Lead signal
Insurers carry responsibility for what intermediaries sell, and the FMA's add-on review says so plainly. The same window brought a fee-drift warning, new privacy expectations on dormant accounts and climate relief that depends on the next government.
Regulatory changes on the radar
Show radar
Regulatory radar overview
Select a numbered signal to read its detail. Size and colour show severity.
Zoom and drag to explore. The radar stays open until you hide it.
Fair outcomes can't be outsourced
- Who it affects
- insurers selling add-on cover and extended warranties through dealers, lenders and other intermediaries
- What it can disrupt
- distribution oversight that never sees intermediary sales, cancellations, claims and complaints data
- Why it matters now
- Review published with feedback to participating insurers. The FMA expects the rest of the sector to self-assess against it.
Who counts as sanctioned has changed
- Who it affects
- insurers screening policyholders, claimants, beneficiaries and marine or cargo risks
- What it can disrupt
- customer checks that only match names against the list, and miss someone acting for a sanctioned person
- Why it matters now
- Since 3 September, any dealing designed to get around sanctions is expressly banned, and relatives and associates count only if named on the register. More names were added on 7 August.
Indirect collection rules started in May
- Who it affects
- insurers receiving policyholder data from brokers, intermediaries and lead providers
- What it can disrupt
- data feeds from third parties that never trigger a notice to the person they describe
- Why it matters now
- Applies to personal information collected since 1 May 2026. Everything collected indirectly since then is already in scope.
A 25 cent fee cost $1.73m
- Who it affects
- insurers whose premium, fee and discount logic must match the policy wording
- What it can disrupt
- fee tables that kept charging after the terms were reworded around them
- Why it matters now
- Public warning issued 21 September. The fee ran from November 2017 to November 2023 before it was caught.
Dormant accounts became a breach finding
- Who it affects
- insurers with lapsed policies and customer portal accounts nobody uses
- What it can disrupt
- customer platforms with no process to check in on, close or purge accounts nobody uses
- Why it matters now
- Final report released 30 October. The Commissioner generally expects a check-in after 12 months of inactivity.
Boards must know where AI runs
- Who it affects
- licensed insurers using AI in pricing, claims or customer channels
- What it can disrupt
- AI use nobody has inventoried: vendor features, staff tools and code assistants outside the risk register
- Why it matters now
- Expectations already published. Boards and senior managers should know where AI is deployed and who owns the risk.
Breach notified six months late
- Who it affects
- insurers whose security incidents run through IT, outsourcers or group functions
- What it can disrupt
- incident response that treats cyber and privacy separately, so nobody asks whether to notify
- Why it matters now
- Decision published. The Commissioner expects notification within 72 hours of knowing a breach is notifiable.
Overseas policy, New Zealand problem
- Who it affects
- insurers whose privacy notices come from an overseas parent
- What it can disrupt
- collection notices and privacy policies inherited from a parent company that cite foreign law
- Why it matters now
- Decision published. The Commissioner signals targeted adverse comment, including to parent companies, when firms do not engage.
Personal emails on work systems count
- Who it affects
- insurers handling access requests from current and former staff
- What it can disrupt
- access-request processes that skip personal email held in company mailboxes
- Why it matters now
- Case note published. Personal emails held on work systems can fall inside an access request.
AML supervision now carries a levy
- Who it affects
- life insurers and other insurers that are AML/CFT reporting entities
- What it can disrupt
- budgets, payables and compliance calendars with no line for levy invoices, challenges or class changes
- Why it matters now
- Regulations in force since 8 October. Levies apply from the financial year starting 1 July 2027.
Climate reporting relief, for now
- Who it affects
- health and life insurers still technically inside the climate reporting regime
- What it can disrupt
- reporting plans that assume the exemption became law, when it has not
- Why it matters now
- No-action relief covers reporting periods starting up to 1 February 2027. Later periods depend on the incoming government.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.