The Insurance and Pensions Commission (IPEC) has ordered insurers, pension funds, brokers and medical aid societies to form and test contingency plans for events such as cyber attacks, floods, blackouts and market shocks.
IPEC issued its “Guidelines on Business Continuity, Disaster Recovery and Contingency Planning” last week, which take effect on 1 January 2027 with full compliance required by 30 June 2027, the newspaper The Herald reported.
The guidelines cover life assurers, short-term insurers, microinsurers, funeral assurers, reinsurers, brokers, pension funds, administrators and medical aid funds.
IPEC Commissioner Dr Grace Muradzikwa said the arrangements are to ensure the continuity of critical business operations and services while safeguarding policyholders, members and beneficiaries.
The guidelines require industry players to map their critical functions, such as claims payment, pension payroll and treatment pre-authorisation. For each, they must set maximum tolerable downtime and data-recovery targets and keep backup facilities geographically separate from primary sites.
Contingency plans must be tested at least once a year, with results reported to the company’s board. An independent review is required at least every two years. Entities must keep four documented policies: business continuity, disaster recovery, crisis communication and third-party resilience.