GOVERNMENT OF PAKISTAN
SECURITIES AND EXCHANGE COMMISSION OF PAKISTAN -.-.-.- Islamabad, the 16th August, 2022

NOTIFICATION

S.R.O. 1513 (I)/2022. In exercise of the powers conferred under Section 167 of the Insurance Ordinance, 2000 (XXXIX of 2000) read with SRO 708(I)/ 2009 dated July 27, 2009, the Securities and Exchange Commission of Pakistan is pleased to notify the following amendments to the Insurance Rules, 2017 with the approval of the SEC Policy Board, the same having been previously published for public comments vide SRO 755(I)/2021 dated June 14, 2021 as required by sub-section (2) of said section 167, namely:-

AMENDMENTS

In the aforesaid Rules. –

1. In rule 2, in sub-rule (1) after clause (c), the following new clauses will be inserted, namely: -

(ca) “Digital-only insurer” means insurer as defined in the Ordinance having registration to carry on insurance business and primarily relies on technology for its insurance operations and makes distribution only through digital modes including outbound calls;

(cb) “Microinsurance” means as defined in the SEC (Microinsurance) Rules, 2014;

(cc) “Microinsurer” means insurer as defined in the Ordinance which is allowed to transact the microinsurance only;

(cd) “protection products” means products as defined in the Corporate Insurance Agents Regulations, 2020;

(ce) “Saving products” means products as defined in the Corporate Insurance Agents Regulations, 2020;”

2. In rule 6, after the sub-rule (2), the following new sub-rules shall be inserted, namely: -

“(3) The applicant desirous to obtain registration as digital-only insurer shall provide the following information in addition to the information mentioned in sub-rule (1), namely: -

(a) description of business model of digital-only insurer, its vision, mission and strategic plan;

(b) market analysis along with analysis of business and economic conditions and inherent opportunities;

(c) description of target market or customer segment, along with relevant geographic or demographic factors and strategic plan to access that segment;

(d) need analysis of targeted customer segment, products and services proposed to be offered and illustration of how these will address the customer needs;

(e) distribution strategy, intended partnerships and alliances to be built, and product-wise projected business volume and value from each distribution channel/ mode;

(f) product-wise expected claim ratios along with comparison of claim ratios of similar products in Pakistan and in regional and international markets;

(g) branding, marketing and go to market strategy;

(h) details of payment platform(s) with which the applicant intends to integrate/partner for premium collection and claim disbursements while considering the accessibility and outreach factor;

(i) demonstration of adequacy of human resources capacity with core competencies particularly in the area of technology such as data sciences, artificial intelligence/ machine learning, among others;

(j) risk assessment, with special focus on operational risk and mitigating measures to be taken by the applicant to materialize its strategic plan and achieve the business targets as per submitted financial projections;

(k) details of technology architecture to be deployed for conduct of end-to-end digital only operations in the areas of customer acquisition, underwriting, administration, claims processing and payment, etc. along with implementation plan. Also include the details of vendors/ entities from whom technology systems will be procured or outsourced, technology implementation partners, use of cloud service, where cloud will be hosted, security/ encryption mechanism used by cloud service provider (CSP) and/ or any service level agreement between company and SLA;

(l) results of Vulnerability Assessment and Penetration Testing performed by the Company, if any, and remedial actions taken by the company;

(m) results of third-party independent audit conducted by the applicant on Information Technology and Information System operations, if any;

(n) CV of sponsors/ shareholders and details of sources of capital;

(o) any other information/document as required by the Commission.

(4) The applicant desirous to obtain registration as microinsurer will provide the following information, in addition to the information mentioned in sub-rule (1), namely: -

(a) description of business model of microinsurer, its vision, mission, and strategic plan with special focus on serving the underprivileged societal segment;

(b) market analysis along with analysis of business and economic conditions and inherent opportunities;

(c) description of geographic and demographic segment in which it intends to operate and strategic plan to access that segment;

(d) need analysis of targeted customer segment, target products and services and illustration of how these will address the customer needs;

(e) distribution strategy, intended partnerships and alliances to be built, and product-wise projected business volume and value from each distribution channel/ mode;

(f) product-wise expected claim ratios along with comparison of claim ratios of similar products in Pakistan and in regional and international markets;

(g) branding, marketing and go to market strategy;

(h) risks and mitigating measures to be taken by the applicant to materialize its strategic plan and achieve the business targets as per submitted financial projections;

(i) CV of sponsors/ shareholders and details of sources of capital;

(j) any other information/ document as required by the Commission.”

