News

When speaking to clients who are concerned about the complexity of compliance, I advise aligning compliance obligations with the customer experience. This enables us to think about compliance in a logical, systematic manner. The risk of non-compliance, regulatory enforcement action & customer detriment is managed. 𝙏𝙝𝙚 𝙞𝙣𝙨𝙪𝙧𝙖𝙣𝙘𝙚 𝙨𝙖𝙡𝙚𝙨 𝙥𝙧𝙤𝙘𝙚𝙨𝙨 – 3 𝙥𝙧𝙚𝙡𝙞𝙢𝙞𝙣𝙖𝙧𝙮 𝙦𝙪𝙚𝙨𝙩𝙞𝙤𝙣𝙨 Answering 3 simple questions sets the signage for the customer sales pathway. 1. Is the client retail or wholesale? It is important to understand the disclosure documents & warnings that must be provided. This is a 2 step process. a) is the customer an individual or small business (as defined)? If yes, keep going, no = wholesale client b) does the product fall within s761G(5)(b) Corps Act as defined in Regs 7.1.11 – 7.117A? if yes = retail, if no = wholesale. 2. Is this a consumer insurance contract? This is important to determine whether the duty to take reasonable care not to make a misrepresentation or the Duty of disclosure applies. Either: a) falls within the definition of s11AB Insurance Contracts Act; or b) is deemed to be a consumer insurance contract by the insurer giving a written notice to that effect 3. Are you a Distributor (GI Code) or a [NIBA member] Insurance broker or AR of a broker (Brokers Code). This determines whether the standards & obligations of the relevant industry Codes apply to you during the sales process 𝙏𝙝𝙚 𝙘𝙪𝙨𝙩𝙤𝙢𝙚𝙧 𝙞𝙣𝙨𝙪𝙧𝙖𝙣𝙘𝙚 𝙨𝙖𝙡𝙚𝙨 𝙥𝙧𝙤𝙘𝙚𝙨𝙨 Once you have the information, it is relatively easy to map compliance obligations to each stage of the customer insurance sales process As an example – a retail client for a consumer insurance contract & you are an insurance broker acting for an insured or in plain language, a new client asks about insurance for their home. 𝘼𝙩 𝙚𝙣𝙜𝙖𝙜𝙚𝙢𝙚𝙣𝙩 provide the client with: 1. Terms of engagement (Brokers Code) 2. FSG (AFSL requirement) 𝙉𝙚𝙚𝙙𝙨 𝙖𝙣𝙖𝙡𝙮𝙨𝙞𝙨 1. provide a warning – general or personal advice [AFSL] 2. understand the insurers or underwriting agency’s underwriting questions to respond to the insured’s duty to take reasonable care not to make a misrepresentation [Insurance Contracts Act] 3. Disclose $$ remuneration (or an estimate & the actual amount as soon as reasonably practicable) [Code] 4. ensure the client falls within the relevant TMD [AFSL] 𝙌𝙪𝙤𝙩𝙞𝙣𝙜 𝙨𝙩𝙖𝙜𝙚 1. Provide the PDS [AFSL] 𝙈𝙖𝙥𝙥𝙞𝙣𝙜 𝙩𝙝𝙚 𝙨𝙖𝙡𝙚𝙨 𝙥𝙧𝙤𝙘𝙚𝙨𝙨 There may be other obligations that arise during the sales process such as misleading or deceptive conduct, hawking etc however you can see that this is merely a case of mapping out the sales process & assigning the compliance obligation at each stage

AFS Licensees have an obligation to ensure that their 𝒓𝒆𝒑𝒓𝒆𝒔𝒆𝒏𝒕𝒂𝒕𝒊𝒗𝒆𝒔 are adequately trained & are competent (s912A(1)(f) Corps Act) 𝗪𝗵𝗼 𝗶𝘀 𝗮 𝗿𝗲𝗽𝗿𝗲𝘀𝗲𝗻𝘁𝗮𝘁𝗶𝘃𝗲? Representative means (s9): – an authorised representative of the licensee; – an employee or director of the licensee; – an employee or director of a related body corporate of the licensee; & – any other person acting on behalf of the licensee. 𝘼𝙎𝙄𝘾’𝙨 𝙚𝙭𝙥𝙚𝙘𝙩𝙖𝙩𝙞𝙤𝙣𝙨 ASIC expects licensees to: (a) identify the knowledge & skills your representatives need to competently provide the financial services; (b) ensure they have the necessary knowledge & skills; (c) ensure they undertake continuing training programs to maintain & update their knowledge & skills; & (d) maintain a record of the training they have undertaken (this is required under reg 7.6.04(1)(d)). As you will observe, training is an ongoing obligation. 𝙏𝙧𝙖𝙞𝙣𝙞𝙣𝙜 Most firms adopt a CPD approach to training. However, in order to meet the obligation, representatives must be trained in financial services laws & in the specific financial services & insurance products offered. Simply attending functions or events to obtain CPD points may not satisfy the AFSL obligation. The training must have a connection with your authorised financial services. ASIC has specified minimum training for representatives who provide financial product advice to retail clients (RG 146): Tier 1 products – personal sickness & accident, CCI; Tier 2 – all other general insurance products. 