Compliance Advocacy Solutions

February 29, 2024
By admin
News
No Comments

𝐖𝐡𝐚𝐭 𝐝𝐨𝐞𝐬 𝐢𝐭 𝐦𝐞𝐚𝐧 𝐭𝐨 𝐛𝐞 𝐚𝐧 𝐀𝐮𝐭𝐡𝐨𝐫𝐢𝐬𝐞𝐝 𝐑𝐞𝐩𝐫𝐞𝐬𝐞𝐧𝐭𝐚𝐭𝐢𝐯𝐞, 𝐟𝐫𝐨𝐦 𝐚 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐩𝐞𝐫𝐬𝐩𝐞𝐜𝐭𝐢𝐯𝐞?

An Australian financial services licensee may appoint ‘authorised representatives’ to provide specified financial services on its behalf. Acting as an AR can be a cost effective way of operating a financial services business although most insurers require their MGAs & TPAs to hold their own AFSL. This is due to the risk that the AR presents to the insurer’s Licence. AR networks continue to be used within the Insurance Broking community however due diligence & compliance monitoring is being strengthened. There are regulatory requirements for appointing ARs & notifying ASIC. There are also rules & limitations in appointing sub-authorised representatives. Notification requirements also apply in respect of when an AR ceases to be authorised. These requirements should be captured in the Licensee’s compliance manual. In addition, the Licensee, if a subscriber to the GI Code or Insurance Brokers Code, will also have Code obligations in respect of the conduct of its ARs (GI Code see Parts 3-5 & Brokers Code see Part 8). Generally, the Licensee is responsible for the training, competency & conduct of its ARs & therefore should have a Monitoring & Supervision Program in place. This benefits & protects both the Licensees & Authorised Reps business. 𝑶𝒃𝒍𝒊𝒈𝒂𝒕𝒊𝒐𝒏𝒔 𝒐𝒇 𝒂𝒏 𝑨𝒖𝒕𝒉𝒐𝒓𝒊𝒔𝒆𝒅 𝑹𝒆𝒑𝒓𝒆𝒔𝒆𝒏𝒕𝒂𝒕𝒊𝒗𝒆 In addition to meeting the obligations of the Licensee, ARs have a number of independent obligations, including: Be appointed in writing as an Authorised Representative of the Licensee ; Not hold out that they have an AFS Licence. In this regard, the AR should include their AR number & disclose the relationship with the Licensee in all business documents & on their website; Provide disclosure documents (FSG, PDS) as required when the General Insurance Products are provided to Retail clients; Provide details of remuneration in an FSG; Keep records of insurance transactions; Comply with hawking prohibitions (retail clients) & misleading & deceptive conduct provisions; Ensure they act within the scope of authority given; & Comply with Product design & distribution requirements & TMD (when financial services are provided to retail clients). 𝘼𝙪𝙩𝙝𝙤𝙧𝙞𝙨𝙚𝙙 𝙍𝙚𝙥𝙧𝙚𝙨𝙚𝙣𝙩𝙖𝙩𝙞𝙫𝙚 𝙘𝙤𝙢𝙥𝙡𝙞𝙖𝙣𝙘𝙚 𝙢𝙚𝙖𝙨𝙪𝙧𝙚𝙨 It follows from the above, that the best practice is for the Authorised Representative to have its compliance measures captured in a Compliance Manual. The Manual should be tailored to the ARs business model & way of working & dovetail with the Licencee’s compliance requirements. Speak to me if you are an Authorised Representative requiring assistance with your compliance requirements or if you are an AFS licensee requiring assistance with your AR monitoring & supervision program.

February 19, 2024
By admin
News
No Comments

𝗖𝗮𝗻 𝘆𝗼𝘂 𝗺𝗲𝗮𝘀𝘂𝗿𝗲 𝘁𝗵𝗲 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗿𝗶𝘀𝗸 𝗺𝗮𝘁𝘂𝗿𝗶𝘁𝘆 𝗼𝗳 𝘆𝗼𝘂𝗿 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻?

