The Central Bank of China and other 9 Ministerial departments jointly issued the “Guiding Opinions on Promoting the Healthy Development of internet Finance” on 18th July 2015 ，establishing the principle of supervision over internet finance as being “legitimate, moderate, categorized, coordinated and creative”. Just days after that, the China Insurance Regulatory Commission (hereinafter “CIRC”) also released the “Interim Measures for the Supervision over internet Insurance Business” (hereinafter “the Measures”) and established its supervision principle. The Measures applies to the internet insurance business which means the business of concluding insurance contracts and providing insurance services by insurance institutions via self-operated network platforms, third-party network platforms and other methods by relying on the internet, mobile communication and other technologies, and it also applies to the administration over the sales of insurance products by insurance institutions through channels such as instant massagers, application software, social platforms and other channels. Thus, it is important to learn how to interpret the Measures and the following points shall attract our attention.
I. THE THRESHOLDS FOR PRACTICING INTERNET INSURANCE BUSINESS
In the Measures，the entities that are permitted to practice internet insurance business are mainly categorized into three groups: insurance companies, professional Insurance intermediaries and third party online platform.
1. Permitted insurance institutions are limited to the business platforms established in the head offices level.
The Measures requires insurance companies to build centralized business platforms and establish processing procedures at the level of the head offices of the insurance companies in order to concentrate the operation and administration of internet insurance. Any individual, non-insurance subsidiary or asset management company shall not be allowed to engage into internet insurance business in their own name. Meanwhile, branches of insurance companies are also not qualified to conduct internet insurance on their own but could perform some specific works including issuance of insurance policies, settlement of claims, and customer services under the guidance and administration of the head office. Any insurance companies that arbitrarily authorize any branch to conduct the internet insurance business shall be commanded by the CIRC to make rectification; if the circumstance is serious, the CIRC may impose administrative punishment according to the laws.
Self-operated network platforms, through which insurance institutions may conduct internet insurance business, shall meet the following conditions:
(1) they shall have the information management system supporting the operation of the internet insurance business to realize real-time seamless connection with the core business system of insurance institutions, and ensure effective separation from any other internal application system of insurance institutions so as to avoid the transmission and spread of risks related to information safety inside and outside insurance institutions;
(2) they shall have perfect internet information security management systems such as firewall, intrusion detection, data encryption, disaster recovery and etc.;
(3) they shall have a license issued by a competent department of internet industry or have completed the website filed with a competent department of internet industry, and access locations of their websites shall be within the territory of People's Republic of China;
(4) they shall have special management departments of internet insurance business equipped with corresponding professionals;
(5) they shall have sound management system and operation procedures for the internet insurance business;
(6) the sales personnel of the internet insurance business shall comply with relevant provisions of the CIRC; and (7) they shall meet other conditions stipulated by the CIRC.
It should be noticeable that the security issue of self-operated network platforms is specifically addressed in the above conditions.
2. The professional insurance intermediaries shall be limited to those intermediaries who are permitted to practice in the national level.
It is defined in the Measures that professional insurance intermediaries refer to the professional insurance agencies, insurance broker companies and public assessment institutions that can operate in the areas not limited to provinces, autonomous regions or municipalities directly under the Central Government of the PRC (“Central Government”) where they are registered，so neither regional insurance intermediaries nor concurrent insurance agencies are on the white list. Besides the above, individual staffs in professional insurance intermediaries shall not operate internet insurance business in their own names. Professional insurance intermediaries shall, when conducting the internet insurance business, follow the same rules with insurance companies.
3. Third-party network platforms shall be limited to provide internet technology support auxiliary services, otherwise it shall be required to obtain a qualification to operate insurance business.
Under the Measures, third-party network platforms refer to the network platforms (excluding self-operated network platforms) providing auxiliary services for insurance consumers and insurance institutions during internet insurance business activities. Therefore before it obtains the required qualification, it could only provide auxiliary services for insurance consumers and insurance institutions and are restrained from directly getting involved in the internet insurance business such as underwriting, settlement of claims, cancellation of insurance, complaints and customer services except it has obtained corresponding qualifications for insurance business operations. Accordingly, the premiums paid by the policy holder should not enter third-party network platforms’ bank accounts but shall be directly transferred to specific premium income accounts of insurance institutions (including the specific premium income accounts opened by insurance institutions on third-party network platforms) and third-party network platforms shall not collect premiums and then transfer the premiums to insurance institutions.
