New insurance regs in Qatar: Clyde & Co’s take
The United Arab Emirates isn’t the only Gulf country in which insurance company executives are agonising over the exact meaning of new regulations affecting their industry. A year ago, the Qatar Central Bank introduced a raft of new regulations that effectively overhauled the regulatory requirements for Qatar’s insurance industry as well.
Below, in analysis posted the Clyde & Co website, Clyde & Co legal director Roger Phillips takes a look at how the new regulations are bedding down; the current position, and what can be expected going forward.
Qatar is now the third largest insurance market in the Gulf countries, and is continuing to benefit from the country’s energy and infrastructure projects – albeit that the recent fall in oil prices has seen some negative impact in the earlier significant growth levels.
For public confidence in, and protection of, Qatar’s economy, the growth and development of the Qatari insurance market needed to be matched with a robust and internationally aligned legal and regulatory framework.
New legal and regulatory framework
The first step was the implementation of Law No.13 of 2012 governing the Qatar Central Bank and Financial Institutions (known as the QCB Law), which has brought in oversight and responsibility for all financial services in Qatar to the Qatar Central Bank, and a framework for enhanced licensing, regulation and supervision of insurers and insurance businesses.
Following on from the QCB Law, the QCB is now in the process of implementing the necessary enabling rules and regulations for insurance businesses.
The QCB introduced the Executive Instructions for Insurers in April 2016, with extensive prudential and conduct of business requirements for insurers operating in or from Qatar.
Draft Instructions for Insurance Intermediaries, Representatives and Service Providers were also issued in October 2016, and these are expected to be approved as final within the next few months.
Scope of the law and regulations
The Insurer Regulations cover regulation of all insurance business including general insurance, long term insurance and health.
Under the regulations, no person can carry on insurance business in or from Qatar without a QCB licence, and only insurance business activities within the scope of the insurer’s licence can be undertaken.
Composite insurance is not allowed, unless the QCB gives special approval, although there are transitional rules to allow composites time to adapt to the new requirements.
Chapter 2 of the QCB Law provided the legal framework for regulations covering Insurance and Reinsurance.
Under Article 94, Qatar insurance and reinsurance companies licensed in the State must operate either as joint stock companies, local branches of foreign entities or representative offices.
Article 95 further details that “funds and properties located in the State or the liabilities resulting therefrom may not be insured abroad. Insurance brokerage shall not be sought in regard to such funds, properties, or liabilities except through the companies subject to the provisions of this law”.
The interpretation of “funds and properties located in the State” contemplates that some insurances, such as long term and medical insurances for local residents, can be insured by foreign insurers. The draft Intermediary and Service Provider Regulations also provide for intermediary sales of foreign insurances, permitted under Article 95, by licensed QCB intermediaries, subject to certain disclosures and conditions.
Changes in supervision and transitions
to the new regulatory requirements
As mentioned above, a year has now passed since Qatar’s new Insurer Regulations came into effect, and it is therefore an opportune time to review the implementation of this substantial change to regulation of Qatar’s insurance market.
When the Insurer Regulations came into force, insurers, previously licensed by Qatar’s Ministry of Economy and Commerce, responded to requests from the QCB for information and documentation as part of the initial process for the granting of new QCB licenses.
Those insurers previously licensed by the MEC have also been given some time to adapt to a substantially different regulatory regime.
The “transition periods” provide extended time to comply with certain rules and are set out in the Insurer Regulations.
These periods are linked to the date when the insurer was granted its new QCB licence.
A one year transition period is available to insurers from the issue of their new QCB licences, and provides a further one year for insurers to adapt to certain requirements.
This transition applies to the rules for establishment of internal systems of control covering prescribed internal controls and functions, policies, and procedures as well as compliance with remuneration, business continuity and outsourcing arrangements.
Furthermore, there is an additional one year to comply with the requirements for a risk management strategy, policies and procedures and related “Own Risk and Solvency Assessments”, known as ORSAs, together with actuarial calculations and reporting requirements in relation to the insurer’s insurance liabilities and prescribed minimum capital requirements and eligible capital.
This latter actuarial reporting requires for the first time an annual financial condition report for the business.
One year following issue of licences, insurers must now also be able to demonstrate compliance with the conduct of business requirements set out in the Insurer Regulations. These cover advertising, product disclosure, sales and post-sales servicing, claims and complaint handling as well as data protection.
The Insurer Regulations allow two years from licensing for compliance with on-line marketing and process requirements given the anticipated time required to develop the necessary IT system changes for on-line business models.
A period of learning for the regulator
and the regulated
The step change in compliance required from the new Insurer Regulations does not only affect the insurers. One year on from the issue and effective date of the new regulations, the QCB has established a dedicated Insurance Division, and is continuing to develop effective licensing and supervisory capability for approvals and oversight of insurer businesses operating in Qatar against the comprehensive and complex new requirements.
