Clear Horizon Discuss your requirements

Regulatory notes

Delegated underwriting authority: KYC for MGAs, coverholders and insureds

A binding authority creates two distinct compliance questions: who is authorised to act for the insurer, and how customer due diligence and sanctions controls are performed when risks are bound through an intermediary. The applicable perimeter has to be established before the arrangement can be characterised as third-party reliance or outsourcing.

First published
8 October 2026
Last revised
8 October 2026

Under a binding authority agreement, an intermediary may accept risks and issue insurance documentation on an insurer’s behalf. Commercially it is described as a managing general agent (MGA) or coverholder. The insurer may learn of risks written under the authority only after inception, through periodic bordereaux.

This creates two legally distinct questions. The first concerns the intermediary: its identity, ownership, authorisation and fitness to exercise delegated powers. The second concerns the business written under those powers: which due diligence, screening and monitoring requirements apply, and who performs them. The binding authority alone does not answer the second.

The regulatory perimeter comes first

Article 2(12) of Cabinet Resolution No. 134 of 2025 covers life and other investment-related insurance, including activities conducted through insurance agents and brokers. It does not by itself extend the full statutory customer due diligence regime to every non-life policy, and many delegated authorities cover non-life classes. Article 2 classifies the person by the activities it carries on, however, so for a composite insurer the non-life character of a particular risk does not answer the classification question. Targeted financial sanctions requirements and insurance regulatory controls apply independently. The analysis is set out in the note on the 2025 instruments and the insurance perimeter.

Jurisdiction matters too. Article 2 of Federal Decree-Law No. 6 of 2025 excludes the financial free zones and institutions regulated by their authorities from that Central Bank legislation; it creates no general exemption from federal anti-money laundering law. Activities in the DIFC and ADGM require separate consideration of the DFSA or FSRA framework alongside federal requirements, and an ordinary commercial free zone is not a financial free zone.

The Central Bank’s 2022 Guidance for the Insurance Sector remains in force but was drafted under the preceding federal legislation. It is read together with the 2025 instruments and cannot override them.

The intermediary is a counterparty and a channel

The intermediary is a contractual counterparty and a channel through which business reaches the insurer. Before granting authority, the insurer should establish its legal identity, ownership and control, management, regulatory status, territorial permissions and authority for the activities it proposes to perform. Section 3.7 of the guidance expects agents and brokers to be screened before they are engaged. The Article 10 beneficial ownership sequence governs legal-person customers where statutory due diligence applies; it does not apply automatically to an intermediary merely because it is a service provider, so the basis of the insurer’s enquiry should be identified.

The commercial title does not determine classification. Section 2.1 of the guidance describes an insurance agent as “any natural or legal person approved and authorized by the insurance company to carry out insurance operations” and states that “All insurance agents are “tied” agents”, while brokers may act for several insurers. An intermediary holding authorities from several insurers should not automatically be treated as a tied agent, nor is the title MGA or coverholder proof of a licence.

The file must remain current: changes in ownership, permissions, management, subcontracting or control standards may alter the assessment, and a satisfactory file at appointment says nothing about the relationship later in its term.

Whose customer due diligence is being performed?

Where an authorised intermediary concludes a contract on the insurer’s behalf, the insurer remains the contractual risk carrier, subject to the terms of the arrangement and applicable law. The policyholder, insured person, premium payer and beneficiary may nevertheless be different persons, and their identities and obligations must be assessed under the relevant framework. In reinsurance, the cedant ordinarily stands in the contractual relationship with the reinsurer; the original insured is not automatically the reinsurer’s customer.

Where customer due diligence is required and an intermediary performs it, Article 20 of the Resolution requires the arrangement to be characterised by its substance. Reliance under Article 20(1) depends on conditions, including the third party’s regulated and supervised status; an intermediary lacking that status cannot qualify merely because it holds binding authority, and responsibility for accuracy is not transferred. The conditions are considered in the note on relying on another participant’s due diligence. Article 20(3) separates from reliance the outsourcing or agency case, where the provider works under the institution’s own policies, subject to its supervision and control, with fitness and propriety standards and effective audit procedures for relevant staff. It defines a boundary; it does not authorise every outsourcing relationship.