3. In rule 11, in sub-rule (1), for the table the following shall be substituted, namely:-

Minimum Paid up Capital Requirement	Amount in PKR (million)
Life insurers	700
Non-life insurers	500
Life microinsurers	150
Non-life microinsurers	80
Life digital-only insurers	250

Non-life digital-only insurers	100

4. In rule 14, in sub-rule (1), for clause (a), the following shall be substituted namely: -

“(a) A fixed amount which shall be as follows: -

(i) for life insurer, rupees one hundred and sixty-five million only; and

(ii) for life microinsurer and life digital-only insurer, rupees seventy-five million only;

5. In rule 15, in sub-rule (1), for clauses (a) and (b), the following shall be substituted, namely:-

(a) for non-life insurer, rupees one hundred and fifty million only;

(b) for non-life microinsurer, rupees fifty million only.”; and

(c) For non-life digital-only insurer, rupees seventy-five million only.

6. After rule 62, the following new rules shall be inserted, namely: -

“62A. Allowable classes of business. – (1) For the purposes of sub-section (6) of section 4 of the Ordinance and rule 5 of these Rules, a life digital-only insurer is allowed to transact class 1 and class 4 as stated in sub-section (1) of section 4 of the Ordinance subject to the requirement that digital-only insurance will only cover the individuals and/or natural persons and not the legal persons or any person who is not a natural person.

(2) For the purposes of sub-section (6) of section 4 of the Ordinance and rule 5 of these Rules, a non-life digital-only insurer may transact class 1, 2 7, 8 and class 9 as provided in sub-section (3) of section 4 of the Ordinance subject to the requirement that digital-only insurance will only cover the individuals and/or natural persons and not the legal persons or any person which is not a natural person:

Provided that life and non-life digital-only insurer may sell insurance to legal person for covering the risks of individuals associated with it such as in case of group life insurance or group health insurance or such similar cases where beneficiary of the insurance policy is natural person and not the legal person.

(3) The maximum exposure of a digital-only insurer under a single policy issued by it shall be 5% of the shareholders’ equity of the digital-only insurer plus the related reinsurance available to it under the said policy:

Provided that for the purposes of this sub-rule, the shareholders’ equity shall be taken as per the latest available audited accounts of the digital-only insurer on the date of issuance of the policy.

Provided further that the Commission may revise the percentage of maximum exposure provided in this sub-rule through notification in the official Gazette.

(4) The life digital-only insurer will underwrite protection products only as per classes envisaged in sub-rule (1).

(5) Without prejudice to the requirements of sub-rule (4) above, the Commission may, on application in writing, allow a life digital-only insurer to underwrite life insurance saving products, subject to compliance with the following requirements:

(a) The life digital only insurer shall have minimum paid up capital of at least Rs. 500 million;

(b) The life digital only insurer shall maintain net admissible assets in its shareholders fund in accordance with the requirement of sub-clause (i) of clause (a) of sub-rule (1) of rule 14 of these rules;

(c) The life digital only insurer shall demonstrate technological and operational readiness before the launch of life insurance saving products substantially in accordance with the requirements of rule 62C of these rules.

(d) For all saving products, the life digital only insurer, shall demonstrate its readiness for compliance with the following:

(i) provision of policy illustration to the policyholder in accordance with the requirements of the Director for Life Insurance and Family Takaful Illustrations, 2016;

(ii) pre and post-sale disclosure and communication to be made with the policyholders along with timelines thereof;

(iii) acknowledgment of receipt of policy documentation and terms and conditions by the insurance policyholder;

(e) Where the life digital only insurer intends to issue unit linked contracts, it shall demonstrate its readiness for compliance with the following:

(i) communication of disclosure requirements under rule 6 of the Unit Linked Product and Fund Rules, 2015 to the policyholder through digital modes;

(ii) undertaking of need analysis and unit linked fund suitability analysis under rule 7 and rule 7A of the Unit Linked Product and Fund Rules, 2015 through digital modes; and

(iii) the minimum allocations proposed to be made into the investment account of the insurance policyholders.

