ISSUES PAPER ON CONDUCT OF
BUSINESS RISK AND ITSMANAGEMENTNOVEMBER 2015.

About the IAISThe International Association of Insurance Supervisors (IAIS) is a voluntary membershiporganisation of insurance supervisors and regulators from more than 200 jurisdictions innearly 140 countries. The mission of the IAIS is to promote effective and globallyconsistent supervision of the insurance industry in order to develop and maintain fair, safe
and stable insurance markets for the benefit and protection of policyholders and tocontribute to global financial stability.
Established in 1994, the IAIS is the international standard setting body responsible fordeveloping principles, standards and other supporting material for the supervision of theinsurance sector and assisting in their implementation. The IAIS also provides a forum forMembers to share their experiences and understanding of insurance supervision andinsurance markets.
The IAIS coordinates its work with other international financial policymakers andassociations of supervisors or regulators, and assists in shaping financial systems
globally. In particular, the IAIS is a member of the Financial Stability Board (FSB), memberof the Standards Advisory Council of the International Accounting Standards Board (IASB)
and partner in the Access to Insurance Initiative (A2ii). In recognition of its collective
expertise, the IAIS is also routinely called upon by the G20 leaders and other international
standard setting bodies for input on insurance issues as well as on issues relating to theregulation and supervision of the global financial sector.

Issues Papers provide background on particular topics, describe current practices, actual
examples or case studies pertaining to a particular topic and/or identify related regulatory
and supervisory issues and challenges. Issues Papers are primarily descriptive and notmeant to create expectations on how supervisors should implement supervisory material.
Issues Papers often form part of the preparatory work for developing standards and may
contain recommendations for future work by the IAIS.

This document was prepared by the Market Conduct Working Group.
This publication is available on the IAIS website (www.iaisweb.org).
© International Association of Insurance Supervisors 2015. All rights reserved. Brief excerpts may
be reproduced or translated provided the source is stated.

Issues Paper on Conduct of Business Risk and its Management

Contents
1.

Background and purpose ............................................................................................... 4

2.

Conduct of business risk and its impact ......................................................................... 6

3.

2.1

Linkages between conduct and prudential risk ........................................................ 6

2.2

Impacts of a failure to manage conduct of business risk ......................................... 9

Sources of conduct of business risk ............................................................................. 11
3.1

Inherent factors ..................................................................................................... 11

3.2

Governance and business processes ................................................................... 16

3.3

Economic and environmental factors .................................................................... 24

4.

Conduct risk management ........................................................................................... 28

5.

Supervisor’s role .......................................................................................................... 30

6.

5.1

Supervisory requirements and approaches ........................................................... 30

5.2

Risk identification and monitoring.......................................................................... 32

5.3

Communication on conduct of business risk by the supervisor ............................. 32

Conclusion ................................................................................................................... 35

Annex I ............................................................................................................................... 37
Annex II............................................................................................................................... 46

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 3 of 47

1.

Background and purpose

1.
The IAIS Application Paper on Approaches to Conduct of Business Supervision (“theCOB Supervision paper”) 1 points out that, historically, insurance supervisors have sought toprotect policyholder interests mainly by focusing on the financial soundness of individual
insurers and, in more recent times, extending this focus to the financial soundness of
insurance groups and conglomerates. Although it has long been recognised that supervisorysystems should also protect consumers from unfair or abusive business practices, this has
typically been regarded as secondary to maintaining financial soundness.
2.
However, the impact of poor business conduct has attracted more attention in recent
years. Conduct failings can and do occur in, and affect, individual insurance markets. The
recent global financial crisis highlighted that poor conduct of business can also give rise tosystemic risks. Not only does poor conduct affect individual customers, it can impact the
reputation of individual insurers, whole markets, or consumer confidence in the sector as awhole.
3.
It is important to financial sector supervisors that supervisory frameworks adequately
and holistically address both prudential and conduct of business risks, and also recognise thedifferences and interlinkages between the two.
4.
Prudential and conduct of business supervision pursue a common goal in protecting
the interests of customers. Indeed, the connection between consumer protection and financial
soundness is made in the IAIS’s mission statement: “The mission of the Association is to (a)promote effective and globally consistent supervision of the insurance industry in order todevelop and maintain fair, safe and stable insurance markets for the benefit and protection ofpolicyholders; and to (b) contribute to global financial stability.” The main difference between
the two types of supervision might be described as the lens through which the supervisor looks
at an entity or market. The prudential approach looks through a capital and solvency lens,
while the conduct supervisor looks through the lens of the customer.
5.
While ICP 8 (Risk Management and Internal Controls) and ICP 16 (Enterprise Risk
Management for Solvency Purposes) address the identification and management of risk within
an insurer, IAIS literature in general is currently limited in its discussion of conduct of businessrisk. It could be argued that conduct of business risk is implicitly considered to fall within thereferences in those ICPs to “operational risk”, which requires appropriate risk management(ICP 8) and sufficient capital (ICP 16). However, there is benefit to having more discussion
specific to the management and/or mitigation of conduct of business risk.
6.
In the aftermath of the financial crisis, supervisors’ immediate priorities were to focus
on prudential regulatory issues, including strengthening capital. As the concept of conduct ofbusiness risk now gathers momentum globally, it is timely that the IAIS considers this form ofrisk in more detail within the context of supervision of the insurance sector. This is also
recognised in the IAIS Mission and 2015 – 19 Strategic Goals, 2 High Level Goal 2, which
recognises the importance of conduct of business supervision alongside prudential
supervision. In addition, other international bodies are focusing on conduct of business risk,
as evidenced by publications of the Financial Stability Board (FSB), the Organisation for
Economic Co-operating and Development (OECD) and others.
7.
In describing conduct of business risk and its mitigation, this Issues Paper seeks tocontribute to a comprehensive understanding and assessment of a sound risk culture andraise awareness of conduct of business risk, with a primary focus on retail customers. It
1 IAIS Application Paper on Approaches to Conduct of Business Supervision, paragraph 36.
2 IAIS Mission and 2015-19 Strategic Goals, available on the IAIS’s public website, under “About the IAIS”.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 4 of 47

reflects and highlights ideas on the scope of, and approaches to, conduct of business risk
management that IAIS members may wish to consider when implementing ICP 19 on Conduct
of Business, ICP 18 on Intermediaries and ICP 9 on Supervisory Review and Reporting. Moreparticularly, the paper considers the sources and impact of conduct of business risk and its
place within risk management frameworks. It also considers the mitigation of conduct ofbusiness risk in terms of both the management of conduct of business risk by the regulated
entities themselves and the role that the supervisor can play. In doing so, the paper discusses
some of the broader consequences that can come from inadequate management of conductof business issues, such as harm not only to policyholders but to insurers, intermediaries andthe insurance sector as a whole. In this regard, the linkages between conduct of business risk
and risks to financial soundness (prudential risk) are considered.
8.
As an Issues Paper, this paper provides background, describes current practices andexamples of relevant business conduct, and identifies regulatory and supervisory challenges
relevant to its subject matter. Given that its subject matter is conduct risk, the paper inevitably
highlights aspects of insurance markets and insurance business models or practices that havethe potential to result in unfair customer treatment. The paper does not suggest that thebusiness models or practices noted are inherently problematic. On the contrary, the paper
notes that a number of the elements discussed are beneficial to customers, assuming any
associated risks are adequately managed. The paper therefore does not propose thatsupervisors should implement any specific regulatory or supervisory interventions. Instead, itseeks to provide insights that may be helpful to insurers and supervisors in making their own
risk-based assessment of conduct risks in their environments, taking into account the extent
to which the issues highlighted are applicable to them, as well as the risk mitigation measuresthey may already have implemented.
9.
Importantly, in considering the potential risks posed by a business model or practice,care should be taken not to stifle potential positive effects of innovation and competition.
10.
This section having provided the background and purpose of the paper, section 2
discusses conduct of business risk and its impact; section 3 outlines the sources of conductof business risk; section 4 provides a description of conduct of business risk management;
section 5 adds considerations on the supervisor’s role in monitoring insurers’ andintermediaries’ conduct of business risk. Finally, concluding remarks are made in section 6.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 5 of 47

2.

Conduct of business risk and its impact

11.
It is useful firstly to consider what – for the purposes of this paper – “conduct ofbusiness risk” means. In the COB Supervision paper, 3 the point is made that different
jurisdictions interpret the scope of conduct of business supervision differently. For example,
in some cases conduct of business supervision is seen as part of a broader “market conduct”
mandate, which includes supervision of market efficiency and integrity aspects such as
disclosures to the financial markets, financial market infrastructures (e.g. securities or otherexchanges), insider trading and market abuse, and related activities. It would follow that insuch jurisdictions the understanding of conduct of business risk would therefore also
encompass these broader elements. The COB Supervision paper however confines its
discussion of conduct of business to matters “primarily concerned with the fair treatment ofcustomers”, in line with the language used in ICP 19. This Issues Paper adopts a similar
approach. For purposes of this paper, a high-level description of conduct of business risk might
therefore read as follows:“Conduct of business risk can be described as the risk to customers, insurers, theinsurance sector or the insurance market that arises from insurers and/orintermediaries conducting their business in a way that does not ensure fairtreatment of customers.” 412.
This description includes the risks to which insurers, intermediaries and the insurance
sector may be exposed as a result of their poor business conduct, as well as the risks to whichsuch conduct exposes their customers. This paper primarily focuses on conduct of businessrisk to retail customers.
2.1

Linkages between conduct and prudential risk

13.
The interaction between conduct of business and prudential risks is a dynamic one.
For example, poor management of prudential risk may lead to an insurer or intermediary being
under financial pressure, which could increase the risk of poor customer treatment such as
unfair pricing, inappropriate “hard selling” sales tactics, or unfair claims handling. Conversely,
persistent poor customer outcomes may in turn expose an entity to reputational, legal andregulatory risks that could ultimately threaten its sustainability.
14.
The definition above suggests that there are key differences between conduct andprudential risks. These differences will lead to different but complementary approaches to risk
management and supervision.
Differences in scope and interaction between prudential and conduct of business risks
15.
The first difference is one of scope. Conduct of business risk includes risks to which
insurers and intermediaries become exposed as a result of the way in which they conduct theirbusiness. Equally, the way in which insurers and intermediaries conduct their business could
expose them to prudential risks. All such risks should be assessed holistically. However, while
3 Paragraph 2.2.1
4 In accordance with ICP 19, the supervisor sets requirements for the conduct of the business of insurance toensure that customers are treated fairly both before a contract is entered into and through to the point at which all
obligations under a contract has been satisfied. ICP 19 describes the principle of fair treatment of customers asencompassing concepts such as ethical behaviour, acting in good faith and the prohibition of abusive practices. In
this paper, terms such as “poor customer outcomes” and “poor customer treatment” are used in this context – theyrefer to the effects on customers of not adhering to these fair treatment concepts, as elaborated in the standards
and guidance in ICP19. Although different products, different distribution channels, different business models andpractices may entail widely divergent degrees or types of conduct risk, all insurance and insurance intermediation
business should result in fair customer outcomes.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 6 of 47

prudential risk management focuses almost entirely on risks to the insurer or intermediary
itself, conduct of business risk also covers risks faced by the customers of those insurers orintermediaries.
16.
In seeking to ensure financial soundness, insurers may focus on mitigating prudential
risks through underwriting and administrative practices that promote profitability and containcosts. If too aggressive, these can compromise the interests of their customers in terms of
ensuring that product benefits, terms and conditions, and product servicing deliver fairoutcomes for customers.
17.
Recognising the interaction between conduct risks and prudential risks over time is ofimportance for insurers’ risk management frameworks.
18.
As pointed out in the COB Supervision paper, 5 contrary to what happens in the caseof prudential risks, conduct of business risk may not constitute immediate or direct threats toan insurer’s sustainability and soundness, and consequently may not initially attract theattention of prudential supervisors. Nevertheless conduct of business risk can ultimately leadto prudential concerns.
19.
This is why monitoring conduct of business risk may play a significant role in the early
detection of issues that could affect the financial strength of an insurer, and provide animportant input into prudential supervision.
20.
For example, unfair or misleading business practices can be symptoms of insufficient
control over distribution channels, ineffective governance or inadequate internal controls.
Such issues may contribute to financial difficulties whereby insurers need to reassess existingcommitments or redress the mis-selling of products. In the same way, inappropriate claims
payment policies can be a means to compensate for otherwise unprofitable products or otherfinancial pressures. By identifying unfair customer outcomes, conduct of business supervisors
can help prudential supervisors in anticipating emerging prudential concerns.
Complementary impacts of prudential and conduct of business risks on financial stability
21.
The second point of interaction between conduct risks and prudential risks is thedifferent but complementary roles they play in relation to financial stability.
22.
The recent global financial crisis highlighted that systemic risks can arise not only
through poor financial and capital management, but also in poor conduct of business practices.
As part of its work on risk governance, the FSB identified poor business conduct as a sourceof financial instability, leading to the FSB doing further work in this area. 6
23.
For example, to manage their prudential risks, financial institutions, including insurers,
may be tempted to transfer more risks to the customer or accept less risks from them. If
conduct of business risk is not appropriately managed, this may lead to the accumulation ofrisks that customers are not aware of or not able to sustain.
24.
Unfair customer outcomes and poor business practices impact the lives of large
numbers of financial services customers. Reducing conduct of business risk and promoting
fair conduct of business practices – including through requiring insurers and intermediaries toconsistently consider the interests of their customers – increases customers’ trust that
regulated entities will treat them fairly. Effective conduct supervision and management of
5 See paragraph 36.
6 In its guidance on Supervisory Interaction with Financial Institutions on Risk Culture (April 2014), the FSB notes:
An environment that promotes integrity should be created across the institution as whole, including focusing on fairoutcomes for customers. See also sections 1 and 3.2.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 7 of 47

