5. Insurance Institutions, Licensing and Distribution

Introduction and Context

Insurance is not merely a contract between an insurer and a policyholder. It is an institutional system involving risk-bearing enterprises, intermediaries, technology providers, financial institutions, regulators and service partners. The legal quality of this system depends on whether each participant is properly authorised, competently managed, adequately supervised and held accountable for the consequences of its conduct.

Insurance institutions perform different economic and legal functions. Insurers underwrite risk and promise performance in the future. Brokers represent or advise customers, depending on their mandate. Agents generally act for insurers in soliciting and arranging business. Banks may distribute insurance products as corporate partners. Aggregators provide comparison and information services. Managing general agents may perform delegated underwriting and administrative functions. Digital platforms can combine distribution, payment, customer service and claims interfaces. These roles may overlap operationally, but the legal consequences of each role are not identical.

This chapter examines the legal status, licensing requirements, duties, liabilities and governance concerns associated with major insurance institutions and distribution channels. It adopts a principles-based approach because the precise regulatory rules differ across jurisdictions. Students should therefore read the chapter together with the insurance legislation, regulations, licensing rules and supervisory circulars applicable in the relevant country.

Learning Objectives

After studying this chapter, the student should be able to:

1. distinguish insurers from the principal categories of insurance intermediaries and service providers;

2. explain the purposes and stages of licensing and authorisation;

3. analyse the duties and liabilities of insurers, brokers, agents and other distributors;

4. evaluate remuneration structures, conflicts of interest and disclosure obligations;

5. assess outsourcing, delegated authority and digital distribution risks;

6. apply governance and compliance principles to practical insurance scenarios; and

7. identify emerging regulatory issues involving platforms, data, automation and artificial intelligence.

1. The Institutional Architecture of Insurance

1.1 Insurers as regulated risk-bearing institutions

An insurer is an entity authorised to accept insurance risks and to create legally enforceable obligations to policyholders or beneficiaries. Its distinctive function is risk pooling: premiums collected from many policyholders are used, subject to expenses and investment arrangements, to meet the claims of those who suffer insured events. This function creates a substantial time gap between receipt of premium and payment of claims. Regulation is consequently concerned with solvency, liquidity, reserving, investment, governance and fair treatment.

The insurer’s legal personality may be that of a company, mutual, cooperative or another permitted form. Regardless of form, authorisation normally specifies the classes of insurance that may be written, the territories in which business may be conducted and any conditions imposed by the regulator. An insurer cannot ordinarily avoid regulatory responsibility by conducting business through an intermediary or technology provider.

1.2 Intermediaries and auxiliary institutions

An intermediary facilitates insurance business without necessarily bearing the insured risk. The principal categories are:

• Agents, who generally represent an insurer and solicit, arrange or service policies on its behalf.
• Brokers, who commonly act for clients seeking insurance, although their precise duties depend on the mandate and law.
• Corporate agents and bancassurance partners, which distribute insurance through an institutional relationship with one or more insurers.
• Insurance aggregators, which present product or price information and may generate leads or facilitate transactions.
• Managing general agents, which receive delegated authority from insurers to perform functions such as underwriting, pricing, policy administration or claims handling.
• Digital platforms, which use websites, applications, APIs or embedded interfaces to market, compare, sell or service insurance.

A service provider may not be an intermediary in the formal statutory sense but may still create material regulatory risk. Examples include outsourced claims administrators, call centres, cloud providers, medical networks, payment processors, surveyors and data analytics firms.

1.3 Functional classification rather than labels

Legal analysis should focus on what an institution actually does. A business calling itself a “technology company” may be performing regulated solicitation if it recommends a product, collects proposal information or influences a customer’s purchase. Similarly, a broker may assume insurer-like responsibilities if it holds client money, issues documents or exercises delegated authority. Substance should prevail over commercial labels.

2. Licensing as a System of Market Access and Control

Licensing protects policyholders by preventing unsuitable persons from undertaking insurance business or influencing insurance decisions without accountability. It also enables the regulator to identify market participants, impose conditions, inspect records and apply sanctions.

