Cyprus: Insurance & Reinsurance

The insurance sector in Cyprus is mainly regulated by the provisions of the Law on Insurance and Reinsurance Services and Other Related Matters of 2016, Law 38(I)/2016, which came into force on 11th April 2016 whilst transposing Directive 2009/138/EC of the European Parliament and Council of 25th November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) into national law (the “Law”). The Law is currently supplemented by regulations issued by the Council of Ministers. EU Delegated Regulations issued with respect to the Solvency II framework and other matters pertaining to insurance activities are also directly applicable in Cyprus.

The Law provides the legal framework for the regulation of contracts of insurance, in so far as these relate to insurance activities pertaining to the categories of life or non-life insurance. There are currently eighteen (18) classes of general (non- life) insurance and nine (9) classes of life insurance.

Life and non-life insurers and reinsurers are regulated in similar manner under the Law. All undertakings that provide insurance or reinsurance services by way of business in Cyprus must be authorised to do so, unless exempt, by the Cyprus Insurance Companies Control Service (“ICCS”) headed by the Superintendent of Insurance (“Superintendent”) under Part II, Chapter Two of the Law, or authorised by the supervisory authority in another EEA member state and passported into Cyprus, either on a freedom of establishment or freedom of services basis.

In practice, most insurers are registered members of the Insurance Association of Cyprus, although this is not compulsory.

Insurance brokers and intermediaries are regulated in accordance with Part VIII of the Law, transposing the provisions of Directive 2016/97/EU on insurance distribution (“Insurance Distribution Directive”) which became effective in Cyprus on 21 March 2019 by adoption of law 38(I)/2019 and the Insurance and Reinsurance Business Regulations 104/2019 issued by the Council of Ministers (together, “IDD Law”). The IDD Law has amended the then existing framework on intermediaries by deleting and replacing the relevant part of the Law thus fully aligning the legal framework on insurance intermediaries with the provisions of the Insurance Distribution Directive. The IDD Law deals with the authorisation, passporting and general regulatory requirements for insurance and reinsurance intermediaries and distributors.

The taking-up of business of insurance or reinsurance is subject to prior authorisation from the Superintendent issued upon filing a relevant application. In a similar manner, intermediaries must also apply for permission to carry out activities such as arranging deals in insurance contracts, dealing in insurance contracts as agent and assisting in the administration and performance of an insurance contract. Throughout the authorisation process the Superintendent ascertains if the applicant complies with the appropriate provisions of the Law. From our experience, key criteria for authorisation include satisfying the Superintendent that the applicant carries on business in the Republic, complying with capital requirements to conduct the insurance activity for which it applies per the scheme of operations submitted for assessment, having appropriate systems and controls in place as well as qualified persons that are fit and proper and capable of performing senior management functions.

All relevant information should be provided to the Superintendent to satisfy the above requirements. The assessment period will not begin, unless all required documents are submitted to the Superintendent and the relevant fees are paid. The assessment period will depend on the quality and completeness of the data submitted by the applicant.

Any person natural or legal, who either individually or in cooperation with others has a direct or indirect participation in the share capital or voting rights of an insurance or reinsurance undertaking of 10% or higher is considered a qualifying holder. A proposed acquirer of a qualifying holding within the meaning of the Law, in the capital or the voting rights in an insurance or reinsurance undertaking or a person intending to further increase, directly or indirectly, such a qualifying holding as a result of which the proportion of voting rights or of capital held would reach or exceed 20%, 30% or 50% or so that the insurance or reinsurance undertaking would become its subsidiary, must obtain the Superintendent’s approval, indicating the size of the intended holding and relevant information. The equivalent requirement applies with respect to a person who intends to dispose of a qualifying holding in an insurance or reinsurance undertaking or who has taken a decision to reduce such qualifying holding so that the proportion of the voting rights or of the capital held would fall below the thresholds set out above.

There are no foreign investment restrictions on acquiring a regulated entity in Cyprus.

Insuring or re-insuring risk in the Republic without a license is generally prohibited. Exceptions apply with permission from the Superintendent or through a “fronting” arrangement with a local carrier. Compulsory insurances cannot be issued on a non-admitted basis.

All insurance companies, local or foreign, must be registered with and licensed by the Superintendent either in the form of Cyprus insurance undertakings or branches of non-EEA insurance undertakings in order to carry out insurance activities in the Republic. Insurers and intermediaries regulated in the EEA have the right to passport their permissions into Cyprus by adhering to certain notification requirements, whilst they need not seek permission from the Superintendent to carry on a regulated activity in this respect.

Carrying on a regulated activity in the Republic without authorisation or the benefit of an applicable exemption is a criminal offence for which the Superintendent can instigate proceedings and for which, on conviction, a fine or imprisonment can be imposed pursuant to the Law.

