12. Financial Crime, Sanctions and Data Governance

Introduction and Context

Insurance is exposed to financial crime because it moves substantial funds, relies on intermediaries, receives information from many jurisdictions, and often pays claims to parties whose identity, ownership, or economic purpose may be difficult to verify. Life insurance, annuities, reinsurance, marine insurance, specialty lines, claims settlements, premium refunds, and insurance-linked investments can all be misused to disguise criminal proceeds or transfer value to prohibited persons.

Financial-crime compliance is therefore not a narrow banking issue. It is a central element of insurance governance and risk management. An insurer must understand who its customers and beneficiaries are, identify the source and purpose of transactions, recognise suspicious behaviour, prevent dealings with sanctioned parties, control bribery risks, preserve reliable records, and protect personal data. These duties are connected but not identical. Anti-money-laundering controls may require the collection and analysis of personal information, while data-protection law limits excessive collection, restricts disclosure, and requires secure handling. Effective compliance depends on reconciling these obligations rather than treating one as automatically superior to the other.

The precise legal requirements differ across jurisdictions. International standards, including those developed by the Financial Action Task Force (FATF), provide an influential framework, but domestic statutes, supervisory rules, sanctions regimes, privacy legislation, and sector-specific guidance determine the duties applicable to a particular insurer. This chapter presents the principal concepts and a practical governance framework for postgraduate study and professional application.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain how insurance products and distribution channels may be exploited for money laundering, terrorist financing, sanctions evasion, bribery, and fraud.

2. Distinguish customer due diligence, enhanced due diligence, beneficial ownership, suspicious-transaction reporting, sanctions screening, and recordkeeping.

3. Apply a risk-based compliance framework to underwriting, policy administration, claims, reinsurance, intermediaries, and payments.

4. Analyse the relationship between AML/CFT duties, anti-bribery controls, data protection, cybersecurity, and cross-border data transfers.

5. Evaluate the managerial, ethical, technological, and governance challenges involved in implementing financial-crime controls.

6. Recommend an appropriate response to a complex insurance compliance scenario.

The Financial-Crime Landscape in Insurance

Money laundering generally involves converting, concealing, disguising, acquiring, using, or transferring the proceeds of crime. A traditional analytical model identifies three stages: placement, layering, and integration. Placement introduces illicit funds into the financial system; layering creates complex transactions to obscure their origin; integration makes the funds appear legitimate. The stages do not always occur separately, and an insurance transaction may support more than one stage.

Terrorist financing differs in an important respect. Funds may originate from legitimate sources, but they are collected or transferred to support terrorist acts, organisations, or individuals. Consequently, focusing only on the criminal origin of money is insufficient. Insurance firms must also consider the intended use, destination, and beneficiaries of funds.

Insurance products present different levels of exposure. Single-premium life policies, investment-linked products, annuities, cash-value contracts, and policies with third-party premium payments may be more vulnerable than ordinary property insurance. However, non-life business is not risk-free. False claims, inflated losses, staged accidents, premium diversion, fronting arrangements, and misuse of brokers can conceal fraud or facilitate transfers of value. Reinsurance creates additional complexity because counterparties, retrocessionaires, brokers, cedants, and payment routes may span several jurisdictions.

The risk is not confined to customers. A policyholder, insured person, beneficiary, claimant, broker, agent, reinsurer, service provider, director, or ultimate owner may present a risk. Controls must therefore operate across the relationship lifecycle rather than only at initial onboarding.

Core Concepts and Regulatory Architecture

A risk-based approach

A risk-based approach allocates greater attention and resources to relationships and transactions presenting higher risks, while permitting proportionate treatment of lower-risk situations. It is not a licence to ignore low-value transactions or entire categories of customers. The insurer should assess customer, product, geographic, delivery-channel, and transactional risks, document the reasoning, apply controls, and periodically review the assessment.

A sound risk assessment considers factors such as complex ownership, politically exposed persons (PEPs), high-risk jurisdictions, unusual payment methods, non-face-to-face onboarding, opaque intermediaries, rapid surrender of policies, unexplained changes in beneficiaries, large third-party payments, and inconsistencies between the customer profile and the transaction. Risk ratings should not be based on nationality or other broad proxies alone; they should be supported by relevant evidence and subject to human review.