    (6) The products underwritten by the microinsurer will be subject to the sum insured limits prescribed under SEC (Microinsurance) Rules, 2014 and as revised from time to time.

    (7) Subject to meeting the minimum paid-up capital, solvency, and other applicable regulatory requirements applicable to life insurer and non-life insurer, as the case may be, the Commission may, on application by the digital-only insurer and/or microinsurer, remove the restriction on classes of business to be underwritten and the requirements of net retained exposure by the digital-only insurer and/ or microinsurer, as the case may be.

62B. Digital-only Insurer to have adequate Reinsurance Arrangements. – (1) The

digital-only insurer will maintain adequate reinsurance arrangements having regard to its exposure, nature and volume of business and risk portfolio, in accordance with the provisions of Section 41 of the Ordinance.

(2) Subject to the requirements of section 42 of the Ordinance, the digital-only insurer shall make reinsurance arrangements with insurers or reinsurers registered under the Ordinance.

Provided that where it is not practicable to comply with the requirements of sub-rule (2) above, the digital-only insurer shall along with its reinsurance arrangements submit reasons for its inability to comply with sub-rule (2) along with supporting documentary evidence thereof.

62C. Digital-only insurer to demonstrate technological and / or operational readiness before commencement of operations.- (1) The Commission may require the applicant

desirous to obtain registration as digital-only insurer to present the system prototype demonstration in operational environment during the registration process to assess the technology and operational readiness level of the digital-only insurer.

(2) The digital-only insurer will develop digital claim lodgment and payment process since inception of operations, and will develop system to provide updates to the policyholder about the stage of claims processing. The digital-only insurer will demonstrate the implementation plan for complete transition to digitalized claims processing comprising of claim intimation, claims assessment and payment.

(3) The Commission may give directions to the applicant desirous to obtain registration as digital-only insurer to make such modifications in its technology, systems, products, solutions, and/ or business model as the Commission may deem fit.

(4) The Commission may conduct onsite inspection of applicant desirous to obtain registration as digital-only insurer or may require it to produce such documents, information, or reports, verified by independent experts for assessment of its technological or operational and/ or commercial readiness, as it may deem fit.

(5) The Commission may levy certain conditions at the time of registration such as number or volume of transactions, number or nature of customers to be enrolled, limits on premium and / or overall business volume or such other elements, to be complied with during specified period of time.

62D. Competence and Capability of Digital-only Insurer.- (1) Without prejudice to anything stated in the Insurance Companies (Sound and Prudent Management) Regulations, 2012, the digital-only insurer should have at least two directors on its Board with at least five years’ experience in digital financial services, or Insurtech or fintech or such other relevant field preferably at senior level.

(2) The digital-only insurer will ensure the availability of technology proficient human resource necessary for the conduct of business operations on digital basis with least involvement of non-tech mode for any aspect of core business.

62E. Digital-only insurer to file products with Commission.- (1) Along with the product details submitted in compliance of Section 13 of the Ordinance, the life digital-only insurer is required to submit, in respect of each product, break-up of profit margins and expenses, associated terms and conditions, benefits, exclusions, expected claim ratios, with special focus on communication of terms and conditions to the policyholders through digital mode, offer and acceptance mechanism, customer enrolment process, premium collection mode, claim lodgment options available to policyholder, claim payment mechanism, and any other aspect related to the insurance policy proposed to be distributed by the life digital-only insurer.

(2) The non-life digital-only insurer is required to submit to the Commission, on semi-annual basis, details of products launched in last six months envisaging product features, rates, benefits, pricing mechanism and all contents specified in (1) above.

(3) The submission made under sub-rule (1) and (2) will be accompanied by the assessment of whether the proposed insurance product has and is likely to provide value to the policyholders for whom it is designed, whether the product is sustainable, and whether the terms of the contract are fair to insured persons along with the basis on which it has assessed the proposed insurance product as meeting the criteria.

(4) The digital-only insurer is required to ensure that anything in the insurance product contents or the promotional material is not misleading or deceptive.

