Insurance & Insurtech Compliance in the United Kingdom

The UK market is open to new insurers and insurtechs, including fully digital distribution, but entry is through a demanding authorisation process. The PRA authorises insurers and supervises them prudentially; the FCA authorises intermediaries, sets conduct rules and is the AML supervisor for insurers in scope of the Money Laundering Regulations. Financial services, AML and sanctions rules apply across the whole of the UK.

The biggest obstacle for a new entrant is usually the authorisation itself, followed by a split compliance model: life and investment-type products carry full customer due diligence (CDD) duties, while general insurance products rely on sanctions, fraud and suspicious activity controls without a formal CDD rule.

1. Who regulates this sector

2. Licensing and authorisation

Insurers. Effecting and carrying out contracts of insurance are regulated activities. The Bank of England states that any firm wanting to be an insurer must be authorised by the PRA with the FCA's consent, after submitting a regulatory business plan showing how it meets the threshold conditions. The two regulators decide independently, and the PRA cannot authorise an insurer without the FCA's consent. On approval the firm receives a scope of permission notice and appears on the Financial Services Register. There is no separate digital licence.

Intermediaries. Brokers, comparison and distribution platforms and managing general agents that arrange or advise on insurance need FCA authorisation for insurance distribution activities.

Embedded insurance. Retailers and travel providers selling insurance alongside their own goods or services may fall within the "connected contract" exclusion in article 72B of the Regulated Activities Order. Since 1 January 2025 it applies only to non-life cover with a premium of £500 or less a year, or £175 or less where the cover complements a service lasting three months or less, and only for specified risks such as breakdown, loss or damage of non-motor goods and certain travel risks. Cover outside those limits needs an authorised distributor.

Operating without authorisation. Carrying on a regulated activity without permission breaches the general prohibition in section 19 of the Financial Services and Markets Act 2000 (FSMA) and is an offence under section 23, punishable by up to two years' imprisonment or a fine on indictment.

3. AML, KYC and customer due diligence

Which insurance business is in scope

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) apply to "financial institutions". Under regulation 10(2)(b) that includes an authorised insurer when carrying out or effecting a contract of long-term insurance, other than a reinsurance contract; the reinsurance carve-out was added by SI 2026/621 from 30 June 2026. Regulation 10(2)(f) covers insurance intermediaries when they act in respect of long-term contracts. The FCA is the AML supervisor for these firms (regulation 7).

General insurance is outside the MLRs. The FCA's specific money laundering rules in SYSC 3.2.6A to 3.2.6J also do not apply to general insurance business or to distribution of general insurance and pure protection contracts (SYSC 1 Annex 1, 1.4R). The FCA notes that its AML guidance is less relevant to general insurers but that they remain subject to the Proceeds of Crime Act 2002. HM Treasury's 2025 National Risk Assessment counts approximately 1,200 insurers in scope of the MLRs.

Core CDD obligations for long-term business

When CDD applies

On establishing a business relationship, on an occasional transaction of £12,000 or more, on suspicion of money laundering, or when earlier identity data is doubtful (regulation 27). Existing customers must be re-checked when their circumstances change.

What CDD involves

Identify and verify the customer, anyone acting for them and any beneficial owner, and understand the purpose of the relationship (regulation 28). Register extracts alone do not satisfy the beneficial ownership check (regulation 28(9)).

Beneficiaries

Record beneficiaries' names, or enough detail about a class of beneficiaries, as soon as they are designated, and verify their identity before any payment (regulation 29(3) to (5)).

Records

Keep CDD records and transaction records for five years from the end of the relationship, then delete personal data unless another basis applies (regulation 40).

Enhanced and simplified due diligence

Enhanced due diligence (EDD) is mandatory for high-risk cases, politically exposed persons (PEPs) and their family and close associates, customers who supplied false or stolen documents, and transactions that are unusually complex or unusually large given their nature (regulation 33). Since 30 June 2026, the mandatory country trigger is limited to countries on the Financial Action Task Force (FATF) "call for action" list; other high-risk countries remain risk factors. For life policies, firms must weigh the nature and identity of the beneficiary, and where a high-risk beneficiary is a company or trust, identify and verify its beneficial owner before payout (regulation 33(4A) and (4B)). Simplified due diligence is available where risk is low; the listed indicators include a life policy with a low premium and a pension policy without an early surrender option that cannot be used as collateral (regulation 37).