Similar with self-operated network platforms, certain conditions shall be met for third-party network platforms to conduct internet insurance business, such as the required license for internet operation, sound internet operation system and information safety system, etc. If a third-party network platform does not meet the aforesaid conditions, insurance institutions shall not cooperate with it to conduct internet insurance business. In accordance with the above, third-party network platforms shall be qualified in terms of information security, obtaining and supplying information according to the laws as well as operating period and compliance requirements. Newly-established third-party network platforms not qualified in the above respects may not be allowed to operate internet insurance businesses. Insurance institutions are prohibited from cooperating with these new unqualified third-party network platforms, otherwise they may face administrative punishment.
II. SELF-DETERMINATION ON SELECTING INSURANCE PRODUCTS THAT ARE SUITABLE FOR INTERNET INSURANCE BUSINESS
The Measures gives the right of self-determination on selecting suitable insurance products to insurance institutions, who shall scientifically evaluate their own risk management and control capacity and customer service capacity, and rationally determine and choose insurance products and sales scope suitable for internet operations. If they cannot guarantee customer service quality or risk management and control, they shall make adjustments in a timely manner. The CIRC does not require the “insurance product for internet business” to file separately with the CIRC, which shows the attitude of the CIRC that internet insurance products and traditional insurance products are of no difference in essence. Therefore, the CIRC adopts consistent supervision methods towards internet insurance products compared to the traditional ones, and implement the administration on exit through on-going process and afterwards supervision so as to enhance the supervision over internet insurance business.
According to the Measures, certain types of insurance which may affect the rapid and convenient provision of insurance services to consumers due to factors such as on-site verification, exploration and survey are deemed as insurance types unsuitable for internet sales. On the other hand, for the products suitable for internet sales, their sales could break the boundary limitation and expand operation areas to those provinces, autonomous regions or municipalities directly under the Central Government where even no branches of insurance institutions are established. These products include:
(1) personal accident insurance, term life insurance and ordinary type of whole life insurance;
(2) household property insurance, liability insurance, credit insurance and guarantee insurance with the individual as the policy holder or the insured;
(3) property insurance business with the whole-process services including sales, underwriting and settlement of claims which can be performed independently and completely via the internet; and
(4) other insurance types stipulated by the CIRC.
Please note, health insurance, life insurance with investment functions, and property insurance for corporations and other entities are not within the above product scope which could break the operation boundary limitation.
III.THE INTERNET PLATFORMS’ UNDERTAKING OF THE RESPONSIBILITY TO ENSURE INFORMATION SECURITY
Internet insurance business platform may, during the operations, gain and preserve a great amount of information related to the internet insurance business. The Measures require that insurance institutions shall completely record and preserve the transaction information of internet insurance business. The transaction information shall at least include product advertisement materials and text versions for sales, daily records of sales and services and operation tracks of policyholders. Third-party internet platforms are also under the obligation to assist and support insurance institutions to obtain the above information. All these obligations raise great challenges to the internet platforms on how to handle their transaction information security work.
The Measures expressively requires internet insurance business operating entities to ensure the safety of internet platform and demand insurance institutions to strengthen the security management of information, including but not limited to:
Security management of business data: Insurance institutions shall strengthen the security management of business data, and take technological measures such as isolation through firewalls, data backup and fault recovery to ensure the safety, authenticity, accuracy and completeness of transaction data and information relating to the internet insurance business. Insurance institutions shall prevent illegal or criminal activities conducted by fake websites, applications and so on in connection with internet insurance, check the reliability of external linkages on webpages, and open special channels to receive reports from the public. Once finding any problems, they shall take precautionary measures immediately and report to the CIRC at the same time.