conduct risk therefore also has wider social and economic benefits that go beyond theprudential supervisory framework.
25.
Where poor practices become widespread, this may undermine consumer trust in the
sector as a whole, with resultant impacts on sustainability. Effective monitoring andmanagement of conduct of business risk therefore also supports the broader objective offinancial stability. Equally, promoting stability of the financial sector, including prudential
supervisory action, enhances both consumer trust and the protection of customers.
26.
The interaction between conduct and prudential risks means that addressing theserisks through supervision requires appropriate coordination between conduct and prudential
supervisors. This is discussed further in section 5.
Risk indicators
27.
The differences and links between prudential and conduct of business risks can also
be illustrated by the differences and linkages between the indicators used to identify theserisks.
28.
Assessing prudential risks typically entails close monitoring of indicators such as profit,
growth, cost, claims and combined ratios. The development of an insurer’s profit and growth,for example, has effects on its capital and solvency. On the other hand, the same indicators
can serve as conduct risk indicators (see Annex I). Looking through the prudential supervision
lens, high profit – provided it appears sustainable – is typically considered beneficial for an
insurer’s capital and solvency. From a market conduct perspective, it is possible that an insurer
may be earning high profits because it is efficiently managed and may offer good value tocustomers. But high profit (historic and planned) may also be driven at the expense of faircustomer outcomes, so may be an indicator of products which offer poor value to customers,
or aggressive selling practices or high incentives for inappropriate sales. It is therefore crucial– for regulated entities and supervisors alike – to apply both prudential and conductconsiderations to an assessment of financial data. 7
29.
However, to complement the prudential approach, the monitoring of conduct ofbusiness risk needs to recognise the social and legal context of the market and the nature,scale and complexity of insurers’ and intermediaries’ businesses from a customer perspective.
It is also concerned with ensuring that both the collective interests of customers and theinterests and needs of individual customers are appropriately taken into account throughout
the product life cycle (i.e. from product design through to the point at which all obligations
under a policy have been fulfilled).
30.
Conduct of business risk indicators may therefore comprise a relatively greater
proportion of qualitative information than prudential risk indicators. Their focus may also be
different and comprise both indicators applied at the level of the individual insurer – possibly
in comparison with their peer group or market sector – and indicators aimed at assessing
market outcomes more globally. For this purpose, conduct risk indicators may be drawn frominternal sources (internal to the insurers or intermediaries) as well as external sources, in orderto obtain a picture that is as complete as possible, and to monitor the market in the mostholistic way.

7 See the discussion in section 5.1 regarding co-ordination between conduct and prudential supervisors, whereapplicable.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 8 of 47

2.2

Impacts of a failure to manage conduct of business risk

Impacts on customers
31.
Failure to adequately manage conduct of business risk has a direct impact on
customers. It may lead to customers being sold products they do not need and/or failing to
buy the insurance products they do need or being inadequately insured. Also, customers may
experience a range of unfair outcomes, including not having their reasonable benefit andservice expectations met.
Impacts on individual insurers and intermediaries
32.
There is link between a conduct of business risk exposure for customers and for
insurers or intermediaries. Persistent or materially poor outcomes for customers will lead toadverse impacts for insurers or intermediaries themselves. For example, customer complaints
may lead to reputational risks and/or a decline in business. A failure to properly manage
conduct of business risk may transform into a legal/regulatory risk, also leading to reputational
damage and/or it may affect the financial soundness of the individual insurer or intermediary.
Ultimately, the reputation of the industry can suffer.
Example from the Netherlands
In the Netherlands, for example, a financial conglomerate sold term life insurance jointly with mortgages. The
life insurance premium was paid at the time of taking out the mortgage, as a lump sum, and was financed via
the mortgage. The purpose of the life insurance was to ensure that the mortgage would be paid even if one of
the income providers passed away, and premiums were very high. Because the mortgage included buying
expenses and tax as well as the life insurance premium in addition to the value of the property, this led to
mortgages that were too high in relation to the value of the underlying property. As property prices were rising,
this did not cause major problems. However, when interest rates started rising, a large number of customers
were unable to service their mortgages. This generated a lot of negative publicity, led to a run on the banking
division of the conglomerate and ultimately to a bankruptcy.
Broader adverse impacts
33.
As discussed in more detail in section 2.1, conduct of business risk can emerge more
broadly within insurance markets and have market-wide impact in that market, damaging
consumer trust and potentially ultimately affecting the financial stability of the market
concerned. As noted in the COB Supervision paper, the global financial crisis demonstrated
that systemic risks can arise not only through failings in financial and capital management but
also from poor conduct of business practices. The indiscriminate marketing and poorly
targeted sales of sub-prime mortgage products is an example of how failings in conduct cancontribute to systemic financial instability.
Example from Slovenia
In Slovenia, there was a large scale operation by non-licensed insurance intermediaries in the late ‘80s andearly ’90s selling life insurance policies issued by non-licensed insurers. The essence of the operation was apyramid or Ponzi scheme. The main motives of the policyholders for buying insurance were the promise of highreturns through future commission. Together with high inflation in the late ‘80s, such sales practices virtuallydestroyed the life insurance market for several years. Slovenian regulators and the supervisor have resolved
the issue with strict licensing requirements; however, the consequences might occasionally still be felt in certain
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 9 of 47

sales practices and in the perception of life insurance by consumers. Moreover, at least one insurer has beendenied entry into the Slovenian market until it has resolved the issue of selling non-approved policies.
34.
Significant market conduct failures can materially affect the confidence in particularinsurance products or the insurance sector as whole. In particular, mis-selling practices, where
the products are sold on a large scale without proper disclosure to customers who cannot
afford them or do not need them, may be a source of long-term mistrust in the insurance
industry.
Example from Zimbabwe 8
Eco-Life was a partnership between Econet Wireless (the largest mobile network operator in Zimbabwe), First
Mutual Life (an insurer in Zimbabwe) and Trustco (a third party technical service provider based in Namibia). EcoLife reached 20% of the adult population within 7 months of launch, but due to a dispute between two of the noninsurance entities, Trustco and Econet, the scheme was discontinued overnight. In undertaking a survey of the
discontinued customers of Eco-Life, 63% ruled out the use of similar products in future, 42% were dissatisfied withinsurance and 30% felt there were better ways to protect against future problems than insurance. Considering the
product had reached 20% of the adult population, the impact was significant.

8 Jeremy Leach and Sandisiwe Ncube, Regulating m-insurance in Zimbabwe: managing risk while facilitating
innovation (March 2014, Finmark trust). This example is also mentioned in the Issues Paper on Conduct ofBusiness in Inclusive Insurance (paragraph 40).
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 10 of 47

3. Sources of conduct of business risk
35.
As discussed in the COB Supervision paper, the sources and indicators of conduct ofbusiness risk may differ from those monitored by supervisors focusing on prudential risk.
Sources of conduct of business risk may be broadly grouped into:•

Inherent factors: These are factors inherent in the nature of insurance business and,in many cases, inherent in the nature of financial service provision more broadly. They
would include aspects of the very nature of financial products and services,
information asymmetries between consumers and industry players, and aspects ofthe behaviour of financial customers generally•

Factors related to governance and business processes: These are factors whereaspects of the insurer’s or intermediary’s own governance models or businessprocesses can contribute to conduct of business risk•

Economic and environmental factors: These are factors related to the external
environment in which an insurer or intermediary conducts its business, but which are
typically outside its control.

These factors – which are not mutually exclusive – are expanded on in sections 3.1 to 3.3
below.
36.
The discussion focuses on the sources of conduct risk. This does not mean that theelements of risk identified in this section are in their nature and always prejudicial tocustomers. On the contrary, they can also have positive impacts on customers. For instance,
although risks related to competition and innovation are highlighted here, both clearly also
provide opportunities and benefits to customers where these risks are appropriately managed.
3.1

Inherent factors

Inherent nature of insurance products and how they are distributed
37.
Unlike typical consumer goods, financial products such as insurance products areintangible. The social “public good” benefits of insurance to the economy as a whole, and the“peace of mind” benefits insurance offers to individual customers are crucial benefits – but are
not visible in the way physical assets are. Customers cannot see, touch or taste the productthey are purchasing and are therefore unable to immediately assess whether the productmeets – or does not meet – their needs or expectations, in the way they would do if they werepurchasing a physical asset. This adds to the complexity of insurance transactions from acustomer perspective. The need for fair and appropriate product information that can beunderstood by the target customer base at point of sale is therefore greater for financial
products than for tangible consumer goods.
38.
Related to this, the advantages of insurance products – where these take the form ofa financial pay-out – are often only realised a considerable time (sometimes many years) after
the purchase, when a claim arises or when the customer seeks to access savings orinvestment benefits. Unless sufficient and appropriate information is provided – andunderstood – at both the point of sale and appropriate stages during the life of the product, it
is often only at this later stage that mis-selling, inappropriate advice or product limitations
become apparent, resulting in a failure to meet customer benefit expectations. In many cases,no claim or financial pay-out may arise at all, and the benefit of the insurance purchase lies
solely in the peace of mind provided to customers and their dependants that they are protectedagainst adversity. The need for adequate ongoing information to ensure that customer benefit
expectations are managed and that insurance products remain suitable over the life of the
product is therefore far greater than for many other purchases.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 11 of 47

39.
One particular inherent feature of insurance products – particularly non-investment
insurance products – is that their sales are often “supply driven”. As opposed to physicalassets or even other financial products (such as banking or investment products) consumers
are not per se inclined to buy them. Most of the population is to a greater or lesser degreeaware that it needs some sort of insurance protection, 9 however, for reasons outlined above,
the benefit of insurance may not always be immediately obvious for the consumer. In addition,
insurance products by their very nature deal with negative situations, which customers willoften be reluctant to contemplate at their own initiative. Insurers have adopted various
distribution strategies to overcome this inherent challenge.
40.
The most common strategy is to distribute insurance products via intermediaries, whowill alert the customer to the need for and benefits of insurance coverage. In mostintermediated distribution models, intermediaries approach prospective customers (including
in some cases offering to visit them at their own homes or workplaces) with a view torecommending a product rather than relying on the customer to initiate contact. The mostcommon model for remunerating insurance intermediaries for their services is for the insurer
to pay them commissions based on number and value of successful sales. Commissions areoften coupled with additional incentives to achieve particular sales volumes and/or the settingof minimum sales targets.
41.
Within the context of insurance distribution, intermediaries play a very valuable but
potentially sensitive role. On the one hand, insurance intermediaries play a pivotal role inaddressing the risks faced by customers and ensuring proper insurance coverage. They also
play an essential role in mitigating the information asymmetry risks discussed below, byplacing the customer in the position to make an informed purchase decision and educating
the customer on the nature and benefits of insurance.
42.
On the other hand, the traditional commission-based remuneration model for
insurance intermediaries could be a source of conduct of business risk. The commission
model – typically designed primarily to compensate and incentivise sales – may create
misalignment between the interests of the insurer and intermediary on the one hand and theinterests of the customer on the other. In some jurisdictions, any inherent risks arising fromthis potential misalignment are regarded as effectively managed though appropriate
disclosure, informed customer consent, or other controls. In other jurisdictions, commission
as a form of remuneration is seen as introducing unmanageable conflicts of interest, and steps
have been taken to prohibit or limit the payment of commissions. (See further discussion on
Conflicts of Interest in section 3.2). Arguments are, however, also raised that any suchinterventions should be considered carefully as they may result in limiting consumers’ accessto advice and product choice and under-insurance.
43.
Another mechanism insurers use to address the “supply driven” nature of insurance isby adopting direct marketing strategies where insurer representatives make unsolicited calls
or visits to potential customers to promote products. Such strategies can be an efficient andcost-effective method to promote insurance coverage in markets where traditional
intermediated models may not be sustainable or may not be accessible to all customers.
However, in the case of direct unsolicited calls, the risk arises that the customer feelspressured into concluding a transaction without having adequate opportunity to consider theirdecision.
44.
Another strategy for responding to the “supply driven” challenge is marketing insurance
products alongside, or as an add-on to other ‘primary’ products. This business model may also
9 There are of course cases where consumers, including businesses and professional customers, appreciate thebenefits of insurance and proactively initiate its purchase.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 12 of 47

be referred to as “bundling” of insurance products with other products. These primary products
may be financial services – such as home loans or other credit products, banking products,
etc. – or they may be non-financial products – such as motor vehicles, mobile phones, furnitureor services such as passenger flights. 10 Advantages of this business model include customer
convenience and an effective way to meet multiple needs through a single transaction.
45.
On the other hand, the add-on distribution model has a real impact on customer
behaviour and affects the way people make decisions. Customers’ attention is mainly on thepurchase of the primary product rather than the add-on, leading many to buy add-on products
they do not need or understand. Buyers of add-on products are less likely to shop around andless price sensitive. They may also have a poor awareness of the pricing or benefits of theinsurance products, or even whether they have bought an insurance product at all. This risk
is particularly high in relation to credit insurance, 11 where the customer’s priority is obtaining
credit in order to take out a loan or to acquire an asset such as a property, vehicle or item offurniture on credit, and they pay little heed to whether the insurance product that is “bundled”
together with the credit offering is in fact appropriate to their needs. These risks are further
exacerbated where the customer is obliged to purchase credit insurance – or even the credit
insurance product of a particular insurer – as a prerequisite for obtaining credit (a practicesometimes referred to as “tying”).
Example from Australia: Add-on insurance
In 2014 the Australian Securities and Investments Commission (ASIC) obtained significant penalties through court
action against a firm providing short term, small amount credit contracts to low income consumers (called 'payday'loans in Australia). While the main focus of ASIC's case was on the irresponsible provision of credit, ASIC also
alleged that the add-on consumer credit insurance (CCI) sold with the loans was fundamentally inappropriate. The
consumers of such credit generally have a low level of financial literacy, and it was clear that most either did notunderstand the insurance or know they had purchased insurance with their loan. The majority of the consumers
taking out the loans and the associated insurance were unemployed, which meant that they were ineligible to claimon the insurance. The Judge in her decision said that 'I accept ASIC's submission that CCI was unlikely to be of
any use to customers for a payday loan and certainly useless for those who were unemployed, a fact that musthave been known to the provider…The terms of the CCI were such that the insurance was self-evidently unsuited
to the needs of most customers'. The court found that the sale of this insurance was 'unconscionable' under
Australian law.