Customer due diligence and KYC

Know Your Customer (KYC) is the operational discipline through which the insurer identifies and verifies the customer and understands the relationship. Customer due diligence (CDD) normally includes:

• identifying the customer and verifying identity using reliable, independent sources;
• identifying the beneficial owner and understanding ownership and control;
• understanding the purpose and intended nature of the relationship;
• establishing, where appropriate, the source of funds and source of wealth; and
• conducting ongoing monitoring and updating information.

Identification is the collection of information; verification is the process of testing that information against dependable evidence. A corporate name, registration number, address, and authorised signatory may be insufficient if the individual who ultimately owns or controls the entity remains unknown.

Beneficial ownership refers to the natural person or persons who ultimately own or control a customer, or on whose behalf a transaction is conducted. Ownership may arise through shares, voting rights, contractual arrangements, chains of companies, trusts, nominees, or effective influence. A company’s formal directors are not necessarily its beneficial owners. Where ownership cannot be determined directly, the insurer must follow the applicable legal methodology and document the conclusion rather than simply accepting an unexplained corporate structure.

Enhanced and simplified due diligence

Enhanced due diligence (EDD) is applied when risk is higher. It may include senior-management approval, additional identity and ownership evidence, more detailed source-of-wealth information, stronger transaction monitoring, shorter review intervals, and restrictions on payment or distribution arrangements. PEP status does not establish criminality, but it may require additional controls because of exposure to bribery, corruption, and abuse of public position. Family members and close associates may also be relevant under applicable law.

Simplified measures may be permitted in genuinely lower-risk circumstances, but they do not eliminate the duty to identify the customer or report suspicion. A risk classification should be capable of explanation to supervisors, auditors, and investigators.

Suspicious-transaction reporting

A suspicious transaction is not necessarily an illegal transaction. Suspicion may arise when facts, patterns, or circumstances create a reasonable basis to believe that funds may be connected with criminal activity or terrorist financing. Indicators include a policy that is surrendered shortly after a large premium, payment by unrelated third parties, refusal to provide ownership information, repeated changes to beneficiaries, claims inconsistent with known circumstances, premium payments from high-risk locations, or use of multiple intermediaries without a commercial explanation.

The compliance function should investigate alerts objectively, preserve evidence, and determine whether a report must be filed with the competent financial-intelligence authority. Employees must avoid tipping off a customer or other person where the law prohibits disclosure. A suspicious-transaction report is not a finding of guilt; it is a confidential regulatory communication based on reasonable suspicion.

Sanctions compliance

Sanctions are legal restrictions imposed by states or international bodies. They may target countries, governments, companies, vessels, groups, individuals, sectors, goods, services, assets, or financial activity. Sanctions regimes can include asset freezes, prohibitions on making funds or economic resources available, trade restrictions, capital-market measures, and restrictions on insurance or reinsurance services.

Sanctions screening is distinct from AML monitoring. AML asks whether activity may involve criminal proceeds or terrorist financing; sanctions controls ask whether a prohibited person, activity, asset, or jurisdiction is involved. An insurer should screen relevant parties at onboarding, periodically, and at points of change such as endorsements, claims, payments, renewals, and changes in ownership. Screening should include policyholders, insureds, beneficiaries, claimants, payees, brokers, reinsurers, suppliers, directors, and other relevant parties.

A name match is an alert, not automatically a confirmed match. Resolution requires comparison of identifiers such as date of birth, address, nationality, registration details, ownership, and geography. A potential true match should be escalated, payments or performance paused where legally required, records preserved, and the matter reported to the appropriate authority. Attempting to evade sanctions through a third-party payment, altered description, split transaction, or disguised ownership is itself a serious warning sign.

Anti-bribery and corruption

Insurance operations can create bribery risks in licensing, public procurement, claims settlement, inspections, loss adjustment, placement of reinsurance, and use of agents. An anti-bribery programme should address direct and indirect payments, facilitation payments where prohibited, gifts and hospitality, charitable contributions, sponsorships, political exposure, conflicts of interest, commissions, and third-party due diligence.

The central principle is that an organisation may face liability for conduct carried out through an intermediary. A broker or consultant cannot be used as a shield for an improper payment. Controls should therefore include written standards, approval thresholds, transparent remuneration, conflict declarations, payment through traceable channels, training, whistleblowing, investigation, and disciplinary action.

A Lifecycle Framework for Insurance Compliance

Financial-crime compliance is most effective when embedded in the insurance operating model.