2.1 Authorisation of insurers

An application for an insurer’s licence commonly requires information concerning:

• ownership and controlling shareholders;
• capital and financial resources;
• business plan and proposed classes of insurance;
• actuarial and risk-management arrangements;
• governance structure and fitness of directors and senior managers;
• reinsurance programme;
• information systems and internal controls; and
• arrangements for complaints, claims and policyholder protection.

The regulator may conduct a fit-and-proper assessment of directors, officers and significant owners. Approval is usually conditional and continuing. A licensed insurer may be required to obtain additional approval before entering a new class of business, changing control, transferring a portfolio or opening certain distribution channels.

2.2 Licensing of intermediaries

Intermediary licensing may be entity-based, individual-based or both. Typical requirements include professional qualifications, examinations, continuing education, financial soundness, professional indemnity insurance, record-keeping and compliance systems. The intermediary may also have to disclose its licence number, capacity, remuneration and relationship with insurers.

Licensing is not a substitute for supervision. A licensed intermediary can still breach duties through misrepresentation, unauthorised advice, mishandling of premiums, inadequate disclosure or poor record retention. Conversely, an institution may remain responsible for agents and representatives even where each individual holds a separate certificate or appointment.

2.3 Continuing conditions and enforcement

Regulatory obligations continue after authorisation. They may include periodic returns, solvency reporting, audit, actuarial certification, market-conduct reporting, maintenance of registers and notification of material changes. Common enforcement tools include warnings, directions, administrative penalties, licence conditions, suspension, cancellation, restitution and referral for criminal proceedings.

A sound compliance programme should link each legal obligation to an accountable officer, a documented procedure, evidence of performance and an escalation mechanism. “Compliance” should not be reduced to obtaining a licence at the beginning of the business relationship.

3. Duties and Liabilities of the Principal Participants

3.1 Insurers

The insurer’s primary duty is to perform the insurance contract according to its terms and applicable law. This includes evaluating claims fairly, communicating material decisions, paying valid claims within required periods and giving reasons for repudiation where required. Contractual rights such as exclusions and cancellation provisions must be exercised consistently with statutory standards, good faith obligations and rules against unfair treatment.

Insurers also owe regulatory and organisational duties. They must maintain adequate capital, technical reserves, reinsurance and risk controls. They must ensure that products are appropriately designed, marketed and monitored. Product governance requires attention to the target market, exclusions, affordability, distribution method and foreseeable customer outcomes.

An insurer may incur liability for its own acts and omissions, for the conduct of employees and, depending on agency principles and statutory provisions, for agents acting within actual or apparent authority. A disclaimer printed on a proposal form will not necessarily defeat a customer’s reasonable reliance on an authorised representative.

3.2 Agents

An agent generally owes duties of obedience, loyalty, care and good faith to the appointing insurer. The agent must use only approved product materials, provide accurate information, collect proposal details carefully, avoid unauthorised promises and remit premiums in accordance with procedure. An agent may also owe direct duties to the customer, especially where legislation imposes fair-dealing, disclosure or advice obligations.

An agent who conceals material facts, alters proposal information, fabricates signatures or misappropriates premium may create personal civil or criminal exposure. The insurer may also face consequences if the conduct occurred within the scope of the agency or if its controls and supervision were inadequate.

3.3 Brokers

A broker’s duties depend on the nature of the engagement. A broker acting for a client should identify the client’s needs, obtain relevant information, search or assess suitable options within the agreed market, explain material terms and disclose limitations. A broker must not present itself as independent if it is tied to particular insurers or receives incentives that materially affect recommendations.

Client money is a high-risk area. Premiums collected for insurers, refunds due to customers and brokerage income should be separately identified and handled under applicable trust, segregation or accounting rules. A broker may be liable for failing to place cover, failing to communicate a policy condition, providing negligent advice or allowing a policy to lapse through administrative error.

3.4 Bancassurance partners and corporate distributors

Bancassurance uses a bank or financial institution’s customer relationships, premises, staff and digital channels to distribute insurance. The bank may be an agent, corporate intermediary or platform, but it does not automatically become the insurer merely because the product is sold through its branch or application.

Risks include tying insurance to credit, using banking data without appropriate permission, inadequate explanation of exclusions and sales pressure created by performance targets. Governance should separate legitimate insurance advice from lending decisions, require customer consent, monitor complaints and prevent unsuitable cross-selling.