10 The term “bundling” is sometimes used more narrowly. For example, the Issues Paper on Conduct of Businessin Inclusive Insurance (e.g. paragraph 58), uses the term “bundled” to mean insurance products that combine morethan one risk-based insurance cover in one product, such as a term life cover combined with a health cover.
11 Credit insurance may also be referred to as “payment protection insurance” (PPI) – see the UK example inAnnex II - “debt protection cover” or similar terms. The products are usually designed either to settle the amount ofan outstanding debt or to fund outstanding credit instalments in the event of the debtor’s inability to continue
payment due to death, disability, loss of income, or similar contingencies.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 13 of 47

Example from South Africa: Consumer Credit Insurance
The South African National Treasury and Financial Services Board jointly published a Technical Report on theConsumer Credit Insurance (CCI) Market in South Africa in July 2014, 12 highlighting significant concerns regarding
poor market practices and unfair customer outcomes in the CCI market. These included lack of transparency;
disproportionately high premiums; limited comparability of different CCI products; and concerns that the products
do not meet the needs of the target market. The report noted weaknesses in the structure and operation of the CCI
market, including ineffective competition. This was identified as being largely attributable to the “bundled” natureof the product and the high degree of interconnection between insurers, credit providers and distributors in themarket – all exacerbated by information asymmetry. The paper invited public comment on a number of regulatoryinterventions to improve business conduct by insurers and distributors, as well as more structural interventions in
the market.
Example from the United Kingdom: Payment Protection Insurance (PPI)See Annex II.
46.
Customers’ ability to assess options and make choices may be hindered by the factthat there is often insufficient information available about the quality and prices of bundled or
add-on products, and what information is available is often presented very late. Add-on
providers benefit from a clear point-of-sale advantage in comparison with standalone
providers, which is reinforced by the way customers respond to the add-on option. There islittle pressure on insurers to offer good value, and standalone products do not generally
constrain sales of add-ons. Analysis shows that this can lead to poor value, and to prices
significantly above cost for many add-on products. Ineffective competition translates into
customers paying too much and receiving poor value when buying products distributed in thisway.
Information asymmetries
47.
Information asymmetries arise where one party has better information orunderstanding of that information than the other. This is particularly relevant in regard to
information held by customers, insurers and intermediaries respectively in the buying andselling of insurance.
48.
Insurers and insurance intermediaries have the advantage of better knowledge of thecharacteristics of the products they sell and may even have better understanding of the risk
profile of customers than the customers themselves. Consumers of insurance products all too
often do not fully understand the products and services they buy. As a consequence they often
do not give the right signals or may provide incomplete information to insurers orintermediaries.
49.
In the most developed insurance markets, insurance pricing has become extremelyrefined as insurers utilise big data and a variety of predictive analytical scoring models. Big
data can be used to benefit customers, for example by allowing more tailored insurance
solutions or more accurate risk pricing. However, the advent of big data also means that thenature and extent of information asymmetry has grown in the insurers’ favour.
50.
Financial product and service innovation can result in improved competition and more
effective and efficient service offerings, while low levels of competition and innovation may
pose a corresponding risk to optimal customer and market outcomes. However, with new
12 Available at www.treasury.gov.za.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 14 of 47

products and processes come new risks. Innovation can result in greater complexity of
products and corresponding risks that products are not adequately understood. In addition to
the growing complexity of insurance products, the distribution channels and servicing models
for products have become more numerous and of different types. A wider range of distribution
channels may improve and simplify access to insurance, but also adds to the complexities thatface customers when trying to understand the environment in which they are buying a productand assessing the range of products and channels available to them. Ease of access to
product information, for example through digital channels, has the advantage of offering
customers greater choice – but the range of choices may in itself be bewildering. Supervisors
will therefore need to adopt a risk-based approach in striking an appropriate balance between
the benefits of innovation, while recognising associated risks.
51.
In view of these complexities, disclosure alone may not be sufficient to address
conduct risks arising from asymmetry. In some jurisdictions, supervisors and policy makers
have adopted a more interventionist approach to addressing the inherent risks of information
asymmetry. Such interventions include the setting of explicit product standards for products
sold to less financially sophisticated customer groups, and the prohibition or limitation ofcertain types of distribution models for certain types of products.
52.
Enhancing consumers’ financial capability has been targeted as an international goalof the G20, leading to the publication of High-level Principles on National Strategies for
Financial Education 13 that were developed by the OECD International Network on Financial
Education (OECD/INFE).
53.
Indeed, education plays a major role in enabling consumers to understand theinformation disclosed to them. Where financial literacy levels are low, the inherent information
asymmetry between consumers and industry players is exacerbated and the risk related tothat asymmetry is increased. 14 In addition, where consumers have low levels of financial
literacy, the competitive benefits of innovation may be undermined, as customers may not be
in a position to make informed choices. The aftermath of the financial crisis has shown how
important financial literacy is, especially in an environment in which products have become
more and more complex, with risks transferred to customers, sometimes in an opaque mannerand involving an increasing number of stakeholders. Increasing financial capability thus canhelp to mitigate risks that arise from information asymmetries.
54.
The goal of financial literacy is to empower consumers with knowledge that will help
their understanding of financial markets and products and so enhance their “market power”,
including through supporting ease of access to the information customers require to makeinformed decisions. There are other approaches to increasing consumer market power as ameans of promoting market discipline on insurers and intermediaries. These include measuresrelating to suitability of disclosure and requirements for, and limitations on, product design.
55.
However, due to the inherent complexity of insurance products and the limited timecustomers can or will devote to the study of detailed contracts, education cannot be
considered as a panacea. Even well-educated customers can face difficulties in understanding
risk and product features. Therefore, disclosure and advice are of utmost importance during
the sale process and on an appropriate ongoing basis during the life of the contract.

13 Available at the OECD website.
14 See also the discussion in the IAIS Application Paper on Approaches to Conduct Supervision, regarding theneed to take a jurisdiction’s financial education levels into account in developing a conduct of business supervisionframework. In jurisdictions where such education levels are high, the inherent risk of financial asymmetry is
proportionally lower.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 15 of 47

56.
In inclusive insurance markets, the fair treatment of customers and providing value tocustomers often support public policy objectives such as poverty alleviation, food security andimproving the health of the population.
Consumer behaviour
57.
Even when consumers are fully informed and capable of making a decision,
behavioural biases can still lead to suboptimal results. 15 The consumer is not a homo
economicus who always chooses the product or service that best suits his/her needs.
Consumers will not necessarily make decisions that have entirely rational bases; sometimes
other factors play a role in the decision, for example culture, intuition and emotion.
58.
For many decades, economics relied on models that assumed people chose rationally:
with normal capability, people would form accurate expectations about the likelihood of future
events, and choose the product that best served their needs by assessing all relevant costs
and benefits. The growing literature on behavioural economics shows not only that this is not
the case, but also that some errors made by consumers are persistent and predictable. This
raises the prospect of insurers and intermediaries designing business models to takeadvantage of these behaviours, rather than designing products and processes to mitigate risks
arising from these behaviours.
59.
Behavioural biases can be placed in three categories. First would be “preferences”,
such as present bias, where the urge for immediate gratification values the present more
highly than the future – an example would be over-borrowing; using a high interest short termloan to buy the latest tablet or mobile phone, without thinking how the loan would be repaid.
Second would be “beliefs”, such as over-confidence – for example, an excessive belief in
one’s ability to select winning stocks. Third would be “decision-making” bias, such as
persuasion and social influences – an example would be consumers allowing themselves tobe persuaded to trust the sales person because he or she comes across as ‘likeable’ andtherefore trustworthy, and thus relying on their financial advice, without necessarily giving
weight to the nature or quality of the advice itself or the possible effect of economic incentives
for the adviser.
60.
While biases affect consumer choices in many different markets, there are several
reasons why they are particularly likely to affect decisions in retail financial markets: mostconsumers find financial products complex; many financial decisions require assessing risk
and uncertainty; financial decisions may require making trade-offs between the present andthe future; many financial decisions are emotional; and it can be difficult to learn about financial
products.
61.
This can cause problems that financial markets, left to themselves, may not be able tosolve. See for example the discussion above regarding the impact of “bundling” or add-on
distribution models on customer behaviour.
3.2

Governance and business processes

62.
One of the objectives of corporate governance by insurers and intermediaries is toprotect the interests of policyholders. 16
63.
A governance framework has culture at its heart; this influences the way in which
individuals behave. Where a culture of fair treatment of customers is not embedded within
15 The UK’s Financial Conduct Authority has conducted work in this area. See Occasional Paper No. 1: Applying
behavioural biases at the Financial Conduct Authority, April 2013.
16 See ICP 7 in relation to insurers.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 16 of 47

business objectives and strategies, there is a higher risk that staff and management behaviouror business processes give rise to poor customer outcomes. The culture of an organisationneeds to be set from the top (i.e. the Board and Senior Management), and embedded
throughout the organisation and in those who represent it.
64.
In order to mitigate conduct of business risk, a culture of fair treatment needs to be
sufficiently reflected in the governance framework and business objectives and strategies, with
sufficient attention paid to ensuring fair customer outcomes in the corresponding policies,
procedures, risk management and internal controls. In assessing the adequacy of thegovernance framework to promote fair customer outcomes, the following are some of the key
factors and areas that may be relevant :•the Board and Senior Management are sufficiently involved in and accountablefor promoting good business conduct•

policies and procedures on managing conflicts of interests, and in relation to
ethics and fair customer treatment are adequate•

appropriate product design governance or, in the case of intermediaries,
appropriate product selection processes, ensure that products are designed andpromoted to be suitable to the needs of target markets•

remuneration and incentive policies sufficiently take into account good customer
outcomes•

staff at all appropriate levels are adequately trained in the organisation’scommitment to good business conduct and what they need to do to ensure it isachieved•

recruitment, performance management, and disciplinary processes takecustomer outcomes into account•complaints and claims are adequately managed.

65.
Where insurers and intermediaries do not embed a culture of fair treatment ofcustomers within their governance frameworks and business processes, there is a higher riskof poor customer outcomes. This message is also emphasised by the FSB, which addresses
business conduct as a key element of a sound risk culture. 17 Some of the key sources of risk
are considered below.
Governance and risk management frameworks’ focus on conduct of business66.
In light of the historical supervisory emphasis on prudential risks, the governanceprocesses of insurers and intermediaries, in some jurisdictions, have tended to focus on
financial aspects to a greater degree than customer facing aspects of the business. Risk
management frameworks – including frameworks for internal and external audit andcompliance monitoring – tend to focus on financial soundness risks to the entity itself, withless emphasis on risks posed to the insurer’s and intermediary’s customers (see further
discussion in Section 4 below). Related governance processes such as decision-making
frameworks and delegations of authority also tend to be based on financial consequences tothe entity rather than the impact on the customer.

