Regulatory Priorities for Insurers – what firms should do next? (final article)

The first article, which focused on sales and claims processes can be accessed here and the second article which is focused on service delivery, ensuring fair value and continuing to monitor customer outcomes can be accessed here.

Actions firms should be taking in response to FCA priorities

Actively managing the risks associated with AI use

FCA focus areas include:

• Supporting responsible adoption of AI across the insurance sector while ensuring firms actively manage the risks associated with it.
• Assessing whether firms have appropriate governance, oversight and monitoring in place to ensure AI enabled processes remain aligned with Consumer Duty and broader regulatory expectations.
• Identifying barriers to responsible AI adoption within firms and across the sector.

Firms should consider:

• Creating a robust AI governance model that pulls together input from operations, technology, 1^st line risk, compliance and legal where needed to ensure used cases are assessed and agreed, models are built to agreed requirements, risks are actively managed and there is regularly monitoring of the performance and AI-driven decision making to ensure good customer outcomes are being achieved.
• Ensuring data quality and suitability, including assessing whether the data used to train and operate AI models is accurate, representative and appropriate for the intended purpose. The AI testing data to ensure it demonstrates the spread of outcomes received by customers through AI enhanced journeys both at the outset to validate creation, during scaled implementation, and then periodically to ensure continued confidence.
• Maintaining transparency and auditability, ensuring firms can explain how AI models operate, demonstrate oversight and evidence that customer outcomes remain fair and consistent.
• Ensuring appropriate human oversight, particularly for higher-risk use cases, so that automated decisions can be reviewed, challenged and corrected where necessary.To meet data privacy requirements, ensure the data protection officer is consulted on AI use cases involving personal data to assess whether a DPIA is needed and whether the principles of privacy and security by design are followed throughout the AI lifecycle.

• Ensure appropriate consent or an equivalent lawful basis for processing personal data. Document these steps in accordance with the applicable data privacy regulations in scope.
• Lastly, data protection principles such as data minimisation, purpose limitation, data retention, and, for AI data sets, logs and outputs are appropriately considered and documented.
• On the cyber front, data sharing or third-party access to AI models should be carefully governed, especially when confidentiality and sensitive information are at high risk in AI use cases.

Minimising financial crime risk (larger firms)

FCA focus areas include:

• Looking to ensure larger firms have a robust set of financial crime systems and controls in place to mitigate risk. This includes:
  1. A genuinely risk-based financial crime framework tailored to their products, distribution model and customer base
  2. Board-level ownership and oversight of financial crime risk
  3. Effective sanctions screening, CDD/EDD and fraud controls
  4. Evidence that systems are tested, challenged and improved, not static
  5. Use of data and MI to monitor effectiveness, not just activity

  Firms should consider:

• Re-performing your financial crime risk assessment: Does it reflect your actual business model and emerging risks?
• Testing control effectiveness: When was the last independent review of sanctions, onboarding or fraud controls?
• Challenging governance: Would your Board be able to articulate your top three financial crime risks?
• Reviewing MI: Does it measure outcomes and risk, or just volumes?
• Documenting remediation: Can you evidence a cycle of testing, findings and improvement?

Additional products that the FCA is reviewing/monitoring this year

In addition to the work described above, the FCA has also stated that it intends to carry out the following product reviews this year:

1. Closed customer life insurance books and child trust funds to ensure customers are receiving good outcomes.
2. Funeral Plan providers to assess whether the funeral plan conduct of business sourcebook is delivering the outcomes intended.

The FCA has also identified rising prices and issues with customer understanding for Pet Insurance and Private Medical Insurance and is continuing to monitor those products over the next year and will take action if needed.

Reducing regulatory risk now

The FCA’s is looking to support responsible AI adoption. It emphasises its intention to rely on existing rules and not to create a new sourcebook. This allows innovation, but creates challenges for firms. The key to successful AI deployment is ensuring that good customer outcomes are being delivered and that regulatory requirements are being met. It is crucial that compliance, first line risk and operations roles have the right AI knowledge. This will ensure the firm can deliver the right governance, analysis of used cases, and testing to give confidence that AI solutions are delivering against expectation. Upskilling these teams is the perfect place to start.

Larger firms should be actively looking to review their financial crime systems and controls. The FCA intends to publish a good practice and areas for improvement report later this year. This will provide further guidance with which to enable firms to benchmark their own findings and take steps to close gaps.

Firms that have products including pet insurance, closed life books, private medical insurance and funeral plans should all be looking to proactively review those products to identify gaps and make enhancements where needed. External support can be helpful for these reviews, enabling firms to get an independent perspective that benchmarks the firm against industry best practice.

The purpose of this FCA publication is to ensure firms understand the key areas of regulatory focus and take action to mitigate potential risks. Those that are more proactive in doing the right thing will see less intensive scrutiny, enabling the FCA to focus its attention on the broader market and take action faster where it identifies issues.