Data Protection, Money Laundering and Financial Crime
This domain tests the compliance obligations that sit alongside insurance regulation: handling personal data lawfully, and preventing the insurance sector being used to launder money, finance terrorism, bribe officials or facilitate tax evasion.
Data protection
The UK GDPR and Data Protection Act 2018 apply. The seven principles require lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. A lawful basis is needed - consent, contract, legal obligation, vital interests, public task or legitimate interests. Health data is special category data requiring an additional condition; the DPA 2018 includes conditions supporting insurance underwriting and claims. Individuals have rights of access (one month), rectification, erasure, portability, objection and rights over automated decisions. Reportable breaches must go to the ICO within 72 hours. Maximum fines are £17.5 million or 4% of global turnover. PECR governs electronic marketing.
Money laundering
Money Laundering Regulations 2017 (as amended): risk-based approach, customer due diligence, enhanced due diligence for PEPs and high-risk situations, ongoing monitoring, five-year record retention and an MLRO. Life insurance and investment-linked products fall within the regulated sector. Proceeds of Crime Act 2002 offences cover concealing, arranging and acquiring criminal property (ss.327–329), failure to disclose (s.330) and tipping off (s.333A); disclosure goes to the National Crime Agency by suspicious activity report. The Terrorism Act 2000 imposes parallel duties.
Other financial crime
Bribery Act 2010, including the corporate offence of failure to prevent bribery (s.7); Criminal Finances Act 2017, creating corporate offences of failure to prevent the facilitation of tax evasion; sanctions screening under OFSI and the Sanctions and Anti-Money Laundering Act 2018.
Worked example
A life policy applicant is a senior executive of a state-owned oil company. That role is a prominent public function, so the customer is a PEP. The firm must obtain senior management approval, establish source of funds and wealth, and apply enhanced ongoing monitoring. Simply recording the answer on the form is not EDD.
Traps that cost marks
- Assuming consent is the only lawful basis for processing.
- Sending suspicious activity reports to the FCA rather than the NCA.
- Believing general insurance is automatically outside the regulated sector for AML; assess risk even where the MLRs do not strictly apply.
- Forgetting that tipping off is itself an offence.
- Overlooking sanctions screening as distinct from AML checks.