If neither arrangement is properly established, the assumption that the intermediary did the work is not evidence of compliance. Conversely, where statutory due diligence does not apply to the activity, Article 20 should not be invoked as though it created the obligation.

The supervisory guidance adds further requirements

Section 3.6 of the Guidance for the Insurance Sector treats reliance and outsourcing as distinct models, associating the first with brokers and the second with tied agents; the examples do not replace an assessment of the actual position. Section 3.6.1 states that insurers “are not permitted to rely on third parties to conduct ongoing monitoring of business relationships”, although that function may be outsourced. Section 3.6.2 states that “an insurer should therefore include any outsourced entity in its own AML/CFT program and internal control processes”. In either model, “the insurer retains ultimate responsibility for the implementation of applicable AML/CFT preventive measures”.

The Central Bank’s Guidance on Customer Due Diligence/Know Your Customer and Record-Keeping, in force from 7 November 2025, adds expectations on reliance. Section 3.10 refers to the submission of a non-objection certificate or letter of the third party to the Central Bank for approval. It also states that third-party reliance does not apply to outsourcing, service provider, vendor or agency relationships, and is acceptable only in relation to other financial institutions or designated non-financial businesses and professions, typically with their own relationship with the customer. Section 3.10 cites the corresponding provision of the former executive regulations; the operative provision is now Article 20 of the Resolution.

Where an MGA or coverholder performs customer due diligence on the insurer’s behalf in its capacity as agent, the arrangement should ordinarily be assessed as outsourced or agency-based performance rather than third-party reliance. The intermediary’s status and the actual operating arrangements must nevertheless be examined before that characterisation is adopted.

A further layer is the Central Bank’s Operational Risk Management Regulation, in force from 14 September 2026 and applicable to licensed (re)insurance companies. Article 13.3 requires a risk assessment and due diligence before a third-party service provider arrangement is entered into; Articles 13.6 to 13.11 address contracts, records, subcontracting and exit. Under Article 13.5, an LFI must obtain the Central Bank’s prior notice of non-objection before outsourcing an activity that, if disrupted, could have a significant impact on its critical operations. Whether delegated functions meet that threshold must be assessed rather than assumed.

Where the arrangement becomes evidence

The binding authority agreement, supporting procedures and evidence of actual supervision should establish:

  • which due diligence and sanctions requirements apply, and which party performs each control;
  • whose procedures the intermediary applies, and the legal basis for that model;
  • which risks may be bound without referral, including escalation of financial-crime concerns;
  • how the insurer supervises performance through reporting, file reviews, testing, audit and remediation;
  • what personnel screening, training, fitness and propriety, and audit arrangements apply to those performing compliance measures; and
  • how records remain accessible during the relationship, after termination and on supervisory request.

A contractual undertaking alone is not evidence of effective implementation.

Sanctions screening at the point of binding

Delegated authority separates the moment a commitment is made from the moment the insurer receives the information. Where screening must precede onboarding or a transaction, a bordereau received after inception does not satisfy it retrospectively. The framework should establish how parties are screened before binding, how potential matches are resolved and when a risk must be referred. The persons requiring screening are not necessarily those subject to full due diligence. Later checkpoints are set out in the note on sanctions checkpoints.

Records and continuing oversight

Where Article 25 applies, records are retained for at least five years from the latest of the events it specifies; the end of the authority does not shorten that period, including on insolvency or portfolio transfer. Oversight is risk-based: it does not require duplicating every properly performed step, but it requires enough access, testing and escalation to show that controls operate.

What the file should demonstrate

A defensible delegated authority file answers four questions: who holds the authority; what controls apply to the bound business, and to whom; who performs them, and on what legal basis — direct performance, eligible reliance or controlled outsourcing, evidenced rather than labelled; and how the insurer remains in control, from referral thresholds and pre-binding checks to testing and exit arrangements.

Delegation may transfer the performance of specified tasks. It does not, by itself, transfer the insurer’s regulatory responsibility.

Primary references

This note sets out general observations on the applicable regulatory framework and practice and does not address the circumstances of any particular entity. It does not constitute legal advice and should not be relied upon as such. The positions described reflect the regulatory framework as at the date of the latest revision stated above. Any English translation of UAE federal legislation cited in this note should be read subject to the authoritative Arabic text, which prevails in the event of inconsistency.