Guidelines on Risk Management Practices for Insurance Business - Insurance Fraud Risk

Monetary Authority of Singapore INSURANCE BUSINESS

• INSURANCE FRAUD RISK January 2024

INSURANCE BUSINESS

• INSURANCE FRAUD RISK Monetary Authority of Singapore January 2024

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS
• INSURANCE FRAUD RISK

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE TABLE OF CONTENTS 1 INTRODUCTION AND FUNDAMENTALS ......................................................................... 1 1.1 INTRODUCTION ............................................................................................................. 1 1.2 FUNDAMENTALS OF DEALING WITH INSURANCE FRAUD............................................. 1 2 RISK MANAGEMENT FRAMEWORK ............................................................................... 2 2.1 STRATEGY....................................................................................................................... 2 2.2 STRUCTURE.................................................................................................................... 3 2.3 POLICIES AND PROCEDURES.......................................................................................... 4 3 RISK IDENTIFICATION, CONTROL AND MONITORING..................................................... 6 3.1 RISK IDENTIFICATION AND MEASUREMENT ................................................................. 6 3.2 RISK CONTROL AND MITIGATION.................................................................................. 8 3.3 RISK MONITORING AND REVIEW................................................................................. 10 APPENDIX 1: Details to be furnished to MAS for any suspected or confirmed fraudcases

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 1 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK 1 INTRODUCTION AND FUNDAMENTALS 1.1 INTRODUCTION 1.1.1 Fraud poses a serious risk to all insurers and policyholders. Fraudulent activities committed within or against the insurer can adversely affect an insurer’s financial soundness and reputation. There may also be an indirect impact on the policyholders through premium increases arising from higher claims cost experienced by the insurer. The Monetary Authority of Singapore (MAS) takes a serious view of fraudulent activities and expects all insurers to undertake sound risk management practices in order to effectively deter, prevent, detect, report and remedy insurance fraud. 1.1.2 This chapter provides guidance on sound risk management practices to identify and mitigate insurers’ exposure to the risk of insurance fraud. It articulates broad principles that should be embedded in a risk management framework covering strategy, organisational structure, policies and procedures for managing insurance fraud risk. 1.1.3 This chapter should be read in conjunction with other relevant Notices and guidelines issued by MAS, in particular “MAS Notice 123 on Reporting of Suspicious Activities & Incidents of Fraud”, “Guidelines on Outsourcing”, “Guidelines on Corporate Governance for Designated Financial Holding Companies, Banks, Direct Insurers, Reinsurers and Captive Insurers which are Incorporated in Singapore”, “Guidelines on Individual Accountability and Conduct”, and all the chapters on “Guidelines on Risk Management Practices”. 1.1.4 Insurers are encouraged to adopt the sound practices recommended in this chapter and the other guidelines where applicable and to the level that is commensurate with the institutions’ risk and business profiles. 1.1.5 The expressions used in these Guidelines shall, except where expressly defined in these Guidelines or where the context otherwise requires, have the same respective meanings as in the Insurance Act 1966. 1.1.6 For the purposes of this chapter, “Board” refers to: (i) in the case of an insurer incorporated in Singapore, the Board of directors; and (ii) in the case of an insurer incorporated or established outside Singapore, a governing body or committee beyond local management that is charged with oversight and supervision responsibilities for the insurer’s operations in Singapore. 1.2 FUNDAMENTALS OF DEALING WITH INSURANCE FRAUD 1.2.1 Fraud can be defined as an act or omission intended to gain dishonest or unlawful advantage for the party committing fraud or for other related parties. In the case of insurance