Reporting

UK reporting is suspicion-based. Staff in the regulated sector, which includes long-term insurance business, commit an offence if they fail to disclose knowledge or suspicion of money laundering to their nominated officer or the National Crime Agency (Proceeds of Crime Act 2002, section 330 and Schedule 9). The firm must appoint a nominated officer (regulation 21(3)). Where CDD cannot be completed, the firm must not proceed and must consider a disclosure (regulation 31).

4. Identity verification and onboarding

Standard of evidence. Verification must use documents or information from a reliable source independent of the person being verified. Documents issued by an official body, such as passports and driving licences, count as independent even when the customer supplies them (regulation 28(18)). The MLRs do not list mandatory document types; the method must match the firm's risk assessment and the risk of each case (regulation 28(12)).

Electronic identification. Information obtained through an electronic identification process, including electronic identification means or a trust service, counts as reliable and independent where the process is secure from fraud and misuse and gives the assurance needed to manage money laundering risk (regulation 28(19)). Since 26 February 2026, joint guidance from HM Treasury and the Department for Science, Innovation and Technology states that digital verification services certified against the UK digital identity and attributes trust framework and listed on the government register can be used to verify individuals under regulation 28, and that uncertified services cannot reliably be treated as suitable. Firms stay liable for their CDD.

Timing. Verification must be completed before the relationship is established, unless that would interrupt normal business and the risk is low, in which case it must be completed as soon as practicable (regulation 30). Beneficiaries designated by class must be verified before any payment to them.

Reliance and outsourcing. A firm may rely on another regulated firm to carry out CDD, for example a broker, but remains liable for failures and must be able to obtain the underlying data immediately on request (regulation 39). Using an identity provider as an outsourced service is not reliance; the firm is applying its own CDD through the provider.

Corporate customers. For companies, firms must obtain and verify the name, registration number and registered address, take reasonable measures to understand ownership and control, and identify beneficial owners holding more than 25% (regulations 5 and 28). Companies House made identity verification of directors and people with significant control a legal requirement from 18 November 2025, with a 12-month transition period.

5. Digital channels: what's different

Bottom line: the UK rules are largely channel-neutral, but remote onboarding is a risk factor unless it uses a secure electronic identification process, and government guidance now points firms to certified digital verification services.

Remote onboarding as a risk factor

When deciding whether EDD is needed, firms must consider whether the situation involves non-face-to-face relationships or transactions without safeguards such as an electronic identification process meeting regulation 28(19) (regulation 33(6)(b)(iii)). An app or web journey that uses a secure electronic identification process therefore does not of itself push a customer into EDD; one that relies on unchecked self-declared data may.

Certified digital identity

The February 2026 HM Treasury and DSIT guidance is approved guidance for MLR compliance. It ties the regulation 28 test to certification against the trust framework and listing on the digital verification services register established under the Data (Use and Access) Act 2025. Providers must support the record retention in regulation 40.

Embedded and partner distribution

The article 72B exclusion lets online retailers and travel sellers distribute small connected non-life policies without authorisation. Life policies are outside it, so embedded life and investment-type products always need an authorised distributor and full CDD.

Pending

FCA consultation CP26/22 [Proposed, consultation closed 19 Sep 2026] would give insurers more flexibility to provide required disclosures through digital channels, while keeping a durable medium and paper on request.

6. Data protection and biometrics

The UK GDPR and the Data Protection Act 2018, supervised by the ICO, apply to all identity data an insurer collects. Three points bite specifically on onboarding. First, personal data obtained for MLR purposes may only be processed to prevent money laundering, terrorist financing or proliferation financing unless another law permits it or the customer consents, and customers must be told this before the relationship starts (regulation 41). Second, CDD records must be deleted once the retention period ends unless another basis applies (regulation 40(5)). Third, the ICO's biometric guidance treats data used to recognise a person as special category data; explicit consent is likely to be the most appropriate condition, and if no valid condition exists the firm must not use biometric recognition and should offer an alternative.

7. Sector-specific obligations

Misrepresentation and fraudulent claims

Consumers must take reasonable care not to make a misrepresentation when buying or varying a policy, and failing to confirm or correct details when asked can amount to one (Consumer Insurance (Disclosure and Representations) Act 2012, section 2). If a claim is fraudulent, the insurer need not pay it, may recover sums already paid, and may treat the contract as terminated from the time of the fraud (Insurance Act 2015, section 12).

Claims handling

Insurers must handle claims promptly and fairly, not unreasonably reject a claim, and settle promptly once terms are agreed (FCA ICOBS 8.1.1R). Payout identity checks and sanctions screening have to be designed so they do not cause unreasonable delay.

