There has been a change in the professional secrecy that applies to all of Luxembourg’s insurance professionals, under the Law of 27 February 2018, to align itself with the country’s banking secrecy system.

It will now take greater account of the developments linked to the digitalisation and structuring of groups located in different jurisdictions.

This change was welcomed given the sector’s increasing digitalisation, as well as to ensure strict confidentiality and meet customers’ needs.

 

Why professional secrecy?

Professional secrecy is based on the same principle as medical secrecy, where the patient discloses confidential information to his/her confidant in complete trust. Similarly, customers have to reveal confidential financial information to their confident, be it their banker or insurer.

Professional secrecy was therefore developed for banks and insurance companies to guarantee confidentiality and gain  customers’ trust in their key insurance partner.

Secrecy is also essential because of the intrinsic features of insurance contracts, especially when drawing up the beneficiary clause of which the beneficiaries may or may not be aware.

On the other hand, due to the sector’s digitalisation, it proved necessary to adjust secrecy in order to address new customer needs, for which OneLife already provides solutions (aggregators, digital onboarding, electronic documents and signing, etc).

 

What is professional secrecy?

Under Article 300 of the Law of 7 December 2015 on the insurance sector, professional secrecy in insurance is such that all insurance industry professionals “are required to maintain the confidentiality of the information entrusted to them during the exercise of their mandate or as part of their professional duties”.

This means that all conversations, documents, personal data and secrets disclosed by the policyholder, the insured life, the beneficiaries or any other person acting on the customer’s side of the insurance relationship, must be kept secret and strictly confidential by the professional receiving the information.

 

What if these professional secrets are revealed?

Any disclosure of information covered by secrecy – with the exceptions specifically provided for by law – may result in the penalties applicable under Article 458 of the Luxembourg Criminal Code. For medical secrecy, as set out in Criminal Code, the penalty is imprisonment from 8 days to 6 months and a fine of between €500 to €5000.

These penalties are relatively strict in order to deter anyone from betraying one of the most fundamental requirements of the insurance industry.

 

Who is professional secrecy for?

There are various individuals who are subject to insurance secrecy, as it applies to all professionals in the insurance relationship, including:

• All natural or legal persons established in Luxembourg and subject to the control of the CAA (Commissariat aux Assurances) or of a foreign authority for insurance activities conducted from Luxembourg

This broad category naturally includes insurance companies, but also insurance brokers, insurance agents, branches of foreign insurance companies, etc.

• Directors and members of governing and supervisory bodies
• Managers and employees of the above-mentioned natural and legal persons
• Insurance industry professionals experiencing difficulties and the individuals appointed to address them

 

Professional secrecy, geographical and temporal scope?

Secrecy applies to all insurance activities carried out either from the Grand Duchy of Luxembourg, or with the freedom to provide services from the same location.

In other words, an employee of an insurance company going to meet a customer or partner abroad for example is also subject to secrecy.

Moreover, Article 300(10) of the Law of 27 February 2018 establishes that “the violation of secrecy remains punishable after the termination of the mandate, employment relationship or exercise of the profession”, i.e. any disclosure of information even after the end of the person’s employment is still punishable!

 

Professional secrecy, exceptions prior to 27 February 2018

The exceptions laid down in the 1991 law were maintained unaltered in the 2015 law on the insurance sector, namely the following cases:

1. Where the disclosure of information is authorised or required by a legal provision (e.g. reporting under the Common Reporting Standard or NCD – ‘Norme Commune de Déclaration’)
2. To fulfil the commitments under the insurance contract in good faith
3. To prevent or control fraud (e.g. reporting suspicions to tackle money laundering)
4. To provide information to the sector’s regulatory authorities in the European Union where there are similar local professional secrecy laws to Luxembourg.
5. To provide information to the insurance company’ shareholders and partners to ensure it is “sound and prudent management”
6. To provide information between insurance companies, individuals working in the role of Insurance Sector Professionals (PSA – ‘Professionnels du Secteur des Assurances’), Luxembourg branches of foreign PSAs and individuals operating as Financial Sector Professionals (PFS – ‘Professionnels du Secteur Financier’) if said information is provided as part of a service contract (e.g. a business contract between a PSA and an insurance company)
7. To provide information to reinsurers and co-insurers
8. To provide information between entities in a financial conglomerate, although this is limited to information which must be subject to further reporting to the supervisory authorities
9. To provide information to approved brokers in Luxembourg, for customer data where the broker has acted as an intermediary.