𝘾𝙤𝙢𝙥𝙚𝙩𝙚𝙣𝙘𝙚 Competence includes skill, knowledge & experience. The competence must be aligned to the financial services (such as claims handling or insurance broking) & the products provided. Generally role descriptions, qualifications, short industry courses, on the job training & professional membership (ANZIIF, NIBA) are indicators of competence however on-going training is required to ensure professional development & remaining relevant. 𝙏𝙧𝙖𝙞𝙣𝙞𝙣𝙜 𝙨𝙥𝙚𝙘𝙞𝙛𝙞𝙘𝙖𝙡𝙡𝙮 𝙛𝙤𝙧 𝙥𝙚𝙤𝙥𝙡𝙚 𝙬𝙤𝙧𝙠𝙞𝙣𝙜 𝙞𝙣 𝙜𝙚𝙣𝙚𝙧𝙖𝙡 𝙞𝙣𝙨𝙪𝙧𝙖𝙣𝙘𝙚 I have developed training options, specifically for general insurance, to assist in meeting your AFSL obligations: I provide training services to businesses: a) Facilitated training on financial services laws, Industry Codes, Responsible Managers; & b) Design of in-house tailored compliance training modules. Check out ‘Compliance Education & Training’ under the ‘Services’ tab on my website (link below) I provide training services to individuals: a) Compliance workshop in Brisbane 21st Mar b) Monthly virtual financial laws training: next course 14th Mar c) Membership subscription Click below & go the tabs ‘Training’ & ‘Membership’ to learn more & register Compliance Advocacy Solutions

Under-reporting of breaches continues to be an industry-wide issue A business focus on incidents is key to successfully managing breaches 𝙁𝙤𝙘𝙪𝙨 𝙤𝙣 𝙞𝙣𝙘𝙞𝙙𝙚𝙣𝙩𝙨 An incident is something that has happened that shouldn’t have (this includes inaction) All people across the business, Authorised Reps, distributors & anyone acting on your behalf should be trained in understanding, identifying & raising incidents If you focus on breaches then you are expecting your people to know ‘000’s laws Your obligations should be linked to key control(s) therefore control breakdowns are automatically an incident. The training should include practical examples of what an incident(s) looks like within your business & for each business area. If your incident management is inadequate, the incident will continue to grow & cause harm & detriment until such time that it manifests into a breach or a significantly larger breach than if immediately detected. There is also the risk that the breach will be identified by a customer. This suggests that your compliance arrangements are inadequate & may lead to a systemic issue investigation by ASIC or AFCA. An incident & breach register should be maintained. 𝙏𝙧𝙞𝙖𝙜𝙚 𝙤𝙛 𝙞𝙣𝙘𝙞𝙙𝙚𝙣𝙩𝙨 It is important that you don’t allow the business to determine whether an incident is a breach. This analysis requires expertise. An experienced compliance person should review all incidents periodically (frequency based on the size of the organisation) & determine whether (1) additional information is required (2) the incident is a breach & if so, (3) the law &/or Code that has been breached & (4) comply with breach reporting requirements 𝙎𝙤𝙪𝙧𝙘𝙚𝙨 𝙤𝙛 𝙗𝙧𝙚𝙖𝙘𝙝 𝙤𝙗𝙡𝙞𝙜𝙖𝙩𝙞𝙤𝙣𝙨 Each Law/Code has its own requirements on what needs to be reported, to who & the timing Chp 7 Corporations Act (AFS Licensees) – Section 912DAA – note that ‘financial services laws’ is defined widely (s761A) & include, for example, breaches of the Insurance Contracts Act & the ASIC Act. Insurance Act (APRA regulated insurers) – Section 38AA Privacy Act – Division 3 (notifiable data breaches) GI Code of Practice – paragraph 181 Insurance Brokers Code of Practice – paragraph 11.2 Having separate processes for each law/code is impractical, adds complexity & creates gaps. A single breach management process is paramount 𝘽𝙧𝙚𝙖𝙘𝙝 𝙢𝙖𝙣𝙖𝙜𝙚𝙢𝙚𝙣𝙩 𝙥𝙧𝙤𝙘𝙚𝙨𝙨 Your breach management process should incorporate RG 78 with pathways to incorporate the breach reporting requirements of all other laws/industry Codes. The process should include: timeframes roles & responsibilities information gathering analysis breach committee or similar breach reporting remediation & rectification learning from the breach & continual improvement Contact me for assistance with your incident & breach management process.

