ASIC's September general letter: What It Means for Insurers

Late last month, ASIC published its sector letter for general insurance. Addressed to the boards and executives of Australian general insurers, it sets the regulator's priorities for the next cycle of work. New focus areas include a review of paid home insurance claims advocates and an assessment of the proposed General Insurance Code once it is submitted for approval. Continuing scrutiny covers motor premium disclosure, home building cash settlements, and the conduct implications of emerging cyber risks. The oversight spans product design, distribution, pricing, claims and dispute resolution. If you have delegated authority with an insurer (as every MGA does), you inherit the lot through your binder commitments.

Read in isolation, the letter is a reasonable list of focus areas. Read in the context of the other two regulator letters that have landed in 2026, it is something more interesting. Three letters, one question:

In April, APRA wrote to every bank, insurer and superannuation trustee it regulates. The message was that governance and risk management practices were not keeping up with the pace of AI adoption. In May, ASIC followed with its cyber letter to all AFS licensees, saying frontier AI was accelerating the threat environment and requiring boards to table the letter at their next governance meeting. In June, the General Insurance Code Governance Committee published its review of renewal pricing transparency, which concluded that six of the twenty insurers it sampled were not clearly explaining why monthly installment prices were seven to eleven percent higher than annual payments. Now, in September, we have the ASIC sector letter.

The topics are different, but I don't think the underlying questions are. Three regulators (in four separate letters across six months) are asking Australian insurers to prove that what they say they do, they actually do. Not at the policy level, which is where most responses are being drafted. At the record level.

For this customer, on this day, under this product, through this channel. Can you evidence it? That is the shift worth paying attention to, because it is where a lot of insurers and MGAs are structurally short - it's an evidence problem.

Motor premium disclosure, which is on ASIC's continuing scrutiny list, is a clean example. The GICGC flagged it in June. ASIC has now underlined it in September. The expectation is now unambiguous. On every motor renewal notice, the customer should see the annual premium, the installment total, the difference, and any change to excess or insured value, in plain language, on the document itself, without having to click through to a separate guide. Delivered the same way whether the notice reaches the customer direct from the insurer, through a broker, or through a portal operated by an agent. For an insurer running a modern core where pricing, documents and distribution all operate from one data model, that is a template rewrite. For an insurer whose motor renewal notice is generated by one system, whose installment logic sits in another, whose fee calculation lives in a third, and whose broker-channel documents are produced from yet another template that was last audited two years ago, it is a project. And when ASIC asks for evidence that the disclosure is consistent across every one of those paths, the honest answer in a lot of cases is that nobody can produce it on demand.

Home-building cash settlements have the same structural shape. The question the regulator is asking is whether the customer was told, in a way they could understand, what the settlement figure represented, what it did not cover, and what the trade-offs were. The policy answer is yes. The evidence answer requires pulling the specific communications sent to that customer, in sequence, with timestamps, through whichever channel the claim was handled. If those communications live across a claims system, an email archive, a loss adjuster's own notes and a document portal, the evidence takes weeks to assemble, not minutes.

Paid claims advocates, the new review area, is a conduct issue dressed as a market issue. ASIC is going to look at why customers are reaching for a paid representative at all, and whether insurers responded fairly when they did. For an MGA handling claims under delegated authority, the question comes back as whether the authority of the representative was verified before information was released, and whether the handling after that point held to Code standards. Both are evidenceable only if the record of what was done, by whom, and when, sits in one place that an auditor can actually read.

If you run under delegated authority, the sector letter was addressed to insurer boards, but every MGA needs to read it as if it were addressed to them. Delegated authority is a privilege granted by a carrier, and the carrier is the one on the hook with ASIC. When your insurer partners come back in the next quarter asking you to confirm compliance against the priorities in this letter, your binder commitments will be the test. Agencies that can produce clean, timestamped, record-level evidence of what they did under delegation will keep those binders. Agencies that can't, won't. 

The temptation after a letter like this is to run a compliance project and check boxes. Update the templates. Rewrite the policy. Train the frontline. Sure - All of that is necessary. None of it is sufficient, because the regulators are no longer taking policy as evidence. They are asking you to produce the actual records, and in most insurers, the gap is not the policy. It is the architecture that is supposed to generate the record and store it somewhere auditable.

The structural question that follows this letter, for anyone running an insurer or an MGA in Australia right now, is whether their core platform can produce record-level evidence of what was communicated to a customer, under which authority, at what price, through which channel, on demand. If the answer takes more than two systems and more than two people to assemble, that is the actual problem. The sector letter is a reminder to fix it before ASIC asks you to prove something you cannot.