APRA has mandated an insurer to undertake a risk remediation program & has increased its capital requirements in response to concerns about its risk governance. APRA’s decision follows a prudential review that identified significant weaknesses in the insurer’s risk governance, risk management & compliance practices. These included capability & capacity weaknesses in the risk function, ineffectiveness of the “three lines of defence” model, & weak risk reporting. The review also revealed unclear accountabilities and responsibilities across the business, & overall, an immature risk culture. Given the heightened prudential risk arising from the identified weaknesses, APRA has also imposed an additional $50 million capital requirement in the form of an operational risk charge. 𝙈𝙚𝙖𝙨𝙪𝙧𝙞𝙣𝙜 𝙘𝙤𝙢𝙥𝙡𝙞𝙖𝙣𝙘𝙚 𝙧𝙞𝙨𝙠 𝙢𝙖𝙩𝙪𝙧𝙞𝙩𝙮 There are many benefits in measuring compliance risk maturity: Identification of gaps & weaknesses in your compliance arrangements; A prioritised action plan to close out gaps by adopting a risk-based approach; Enables the allocation of resources (including human, technology & financial) to those areas of strategic, customer or regulatory importance; Provides transparent criteria to benchmark progress & facilitate board reporting; & Enables different maturity levels to be set as targets for each of the 4 components. 𝙃𝙤𝙬 𝙩𝙤 𝙘𝙤𝙣𝙙𝙪𝙘𝙩 𝙖𝙣 𝙖𝙣𝙖𝙡𝙮𝙨𝙞𝙨 𝙤𝙛 𝙘𝙤𝙢𝙥𝙡𝙞𝙖𝙣𝙘𝙚 𝙧𝙞𝙨𝙠 𝙢𝙖𝙩𝙪𝙧𝙞𝙩𝙮 (𝙞𝙣 𝙩𝙝𝙚 𝙞𝙣𝙨𝙪𝙧𝙖𝙣𝙘𝙚 𝙞𝙣𝙙𝙪𝙨𝙩𝙧𝙮) Step 1 – there are 4 components or categories that are assessed from a compliance risk perspective – (1) governance, (2) process & procedures, (3) people and (4) systems & reporting. A compliance review is conducted to determine the firm’s current state against each of these components; Step 2 – the current state is assessed as either ‘basic, evolving, established, advanced or optimised’. Pre-agreed criteria is used to describe each phase of maturity enabling a robust conversation to take place so that a realistic current state is determined. The current state is plotted on the matrix for each category; Step 3 – recognising the cost-benefit trade-off, the board sets the desired level of risk maturity to be achieved over a defined period for each component. For example, the Board may set a target that within 18 months: systems will be ‘Advanced’ while people will be ‘Optimised’. This enables a strategic allocation of resources & a plan that can be shared with key stakeholders; Step 4 – actions are developed, cost & approved to achieve the target level of risk maturity for each of the 4 components; Step 5 – Progress to plan is monitored & included in board reporting. Please contact me if you would like to explore the compliance reviews & risk maturity assessments I provide.

February 12, 2024
By admin
News
No Comments

𝗔𝗿𝗲 𝘆𝗼𝘂 𝗮𝗻 𝗨𝗻𝗱𝗲𝗿𝘄𝗿𝗶𝘁𝗶𝗻𝗴 𝗔𝗴𝗲𝗻𝗰𝘆, 𝗖𝗹𝗮𝗶𝗺 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗦𝘂𝗽𝗽𝗹𝗶𝗲𝗿 𝗼𝗿 𝗜𝗻𝘀𝘂𝗿𝗮𝗻𝗰𝗲 𝗕𝗿𝗼𝗸𝗲𝗿? 𝗔𝗿𝗲 𝘆𝗼𝘂 𝗽𝗿𝗲𝗽𝗮𝗿𝗲𝗱 𝗳𝗼𝗿 𝗖𝗣𝗦 𝟮𝟯𝟬?