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 2 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK fraud, this would usually involve an exaggeration of an otherwise legitimate claim, premeditated fabrication of a claim or fraudulent misrepresentation of material information. 1.2.2 Insurers rely greatly on the accuracy and completeness of information provided by policyholders, claimants and intermediaries1 when underwriting risks and processing claims. However, they may face various constraints in verifying the information provided due to factors such as high volume of transactions (for some insurance products), complexity of circumstances leading to a claim and incomplete information. 1.2.3 The broad categories of insurance fraud include: (a) policyholder and claims fraud – fraud against the insurer by the policyholder and other parties in the purchase and/or execution of an insurance product; (b) intermediary fraud – fraud by intermediaries against the insurer or policyholders; and (c) internal fraud – fraud against the insurer by its director or employee on his/her own, in collusion with parties internal or external to the insurer, or fraud perpetuated by any external party (e.g. accountants, auditors, consultants, claims adjusters) engaged as a service provider by the insurer. 1.2.4 The scope of this chapter only covers policyholder and claims fraud as well as intermediary fraud. For guidance on risk management practices to mitigate risk of internal fraud, insurers should refer to the “Guidelines on Risk Management Practices – Internal Controls”. 1.2.5 Although certain categories of insurance intermediaries are licensed by MAS, an insurer should still assess each and every intermediary based on the intermediary’s track record and the insurer’s past experience in its dealings with the intermediary. Based on that assessment, the insurer should apply the appropriate risk management measures in respect of transactions involving an intermediary, regardless of whether it is licensed by MAS. 1.2.6 As fraud can be perpetrated by collusion involving a few parties, an insurer should adopt a holistic approach to adequately identify, measure, control and monitor fraud risk and embed appropriate risk management policies and procedures into its processes across the organisation. 2 RISK MANAGEMENT FRAMEWORK 2.1 STRATEGY 2.1.1 An insurer should have a sound strategy to manage fraud risk arising from its operations. 1 For the purposes of this chapter, intermediaries would include the insurer’s financial adviser (FA) representatives, general insurance agents, financial advisors and insurance brokers (where applicable).

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 3 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK The fraud management strategy should form part of an insurer’s business strategy and be consistent with its overall mission, business strategy and objectives. It should: (a) include a clear mission statement to indicate the insurer’s level of tolerance to fraud; (b) facilitate the development of quantitative risk tolerance limits on fraud; and (c) provide direction to the overall fraud management plan. 2.1.2 A sound and prudent fraud management strategy should be compatible with the risk profile of the insurer. In determining its risk profile as well as its vulnerability to fraud, insurers should consider the following factors: (a) size, composition and volatility of its business; (b) its organisational structure; (c) complexity of its operations; (d) products and services offered; (e) remuneration and promotion policies; (f) distribution modes; and (g) market conditions. 2.1.3 To ensure its relevance and adequacy, the strategy should be reviewed regularly by the Board and senior management of the insurer to ensure that it continues to be effective, especially when there are material changes to the insurer’s risk profile. The strategy should also be properly documented and effectively communicated to all relevant staff. There should be a process to approve proposed deviations from the approved strategy, and systems and controls to detect unauthorised deviations. 2.2 STRUCTURE 2.2.1 An insurer should adopt a risk management structure that is commensurate with the size and nature of its activities. The organisational structure should facilitate effective management oversight and execution of its fraud risk management and control processes, including the allocation of sufficient resources to deter, prevent, detect, report and remedy fraud. The structure should facilitate communication between departments and to senior management and the Board of Directors to ensure prompt responses to instances or suspicions of fraud.

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 4 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK 2.2.2 The Board and senior management of the insurer are ultimately responsible for the sound and prudent management of fraud risk. It should recognise and understand the risk of fraud and its potential impact on the institution. 2.2.3 The Board should approve the fraud management strategy and ensure that adequate resources, expertise and support are provided for the effective implementation of the insurer’s fraud management strategy, policies and procedures. Any deviation from the approved strategy and policies should be subject to the Board’s review and approval. 2.2.4 An insurer should consider establishing a fraud management function if warranted by its risk assessment. This function would be primarily responsible for the compliance with the insurer’s fraud management policies and procedures covering fraud identification, reporting and investigations. In order to be effective, this function should have the requisite authority, sufficient resources and be able to raise issues directly to the Board and relevant Board Committee. 2.3 POLICIES AND PROCEDURES 2.3.1 An insurer should establish clear policies and procedures for the management of fraud risk. These policies and procedures should: (a) be well-defined and consistent with the insurer’s fraud management strategy, as well as its overall risk management framework; (b) be adequate for the nature and complexity of its activities; and (c) address, at a minimum: i. the roles and responsibilities of the fraud management function or staff assigned to execute the insurer’s fraud management strategy, policies and procedures ii. the roles of the senior management and Board of Directors (if any) as being ultimately responsible for the sound and prudent management of fraud risk; iii. measures to identify and mitigate the risk of fraud; iv. measures to monitor and detect instances or suspicion of fraud; v. clearly defined process of reporting of suspected fraud cases to designated person(s) for review and investigation, including clear trigger points for when to report such cases; vi. escalation to senior management and Board members of suspected fraud

