FCA compliance covers the full insurance lifecycle, from product design and pricing through sale, servicing, claims and complaints. The framework includes the Principles for Businesses, the Consumer Duty, the Insurance Conduct of Business sourcebook (ICOBS), product governance in PROD 4, systems and controls (SYSC), the Senior Managers and Certification Regime (SM&CR), financial crime, operational resilience, complaints and regulatory reporting.
Most insurers are also regulated by the Prudential Regulation Authority (PRA), which sets capital and solvency rules, so conduct and prudential duties need to be kept distinct while being governed together. The PRA side is covered in the guide to PRA compliance for banks and insurers.
Simplification of the rulebook does not remove the duty to deliver good outcomes. Boards should treat compliance as an operating system that produces evidence, not as paperwork prepared for an inspection.
The exact rules depend on the business: life, general, protection, wholesale, Lloyd's, or delegated authority chains. Compliance should start with a map of permissions, products, customers, distribution and group entities.
| Framework | What it covers |
|---|---|
| FCA Principles | High-level duties on integrity, skill, management and control, customers and regulators |
| Consumer Duty | Good retail outcomes on products, value, understanding and support |
| ICOBS | Sales, disclosure, communications, claims and post-sale conduct |
| PROD 4 | Product manufacture, target markets, distribution and review |
| SYSC | Governance, risk, compliance, controls, outsourcing and record keeping |
| SM&CR, FIT and COCON | Senior accountability, fitness and propriety, certification and the Conduct Rules |
| Financial promotions | Fair, clear and not misleading marketing |
| Financial crime | Anti-money laundering where applicable, sanctions, fraud, bribery and corruption |
| DISP | Complaints handling and access to the Financial Ombudsman Service |
| Operational resilience (SYSC 15A) | Important business services and impact tolerances for firms in scope |
| SUP | Notifications, reporting and supervision |
| PRA Rulebook and Solvency UK | Capital, solvency, governance and prudential rules for PRA-regulated insurers |
The FCA's Regulatory Priorities report for insurance, published on 24 February 2026, sets out four priorities for the year. They indicate where supervisory attention and information requests are likely to concentrate.
| Priority | What it means for firms |
|---|---|
| Consumer understanding, claims handling and service quality | Evidence that customers understand cover and that claims are handled promptly and fairly, including by outsourced providers |
| Access to insurance | Product and pricing decisions that do not unfairly exclude customer groups |
| Growth and innovation | Room for new products and technology, with governance over their outcomes |
| Simplifying regulation | Fewer prescriptive rules, with outcomes still measured under the Consumer Duty |
The FCA is simplifying the insurance rules in stages. Firms should separate final changes from proposals, assign owners and record effective dates.
| Paper | Status | Content |
|---|---|---|
| PS25/21 | In force from 9 December 2025 | Optional changes giving firms more flexibility in applying the insurance rules |
| Handbook Notice 142 rules | In force from 26 June 2026, with the remainder from 27 July 2026 | Removal of specific rules for payment protection insurance and packaged bank accounts, changes to product governance rules, pricing practices and value measures reporting, and funeral plan reviews |
| CP26/22 | Consultation closed 19 September 2026 | Narrower territorial scope of ICOBS and PROD 4, fewer duplicative disclosures, more digital flexibility, simpler advised sales rules, and minimum PII for intermediaries set in sterling |
Removing prescription does not reduce the expectations under the Principles or the Consumer Duty. Where a specific rule is removed, the firm still needs to show that the outcome it protected is being achieved.
ICOBS is the central FCA conduct framework for non-investment insurance. It covers communications, information about the firm, identifying the customer's demands and needs, product information, cancellation rights, claims handling and product-specific rules.
Its application differs for insurers, intermediaries and firms that do both, so each provision should be mapped to each stage of the customer journey. Policies must then be turned into operational controls across quotes, policy documents, renewals, mid-term changes, cancellations, claims and customer support. Monitoring should test live journeys and customer files, not only the written policy.
The Consumer Duty sits on top of ICOBS and requires good retail outcomes across products and services, price and value, consumer understanding and consumer support. The cross-cutting rules require firms to act in good faith, avoid foreseeable harm and enable customers to pursue their financial objectives. It applies across design, pricing, distribution, communications, claims and servicing.