3.5 Aggregators

An aggregator may compare premiums, benefits or features and direct a customer to an insurer or intermediary. Its legal status depends on whether it merely displays information or actively recommends, solicits, negotiates and concludes insurance contracts. Accuracy is critical: ranking algorithms, sponsored placement and incomplete comparisons can mislead consumers.

An aggregator should identify participating insurers, explain the basis of comparisons, disclose commercial relationships and ensure that displayed information is current. It should retain evidence of quotations, customer consent and communications. The platform may be liable for negligent misstatement, misleading advertising, data breaches or unauthorised distribution even if the policy contract is ultimately issued by an insurer.

3.6 Managing general agents

A managing general agent (MGA) operates under delegated authority from an insurer. The delegation may include underwriting within specified limits, pricing, policy issuance, premium collection, claims administration or appointment of sub-intermediaries. The insurer retains ultimate responsibility for the risk and must exercise meaningful oversight.

A proper delegation agreement should define authority limits, referral thresholds, underwriting guidelines, reporting, audit rights, remuneration, complaints handling, data access, termination and treatment of outstanding claims. An MGA should not be allowed to approve risks outside its competence or to alter controls merely because it has commercial expertise. Delegation without supervision is not effective governance.

3.7 Digital platforms and embedded insurance

Digital distribution can reduce transaction costs and improve access, but it also changes how advice, consent and disclosure occur. A platform may use pre-selected options, default settings, behavioural prompts and automated recommendations. These design choices can influence consumer decisions as strongly as an individual salesperson.

Legal concerns include electronic consent, authentication, accessibility, cybersecurity, data protection, algorithmic bias, auditability and continuity of service. Digital convenience does not remove the duties of suitability, fair presentation or complaint resolution. Firms should provide understandable disclosures at the point of decision rather than relying solely on lengthy policy documents.

4. Remuneration, Conflicts of Interest and Customer Fairness

Remuneration may consist of commission, brokerage, fees, bonuses, profit-sharing, renewal income or non-cash incentives. It can support distribution, but it may also encourage excessive sales, replacement of existing policies, under-disclosure of exclusions or selection of products that produce higher compensation.

Conflict management begins with identification. A firm should ask who pays the distributor, whether remuneration varies by product, whether targets influence advice, whether the distributor owns or is owned by an insurer, and whether the representative has a personal interest in the transaction. Disclosure is important but may not cure every conflict. Where a conflict cannot be effectively managed, the appropriate response may be to avoid the transaction or restrict the representative’s role.

A useful governance framework contains four stages:

1. Identify actual, potential and perceived conflicts.

2. Assess their likelihood and effect on customer outcomes.

3. Control them through separation of duties, remuneration limits, approval procedures and supervision.

4. Disclose and monitor residual conflicts and test outcomes through complaints, cancellations and claims data.

Remuneration should be linked not merely to sales volume but also to persistency, suitability, service quality and customer outcomes. Clawback arrangements may discourage early replacement or mis-selling, but they should not unfairly penalise representatives for events beyond their control.

5. Outsourcing and Delegated Functions

Outsourcing occurs when a regulated institution appoints another party to perform a function that could otherwise be performed internally. It can provide specialist skills and scalability, but it does not transfer regulatory accountability. The insurer remains responsible for ensuring that outsourced activities comply with law and support policyholder protection.

Before outsourcing, management should assess the criticality of the function, provider competence, financial stability, information-security controls, subcontracting arrangements, geographic location, business continuity and exit feasibility. Contracts should include service levels, confidentiality, audit and inspection rights, incident reporting, regulatory access, data ownership, retention, termination and transition assistance.

Critical outsourcing requires stronger safeguards. Claims administration, underwriting engines, premium accounting and customer databases may directly affect policyholder rights. The insurer should maintain access to records, test continuity plans and conduct risk-based audits. A contract that prevents the regulator from accessing relevant information is generally unacceptable.

6. A Practical Compliance and Governance Framework

An institution can integrate licensing and distribution obligations through a three-lines model. The first line consists of business units that own risks and follow approved procedures. The second line includes compliance, legal and risk functions that establish standards and monitor conduct. The third line is internal audit, which provides independent assurance to the board or audit committee.