APRA Prudential Standard CPS 230 ‘Operational Risk Management’ comes into force July 2025. CPS 230 applies to APRA-regulated insurers (including both local insurers & Category C insurers) however there are indirect or downstream impacts on Underwriting Agencies, Claim Managers (Service Suppliers) & Insurance Brokers. These impacts arise in respect of insurers’ critical operations & material service providers. 𝙘𝙧𝙞𝙩𝙞𝙘𝙖𝙡 𝙤𝙥𝙚𝙧𝙖𝙩𝙞𝙤𝙣𝙨 An APRA-regulated entity must maintain its critical operations within tolerance levels through severe disruptions & manage the risks associated with the use of service providers (para 12 CPS 230). For an insurer, claims processing is a critical operation unless the insurer can justify otherwise. 𝙈𝙖𝙩𝙚𝙧𝙞𝙖𝙡 𝙨𝙚𝙧𝙫𝙞𝙘𝙚 𝙥𝙧𝙤𝙫𝙞𝙙𝙚𝙧𝙨 An APRA-regulated entity must, at a minimum, classify a provider of the following services as a material service provider, unless it can justify otherwise: for an insurer (general, life, private health): underwriting, claims management, insurance brokerage & reinsurance (p50) 𝘔𝘢𝘯𝘢𝘨𝘦𝘮𝘦𝘯𝘵 𝘰𝘧 𝘴𝘦𝘳𝘷𝘪𝘤𝘦 𝘱𝘳𝘰𝘷𝘪𝘥𝘦𝘳 𝘢𝘳𝘳𝘢𝘯𝘨𝘦𝘮𝘦𝘯𝘵𝘴 An APRA-regulated insurer must: Maintain a comprehensive service provider management policy (p47); Identify & maintain a register of its material service providers & manage the material risks associated with using these providers (p49) & submit the register to APRA on an annual basis; Before entering into or modifying a material arrangement undertake due diligence assessing the financial & non-financial risks (p53) Maintain a formal legally binding agreement covering the matters listed in p54 (a) – (g); Monitor the arrangement (p58); Meet the APRA notification requirements (p59); & Have the arrangements reviewed by its internal audit function (p60). 𝙎𝙤 𝙬𝙝𝙖𝙩 𝙙𝙤𝙚𝙨 𝙩𝙝𝙞𝙨 𝙢𝙚𝙖𝙣 𝙛𝙤𝙧 𝙢𝙖𝙩𝙚𝙧𝙞𝙖𝙡 𝙨𝙚𝙧𝙫𝙞𝙘𝙚 𝙥𝙧𝙤𝙫𝙞𝙙𝙚𝙧𝙨? Material service providers who are well prepared for the impacts of CPS 230 will achieve a competitive advantage in their partnering with insurers. Providers of material services must: Incorporate the requirements of CPS 230 into their risk & compliance arrangements including referencing APRA’s Prudential Practice Guide (CPG 230); Engage early with insurer(s) to understand the insurer(s) project plan in respect of timeframes & any unique requirements they have; & Arrange for a compliance review in early 2024 (due diligence) to fully understand the impact of the proposed changes to ensure a seamless transition to the new arrangements. Do not hesitate to contact me to assist in being prepared for the impacts of CPS 230 on your business.

February 8, 2024
By admin
News, Uncategorized
No Comments

𝗠𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗲𝗳𝗳𝗲𝗰𝘁𝗶𝘃𝗲𝗹𝘆 & 𝗲𝗳𝗳𝗶𝗰𝗶𝗲𝗻𝘁𝗹𝘆 – 𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝘁𝗼 𝗽𝗿𝗼𝘁𝗲𝗰𝘁

