1 April, 2020
For insurers in Hong Kong, the outbreak of novel coronavirus may cause potential disruption to their business operations due to office absences, travel restrictions and other precautionary measures taken in the region. It is important that insurers should take appropriate measures and actions to ensure continuity of their business operations and their abilities to comply with regulatory requirements under the current situation. We set out below some of the key considerations for insurers in Hong Kong from an insurance regulatory perspective and the latest development in the insurance industry.
Business continuity planning
Insurers should ensure that appropriate business continuity plans are in place which can cater for the potential disruption which may be caused by serious communicable pandemics such as the novel coronavirus so that their business operations will not be affected and there is no or only minimal impacts on their customers.
The Guideline on the Corporate Governance of Authorized Insurers (GL10) issued by the Insurance Authority (IA) has provided clear guidance on the IA's expectations of insurers in respect of their business continuity plans (BCP). In particular, the BCP should be made appropriate to the nature, scale and complexity of the business and the risk position of the insurers and should cover detailed actions and procedures, including contingency plan, identification of critical business activities, roles and responsibilities of different parties, succession plan of critical staff, communication plan, recovery target timeline and technology recovery and support.
If an insurer in any circumstances needs to activate the BCP, it has to inform the IA promptly, and provide information of the disruptions, actions taken, potential impacts and the recovery target timeline. Progress reports should be provided thereafter until the position or business activities are restored to or resumed normal.
Regulatory requirements
Insurers should ensure that they can continue to fulfil all regulatory requirements under the Insurance Ordinance (IO). In particular, insurers should pay particular attention to the following:
- Insurers should ensure that they can continue to maintain adequate capital and solvency as required under the IO and appropriate enterprise risk management framework is in place to mitigate any potential risks for solvency purposes in accordance with the Guideline on Enterprise Risk Management (GL21) issued by the IA.
- Insurers should ensure that their directors and controllers remain fit and proper under the current situation. If any director or controller is unable to attend to his/her duties as director or controller due to, for example, quarantine measures or virus infection, the insurers should undertake appropriate contingency plans and inform the IA accordingly.
If insurers encounter difficulties or anticipate delays in fulfilling any of the regulatory requirements under the IO, it is advisable that they should communicate promptly with the IA.
Notification requirements
Insurers should consider whether any changes resulting from the novel coronavirus outbreak will trigger notification requirements to the IA. Section 14(1) of the IO requires insurers to notify the IA within one month from the date of any changes of particulars or information in respect of the insurers given to the IA under or in support of its application for authorization. In the context of the current situation, if there are material changes in the nature of the business carried out or in the business plan of the insurers, it is advisable to inform the IA promptly.
Record keeping
Where alternative working arrangements are in place, such as working remotely from home or overseas, insurers should be mindful of their record keeping obligations under the IO. Section 16 of the IO requires insurers to keep proper books of accounts which sufficiently exhibit and explain all transactions entered into by the insurers in the course of any business carried on by them. If their employees are not working in the office premises, they should be reminded to produce and save documents properly and securely in accordance with the internal policy and procedures on record keeping of the insurers. In particular, hard copy materials and documents must be preserved securely.
Cyber security
Insurers should ensure that they are appropriately equipped to manage any cyber security risks which may arise from alternative working arrangements such as where the majority of employees is working remotely from home or overseas. It is important that customer information and digital/electronic business data are protected under the alternative work arrangements. In particular, employees working remotely should only access the network and email of the insurers under secured internet connection and with electronic devices provided by the insurers.
GL10 requires that insurers should have policies and procedures, which are commensurate with the scale and complexity of its business, to identify, prevent, detect and mitigate cyber security threats. Insurers should identify cyber security threats arising from network, email and relevant devices. Mitigation measures should be in place to deal with cyber security threats timely and effectively. Insurers should also be mindful of the requirements under the Guideline on Cybersecurity (GL20) issued by the IA.
Customer services
In light of the various precautionary measures taken against the novel coronavirus outbreak, the insurers should assess the impact on their ability to service customers due to, for example, the absence of employees in customer-facing functions, and consider if alternative arrangements should be made for certain customer services and whether the customers should be notified.
Board and senior management
Insurers should ensure that their board of directors and senior management are kept informed of the impact of the novel coronavirus on their businesses and the latest developments with the novel coronavirus situation. If the existing measures and procedures are not sufficient to address the current situation, the board of directors and senior management should determine if additional measures and procedures are required.
Introduction of new measures
Since the outbreak of novel coronavirus, insurers have been introducing various new measures on medical insurance to virus-inflicted policyholders in Hong Kong. According to the news release issued by the Hong Kong Federation of Insurers (HKFI) on 3 February 2020, some insurers have announced that hospitalization/treatments prescribed for the novel coronavirus will be covered. If the insured person is diagnosed as suffering from novel coronavirus or is ordered mandatory quarantine, the insurers will provide additional hospital cash protection. For customers taking out a new policy within a specified period of time, the waiting period for novel coronavirus will be waived. It should be noted that the IA has also issued a recent Guideline on Medical Insurance Business (GL31) which will take effect from 23 September 2020.
The HKFI has also announced on 21 February 2020 that the IA has introduced temporary facilitative measures on non-face-to-face distribution methods, for Qualifying Deferred Annuity Policy (QDAP) and Voluntary Health Insurance Scheme (VHIS) products in view of the outbreak of novel coronavirus. From now until 31 March 2020, life insurers and intermediaries selling QDAP and VHIS products will be able to offer their products to policyholders through non-face-to-face applications, such as digital, telemarketing, postal, video conference or any combination of these methods.
For further information, please contact:
Martin C.W. Tam, Partner, Baker & McKenzie
martin.tam@bakermckenzie.com
