Preparing for an Insurance Authority (IA) On-site Inspection: The 5 Most Common Compliance Deficiencies Identified in Insurance Intermediaries
Since 23 September 2019, the Insurance Authority (IA) has been the sole regulator and licensing body for insurance intermediaries in Hong Kong. After several years of transition and familiarisation, the IA has significantly stepped up the intensity and enforcement effectiveness of its on-site inspections, and has begun imposing disciplinary sanctions on non-compliant intermediaries. According to its announcement in June 2025, the IA has recently taken disciplinary action against a number of non-compliant broker companies. Drawing on our analysis of recent regulatory trends, this article summarises the five most common compliance deficiencies identified during on-site inspections and, with reference to actual cases, provides practical guidance for insurance intermediaries.
The “High-Risk Areas” of IA On-site Inspections: Five Common Compliance Deficiencies
The IA has substantially enhanced its market surveillance capability through on-site monitoring, mystery shopping and data analytics tools. The five most frequently identified compliance deficiencies during on-site inspections are as follows:
缺失類別 Deficiency Category | 具體問題 Specific Issues |
|---|---|
Improper Use of Unlicensed Referrers for Sales | Broker companies relying on unlicensed third parties to carry out regulated activities (such as insurance promotion and sales), and paying excessive commissions or providing illegal rebates to clients |
Deficiencies in Anti-Money Laundering (AML) Procedures | Failure to establish effective customer due diligence (CDD) procedures, including inaccurate document verification, overdue screening, or failure to identify politically exposed persons (PEPs) |
Failure to Identify Persons Claiming to Act on Behalf of Clients | Internal manuals lacking procedures to verify the identity and authority of persons claiming to act on behalf of clients, creating opportunities for abuse by wrongdoers |
Inadequate Due Diligence on Offshore Products | Insufficient due diligence and risk assessment on offshore insurance products, in breach of the governance requirements under paragraph 6.2 of the Code of Conduct |
Inadequate Professional Indemnity Insurance (PII) | Insufficient insurance coverage or missing policy terms that fail to cover the company’s day-to-day operations and litigation risks |
Continuous Tightening of Compliance Supervision: From Transition to Robust Enforcement
Since the implementation of the single licensing regime in 2019, the IA has in recent years substantially strengthened the imposition of substantive sanctions for non-compliance. The following cases clearly illustrate the rising compliance pressure on intermediaries:
-
Case 1: AIA fined HK$23 million
In August 2024, the IA imposed its largest-ever fine on AIA because of technical deficiencies in its AML system that failed to identify all politically exposed persons (PEPs) and caused delays in the review of high-risk customers.
Hong Kong Monetary Authority (HKMA) Press Release (2 August 2024):https://edon.asia/en/wechat-pay-hong-kong-limited-因違反《支付系統及儲值支付工具條例》金/
-
Case 2: Three broker companies fined a total of HK$429,000 for AML breaches
In March 2026, three broker companies were fined a total of HK$429,000 and the relevant individuals were reprimanded for failing to establish and maintain effective customer due diligence and record-keeping procedures (including improper customer identity verification and omission of PEPs screening).
Insurance Authority (IA) Press Release (4 March 2026): "Insurance Authority reprimands and fines three broker companies for contraventions of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, whilst concurrently reprimanding three associated individuals
https://www.ia.org.hk/sc/infocenter/press_releases/20260304.html
-
Case 3: Crackdown on unlicensed selling and irregular commission rebates
In April 2024, the IA conducted a joint operation with the Independent Commission Against Corruption (ICAC) to combat suspected unlicensed cross-boundary selling of insurance policies to Mainland visitors. In response to the industry practice of paying referrers commissions exceeding 90%, the IA has, with effect from 1 October 2025, drawn a “referral fee red line” at 50% of the commission.
Insurance Authority (IA) Press Release (11 April 2026): "Insurance Authority and Independent Commission Against Corruption (ICAC) conduct first joint operation to combat suspected unlicensed selling of insurance policies to Mainland visitors"
https://www.ia.org.hk/tc/infocenter/press_releases/20240411_1.html
Case 4: Scrutiny of practitioners’ background and qualifications
In response to concerns over questionable academic qualifications or inadequate qualifications of some practitioners, the IA has made clear that from 2026 onwards it will expand its background checking programme to more areas.
Wen Wei Po News Report (3 June 2026):
https://www.wenweipo.com/a/202606/03/AP6a1f37d0e4b0b49ad1bdccae.html
Case 5: “Mystery shopping” surveillance operations
To combat unlicensed intermediaries, the IA has conducted on-site surveillance using mystery shoppers and has deployed technology to monitor social media platforms for intelligence gathering.
Insurance Authority (IA) Official Article (15 June 2025): "Strengthening Market Supervision to Safeguard the Interests of Policyholders"
https://www.ia.org.hk/tc/infocenter/speeches_articles/20250615.html
ComplianceOne’s Professional Support Services for On-site Inspections
Facing an increasingly stringent regulatory environment, ComplianceOne Consulting Limited (“ComplianceOne”) provides professional support to insurance intermediaries in preparing for and responding to IA on-site inspections. Our services cover the following stages:
服務階段 Service Stage | 具體內容 Specific Content |
|---|---|
Preparation Stage | Assist in preparing inspection documents according to the document request list and formulate internal verification strategies |
Meeting Support | Participate in opening meetings and other meetings as required to assist in responding to regulatory questions |
Enquiry Responses | Assist in responding to various regulatory enquiries on business activities to ensure smooth communication |
Post-inspection Remediation | Assist in formulating and implementing appropriate policies and procedures in light of regulatory recommendations |
Additional Advisory | Provide other compliance advisory services related to the on-site inspection |
Q&A: How Should Insurance Intermediaries Respond to an IA On-site Inspection?
Q1: How can the compliance risk of “improper use of unlicensed referrers” be prevented?
A: Always enter into service agreements only with authorised licensed intermediaries and establish a continuous due diligence mechanism over referral business. The IA has indicated that if a broker company clearly relies on unlicensed persons to carry out regulated activities without effective supervision, this constitutes a breach of the Insurance Ordinance.
Q2: How should AML documents be prepared before an on-site inspection?
A: The core requirement is to ensure that customer identity verification procedures have been fully executed and properly documented. Recent disciplinary actions by the IA have revealed that a number of companies breached the requirements by omitting verification dates during the pandemic period, highlighting the importance of procedural discipline.
Q3: What are the consequences of inadequate due diligence on offshore insurance products?
A: Failure to conduct adequate due diligence and to explain the risks will not only attract regulatory attention but may also result in disciplinary sanctions. Under the Code of Conduct, if a broker company is not competent to advise on offshore products, it should not offer such options.
Q4: How should the adequacy of internal compliance personnel be assessed?
A: With reference to ComplianceOne’s “Guide to Recruitment and Qualification Assessment of Compliance Personnel”, firms should ensure that compliance staff possess practical experience in regulatory communication and relevant professional certifications (such as CAMS or CGSS).
Q5: Apart from compliance infrastructure, what else should be noted when facing an IA on-site inspection?
A: Firms should rigorously review whether the academic and professional qualifications of their team members meet the required standards, whether record-keeping under the AML Ordinance is complete, and whether reasons for clients’ rejection of recommendations have been properly documented when recommending offshore products. ComplianceOne can assist your firm from pre-inspection preparation through to post-inspection remediation follow-up, ensuring end-to-end compliance.
Final Note
As the IA continues to intensify its enforcement efforts, passive waiting is no longer sufficient. Only by proactively building a robust compliance framework can regulatory risks be steadily reduced.