A common issue I observe when reviewing risk & compliance frameworks is the absence of a logical flow. Risk & compliance should be managed in a systematic manner ensuring that nothing is missed & no gaps emerge. The purpose of compliance is to protect. Protect the business, its people, stakeholders & customers. To do this, all component parts must work in sync. 𝙏𝙝𝙚 𝙘𝙤𝙢𝙥𝙤𝙣𝙚𝙣𝙩𝙨 𝙤𝙛 𝙖 𝙨𝙮𝙨𝙩𝙚𝙢𝙖𝙩𝙞𝙘 𝙖𝙥𝙥𝙧𝙤𝙖𝙘𝙝 𝙩𝙤 𝙧𝙞𝙨𝙠 & 𝙘𝙤𝙢𝙥𝙡𝙞𝙖𝙣𝙘𝙚 1. What you do & how you do it. Within the insurance industry, the services & products you provide & on whose behalf, determine the need for you to be APRA authorised, AFS Licensed, Authorised Rep, Code subscriber, Distributor, Service Supplier etc. This in turn shapes your risk profile. Unpacking what you do & how you do it, is always the starting point in any risk & compliance framework. 2. Governance Roles & responsibilities: whose doing what, who provides oversight & the mechanics of ‘doing & oversight’, is the next step & creates an environment within which business can be safely conducted & layers of protection. 3. Risk management Understanding your risks & managing those risks [in 6 simple steps] within the boundaries of the firm’s risk appetite provides an internal mechanism for decision-making. 4. Licence management For AFS Licensees, I call out licence management as a separate component. Your Licence, is, after all, your ticket to play [including any Authorised Reps]. 5. Material obligations. AFS Licence, APRA authorisation, Code & AFCA membership, Binder & Authorised Rep Agreements, Distribution & Claim service supplier arrangements all create obligations. These obligations must be identified. You can’t manage what you don’t know. Depending on the size of the firm, I include the key control(s) within the obligations section. I find its best to have a single source of truth [manual] rather than multiple referenced documents. 6. Obligations management This sets in place a systematic approach to managing the obligations including the sources of new/amended obligations & how these are incorporated into the framework. 7. Control testing A control that is not tested (design & operational) is no control. 8. Monitoring & supervision This extends to staff & AR’s & forms another layer of protection. The M&S needs to be independent, fit-for-purpose & risk-based. 9. Reporting Data from risk & compliance registers, control testing, monitoring & supervision provides an indication of the health of the compliance system. 10. Incident & breach management Things do go wrong. The quicker they are identified the less harm caused. 𝙍𝙞𝙨𝙠 & 𝙘𝙤𝙢𝙥𝙡𝙞𝙖𝙣𝙘𝙚 𝙖𝙨𝙨𝙞𝙨𝙩𝙖𝙣𝙘𝙚 Contact me to understand how a systematic approach to risk & compliance protects your business, people & customers.

February 5, 2024
By admin
News
No Comments

𝗣𝗿𝗼𝘃𝗶𝗱𝗶𝗻𝗴 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀 – 𝗚𝗲𝗻𝗲𝗿𝗮𝗹 𝗜𝗻𝘀𝘂𝗿𝗮𝗻𝗰𝗲 𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘀𝗮𝘁𝗶𝗼𝗻𝘀

