The Bordereaux Problem Is a Data Problem. The Data Problem Is a Governance Problem.
Adam Wenham | Founder & Managing Director, Garrison · 16 October 2026
Bermuda registered 25 new special purpose insurers and 10 new collateralised insurers in 2025 alone, with that pace holding into 2026. Each new MGA, sidecar, and transformer adds another layer of delegated authority — and another bordereaux feed that the carrier must ingest, validate, reconcile, and report against.
Yet most carriers manage bordereaux through spreadsheets, manual reconciliation, and email chains. The data arrives in different formats from different MGAs, on different schedules, with different field definitions. The carrier's finance team spends days each month assembling a picture that should be available in minutes. And when the BMA asks for a view of the carrier's aggregate exposure through its delegated authority programme, the answer takes a week to produce — if it can be produced at all.
Three forces have made bordereaux a board issue
Three forces have converged to make bordereaux management a strategic priority rather than a back-office function.
The MGA Boom
Bermuda has seen a significant increase in MGA formations. As a recent analysis in Bermuda:Re+ILS observed, carriers and regulators are increasingly focused on alignment between the MGA and the capacity provider. Each MGA writes business on behalf of one or more carriers under delegated authority. The carrier provides the capital. The MGA makes the underwriting and claims decisions. The bordereaux is the mechanism through which the carrier maintains visibility of what is being done in its name. As the number of MGA relationships grows, the volume and complexity of bordereaux data grows proportionately.
Regulatory Convergence
Bermuda's regulatory architecture — OpRes Code, Cyber Code, PIPA, AI governance — all depend on the carrier having accurate, timely, and complete data about its operations. Bordereaux data feeds into regulatory reporting (INTEGRA submissions), risk management (aggregate exposure monitoring), financial accounting (premium and claims reconciliation), and compliance (data governance under PIPA). A carrier that cannot trust its bordereaux data cannot produce trustworthy regulatory submissions. The data quality problem is not a technology problem. It is a governance problem with regulatory consequences.
The Delegated Authority Governance Expectation
The BMA expects carriers to demonstrate oversight of the business written on their behalf — which means the carrier must have timely, accurate data from its MGAs. A carrier that receives monthly bordereaux eight weeks after the reporting period, riddled with data quality issues, cannot meaningfully oversee its delegated authority programme. The OpRes Code's requirement to identify and document the resources supporting important business services extends to the data flows that enable oversight of delegated operations.
The same five failures recur everywhere
Having worked on data governance across seventeen years at Credit Suisse — where the complexity of cross-border, multi-counterparty data flows was a daily operational challenge — I have seen the same failure modes repeat across every institution.
Format Inconsistency
Every MGA has its own bordereaux format. Date formats differ (DD/MM/YYYY versus MM/DD/YYYY). Currency codes differ. Policy reference conventions differ. Field names differ even when they describe the same data. Industry data standards — ACORD schemas in particular — exist to address this, but adoption across Bermuda's MGA community is inconsistent, and many smaller MGAs submit in proprietary formats. The carrier receives bordereaux from ten MGAs and must normalise ten different formats into a single data model before any analysis can begin. This normalisation is typically performed manually — slowly, inconsistently, and with errors that compound over time.
Timeliness
Bordereaux arrive late. The binding authority agreement specifies monthly reporting within thirty days. The MGA submits at day forty-five. The carrier's finance team chases. The resubmission arrives at day sixty with corrections that introduce new errors. Meanwhile, the carrier's risk management function is operating with data that is two months stale — making decisions about aggregate exposure based on a picture that has already changed.
Completeness
Fields are missing. Premium amounts without policy effective dates. Claims without loss dates. Policies without geographic location data. Each missing field degrades the carrier's ability to monitor its exposure, reconcile its accounts, and report to the BMA. The carrier's response is typically to request resubmission — which adds further delay and further friction to the MGA relationship.
Reconciliation Failure
The premium bordereaux says the MGA has written $12 million in premium. The cash received by the carrier is $10.8 million. The difference could be commission, could be a timing difference, could be an error. Without automated reconciliation against the binding authority terms, the carrier's finance team investigates manually — consuming days that could be spent on analysis rather than detective work.