17 See Section 1 above and FSB: Guidance on Supervisory Interaction with Financial Institutions on Risk Culture,
A Framework for Assessing Risk Culture, 7 April 2014.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 17 of 47

Conflicts of interest
67.
Conflicts of interest can create barriers to good conduct, particularly where theinsurance seller is in a stronger position than the buyer, for example in view of information
asymmetries. Conflicts arise where the insurer or intermediary is subject to competinginterests; a number of examples of situations in which these can arise are given in ICP 19. 18
Where personal interests, including incentives, compete with duties of care owed tocustomers, they can create risks that insurers and intermediaries will not act in customers’
best interests.
68.
Sales incentives (including, in some jurisdictions, commissions) have been a particularsource of concern in many jurisdictions. Risks increase where remuneration structures do notsupport fair treatment. Where incentives do not sufficiently take into account good customer
outcomes as a factor, this can encourage behaviour by insurance intermediaries or the
insurer’s sales staff that is not in the best interest of their customers. For example, they mightrecommend a product that would result in a higher commission or a salary bonus rather than
one that best suits the customer’s needs, or encourage a customer to buy a product that they
do not need.
69.
Intermediary compensation structures which do not align the interests of the insurer
and intermediary with the interest of the customer, for example by rewarding sales over longterm retention or suitability of the products, can result in unsuitable sales or the unnecessary
replacement of life insurance and savings products. Such compensation structures may put
intermediaries under pressure to achieve sales results and “push” sales of products that
customers might not need or be able to afford. Furthermore, efforts to ensure a sale might
involve advising customers to enter into lower priced products which offer lower protection
than required.
70.
The increased sophistication of some intermediary remuneration models, including
contingent commissions, profit sharing arrangements, etc. further exacerbates the potential
for conflicts of interest.
71.
It is, however, not only the remuneration of insurance intermediaries or insurers’ sales
staff that may entail conflicts of interest. To support fair customer outcomes, it is important that
remuneration models across all relevant levels of the organisation do not conflict withcustomer interests.
72.

Factors that may increase conflict of interest risks include:•

performance assessment and incentives being based on financial profitability
and/or efficiency/productivity/volume measures at the expense of customer
outcome related measures•lack of alignment between the incentives of senior management and those atlower levels of the organisation•

non-financial incentives, such as performance management, for sales staff being
linked to sales targets rather than customer outcomes•pressure to engage in cross-selling, including “add-on” products•

customer-related performance targets being vague or too easily achievable,
resulting in less focus on achieving these.

18 See ICP 19.7
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 18 of 47

73.
Remuneration models are not the only source of conflicts of interest that could resultin sub-optimal outcomes for customers. Conflicts of interest can also arise as a result of theway in which the business relationships between insurers, intermediaries and their groups, ortheir relationships with other parties, are structured. This is not to suggest that these types ofbusiness relationships are necessarily problematic, but that particular risk mitigation measures
may be required in these cases. Examples include:•

intra-group relationships where different entities within a group offer different
products and services to the same customer base – for example where the groupoffers insurance, intermediation, and other products and services. This can
support convenience and efficiency for customers, but can also lead to bundling
products and services in ways which can inhibit freedom of choice, add layers ofcost, and sometimes entail conflicted advice•

shareholding and ownership arrangements can be such that the insurer orintermediary is incentivised (directly or indirectly) to act in the interests ofshareholders or owners at the possible expense of customers. In particular,
conflicts of interest can arise where an intermediary has an ownership interest in
an insurer, or vice versa. Similar risks may arise from profit sharing or joint
venture arrangements, particularly where the nature of such relationships andtheir associated incentives are not transparent to or well understood bycustomers•

outsourcing relationships where, for example, services are outsourced byinsurers to intermediaries in exchange for additional remuneration – resulting inintermediaries being incentivised to place business with those insurers fromwhich they have an opportunity to earn additional income. This may also create
the risk of insurers paying outsourcing fees that are not in fact commensuratewith the true cost of the outsourced services, in order to attract sales from theintermediaries concerned.

74.
Self-placement practices can be another source of conflicts of interest. Some financial
institutions sell financial instruments that they themselves have issued in order to comply withenhanced prudential requirements, to their own customer base. Such practices enable themto raise capital in a cheaper and easier way because of the captive nature of their customer
base. This risk may be exacerbated within financial conglomerates when, for example,
insurers distribute financial instruments structured by banks in the same group to theircustomers through unit-linked policies.
75.
The use of self-placement by insurers may also put customers at risk. These financial
instruments are more likely to absorb losses first. Concerns also arise regarding the extent towhich these conflicts are disclosed to or understood by customers.
Self-placement as described by the Joint Committee
To comply with the Solvency II Directive’s enhanced requirements, some insurers have used self-placement
practices (placing with their clients financial instruments that they, or their group companies, have issued and thatare eligible to comply with specific prudential requirements).
The Joint Committee of the three European Supervisory Authorities (ESAs) – comprising the European Banking
Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European
Securities and Markets Authority (ESMA) – was used to facilitate cooperation between the ESAs in work on selfplacement. The Joint Committee carried out an analysis of the sort of breaches to consumer protection rules thatare found when these products are sold. Among other risks the customers can face are insufficient or misleading
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 19 of 47

information about product characteristics, prices or risks. They may also be exposed to misleading marketing andadvertising or unsuitable advice.
In this context, the Joint Committee in July 2014 issued a reminder to credit institutions and insurers about
applicable regulatory requirements as regards self-placement. 19

Governance of product design
76.
The design of a product is the very first stage of the product’s life. Product design istherefore of paramount importance as poor or inappropriately targeted product design has
potential to result in material customer detriment.
77.
In the product design and approval process, meeting customer needs and delivering
on reasonable customer benefit expectations should be balanced against profitability or sales
volume priorities.
78.
In addition, the insurance industry is increasingly designing products aimed at
purposes beyond mere risk coverage, such as investment and savings products. These typesof products may be complex, and their investment performance related risks may not easily
be perceived by the average customer and may not be aligned to the customer’s risk profile.
Different types of products, designed to meet different types of customer needs and marketed
to different target customer groups, will pose different degrees of conduct risk.
79.
A “one size fits all” approach to product design and/or distribution therefore also poses
the risk of poor customer outcomes where the insurer’s product design process anddistribution model do not take account of these differences. In particular, a failure to carry out
an appropriate assessment of the needs and expectations of the intended target market at
product development stage may increase the risk of the product failing to meet reasonable
customer benefit expectations.
80.
Where intermediaries are concerned, although they are typically not involved in
product design, conduct of business risk arises where intermediaries do not do sufficient due
diligence when selecting insurance products or insurers, in order to familiarise themselveswith the product features and satisfy themselves that the products are suitable for thecustomers whom they will advise to purchase them.

19 See EIOPA’s website (https://eiopa.europa.eu/).
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 20 of 47

Product oversight and governance (POG) – a European initiative
Work on POG was launched by the European Parliament to ensure that consumer protection issues areappropriately addressed in the processes that occur prior to the sale of the product. Product oversight andgovernance is defined as the responsibilities of manufacturers in organising processes, functions and strategies
aimed at designing, operating and bringing products to market, and reviewing them over the life of the product.
Product oversight and governance is distinct from product approval by regulators in the formal licensing or
authorisation sense or regulatory interventions such as ‘banning’ (i.e. product intervention).
The Joint Committee of the three European Supervisory Authorities (ESAs) was used to facilitate cooperation
between the ESAs in this work. In 2013, the Joint Committee issued high level principles on POG. The Joint
Committee set several high level principles that encourage manufacturers to define a target market as well as a
distribution channel. Manufacturers are able to limit the distribution to the target market or, where products are soldto customers outside the target market, ask the distributor to justify the sale. In addition, the manufacturer should
periodically monitor the performance of the product to ensure that it continues to meet the objectives and interestsof the target market as well as review the product, where appropriate, to ensure compliance.
Following the publication of these high level principles, the three ESAs became responsible for issuing guidelines
on POG. Since then (October 2014) EIOPA has published a consultation paper. 20

Underwriting practices
81.
Poor underwriting practices could result in increased prudential risk to the insurer. They
could also result in customers not being treated fairly as the objective of proper risk
assessment and accepting individual risks by charging premiums commensurate with theindividual risk profile would also suffer, potentially impacting negatively on the interests oflarger groups of customers. In some business models, no or minimal individual underwriting
is carried out before policy issue, but insurers rely on standard health declarations and/or
cover exclusion clauses to manage their underwriting risk. This practice, sometimes referred
to as “underwriting at claim stage” may be appropriate in so-called “group underwriting”
models, where a group of lives is insured collectively and individual up front underwriting would
unreasonably increase the cost of cover and render the offering commercially non-viable.
However, unless sufficient care is taken to ensure that customers fully understand theimplications and scope of the declarations and/or exclusions concerned, this practice can leadto materially unfair outcomes with customers’ benefit expectations not being met at claim
stage.
Non-advice selling
82.
Where products are sold without advice, there may be an increased risk of poor
customer outcomes. Many customers do not adequately understand the features andconsequences of products, particularly complex products. These need to be explained to themin a manner that takes the customer’s financial capability levels into account, to avoid
misunderstanding and outcomes that do not meet their expectations. In models that do entail
advice, the intermediary is typically tasked with providing these explanations.
83.
Accordingly, in non-advice distribution models, alternative risk mitigation measures
may be appropriate to address this information asymmetry risk. Subject to relevant regulatory
requirements, alternative measures may include insurers placing particular focus on thequality and clarity of point of sale product information; insurers electing not to offer certain
types of products – such as relatively complex products – through non-advice channels;
20 EIOPA, Consultation Paper on the proposal for Guidelines on product oversight & governance arrangements
by insurance undertakings, EIOPA-BoS-14/150, 27 October 2014, available at EIOPA’s website.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 21 of 47

insurers offering certain products through non-advice channels only to more sophisticatedcustomers.
Quality of advice
84.
Where products – particularly complex products – are sold with poor quality advice,
the information asymmetry risks are similar to those arising in non-advice models.
85.
Various situations, over and above the conflicts of interest discussed above, may resultin inadequate or inappropriate advice being given to the customer, for example:•

sometimes advice is based on insufficient knowledge about the customer orinadequate documentation. Customer information that is gathered at the start of
the relationship may be insufficient, not providing the adviser with enoughinformation to understand the customer’s circumstances, needs and objectives
and attitude to risk.

•

processes for the provision of advice can sometimes be too formal and apparently
in place only to satisfy regulatory requirements – a “tick the box” approach.

86.
In both advice and non-advice distribution models, a “quantity over quality” approachto disclosure should be avoided, where the customer is provided with large quantities ofcomprehensive information, without due regard to whether the information is appropriate to
the customer’s level of financial capability and is in fact understood. Requiring a customer tomake a declaration that they understand information provided to them may not be an
appropriate safeguard87.
In both distribution models, insurers’ and intermediaries’ IT systems may not be
sufficiently developed or adapted. This can be the case in particular regarding non-advice
sales via the Internet, for instance where the questions asked to identify the customer’s
circumstances create unfair bias toward particular products or focus on price to the exclusionof risks, benefits or other suitability criteria.
Knowledge, ability and experience of advisers or sales staff
88.
Adequate product training is essential to ensure that advisers and sales staff havesufficient knowledge of the product. Where advisers do not understand the productadequately, this increases the risk of mis-selling. Risk of mis-selling is mitigated by appropriate
experience and qualifications.
89.
Intermediaries’ and insurers’ sales staff may have insufficient knowledge of businesspractices and their own obligation to adhere to consumer protection rules. This may result inthem failing to follow the necessary procedures to respect consumers’ rights. To be complete,training programs should deal sufficiently and appropriately with business practices andconsumer protection issues and ensure that knowledge, including specific product knowledge,
remains current and does not become obsolete. 21

21 Other parties may also be involved in the distribution of insurance. They may have less skills and training
compared to conventionally licensed brokers and agents. See for example section 3.2 of the Issues Paper on
Conduct of Business in Inclusive Insurance.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 22 of 47

Advertising practices
90.
Advertising is often the catalyst for contact between the customer and the insurer orintermediary. Its main purposes are to attract customers to a product, and to encourage themto purchase it. It is a key element in maintaining and growing the business. Supervisors havelong been aware of the risks of inappropriate advertising and marketing practices.
91.
There are risks when advertising or other pre-contractual material is not clear,inaccurate or misleading, including when the presentation of risks against benefits is notbalanced.
Disclosure practices
92.
The effectiveness of disclosure practices is closely linked with the issues of information
asymmetry discussed above. Disclosure material that is not designed with the financial
capability of the target customer market in mind may fail to achieve its intended purpose.
93.
Risk can also arise where different disclosure formats make insurance product featuresdifficult to compare and where advertising or product disclosure materials are not regularly
reviewed and kept up to date.
94.
Risk also arises where, after the sale, insufficient ongoing information is provided
during the life of the product concerned, and there is failure to take adequate steps to monitor
the customer’s changing circumstances in order to confirm the ongoing suitability of the
product.
95.
Insurers may view disclosure from a legalistic, compliance-based perspective – diddocuments provided to a customer disclose all features of the product required to bedisclosed? This legalistic perspective is generally less effective than one in which disclosures
are drafted with the aim of empowering customers to make well informed purchase decisions
whilst also fairly establishing customer expectations about the insurance product.
Claims management96.
As important as pre-contractual information, post-sale service has to be carefully
considered as it can give rise to risks to insurers and customers. Claims management inparticular has a prudential risk component as it can have a key impact on insurers’ financial
soundness, but fair claims management is also key to managing conduct of business risk.
97.
This part of the contractual relationship is of utmost importance to customers. To beadequately covered in case of a claim is the very aim of buying insurance. Therefore, there
are then two main risks of failure to meet customer benefit expectations: not to be covered forthe risk at all or being underinsured.
98.
Beside insufficient cover, poor claims administration can in itself be a source of risk forcustomers. They can suffer, for instance, from unjustified delays or inadequate explanations
by insurers or intermediaries for unfavourable claims decisions, at a time when they are
typically in a vulnerable or stressful situation. 22
99.
Claims rejection data can be an early warning to detect deteriorating claims
experience, indicating for instance weaknesses in the product design or in mis-selling
practices.