Regulated entities are subject to on-going regulatory monitoring and oversight and must comply with the detailed requirements set out in orders and circulars issued from time to time by the Superintendent exercising its supervisory functions. Key areas of focus include governance, regulatory capital requirements, fitness and propriety and systems and controls.

The Cyprus insurance industry is highly regulated with respect to solvency capital requirements. The Superintendent, as the supervisory authority, requires insurers/reinsurers to periodically submit regulatory reports, some of which should be audited by externally appointed auditors.

The calculation of minimum capital requirement (MCR) is regulated by section 136 of the Law and is generally set to EUR 3.700.000 for life and non-life insurance undertakings. In addition, the Superintendent, by a circular dated 20 November 2016, requires all insurers or reinsurers to immediately notify the Superintendent in the event where their solvency ratio falls below 115% and at the same time submit a specific recovery plan with a target to return to coverage of adequate solvency capital requirements.

No policyholder protection scheme currently applies in Cyprus.

The supervision of insurance or reinsurance undertakings at the level of the group is applied by the Superintendent pursuant to the provisions of the Law. A single supervisor, responsible for coordination and exercise of group supervision shall be designated from among the supervisory authorities of the Member States concerned. The Superintendent constitutes the competent group supervisor on cases falling within the provisions of section 286 of the Law. In certain cases falling within the Superintendent’s supervision, at the request of any other supervisory authority concerned, a joint decision may be taken by the supervisory authorities to determine another competent authority of a member state as the group supervisor instead of the Superintendent, if it would be inappropriate for the Superintendent to exercise supervision, taking into account the structure of the group and the relative importance of the insurance and reinsurance undertakings’ activities in different countries.

Senior managers, directors and persons who exercise key functions under the Law including “c-suit” executives, internal audit, compliance, actuary and risk functions, must be approved by the ICCS before they can commence performing their functions. Regulated entities must ensure that their senior managers are fit, proper and qualified to carry out the functions they are responsible for on an on-going basis. Any such person being assessed submits to the insurer a prescribed application along with supporting documentation to the extent that academic, professional and good standing criteria can be determined and once the insurer clears the application in line with its internal policies it then further submits the same to the Superintendent for authorisation.

Any members of the board of directors, general manager, secretary or any other officer or other governing body of the legal person who acted on behalf of the legal person and is evidenced that he consented or collaborated in committing an offence, also has criminal liability, for the criminal offences under this Law that were committed by a legal person. Persons who are found to have criminal liability for offences committed by legal persons, are jointly and or severally liable for any damage to third parties on the grounds of the action or omission that constitutes the offence.

One of the conditions for an undertaking to obtain authorisation for the pursuit of insurance or reinsurance business from the Superintendent is for the undertaking to maintain both its head office and registered office in the Republic.

An insurance undertaking of a member state may however pursue insurance business under the freedom to provide services without establishing a branch or having presence in the Republic, provided that it has informed the supervisory authority of its home member state which in turn must notify the Superintendent and provide him with certain information, mainly a certificate attesting that the insurance undertaking covers the Solvency Capital Requirement and Minimum Capital Requirements, the classes of insurance it has been authorised to offer and the nature of the risks it intends to cover in the Republic.

Outsourcing of critical or important functions or activities is subject to advance notification to the Superintendent, who may not permit the outsourcing if he deems that such outsourcing may materially impair the quality of the system of governance of the insurers/reinsurers concerned; unduly increase operational risk; impair the Superintendent’s ability to monitor compliance; or undermine continuous and satisfactory service to policy holders.

Moreover, outsourced functions and activities remain subject to the supervision of the Superintendent, and in particular the service provider must cooperate with the Superintendent in relation to the outsourced function, for whom access to both the data relating to the outsourced activity as well as the premises of the services provider must be safeguarded.

It is clarified that insurers/reinsurers which outsource a function or activity remain fully responsible for discharging their relevant obligations under the Law and Regulations.

So far as digital operational resilience is concerned, the Superintendent adopts and follows the EIOPA guidelines on information and communication technology security and governance which apply to both individual insurance/reinsurance undertakings and mutatis mutandis at the level of the group; in practice aiming to offer clarification and transparency to market participants on the minimum expected information and cyber security capabilities, i.e. security baseline and supervisory convergence regarding the expectations and processes applicable in relation to information and communication technology (ICT) security and governance as a key to proper ICT and security risk management.

Insurers/reinsurers should have assets of sufficient quality to cover their overall financial requirements and must invest all their assets in accordance with the “prudent person principle” as specified in the Law. This requires insurers/reinsurers to only invest in assets and instruments whose risks they can properly identify, measure, monitor, manage, control and report, and appropriately take into account in the assessment of their overall solvency needs in accordance with the Law. Also, all assets particularly those covering the Minimum Capital Requirement and Solvency Capital Requirement must be invested so as to ensure the security, quality, liquidity and profitability of the portfolio as a whole and the assets’ localization must ensure their availability.

