Code readiness
Talk to Adam



INSIDE THE CARRIER. AHEAD OF THE REGULATOR.

Senior technology leadership for Bermuda's regulated firms.

When a technology seat is empty, a programme needs running or the BMA's codes need an owner, Garrison provides the senior leader, runs the programme, brings in the specialists and gets the firm ready.

For insurers and reinsurers, insurance managers, banks and trust companies, digital asset businesses, and administrators and corporate service providers. Banks come under the BMA's operational resilience code on 1 January 2027; insurers by 31 March 2028.

Hamilton, Bermuda | On-island, founder-led, independent | Talk to Adam: adam@garrison.re · +1 441 732 2308

What We Do

Four ways Garrison helps.

COVER THE SEAT

Technology leadership.

· A part-time or interim CIO, CTO or CISO who answers to the board and the BMA

· While the permanent search runs, and stops when the new leader starts

More: garrison.re/techleader

RUN THE PROGRAMME

Delivery.

· Programme management for remediation, a platform change or an integration

· One plan, one delivery rhythm, integrators and vendors held to it

More: garrison.re/techtrans

BRING IN SPECIALISTS

Depth on demand.

· Cyber, cloud, data and architecture specialists for a defined piece of work

· On the island first, from London and the US where the skill isn't here, under Garrison's accountability

More: garrison.re/techleader

BMA CODE READINESS

Evidence and compliance.

· One review against the BMA's cyber and resilience codes, PIPA and the AI consultation, with every answer in your cyber return checked against evidence

· Fixed fee, with a plan the board can sign

More: garrison.re/diagnostic

On any piece of work Garrison either assesses or delivers, never both. Watchtower by Garrison, the evidence platform built from this work, follows in the second half of 2027.

See what the work looks like: ask for the sample report, a full set of findings for a fictional Class 3A carrier: adam@garrison.re

Three questions every board asks about technology. Garrison answers all three.

Are we safe and compliant, and can I prove it?

A posture the Risk Committee can rely on, with the gaps closed rather than listed, kept true every quarter to 2028.

Can we change, and who is running it?

A roadmap the board approved, delivered on the rhythm you set, by an independent firm accountable to you.

Will it hold once the project is over?

No surprises from the board, the regulator or the rating agency.

The codes interlock, so the gaps do too.

Two codes in force, one binding banks from 2027 and insurers from 2028, one consultation

They interlock by design. One outsourcing agreement is an OpRes dependency, a Cyber Code third-party risk and a PIPA processor relationship at the same time, and if the provider uses AI, an AI use case as well. Assessed separately, the gaps that cross all three stay invisible.

31 Mar 2028

Insurers under the BMA's operational resilience code. Banks from 1 January 2027
BMA Operational Resilience and Outsourcing Code

44%

of 200 Bermuda companies reviewed had no privacy notice
Appleby review, 2026

21%

of entities had not completed data classification
BMA cyber report, 2025

What is missing on-island

· Few firms assess the two BMA codes, PIPA and the AI consultation in a single engagement. The usual model is one domain at a time, often with a team flown in.

· Few firms that write the report then deliver the fix. The report is the end of their engagement and the beginning of your problem.

· Nobody to run the change the board has already approved. Multi-year transformation gets sequenced by whoever has capacity, with the integrators and vendor partners managing themselves and no single plan the board has seen.

· Little senior technology leadership available to buy. A firm that cannot hire a CTO has few places on-island to rent one, and no way to get platform, cyber or cloud depth onto the island for a defined piece of work.

· Garrison is here permanently, works for the client, and stays for the hard months. Assessment, delivery and the technology leadership to run it, from one firm. We garrison.

Latest analysis

1 January 2027: What the BMA's Resilience Code Asks of a Bermuda Bank's Board

Banks go first. What the board approves, and what the weeks before January can still do.

March 2028 Is Closer Than Your Longest Programme

Twelve findings that become programmes, and the lead times that mean some must start now.

The BMA's AI Guidance: What Already Applies, and What Is Proposed.

No new regime: existing obligations already apply to every AI use case.

All analysis: garrison.re/analysis

Leadership

Founded by a Practitioner.

Adam Wenham

Founder & Managing Director

Permanently based in Hamilton, Bermuda. Garrison's first hire will be on the island.

Adam Wenham has run the technology side of regulated firms’ multi-year change for 30 years: technology transformation, legacy elimination and M&A integration at Credit Suisse; IT modernisation, M&A integration and a dedicated offshore development centre at StoneX; and led technology transformation and operational resilience at the Bank of England, the regime closest to the BMA's new code. He began his career at Barclays, where he ran the technology for the move of BZW’s 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf.

How Garrison works

One person to look in the eye.

Adam runs every engagement and is named in your governance papers. Retained by a small number of clients at a time, because the aim is a deep, long-term relationship with each, not a client list.

Senior specialists, named before you sign.

Brought in on defined scopes under Garrison's accountability: technical testing and cyber assurance, data and privacy, insurance platforms, programme office. On-island where the skill exists, from the UK where it does not. Client data is handled under Garrison's information security policy and deleted after the engagement.

Fixed where scope is fixed.

The diagnostic, due diligence and vendor selection are fixed fee. Retainers are a stated number of days a month, not a day rate that drifts. Your side of the diagnostic is seven one-hour interviews, 30 minutes with your chair, and a compliance lead who coordinates the documents.

Independent.

Garrison does not audit you and takes no fees or commissions from any technology vendor. Your CRO sees every finding first, a second reviewer, named in the engagement letter, checks every adverse rating, and your board decides. Your accountable officer stays accountable to the BMA, and Garrison does not front with the regulator unless you ask.

On-island, permanently. In the room for the hard months, not just the kick-off.

Get in Touch

A first conversation, 30 minutes, on-island or by call. No cost, no pitch.

adam@garrison.re
+1 441 732 2308
Hamilton, Bermuda

What Garrison Does

Cover the seat
Run the programme
BMA code readiness
Who we work with
Privacy notice

Practitioner analysis

Operational Resilience · Cyber Risk · PIPA · AI Governance · Technology Transformation · Third-Party Risk · Bordereaux · Insurtech Advisory

© 2026 Garrison, Hamilton, Bermuda · Privacy notice