Financial services laws are designed to protect consumers. The 1st layer of protection is the need to hold an AFS Licence. Unless you are an AR of a Licensee or can rely upon an exemption you need to hold an AFS Licence to provide general insurance financial services: 𝙇𝙞𝙘𝙚𝙣𝙘𝙚 𝙖𝙪𝙩𝙝𝙤𝙧𝙞𝙨𝙖𝙩𝙞𝙤𝙣𝙨 The 3 authorisations relevant for GI are: 1 Providing financial product advice, this may be restricted to general product advice; 2. Dealing in general insurance products by: Issue, apply for, acquire, vary or dispose of; and/or Apply for, acquire, vary, or dispose of on behalf of another. 3. Provide a claims handling & settling service. to Retail &/or Wholesale clients. 𝙒𝙝𝙖𝙩 𝙖𝙪𝙩𝙝𝙤𝙧𝙞𝙨𝙖𝙩𝙞𝙤𝙣 𝙙𝙤 𝙮𝙤𝙪 𝙣𝙚𝙚𝙙? APRA-regulated insurers – although authorised by APRA to carry on insurance business in Australia, insurers require an AFS Licence when providing financial services unless relying upon the Wholesale client exception. Insurers generally need all 3 authorisations although dealing is limited to the issuing authority & the claims authorisation does not include representing a person making a claim. Underwriting Agencies – depending on their binder/agency agreement will generally require the same authorisations as insurers. If the MGA places the business in the open market (ie not under a binder) they will require the dealing authorisation ‘on behalf of another’. Insurance brokers – require financial product advice & dealing on behalf of another authorisation only. Brokers can rely on the claims exemption provided they arranged the contract of insurance or are acting under a letter of appointment. Brokers also require the Licence condition permitting them to use the restricted terms associated with insurance broking. TPAs – will require the same claim authorisations as insurers, as the TPA acts on behalf of insurers as an ‘Insurance claims Manager’. Claimant Intermediaries act on behalf of insureds & will require a Claims authorisation limited to making a recommendation; assisting & representing a person making a claim. Claim Service Suppliers & insurance fulfilment providers, acting on behalf of insurers, generally do not require a licence as they can rely on exemptions. In these cases it’s necessary to examine the authority they have from insurers/MGA. 𝙒𝙝𝙖𝙩 𝙝𝙖𝙥𝙥𝙚𝙣𝙨 𝙞𝙛 𝙮𝙤𝙪 𝙥𝙧𝙤𝙫𝙞𝙙𝙚 𝙛𝙞𝙣𝙖𝙣𝙘𝙞𝙖𝙡 𝙨𝙚𝙧𝙫𝙞𝙘𝙚𝙨 𝙬𝙞𝙩𝙝𝙤𝙪𝙩 𝙖 𝙇𝙞𝙘𝙚𝙣𝙘𝙚? It is an offence to provide financial services without a licence (or acting as an AR or relying on an exemption). It is also an offence to hold out that you hold an AFS Licence if you do not. Ensuring that you hold the correct AFS Licence authorisations & conditions is critical when providing (or intending to provide) financial services in Australia.

Family

𝐖𝐡𝐚𝐭 𝐝𝐨𝐞𝐬 𝐢𝐭 𝐦𝐞𝐚𝐧 𝐭𝐨 𝐛𝐞 𝐚𝐧 𝐀𝐮𝐭𝐡𝐨𝐫𝐢𝐬𝐞𝐝 𝐑𝐞𝐩𝐫𝐞𝐬𝐞𝐧𝐭𝐚𝐭𝐢𝐯𝐞, 𝐟𝐫𝐨𝐦 𝐚 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐩𝐞𝐫𝐬𝐩𝐞𝐜𝐭𝐢𝐯𝐞?

𝗖𝗮𝗻 𝘆𝗼𝘂 𝗺𝗲𝗮𝘀𝘂𝗿𝗲 𝘁𝗵𝗲 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗿𝗶𝘀𝗸 𝗺𝗮𝘁𝘂𝗿𝗶𝘁𝘆 𝗼𝗳 𝘆𝗼𝘂𝗿 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻?

𝗠𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗲𝗳𝗳𝗲𝗰𝘁𝗶𝘃𝗲𝗹𝘆 & 𝗲𝗳𝗳𝗶𝗰𝗶𝗲𝗻𝘁𝗹𝘆 – 𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝘁𝗼 𝗽𝗿𝗼𝘁𝗲𝗰𝘁

𝗣𝗿𝗼𝘃𝗶𝗱𝗶𝗻𝗴 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀 – 𝗚𝗲𝗻𝗲𝗿𝗮𝗹 𝗜𝗻𝘀𝘂𝗿𝗮𝗻𝗰𝗲 𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘀𝗮𝘁𝗶𝗼𝗻𝘀