22 As is described in section 3.6 of the Issues Paper on Conduct of Business in Inclusive Insurance, efficient andtimely claims management is even more pertinent to inclusive insurance customers as very often the insurance
covers the basic needs of existence and income and a further decrease in income or sales of assets to cover
expenses needs to be avoided.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 23 of 47

Complaints management
100. Effective complaints management and complaints data analysis can also provide
insight into product design concerns, mis-selling, misidentification of target market needs, andother potential risks of poor customer outcomes.
Outsourced processes 23101. Insurers and, to a somewhat lesser extent intermediaries, may outsource certain
business process. The potential for conflicts of interest to arise from outsourcing, particularly
outsourcing by insurers to intermediaries, has been discussed above. In addition, although
outsourcing can be an effective efficiency driver, poorly priced outsourcing models pose therisk of additional costs being unfairly passed on to customers. A further conduct of businessrisk arising from outsourcing models is where insurers or intermediaries in effect “abdicate”
responsibility for fair customer outcomes to the outsourced service provider, without having
sufficient controls in place or adequately recognising that they remain accountable for theoutsourced functions. This risk arises in particular where the insurer or intermediary does not
ensure that it has adequate ongoing access to customer related information in order to enable
it to monitor customer outcomes. Inadequate data protection and confidentiality controls within
the service provider are also a key risk area, as is the situation where there is a concentrationof services being provided to multiple insurers or intermediaries by a single outsourced service
provider.
Systems and operational business processes
102. Where an insurer’s or intermediary’s systems and processes are not adequate toensure suitable levels of customer service, the risk of unfair customer treatment is increased.
Examples include unreasonable obstacles to accessing funds, making claims or complaints,
or accessing information. The risk of providing incorrect information and errors or delays inprocessing service transactions may be a direct consequence of weak operating systems. In
addition, adequate systems and controls to mitigate the risk of data privacy breaches andunauthorised use or loss of personal customer information – whether through “cyber security”
breaches or otherwise – are essential. Failings in this regard pose significant legal andreputational risk to individual insurers and have the potential to undermine trust andconfidence in the sector as a whole.
3.3

Economic and environmental factors

Market-wide business practices
103. Market-wide business practices, such as prevalent product structures, distribution
models, marketing strategies, etc. can have broad impact on a large number of customers. In
many cases, supervisors will be aware of common market practices or business models thatpose a risk of unfair customer outcomes if adequate governance and control measures are
not in place to mitigate these risks. The extent to which a particular insurer or intermediary
adopts such practices may therefore be an indicator of the conduct of business risk it poses.
Examples are discussed elsewhere in this paper and in Annex II.
Economic/environmental factors and the structure of the market
104. The structure of the market and the levels of competition in the market may also be
sources of conduct of business risk. Clearly, effective competition presents advantages tocustomers. It increases choice, comparability and substitutability and imposes market
23 See ICP 2.13
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 24 of 47

discipline on poor business practices. Market structures in a jurisdiction will however influence
the extent to which market forces can be relied on to discipline poor business practices. For
example where competition is fierce, insurers and intermediaries may seek to differentiate
their products or services in ways that may pose risk to customers – such as by promoting
add-on or “bundled” products or features that may not be necessary to the customer or may
introduce hidden cost. Conversely, there are also risks where there is insufficient competition,for example in highly concentrated and/or interconnected markets, where conflict of interest
risks are exacerbated. Understanding of whether there is adequate competition in the market
to benefit the customer is therefore an insight that can be useful to a conduct supervisor inassessing conduct of business risk. 24
105. Supervisors and industry participants should be particularly alert to the possibility thatmarket failures (e.g. due to asymmetric information) may generate broad conduct of businessrisk that results in “collective action problems”. A collective action problem may arise when an
industry practice (e.g. inappropriate marketing techniques or remuneration policies) causes
consumer detriment, but where it is difficult for an individual insurer to unilaterally change thepractice as they may lose market share. Supervisors have a particular role in identifying andsupporting broader solutions to such market-wide conduct of business risk.
106. Market structures and competition levels also pose potential risk to financial inclusion.
In a saturated market, there may be an increased tendency to target new markets such as
unsophisticated, previously excluded consumers. Care needs to be taken to ensure that
aggressive marketing practices do not exploit the vulnerability of such consumers and that
products sold are indeed appropriate to their needs. On the other hand, in a developing market
with less competition, there is the risk that products may not offer adequate value for money
due to lower levels of competition coupled with information asymmetry. In both scenarios,
although products may be sold into previously under-served markets, there is a risk of true
inclusion not being achieved as the products concerned may not deliver fair customer
outcomes.
107. In various segments of financial services there is an increasing tendency to transfer
risk to customers. These customers, with or without the support of an intermediary, arerequired to make financial decisions in order to achieve their goals and fulfill their identified
needs, with products designed in such a way that the risk of poor decisions is borne by thecustomer. Retirement savings and investment products where the customer chooses
underlying investment portfolios and benefits are solely dependent on the performance of
these chosen portfolios, are examples. Within this decision-making process, assumptions onoften unpredictable economic factors such as future interest or inflation rates often need to bemade by ordinary customers.
108. Assumptions are also important from an insurer’s perspective, for instance with regard
to longevity risk. Although this is primarily a prudential risk it will ultimately also have an impact
on customers. If assumptions turn out to be wrong, customers have a product that may nolonger be sustained and therefore will not fulfil their need. One possible example in this area
is long term savings policies or life annuities. Since such products typically have a long term
focus, potential detriment could be significant. The greater the levels of economic uncertainty
and volatility, the greater the risk inherent in products whose performance is linked to theseassumptions.

24 As discussed in the Application Paper on Approaches to Conduct of Business Supervision, the question ofwhether or to what extent the insurance conduct of business supervisor has a mandate to promote competition,
will vary from jurisdiction to jurisdiction.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 25 of 47

109. Irrespective of the stage of development of a specific market, economic factors also
influence the demand for financial products. For instance, a recession can result in overindebtedness, increasing the risk of customers making poor financial product decisions (either
to enter into additional debt or to cancel policies and cash in investments inappropriately), as
well as the risk of exploitation of these vulnerable customers. On the other hand, in periods of
economic success, where credit may be more readily available and customers may be overly
optimistic regarding their financial capability and prospects, the risk of customers making poor
financial decisions and being lured into unsustainable products is increased.
Legal/regulatory environment
110. As stated in ICP 19.0.2, “conduct of business, including business practices, is closely
linked with jurisdictions’ tradition, culture, legal regime and the degree of development of theinsurance sector. For this reason, regulatory approaches to the conduct of business also tend
to vary”. It follows that approaches to the identification and management of conduct ofbusiness risk will similarly be influenced by these factors.
111. To encourage financial sector development that supports fair customer outcomes, thelegal and regulatory environment should provide a framework that enables the developmentof sustainable and competitive markets, supports customer value-enhancing innovation,
facilitates monitoring and enforcement of rules, and promotes consumer protection.
Unregulated or inadequately regulated and/or supervised financial services providers
significantly increase the risk that customers face fraud, abuse and misconduct.
112. On the one hand, gaps within as well as between regulatory frameworks can lead toregulatory arbitrage. On the other hand, inflexible or overly detailed regulation can also giverise to conduct of business risk since this can result in a “tick-box” type of compliance insteadof a mindset focused on fair customer outcomes. Overly detailed regulation can also lead to
unreasonable barriers to new entrants, and therefore hinder competition and financial
inclusion.
Technology
113. Technological developments reduce the importance of actual physical accessibility offinancial services providers. At the same time, technological solutions that create a perceptionof personal proximity are becoming ever more prevalent. A wider range of financial products
and services as well as financial online tools and applications are becoming available. Thereis also more information on products and services than ever before. New technology enables
insurers, intermediaries and other financial service providers to customise products andmarketing material. Also, using comparison websites to find an alternative product or switchingfrom one insurer or other provider to another can be arranged within minutes. However, more
opportunities and fewer barriers do not automatically mean better market or customer
outcomes and can give rise to conduct of business risk.
114. For instance, comparison websites create risks that consumers select products based
solely on price, with insufficient regard to the appropriateness of product features to theirneeds. In addition, there is risk where complex products are sold online or using digitalplatforms without appropriate advice. In line with the developments from a technologicalperspective, data is considered more and more a valuable asset in itself. Financial services
are becoming increasingly data driven. This growing importance of data leads to risks from a
privacy protection perspective as well as from a data security perspective. Sophisticatedcyber-attacks can lead to customer data being stolen, manipulated or destroyed.
115. These developments pose supervisory and regulatory challenges. Supervisors needto adapt, to foresee potential risks, and to act in a timely and appropriate manner to pre-emptIssues Paper on Conduct of Business Risk and its Management
November 2015

Page 26 of 47

emerging conduct of business risk. The regulatory framework needs to adapt as well, since
this framework is based on the current situation and existing supervisory methods.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 27 of 47

4.

Conduct risk management

116. It is important that risk management frameworks are designed to adequately identify,
monitor and mitigate all relevant classes of risk, whether prudential or conduct related. 25 An
insurer’s risk management system should take into account all reasonably foreseeable andrelevant material risks to which the insurer is exposed, at both the level of the specificregulated entity and the broader group, where relevant. This includes current and emerging
risks. 26 An appropriate risk management framework needs to ensure that all risks posed to or
by an insurer are managed holistically, at all stages of the insurance product life cycle, fromthe point before a contract is entered into through to the point at which all obligations under
the contract have been satisfied. Following a holistic approach means that conduct of businessrisk is fully integrated into the insurer’s risk management framework.
117. Customer complaints and disputes can be time-consuming and costly. Consumers’
loss of confidence may damage an individual insurer or intermediary or ultimately part or thewhole of the insurance sector. Furthermore, where insurers and intermediaries do not act with
due skill, care and diligence when dealing with customers, 27 non-compliance itself represents
a compliance and reputational risk. For these reasons conduct of business risk needs
appropriate attention within the risk management framework.
118. It is important that risk management is an ongoing process. Risks need to be regularly
monitored and assessed, as they change over time. Similarly risk mitigation mechanisms(including relevant policies and procedures, training and competence requirements, etc.) need
to be maintained and subject to appropriate evidence and documentation.
119. Where conduct of business risk is concerned, a holistic risk management frameworkneeds to recognise that insurers may wish to review the current risk frameworks they use todetermine if they are appropriate for identifying and managing conduct of business risk.
Particularly in jurisdictions where risk management has historically been focused primarily on
prudential risks, some changes to the risk management approach are likely to be required.
120. The need to review risk management frameworks to address conduct of business risk
may include a review of the risk classification or risk taxonomy used, to ensure that theclassification or taxonomy enables adequate focus on conduct of business risk. The
classification of risk is important, as it will help in the determination of the sources of risk andwhether the activity giving rise to the risk should be curtailed or ceased in its entirety, as well
as dictate the type of risk mitigation measures applied.
121. For example, to the extent that conduct of business risk is currently addressed in risk
management frameworks, these risks are typically classified under “operational” risks. They
are less frequently considered under “strategic” risks (where such a category is used). As aresult, there is a risk that customer interests are addressed at an operational level, without
paying due regard to the impact that the insurer’s or intermediary’s broad strategic goals may
have on customers. An exclusively operational focus on customer outcomes may result in an
entity focusing its risk mitigation efforts on addressing issues of customer service efficiency
and transactional processes, without necessarily addressing customer outcomes when setting
strategy, or designing products and distribution models.
25 See ICP 8. Although the ICPs do not specifically address risk management frameworks in relation tointermediaries, and the paragraphs which follow therefore focus mainly on insurers, supervisors may wish toconsider the extent to which intermediaries’ achievement of the outcomes of ICP 18 and 19 would be strengthened
through appropriate risk management frameworks.
26 See ICP 8.1.
27 See ICP 19.1.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 28 of 47

122. Conduct of business risk may also be viewed under the heading of “reputational” risk.
This is understandable as poor customer experience can clearly impact negatively on an
insurer’s or intermediary’s reputation. However, where conduct matters are viewed only fromthis perspective, it is possible that risk mitigation efforts will be aimed mainly at protecting the
reputation of the organisation (for example through public relations interventions), without
necessarily improving customer outcomes or ensuring appropriate customer redress. 28
123. Another relatively common classification of conduct related risk is to regard them as“legal or regulatory” risks. This is because regulatory frameworks typically impose specificconsumer protection obligations on insurers and intermediaries, with contraventions of thesetriggering potential supervisory action or sanctions. Where conduct of business risk is viewed
mainly from this perspective, there is potential for a “tick the box” approach to managing theserisks, with entities focusing mainly on achieving minimum regulatory compliance rather thanfully considering customer outcomes across their business and ensuring that a culture of fairtreatment is embedded.
124. It is not the intention of this paper to propose that insurers and intermediaries shouldnecessarily change the risk classification or risk taxonomies they use in order to accommodate
conduct of business risk. Rather, the discussion above is intended to highlight the need for
insurers and intermediaries to carefully consider how best to accommodate conduct ofbusiness risk in whatever risk management framework they have adopted – and to highlightthe fact that traditional frameworks may not always lead to the most effective conduct risk
identification and mitigation.