Inevitably, the supervisory teams will be initially trying to not only become familiar with the new requirements, but also, to better understand the insurers and the businesses that they need to regulate. This will require time, and continuing dialogue and questioning as part of reporting processes, both formal and informal.
Some requirements of the new Insurer Regulations have been in place from day one, and we can look at some of these key requirements of change and how these are being approached and are bedding in.
Internal Control Framework,
Functions, Policies and Systems
The Insurer Regulations have specific requirements for governance frameworks relating to internal control functions and policies, remuneration, business continuity and outsourcing. These are now in force, and require substantial investment in people, policies and processes.
Insurers are now mandated to have in place certain functions in their businesses, including risk management, compliance, actuarial and internal audit.
It is interesting that, with the exception of internal audit, such “internal control functions” can be outsourced to a third party, subject to QCB approval. (Having one’s own internal audit functions has always been a requirement of Qatar’s listing requirements for public companies.)
Given the challenges of costs and finding necessary expertise, such outsourcing can offer opportunities in the market, and may perhaps provide scope for the development of external compliance network and service models that have been prevalent in more developed international markets, such as the UK.
These models can be useful in not only helping to drive better compliance with regulation, but also to increase distribution of insurance by helping establish more networks of intermediaries.
It remains to be seen how these “outsourced models” develop, but there are early indications that specialist actuarial services are to be engaged from outside of the firm.
The Insurer Regulations detail the responsibilities of the relevant functions. This includes a key requirement for internal audit to periodically report to the board or specialist board committees on the performance of internal control functions (such as compliance), so that areas such as resourcing and effectiveness can be monitored at the highest level.
With regard to the actuarial function, the QCB may require a meeting with an insurer’s principal actuary, and for such meeting to be held without the presence of the board or senior management, if deemed necessary.
With regard to outsourcing, the insurers must now have in place a documented and Board approved outsourcing policy. The policy must address intra-group as well as third party arrangements. Any outsourcing arrangements with a party outside of Qatar must not be entered into without prior consent of the QCB.
The concept of “material outsourcing” referred to in the insurer regulations requires particular care from insurers.
This is defined as outsourcing of a function “of such importance to the insurer that weakness or failure in exercising that function would cast doubt on the insurer’s ability to comply with the law or regulatory requirements, instructions, performance, financial position, or its ability to continue the conduct of its business”.
Typically, such material outsourcing would include claims management, information technology, investment management or underwriting.
Prior approval is required from the QCB for material outsourcing, and there are very detailed and comprehensive minimum requirements for the terms and conditions of the legal agreements covering the outsourcing arrangements.
The arrangements must be reviewed annually, and the resulting report assessed by and actioned by the Board.
(Continued from page 1)
Risk Management and Solvency
risk management framework, policies, procedures and an ORSA (Own Risk and Solvency Assessment) for insurers represents a significant mandatory change to the management and reporting by Insurers.
The ORSA is the ultimate evidential output from this framework, representing a detailed examination by the insurer of the strength and robustness of its risk management framework and its present and future solvency positions.
The ORSA must be carried out annually, in accordance with the detailed provisions of the Insurer Regulations. There must be “stress testing” of the quantative evaluation in the ORSA and the ORSA report issued to the QCB within 14 days following board approval.
Guidance is provided in the Insurer Regulations on the classes of risk to the insurer that should be considered and how to approach these in the ORSA.
The insurers are now at the early stages of getting to grips with the new Insurer Regulations relating to Risk Management and the first ORSAs are not required until end of 2017, although early planning is essential.
It is an area where there will be considerable learnings, some uncertainties and a need for training and specialist expert advice to ensure understanding and compliance for the insurers, their Boards and the regulatory authorities themselves.
Prudential Requirements including capital and solvency
Compliance with the prudential requirements of the Insurer Regulations has been a requirement from inception and day one of the Insurer Regulations.
From April 2016, these requirements have included the need for adequate financial resources to meet the nature, scale and complexity of the business and compliance with the prescribed solvency ratio and minimum capital requirements set out for insurers.
There are detailed provisions covering eligible capital, rules on investments and the valuation of assets and liabilities of the insurer to demonstrate compliance.
Insurers have been getting accustomed now to internal quarterly review and reporting of the risk-based capital and solvency requirements, with formal end-of-year reports to the QCB.
Particular difficulties and challenges for insurers in these prudential requirements have been in relation to adapting to the new investment and concentration limits. It is key to be able to agree plans in advance with the QCB, regarding steps and timelines to correct any adverse positions.
Immediate reporting to the QCB is required if eligible capital falls below the minimum capital requirement, or if the eligible capital falls below the required solvency ratio, or if, in either case, the insurer considers either may occur.
For insurer’s licensed as branches, the insurer’s capital shall not be less than QAR35m (US$9.6m, £7.5m, €8.7m).
