Insurance & Insurtech Compliance in the United States

The United States market is open to insurers and insurtechs, including fully digital ones, but entry runs through state insurance departments rather than a single national authority. Federal law reserves the business of insurance to the states, so licensing, conduct and most data security rules differ from state to state.

The principal authorities are the state insurance regulators (New York's Department of Financial Services is the most prescriptive), the Financial Crimes Enforcement Network (FinCEN) for AML rules on life and annuity products, and the Office of Foreign Assets Control (OFAC) for sanctions across all lines.

The biggest practical obstacle for a new entrant is not a single identity rule but the absence of one: an insurer selling annuities or permanent life online must decide for itself what customer information and verification its AML programme needs, document why, and prove that its distribution partners follow it.

1. Who regulates this sector

The McCarran-Ferguson Act subjects the business of insurance, and everyone engaged in it, to the laws of the states, and federal statutes do not override state insurance law unless they relate specifically to insurance (15 U.S.C. 1012). Federal agencies therefore regulate particular risks (money laundering, sanctions) rather than the business as a whole.

Health insurers are also subject to federal health privacy rules administered by the Department of Health and Human Services. Variable insurance products that are securities bring broker-dealer regulation into play.

2. Licensing and authorisation

An insurer needs authority from each state in which it writes business, and agents and brokers are licensed under the same state insurance laws. There is no separate online insurance licence: a digital insurer or insurtech carrier holds the same state authority as a traditional carrier, and an insurtech that only distributes another carrier's products operates as a licensed agent or broker. Application processes, capital requirements and timelines are set state by state.

Licensing status also determines which state cybersecurity rules apply. New York's Part 500 covers any person operating, or required to operate, under a licence or similar authorisation under the Insurance Law, regardless of other regulators' oversight (23 NYCRR 500.1(e)). An agent or broker that is covered by its principal's cybersecurity programme need not build its own (23 NYCRR 500.19(b)).

The Federal Insurance Office has no power to license or supervise insurers. Its statutory role is to monitor the industry, coordinate international prudential matters and advise the Treasury (31 U.S.C. 313(c) and (k)).

3. AML, KYC and customer due diligence

Which insurers are in scope

The Bank Secrecy Act lists an insurance company as a financial institution (31 U.S.C. 5312(a)(2)(M)). FinCEN's implementing rule applies to any person engaged in the United States as a business in issuing or underwriting a covered product: a permanent life policy other than group life, an annuity other than a group annuity, or any other insurance product with features of cash value or investment (31 CFR 1025.100(b) and (g)). FinCEN's guidance confirms that group products, term (including credit) life, property, casualty, health and title insurance, reinsurance and retrocession are not covered products. The test is functional: a new product with cash value or investment features is covered, whatever it is called.

Agents and brokers are excluded from the definition of insurance company (31 CFR 1025.100(g)(2)) and have no separate AML programme obligation under this rule.

The programme

A covered insurer must maintain a written AML programme for its covered products, approved by senior management, with four minimum elements (31 CFR 1025.210): risk-based policies, procedures and internal controls; a designated compliance officer; ongoing training; and independent testing. The policies must integrate the insurer's agents and brokers into the programme and obtain all relevant customer-related information needed for an effective programme. An insurer registered as a broker-dealer satisfies the rule for its broker-dealer activities through its broker-dealer programme.

No customer identification programme rule

Insurers are not subject to a Customer Identification Program (CIP) rule with minimum mandatory identifying information and verification, as banks and broker-dealers are. FinCEN's guidance (FIN-2006-G010) states this expressly, and adds that other Bank Secrecy Act duties still require insurers to obtain and retain customer information. The beneficial ownership rule at 31 CFR 1010.230 does not apply either, because insurers are not among the covered financial institutions listed in 31 CFR 1010.605(e). Identification standards are therefore a design decision inside each insurer's risk-based programme.

Reporting and records

Suspicious activity reports

Required for transactions involving a covered product of at least $5,000 that the insurer knows or suspects are suspicious. File within 30 calendar days of initial detection, extendable to 60 days if no suspect is identified (31 CFR 1025.320). The insurer reports activity conducted through its agents and brokers. Retain the report and supporting documents for five years.

Cash over $10,000

Insurers do not file currency transaction reports. Receipt of more than $10,000 in currency in one or related transactions is reported on Form 8300 within 15 days, and the insurer must verify the payer's identity (31 CFR 1025.330 and 1010.330). Copies are kept for five years.

A SAR is not required for false information submitted to obtain a policy or make a claim unless the insurer believes it relates to money laundering or terrorist financing (31 CFR 1025.320(c)).