The internal market of insurance products which are distributed or sold in the Republic or from the Republic is subject to monitoring by the Superintendent who supervises the activities of distributors, with power to impose sanctions or other measures as provided in the Law.

Cyprus has fully implemented the Insurance Distribution Directive and the Law provides detailed provisions on inter alia (i) insurers’ and insurance intermediaries’ conduct of business standards and duty to act in accordance with the best interests of their customers; (ii) information and disclosures which must be made by the insurance intermediary or insurance undertaking to the customer before conclusion of an insurance contract, establishing a high level of transparency and intended to avoid conflicts of interest; and (iii) advice and standards which ensure that the contract proposed is consistent with the customer’s insurance demands and deeds and that the customer receives objective information about the insurance product in a comprehensible form allowing him to make an informed decision.

There are additional requirements and standards aimed for customer protection in relation to distribution of insurance-based investment products which include provision of appropriate information, requirements for advice to be suitable and restrictions on remuneration.

It is possible to actively market the sale of insurance into Cyprus on a cross border basis under the right of establishment and/or freedom to provide services. The Law lays down specific conditions that must be met for branch establishment and for pursuing insurance business under the freedom to provide services.

Online sales of insurance are subject to different statutory instruments which govern the conduct of business online, which apply to all business activity. Regulations which are of particular significance include:

• The Consumer Rights Law of 2013 implementing Directive 2011/83/EU, provides for consumer rights and consumer information, and further introduces cancellation rights for consumers in relation to distance contracts.
• The Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data of 2018 implementing certain provisions of Regulation (EU) 2016/679, contains provisions around the use of personal data, including concerning website users
• The Law on the Regulation of Electronic Communications and Postal Services Law of 2004 implementing the ePrivacy Directive 2002/58/EC, governs direct marketing (both solicited and unsolicited) by means of electronic communication.
• The Law on Certain Legal Aspects of Information Society Services in Particular Electronic Commerce and Associated Matters of 2004 implementing the eCommerce Directive 2000/31/EC, provides inter alia for conclusion of electronic contracts.

Consumer policies must meet the requirements of the Unfair Terms in Consumer Contracts Law of 1996 which prohibits the use of unfair contract terms in consumer agreements. A term is considered unfair if contrary to the requirement of good faith, it causes a significant imbalance between the parties’ rights and obligations under the contract, and is to the detriment of the consumer. The assessment of whether a term is unfair is made by considering the nature of the products or services, which are the main matter of the contract, and all the circumstances at the time the contract was concluded. To determine the unfairness, various factors are taken into consideration such as the negotiation power of the parties, whether the consumer was induced to enter the contract etc. If a term is regarded as unfair, then the consumer is not bound by that term.

The Cyprus courts have a long history of dealing with diverse and complex commercial claims, with a significant number of cases being brought before the Cypriot courts involving high-value claims between international parties with a connecting link in Cyprus. The legal framework in Cyprus is extensively codified, but at the same time Cyprus remains a common law jurisdiction and the principle of judicial precedence applies, which provides parties in commercial litigation with a degree of certainty, foreseeability and predictability.

Arbitration is a well-established dispute resolution method in Cyprus which is governed by (i) the Arbitration Law Cap 4, which governs all domestic arbitrations and (ii) the International Commercial Arbitration Law of 1987 which is based on the 1985 UNCITRAL Model Law and applies in “international commercial disputes” as specified in the said Law.

Mediation has been formalised with the enactment of the Mediation Law on 2012, transposing EU Directive 2008/52/EC although mediation, through the appointment of a mediator and generally through utilisation of the mechanism of the Law, is still sparingly used in Cyprus. Mediation is also provided by certain specific legislative enactments, such as (i) The Alternative Resolution of Consumer Disputes Law, harmonizing national law with EU Directive 2013/11 and (ii) Establishment and Functioning of Single Entity of Out of Court Settlement Financial and Monetory Disputes Law, implementing EU Recommendation 98/257 on out-of-court settlement of consumer disputes.

There is a statutory transfer mechanism available for sales or transfers of books of (re)insurance which is provided in Chapter 11 of the Law. In relation to the transfer of a portfolio of life insurance policies between Cypriot undertakings, the process involves approval by a court order that is issued under the provisions of the Law and is submitted with the Superintendent, whilst in relation to the transfer of non-life policies portfolio or the transfer of a portfolio of reinsurance activities of non-life or life reinsurance between Cypriot undertakings, the process involves approval by the Superintendent. Moreover, Cypriot insurance or reinsurance undertakings may transfer all or part of their portfolios to an insurance undertaking of another member state, provided the competent authorities of the home member state of the transferee certify that, after taking the transfer into account, the accepting office possesses the necessary solvency margin.