I was chatting to some Lloyd’s underwriters last night & they mentioned the complexity of the Australian regulatory landscape for general insurance. I agree that the landscape is complex however, I also made the point, of how a systematic approach to compliance enables that complexity to be adequately managed. 𝘼 𝙨𝙮𝙨𝙩𝙚𝙢𝙖𝙩𝙞𝙘 𝙖𝙥𝙥𝙧𝙤𝙖𝙘𝙝 𝙩𝙤 𝘾𝙤𝙢𝙥𝙡𝙞𝙖𝙣𝙘𝙚 Identify the sources of your obligations. Obligations will arise from (i) what you do (& the licences & authorisations you need/hold); different obligations apply to insurers, Underwriting Agencies, brokers & TPAs & (ii) how you provide your services e.g., different distribution channels & use of claim service suppliers Record your material obligations. Larger firms may do this through a stand-alone register while smaller firms should incorporate it within their risk & compliance manual Adopt a risk appetite statement (RAS) position for regulatory/compliance risk. Assign key control(s) to each obligation until the obligation is within your RAS. Periodically test the control to ensure that it is designed effectively & operating effectively. Take action to close out any identified gaps Train your people (& ARs) on how compliance protects, the importance of a systemic approach to compliance & their role in control testing & self-reporting by promptly identifying & reporting incidents, breaches & complaints Use data generated by the systematic approach to compliance (incidents, breaches, complaints, self-reports, file reviews, QA etc) to validate the control test results & to report breaches to regulators or Code committees Use external information such as regulatory/Code reviews, ASIC letters, Court cases, regulator speeches & media releases & the like to question ‘could this happen to us?’ or ‘How are we managing this?’ Report the control test results & data & external information to your risk & compliance committee. The data should be analysed, connections & insights provided & decisions made. Incorporate regulatory change mechanisms into your systematic approach. Use the data that the systematic approach generates as a continuous improvement mechanism so that compliance continues to protect & adds value to your business. 𝙂𝙚𝙣𝙚𝙧𝙖𝙡 𝙞𝙣𝙨𝙪𝙧𝙖𝙣𝙘𝙚 𝙞𝙨 𝙘𝙤𝙢𝙥𝙡𝙚𝙭 A systematic approach to compliance results in an ecosystem that continually evolves to respond to & manage the risks associated with business growth & regulatory change & increasing complexity. The regulatory landscape for general insurance is complex. However, a systematic approach to compliance enables this complexity to be understood & managed in a way that protects your business, people, customers & stakeholders.