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 5 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK cases; vii. record keeping of suspected or investigated fraud cases; and viii. regular training on fraud matters for its directors, management and staff. 2.3.2 Senior management should ensure that proper and effective reporting systems are in place to satisfy all requirements of the Board with respect to reporting frequency, level of detail, usefulness of information and recommendations to address fraud risk. It is also the responsibility of the senior management to alert the Board promptly in the event that they become aware of or suspect that fraud that may have a significant adverse impact on the insurer has occurred. Record Keeping 2.3.3 An insurer should retain records of all reported cases of suspicion or incidents of fraud together with internal findings and analysis done in relation to them. It should establish standards relating to the turnaround time for the assessment of fraud, documentation of analysis, and keeping of records on suspicions/incidents of fraud. At a minimum, the insurer should specify the following in its policies and procedures in respect of record-keeping: (a) the types of information and analysis to be recorded2 ; (b) the minimum retention period of the records; and (c) staff access rights to records based on their confidentiality classification. Anti-Fraud Policies 2.3.4 An insurer’s anti-fraud policies should be communicated to all staff. An insurer should also review the effectiveness of its policies, taking into account changing internal and external circumstances, as well as identification of lessons from incidents of fraud or suspicions of fraud, to enhance its management of fraud risk. Policies and procedures should be documented and set out in sufficient detail to provide operational guidance to staff. Reporting of Fraud 2.3.5 An insurer should have in place proper and effective reporting systems to satisfy the requirements of the Board with respect to reporting frequency, level of detail, usefulness of information and recommendations to address issues of concern. There should be clear guidelines on the type of information to be reported to the Board on a regular basis as well as when certain 2 When determining the type of information it should record andmonitor, the insurer may refer to Appendix 1 for the list of information to be provided to MAS on fraud cases, and paragraph 2.3.5 on having clear guidelines setting out the type of information to be reported to the Board.

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 6 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK information or development ought to be communicated immediately to the Board. 2.3.6 An insurer should report any suspected or confirmed fraud cases to MAS as soon as practicable. The insurer should provide, at a minimum, the details of the fraud case using the format as outlined in Appendix 1. To avoid doubt, as specified under MAS Notice 123, an insurer must report to MAS no later than 5 working days upon discovery of any suspicious activities and incidents of fraud where such activities or incidents are material to the safety, soundness or reputation of the insurer and in accordance with the requirements in MAS Notice 123. Training 2.3.7 An insurer should provide regular training on anti-fraud measures to Board members, senior management and members of staff as appropriate. The type of training should correspond with the business process in which the person is engaged. Key personnel whom the insurer should consider providing training to regularly include persons in the claims, finance and agency management and distribution functions. Such training should be tailored to the specific needs of the relevant functions. 3 RISK IDENTIFICATION, CONTROL AND MONITORING 3.1 RISK IDENTIFICATION AND MEASUREMENT 3.1.1 An insurer should assess its business activities and internal processes for any vulnerability to fraud and determine the consequential impact of any potential fraud. In determining the potential sources of fraud risk, the insurer should consider the following: (a) adequacy of measures to verify customer information before accepting a customer’s proposal, taking into consideration the risk factors posed by different distribution channels (such as online policy applications without face-to-face contact); and (b) fit and proper standards for its intermediaries. 3.1.2 The insurer should recognise that certain products or lines of business may be more susceptible to particular types of fraud, and should also identify fraud risk factors in product design during the early stages of product development. For instance, for workman compensation insurance, employers may misrepresent their employees’ payroll and job scope in order to pay lower premiums. Similarly, motor insurance is susceptible to inflated claims as well as staging of accidents so that policyholders and workshops can obtain more compensation from insurers. 3.1.3 The insurer should establish appropriate indicators that, when triggered, suggest a higher risk of fraud. In the event that one or more indicators are triggered, the insurer should ascertain the facts to determine whether a more in-depth investigation and follow up actions are warranted. There should be adequate documentation of the verification actions taken. The