Conduct of Business Requirements
Chapter 11 of the Insurer Regulations provides for extensive requirements relating to conduct of business, and how insurers must conduct themselves when dealing with customers and policyholders. The requirements extend from advertising to product disclosure at sale, and to after-sales servicing and claims management.
The language of documentation has become an area for attention with all policy related documentation and information to be in a language that the customer understands.
The key is the “understanding” of the policyholder, and there is an onus on the insurer to find out if the policyholder understands what is taking place.
There are potentially many different language-speaking policyholders in Qatar. The practice in the market seems to be moving to documentation in at least Arabic and English, but the expectations of the regulators and the courts need close attention.
Compliance sign-off is required for advertising materials, and further controls required including policies and procedures for product development, which should include safeguards to ensure that marketing and distribution to customers is appropriate to the nature and risks of the product.
Standard policy forms need also to be approved by the QCB before use with customers.
For other non-standard policies, the requirement is for notification only to the QCB.
During the initial process for licensing of MEC firms, insurers were asked to submit standard policy documents. The QCB has not been issuing individual approvals for such policies with insurers, assuming that the documentation is acceptable as “no objections” have been raised. It would be wise, though, to confirm this assumption with the QCB.
This was always likely to become an area in which regulatory practice would be key for ongoing compliance, and it is expected that the regulator would tend to be reasonably flexible in the early days of the new regime.
The Insurer Regulations provide for documentation required relating to disclosures to customers prior to sale, including details of the insurer’s regulatory status and product disclosure. All of this documentation must now be compliant.
Prior to the sale of policies, and before making recommendations to a customer, the insurer must have in place training for staff, and comprehensive processes to ensure that enough information has been obtained from the customer to understand his needs, and to recommend an appropriate insurance solution. This includes a requirement to conduct a suitability assessment for each customer solution.
This whole process must be carefully documented for evidential purposes, including regulatory inspection and possible complaint resolution.
Post-sales contractual confirmations, after-sales servicing and claims handling as well as complaint handling provisions must all now be complied with. The insurers are required to meet the strict timelines for responding to and investigating complaints, and give the QCB a monthly report on these in the prescribed form.
The Law provides for a QCB dispute resolution process for complaints where these cannot be resolved by the internal complaint process.
For online insurance business, insurers have extended time until April 2018 to comply with the requirements.
Insurers are not permitted to carry on online insurance business without QCB approval, with a business plan, analysis of risks, contingency measures for business continuity and three-year projections to form part of the QCB application required.
Customers cannot be contractually committed online to long term business contracts or to policies with a premium greater than QAR20,000.
Data Protection
The Insurer Regulations also bring in specific requirements in respect of measures required for the protection of customers’ personal data.
Given that the new Qatar Law No.13 of 2016 concerning Personal Information Privacy Protection (also known as the Data Privacy Law) became law on December 29, 2016 (with a six-month period given for all businesses to adapt to the new provisions), insurers will also need to comply with this primary legislation, in addition to the Insurer Regulations.
There are differences between the Data Privacy Law and the provisions in the Insurer Regulations. It remains to be seen whether the QCB will make changes to the Insurer Regulations to address these inconsistencies.
The Ministry of Transport & Communications is the competent authority with overall responsibility for the Data Privacy Law, and the rights to enforce it. Ministerial resolutions of the ministry and guidance are likely to provide further clarifications, so careful attention to this area is strongly advised.
The Insurer Regulations require that personal data must be collected and used only “for specified and lawful purposes”. This is similar to the Data Privacy Law, but the latter goes further, and requires pre-notification of processing activities to customers and the securing of consent in advance to use for processing for other purposes that are not obviously directly connected with the insurance transaction, such as processing for analytics or research.
In terms of third party disclosures of personal data, including cloud and outsourced arrangements, insurers may, under the Insurer Regulations, disclose personal data to QCB- or Qatar Financial Centre-regulated insurers, company representatives or insurance service providers if for a purpose connected with the applicable contract of insurance, ie, disclosure to an insurance service provider for claims management.
However, consent of the customer, or authorisation from the QCB, is required for disclosure to any other third party.
Still early days and review essential
So a year on, and the new regime is starting to bed in. There is still some way to go to see the full effect of implementation of the Risk Management frameworks and policies, including the ORSA and Actuarial reporting processes, in particular.
The level of change is substantial, and will require considerable investment in compliance and training at all levels to ensure understanding and ongoing ability to meet the new requirements.
It should not be underestimated, and the governing bodies of insurers should be attentive to the need for regular review and reporting on implementation plans.
This should include a level of independent review to provide further assurance to the governing function, and to the regulatory authorities, that all is in order.
Roger Phillips is legal director for Clyde & Co, and is based in Doha, Qatar. To see this analysis of the new Qatari regulations on the Clyde & Co website, and other information on this and related topics, click here.
