March 2028 Is Closer Than Your Longest Programme
What Bermuda's technology codes will demand of change, and when it has to start.
Adam Wenham | Founder & Managing Director, Garrison · 30 October 2026
Every commercial insurer, insurance manager, broker and agent in Bermuda must comply with the BMA's Operational Resilience and Outsourcing Code by 31 March 2028. The cyber code already applies, PIPA has been fully in force since January 2025, and the BMA's AI guidance is on its way.
An assessment produces a list, and few items on it are closed by writing a policy. An untested recovery plan needs a platform that can be recovered. An outsourcing register needs exit plans for providers nobody could exit today. The months to March 2028 will be decided by who starts the right programmes in time.
Long programmes need to start now
Allow a quarter for board review of the evidence, and the working deadline is the end of 2027. Working back from the top of typical lead times:
Exhibit 1. The clock: integrations and platform replacements are already on the critical path
Source: Garrison practitioner estimates. Typical ranges before contingency; your estate will differ.
Most findings need a programme, not a policy
Few firms will have all twelve; the codes are proportionate to size and risk.
Exhibit 2. Twelve common findings, and the programme each one creates
Source: Garrison diagnostic methodology, across the BMA Operational Resilience and Cyber codes, PIPA and the BMA AI consultation.
The work differs by type of firm
Exhibit 3. Where the work will be, and a typical first programme
Examples are illustrative composites, not client engagements.
Run programmes by root cause, with the evidence built in
- Organise by root cause, not by code. Separate OpRes, cyber and PIPA programmes touch the same systems three times.
- Design the evidence in. If a workstream's deliverable is a tested, recorded recovery, the self-assessment evidence is a by-product.
- One plan, one owner, with stage gates the board approves before each phase is funded.
- Make decommissioning a deliverable. Where a core system cannot go in one move, wrap it and retire it piece by piece, as we did with legacy platforms at Credit Suisse.
- Keep assurance independent. Internal audit or a third party tests the evidence; whoever runs a programme should not mark its own work.
Five questions show whether a board has a programme or a list
Which of our gaps are technology change, and what will closing them cost?
Which programmes should already have started?
Do we have one plan, and who owns it?
Will each programme produce its own evidence?
What are we switching off, and when?
Start with the diagnostic: garrison.re/diagnostic. Need someone to run the programme? garrison.re/techtrans
About the author. Adam Wenham is the founder of Garrison, a Bermuda firm that provides senior technology leadership to Bermuda's regulated firms: covering technology seats, running programmes, bringing in specialists and getting firms ready for the BMA's technology codes. He led technology transformation and operational resilience at the Bank of England, held senior roles across operations, engineering, architecture, innovation and change during seventeen years at Credit Suisse, and led the technology modernisation function at StoneX. At both Credit Suisse and StoneX he led the technology side of mergers and acquisitions. He began his career at Barclays, where he ran the technology for the move of BZW's 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf. adam@garrison.re
Practitioner analysis, not legal advice. Examples are illustrative composites, not client engagements.
Garrison · Hamilton, Bermuda · More at garrison.re/analysis