The recent Federal Court decision in Australian Securities and Investments Commission v Lanterne Fund Services Pty Limited [2024] FCA 353 provides the elements that an effective monitoring & supervision program should contain. I have expanded these elements based on my experience in working with clients in the insurance industry. 𝙄𝙢𝙥𝙡𝙚𝙢𝙚𝙣𝙩𝙞𝙣𝙜 𝙖𝙣 𝙚𝙛𝙛𝙚𝙘𝙩𝙞𝙫𝙚 𝙈𝙤𝙣𝙞𝙩𝙤𝙧𝙞𝙣𝙜 & 𝙎𝙪𝙥𝙚𝙧𝙫𝙞𝙨𝙞𝙤𝙣 𝙥𝙧𝙤𝙜𝙧𝙖𝙢 A robust due diligence process of all representatives pre-appointment Agreements with new CARs (& employees) containing requirements & obligations Supervisory arrangements – comprising monthly attestations, self-audits & risk-based audits by the licensee, formal & informal meetings with comprehensive note-taking, robust reporting of incidents, breaches & complaints Risk management & compliance systems – must be formal, systematic & documented & cover the risks faced by the firm. Risk & Compliance manuals must be tailored & current. The licensee should provide clear guidance & instructions to its CARs & ARs about their obligations regarding compliance with the financial services laws Training – must be provided & cover financial services laws including AR obligations & the relevant industry Codes. Conducted during induction & annually thereafter Human resources – the licensee must have enough people to conduct the monitoring & supervision activities. This includes regular performance reviews of the representatives & consequence management Technological resources – an adequate IT infrastructure to keep abreast of issues such as IT security or cyber security The Licensee must have enough responsible managers who are qualified, skilled & experienced in general insurance with sufficient time to conduct their role effectively Governance should include a risk & compliance committee meeting quarterly & receiving data, information & insights to oversight the licensee & their representatives The Monitoring & Supervision program must include self-checking mechanisms so that your compliance arrangements continue to evolve with regulatory changes & business growth.   I can work with you to: 1. Conduct a compliance review of your current compliance arrangements identifying gaps and adopting a risk-based approach. My reviews adopt a top-down approach not a file-by-file audit approach; 2. Design a fit-for-purpose, tailored AR program for your business; 3. Provide training for your representatives.

In the wake of the recent public hearings and the release of transcripts, there’s been a surge of discussions, particularly among clients in Queensland. These conversations are honing in on several key areas highlighted during the hearings. One significant topic of interest is ‘claims handling including delays’. People are keen to delve into how insurers are managing claims, especially in terms of timeliness and efficiency. Another focal point is ‘the role of experts such as assessors & builders’. This aspect delves into the expertise involved in assessing claims and the impact it has on the overall process. Lastly, there’s a spotlight on ‘customers experiencing vulnerability’. The discussions are examining how insurers are addressing the needs of vulnerable customers and ensuring they receive fair treatment throughout the claims process. These discussions are driven by submissions and the line of questioning from the Committees during the hearings. As we continue to analyse and reflect on these topics, we aim to gain deeper insights into the dynamics of insurance practices and how they affect clients, particularly in Queensland.

