveness of people to change, attitude to feedback and effective governance on
consumer protection matters by the Board.
Changes to the supervisory structure234. Some jurisdictions have reviewed their supervisory structure and made, or areplanning to make, changes to ensure that conduct supervision receives appropriate
resources and attention.
"Dashboards" or similar rating tools
235. Supervisors may develop market conduct "dashboards" or other assessment tools thatare based on customer treatment indicators to measure the extent to which insurers areprioritising customer interests and delivering fair outcomes for customers. These
measurements can be translated into a score or ranking, and be used to identify trends(whether positive or negative) or areas of concern.
236. Individual discussions with different companies about the results of these assessments
enable the supervisor to benchmark different companies, as well as identify good practices
and areas for further improvements. In addition, the general assessment findings can beshared (without identifying individual insurers) with industry more broadly, to create sharedunderstanding of good and poor practices, and help insurers benchmark their own
assessment ratings against those of their peers.
Self-assessment
237. Some supervisors encourage insurers to assess their own compliance with conduct ofbusiness requirements, and share the results with the supervisor. Sometimes such selfassessments are used in combination with other information gathered and analysed by thesupervisor. The additional information helps the supervisor to judge the credibility of the selfassessment, engage in further interaction with the insurer for validation purposes, and thentake the self-assessment into account its own assessment of the insurer. The selfassessment thus contributes to, but does not alone determine the supervisor’s assessment
Application paper on approaches to conduct of business supervision
October 2014

Page 57 of 59

of the insurer. Where weaknesses are identified these can be used to influence the degreeof supervisory intensity needed, as well as to require improvements to be made.
238. Such self-assessments can take the form of “dashboards” or other self-assessment
tools as described in paragraph 228 above. The self-assessment tool can either be
developed by the insurer itself, or in some cases the supervisor may develop a selfassessment tool which insurers may use or adapt voluntarily. Again, discussing selfassessment results with the insurer will assist the supervisor in understanding thechallenges and successes the insurer is experiencing in relation to fair customer treatment,
and identify and agree action to be taken.
COB Survey responses
Survey respondents were asked whether they had made recent changes to their approach to
COB supervision, or whether such changes were planned in the near future.
Responses to this question highlighted an increasing supervisory focus on COB matters.
Nearly half the respondents provided details of recent or pending initiatives to intensify COB
supervision practices, including:
•
•
•
•
•

new insurance legislation and/or regulatory guidance with enhanced COB provisions
strengthening of the supervisor’s mandate in relation to market conduct/businesspracticesfocusing on unfair contract terms
a growing trend toward COB related data collection and analysis
moving to a Twin Peaks model, with prudential supervision and market conduct
supervision carried out by separate regulators, with dedicated focus on COB supervision.

Application paper on approaches to conduct of business supervision
October 2014

Page 58 of 59

Annex I
Selected reference to international standards or material on COB supervision•

AMF, Quebec: Sound Commercial Practices Guideline (June 2013)•

EIOPA: Guidelines on Complaints Handling by Insurance Undertakings (June 2012)•

EIOPA: Report on Best Practices by Insurance Undertakings in handling complaints(June 2012)•

EIOPA: Report on Good Practices on Comparison Websites (January 2014) FCA, UK:
Journey to the FCA (October 2010)•

FCA, UK: Applying behavioural economics at the Financial Conduct Authority (April
2013)

•

FSA, UK: Mystery Shopping Guide (November 2006)•

FSA, South Africa: Implementing a twin peaks model of financial regulation in South
Africa (February 2013)•

NAIC: Market Regulation Handbook (2013)•

OECD: G20 High-level Principles on Financial Consumer Protection (October 2011)

Application paper on approaches to conduct of business supervision
October 2014

Page 59 of 59