Insurance (Insurance Marketplace Provider) (Statutory Financial Return) Rules 2020 - Schedules

Summary

This document is Schedule I to Bermuda's Insurance (Insurance Marketplace Provider) (Statutory Financial Return) Rules 2020, issued by the Bermuda Monetary Authority. It sets out, in detailed schedule form, all of the information that a registered Insurance Marketplace Provider must include in its annual statutory financial return, covering governance, outsourcing, cyber risk, AML/ATF and sanctions matters.

• Governance and structure: Details of directors, senior executives and key staff, organisational structure, outsourced service providers, professional indemnity/D&O/E&O insurance coverage, and confirmation of compliance with minimum registration criteria (or details of any non-compliance and remediation).
• Client and business data: Names, registration numbers, insurance classes and affiliate status of clients serviced in the prior 12 months, transaction volumes, gross premium volume, and whether a conflict of interest policy is in place.
• Cyber risk management: Confirmation of headquarters location, user numbers, data hosting arrangements, data types processed, internet-facing services, dedicated IT/security/BCP roles, and a detailed self-assessment against identification, protection, detection, response, recovery and technical security controls (e.g. encryption, patching, penetration testing, incident response plans, DDOS defences).
• AML/ATF questionnaire: For providers that are AML/ATF Regulated Financial Institutions under the Proceeds of Crime Act 1997: client numbers and risk ratings, products/services and delivery channels, UBO and PEP geographic exposure, GoAML registration and SAR filings, staff training, AML/ATF controls, risk assessments, independent audits, and Compliance/Reporting Officer reporting.
• International sanctions questionnaire: Confirmation of client and employee sanctions screening and disclosure of any asset freezes in the preceding 12 months, including designated person details and value of frozen assets.
• Corporate governance and compliance culture: Confirmation of enterprise risk management oversight, independence of compliance/audit functions, employee integrity vetting, staff AML/ATF knowledge and training (including annual refresher training), and disciplinary measures for non-compliance.

The schedule itself is a data-content annex rather than the operative rule provisions, so it does not independently state filing deadlines or transitional dates; those are set out in the main body of the Rules, which is not part of this excerpt.

Key obligations

• Insurance Marketplace Providers must submit an annual statutory financial return containing all information specified in Schedule I, including director, organisational, outsourcing and insurance coverage details.
• Providers must confirm compliance with minimum registration criteria in the annual return, and where not met, describe the non-compliance and any remedial action taken.
• Providers must complete the cyber risk management self-assessment covering business summary, general controls (identification, protection, detection, response, recovery) and technical security controls.
• Providers that are AML/ATF Regulated Financial Institutions under the Proceeds of Crime Act 1997 must complete the AML/ATF questionnaire, including client risk rating data, SAR filings, GoAML registration status, staff training details and AML/ATF control assessments.
• Providers must confirm whether staff undergo AML/ATF refresher training at least annually.
• Providers must complete the international sanctions questionnaire, confirming client and employee sanctions screening and disclosing any asset freezes in the prior 12 months with supporting details.
• Providers must maintain and disclose in the return whether they have a conflict of interest policy and appropriate corporate governance and compliance oversight arrangements.

Applies to

Insurance Marketplace Providers