New market entrants face complex challenges in an increasingly competitive environment with numerous established insurance suppliers and an increasing demand for specialised and sophisticated products. The Cypriot insurance regime is fully aligned with EU law and offers a robust and transparent framework for doing business but at the same time the cost of complying with continuously enhanced regulatory and capital requirements can pose a significant challenge to new entrants in the industry.

The introduction of the new General Healthcare System which is based on a single-payer system that excludes private insurers poses a significant challenge to existing and potentially new private health insurance businesses, whilst COVID-19 pandemic and post-pandemic period is also expected to impact the insurance market.

Digital innovation is key to staying competitive in the insurance market, with growing emphasis on insurers streamlining processes, implementing automation, electronic workflows and providing online offerings and claims handling processes. There is an increasing trend of insurers implementing online policy offerings, promoting digital payments and fostering new technology practices, such as online quotes, regular electronic communication techniques, digital advertising, algorithms-based pricing, and digital claims management.

Digital innovation has also opened new opportunities for the market with new products emerging, such as cyber insurance covering ransomware, network interruptions, data breaches and related liability.

There’s ongoing work at EU level on digitalization and particularly with respect to the supervisory challenges that may arise as a result of digitization to the insurance industry and the emerging risks arising in the context of financial soundness and stability as well as consumer protection. The Superintendent has not yet issued guidance in this respect.

At the same time, Cyprus has adopted a Law Providing for a legal framework for electronic identification and related issues (Law 55(I)/2018) which incorporates the provisions of EU Regulation 910/2014/EU (eIDAS) and provides a legal framework governing electronic signatures and certification services which aim at facilitating their use and legal recognition. The Government is in the process of digitalising various functions of the public authorities including filings at the registrar of companies, court’s registrar, issuance of birth certificates, property transfers etc.

Insurers’ use of customer data is subject to monitoring by the Commissioner for Personal Data Protection, which is an independent public authority responsible for monitoring the implementation of Regulation (EU) 2016/679 (GDPR) and other laws aiming at the protection of individuals with regards to the use and processing of their personal data.

The Commissioner considers insurance companies to be data controllers in relation to their customers (individual covers) for whom they collect personal data directly and/or from other sources, as well as to beneficiaries of group covers for whom they collect personal data through their employers. In the latter case the Commissioner considers that insurance companies are not data processors given that they do not simply offer a service to the employer but rather assume responsibility pursuant to relevant laws and practices on the basis of which they act for the handling and decision-making in relation to the provision of insurance coverage.

There are no restrictions on the transfer of customer data within the EU, provided such processing is undertaken in compliance with the principles and provisions of the GDPR. The transfer of customer data to jurisdictions outside the EU however are only permitted if (i) the European Commission has decided that the third country in question ensures an adequate level of protection; (ii) the controller or processor has provided appropriate safeguards (eg adoption of standard data protection clauses adopted by the European Commission); or (iii) an individual derogation applies (eg made with the data subject’s explicit consent). Exceptionally transfers to a third country which cannot be based on any of the above grounds are permitted (eg if non-repetitive, concerns limited number of data subjects etc). Moreover, the Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data of 2018 imposes certain notification and consultation requirements on transfers of special categories of personal data (sensitive data) to third countries.

The Non-Financial Reporting Directive (NFRD) 2014/95/EU amending Directive 2013/34/EU and laying down the rules on disclosure of non-financial and diversity information by certain large companies has been transposed into Cyprus law through an amendment to the legislation bringing about the addition of new Articles 151 A and B to the Cyprus Companies Law (CAP113).

The European Commission’s guidelines on climate-related reporting issued pursuant to NFRD on the disclosure of non-financial and diversity information by certain large companies and groups apply to insurance companies with more than 500 employees. Relevant information that must be disclosed includes:

• Environmental matters including climate related information
• Social matters and treatment of employees
• Respect for human rights
• Anti-corruption and bribery
• Diversity on company boards (in terms of age, gender, educational and professional background).

No further regulation applying to the insurers in particular has been issued in this respect.

It is evident that digitalisation will continue playing an important role in the industry, with growing demands on automation and electronic workflows, particularly during the post-pandemic period. We expect that companies which are able and willing to embrace the technological changes and create new innovative insurance products and processes will emerge as market leaders in the next five years.

The demand for D&O liability coverage is also rapidly increasing in the jurisdiction whilst due to the implementation of the national health system, we have seen a tendency of insurers shifting to more targeted rather than general medical policies essentially pertaining to dread disease and critical illnesses policies.