Confidentiality: Insurance institutions shall reinforce the customer information management to ensure the authenticity and effectiveness of materials of customers and the safety and legality of collection, processing and use of the information. Insurance institutions shall strictly keep the confidentiality of customer information collected in the course of conducting internet insurance business, and shall not disclose it. Without the consent of customers, they shall not use the customer information for any purposes other than the provision of relevant services. Within 24 hours after receipt of insurance application, third-party network platforms shall provide complete information of the insured to related insurance institutions, including but not limited to the name, identity type, identity number, contact information and bank account of the insurance applicants. Unless otherwise specified in the laws and regulations, insurance institutions and third-party network platforms shall not disclose relevant information to any other institution or individual.
Emergency action plan：Insurance companies shall formulate emergency action plans, and properly deal with the suspension of internet insurance business operation caused by any emergency, force majeure, etc. Where an insurance institution suspends the operation of internet insurance business, it shall promptly announce to the public about the suspension and make explanations on relevant reasons and subsequent solutions at a noticeable position on the home page of its self-operated network platform or relevant third-party network platform.
IV. AVOIDING MISLEADING ADVERTISEMENT IN INTERNET INSURANCE SALES
As misleading advertisement in internet insurance business are common, the Measures demand that in conducting internet insurance business, insurance institutions shall not make any misstatement, partially publicize or exaggerate previous achievements, illegally promise earnings or undertake losses, or provide any other misleading information. Certain information is required to be disclosed on the eye-catching position of the internet platform and internet web pages regarding insurance policy sales. Third party internet platform specific information disclosure: Third-party network platforms shall disclose the information of cooperative insurance institutions and their own filing information at the noticeable position, and point out that the insurance services are provided by insurance institutions.
Insurance companies shall uniformly prepare and authorize the issue of relevant information on insurance products on internet network platforms, and ensure the legitimacy, authenticity, accuracy and completeness of such information. If a third-party network platform provides advertisement services for an insurance institution, the insurance company concerned shall review the advertisement contents to ensure that such contents conform to relevant provisions of the regulations, and assume corresponding responsibility for the authenticity, accuracy and compliance of the advertisement contents. Customers could, via the official website of insurance institutions, find the names and URLs, the information on the internet insurance products, methods of customer services and consumer complaints. Customers could also find the above information via special column for the information disclosure of internet insurance business established by the Insurance Association of China and official website of the CIRC.
V. STRENGTHENING THE SUPERVISION OVER INTERNET INSURANCE
In addition to the above, the Measures also strengthen the supervision of internet insurance business from the perspectives below:
Anti-money laundering：Insurance institutions shall establish and improve the customer identification system, reinforce the monitoring and reporting of large-amount transactions and suspicious transactions, and strictly observe relevant anti-money laundering provisions. Insurance institutions shall require policyholders to use their own accounts to pay premiums in principle, and the surrender value and insurance indemnity shall be paid to the bank accounts of policyholders, the insured or the beneficiary. As for personal insurance with the term more than one year, the insurance institution should verify the authenticity of policyholder’s bank account to ensure the premium payer and the indemnity payee is the policyholder himself/herself.
Anti-fraud: the Measures require insurance institutions to build a sound anti-fraud system for internet insurance and strengthen the monitoring and reporting of internet insurance fraud. Third-party platform should assist the insurance institutions in the anti-fraud investigation.
Supervision and investigation of the CIRC: The CIRC and its local agencies are authorized to, according to the laws, regulations and relevant supervision provisions, monitor the daily work and inspect the internet insurance operations of insurance institutions on-site, and insurance institutions and third-party network platforms shall cooperate.
Self-discipline under the Insurance Association of China: The Insurance Association of China shall conduct the self-discipline administration over the internet insurance according to the laws, regulations and the relevant rules of the CIRC.
The Measures establish the rules governing internet insurance business in China and help to regulate the issues arising from the blooming internet insurance industry such as sales behaviors on the edge of violating the supervision rules, out-of-date service system and insufficient control of risks. Meanwhile, it may also reshuffle the newly flourishing market and block out a great number of unqualified internet insurance platforms via a black list, where the listed entities will be forbidden to cooperate with others and be forced to exit the market. Thus only internet insurance entities who can both meet the compliance requirements under the Measures and other related rules and the demands of the customers, may gain developments in the long term and realize the real value of internet insurance business.