Business Continuity and Disaster Preparedness (2018-06-04)

Summary

This is a CIMA Supervisory Information Circular addressed to Class 'A' Property and Casualty Insurers in the Cayman Islands, issued in June 2018 in the wake of the highly destructive 2017 Atlantic hurricane season. It reminds insurers of their existing obligations under the Statement of Guidance on Business Continuity Management (SOG BCM), the Statement of Guidance on Market Conduct for Insurers, Agents and Brokers (SOG Market Conduct), and the Statement of Guidance on Internal Controls for Insurance (SOG IC) to maintain robust Disaster Recovery and Business Continuity Plans (BCPs).

The circular emphasizes that boards and senior management are responsible for ensuring effective business continuity arrangements, including safeguarding data access, claims processing capability, and customer communication after a major disruption such as a hurricane.

• Alternate site activation: BCPs should address activation of alternate sites in the event of disruption.
• Backup data access: BCPs should ensure backup data access is available.
• Claims volume management: BCPs should address managing increased claims volume, including use of loss adjusters.
• Emergency equipment: BCPs should address storage and availability of emergency equipment.
• Underwriting and claims management practices: The circular reiterates expectations around fair treatment of customers, clear disclosure regarding underinsurance risk, and documented, fair, and timely claims handling procedures, including within BCPs.

This document does not introduce new legal rules but restates and elaborates on obligations already found in the referenced Statements of Guidance, urging insurers to review, test, and where necessary improve their BCPs ahead of the 2018 hurricane season. No new deadlines or transition periods are specified.

Key obligations

• Class 'A' Property and Casualty Insurers must maintain up-to-date Disaster Recovery and Business Continuity Plans (BCPs) that are regularly tested, per the SOG BCM.
• Where insurers operate through Insurance Brokers in the Cayman Islands, their BCPs must cover the operations of those brokers.
• Boards and senior management must ensure effective, comprehensive business continuity policies and procedures covering data access, claims processing, and customer communication post-disruption.
• Insurers must conduct simulation exercises to test BCPs and remediate any deficiencies identified.
• BCPs must address alternate site activation, backup data/server access, and management of large claims volumes, including protocols for use of external loss adjusters.
• Insurers must ensure emergency equipment and materials (e.g., satellite phones, laptops, underwriting files, claims forms) are readily available for post-event use.
• Insurers must subject their BCPs to independent audit and review for objectivity.
• Insurers must advise clients of underinsurance risks and provide remediation recommendations, and ensure information given to insureds is accurate, understandable, and accessible, per SOG Market Conduct.
• Insurers must have documented, fair, and timely claims handling policies and procedures in accordance with SOG Market Conduct and SOG IC, including clear claim contact details and procedures within policy documents.
• Insurers must ensure sufficient trained staff are available to recover critical claims operations after a disruption.
• Loss adjusters used by insurers must have appropriate local market knowledge and relevant expertise.

Applies to

Class 'A' Property and Casualty Insurers, Insurance Brokers (as represented under insurers' BCPs)