Outsourcing: UK regulator fines insurance company for compliance failings

AIG's UNAT DIRECT Insurance Management Limited used nine call centres to sell general insurance products (mainly personal accident insurance policies) underwritten by another AIG Group company. UNAT had in place procedures to check whether the call centres were authorised by the Financial Services Authority and also systems to check the extent of the compliance resources at the call centres and their processes for compliance monitoring and data security.

However, the company permitted the call centres to start work on the business before the necessary checks had in fact been completed, and they started calling to make sales. More critically, says the FSA, "senior management did not receive adequate management information to enable them to satisfy themselves that the call centres were suitable to carry out insurance sales."

The FSA formed the view that "This lack of effective control and oversight meant UNAT did not carry out an acceptable level of due diligence before the call centres began selling. In one case, UNAT had not completed its due diligence over 250 days after the call centre had begun selling. In another case, a call centre sold insurance when it was not authorised by the FSA to do so - while UNAT's compliance team identified concerns about this call centre's regulatory status at an early stage, UNAT failed to resolve these concerns and the unauthorised call centre continued to sell around 4,000 policies to consumers over a period of six months prior to it becoming FSA authorised."

Margaret Cole, Director of Enforcement at the FSA, said:

"Selling general insurance products to consumers through call centres involves greater risk. UNAT was aware of the higher risk but failed to carry out proper checks on the call centres it used. UNAT's failure to have effective control over its due diligence process exposed customers who bought policies from the call centres to an unacceptable level of risk that they would not be treated fairly. The FSA will impose significant fines on general insurance firms whose management of call centre risks falls below acceptable standards."

Between 14 January 2005 and 22 March 2007, over 150,000 insurance products were sold though the nine call centres. UNAT ceased all sales of general insurance through call centres on 22 March 2007 pending the outcome of a review. UNAT has improved its systems and controls following the recommendations in the review, says the FSA. Since the discovery of these issues, UNAT has been working with the FSA to ensure that no customer has suffered loss by putting in place a comprehensive restitution package.

The case is interesting for in Malaysia AirAsia has entered into an arrangement with American Home Assurance (AHA) (a subsidiary of AIG) under which AirAsia customers' details, including mobile phone numbers, are passed to AHA for the purpose of cold-calling. AirAsia sells via its website a travel insurance product called "GoInsure Protection." According to AirAsia when responding to a customer's complaint at the release of his data for this purpose " AirAsia is providing customers an option to purchase a comprehensive insurance product, as an extension to AirAsia GoInsure Protection." The customer concerned has never purchased Air Asia's GoInsure package, he says. He says that the caller (who disabled transmission of his telephone number) identified himself as calling from American Home Assurance and that it is clear that AirAsia had passed his details to the insurance company with which he has had no direct or indirect dealings.

AirAsia says "AirAsia does not sell or rent any personal information you provide on our web site to any other parties." That, one might consider, is a carefully worded answer to a different question, particularly as it is the norm for call centres to withhold their number, so raising the spectre of AIG's Malaysian subsidiary using call centres where there is not the same protection for data and other matters as provided for in the UK under the FSA and Data Protection regimes.