Compliance for General insurers
General insurance providers regulated by APRA.
Published obligations that apply to general insurers (13)
- criticalCWLTHNotifiable Data Breach (NDB) scheme
Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
- criticalCWLTHComply with Design and Distribution Obligations (DDO)
Issuers and distributors of retail financial products must have a Target Market Determination (TMD) and distribute consistently with it.
- criticalCWLTHComply with APRA CPS 230 (Operational Risk Management)
APRA-regulated entities must manage operational risk including a comprehensive third-party / outsourcing register from 1 July 2025.
- criticalCWLTHComply with Financial Accountability Regime (FAR) accountability obligations
Banking entities from 15 March 2024; insurers and super trustees from 15 March 2025.
- criticalCWLTHComply with APRA CPS 234 (Information Security)
APRA-regulated entities must maintain information security capability commensurate with the size and extent of threats.
- criticalCWLTHFAR deferred remuneration arrangements (40% deferral 4 years)
FAR accountable persons must have 40% of variable remuneration deferred 4 years.
- criticalCWLTHComply with APRA CPS 220 (Risk Management)
APRA-regulated entities must have a comprehensive risk management framework.
- criticalCWLTHComply with claims handling + settling as a financial service (s 766A)
From 1 January 2022, insurance claims handling is a financial service requiring AFSL authorisation.
- highCWLTHComply with General Insurance Code of Practice (ICA)
ICA Code binds member insurers on conduct + claims + complaints.
- highCWLTHAvoid unfair contract terms in standard form consumer & small business contracts
From November 2023, unfair contract terms carry pecuniary penalties — up to $100M per term (from 28 March 2026).
- highCWLTHPublish a Privacy Policy that meets APP 1
Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.
- highCWLTHManage business interruption claim definitions (post-pandemic precedent)
BI insurance policies must clearly define pandemic exclusions per Federal Court guidance.
- highCWLTHGeneral Insurance Code of Practice 2020
ICA member insurers bound by service standards + claims handling timeframes.