(5) The Commission may, as it may deem fit, require the digital-only insurer to make such changes in the particulars submitted as per sub-rule (1), (2) and (3).

62F. Technological Capability of Digital-only insurer.- (1) The digital-only insurer will develop adequate technological capability to conduct the operations digitally in the areas of customer engagement, customer enrolment, distribution, administration, servicing, claim processing and/ or any other aspect of core operations. This may include inter alia the necessary resources to carry out the business operations, the availability of back-up system for business continuity planning and disaster recovery and arrangements to protect the confidentiality of policyholder data.

(2) The digital-only insurer will make available its technology systems/ platforms along with the details of applications and/ or algorithms used in its business operations, whether proprietary or outsourced, for review or inspection of the Commission, as may be required by the Commission.

(3) The digital-only insurer will comply with the SEC Guidelines on Cybersecurity for Insurance Sector, 2020, and will formulate cybersecurity framework in accordance with the guidance given in the said Guidelines and align its risk management framework with the cybersecurity framework.

62G. Disclosures and Business Conduct Requirements. - (1) The digital-only insurer will

ensure that the key facts relating to insurance policy such as risk insured, sum insured, policy benefits, premium, free look period, period of coverage and any other material fact, are communicated to the prospective policyholder while making the sales pitch before the offer to insurance contract is made. The detailed terms and conditions may be communicated to the policyholder after issuance of insurance policy and the onus of such communication as stated in this sub-rule lies on digital-only insurer.

(2) The digital-only insurer will provide evidence of insurance cover promptly after inception of insurance policy.

(3) The digital-only insurer will obtain necessary information that forms part of proposal form and the beneficiary information including name, CNIC/ passport number or another national identity number and relationship of policyholder with the beneficiary. The insurer will disclose the risk of refusal of claim payment due to non-disclosure of medical or other material information in the proposal form.

(4) In case of loyalty insurance products where policyholders are automatically enrolled, the insurance policy summary envisaging benefits, period of coverage, and claim notifying process will be communicated to the policyholder/ insured person.

(5) The digital-only insurer will take all reasonable steps possible to ensure that potential policyholder is able to take informed decision about the proposed insurance policy. Where intermediaries’ services are used, the digital-only will ensure that intermediaries are taking such steps which enable the potential policyholder to take informed decision about the proposed insurance policy.

(6) The digital-only insurer may provide the policyholder with a copy of the insurance policy in electronic form that enables reproduction and storing.

(7) The digital-only insurer may provide post sale servicing to the policyholder through electronic means, in respect of insurance policies issued by it.

(8) The information about claim lodging process and complaint filing forums will be provided to the policyholder along with the insurance terms and conditions. The digital-only insurer will be first resort for complaint resolution.

(9) The digital-only insurer will seek to enhance inclusive insurance with special focus on section 87 of the Ordinance so as to not create undue discrimination against certain individuals.

62H. Requirements related to AML/ CFT for digital-only insurance.- (1) The digital-

only insurer will comply with the requirements of SEC (AML/ CFT) Regulations, 2020, and as amended from time to time, including but not limited to Customer Due Diligence (CDD), Enhanced Due Diligence (EDD) where applicable, ongoing transaction monitoring, filing of Suspicious Transactions Report (STR), screening of customer database against proscribed persons in accordance with TFS obligations under the United Nations (Security Council) Act 1948 and/or Anti-Terrorism Act 1997, as stated in the SEC (AML/ CFT) Regulations, 2020.

(2) The digital-only insurer may obtain and store the documents and information as required in the SEC (AML/ CFT) Regulations, 2020 digitally.

(3) The digital-only insurer may obtain information directly from customer or through another source such as entity through which customer database is accessed, for example, mobile network operator (MNO) or microfinance bank in case of branchless banking account holder or such other entity with which customer information is available.

(4) The information of source of income will suffice for the purpose of identification of source of funds required under SEC (AML/ CFT) Regulations, 2020 in respect of policies issued by the digital-only insurer and microinsurer subject to limits applicable under these Rules and SEC (Microinsurance) Rules, 2014 as the case may be.