Sanctions

Every firm with FSMA Part 4A permission, which includes all authorised insurers and intermediaries, is a "relevant firm" with a duty to report to HM Treasury if it knows or suspects that a person is designated or has breached financial sanctions, and to report frozen funds it holds (for example, Russia (Sanctions) (EU Exit) Regulations 2019, regulations 70 and 71). Premium receipts and claim payments both need screening.

Failure to prevent fraud

Since 1 September 2025, a large organisation commits an offence if an employee, agent or other associated person commits a listed fraud offence intending to benefit it, unless it had reasonable prevention procedures (Economic Crime and Corporate Transparency Act 2023, section 199). For insurers this extends to agents, introducers and outsourced claims handlers.

8. Risk indicators and red flags

Insurance typologies and indicators

• Investment-type policies: unit-linked, with-profits, bonds and whole-of-life policies used in a chain to clean funds (National Risk Assessment 2025).
• Cash premiums: rare in UK insurance, so cash funding is itself a risk factor (National Risk Assessment 2025).
• Unknown payers: premiums received from unknown or unassociated third parties (MLR regulation 33(6)(b)(iv)).
• Policy assignment: rights assigned to a new beneficiary receiving the policy's value (MLR regulation 29(5)).
• Opaque ownership: complex wholesale and commercial structures that make beneficial owners hard to establish (National Risk Assessment 2025).
• High-risk exposure: cover written in high-risk jurisdictions or involving PEPs, especially in the London market (National Risk Assessment 2025).
• Introducers: overseas introducers and intermediaries with weak anti-bribery controls (FCA, JLT Specialty, 2022).
• False identity: false or stolen identity documents supplied at onboarding (MLR regulation 33(1)(e)).

9. Enforcement and penalties

Money Laundering Regulations. The FCA may impose a civil penalty of any amount it considers effective, proportionate and dissuasive, publish a censure, and penalise officers knowingly concerned in a breach; it may not penalise a firm that took all reasonable steps and exercised all due diligence (regulation 76). Breaching a relevant requirement is also a criminal offence carrying up to two years' imprisonment, a fine, or both on indictment (regulation 86).

FSMA. For breaches of FCA rules such as the financial crime systems requirements, the FCA uses its penalty power in FSMA section 206 and the five-step framework in DEPP 6.5A: disgorgement of benefit; a seriousness figure, usually a percentage of relevant revenue set at one of five levels between 0% and 20%; adjustment for aggravating and mitigating factors; an uplift for deterrence; and a settlement discount.

Example. In June 2022 the FCA fined insurance broker JLT Specialty Limited £7,881,700 for financial crime control failings that allowed over $3 million in bribes to be paid through an overseas introducer to officials at a state-owned insurer. The fine reflected a 30% discount for early settlement on a penalty of £11,259,500.

Supervisory findings. The FCA's June 2026 multi-firm review found insurers' financial crime controls mostly effective, with life insurers strongest. It rated client due diligence controls weak across most large retail firms because their approach was not documented, and expects all insurers and intermediaries to consider the findings.

10. Recent changes and what to watch

• 19 Sep 2026 [Proposed, consultation closed 19 Sep 2026] FCA CP26/22 on simplifying insurance rules, including more flexible digital disclosures; watch for a policy statement.
• 30 Jun 2026 [In force] MLR amendments (SI 2026/621): reinsurance excluded from scope, thresholds in sterling, EDD country trigger narrowed to the FATF call for action list, new wording for unusually complex or large transactions.
• 23 Jun 2026 [Published findings] FCA multi-firm review of insurers' financial crime controls; firms are expected to benchmark against it.
• 26 Feb 2026 [In force] HM Treasury and DSIT guidance on using certified digital identities for MLR checks.
• 9 Dec 2025 [In force] FCA PS25/21 narrowing conduct rules for larger commercial insurance customers.
• 18 Nov 2025 [In force, transition to Nov 2026] Companies House identity verification for directors and people with significant control.
• 1 Sep 2025 [In force] Failure to prevent fraud offence for large organisations.

11. What this means for identity verification

Design onboarding around the product, not the channel: long-term and investment-type products need full verification before cover starts, while general insurance relies on sanctions and fraud controls rather than statutory CDD. Remotely, a certified and registered digital verification service is the clearest route to meeting regulation 28; face matching also works but needs explicit consent and a fallback route. Capture beneficiary details at designation and add a verification and sanctions re-screening step before any payout. Re-verify on assignment, changed circumstances or doubtful data, keep evidence for five years after the relationship ends, then delete it.