4. Identity verification and onboarding

Because there is no CIP rule, no federal regulation lists accepted identity documents, requires documentary or non-documentary verification, or specifies biometric or liveness methods for insurance customers. What an insurer verifies, and how, follows from its own risk assessment of its covered products, customers, locations and distribution channels, which FinCEN's guidance names as the factors to weigh. Two federal rules do fix identity points:

• Cash payments. When reporting currency over $10,000, the insurer must verify the payer's identity by examining a passport, alien identification card or other official document for a person claiming to be a non-citizen, or a document normally accepted when cashing cheques for others (31 CFR 1010.330(e)(2)).
• Sanctions. OFAC prohibits issuing a policy to a blocked person, and a deposit sent with such an application must be blocked and reported within 10 business days (OFAC FAQ 62).

Reliance on agents is permitted within limits. Where an agent is affiliated with another institution that has its own AML programme, the insurer may reasonably rely on that programme for point-of-sale checks if it knows of no defect, while its own programme concentrates on ongoing administration of the product (FIN-2008-G004, question 7). The insurer remains responsible for the overall programme.

5. Digital channels: what's different

Bottom line: the federal AML and sanctions rules are channel-neutral, so selling online does not add or remove an identity requirement; what changes is who collects the customer's data, how documents are signed and delivered, and the cybersecurity duties that attach to customer-facing systems.

The insurer collects what agents used to

The AML rule requires insurers to obtain customer information "from all relevant sources, including" agents and brokers (31 CFR 1025.320(a)(3)), and FinCEN describes agents as often best placed to know the source of funds and the purpose of a purchase. In a direct online sale there is no agent to ask, so the questions an agent would cover (purpose, source of funds, relationship to beneficiaries) need to be built into the digital application. Embedded distribution by a non-insurer partner raises the same oversight duty the rule imposes for agents.

Electronic signatures and records

The Electronic Signatures in Global and National Commerce Act (E-SIGN) applies expressly to the business of insurance (15 U.S.C. 7001(i)). Where a law requires information to be given to a consumer in writing, an electronic record satisfies it only if the consumer has affirmatively consented after receiving the prescribed disclosures (15 U.S.C. 7001(c)). Notices cancelling health insurance or life insurance benefits (excluding annuities) cannot be given electronically under E-SIGN (15 U.S.C. 7003(b)(2)(C)).

Customer-facing systems are an enforcement target

DFS penalised eight auto insurers more than $19 million in October 2025 after attackers took driver's licence numbers and dates of birth through public quoting applications and agent portals. Prefilled quote flows that display identity data before the customer is verified are the pattern regulators have acted on.

6. Data protection and biometrics

There is no single federal data protection statute or authority in the United States. For insurers, the Gramm-Leach-Bliley Act's privacy and safeguarding duties are enforced under state insurance law by the insurer's domiciliary state insurance authority (15 U.S.C. 6805(a)(6)), and health insurers also fall under federal health privacy rules.

Identity capture data is squarely within state insurance data security rules. NAIC Model #668, where enacted, treats biometric records, Social Security numbers and driver's licence numbers linked to a consumer as nonpublic information, requires a written information security programme based on a risk assessment, oversight of third-party service providers, and notice to the commissioner within 72 hours of determining that a qualifying cybersecurity event occurred. Its multi-factor authentication provision is permissive: effective controls "may include" it. New York's Part 500 goes further (section 7). Some states also have biometric privacy statutes that regulate consent and retention for facial geometry used in selfie checks; requirements vary by state and should be reviewed before deploying face matching.

7. Sector-specific obligations

Sanctions across the policy lifecycle

OFAC holds underwriters, brokers and agents responsible for sanctions compliance throughout their involvement with a policy (OFAC FAQ 62). If an existing policyholder or named beneficiary becomes blocked, the insurer must block the policy or the relevant portion, report within 10 business days, place future premiums in a blocked interest-bearing account and seek a licence for any payment (FAQ 63). OFAC recommends screening at renewal, amendment, addition of insureds or beneficiaries, claim submission, claim payment and list updates, and warns that screening only at issuance leaves exposure (FAQ 65). Liability is strict. OFAC regulations preempt conflicting state insurance rules on withholding claims or cancelling policies (FAQ 61).

Oversight of agents and brokers

The insurer must train its agents and brokers (directly, or by verifying training by another insurer or a competent third party), monitor their compliance, and include them in independent testing (31 CFR 1025.210(b)). FinCEN expects an insurer facing a non-compliant agent to secure compliance and, where appropriate, end the relationship.