The FCA uses the Duty as a core supervisory tool and expects evidence based on data. Useful measures include claims acceptance rates, claims complaints, cancellations, renewal behaviour, waiting times, outcomes for customers with characteristics of vulnerability, value measures and differences between channels. Boards should explain what the data shows and what changed as a result. The wider framework is covered in the guide to Consumer Duty compliance in 2026.
Manufacturers need a product approval process, a defined target market, a distribution strategy that fits it, and regular reviews of whether products still meet customers' needs. Significant changes to an existing product need the same governance as a new one.
Product governance should link underwriting, pricing, claims, distribution and outcome data. Persistently low claims acceptance or high complaints in one segment should trigger investigation. Manufacturers and distributors must exchange the information each needs to meet its own obligations, and outcome data should flow between them rather than being treated as commercially restricted.
Brokers and other intermediaries have their own conduct obligations under ICOBS. Before a contract is concluded, the distributor identifies the customer's demands and needs and offers only a contract consistent with them, and gives the customer a standard product information document for general insurance.
Intermediaries disclose the nature of their remuneration and whether they work for the customer or the insurer, and must manage conflicts of interest where commission could influence a recommendation. Under MIPRU 3, they hold professional indemnity insurance at the minimum levels set by the FCA, which CP26/22 proposes to restate in sterling without changing the underlying minimums. Intermediaries holding client money apply CASS 5, with risk transfer agreements recording where premiums are held for the insurer.
Insurers that distribute through appointed representatives, coverholders or managing general agents remain responsible for how their products are sold. Oversight should cover sales quality, customer outcomes and adherence to the agreed target market.
Insurers in scope must show that their products offer fair value. The lowest price is not required, but there must be a reasonable relationship between the total price paid and the benefits customers can expect.
Relevant factors include commission, add-ons, fees, premium finance, exclusions and expected claims experience. The FCA publishes general insurance value measures data, covering claims frequency, acceptance rates, average payouts and claims complaints, which firms can set against their own data. A once-a-year sign-off without data or challenge is weak evidence.
Remuneration across the distribution chain affects value and must be understood by the manufacturer. Distributors should also consider the value of their own service, and governance should set out who is responsible for each part of the assessment and how information flows.
ICOBS 6B sets the pricing rules for home and motor insurance. The renewal price offered to an existing customer must not exceed the equivalent new business price for the same product through the same channel. The rule ended the practice of charging longer-standing customers more.
Compliance requires governance over pricing engines, channels, discounts, manual overrides and product versions. Changes to algorithms or data should be tested before release. Meeting the pricing rule does not settle fair value, consumer understanding or barriers to support, so pricing tests should be linked to outcome testing.
ICOBS 8 requires insurers to handle claims promptly and fairly, give reasonable guidance, not unreasonably reject a claim and settle promptly once terms are agreed. Claims data is core conduct information.
Firms should monitor decline rates, partial settlements, claims complaints, repeated information requests, settlement times, the performance of outsourced loss adjusters and outcomes for customers with characteristics of vulnerability. Rule testing should be combined with outcome testing, since internal service targets can be met while customers still receive poor outcomes, such as repeated unnecessary evidence requests or unclear reasons for a decline.
Where models support triage, fraud detection, valuation or declines, management must understand how they work and what outcomes they produce for different customer groups. Responsibility stays with the firm when third parties or models do the work.
Insurers increasingly use data and models in pricing, underwriting, fraud detection and claims. The FCA applies its existing rules to these uses: the Consumer Duty, the pricing rules, the Equality Act 2010 and data protection law all apply to model outcomes, and accountability sits with named senior managers.
A sound model governance framework records each model's purpose, data sources and owner; tests outcomes across customer groups before and after release; monitors drift; and sets out when a person reviews an automated decision. Boards should receive a periodic view of the material models in use and the outcomes they produce, so that issues such as unexplained price differences between groups are identified early.
Exclusions, excesses, conditions and limits can materially affect cover. The Consumer Duty requires key information to be given at the right time and in a form customers can use, and technically accurate disclosure can still leave an overall impression that misleads.