A term requiring insureds to notify A&G of any changes to their home & contents was not unfair under the ASIC Act 1. The proceedings concern home/contents insurance which contained certain notification obligations on the part of the insureds. 2. The PDS contained a number of references that explained certain matters relevant to the notification obligations (see paras 4-11 of the judgment). 3. Relevantly, the PDS contained 11 examples of changes A&G wanted the insured to tell them about 4. The offending clause, which preceded the 11 examples stated, ‘you need to tell us if 𝗮𝗻𝘆𝘁𝗵𝗶𝗻𝗴 changes about your home & contents.’ This Notification Clause was the focus of ASIC’s claim 5. Evidence concerning the processes for applying for cover (p12-22) & claim assessment (p23-30) was led by A&G 6. The Crt considered relevant provisions of Unfair Contract Terms (ASIC Act) & Utmost Good Faith (ICA) 7. The Crt rejected the literal meaning of 𝗮𝗻𝘆𝘁𝗵𝗶𝗻𝗴. 8. The Crt accepted that the requirement in the Notification Clause was restricted to notify A&G “if anything changes” concerned the information already provided by the insured to A&G. (refer 2 & 3 above) 9. The Crt held that the duty of UGF operates to limit what A&G can do under the Notification Clause in response to an insured’s failure to notify it of the relevant changes. 10. The Crt determined, upon the proper construction of the Notification Clause, the contracts of insurance contained a term that: (a) the insured must notify A&G if, during the term of the policy, there was any change to the information about the insured’s home or contents that the insured had disclosed to A&G prior to entry into the contract; & (b) if the insured failed to notify A&G of such changes, it had the right to refuse to pay a claim, reduce the amount it paid, cancel the contract or not offer to renew the contract if & to the extent that it would be consistent with commercial standards of decency & fairness for A&G to do so 11. The Crt applied the 3 limb test for ‘unfair clauses’ & held a. s54 (ICA) operates to ensure that A&G’s powers to refuse or reduce claims would not cause a 𝙨𝙞𝙜𝙣𝙞𝙛𝙞𝙘𝙖𝙣𝙩 𝙞𝙢𝙗𝙖𝙡𝙖𝙣𝙘𝙚 in the rights & obligations of the parties arising under the contract b. 𝙋𝙧𝙤𝙩𝙚𝙘𝙩𝙞𝙣𝙜 𝙡𝙚𝙜𝙞𝙩𝙞𝙢𝙖𝙩𝙚 𝙞𝙣𝙩𝙚𝙧𝙚𝙨𝙩𝙨 of A&G – s54 & UGF constrains A&G to the extent that only a failure to notify a change in information that has prejudiced its interests is relevant c. The Crt accepted ASIC’s submission that the lack of clarity in the Notification Clause 𝙘𝙖𝙪𝙨𝙚𝙙 𝙙𝙚𝙩𝙧𝙞𝙢𝙚𝙣𝙩 to the insured 𝘾𝙤𝙣𝙘𝙡𝙪𝙨𝙞𝙤𝙣 The Crt found that as only 1 of the 3 criteria of an unfair term was met, ASIC failed to establish that the Notification Clause is unfair

As the industry continues to be under scrutiny, it’s timely to revisit the overarching obligations in the GI Code & Insurance Brokers Code of Practice. 𝙂𝙄 𝘾𝙤𝙙𝙚 𝙤𝙛 𝙋𝙧𝙖𝙘𝙩𝙞𝙘𝙚 Part 3 of the GI Code requires insurers & their distributors & claim service suppliers to be 𝘩𝘰𝘯𝘦𝘴𝘵, 𝘦𝘧𝘧𝘪𝘤𝘪𝘦𝘯𝘵, 𝘧𝘢𝘪𝘳, 𝘵𝘳𝘢𝘯𝘴𝘱𝘢𝘳𝘦𝘯𝘵 & 𝘵𝘪𝘮𝘦𝘭𝘺 𝘪𝘯 𝘥𝘦𝘢𝘭𝘪𝘯𝘨𝘴 𝘸𝘪𝘵𝘩 𝘤𝘶𝘴𝘵𝘰𝘮𝘦𝘳𝘴. Let’s unpack this: – the obligation extends to underwriting agencies & external insurance claim managers; – the obligation applies to both retail & wholesale insurance. – the obligation applies to all dealings including buying insurance, making a claim, dealing with customers experiencing vulnerability & complaints. – You may ask, how does Part 3 apply to claims for wholesale insurance when, for example ‘Part 8 Making a Claim’ (& Parts 5,6,7,9 & 11), does not apply to wholesale insurance? The individual requirements of Part 8 would not apply to wholesale insurance claims however the insurer & their claim service suppliers must continue to be ‘honest, fair etc..’ – it would be a reasonable interpretation of Part 3 to suggest that each component is a separate obligation. Therefore a failure to act timely (such as in claim delays) would be a breach of the Code. 𝙄𝙣𝙨𝙪𝙧𝙖𝙣𝙘𝙚 𝘽𝙧𝙤𝙠𝙚𝙧𝙨 𝘾𝙤𝙙𝙚 𝙤𝙛 𝙋𝙧𝙖𝙘𝙩𝙞𝙘𝙚 The Brokers Code, requires NIBA members to have 𝙥𝙧𝙤𝙛𝙚𝙨𝙨𝙞𝙤𝙣𝙖𝙡 𝙘𝙤𝙢𝙢𝙞𝙩𝙢𝙚𝙣𝙩, 𝙖𝙘𝙩 𝙚𝙩𝙝𝙞𝙘𝙖𝙡𝙡𝙮 & 𝙗𝙚 𝙩𝙧𝙖𝙣𝙨𝙥𝙖𝙧𝙚𝙣𝙩 & 𝙖𝙘𝙘𝙤𝙪𝙣𝙩𝙖𝙗𝙡𝙚. Due to Part 8.0, these obligations extend to the brokers employees, agents & authorised representatives. The Ethical behaviour commitment requires brokers, their staff & [authorised] representatives to act honestly & with integrity in all dealings with clients. 