Insurance outsourcing arrangements in Luxembourg will require more attention

Silvia Bracaloni of Pinsent Masons in Luxembourg was commenting as new guidance is set to take effect that will be relevant to agreements put in place by insurers and reinsurers for the outsourcing of critical or important operational functions and activities on or after 1 November 2022.

Insurers and reinsurers are obliged to notify Luxembourg’s insurance regulator, the Commissariat aux Assurances (CAA), of their intention to outsource critical or important outsourcings under Luxembourg insurance law, as well as of any subsequent material developments with respect to those functions or activities. The CAA’s guidance, set out in a circular letter (7-page / 346KB PDF), clarifies its expectations of insurance or reinsurance undertakings when putting in place such outsourcing arrangements.

The CAA expects insurers and reinsurers to engage in “pre-outsourcing analysis” to, among other things, “assess whether the outsourcing agreement concerns an important or critical operational function or activity”. As part of that exercise, the CAA has encouraged the firms to consider how outsourcing would impact their business plan, on control and supervision, and on brand and public perception.

The CAA has developed a standardised notification form that insurers and reinsurers can fill in and submit to it, and its letter provides guidance on the type of information that the firms should include in their written notifications. The notification form has six sections requiring information to be provided on the insurance or reinsurance undertaking; the outsourced activity or function; general information about the service provider; due diligence in relation to the service provider; the outsourcing agreement with the service provider; and control and management of the outsourcing.

Insurers and reinsurers are also expected to make a series of declarations to the CAA in respect of their critical or important outsourcing agreement – including that the arrangements do not breach any law, that they have carried out due diligence on the service provider, and that they have put in place means by which to regularly monitor the service provider’s performance and results.

The CAA has explained that its letter does not apply to IT outsourcing or outsourcing chain that is cloud-based – in that situation, insurers and reinsurers must refer to separate guidance in circular letter 21/15 (15-page / 298KB PDF) and meet the requirements detailed in that.

Bracaloni said: “The CAA’s guidance does not introduce major changes to requirements insurers and reinsurers will already be familiar with under Luxembourg’s insurance law, EU regulations and guidelines issued by the European Insurance and Occupational Pensions Authority (EIOPA). However, insurers and reinsurers are required to better structure the information on their outsourcing arrangements when notifying the CAA.”

“The CAA intends to be put in a position to effectively and concretely verify the compliance of insurance and reinsurance companies with the conditions laid down by Luxembourg’s insurance law, such as in relation to governance, operational risk, regulatory oversight, and service levels,” she said.

“Insurance and reinsurance undertakings remain fully responsible for the activities discharged and it is also their responsibility to determine whether the outsourced function or activity is critical or important,” she said.