28 According to the American Academy of Actuaries, U.S. insurers generally address conduct of business risks
though operational risk. The identification and management of operational risks (and different types of operationalrisk) is frequently performed in conjunction with an insurer’s internal audit function. Some insurers consider suchrisks as part of strategic or reputational risk, which may be separately identified in the taxonomy.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 29 of 47

5.

Supervisor’s role
5.1

Supervisory requirements and approaches

125. The supervisory requirements in respect of conduct of business are addressed in other
IAIS literature, primarily ICP 19 (Conduct of Business), ICP 18 (Intermediaries), ICP 8 (RiskManagement and Internal Controls) and ICP 9 (Supervisory Review and Reporting). A numberof other ICPs introduce risk mitigation measures, including for conduct of business risk,
through their requirements, inter alia, in respect of licensing and governance. The COB
Supervision paper also provides a considerable amount of material on how conduct ofbusiness requirements can be addressed through the supervisory process, including in thecourse of off-site monitoring and on-site inspection.
Key factors for a conduct of business risk-based supervisory framework
126. The supervisory framework needs to provide the supervisor with a holistic view of allrisks to which an insurer is exposed, as well as risks posed by the insurer and/or theintermediary, at all stages of the insurance product life cycle. Jurisdictions should have riskbased approaches (used by the supervisor and/or insurers) that are appropriate for identifying
and managing conduct of business risk. Supervisors need to take conduct of business risk
into account in assessing the “riskiness” of insurers and intermediaries, including creating
conduct of business risk profiles and incorporating conduct of business risk within a risk-based
approach.
127. Conduct of business supervision can benefit from a forward-looking approach thatseeks to identify and address potential risks at an early stage, before they become significant.
This involves making forward-looking judgements regarding the likelihood of conduct ofbusiness risks crystallising and the most effective supervisory response to prevent or limit
customer prejudice. 29 Annex I provides some examples of indicators of conduct risk that asupervisor may find useful in adopting a forward-looking approach.
128. Mitigating conduct risk should apply at all stages of supervision – from initial licensing
to supervisory review and reporting through to enforcement. 30
Prudential and conduct of business supervision: Complementary approaches
129. Prudential and conduct of business supervision pursue a common goal in protecting
the interests of customers. As pointed out in the COB Supervision paper, however, conduct ofbusiness supervision requires a different set of knowledge, skills and abilities to prudential
supervision, including a strong understanding of topics such as:•

insurance law and regulations•

general consumer protection practices•

insurance business models, products and practices•

best practices and risks related to fair treatment of customers.

130. The requirements and expertise used in prudential supervision provide supervisors
with a significant amount of information on insurers’ financial health. This information can also
be useful to conduct of business supervision.

29 See also ICP 9.2
30 See also ICP 9.2
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 30 of 47

131. Conversely, conduct of business supervision can play a role in the early detection ofissues that could affect the financial strength of an insurer, and provide an important input into
prudential supervision. For example, aggressive or misleading business practices can be
symptoms of insufficient control over distribution channels. They can also be signs of poor
culture, inappropriate governance and/or ineffective internal controls. Ultimately such issues
can trigger financial difficulties where insurers need to reassess existing commitments orredress the mis-selling of products. As discussed earlier, inappropriate remuneration andincentive policies can lead to the selling of products that do not deliver fair outcomes, although
the discovery and consequences of mis-selling may only arise in the future.
132. Improving the linkage between conduct of business oversight and prudential oversightwill facilitate a holistic evaluation of whether the insurance sector is delivering desired andappropriate customer and broader market outcomes. The goal of prudential oversight is tominimise the likelihood of an insurer failure. Since such failures are rare, prudential oversight
focuses on high level policies and procedures for insurer operation as opposed to focusing ondata that evidences customer outcomes. In contrast, in addition to reviewing policies andprocedures, conduct of business oversight often involves review of a myriad of day to day
business practices, such as sales, claims and complaints processes and data. This
information in turn can be used on an aggregated basis to monitor market outcomes andassess market wide conduct of business risk.
133. Corporate governance and risk management oversight, from the prudential regulatory
perspective, evaluates insurer processes based on the premise that good processes willproduce favourable outcomes for consumers and the market. The problem is that there are
not necessarily mechanisms in place to assess whether this linkage is transmitting properly –i.e. that "good processes" indeed produce good outcomes. Some supervisors have adopted
granular market surveillance in a variety of forms to evaluate customer and market outcomesin order to assess the effectiveness of insurer governance and risk management processes.
Such detailed conduct of business outcome analyses may be helpful in assisting prudential
supervisors, who may otherwise have difficulty differentiating between governance processes
that are truly effective and those that are not.
Coordination among insurance supervisors and other authorities
134. In cases where conduct of business supervision and prudential supervision areallocated to different supervisors (for example in so called “Twin Peaks” supervision models),
it is important that appropriate co-ordination arrangements are established between the two
authorities to promote a holistic approach to assessing the totality of an insurer’s orintermediary’s risk profile. Equally, in cases where conduct of business and prudential
supervision resides within an integrated supervisor, coordination may be required between
different departments or staff who may have a different focus.
135. Coordination is also important where the supervision of insurers and intermediaries
respectively is allocated to different supervisors (or different departments or staff within thesame supervisor), as conduct of business risk may be detected by assessing the nature of therelationships between insurers and intermediaries, and not necessarily from the conduct ofeach of them when viewed separately.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 31 of 47

136. Insurance supervisors may also have to coordinate with non-financial supervisors,
such as competition authorities, general consumer protection agencies andtelecommunication supervisors. 31
137. Cooperation on conduct-related matters at an international level may also be
important, as the market in one jurisdiction can be affected by both conduct and prudential
issues in another jurisdiction.
5.2

Risk identification and monitoring

138. As indicated earlier, conduct of business risk indicators will be different from, or
additional to, those used for prudential supervision. This applies not only to risk indicators
used by insurers and intermediaries themselves, but also to the risk indicators monitored by
the supervisor.
139. Conduct of business supervision should comprise a balance of qualitative andquantitative information. In addition, conduct of business supervision requires sufficientquantitative financial expertise to understand both the financial aspects of culture andbehaviour in organisations, and the drivers of profit and cost.
140. In identifying and monitoring conduct of business risk, supervisors need to take anoverall view of conduct of business risk indicators – some examples of which are listed in
Annex I. The supervisory approach will go beyond the insurer or intermediary-specific factors
and include a review of the broader external risk sources discussed in section 3.3 above.
These broader reviews may include macroeconomic analysis, as well as market analysis tounderstand new or emerging market-wide trends and developments (such as new product or
distribution strategies). Analysis of relevant market-wide data (such as the types and sourcesof complaints handled by alternative dispute resolution structures), to identify sector or subsector risks, may also be used as a basis for supervisory action. The results from market
monitoring and other information sources should provide feedback into the supervisory
approach.
141. Supervisors may also take into account thinking from the field of behavioural
economics, to assess the risk of poor customer outcomes.
5.3

Communication on conduct of business risk by the supervisor

Publication of forward-looking risk assessments
142. As highlighted in the COB Supervision paper, some supervisors take a forward-looking
approach to conduct of business risk and publish an assessment of the risks foreseen as
emerging in the near to medium term, typically over the next 12 or 18 months, together withthe likely supervisory action should those risks crystallise. The assessment may also include
an explicit message concerning the supervisor’s expectations of how insurers andintermediaries should engage with and react to the analysis contained in such a risk
assessment. Such risk assessments could include both risks arising from the business models
and practices of insurers and other financial institutions, as well as risks arising from broader
economic, regulatory or other external developments. This assessment should becommunicated to industry and the public and may include communication on perceived risks,and supervisory expectations on how the supervisory objectives will be met.

31 In some inclusive insurance markets extensive use of mobile technology is used to distribute insurance products.
See IAIS Application Paper on Regulation and Supervision of Inclusive Insurance Markets (October 2012),
paragraphs 1.19, 1.28 and 5.15
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 32 of 47

Example from United Kingdom: Risk Outlook
In 2013 and 2014 the UK’s Financial Conduct Authority (FCA) published an annual Risk Outlook. For 2015/16 thisrisk outlook is embedded within the Business Plan published by the FCA. These publications set out the FCA’sviews on the conduct and prudential landscape for the firms it regulates. They look at the causes of risks and how
these affect consumers, and use this to prioritise areas of supervisory focus in the future. 32
143. Proactively highlighting potential risks and areas of concern can encourage insurers
and intermediaries to take these into account, and can help to stop the issues from becoming
significant problems. In addition, where the supervisor has proactively drawn the industry’s
attention to potential areas of concern, such as business practices that it has identified as
potentially leading to poor customer outcomes this may, subject to the regulatory frameworkin the jurisdiction concerned, strengthen the supervisor’s hand if subsequent enforcement
action becomes necessary. Where the supervisor’s concerns have been clearly signalled, an
insurer or intermediary who has not taken account of these concerns and has persisted withthe business practices concerned is less likely to be able to defend its actions and challenge
the supervisor’s intervention if those practices do in fact result in poor outcomes.
Supervisory expectations
144. Supervisors communicate their expectations to industry on conduct of businesspractices through a variety of means ranging from formal to informal approaches. This canoften involve issuing forms of guidance that may be binding, non-binding, or binding but notnecessarily subject to the same enforcement processes as explicit rules-based requirements.
145. Guidance is a very useful tool for conduct supervisors to try to influence industry
behaviour and to explain expectations regarding rules that are not as quantitative as prudential
rules. Examples include:•“Dear CEO” letters•

information letters•presentations to industry participants or associations•

formal guidance (e.g. in the form of directives, official notices, circulars, policy
statements)•

recommendations about best practice in relation to specific topics (e.g. claims orcomplaints handling).

Such guidance, even where it is non-binding, can be a useful tool for avoiding disputes as tothe supervisor’s expectations in the event that formal enforcement action is required,
particularly in the case of principles-based requirements.
146.

Other mechanisms for communication on supervisory expectations include:•

meetings with management•

on-site inspections, including follow-up meetings and communications•

newsletters•

events hosted by the supervisor or industry, professional or consumer association
events.

32 See UK FCA’s website for further information.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 33 of 47

Public disclosure by the supervisor
147. Some supervisors publish conduct-related information that can help to mitigate risks
to consumers. Such information might include:•

warnings (e.g. in relation to insurers or intermediaries operating without a licence,suspicions of fraud or other financial crime, potential abusive selling practices)•supervisory action taken (including enforcement action)•

general information related to financial services products and their distributionthat seeks to enhance consumer awareness•data on individual insurers’ performance in relation to appropriate conduct
indicators or benchmarks – such as complaints or claims related data – that can
act as a deterrent to unfair customer treatment. 33

Example from France: communication with consumers and industry
Communication with consumers
The ACPR operates a common gateway, together with the French financial markets regulator (AMF) and theBanque de France that provides information and guidance to consumers. Under the name of “Assurance BanqueEpargne Info Service” (ABE IS), it comprises a website (www.abe-infoservice.fr) and a helpline that provides
general information about financial products, contracts and services, and on procedures for dealing with disputes.
The website is also intended to warn the public where poor conduct practices have been identified in particularinstitutions. The ACPR can also issue warnings to the public directly.
Communication with industry
The ACPR is able to issue good practices recommendations to explain how the Authority expects the industry toapply the law and regulatory requirements in practice. These soft law instruments can be an efficient tool to reduce
conduct of business risk on a market-wide scale.
Additional means of communication used by the ACPR include things such as its bimonthly publication (La Revuede l’ACPR), and its annual conference.
Example from the United States: Consumer Information and Education
The National Association of Insurance Commissioners (NAIC) provides a variety of public information useful for
consumers. Information and tools that U.S. state insurance supervisors have found helpful to make available toconsumers include:• the NAIC’s Consumer Information Source (CIS) which provides key information about insurers that consumers
can use (for example, before purchasing insurance), including closed insurance complaints, licensing
information and key financial data.
• INSURE U - Get Smart About Insurance, which is a public education program created to assist consumers withinformation about insurance issues. INSURE U is designed to help insurance consumers as their lives andneeds change, and to educate them about how to avoid being scammed. Since its 2006 launch, INSURE U
has featured public service announcements (PSA), consumer alerts, news releases, mobile apps and games,
along with integrated social media campaigns, in order to help consumers understand difficult topics.

33 Some supervisors require insurers and intermediaries themselves to publish such data.
Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 34 of 47

6.

Conclusion

148. This Issues Paper demonstrates that prudential and conduct of business risks areclosely linked but also differ in important ways and need to be managed, mitigated andsupervised differently and in a holistic manner.
149.