Accumulation Blindness
Each bordereaux is processed individually. The carrier can see what each MGA has written in each period. But can the carrier see its aggregate exposure across all MGAs, all periods, all geographies, in real time? In most cases, no. The aggregate view requires assembling data from multiple sources, normalising it, and presenting it in a format that enables risk management decisions. This is the exercise that takes a week when the BMA asks — because the data has never been assembled in one place before.
Bad bordereaux data flows into every regulatory return
The bordereaux problem is not contained within the finance team's reconciliation process. It intersects with every regulatory obligation the carrier faces.
INTEGRA Submissions
The BMA's regulatory reporting portal depends on data that, for carriers with delegated authority programmes, originates in bordereaux feeds from MGAs. If the underlying bordereaux data is unreliable — late, incomplete, inconsistently formatted — the INTEGRA submission built on top of it inherits those quality problems. A carrier that manually assembles its INTEGRA submission from spreadsheet-based bordereaux is introducing human error into its regulatory filings at every step.
PIPA
Bordereaux contain personal information — policyholder names, addresses, claims details, sometimes health data for specialist lines. The data flows from the MGA to the carrier, potentially across jurisdictions. Under PIPA, the carrier must have data processing agreements governing this transfer, must know where the personal information resides, and must be able to respond to data subject access requests within the timeframes the Act requires. A carrier that cannot locate a specific policyholder's data across ten MGA bordereaux cannot satisfy a PIPA access request.
OpRes Code
If the carrier's delegated authority programme is an important business service — and for many carriers it represents the majority of their premium income — then the bordereaux data pipeline is a resource supporting that service. The carrier must map this resource, set impact tolerances for its disruption, and test whether the carrier can continue to operate within those tolerances if the data pipeline fails. A carrier whose aggregate exposure view depends on monthly spreadsheet reconciliation has an important business service supported by a fragile, manual process.
Cyber Code
Bordereaux data flows between organisations — MGA to carrier, sometimes through brokers or intermediaries. Each data transfer is a potential cyber risk. The carrier must assess the cyber controls governing these transfers: is the data encrypted in transit? Is it stored securely at both ends? Are access controls appropriate? The BMA's Cyber Code requires carriers to assess third-party cyber risks — and the MGA bordereaux feed is a third-party data flow that many carriers have never assessed from a cyber perspective.
Three questions show whether the board can see its delegated business
Three questions that connect bordereaux management to the broader governance conversation:
How many days after the reporting period does it take to produce a complete, reconciled view of our delegated authority programme? If the answer is more than five business days, the carrier's oversight of its delegated authority business is operating on stale data. Every day of delay is a day the board is making decisions based on an incomplete picture.
Can we produce an aggregate exposure view across all MGAs, all lines, all geographies, in real time? If the answer is no, the carrier cannot demonstrate to the BMA that it has effective oversight of the business being written in its name. This is not a technology question. It is a governance question. The technology enables the answer. The governance demands it.
Have we assessed the bordereaux data pipeline against our regulatory obligations — INTEGRA, PIPA, the OpRes Code, and the Cyber Code — as an integrated exercise? If the bordereaux process has been evaluated only as a finance function, the regulatory dimensions remain unaddressed. The data flows through the same pipeline. The governance assessment should cover all four dimensions in a single view.
About the author. Adam Wenham is the founder of Garrison, a Bermuda firm that provides senior technology leadership to Bermuda's regulated firms: covering technology seats, running programmes, bringing in specialists and getting firms ready for the BMA's technology codes. He led technology transformation and operational resilience at the Bank of England, held senior roles across operations, engineering, architecture, innovation and change during seventeen years at Credit Suisse, and led the technology modernisation function at StoneX. At both Credit Suisse and StoneX he led the technology side of mergers and acquisitions. He began his career at Barclays, where he ran the technology for the move of BZW's 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf. adam@garrison.re
Garrison · Hamilton, Bermuda · adam@garrison.re
Practitioner analysis, not legal advice. More at garrison.re/analysis