With the upcoming Conduct of Financial Institutions (COFI) Bill and Omni-Risk Return (Omni-RR) set to replace much of the existing legislation to create a more harmonised regulatory framework for South Africa’s financial services sector, underwriting management agencies (UMAs) will face growing expectations around governance, data quality and compliance. This article unpacks what UMAs do, how they operate and how they can prepare for the evolving regulatory environment.

The role of UMAs - UMAs have become a key part of South Africa’s short-term insurance sector. They represent insurers through binder agreements, performing specialist functions such as underwriting, claims management and policy administration. They bring technical expertise and efficiency to the process.

In the insurance value chain, UMAs sit between the insurer and financial advisors (the distribution channel). The insurer provides the cover and carries the risk; the broker provides advice and deals directly with the client – and the UMA handles the technical and administrative side that keeps everything running smoothly. While clients usually interact with brokers rather than UMAs, their behind the scenes work directly influences how effectively policies are managed and how fairly claims are settled.

The current compliance landscape - Because UMAs operate under delegated authority, they face a unique mix of compliance and operational responsibilities.

To operate as a UMA, an entity must meet both Financial Advisory and Intermediary Services (FAIS) licensing and insurance regulatory requirements. This usually means holding a Category I FSP licence to perform intermediary services and being formally approved by an insurer as a binder holder under the Insurance Act.

Like all FSPs, UMAs must meet the FAIS Fit and Proper requirements relating to competence, operational ability and financial soundness. They also need strong governance structures, experienced underwriters, sound financial management and robust systems that can produce accurate reports for insurers and regulators.

Beyond licensing, UMAs have several ongoing compliance duties, including:

• Treating customers fairly (TCF) and managing conflicts of interest

• Keeping detailed records for at least five years

• Ensuring compliance with the Protection of Personal Information Act (POPIA)

• Maintaining accurate, auditable data to support insurer oversight

Before signing a binder agreement, a prospective UMA should take a careful, informed approach. The agreement defines their authority, accountability and compliance obligations. Terms around remuneration, indemnity, data ownership and reporting must be fair and transparent, and the UMA should ensure it has the systems and staff to maintain the requirements stipulated in the binder agreement. Binder fees must stay within regulatory limits, and UMAs should understand audit rights and performance expectations upfront. In essence, the binder agreement is both a contractual agreement and a compliance commitment.

Because the insurer remains ultimately responsible for all decisions a UMA makes, oversight is continuous. Insurers typically conduct annual audits, review underwriting and claims processes and require regular reports on performance and complaints. For UMAs, demonstrating strong governance and transparent reporting is essential to maintaining trust and meeting regulatory expectations.

Common pitfalls and compliance risks - UMAs often run into difficulties when they overstep their binder authority or fail to follow insurer procedures. Common issues include:

• Making underwriting or claims decisions beyond their mandate

• Weak recordkeeping or inconsistent claims outcomes

• Delayed or incomplete reporting to the contracted insurer

• Conflicts of interest, particularly where a UMA has links to a brokerage

• Non-compliance with binder fee limits or justification requirements

• Failing to meet reporting and screening requirements under the Financial Intelligence Centre Act (FICA)

These challenges usually stem from gaps in governance or insufficient monitoring – areas that can be strengthened through proactive compliance planning.