At product design stage, the insurer should assess whether a product permits anonymous ownership, rapid cash value, unusual payment routes, or easy assignment to third parties. Product governance should define acceptable distribution channels, payment methods, jurisdictional restrictions, and escalation criteria.

During distribution and onboarding, the insurer should identify the customer, intermediary, insured, beneficiary, and beneficial owner as relevant. Digital onboarding can improve consistency, but automated identity verification must be tested for accuracy, bias, document fraud, and accessibility. Reliance on an intermediary or group entity should be supported by a legally valid arrangement and assurance that required information can be obtained promptly.

Underwriting should compare the proposed policy with the customer’s profile, occupation, business activity, financial capacity, geography, and stated insurance need. A legitimate high-value policy is not suspicious merely because it is large; concern arises when the transaction lacks a credible economic explanation or conflicts with available information.

Policy administration presents ongoing risks. Changes in ownership, beneficiaries, payment accounts, address, premium payer, or insured interest may alter the risk profile. A request to redirect a claim payment to an unrelated account should not be treated as an ordinary administrative instruction.

Claims handling requires careful coordination between fraud detection, sanctions screening, privacy, and fair claims treatment. The insurer should verify the claimant and payee, assess the legitimacy of the loss, identify conflicts, and investigate unusual patterns without unlawfully delaying valid claims. A claims investigator should record the factual basis for escalation and avoid discriminatory assumptions.

Reinsurance and retrocession demand counterparty due diligence, ownership checks, sanctions screening, payment transparency, and contractual cooperation clauses. The insurer should understand the chain of participants sufficiently to identify prohibited parties and unusual flows of funds.

At termination, surrender, refund, or cancellation, the insurer should examine whether the timing and destination of funds are consistent with the relationship. Records must be retained for the period required by applicable law, even after the relationship ends.

Data Governance: Privacy, Security and Lawful Use

AML, sanctions, fraud, and anti-bribery controls depend on data. The relevant data may include identity documents, addresses, financial information, biometric information, health information in claims files, criminal-record information, communications, device information, and transaction histories. This creates a dual responsibility: the insurer must collect and use sufficient information for compliance, while respecting principles of legality, fairness, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, and accountability.

A data-governance framework should identify what information is collected, why it is required, who may access it, where it is stored, how long it is retained, and when it must be deleted or restricted. Compliance records should not become an uncontrolled archive of personal information. Data used for one purpose should not automatically be reused for unrelated marketing or profiling without a lawful basis and appropriate transparency.

Privacy notices should explain relevant processing in understandable terms, subject to lawful limits where disclosure could compromise an investigation. Access rights and other data-subject rights may be restricted in some jurisdictions for AML or investigative reasons, but restrictions should be grounded in law, proportionate, documented, and reviewed.

Cybersecurity is a component of data governance, not a separate technical concern. Controls should include identity and access management, least privilege, multi-factor authentication, encryption, secure interfaces with vendors, logging, backup, vulnerability management, incident response, and staff awareness. A compliance database containing sanctions alerts and suspicious-activity information is particularly sensitive because unauthorised disclosure may cause legal, safety, and reputational harm.

Cross-border data transfers

Insurance groups commonly centralise KYC, claims, fraud, and sanctions functions. Cross-border transfers may be necessary, but they raise questions concerning transfer mechanisms, localisation rules, supervisory access, confidentiality, onward transfers, government access, and contractual responsibility. Before transferring data, the organisation should determine the legal basis, assess the destination and recipient, use an approved transfer mechanism where required, apply technical safeguards, and document the decision.

Data localisation is not always an absolute prohibition on international processing, and global centralisation is not automatically lawful. A proportionate model may involve regional storage, controlled access from other jurisdictions, pseudonymisation, field-level masking, or transfer of only the information necessary for the task.

Governance, Technology and Accountability

The board remains responsible for ensuring that financial-crime and data risks are governed, even when operational responsibility is delegated. A three-lines model is useful: business and operations own day-to-day risk; compliance, legal, privacy, and information-security functions provide oversight and challenge; and internal audit gives independent assurance. Clear reporting lines, documented escalation, adequate resources, and protected whistleblowing channels are essential.

Technology can support screening, transaction monitoring, network analysis, optical character recognition, sanctions-list ingestion, adverse-media review, and case management. Machine-learning systems may identify patterns that rule-based systems miss, but they can also reproduce poor data, generate opaque outcomes, or create excessive false positives. Automation should therefore be risk-based, explainable to the extent required, monitored for performance and bias, and subject to human decision-making for consequential outcomes.