The framework should include:

• a current register of licences, appointments and delegated authorities;
• fit-and-proper checks and continuing competence requirements;
• product approval and target-market assessment;
• documented scripts, disclosures and advice standards;
• controls over premium and client-money handling;
• monitoring of sales quality, cancellations and complaints;
• vendor and outsourcing due diligence;
• cybersecurity and privacy controls;
• incident escalation and remediation; and
• board reporting on conduct and customer outcomes.

Data analytics can identify unusual cancellation rates, repeated policy replacements, regional anomalies, complaint clusters or claims decisions that differ significantly from comparable cases. Analytics should support, not replace, professional judgment. Automated systems require validation, human override, records of model changes and controls against discriminatory or inexplicable outcomes.

7. Illustrative Case Study: The Bancassurance Platform Failure

Background

Harbour Bank entered into an agreement with Meridian Life to distribute credit-linked life insurance through its branches and mobile application. Bank employees received sales-based incentives. The application displayed insurance as a pre-selected option during the loan process.

Situation and Problem

Many borrowers believed the insurance was compulsory for loan approval. Employees did not consistently explain exclusions, waiting periods or cancellation rights. A third-party call centre confirmed policies using a short script but did not verify whether customers understood the product. Complaints increased after claims were declined because death occurred within an excluded period.

Analysis

The problem was not limited to employee misconduct. The distribution design created a structural conflict: the bank’s lending objective and sales targets influenced the presentation of insurance. Pre-selection and inadequate explanations weakened meaningful consent. Meridian Life had delegated customer confirmation to the call centre but had not tested the quality of calls or reviewed complaint trends. Both institutions failed to treat the platform and the bank as material conduct risks.

Approach and Solution

The institutions suspended automatic enrolment and redesigned the customer journey. Insurance became an affirmative choice separate from the credit decision. The system displayed key exclusions and a short explanation before consent, followed by access to full policy terms. Incentives were changed from simple volume targets to balanced measures including persistency, complaint rates and quality assurance. Meridian established call monitoring, sample-based verification and escalation of unusual claims patterns. Harbour Bank created a separate compliance review for cross-selling and prohibited staff from representing insurance as mandatory unless legally required.

Outcome

The institutions provided remediation to affected customers according to the applicable legal and supervisory framework, strengthened disclosures and introduced periodic board reporting. The case illustrates that responsibility may be shared among insurer, distributor, platform operator and outsourced service provider. Contractual allocation of tasks does not eliminate the need for oversight.

Learning Points

The case demonstrates five principles: licensing must reflect actual activities; digital design can amount to sales conduct; conflicts cannot be cured by disclosure alone; outsourcing requires active supervision; and customer-outcome data should inform governance decisions.

8. Challenges, Risks and Professional Judgement

The first challenge is regulatory fragmentation. Insurance distribution may be governed by insurance, consumer-protection, privacy, electronic-transactions, competition and financial-crime rules. Institutions must map overlapping requirements rather than assuming that compliance with one regime is sufficient.

The second challenge is role ambiguity. A platform may be both a lead generator and a distributor; a broker may receive insurer incentives; an MGA may perform functions resembling those of an insurer. Ambiguity increases the risk of regulatory gaps and customer misunderstanding.

The third challenge is accountability in complex supply chains. Multiple subcontractors can make it difficult to identify who made a decision, who holds the record and who must compensate the customer. Responsibility matrices, audit trails and clear escalation arrangements are therefore essential.

Common mistakes include allowing an unlicensed entity to solicit business, using outdated product information, treating disclosure as a complete conflict solution, failing to reconcile premium accounts, delegating claims decisions without audit rights and relying on automated recommendations without testing their consequences.

Ethically, insurance institutions must recognise the information and bargaining imbalance between firms and customers. Fair treatment requires more than technical compliance. It requires intelligible communication, accessible service, respect for privacy, honest representation and timely correction of errors. Senior management and boards are responsible for establishing a culture in which revenue does not override lawful and fair customer outcomes.

