The Saudi Arabian Monetary Authority (SAMA) issued on 17 November 2012 the outsourcing regulation for insurance and reinsurance companies and insurance services providers (the Regulations) operating in the Kingdom of Saudi Arabia (KSA). The regulations are progressive by regional standards, allowing outsourcing to entities outside of KSA, but will need to be carefully considered by insurance sector players. This is not least because the regulations apply equally to functions performed by group entities as well as third parties.
The Regulations require that outsourcing arrangements should be recorded in a legally binding contract. The contract must comply with Saudi law and contain specific details provided by the Regulations, including service levels and performance standards and data protection provisions. The contract should be governed by Saudi law and subject to the jurisdiction of the Saudi courts (unless otherwise approved by SAMA). In addition, it is necessary for an insurance sector player to have analysed the business case and suitability of the outsourced service provider (even where that entity is another group company). Such analysis must be reassessed at least on an annual basis.
It is important to note that dealing with reinsurance companies and insurance/reinsurance brokers, agents, insurance claims settlement specialists (i.e., third party administrators), surveyors, loss assessors, loss adjusters, actuaries, and insurance consultants, is not considered an outsourcing arrangement for the purpose of these Regulations. In addition, any dealings with Service Providers required by law falls outside the scope of these Regulations.
The Regulations differentiate between material outsourcing and non-material outsourcing. In the context of material outsourcing additional requirements apply. For these purposes material outsourcing includes any arrangement which, if disrupted, has the potential to significantly impact on an entity's business operations, reputation or profitability. No material outsourcing is permitted without SAMA's prior written no objection. The outsourcing of material functions, such as underwriting, claims handling, investment, risk management, finance, internal audit, compliance and primary-decision making processes, must be approved by SAMA on a case-by-case basis for each individual function.
Consider the example of an insurer in KSA which utilises the services of a group entity elsewhere in the world to provide specialist underwriting support for specialist classes of business. Such an arrangement may provide the insurer with a competitive advantage where the local market does not have the necessary skills to underwrite such business. Because the outsourcing involves underwriting and may also involve the primary decision-making process being outside of the country it would amount to the outsourcing of a material function in addition to being outsourcing overseas. If such an arrangement is already in place it is necessary to seek a no objection from SAMA retrospectively within 120 days of the issuance of the regulations. Any new arrangement must be submitted to SAMA at least 60 working days prior to the commencement of the arrangement together with supporting information detailing the functions to be outsourced, highlighting such functions as material and the reason for the outsourcing.
In the context of material outsourcing, sub-contracting of services by the outsourced service provider is only permitted with the prior approval of SAMA. This requirement is particularly challenging for large international groups which may provide human resources, finance, information technology, internal audit etc. on a group-wide basis through different entities in the group. Careful consideration will be required in order to determine whether separate contracts with each group entity is more appropriate than a single contract with an appropriate group holding company under which functions are to be sub-contracted to other group entities.
In other cases of material outsourcing, compliance could become more stringent. For example, outsourcing of investment activities requires, prior to obtaining SAMA's prior no objection, that such arrangement be in compliance with the investment regulations issued by SAMA and the internal investment policies approved by the General Assembly of an insurer which were set in accordance with the investment regulations. Such activities should be addressed in the internal policies of insurers to prevent them from entering into transactions without the approval of their shareholders. Those insurers that have established their investment policies prior to the issuance of the Regulations will need to amend their policies to reflect the requirements for such approvals, if this was not mentioned in the current policies.
Another example is risk management, which is also subject to the risk management regulations issued by SAMA in December 2008. Outsourcing of risk management should be approved in the internal risk management policies of insurers prior to obtaining SAMA's prior no objection.
Third Party Administrators (TPAs) are also significantly affected by these new Regulations. Although they are not many, most of the medical TPAs in KSA are part of a multinational group of TPAs. The requirements set by the Council of Cooperative Health Insurance (CCHI) to qualify TPAs increases the cost of operations on Saudi licensed and qualified TPAs. Accordingly, these TPAs tend to outsource a significant bulk of their claims handling to related entities in other jurisdictions where manpower is much lower.
Another example whereby these Regulations are triggered for TPAs is outsourcing information system management and maintenance. These are also classified as material outsourcing. In practice, TPAs and Insurers deal with information technology companies that provide services of electronic linkage between health service providers, TPAs and insurers. This service is essential to guarantee proper connection and up-to-date exchange of information between parties of a health insurance. Furthermore, TPAs and insurers receive bulks of paper documents. Subsequently, they tend to outsource scanning and data entry services to third parties. These examples have been existing prior to these new Regulations. Accordingly, all insurance sector players have to expose these matters to SAMA to obtain the required approvals, and thus, should make sure these contracts are amended to cover all requirements set forth by the Regulations.
A clear driver for SAMA in introducing the regulations is to ensure that it has visibility of all functions that are outsourced and access to information held by the outsourced service provider. For this reason the regulations include extensive provisions governing the handling of data and include a requirement that all data held by the outsourced service provider is segregated from its other data pools. In the context of outsourcing to an entity outside of KSA it is necessary to have confidentiality provisions in place regarding the services and to ensure that SAMA has a right of access to the entity providing the outsourced service. This right of access must be either in the format of a standard provision approved by SAMA or supported by a legal opinion to be issued by the insurance sector player's lawyers to SAMA.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