Important performance measures include alert volumes, false-positive rates, investigation timeliness, overdue reviews, quality of beneficial-ownership data, sanctions-screening coverage, training completion, control-testing results, data incidents, and remediation age. Metrics should not reward the simple closure of alerts. A low alert count may indicate effective targeting or a defective monitoring system; interpretation requires context.

Vendor risk is significant because insurers often rely on screening providers, cloud platforms, claims administrators, brokers, and identity-verification firms. Contracts should address security, confidentiality, audit rights, subcontracting, incident notification, data deletion, regulatory cooperation, service continuity, and return of records.

Illustrative Case Study: The Redirected Claim Payment

Background

Atlas Assurance, a fictional commercial insurer, provides property cover to Meridian Trading Ltd., a company incorporated in Country X. Meridian’s beneficial ownership is held through two intermediate companies. Its policy was placed by a local broker, and premiums were paid from an account in Country Y. The insured property suffers a substantial fire loss.

Situation and problem

During claims processing, the appointed loss adjuster receives instructions to pay the claim into an account in Country Z belonging to a newly formed company that is not named in the policy. The claimant explains that the new company is a “group financing vehicle.” The beneficial-owner documents supplied at onboarding are more than two years old, and one director appears similar to a person on a sanctions list. The broker urges immediate payment, stating that delay will damage the commercial relationship.

Analysis

Several risks interact. The change of payee is inconsistent with the original relationship and may represent an attempt to transfer value to a third party. The new company’s ownership is unclear. The possible sanctions match cannot be dismissed on name similarity alone, but it requires prompt resolution. The cross-border payment creates jurisdictional and sanctions exposure. The pressure from the broker may also indicate a governance or bribery concern. At the same time, the insurer must avoid treating suspicion as proof that the underlying fire claim is fraudulent.

Approach and solution

Atlas should place the payment instruction on hold in accordance with its sanctions and claims procedures, while preserving the claim file and avoiding disclosure of any confidential report. It should refresh customer and beneficial-owner information, verify the proposed payee, identify the relationship between Meridian and the new company, and resolve the potential sanctions match using reliable identifiers. Compliance, legal, claims, privacy, and sanctions personnel should coordinate the review.

The insurer should assess whether a suspicious-transaction report is required, determine whether any sanctions authority notification or licence is relevant, and document the decision. Access to sensitive information should be restricted to authorised personnel. The broker’s conduct should be reviewed under intermediary oversight and anti-bribery procedures. If the payment is ultimately lawful and the claim valid, it may be paid through an approved route after controls are satisfied; if a prohibition applies, the insurer must follow the applicable legal process.

Outcome

For this illustrative case, Atlas determines that the apparent sanctions match is a false positive but discovers that the new company is controlled by an undisclosed person connected to a high-risk public procurement relationship. The insurer files the required report, declines the unexplained redirection, and pays only after obtaining a lawful, verified payment instruction. It also subjects the broker to enhanced oversight and updates its beneficial-ownership review procedures.

Learning points

The case demonstrates that sanctions screening, AML, anti-bribery, claims governance, privacy, and payment controls cannot operate in isolation. A valid claim does not automatically justify payment to any nominated recipient. Equally, a compliance alert does not automatically establish wrongdoing. Professional judgment requires documented facts, proportionate escalation, legal awareness, confidentiality, and fair treatment.

Challenges, Limitations and Common Errors

A major weakness in compliance programmes is a paper-based approach: policies exist, but staff cannot apply them to real transactions. Other common failures include treating KYC as a one-time event, relying uncritically on intermediary assurances, failing to identify control through complex structures, using outdated sanctions lists, and confusing a name match with a confirmed sanctions violation.

Data quality is another limitation. Incomplete corporate registers, transliteration differences, common names, inconsistent addresses, and unreliable beneficial-owner declarations can produce both missed risks and excessive alerts. Excessive alert volumes may overwhelm investigators and encourage superficial closure. Conversely, an overaggressive approach may cause de-risking, unfair exclusion, or unnecessary delay of legitimate claims.

Global groups face conflicts between group policy and local law. A central compliance team may seek broad access to customer files, while local privacy or secrecy law restricts transfer. Such conflicts require legal analysis and governance, not informal workarounds. Staff training must also be role-specific: claims handlers, underwriters, brokers, investigators, IT personnel, and senior managers encounter different risks.