9. Current Developments and Emerging Directions

Supervisors increasingly focus on conduct outcomes rather than only formal licensing. This involves examining whether products reach appropriate customers, whether claims are handled fairly and whether remuneration creates harmful incentives. Digital identity, open insurance data, embedded insurance and application programming interfaces are expanding the number of institutions involved in distribution.

Artificial intelligence is being used in lead generation, underwriting, fraud detection, service chatbots and claims triage. Its use requires governance over data quality, explainability, human review, security and responsibility for errors. An institution should be able to explain the basis of a significant customer decision and correct inaccurate data.

Climate-related risks, cyber incidents and reliance on cloud infrastructure are also changing institutional risk management. Regulators may expect scenario analysis, operational resilience and documented recovery arrangements. The central trend is clear: firms are increasingly judged not only by the existence of policies but by their ability to demonstrate effective control and fair results.

Best-Practice Checklist

A responsible insurance institution should:

• verify that every regulated activity is properly licensed;
• define each participant’s legal capacity and authority;
• maintain current fit-and-proper and competence records;
• approve products for identifiable target markets;
• disclose remuneration and manage conflicts proportionately;
• segregate and reconcile client money;
• monitor agents, brokers, MGAs and outsourced providers;
• preserve reliable records and audit trails;
• test digital journeys for comprehension and fairness;
• use analytics to detect poor outcomes without abandoning human oversight; and
• ensure that governance, complaints and remediation reach board level when risks are material.

Chapter Summary

Insurance institutions operate within a regulated network rather than as isolated businesses. Insurers bear risk and remain responsible for solvency, product governance, claims and oversight. Agents, brokers, bancassurance partners, aggregators, MGAs and digital platforms perform different functions, and their duties depend on legal status, contractual mandate and actual conduct. Licensing establishes market access and continuing supervision but does not remove the need for competent management. Remuneration and conflicts must be identified, controlled and monitored through customer-outcome measures. Outsourcing and delegated authority may improve efficiency, but accountability remains with the regulated institution. Digital distribution creates opportunities for access and automation while introducing risks involving consent, data, algorithms, cybersecurity and explainability. Effective governance therefore combines licensing controls, clear authority, professional competence, monitoring, auditability, fair treatment and active regulatory accountability.

Key Terms

Agent: A person or entity authorised to solicit or service insurance generally on behalf of an insurer.

Aggregator: A platform that compares, displays or facilitates access to insurance products from multiple providers.

Bancassurance: Distribution of insurance through a bank or other financial institution.

Broker: An intermediary commonly acting for a customer in arranging or advising on insurance.

Conduct risk: The risk that business practices produce unfair or harmful customer outcomes.

Delegated authority: Power granted by an insurer to another party to perform specified insurance functions.

Digital distribution: Marketing, sale or servicing of insurance through electronic platforms or interfaces.

Fit and proper: A regulatory assessment of a person’s integrity, competence, experience and financial soundness.

Insurer: An authorised risk-bearing institution that undertakes insurance obligations.

Managing general agent: A delegated intermediary authorised to perform functions such as underwriting or administration within defined limits.

Outsourcing: Use of an external provider to perform a function for a regulated institution.

Policyholder: The person or entity that enters into or owns an insurance policy.

Product governance: Processes for designing, approving, distributing and reviewing insurance products.

Remuneration: Commission, fees, bonuses or other compensation paid for insurance-related services.

Solvency: The capacity of an insurer to meet its present and future obligations.

Third-party administrator: An external provider performing administrative, claims or service functions.

Conflict of interest: A situation in which a personal or institutional interest may impair objective conduct.

Customer outcome: The practical effect of a firm’s product, advice, process or decision on the customer.

Review Questions

Short Answer Questions

1. Why is an insurer’s licence generally limited to specified classes of insurance?

2. Distinguish an agent from a broker.

3. What is delegated authority in the context of an MGA?

4. Why does outsourcing not remove an insurer’s regulatory accountability?

5. Identify two risks associated with bancassurance.

Long Answer Questions

1. Explain the legal and governance duties of an insurer from licensing through claims settlement.

2. Compare the duties and potential liabilities of agents, brokers and aggregators.

3. Discuss how remuneration can create conflicts of interest in insurance distribution.

4. Explain the principal controls required when an insurer outsources claims administration.

5. Analyse the regulatory challenges created by digital insurance platforms and embedded insurance.

Analytical / Application Questions

1. A comparison website ranks an insurer first because the insurer pays a higher placement fee, but the website describes the ranking as independent. Analyse the possible legal, conduct and governance issues.