 

New provisions and exceptions applying to professional secrecy

New exceptions are emerging, while others are being reformulated to:

• align professional secrecy in insurance with banking secrecy
• enable outsourcing within financial groups
• meet new customer needs in relation to digitalisation

while maintaining confidentiality and the trust placed in the insurer, broker or PSA in Luxembourg as the customer’s confidant.

The new exceptions are:

1. A new exception which applies to reinsurers, pension funds and their employees and managers
2. A broader exception for insurers, PSAs and PSFs. Now all entities located in Luxembourg and regulated by the CAA, CSSF or ECB fall within the scope of exception, provided that there is a service contract between the two entities
3. Subcontractors of services provided by a regulated Luxembourg entity, provided that the customer has accepted the subcontracting, type of information transmitted and the country of establishment of the subcontractors, and that the provider is bound by professional secrecy or by a confidentiality agreement
4. A clarification in relation to the provision of information between entities in a financial conglomerate, in view of reporting to European authorities
5. The ability to provide information within a group to assess consolidated risks or to calculate consolidated prudential ratios

The law also provides that the provisions of Article 300 on professional secrecy are “without prejudice to the amended law of 2 August 2002 on the protection of individuals with regard to the processing of personal data”.

That is to say, the information provided is subject to professional secrecy AND to personal data protection, which is changing as of 25 May 2018 following the entry into force of the General Data Protection Regulation (GDPR).

The exception set out in point 3 is the most interesting, but also likely to be the most highly controlled. This exception makes it possible to meet the new needs of customers while ensuring – through professional secrecy at local level or a confidentiality agreement – that their information is kept confidential and used in complete trust by the subcontractor.

OneLife listens to all of its partners’ and customers’ questions about their obligations and rights in relation to professional secrecy and data confidentiality.

 

Article by  Jean-Nicolas Grandhaye, Corporate Counsel at OneLife

 

IDD, MiFID 2, PRIIPS… strange acronyms which probably don’t mean much to most people as well as a random and sometimes contradictory communication.  But these regulations may well prove to be the investor’s guardian angel.

The new IDD, MiFID and PRIIPs regulations impose new rules on financial institutions (banks, asset managers, insurers but also distributors of financial products etc.) and aim to establish a stricter framework for services provided to investors. Here is an overview of the main provisions, common points and differences.

The aims are basically the same for these three regulations but their regimes, obligations and methods imposed are quite different.

 

 

1 – IDD, MiFID 2, PRIIPS: definitions

Firstly, what is the IDD, about which we so often hear in the insurance world?

The IDD, Insurance Distribution Directive, is a European directive published on 2 February 2016 in the Official Journal of the European Union (directive 2016/97). The directive constitutes a new stage in the standardisation of legislation for the European insurance market.

It is intended both for consumers and insurance professionals:

• life insurance/assurance companies, obviously, but also
• insurance intermediaries and
• other insurance distributors

The directive also aims to align the insurance regime with the regime applicable to banks and other financial establishments following the MiFID 2 directive. The IDD was initially supposed to apply from 23 February 2018, but its application was recently postponed.

The MiFID 2, or Markets in Financial Instruments Directive 2, was adopted on 15 May 2014 and aims to remove the loopholes revealed by the 2008 financial crisis. This directive and the so-called MiFIR regulation of 15 May 2014 form a whole applicable from 3 January 2018 onwards.