Ethical and Professional Considerations

Compliance decisions affect access to insurance, payment of legitimate claims, reputation, and sometimes personal safety. Organisations should apply controls consistently, provide escalation and review mechanisms, protect confidential reporting, and avoid decisions based on stereotypes. Privacy is not an obstacle to ethical compliance; it is part of responsible compliance.

Professional integrity requires employees to resist commercial pressure, disclose conflicts, preserve evidence, and document difficult decisions. Senior managers must not establish sales targets or relationship incentives that implicitly encourage staff to bypass controls. A mature culture treats escalation as a control success rather than a business failure.

Current Developments and Best Practices

Financial-crime regulation increasingly emphasises beneficial-ownership transparency, virtual assets and digital payments, sanctions evasion, proliferation financing, third-party risk, and accountability for senior management. Remote onboarding and artificial intelligence are expanding, while regulators are demanding stronger model governance, explainability, cybersecurity, and evidence that risk assessments influence actual controls.

A practical best-practice programme should:

• maintain an enterprise-wide, documented risk assessment;
• integrate AML, sanctions, anti-bribery, fraud, privacy, and cybersecurity governance;
• refresh customer, ownership, and intermediary information according to risk;
• screen at meaningful lifecycle events, not only at onboarding;
• use clear escalation and case-management procedures;
• test automated systems, data quality, and vendor performance;
• retain records securely for the legally required period;
• train staff through realistic insurance scenarios;
• measure outcomes rather than merely counting activities; and
• conduct independent testing, remediate weaknesses, and report material issues to the board.

Chapter Summary

Insurance firms face financial-crime risks through customers, beneficiaries, claimants, intermediaries, reinsurers, suppliers, and payment channels. AML and CFT controls require a risk-based approach, effective KYC, beneficial-owner identification, ongoing monitoring, enhanced due diligence where appropriate, and confidential suspicious-transaction reporting. Sanctions compliance is a separate but related discipline requiring screening, alert resolution, payment controls, and attention to evasion techniques. Anti-bribery controls must extend to intermediaries and third parties.

These obligations depend on data, making privacy, cybersecurity, retention, access control, and cross-border transfer governance essential. Technology can improve detection but requires validation, human oversight, and protection against bias and poor data. Effective compliance is an organisational responsibility supported by board oversight, independent assurance, trained personnel, documented decisions, and ethical judgment. The central professional task is to prevent illicit activity without abandoning proportionality, fairness, confidentiality, or legitimate insurance service.

Key Terms

AML: Measures designed to prevent and detect the laundering of criminal proceeds.

Beneficial owner: The natural person who ultimately owns or controls a customer or transaction.

CDD: Procedures for identifying, verifying, understanding, and monitoring a customer.

CFT: Measures aimed at preventing terrorist financing.

EDD: Additional due diligence applied to higher-risk relationships or transactions.

KYC: The process of knowing and verifying a customer and understanding the relationship.

PEP: A person entrusted with a prominent public function, together with relevant associated persons under applicable law.

Sanctions: Legal restrictions imposed against specified persons, entities, activities, goods, or jurisdictions.

Sanctions screening: Comparing relevant parties or transactions with sanctions lists and restrictions.

Suspicious-transaction report: A confidential report submitted to a competent authority where legally defined suspicion exists.

Source of funds: The origin of money used in a particular transaction.

Source of wealth: The origin of a customer’s overall accumulated wealth.

Tipping off: Unlawfully informing a person that a suspicious-activity report or investigation is being made.

Risk-based approach: Allocating controls and resources according to assessed risk.

Third-party risk: Risk arising from agents, brokers, vendors, or other external providers.

Data minimisation: Collecting and using no more personal data than necessary for a legitimate purpose.

Data localisation: Legal or organisational requirements concerning where data is stored or processed.

Pseudonymisation: Processing data so that direct identification requires additional separately protected information.

Model governance: Oversight ensuring that analytical or automated models are appropriate, tested, explainable, and monitored.