2. An MGA approves risks outside its delegated limits, while the insurer reviews only annual reports. Determine the likely weaknesses in the delegation and oversight framework.

3. A bank employee tells a borrower that insurance is compulsory for loan approval and enters the policy through a pre-selected application box. Assess the responsibilities of the bank, insurer and platform designer, and propose corrective measures.

22. Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes an insurer from an intermediary?

A. The insurer bears the insured risk and undertakes policy obligations

B. The insurer always sells policies through branches

C. The insurer is never subject to licensing

D. The insurer can avoid liability for representatives

Correct Answer: A. The insurer bears the insured risk and undertakes policy obligations

Question 2

A business describes itself as a technology platform but recommends particular policies and collects proposal information. What is the most appropriate regulatory approach?

A. Assess its actual functions rather than relying on its label

B. Treat it as unregulated because it uses software

C. Treat it only as a cloud provider

D. Exempt it from conduct rules if the insurer issues the policy

Correct Answer: A. Assess its actual functions rather than relying on its label

Question 3

Which is a central purpose of intermediary licensing?

A. To prevent unsuitable persons from conducting or influencing regulated insurance business

B. To guarantee that every policy claim will be paid

C. To eliminate all competition among distributors

D. To transfer insurer solvency responsibility to intermediaries

Correct Answer: A. To prevent unsuitable persons from conducting or influencing regulated insurance business

Question 4

A broker receives higher commission for recommending one product but describes its advice as independent. The principal issue is:

A. A potential conflict of interest and misleading representation

B. A solvency calculation error by the insurer

C. A failure of electronic authentication only

D. A breach of reinsurance treaty terms

Correct Answer: A. A potential conflict of interest and misleading representation

Question 5

Which control is most appropriate for a managing general agent?

A. Defined underwriting limits, reporting duties and insurer audit rights

B. Unlimited authority with no referral thresholds

C. A prohibition on all written delegation agreements

D. Reliance solely on the MGA’s sales volume

Correct Answer: A. Defined underwriting limits, reporting duties and insurer audit rights

Question 6

Why does an insurer remain accountable for a material outsourced claims function?

A. Outsourcing transfers performance but not ultimate regulatory responsibility

B. Outsourcing automatically makes the provider an insurer

C. The insurer no longer has any relationship with policyholders

D. Claims functions are outside insurance regulation

Correct Answer: A. Outsourcing transfers performance but not ultimate regulatory responsibility

Question 7

Which design most directly reduces the risk that bancassurance customers believe insurance is compulsory?

A. Separating the insurance decision from the lending decision and requiring affirmative consent

B. Pre-selecting insurance in every loan application

C. Paying staff solely according to policy volume

D. Removing information about exclusions

Correct Answer: A. Separating the insurance decision from the lending decision and requiring affirmative consent

Question 8

An aggregator’s ranking is influenced by undisclosed payments from insurers. Which duty is most directly implicated?

A. Transparency about commercial relationships and the basis of comparison

B. Maintenance of insurer technical reserves

C. Reinsurance placement by the customer

D. Actuarial certification of every bank employee

Correct Answer: A. Transparency about commercial relationships and the basis of comparison

Question 9

Which statement best describes the role of analytics in distribution governance?

A. Analytics can identify unusual outcomes but should support, not replace, human oversight

B. Analytics removes the need for licensing

C. Analytics guarantees that recommendations are fair

D. Analytics permits firms to ignore complaints

Correct Answer: A. Analytics can identify unusual outcomes but should support, not replace, human oversight

Question 10

A digital claims system rejects a claim using an opaque model and provides no meaningful explanation. What is the strongest governance concern?

A. Lack of explainability, reviewability and accountability for the decision

B. The absence of a broker commission

C. The existence of a written policy document

D. The use of a licensed insurer

Correct Answer: A. Lack of explainability, reviewability and accountability for the decision