Compliance in Insurance: A Complete Guide for Carriers, TPAs and IA Firms

Compliance in insurance has moved well beyond the back office. Regulatory scrutiny is intensifying, fines are rising, and policyholders expect more transparency than they used to. Whether you are a carrier, third-party administrator (TPA), independent adjuster (IA) firm, or self-insured entity, the compliance landscape is part of the operating environment rather than a corner of it.

This guide describes that landscape: the regulations that shape the industry, the compliance areas that carry the most risk, and where claims work connects to regulatory obligations. It describes them. It does not tell you how to comply, because that answer turns on your lines, your jurisdictions, your licences, and your own service standards, and it belongs to your compliance counsel rather than to an article.

What compliance in insurance means

Insurance compliance is the set of internal controls, policies, and operational procedures that insurance organizations put in place to meet regulatory requirements, protect policyholders, and prevent financial crime such as fraud and money laundering.

It rests on three connected pillars:

• Regulatory adherence. Following the state, federal, and international laws that govern how insurance is sold, administered, and paid.
• Consumer protection. Fair treatment, timely claim responses, and clear communication with policyholders.
• Risk management. Identifying and addressing exposures, including data breaches, fraudulent claims, anti-money laundering (AML) violations, and sanctions risk.

Because insurance in the United States is regulated at the state level under the McCarran-Ferguson Act, requirements vary by jurisdiction, product type, and distribution channel. An insurer writing across several states faces a patchwork of obligations rather than a single rulebook, which is the structural reason compliance work in this industry is heavier than the equivalent work elsewhere.

Key regulatory bodies and frameworks

National Association of Insurance Commissioners (NAIC). The NAIC coordinates insurance regulation across the states, producing model laws and frameworks that individual states may adopt. Its work covers market conduct standards, risk-based capital (RBC) requirements, and Own Risk and Solvency Assessment (ORSA) filings.

State insurance departments. Each state's department of insurance licenses carriers, agents, and adjusters, approves policy forms and rates, and conducts market conduct examinations. An insurer remains subject to the rules of every state where it is licensed, including requirements on claims handling timeliness and consumer disclosure.

Office of Foreign Assets Control (OFAC). OFAC sanctions compliance applies to insurance participants across the policy lifecycle. Policyholders, beneficiaries, and counterparties are screened against the Specially Designated Nationals (SDN) list, and coverage cannot be issued or claims paid to sanctioned parties without OFAC authorization.

Federal regulations.

• Gramm-Leach-Bliley Act (GLBA). Requires insurance companies to protect non-public personal information under data security and privacy standards. The GLBA Safeguards Rule is where the security expectations sit.
• Health Insurance Portability and Accountability Act (HIPAA). Governs the handling of protected health information in medical and health insurance lines.
• Bank Secrecy Act (BSA) and AML rules. Impose anti-money laundering obligations, including suspicious activity reporting for certain insurance transactions.
• No Surprises Act (NSA). Restricts unexpected out-of-network billing in health insurance and requires transparency in cost disclosure.

The compliance areas that carry the most weight

Licensing and appointments. Every insurer, agent, and adjuster needs active, valid licences in each jurisdiction where it operates. Licence renewals, carrier appointments, and continuing education tracking are high-frequency administrative tasks, and when they are mismanaged the consequence is enforcement rather than inconvenience.

Data privacy and cybersecurity. The GLBA Safeguards Rule sets data security expectations, and state-level privacy laws add further layers around how insurers collect, store, and share policyholder data. A breach triggers regulatory notification obligations and can create substantial civil liability alongside them.

AML and fraud prevention. Life insurance and annuity products can be vulnerable to money laundering schemes, including premium overpayments and early policy surrenders. Insurers are expected to run Know Your Customer (KYC) programs, suspicious activity monitoring, and enhanced due diligence for higher-risk policyholders. Fraud prevention sits next to it: inflated and fabricated claims raise loss ratios across the book.

Market conduct. Market conduct examinations look at how insurers treat customers across the policy lifecycle, from marketing and underwriting through to claims settlement. Recurring findings include delayed claim acknowledgments, missing disclosures, and improper denials. Fines can be substantial, and the reputational consequence outlasts them.

Claims handling regulations. States set timeframes for claim acknowledgment, investigation, and payment through unfair claims settlement practices rules. The standards vary by state, and an operation's own service policy may be tighter than the rule, so the timeframes that apply to a given file are the ones in that state's rules and that operation's policy rather than a number that can be read off an article. Missing them exposes an insurer to bad-faith claims, interest penalties, and regulatory sanction.

How claims work carries compliance risk

The claims lifecycle is where compliance risk concentrates. Every step, from first notice of loss (FNOL) through investigation, reserving, and settlement, sits under regulatory timeframes, documentation standards, and fair-dealing obligations.