New York cybersecurity: the worked example

23 NYCRR Part 500, as amended with effect from November 2023, applies to every DFS-licensed insurer, agent and broker. Since 1 November 2025, section 500.12 requires multi-factor authentication for any individual accessing any of the covered entity's information systems; entities under the small-business thresholds (fewer than 20 employees, under $7.5 million revenue or under $15 million assets) must still use it for remote access, cloud applications holding nonpublic information and privileged accounts. A chief information security officer may approve equivalent compensating controls, reviewed at least annually. Cybersecurity incidents must be reported to DFS within 72 hours, and extortion payments within 24 hours.

8. Risk indicators and red flags

Insurance red flags identified by FinCEN

• Mismatched purchase: a product inconsistent with the customer's evident needs.
• Unusual payment: cash, cash equivalents or structured monetary instruments where that is not normal.
• Early exit: termination soon after purchase, including in the free-look period, especially at a cost to the customer.
• Third-party refunds: payment by, or refunds directed to, an apparently unrelated third party.
• Benefit transfer: assigning the product's benefit to an apparently unrelated person.
• Exit focus: little interest in performance but close interest in surrender terms.
• Thin identity: reluctance to provide identifying information, or minimal or apparently fictitious details.
• Early maximum loan: borrowing the full available amount soon after purchase.

9. Enforcement and penalties

Bank Secrecy Act. Civil penalties are set per violation and inflation-adjusted in 31 CFR 1010.821, last adjusted in January 2025: up to $1,430 per negligent violation, up to $111,308 for a pattern of negligent activity, and, for wilful violations, the greater of the amount involved (capped at $286,184) or $71,545. FinCEN may also impose penalties for failure to maintain an AML programme as a violation of the Act (31 CFR 1025.210(d)).

Sanctions. The civil maximum under the International Emergency Economic Powers Act is the greater of $377,700 or twice the transaction value; wilful violations carry criminal fines up to $1,000,000 and up to 20 years' imprisonment (31 CFR 505.401, consolidated September 2026).

State cybersecurity. Under Part 500, a single prohibited act, a failure to secure nonpublic information due to non-compliance, or a material failure to comply for any 24-hour period each counts as a violation (23 NYCRR 500.20(b)); DFS weighs cooperation, good faith, intent and history. Recent actions against insurers include the October 2025 settlements with eight auto insurers totalling more than $19 million, two of which also failed to report on time, and an April 2026 $2.25 million penalty against Delta Dental entities after attackers exploited a file transfer vulnerability and exfiltrated Social Security, licence and health data.

10. Recent changes and what to watch

• 30 September 2026 [In force] OFAC moved its penalty provisions into a consolidated Part 505. The penalty amounts are unchanged; update internal references.
• 30 April 2026 [In force] DFS fined Delta Dental $2.25 million under Part 500, signalling continued enforcement of incident response and reporting duties against insurers.
• 10 April 2026 [Proposed, comments closed 9 Jun 2026] FinCEN proposed rewriting all AML programme rules, including 31 CFR 1025.210, around a risk assessment process, with an effective date 12 months after any final rule.
• 1 November 2025 [In force] New York's universal multi-factor authentication and asset inventory requirements took effect for all covered entities.
• 14 October 2025 [In force] DFS settlements with eight auto insurers over online quoting portal breaches; expect scrutiny of any public flow that returns identity data.
• 13 November 2024 [In force] OFAC updated its insurance FAQs and added guidance on claims involving blocked persons, emphasising recurring screening beyond issuance.

11. What this means for identity verification

Insurers have unusual freedom, and therefore unusual accountability, in choosing identity methods. For covered life and annuity products, the AML programme should state which identifying data is collected, how it is verified remotely (for example document checks, face match and liveness, or database checks), what triggers enhanced review, and why those choices fit the product risk. Non-covered lines need no AML identity programme but still need sanctions screening of applicants, insureds and beneficiaries.

Re-verification points follow the policy lifecycle rather than login alone: OFAC's guidance points to renewal, beneficiary changes, claims and payouts, and FinCEN's red flags concentrate on early surrender, loans and third-party payments. Identity checks at those points, especially before paying a surrender or claim to a new account, address both risks.

Retention runs to five years for SARs, Form 8300 reports and, under NAIC Model #668, cybersecurity event records. Biometric data captured in onboarding is nonpublic information under state insurance data security laws and may also fall under state biometric statutes, so collection, consent and deletion schedules should be set per state. Where distribution runs through agents or embedded partners, contracts should specify what identity data the partner collects and how the insurer audits it.