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 7 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK indicators should be reviewed regularly for their continued relevance and effectiveness in detecting fraud. 3.1.4 Common indicators that could be used in the identification of fraud risk include: (a) Policyholder and Claims Fraud i. policyholder has been declined coverage by other insurers due to reasons such as non-disclosure or false disclosure of material information; ii. claimant is willing to settle claims for an inexplicably low settlement amount in exchange for a quick resolution; iii. claimant provides inconsistent statements or information to relevant parties such as the insurer or police; and iv. claimant made several claims of similar nature within a relatively short period of time; (b) Intermediary Fraud i. evidence of churning of policies either within the insurer or across several product providers; ii. large number of policies in the intermediary’s portfolio that have arrears in premium payments or unusual product-client combinations, such as instances where the policyholder’s income is not likely to be able to support the premium he/she has to pay for the product purchased or previous instances of fraud; iii. customer complaints against the intermediary, including allegation of mishandling of monies and non-receipt of policy documents from the intermediary when the documents have been issued by the insurer; iv. customers’ records are not in the insurer’s customer database even though proposal documents or payment has been provided to the intermediary some time ago; v. multiple policies under different policyholders but with the same correspondence address and no apparent relationships with each other; vi. correspondence address for both the policyholder and intermediary is the same; and

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 8 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK vii. indications that suggest that the intermediary is in financial distress. 3.2 RISK CONTROL AND MITIGATION Policyholder and Claims Fraud 3.2.1 An insurer should establish an adequate client acceptance policy, which should include the categorisation of usual product-client combinations. For example, an insurer may categorise its customers based on expected earnings and other factors for certain products in order to identify any unusual product-client combinations. For each combination, the insurer should set out clear conditions for the acceptance of the client’s proposal and the appropriate measures to mitigate or detect fraud. A typical client acceptance policy would also include the following: (a) Customer Due Diligence measures to be taken before business relationship is established for various product types; and (b) Measures to be taken for unusual product-client combinations including the request for additional supporting documents. For instance, the insurer may request for additional information to verify whether the policyholder has other sources of wealth such as inheritance, when the latter's normal earnings are not commensurate with the product purchased. 3.2.2 These measures should be designed in order to detect incorrect or incomplete information provided by policyholders in their application for insurance cover, as well as incompatibility of the policyholder characteristics with the insured event, and should give due consideration to policyholder fraud indicators. 3.2.3 An insurer should also incorporate, in its claims assessment procedures, clear requirements on what claims assessors should do to mitigate the risk of claims fraud, for example: (a) checks against indicators for claims fraud; (b) checks against internal database, industry members or other sources for confirmed or potential fraudsters; and (c) interviewing claimants and conducting special investigations for suspicious cases. 3.2.4 The insurer should ensure that it possesses the relevant expertise, such as by enlisting the services of fraud experts, when assessing claims. In addition, the authority limits assigned to claims assessors should be commensurate with their experience and competency. The insurer should also consider the quality and reputation of any other third parties when placing reliance on material information provided by these parties. For this purpose, consideration should be given only to trusted or accredited third parties whose performance and practices have been or