The aim of the MiFID 2/MiFIR regulations is to adapt legislation to technological change, to make the financial markets more resistant to the volatility in the global economy and to enhance the transparency and protection provided to investors, be they natural person clients or professional investors, albeit to differing degrees.

These regulations also strengthen the powers of the regulatory authorities and are applicable to financial institutions, be they:

• credit institutions (banks)
• asset managers
• any other company offering investment services (investment, order execution, advice, wealth management etc.)

 

 

2 – IDD, MiFID 2, PRIIPS: shared objectives

The objectives of the IDD and of MiFID 2 are, then, basically the same and can be summarised as follows:

• Enhancing the protection of investors via specific obligations (personalisation of advice, mandatory professional training, and prevention and management of conflicts of interest)
• Providing a stricter framework for the added value and the quality of the services provided to investors (detailed analysis of requirements, of the profile and of the strategy and mandatory evidencing of the fit between the advice and the requirements)
• Enhancing transparency for investors in respect of remuneration, monitoring and governance obligations and pre-contractual obligations)

The IDD also provides for bringing the obligations of players from the world of insurance more closely into line with the obligations in place in the financial sector, in particular the general obligation incumbent on all financial and insurance players to carry out their business honestly, fairly, professionally and in the best interests of their clients.

 

 

3 – IDD, MiFID 2, PRIIPS: specific but similar obligations

Both the methods adopted and certain objectives are specific to each directive. The IDD is founded on four distinct objectives specific to the insurance distribution market:

1. Governance of the product will be made stricter via the definition of the target market, a regular review of the appropriateness of the product in view of the target market and the reinforcement of the monitoring of distributors
2. Reinforced requirements in terms of skills and experience for all persons involved in the distribution of insurance, whether they be the personnel of insurance companies but also intermediaries and their distribution personnel, via the obligation to provide proof of receiving 15 hours of training per year but also to prove that they are “fit” and “proper”
3. Reinforcement of the duty of advice of all insurance distributors, whether they be upstream or downstream in the distribution chain, via the obligation to carry out an adequacy test between the client’s requirements and the offerings proposed and also to carry out this test periodically
4. Transparency obligations in respect of costs, fees and commission received and reinforced monitoring of conflicts of interests; also – in respect of investment products founded on insurance – the obligation to inform the client initially and annually about all the product’s costs and fees (including those related to distribution)

These new obligations will have a number of effects on all insurance distribution players and OneLife stands alongside its partners to guide them in their new obligations.

As for MiFID 2, banks and other financial institutions have also seen their obligations reinforced and a somewhat stricter framework provided for technological change.

Thus, following the taking into consideration of the limits of the legislation deriving from the first MiFID directive (emergence of opaque liquidity pools, fragmentation of liquidity, impairment of the quality of information, distortions in competition, etc.) it has been decided:

• to refocus trading on organised, regulated markets
• to extend transparency rules prior to and after execution of orders
• to promote fair competition between players by aligning their organisational obligations
• to provide a stricter framework for changes in practice and the increased use of IT solutions, including a stricter framework for algorithmic trading activities in order to guarantee the stability of the markets

These obligations are similar to the obligations originating from the IDD but are broader. Nevertheless, they include obligations in respect of:

• Governance of products
• Remuneration (N.B. the MiFID directive is stricter than the IDD in terms of justification of remuneration and if a payment is no longer considered due, it must, as a matter of course, be returned to the client)
• Advice
• Transparency

 

The MiFID 2 directive and the comments made and measures taken for its implementation are thus a source of precious information for the implementation of the obligations deriving from the IDD.

The obligations originating from the MiFID 2 directive are, then, similar but broader and stricter than those deriving from the IDD. Clients and partners are at the heart of the concerns of OneLife, which communicates regularly on the topic and, on the strength of its expertise, has made the implementation of the new regulatory framework a priority for 2018.

OneLife is committed to accompanying its partners and clients in the implementation of these new obligations.

 

Jean-Nicolas Grandhaye, Corporate Counsel, at OneLife