Firms should test understanding, particularly in digital and automated journeys, using complaints, research, call-centre questions, claims disputes and user testing. Where misunderstanding is widespread, the communication or journey needs to change. Renewal, mid-term change, claims and cancellation communications should be clear and actionable without specialist knowledge.
Marketing, websites, social media and comparison content must be fair, clear and not misleading under ICOBS and the Principles. The overall impression counts, including the headline price, key benefits and material exclusions; a disclaimer in small print does not correct a misleading message.
Governance must cover content created by distributors where the insurer is accountable. Approval should include version control and periodic review, since outdated rates or terms can remain on affiliate sites or archived journeys. Monitoring should include sampling of what is live in the market, not only approval records.
Insurance customers often face vulnerability through illness, bereavement, accident, job loss or the loss of their property. Firms must understand the vulnerability characteristics of their own customer base and respond through product design, communications and support.
Support should be built into claims, collections, renewals and complaints. Management information should show whether these customers receive worse outcomes, and sensitive data should be used proportionately under data protection law. Training should be specific to the role, and quality assurance should test how the training is applied.
Most authorised insurers are within SM&CR. Senior managers need clear responsibilities, must be fit and proper, and must take reasonable steps to control their areas. Statements of responsibilities and management responsibilities maps must reflect actual reporting lines.
The certification regime requires an annual fitness and propriety assessment for staff whose roles could cause significant harm, based on evidence of competence, conduct, complaints and performance. The Conduct Rules in COCON apply to relevant individuals. The FCA's PS26/6 made the regime more proportionate: most changes took effect on 24 April 2026, with further stages on 10 July, 30 July and 1 September 2026, and firms should reflect them in their responsibilities maps and certification processes. The detail is in SM&CR explained.
SYSC covers governance, compliance, risk management, outsourcing, internal controls and record keeping. The provisions depend on regulatory status, but every firm must show clear responsibilities and adequate systems for its scale and complexity.
Monitoring should be risk-based. Firms with delegated underwriting, third-party administrators or multiple distribution channels need more intensive testing. Findings need root-cause analysis and tracked remediation; rewriting a policy does not close an issue. Boards need management information that links product value, claims, complaints, support, incidents, financial crime and outsourcing performance, so they can challenge management.
Insurers commonly rely on managing general agents, coverholders, third-party administrators, loss adjusters, and cloud and technology providers. The insurer remains responsible for its regulatory obligations throughout.
Due diligence covers regulatory capability, resilience, data security, financial strength and the provider's ability to support good customer outcomes. Oversight must examine actual performance, since service levels alone do not show fair treatment, appropriate claims handling or support for customers with characteristics of vulnerability. For material arrangements, contracts should give access, audit and information rights, and exit plans should be documented.
Under PS26/2, from 18 March 2027 firms in scope, including Solvency II firms, must notify the FCA of material third-party arrangements and submit an annual register of them.
Insurers in scope of the operational resilience rules had until 31 March 2025 to be able to remain within impact tolerances for their important business services. The FCA's insights and observations published in March 2026 move the focus to maintaining, testing and improving the framework.
Firms identify important business services from the customer's or the market's perspective, map the people, processes, technology, facilities and third parties behind them, and run severe but plausible scenario tests. Claims, servicing and benefit payments are common important business services. Resilience mapping should be updated after system migrations, acquisitions or new platforms, and from 18 March 2027 operational incidents above set thresholds are reported to the FCA under PS26/2.
The FCA published its insurance financial crime controls multi-firm review on 23 June 2026. It found controls mostly effective, with room for improvement in risk assessments, client due diligence and transaction monitoring.
| Sector | FCA observations |
|---|---|
| Life insurance | Strongest controls overall; transaction monitoring needs improvement |
| Retail insurance | Strong on sanctions, fraud and anti-bribery; risk assessment and client due diligence weaker, with policies often too generic |
| Wholesale insurance | Moderate overall; fraud management limited by management information |
| All sectors | Many firms lacked a formal obligations register and a clear allocation of responsibilities |
The scope of the Money Laundering Regulations 2017 depends on activity: life insurance falls within them, while many general insurance products do not. Sanctions, fraud, bribery and corruption risks apply to every insurer. Firms that do not carry out formal transaction monitoring are expected to document their reasons. The wider expectations are set out in FCA financial crime compliance in 2026.