The Issues Paper provides a number of key messages:
Impact of Conduct of business risk•

conduct of business risk can generate significant consumer detriment, and as aresult also produce significant impacts on consumer trust and industry reputation•

the recent financial crisis has also highlighted that poor conduct of business cangive rise to systemic risks

Sources of conduct of business risk•

conduct of business risk can arise from multiple sources, including factors inherent
to insurance markets, the insurer’s or intermediary’s conduct culture, governanceand business processes, and broader economic and environmental factors•

conduct of business risk includes risks arising from poor business conduct to which
insurers, intermediaries and the insurance sector itself are exposed, but
importantly also risks to which insurers and intermediaries expose their customers

Managing conduct of business risk – issues for supervisors•

the supervisory framework needs to provide the supervisor with a holistic view of
all risks to which an insurer or intermediary is exposed, as well as risks posed bythem•conduct of business oversight often involves the review of day to day businesspractices such as sales, claims and complaints processes and related data•

supervisors have a role to play in communicating conduct of business risks andtheir expectations, to both consumers and the industry

Managing conduct of business risk – issues for industry•

conduct of business risk, and all its components and sources, needs to beconsidered within the overall risk framework of, and risk management by, insurers
and intermediaries•

in order to mitigate conduct of business risk, insurers and intermediaries should
ensure that they have a governance framework that supports fair customer
outcomes

Links between prudential risk and conduct of business risk•

there are key differences between conduct of business and prudential risks that
require different and complementary approaches to risk management andsupervision•

conduct of business supervision goes beyond prudential supervision as it
considers the risks transferred to the insurer, the risks remaining at customer level
or in some cases transferred to the customer, and also the methods through whichrisks are retained or transferred.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 35 of 47

•conduct of business risk indicators differ from – but may complement – prudential
risk indicators, and may be used to assess risks to customer and market outcomesat both individual entity level and broader market-wide level•

where conduct of business supervision and prudential supervision are allocated todifferent supervisors, nationally or internationally, or to different departments within
an integrated supervisor, it is important that appropriate co-ordination
arrangements are established.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 36 of 47

Annex I
Conduct of business risk indicators
This Annex provides examples of issues or focus areas that insurance supervisors may wish
to consider using as indicators of potential conduct of business risk. It is by no means acomplete list, and supervisors should develop an appropriate set of indicators that are suitable
to the insurance markets in their jurisdictions and to the individual insurer or intermediaryconcerned. Jurisdiction-specific issues, such as the relevant legal system and culture, alsoneed to be considered.
As pointed out in the body of this Issues Paper, the intention is not to suggest that the practices
or processes highlighted in the Paper – including those listed here as potential risk indicators– are inherently problematic. For example, the fact that an insurer or intermediary operates ina vulnerable customer target market, or earns high profits, or uses “big data” are in most cases
positive for customers and markets – assuming any associated risks are well managed.
Importantly, any conduct risk indicators should be applied in the context of a risk-based
approach, taking into account the extent to which the indicators may be applicable to thejurisdiction, sector or entity, as well as the risk mitigation measures that may already havebeen implemented.
In most cases, particular risk indicators should not be considered in isolation but should beviewed from a risk-based perspective in combination with other indicators – or other known
information about the insurer’s or intermediary’s business – before forming a view on theexistence or extent of conduct of business risk exposure.
The risk indicators in this Annex are categorised in line with the categorisation of sources ofrisk set out in Section 3 of the Issues Paper, namely:•

Indicators of inherent risks: These indicators may assist supervisors in monitoring
conduct of business risk arising from factors that are inherent in the nature of
insurance business and, in many cases, inherent in the nature of financial service
provision more broadly. In particular, these indicators may be used to monitor risks
related to information asymmetry.

•

Indicators of risks arising from an insurer or intermediary’s governance and businessprocesses: These indicators could be used to identify aspects of the insurer orintermediary’s own governance models or business processes that can contribute to
conduct of business risk. In particular, they may be helpful in assessing the extent towhich fair customer treatment is embedded in the corporate culture and the extent towhich governance and business processes promote fair customer outcomes.

•

Indicators of risks arising from economic and environmental factors: These areindicators of risks arising from the external environment in which an insurer orintermediary conducts its business. Although these matters are typically outside theentity’s control, supervisors will wish to monitor the extent to which the insurers orintermediaries they supervise are exposed to these types of risks.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 37 of 47

1. Indicators of inherent risks
Indicator

Potential implication

1.1.
Vulnerability ofcustomer base

•

•

1.2.
Complexity of
products, including
degree of risk transfer

•
•

1.3.
Type ofdistribution model

•

•

1.4.

Use of “big data”

•

•
1.5.
Quality of initialand ongoing disclosure•••

An insurer or intermediary whose business model targets
customers in low income, unsophisticated segments or withrelatively low financial capability, may be expected to take more
extensive steps to mitigate information asymmetry risks thaninsurers or intermediaries operating in less vulnerable customer
segments
Where an insurer or intermediary serves customers across a rangeof segments with different levels of financial capability, the range of
products, distribution channels and customer service processes
may need to be adequately differentiated to suit the needs andcapability of the different customer segments.
Insurers or intermediaries offering relatively complex products, maypose greater information asymmetry risks than those offering
simpler products
The level of financial asymmetry risk arising from complex products
is potentially increased where such products are sold to lesssophisticated customer groups.
An insurer’s chosen distribution model may either increase or
mitigate the risks of information asymmetry – taking into accountthe complexity of products and / or the vulnerability of the customer
base
Controls an insurer has in place – for example quality and suitabilityof product disclosures, controls over quality of advice, availability of“cooling off” periods, etc. – may indicate mitigation of any risks
arising from the type of distribution model used.
Where insurers or intermediaries make use of sophisticated “bigdata” analytical tools in their marketing and other businessstrategies, such tools may be used to unfairly take advantage of
behavioural biases (such as applying less favourable charges tocustomers who are identified as less likely to complain or switch
products)
Information privacy issues may also arise in relation to the use ofcustomer specific data.
The quality of disclosure (e.g. accuracy and clarity of content, target
market suitability, timing and frequency) may indicate the extent towhich information asymmetry risk is mitigatedInitial and ongoing disclosure throughout the life of a product –either at regular intervals and / or on the occurrence of specific
events – may indicate whether customer expectations are being
met
Analysis of disclosures or customer complaints and feedback may
identify ineffective, unsuitable or unclear communications ordisclosures that do not take into account customer capability andproduct complexity.

2. Indicators of risks arising from governance and business processes
Indicator

Potential implication

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 38 of 47

2.1.
Extent to whichcustomer interests arereflected in strategy andobjectives•

2.2.
Allocation of
responsibility for goodbusiness conduct•

2.3.
Extent ofalignment between
customer interests andremuneration / incentives/ performance
management of staff andmanagement

•

•

•

•
2.4.
Levels of staff
training on conduct ofbusiness issues•

2.5.
Approach to
conduct of business inrisk management
framework

•

•

2.6.
Group structure(including intra-grouprelationships, ownership
structures, selfplacements)••

Insurers’ and intermediaries’ strategies and business objectives
may indicate how customer interests and impacts have been taken
into account, including how those interests are balanced against
other strategic objectives and stakeholder interests where relevant
Explicit corporate values, ethics or culture statements or
documented business policies that include a commitment to faircustomer treatment may also indicate a positive conduct ofbusiness culture. Such statements and policies should be
supported and monitored by effective governance frameworks andcontrols.
Where responsibility for specific decisions or processes affecting
customers or responsibility for specific customer outcomes is
explicitly allocated to identified members of staff or management,
this may indicate a commitment to good business conduct and thus
reduce conduct of business risk.
Having policies in place to align staff and management behaviour
with customer interests, is more likely to indicate effective
management of conduct of business risk than those where suchalignment is lacking; such policies may include recruitment,
remuneration, incentive and reward policies, performance
management and disciplinary policies
The extent to which such policies are applied at all appropriateorganisational levels, including the most senior levels ofmanagement and where appropriate particular members of theBoard or Board committees, may indicate the degree of alignment
within an insurer or intermediary
An assessment of the effectiveness of the above policies in
mitigating conduct of business risk may identify areas where there
is a potential misalignment with customer interests.
Levels and forms of general training on conduct related policies,
risks and objectives or job-specific training on specific businessconduct related systems or processes may indicate the extent towhich relevant staff of an insurer or intermediary have been trainedon conduct of business issues.
The extent to which conduct of business elements are addressedin the risk management framework may indicate the effectivenessof an insurer’s or intermediary’s approach to conduct of businessrisk management
Relevant issues could include: the extent of the Board and Senior
Management’s awareness of conduct of business risks to which theentity and its customers are exposed; the extent to which the risk
management function and other relevant control functions (such ascompliance and internal audit) take conduct of business relatedrisks into account in their processes; whether or how conduct ofbusiness related risks are captured in the entity’s risk taxonomy orrisk categorisation model; the indicators and measures used to
identify and manage conduct of business related risks; and thequality and level of management reporting on conduct of business
related risks.
The complexity of an insurer’s or intermediary’s group structure
may increase the level of conduct of business risk to which it andits customers are exposed
Relevant issues could include: potential conflicts of interest wheremultiple entities in the group serve the same customers or “bundle”
their products and services (for example insurers, intermediaries,

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 39 of 47

2.7.
Quality of conflictof interest management

2.8.
Quality of controls
in outsourcing
arrangements
2.9.
Product design /selection processes

2.10. Use of “bundled”
or add-on products

2.11. Intermediary
remuneration /incentivisation modelbanks, investment managers); the adequacy of outsourcing
controls where activities are outsourced across group entities;
information privacy issues where customer information is sharedacross the group; potentially conflicted remuneration or incentive
structures (including profit sharing structures) at group level; selfplacement of insurance risks within the group; potentiallymisleading promotional information where intra-group relationships
may not be adequately disclosed.
• Insurers or intermediaries with explicit conflict of interest
management policies, supported by appropriate governance andcontrol mechanisms, may be better positioned to manage conductof business risks arising from such conflicts than those where suchpolicies are lacking.
• Insurers or intermediaries with explicit outsourcing policies,
supported by appropriate governance and control mechanisms,
may be better positioned to manage conduct of business risk arisingfrom outsourcing arrangements than those where such policies arelacking.
• In the case of insurers, product design processes may be thesource of conduct of business risk relating to product suitability,
such as whether products are suitable to the needs of target
customer groups• Conduct of business risk may be mitigated where the insurer has
processes in place to identify product sales outside of the intended
target market and take appropriate action to mitigate the risk of misselling.
• In the case of intermediaries, the product or product supplierselection process could indicate whether such selection processes
take account of the suitability of the products for the intermediary’s
customer base.
• Where “bundling” of products or selling products as “add-on”
benefits to other products (for example, credit insurance soldtogether with a credit product, or warranties sold together withmotor insurance) forms part of an insurer’s or intermediary’s
business, processes to ensure that the customer fully understands
the existence, features, costs, risks and suitability of the bundled or
add-on benefit are important to mitigate conduct of business risk inthese models.
Particular focus areas to identify potential conflicts of interest in relation
to intermediary remuneration and incentive models could include:• Actual levels of commission or other remuneration paid, incomparison to comparable products or product providers• The extent to which remuneration is based solely on number ofsales and / or premium size, or whether the remuneration is also
dependent on measures such as quality of compliance with fairtreatment requirements, product retention, etc.
• Whether different products offer different types of incentives or
remuneration levels – in which case it may be useful to monitor theextent to which sales are biased to higher earning products• The availability of additional volume-based incentives or rewards
over and above commissions• The extent to which remuneration is paid up front and, if so, theextent to which this may be influencing policy replacements or

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 40 of 47

••2.12. Advice quality
controls

2.13. Profitability andexpense management,
including for particularlines of business2.14. Data on lapses,surrenders, policy
replacements (“churning”)
and other contractchanges“churn” or may be dis-incentivising ongoing customer advice orservice
The existence of specific minimum sales or production targets, andthe consequences of failure to meet these
The extent to which management remuneration or incentives arelinked to intermediary sales volumes.