The claims-related failures that recur in examination findings:

• Missed state-mandated response deadlines for acknowledgment, investigation updates, and claim decisions
• Claim documentation that does not hold up under a market conduct examination or audit
• Inconsistent reserve practices that fall short of statutory reporting requirements
• Denial letters that omit the required explanation for the denial
• Gaps in claim records that make fair handling hard to demonstrate during a regulatory review

What those have in common is the record. State insurance departments examine claim handling through market conduct examinations, through the Market Conduct Annual Statement, through unfair claims settlement practices rules that set acknowledgment and decision timeliness, and through data calls issued after a declared catastrophe. All of it is answered from dates, codes, and dollars recorded on the claim while the work happens, which is why a compliance conversation so often ends up being a conversation about the claim file.

Bordereau reporting and the Lloyd's market

For DCAs and coverholders in the Lloyd's market, bordereau reporting is part of the delegated authority relationship rather than an add-on to it. A claims bordereau reports claims data to the market on an agreed cycle, and what it must contain is set by agreement with the coverholder or managing agent.

Lloyd's coverholder claims reporting standards have been revised across several versions. Which version and which data set apply to a given binder is a question for the parties to it.

VCA's LloydsConnect produces the Lloyd's report set: the Lloyd's Standard Bordereau, the Lloyd's Standard Bordereau with Certificate Allocation, the Lloyd's Management Information (MI) report, and the Lloyd's Solvency report. The Unique Market Reference (UMR) is set up once and bordereaux auto-populate per claim, for both individual-risk and subscription market business.

Where technology fits

Compliance management spread across spreadsheets, shared drives, and email chains struggles with the volume of modern insurance regulation, and the part of it that lives in the claim record is the part a claims platform can carry.

What claims systems are generally asked to do in this area:

• Deadline tracking. Configurable workflows that alert handlers and managers when a response deadline is approaching or at risk.
• Audit trails. Time-stamped records of claim actions, document uploads, decisions, and communications.
• Reserve records. Reserve movement recorded as it happens, so claim financials reconcile to what finance recognizes.
• Document management. A searchable repository for claim documents, so nothing has to be reconstructed later.
• Structured intake. FNOL workflows that capture the required data elements at the point of first contact rather than at the end.

On the VCA platform, authority limits are set for each user, the platform tracks authority protocols alongside the reporting requirements attached to them, and transactional reserve history records each reserve movement with the date, who made it and the reason given. What those limits should be, and which reporting requirements attach to them, is set by the operation.

AI and emerging technology

Artificial intelligence is increasingly applied to insurance compliance, from transaction monitoring that surfaces unusual patterns to models that flag claims handling issues for review. The NAIC has issued guidance on AI governance, and some states are moving toward transparency requirements for AI-assisted underwriting and claims decisions.

VCA's approach to AI in claims is practical by design: it belongs inside the claim file, where the work is already happening, supporting adjuster judgment rather than replacing it.

What a compliance framework contains

Compliance programs across the industry tend to be assembled from the same components, whatever the size of the organization:

• A risk assessment mapping which regulations apply to the products, channels, jurisdictions, and customer segments the business actually touches
• Documented, version-controlled policies covering licensing, claims handling, data security, AML protocols, and reporting obligations
• Controls embedded in the operational workflow rather than kept alongside it, with manual overrides logged
• Training that keeps staff current as rules change
• Monitoring and periodic internal testing, with a route for updating policies and system configuration when requirements change

Which of those matters most for a given operation, in what order, and measured against which standard, is a judgment for compliance counsel who knows the book. This article describes the terrain. It does not advise on the route.

Frequently asked questions

What does compliance in insurance mean?

Compliance in insurance means meeting the laws, regulations, and standards that govern how insurance products are sold, administered, and paid. That includes state licensing laws, federal data privacy requirements, anti-money laundering obligations, and claims handling regulations.

What are the consequences of non-compliance?

Non-compliance can lead to regulatory fines and penalties, licence revocation or suspension, market conduct findings, bad-faith litigation from policyholders, and reputational damage. Where OFAC sanctions or AML violations are involved, criminal liability is also possible.

What is market conduct compliance?

Market conduct compliance covers the rules that govern how insurers interact with policyholders, from sales and underwriting through claims handling and complaint resolution. State departments of insurance conduct market conduct examinations to assess whether customers are being treated fairly and consistently.

What is bordereau reporting in the Lloyd's market?

A claims bordereau is a structured data report submitted into the Lloyd's market on an agreed cycle by a coverholder or delegated claims administrator. What it contains, how often it goes, and which reporting standard applies are set by the binder and the managing agent rather than by a universal template.

Where does claims software fit into compliance?

A claims platform holds the record that most compliance questions are answered from: the dates, the codes, the documents, the reserve movements, and the communications on each file. It does not decide what the obligation is. It determines how quickly and how completely you can show what happened on a claim when someone asks.

Bottom line

Compliance in insurance is a patchwork by design, and no platform makes the patchwork smaller. What a well-kept claim record changes is the cost of answering for it. If you want to see what that record looks like on a claim like yours, request a demo, and bring your own reporting requirements to the conversation. The operations that handle regulatory scrutiny well are usually the ones whose claims handling was disciplined before anyone asked to see it.