𝘼𝙁𝙎𝙇 𝙜𝙚𝙣𝙚𝙧𝙖𝙡 𝙤𝙗𝙡𝙞𝙜𝙖𝙩𝙞𝙤𝙣 𝙩𝙤 𝙥𝙧𝙤𝙫𝙞𝙙𝙚 𝙛𝙞𝙣𝙖𝙣𝙘𝙞𝙖𝙡 𝙨𝙚𝙧𝙫𝙞𝙘𝙚𝙨 𝙚𝙛𝙛𝙞𝙘𝙞𝙚𝙣𝙩𝙡𝙮, 𝙝𝙤𝙣𝙚𝙨𝙩𝙡𝙮 & 𝙛𝙖𝙞𝙧𝙡𝙮 The overarching obligations of the Codes complement the AFS Licence obligation to provide financial services efficiently, honestly & fairly, but with one important distinction. The AFSL obligation only applies to financial services (which of itself is still far-reaching) while the Code obligation apply to all dealings, including administrative or clerical processes. 𝙃𝙤𝙬 𝙩𝙤 𝙞𝙢𝙥𝙡𝙚𝙢𝙚𝙣𝙩 The Code overarching obligations should be viewed as a lens after specific controls are applied. For example, the obligation to update the customer every 20 business days about the progress of their claim may receive a tick, however the question then needs to be asked, where we ‘𝘩𝘰𝘯𝘦𝘴𝘵, 𝘦𝘧𝘧𝘪𝘤𝘪𝘦𝘯𝘵, 𝘧𝘢𝘪𝘳, 𝘵𝘳𝘢𝘯𝘴𝘱𝘢𝘳𝘦𝘯𝘵 & 𝘵𝘪𝘮𝘦𝘭𝘺’? It is possible to comply with individual Code paragraphs but still be in breach of the overarching Code obligations.

Compliance is only effective when you have all people engaged. This includes staff, authorised representatives, claim service suppliers & business partners. Thinking about compliance in terms of rules & regs is generally not exciting & certainly not engaging. This is one of the things I learnt very early in my compliance career. Not many people really care about the intricacies of section 912A(1) or Part 3 of the GI code or part 8 of the Brokers Code – personally, I love this stuff. Here’s a simple test. If you can’t answer the question ‘why should I care [about compliance]’? or you think the answer is ‘because we must’, then you need to change how you position & see compliance. The true purpose of compliance is to protect. The image below shows who we should protect & from what. Let me explain how compliance protects. Your compliance arrangements are the combination of your people, IT systems, manuals, policies, guidelines & processes. Think about this another way, your compliance arrangements are the controls that you have in place to manage your financial services & industry code obligations. These compliance arrangements provide a safe environment for your people to work within. By staying within these boundaries your compliance arrangements operate to protect your customers, business, partners & people from harm. As we know, mistakes happen; systems, people & processes fail. This is when your people become your early warning system. By identifying ‘something has happened that should not have happened’ at an early stage (aka an incident) your people can quickly identify when the perimeter of your compliance arrangements have been breached. This serves to minimise any harm & enables the control(s) to be quickly rectified. Thus securing the business, its customers & people. The importance of the concept of ‘compliance protects’ has never been more evident as the insurance industry moves into the era of accountability. If something happens, under your watch, in your area of accountability there will be personal consequences – both financial & reputational. FAR & CPS 230 are examples of where accountability is heading & casting a wide net. This is why compliance protects. Robust compliance arrangements provide a mechanism & infrastructure to support & protect your business, your customers & you from harm & detriment. I will be exploring the theme of ‘compliance protects’ at my Compliance workshop in Brisbane on Thursday 21st March at Lightspace, Brisbane’s unique event venue and co-working warehouse. I will be providing you with the tools & insights to develop compliance arrangements that operate to support & protect the things that matter to you. Registration for the workshop is now open & can be accessed via the link below. See you in Brisbane Managing Compliance in the insurance industry