DISP requires effective complaints handling and access to the Financial Ombudsman Service for eligible complainants. Complaints should feed product governance and Consumer Duty monitoring, and closing cases without root-cause analysis loses valuable information.
Firms should monitor themes, upheld rates, repeat issues and outcomes by customer group and channel. Redress must be fair, consistent and evidenced, and systemic issues may require notification to the FCA or wider remediation. Where internal data shows wider harm, the firm should decide whether a proactive review is needed and record its reasoning. The FCA's new complaints reporting rules apply from 1 January 2027, as covered in complaints handling and the new reporting requirements.
Most UK insurers are regulated by both the FCA and the PRA. The PRA is responsible for prudential safety and soundness; the FCA for conduct and market integrity.
Solvency UK is the domestic prudential framework that replaced Solvency II, covering capital, technical provisions, governance, risk management and reporting. Insurers maintain an Own Risk and Solvency Assessment (ORSA), the insurer's own forward-looking assessment of its risks and capital needs, and need suitable governance and financial resources. Where one decision affects both conduct and prudential risk, such as a change in claims strategy or reinsurance, it should be assessed in one conversation.
Reporting to the FCA and the PRA depends on permissions, products and prudential status. Clear data ownership, review and sign-off keep returns complete, accurate and on time, and every figure should trace back to source systems with adjustments explained.
SUP requires event-driven notifications for significant breaches, matters affecting the threshold conditions and senior management changes. Reporting calendars should separate scheduled returns from escalations that require judgement, and reporting should be included in monitoring and assurance.
A fixed calendar keeps recurring obligations visible to the board and to compliance teams. Frequencies should increase for higher-risk areas.
| Frequency | Activity |
|---|---|
| Monthly | Claims outcome MI, complaints themes, breaches and incidents, outsourced provider performance, overdue remediation |
| Quarterly | Monitoring reviews, product governance outcome data, fair value indicators, financial promotions sampling, regulatory change assessment |
| Annually | Consumer Duty board report, fair value assessments, product reviews, financial crime risk assessment, certification and fitness and propriety, operational resilience self-assessment |
| Annually | ORSA (PRA-regulated insurers), compliance monitoring plan approval, review of material outsourcing and delegated authority arrangements |
FCA supervision of insurers combines sector-wide work, such as multi-firm reviews and data requests, with firm-specific engagement. Firms that prepare in advance answer requests faster and with more consistent evidence.
A workable framework has three layers.
The firm's regulatory compliance service supports insurers with gap assessments, file and outcome testing, board reporting and remediation, coordinated with PRA matters where needed.
The framework can include the Principles, Consumer Duty, ICOBS, PROD 4, SYSC, SM&CR and COCON, financial promotions, DISP, SUP, financial crime rules and operational resilience. PRA-regulated insurers also apply the PRA Rulebook and Solvency UK.
Yes, where the product or service is in scope. Insurers must consider design, target market, fair value, understanding and support, and monitor outcomes alongside ICOBS and PROD 4.
Prompt and fair handling, reasonable guidance, no unreasonable declines and prompt settlement once terms are agreed. Claims and service quality are an explicit FCA priority for 2026.
Most authorised insurers are, with requirements depending on classification. The PS26/6 changes, most of which took effect on 24 April 2026, should be reflected in responsibilities maps and certification.
Most insurers are dual-regulated: the FCA covers conduct and market integrity, and the PRA covers prudential safety, including Solvency UK.
Yes. PS25/21 took effect on 9 December 2025 and further changes applied from 26 June and 27 July 2026; CP26/22 consulted on more changes until 19 September 2026.
Controls were mostly effective, with improvement needed in risk assessments, client due diligence and transaction monitoring, particularly in retail and wholesale insurance.
Buckingham Capital Consulting has supported FCA-regulated firms since 2013 with authorisation, compliance monitoring, financial crime and remediation, and has obtained FCA authorisations and variations of permission for firms including Moneliq. For insurers and intermediaries, the firm tests controls against real products, journeys and distribution chains and delivers a prioritised remediation plan with the evidence the FCA expects.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.