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 9 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK could be verified by the insurer. 3.2.5 To deter fraud, an insurer should inform policyholders that certain actions, such as knowingly providing false or misleading information to the insurer, submitting inflated or fictitious claims etc. could be tantamount to committing fraud against the insurer and this could result in the loss of benefits or other consequences to the policyholders. It should also highlight to policyholders their contractual duties to the insurer when a policy is purchased or a claim is made. Intermediary Fraud 3.2.6 An insurer should adopt adequate measures to ensure that the intermediaries it deals with meet fit and proper standards. It should establish an internal assessment framework for the appointment of its intermediaries, taking into account the principles set out in the “Guidelines on Fit and Proper Criteria (FSG-G01). 3.2.7 In assessing the fit and proper standards of its agents and FA representatives, the insurer should conduct adequate background checks including a search for any adverse records in reliable databases, such as the Agents Registration and Continuous Professional Development Management database for general agents or the Representative Notification Framework for FA representatives. In addition, the insurer should conduct industry reference checks with the agents’ and FA representatives’ previous employers using the standard reference check letter adopted by industry and professional bodies in the financial services sector. The insurer should also develop a code of conduct for its agents and FA representatives, with appropriate penalties for non-adherence to the code or other misconduct by the agents and FA representatives. An insurer may refer to Annex 2 of Circular No. CMI 01/2011 on “Due Diligence Checks and Documentation in Respect of the Appointment of Appointed, Provisional, and Temporary Representatives” for further guidance on due diligence checks to be conducted. 3.2.8 An insurer which accepts business from financial advisers and insurance brokers should also ensure that the appointed firms’ performances are reviewed periodically to ensure compliance with the insurer’s fraud management controls. 3.2.9 To minimise the risk of intermediary fraud, insurers should adopt the following measures where appropriate: (a) ensure that policyholders’ information such as mailing addresses are not altered without proper authorisation from or verification with the policyholders; (b) send policies and documents as well as payments directly to policyholdersrather than through intermediaries. If this is not possible, insurers should, at a minimum, send a separate notification to the policyholders if policies and documents as well as payments are dispatched via the intermediaries;

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 10 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK (c) prohibit intermediaries from accepting premium payments in cash (if this is unavoidable, receipts should be issued by the intermediary); (d) strongly encourage policyholders to make all cheques payable to the insurer only and take additional precautionary measures such as indicating the policy number (for renewal policies) or the proposed policyholder’s name and NRIC number (for new policies) on the back of the cheques; (e) enhance the monitoring of an intermediary’s own insurance policies and those of his immediate family members when there are grounds for suspicion; (f) avoid issuing cheques in favour of parties other than beneficiaries of the insurance policies. Should the insurer decide to accommodate a policyholder's request to issue cheques made out in favour of a third party, the insurer should ensure that it has exercised due care to authenticate the authorisation given by the policyholder to issue the third party cheque; and (g) enhance monitoring of cheques received, through an intermediary, that are issued by third parties who are unrelated to the intermediary, to pay for policies owned by the intermediary or his immediate family members, when there are grounds for suspicion of fraud. 3.3 RISK MONITORING AND REVIEW 3.3.1 An insurer should establish and maintain an incident database, which contains the names of staff or their immediate family members, policyholders, claimants or other relevant parties who have been convicted of fraud or have attempted to defraud the insurer. 3.3.2 Insurers are also encouraged to establish an industry-wide database to facilitate the sharing of fraud-related information among industry players, so as to enhance insurers’ ability to identify potential fraudsters and fraudulent transactions at an early stage. 3.3.3 An insurer should monitor the performance and trend of business brought in by intermediaries in relation to the insurer’s products, with a view to detecting any indication of intermediary fraud. For example, should the actual level and pattern of business accepted by the intermediary differ significantly from the intermediary’s track record and projections, this may warrant verifying whether there are legitimate reasons for the disparity. 3.3.4 An insurer should carry out periodic fraud-sensitive independent or internal audits to ensure compliance with its policies and procedures regarding insurance fraud risk. For example, the checks should include verification that whenever fraud risk indicators are triggered, they are properly and consistently dealt with and adequately documented.

JANUARY 2024 MONETARY AUTHORITY OF SINGAPORE 11 GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS

• INSURANCE FRAUD RISK Appendix 1 Details to be furnished to MAS for any suspected or confirmed fraud cases (a) Date of incident (b) Type of insurance policies/products (if applicable) (c) Name of reported fraudster(s) (d) NRIC/FIN or Passport No. of individual fraudster(s) (e) Legal Status of fraudsters in Singapore (f) Country/ies of Citizenship (g) Relationship of fraudsters with insurer (i.e. policyholder, claimant, administrative staff, distributor etc) (h) Dollar Amount involved, if any (i) Status of Case or Legal Proceedings, if any (j) Whether Police Report has been made and who made the Police Report, if applicable