The Office of the Commissioner of Insurance (“OCI”) recently published a Guidance Note on Outsourcing (“GN14”) to regulate the risks created by the outsourcing of business activities by insurers. As stated in the preamble to GN14, the outsourcing of business activities (including customer-related services and back-office activities) is becoming increasingly popular with insurers and, whilst such an arrangement may bring cost and other benefits, the view of the OCI is that it may also increase an insurer’s risk profile and its dependence on other parties.
GN14 will come into operation on 1 January 2013. It applies to all insurers in Hong Kong, and covers the outsourcing of services to service providers, whether third parties (including group companies) or other business units of the same company, such as foreign branches and head offices. For insurers incorporated or based in Hong Kong, GN14 will apply to all outsourcing arrangements. For other insurers, GN14 will apply only to those outsourcing arrangements relating to their operations in Hong Kong.
Under GN14, insurers must notify the Insurance Authority before entering into a material outsourcing arrangement (or significantly varying an existing one) and provide the regulator with information and a detailed description in relation to the outsourcing arrangement in order to show proper compliance with GN14.
GN14 sets out the essential issues which an insurer should take into account in formulating and monitoring its outsourcing arrangements. These are:
- developing an outsourcing policy for approval by the Board;
- developing a materiality assessment framework;
- conducting a comprehensive risk assessment;
- exercising due diligence and care in selecting a service provider;
- undertaking outsourcing arrangements in the form of a legally binding legal agreement;
- ensuring that legal and statutory requirements regarding customer confidentiality are complied with;
- dedicating sufficient and appropriate resources to monitoring and controlling the outsourcing arrangements;
- putting in place contingency plans;
- being particularly vigilant in relation to overseas outsourcing (e.g. country risk); and
- controlling and monitoring the sub-contracting of outsourcing arrangements by service providers.
As regards transitional arrangements for insurers with ongoing material outsourcing arrangements (not expiring before 31 March 2013), they will be required to furnish the Insurance Authority with the information prescribed by GN14 within 30 days of the commencement date of 1 January 2013. All insurers should also conduct materiality and risk assessments on existing outsourcing arrangements within the first three months of 2013. If existing outsourcing arrangements do not comply with GN14, then insurers have until the end of 2013 to bring them into line.
Given that GN14 will come into force very soon, insurers should start making preparations to ensure compliance (e.g. by ensuring that appropriate policies are in place and staff are available and qualified to manage the outsourcing arrangements). As GN14 seeks to set out what is already perceived as international good practice, it may be that insurers will not have to make too many changes to their existing outsourcing arrangements; however, in light of the new supervisory approach of the Insurance Authority, it will be increasingly important for policies, processes and arrangements relating to outsourcing to be clearly documented.