The Future of Insurtech: Partnerships, Legal and Regulatory Change and the Need for Cyber Resilience

As the insurance landscape changes, regulators will need to consider whether the current approach is still appropriate. Two main areas of change that are immediately foreseeable are product design and distribution, and disclosure.

In Australia, following the passage of the Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Act 2019 (Cth), accountability for product design and distribution will shift onto issuers and distributors, such that insurance products will need to be designed with a particular consumer in mind. This legislative change is intended to ensure that complex financial products which are not always easily understood by consumers are aimed at the right markets.

Leveraging big data and analytics, insurtechs are uniquely positioned to help insurers provide insurance products that are tailored to a specific consumer and can also evaluate the suitability of an insurance product with a greater degree of efficiency and accuracy.

The focus of many insurtechs on providing more direct accessibility for consumers will also challenge the current disclosure requirements for retail products. In Australia, these are set out in Chapter 7 of the Corporations Act 2001 (Cth). Products which are designed to provide quick and simple solutions for customers may not readily satisfy the current disclosure requirements in every jurisdiction in APAC. Many predict that further changes can be expected to the disclosure regimes as the demand for point-in-time insurance services increases.

Cyber resilience

As the industry accelerates into the digital economy, there will also be a growing need to ensure cyber resilience. Mr Wayne Byers, Chairman of the Australian Prudential Regulation Authority has commented that cyber defense should not be in any way seen as a competitive battleground, or an issue of tension or friction between regulators and the industry, or industry participants and each other. Intelligence in respect of maintaining cybersecurity should be shared for the common good. Ultimately, the collective effort between government and intelligence agencies, regulators and the private sector can help to protect the financial services industry.

To ensure compliance with mandatory notification laws under the Privacy Act 1988 (Cth), industry participants must carefully consider the practical issues that arise in relation to data retention, responding to a data breach, and the unique crisis management challenges that these events can cause.

In order to partner with some of the largest financial services companies in Australia, insurtechs will need to have in place adequate systems and processes to achieve privacy compliance and must be able to evidence that in any later incident. This will involve putting in place appropriate information handling practices and being prepared to expeditiously assess and respond to larger data breach incidents.