(6) To counter the risk of identity theft, the digital-only insurers are encouraged to verify identity of customer through two-factor authorization, mobile sim ownership verification (CNIC – MSISDN Pairing Authentication) through Pakistan Mobile Network Database, and/ or conduct video call interview with prospective customer at the time of inception of insurance policy.

(7) The digital-only insurer may conduct simplified due diligence of the customer/policyholder as per Regulation 17 of the SEC (AML/ CFT) Regulations, 2020 if it is able to rate the customer/ policyholder as low risk, and justify the decision to rate the customer/ policyholder as low risk in writing.

62I. Digital-only Insurer to be responsible for Policyholder Data Security and

Confidentiality. - (1) The digital-only insurer will ensure fair usage of policyholder information, which it has acquired during the course of its business and may include identity information, financial information, medical/ health related details, among others, and will be responsible for accuracy, safety and confidentiality of policyholder data.

(2) The policyholder information will only be used for the purpose of provision of insurance services to the policyholders and the data will not be shared with any other party except in instances where the applicable regulatory requirements so require.

(3) The insurers will only collect and share the information which is necessary to provide insurance to the policyholder or potential policyholder through the technology-based platforms and not any additional information without the express and informed consent of the policyholder or potential policyholder.

62J. Free look period and accuracy of information.- (1) All life and non-life insurance

policies offered by digital-only insurer, except the group insurance policies, will be subject to free look period of at least fourteen (14) days starting from date of issuance of policy provided and where the policy is cancelled by the policyholder within the free look period, the premium will be refunded to the policyholder in the manner as stipulated in Rule 62 of these Rules.

(2) The disclosure about free look period will be part of key facts required to be communicated to the potential policyholder before the sale of insurance and will also be communicated to the policyholder after the issuance of policy as part of policy terms and conditions and any other medium which is most likely to be viewed by policyholder such as in-app notifications or pop-up messages on opening application/website/ email.

(3) The digital-only insurer will be responsible for accuracy of information presented to the policyholders or potential policyholders through its customer interface and will be liable for any loss caused to the policyholders due to incorrect, inconsistent or incomplete information through its digital customer interface.

(4) The digital-only insurer will ensure that the promotional/ marketing material it uses, whether on its own or through intermediaries or third parties, is accurate, clear, fair and not misleading.

62K. Use of intermediaries or third parties’ services in Distribution and Insurance

Policy Administration. - The digital-only insurer will only use services of insurance intermediaries, or third parties through written agreements, to the extent of digital distribution and/ or policy administration through digital means and will not use non-digital modes of insurance distribution through any intermediary, third party or otherwise.

62L. Place of business and Customer Support. – (1) The digital-only insurer will

establish a physical place of business in Pakistan and will keep the Commission updated about the address of its place of business.

(2) The digital-only insurer will maintain a round-the-clock customer support mechanism, preferably through voice-call/ telephonic helpline and will communicate the details of such helpline to policyholders along with insurance policy.

62M. Electronic Communication.- (1) The digital-only insurer may make all communication with the policyholder using electronic/ digital means while ensuring that the policyholder has received the same.

(2) The communication between the digital-only insurer and the Commission, including submission of documents, reporting and filing as required under the applicable provisions of the Ordinance and Rules and Regulations issued thereunder, may be made electronically/ digitally unless otherwise specified explicitly on case to case basis.

62N. Submission returns by digital-only insurer. - (1) A digital-only insurer shall, in addition to the returns required to be submitted under the Ordinance and these Rules, shall also submit the “Statement of Solvency”, as provided in Annexure – II to these Rules, on a quarterly basis along with the returns required to be submitted under subsection (2) of section 46 of the Ordinance.

(2) The quarterly returns of a life digital-only insurer shall be accompanied by a certificate from its appointed actuary deliberating on the adequacy of capital of the life digital-only insurer and its solvency position.

(3) The annual as well as quarterly returns of a non-life digital-only insurer shall be accompanied by a certificate from an actuary deliberating on the adequacy of capital of the non-life digital-only insurer and its solvency position.

(4) The Commission may at its own expense carry out actuarial investigation of a digital only insurer, from an actuary appointed by the Commission for such purpose.”

[File No. ID/PRDD/DI/2022]

( Ejaz Alam Khan )
Joint Director (CS)