Review Questions

Short Answer Questions

1. Distinguish money laundering from terrorist financing.

2. What is the difference between identification and verification in KYC?

3. Why is beneficial-owner identification important for corporate customers?

4. How does sanctions screening differ from AML transaction monitoring?

5. State three data-governance principles relevant to compliance records.

Long Answer Questions

1. Explain how an insurer can apply a risk-based AML/CFT framework across the policy lifecycle.

2. Discuss the relationship between sanctions compliance and claims payment controls.

3. Examine the role of intermediaries in creating AML, anti-bribery, and sanctions risks.

4. Analyse the challenges of using artificial intelligence in financial-crime monitoring.

5. Explain how an insurance group should govern cross-border transfers of compliance data.

Analytical / Application Questions

1. A policyholder requests that a large surrender payment be made to an unrelated company in another jurisdiction. Analyse the risks and recommend a response.

2. A sanctions-screening system generates thousands of false positives because many customers share common names. Design a proportionate remediation plan.

3. A broker refuses to disclose the beneficial owner of a corporate client but assures the insurer that the client is reputable. Decide whether the relationship should proceed and justify your answer.

22. Multiple Choice Questions with Answers

Question 1

Which feature most clearly indicates the need for enhanced due diligence?

A. A transparent customer with a routine low-value policy

B. A complex ownership structure combined with unexplained third-party payments

C. A customer who updates a postal address through a verified channel

D. A standard renewal with no change in risk factors

Correct Answer: B. A complex ownership structure combined with unexplained third-party payments

Question 2

What is the principal distinction between AML monitoring and sanctions screening?

A. AML applies only to life insurance, while sanctions apply only to property insurance

B. AML concerns criminal proceeds or financing risks, while sanctions concern prohibited persons, activities, or jurisdictions

C. AML is voluntary, while sanctions screening is always optional

D. AML examines data security, while sanctions screening examines only claims

Correct Answer: B. AML concerns criminal proceeds or financing risks, while sanctions concern prohibited persons, activities, or jurisdictions

Question 3

A beneficial owner is best described as:

A. The employee who processes a policy application

B. The broker who introduced the customer

C. The natural person who ultimately owns or controls the customer

D. Any director whose name appears on a company document

Correct Answer: C. The natural person who ultimately owns or controls the customer

Question 4

A potential sanctions name match should initially be treated as:

A. Proof that the transaction is illegal

B. An alert requiring resolution using additional identifiers

C. A matter that can be ignored if the premium is small

D. A reason to disclose the alert immediately to the customer

Correct Answer: B. An alert requiring resolution using additional identifiers

Question 5

Which action best reflects a risk-based approach?

A. Applying identical controls regardless of customer or transaction risk

B. Ignoring all low-value transactions

C. Allocating stronger controls and more frequent review to higher-risk relationships

D. Accepting intermediary assurances without documentation

Correct Answer: C. Allocating stronger controls and more frequent review to higher-risk relationships

Question 6

Why can a claim be valid while its proposed payment instruction still requires investigation?

A. Claims are never subject to sanctions controls

B. Payment to an unrelated or prohibited recipient may create separate legal and financial-crime risks

C. A valid claim automatically proves beneficial ownership

D. Privacy law requires payment to any nominated recipient

Correct Answer: B. Payment to an unrelated or prohibited recipient may create separate legal and financial-crime risks

Question 7

Which data-governance principle limits the collection of compliance information?

A. Data minimisation

B. Unlimited retention

C. Unrestricted onward transfer

D. Anonymous access

Correct Answer: A. Data minimisation

Question 8

What is a significant risk of poorly governed automated transaction monitoring?

A. It eliminates the need for human judgment

B. It can produce excessive false positives or reproduce bias in source data

C. It prevents all data breaches

D. It guarantees correct beneficial-owner identification

Correct Answer: B. It can produce excessive false positives or reproduce bias in source data

Question 9

Which control is most directly relevant to an intermediary’s anti-bribery risk?

A. Transparent remuneration, conflict declarations, and third-party due diligence

B. Removing all approval requirements for commissions

C. Paying commissions through untraceable accounts

D. Allowing gifts without recording them

Correct Answer: A. Transparent remuneration, conflict declarations, and third-party due diligence

Question 10

Before transferring compliance data to another country, an insurer should primarily:

A. Transfer all records first and assess legality later

B. Determine the legal basis, applicable transfer mechanism, safeguards, and recipient responsibilities

C. Assume group companies are exempt from privacy law

D. Delete all audit records to reduce risk

Correct Answer: B. Determine the legal basis, applicable transfer mechanism, safeguards, and recipient responsibilities