In cases where the above practices are prevalent, greater attention may
be focused on the effectiveness of controls in place to manage andmitigate conflicts of interest and mis-selling risks.
The strength of the controls in place to monitor the quality of advice
provided by the agents or representatives of insurers or intermediaries
may affect the risk of providing unsuitable advice. Relevant issues totake into account in assessing the effectiveness of advice controls
include:• Quality, extent and frequency of training provided to advisers• Processes to monitor advice in specific cases, such as checking
customer case files or sitting in on customer appointments• Extent to which less experienced advisers are required to operate
under supervision• Processes used by the insurer or intermediary for monitoring dataon sales volumes, product mix, lapses or surrenders, claims,
complaints or other customer activities at individual adviser level toidentify potential poor customer outcomes.
• The underlying causes of high profits may indicate whether these
are aligned with positive customer outcomes or whether there is arisk that profits are being earned at the expense of fair customer
treatment. For example, where high profit margins are a function ofunusually high charges or unusually low claims ratios, this could
indicate conduct of business risk
• Comparing the relative profitability of different lines of business or
product types with sales volumes of such products may indicate
potentially biased promotion of more profitable products• Conversely, declining profitability – over and above any prudential
risks this may trigger – may also increase the risk that the insurer
or intermediary concerned may lower its service standards orincrease its claim rejection rates to boost profitability• Significant cost cuts may increase the risk of poor service delivery• Rapid growth in the scale of the business may be an indicator ofwhether the insurer’s or intermediary’s systems and operations areadequately equipped to keep pace with increasing sales orcustomer volumes• Monitoring which elements of the business generate the highest
profits or are allocated a proportionally greater share of expenses,
or material changes in the allocation of budgets (i.e. “following themoney”), may help in identifying the strategic priorities of the insurer
or intermediary, and determining whether these are consistent witha culture of fair customer treatment.
• Higher than expected lapses or surrenders may be indicators ofvarious conduct of business risk, including product design that does
not meet customer expectations; potential mis-selling; or customer
affordability challenges• High volumes of early lapses or surrenders, in particular, may
indicate potential mis-selling

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 41 of 47

•

•

•

•

•
2.15. Underwriting
approach••

Where a high proportion of lapses or surrenders result from productreplacement, this could indicate inappropriate product design on
the part of the initial insurer, but could also indicate conflicted,
incentive driven advice on the part of the intermediary concerned(particularly where remuneration is paid up front at the sales stage)
High replacement volumes at individual adviser level, particularly
where the same adviser has sold both the original policy and thenew one, could further highlight potential incentive-driven missellingHigh replacement volumes in favour of a particular insurer could
simply be attributable to it offering more competitive, better value
products; but could also pose risk that the insurer is adopting
particularly aggressive marketing practices, or offering
inappropriate incentives to intermediaries and / or customers
Trends in relation to other types of contractual changes could also
highlight conduct of business risk. For example, relatively highvolumes of premium reduction requests could indicate similar risks
to those indicated by high lapse or surrender volumes
Frequent requests to change underlying investment portfolios onsavings or investment policies may be cause for concern regarding
inappropriate investment-related advice.
Models which entail underwriting risk across a group of insured lives
rather than individual underwriting support cost efficiency andinclusion for certain target markets or types of cover. They may
however also pose risks of unsuitability for some members of agroup (particularly as such models often do not cater for individual
advice) or may result in a lack of benefit flexibility andsubstitutability, prompting a need for suitable risk mitigation
measures
Models where intermediaries share in underwriting profits of thelines of business they promote may also give rise to conflicts ofinterest which may require managing.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 42 of 47

2.16. Claims data andprocesses

Various types of claims related data may provide insight into the extent
to which customer benefit expectations are being met or in relation to
the fairness of an insurer’s claims processes. Relevant issues could
include:• Number and value of rejected claims, including reasons forrejections. Unusually high rejection rates could indicate mis-selling,
inadequate disclosure, unfair claims assessment practices, orineffective underwriting• Number, cause and value of claims-related complaints and claims
resulting in escalations to alternative dispute resolution forums or
litigation. High volumes in this regard, in addition to the risks
associated with high rejection rates, could indicate poor
communication regarding claims decisions and poor service at theclaim stage• Number, age and value of outstanding claims. This information
provides insight into the efficiency of the claims handling process• Claims ratios (i.e. levels of claims relative to premiums). Unusually
low claims ratios may be attributable to a high volume of rejectedclaims, which may indicate mis-selling or inadequate disclosure; ormay be attributable to higher than usual premiums, which may
indicate unfair pricing and poor value for money• Loss ratio information identifies insurers with more claims than thenorm. Significant deviations from the norm could indicate financial
stress if the loss ratio is unusually high; or highlight potential
concerns about claims handling or underwriting practices, if the loss
ratio is unusually low• Monitoring the above types of claims data at individual product levelor at intermediary level may provide additional insight into potential
risks of mis-selling or product shortcomings• Levels of claim provisions, compared to incurred losses.
Fluctuations in provisions can occur for a number of reasons, someof which might signal conduct of business risk. A spike in provisions
without a corresponding change in claims paid warrants
investigation.
Conduct of business risk relating to unfair claims practices is mitigated
where effective controls are in place to ensure the fairness, efficiency
and transparency of the claims processes. Positive indicators in thisregard could include:••••

A process to ensure that claims are assessed not only from a legal
contractual perspective but also taking into account fairness
considerations and the customer's reasonable benefit expectations
Clear and timely communication processes in regard to the progressof a claim, claim related decisions, and available complaint or
dispute resolution channels
A process to identify and settle unclaimed benefits
In the case of intermediaries, processes to provide support toclaimants in relation to submitting claims and to ensure customers
understand the level of support the intermediary will provide.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 43 of 47

2.17. Complaints dataand processes

Effective analysis of complaints related data provides insight into a wide
range of potential conduct of business risk. Complaint information canserve as an early warning system to detect such risks (including
potential risk mitigation problems) and to provide a basis for further
conduct of business review. Relevant issues could include:• Overall complaint volumes, split into suitable categories to enable
meaningful analysis; examples of categories include grouping
complaints per: cause of complaint; product type; distribution
channel; department / business area; customer type; value ofcomplaint; or combinations of these categories• Number of rejected complaints, including reasons for rejections.
Even where complaints are rejected because they are consideredinvalid or not justified, high volumes of such rejections could indicate
customer misunderstanding of products or processes, highlighting aneed for improved disclosure and / or training of staff orintermediaries• Number and cause of complaints that are escalated internally(where applicable) or to alternative dispute resolution forums or
litigation (or the supervisor in some cases). This measure should
also include the proportion of such complaints where the originaldecision is upheld or overturned. High escalation volumes could
indicate poor communication regarding complaint decisions or poor
service at complaint stage. High rates of overturned complaints
could indicate that the entity is not paying sufficient attention toaddressing the underlying causes of the initial complaints, or could
indicate a mis-interpretation of conduct requirements• Complaint resolution rates and timeframes, including number andage of outstanding complaints. This information provides insight into
the efficiency of the complaints handling process• Goodwill or "ex gratia" payments made in settlement of complaints(including but not limited to claims-related disputes). A high volumeof this type of settlement payment could be indicative of an insurer’s
or intermediary's reluctance to admit responsibility for unfair
business practices• Monitoring the above types of complaints data at intermediary level
may provide additional insight into potential risks of mis-selling.
Conduct of business risk relating to unfair complaints handling practices
may be mitigated where effective controls are in place to ensure thefairness, efficiency and transparency of the complaints process.
Positive indicators in this regard could include, where appropriate:•••

Processes to ensure that the complaints management function isadequately resourced, comprises suitably trained staff and issufficiently independent from other parts of the business to enableobjective complaint assessment
Processes to ensure that the complaints mechanism is accessible,
bearing in mind the customer market(s) concerned
An effective internal escalation and / or review process for complex
or unresolved complaints. An assessment of the effectiveness ofsuch a process could take into account how frequently it is used andto what extent it results in a different outcome from the originalcomplaint decision

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 44 of 47

•

•

•
2.18. Use oftechnology•

2.19. Quality of IT
infrastructure•

A clear policy regarding customer redress, as well as the extent towhich redress policies take account of customers affected by theissue giving rise to the complaint but who have not themselvescomplained
A process to ensure that complaints received by insurers that relate
to intermediaries (or, in the case of intermediaries, complaints
relating to insurers) or other third party service providers areappropriately referred and followed throughA process to ensure that complaints are appropriately categorised
and analysed to identify relevant trends and root causes, and that
action is then taken to respond to these findings.
Where insurers or intermediaries make use of new, relatively
untested technologies or non-traditional strategies (relative to norms
in the market concerned) to promote, distribute or service theirproducts or services, such practices may introduce new sources ofconduct of business risk.
The robustness and effectiveness of an insurer’s or intermediary's
IT infrastructure (including related governance and controls)correlates to its ability to meet acceptable conduct of businessstandards. Infrastructure should be adequate in light of the nature,scale and complexity of the business concerned and its associatedconduct of business requirements.

3. Indicators of risks arising from economic and environmental factors
Indicator
3.1.
Levels of
consumer indebtedness
in target market

3.2.
Extent ofcustomer exposure tomarket performance

3.3.
Extent of
involvement in high risk
market wide practices

Potential implications• An insurer or intermediary operating in a target market where a highproportion of consumers are over-indebted, may give rise to
additional risk
• Risks of inappropriate policy lapses or surrenders may increase insuch markets; trends in this regard may have implications forcustomers.
• Products where returns are dependent on market performance pose
higher risk of benefit expectations not being met than those withguaranteed or non-market related returns. This risk is exacerbatedin periods of low or volatile performance of the investment classes
concerned• Relevant issues could include: the suitability of such products for
relatively vulnerable customers; the quality of disclosures andwhether they adequately highlight potential risk; the extent to which
ongoing information is provided to manage customer expectations;the fairness and transparency of product and adviser charges,
particularly where these are dependent on the nature or
performance of underlying investments; customer trends in regard
to the proportion of money being placed into higher risk products orinvestment switching trends.
• Particular market wide product types, business models or otherpractices may pose high conduct of business risk; insurers orintermediaries that specialise or participate extensively in suchpractices may need to pay particular attention to appropriate risk
mitigation measures.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 45 of 47

Annex II

Example from United Kingdom: Payment Protection Insurance
The PPI product
Payment Protection Insurance (PPI) was sold to borrowers alongside credit products. It was meant to help repay
some or all of their borrowing if they lost their income for a period (if, for example, they had an accident, became
unemployed or sick, or died). The most commonly sold types of PPI were single premium policies on unsecuredloans (around 48% of all PPI policies sold), credit card PPI (around 36%), and regular premium policies on loans
or mortgages (around 15%). PPI was not a simple product. It had complex pricing (premiums) and benefits, anddetailed policy conditions (including eligibility criteria, exclusions from cover and limitations to benefits). Suchdetails meant that PPI was suitable for some consumers but not suitable for all. Firms should therefore haveexercised particular care when trying to sell it.
PPI mis-selling and the FSA’s actions
For reasons that were eventually set out in detail by the Competition Commission, PPI proved highly profitable tothe firms who sold it (particularly in its single premium form). Too many firms too often failed to give a balanced
presentation of the product’s pros and cons, or to ensure that a policy was suitable for the consumer’s needs. As
a result, PPI sales grew rapidly through the 1990s, peaking in 2004. Between 1990 and 2010, around 45m policies
were sold, worth £44bn in premiums.
Around two thirds of these PPI sales were made before the Financial Services Authority (FSA) – the predecessor
to the Financial Conduct Authority (FCA) – took on the regulation of non-life insurance selling (on 14 January2005). The FSA was aware from the outset of potential issues with PPI, but believed its new regime for non-life
insurance sales would address the concerns that had been raised. The FSA assessed firms’ compliance with the
new requirements in a thematic review of PPI selling practices in 2005. This identified and set out significant
shortcomings in many firms.
During 2006-08, the FSA conducted further extensive reviews (including major mystery shopping exercises) acrossall sectors of the PPI market. The FSA issued three further updates, explaining the continuing, mainly
disappointing, findings from its reviews. The FSA also took enforcement action against 28 firms and sevenindividuals, with each Final Notice detailing the firms’ sales failings and imposing fines.
The extensive selling of PPI finally contracted in early 2009, when the FSA secured an agreement from the industry
that it would immediately stop selling single premium PPI. This came ahead of the Competition Commission’s
proposed prohibitions on selling single premium policies and on selling any PPI at the same time as a credit
product. More targeted selling of regular premium protection policies has continued since 2009. Such policies canstill meet some consumers’ genuine credit protection needs.
The FSA’s PPI work then focused on ensuring that firms gave fair assessment, and, where appropriate, fairredress, to consumers who complained they had been mis-sold PPI. In August 2010, the FSA introduced additional
measures to improve significantly firms’ handling of PPI complaints. The banking industry challenged thesemeasures in the High Court, but this was unsuccessful, and from April 2011, the FSA’s supervisory work was able
to move forward. The FSA began reviewing whether firms had successfully embedded the new measures andwere generating fair outcomes for consumers’ PPI complaints.
Lessons learned by the FCA
In hindsight, the profits generated for PPI sellers were so large that the FSA’s warnings and fines were not enoughto change firms’ behaviour. The FCA factored this conclusion, and other important lessons from the PPI story, into

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 46 of 47

the design and approach of the new Financial Conduct Authority (launched in April 2013). The FCA has discussed
these changes at length in previous publications, but, to summarise, the FCA learned that they needed to:
•
•
•
•
•
•
•

conduct more market analysis, so they can reach a better understanding of whether markets are operating
well and of how best to resolve any market problems they identify
seek out the root causes of problems and deal with them at an early stage, because prevention is better thancuremake more use of our supervisory judgement
promote competition in the interests of consumers, which will enable them to take a wider range of more
effective actions to address complex issues like PPI in future
look more closely at the risks to consumers from products’ features and design, including restricting theiravailability where this is necessary to protect consumers
pursue a more intrusive supervisory framework which closely examines the largest firms’ business models (tosee where they are making profits or seeking growth), culture (to ensure this puts consumers at the heart ofthe business model), and financial incentives to staff (an important potential driver of mis-selling) andengage more directly with consumers and their representatives, so the FCA can understand their concerns,
and be more informed about consumers’ actual behaviour.

Issues Paper on Conduct of Business Risk and its Management
November 2015

Page 47 of 47