Sl. No.

Guidelines

1.

Applicable to insurers, reinsurers and distribution channels (including insurance intermediaries).Extends to foreign reinsurance branches as well and requires them to adopt either the host jurisdiction’s framework or the Guidelines depending on whichever framework is more comprehensive.

2. 

Fraud was broadly classified in the following categories based on the perpetrator involved:

(i) policyholder fraud and/or claims fraud;

(ii) intermediary fraud, i.e., perpetuated by insurance agent/corporate agent, intermediary, third party administrators; and

(iii) internal fraud, i.e., by a director, manager or staff of the insurer.

The Guidelines recognize two additional categories of fraud i.e.:

(i) external fraud, involving external parties, service providers, vendors; and

(ii) affinity fraud or complex fraud, involving collusion among one or more fraud perpetrators.

Recognizing the growing threat of insurance fraud carried out using digital or new age technologies, the Guidelines require insurers to establish and implement robust cybersecurity frameworks and utilize a team with relevant risk and technological expertise to manage cyber fraud risks across various insurance business lines.

3.

4.

Insurers to have a board approved anti-fraud policy in place, to be reviewed annually.

The circular set out the aspects that must be broadly covered as part of the anti-fraud policy, including among others:

(i) procedures for fraud monitoring;

(ii) identification of potential areas of fraud;

(iii) coordination with law enforcement agencies; and

(iv) due diligence of personnel, intermediaries, vendors etc.

The requirement for a board approved policy continues and under the Guidelines, the policy must now also include: (i) red flag indicators, based on their experience/line of business, to assist them with detection of frauds; and (ii) mechanism for appropriate action in case of non-compliance to the fraud risk management framework and against the fraud perpetrators.

In general, the Guidelines require the policy to be detailed and set out internal turnaround times from identification to remedy and clearly identify responsibilities of different officers.

Insurers must also conduct post-incident reviews to identify missed detection opportunities and implement system improvements after a fraud event.

5.

The risk management committee (“RMC”) of the insurer is responsible for effective implementation and oversight of anti-fraud framework formulated under the Guidelines.

The Guidelines formalize the governance framework for fraud monitoring and require every insurer to establish a:

(i) Fraud monitoring committee: The FMC will be responsible for operationalizing the Framework and must be headed by a senior key managerial person and include senior representatives of relevant departments such as underwriting, claims and legal.

 (ii) Fraud monitoring unit: This unit will function independently from internal audit and support the FMC in discharging its functions.

6.

The FMF was responsible to:

(i) lay down procedures for internal reporting from/and to various departments; and

(ii) furnish periodic reports to the board of directors.

The Guidelines provide a multilayered oversight structure and provide that the FMC must: 

(i)  submit quarterly reports to the RMC on its activities, findings and recommendations and the financial impact of any fraud on the insurer;

(ii)  submit a report of the annual fraud risk assessment undertaken by them to the board of directors through the RMC; and

(iii)  report all internal frauds to the audit committee in addition to the RMC.

As part of the measures to detect and prevent fraud, insurers are also required to maintain an incident database of persons convicted of or attempting fraud and conduct fraud-sensitive audits for compliance with the framework.

7.

Insurers were annually required to provide details to the IRDAI of:

(i) outstanding fraud cases; and

(ii) closed fraud cases.

Insurers are required to report fraud incidents to law enforcement agencies as per applicable laws.

The Guidelines also mandate insurers to file annual returns with the IRDAI to report, among others:

(i) cases detected, closed and unresolved in that year for different categories of fraud;

(ii) details of any cyber fraud faced and its financial impact – this has to be reported separately from the general fraud cases; and

(iii) age-wise analysis of unresolved cases.

Any fraud involving distribution channels registered with the IRDAI must be reported to the IRDAI without delay. This is more expansive than the reporting obligations under the 2013 Circular.

8.

To effectively prevent fraud in the insurance sector and utilize the data available with insurers, the Guidelines mandate insurers to participate in the fraud monitoring technology framework developed by the Insurance Information Bureau (“IIB”).

IIB will facilitate timely threat intelligence sharing within the insurance industry through the industry-wide database and maintain a caution repository containing information on blacklisted distribution channels, vendors, hospitals, and known fraud perpetrators.