Your Insurance Manager Runs Much of Your Business. The Codes Now Ask You to Evidence It.
Adam Wenham | Founder & Managing Director, Garrison · 14 October 2026
Bermuda's insurance market runs on outsourcing. Insurance managers administer carrier operations. MGAs underwrite on carriers' behalf. Third-party administrators process claims. Cloud providers host the data. Catastrophe modelling firms quantify the risk. For many Bermuda carriers, the organisation chart shows twenty employees. The operational reality involves fifty people across six companies in four jurisdictions.
This is not a criticism. It is the architecture that makes Bermuda's market work. A twenty-person Class 3A carrier does not need to build an in-house underwriting administration team. Outsourcing to a specialist insurance manager is operationally efficient, commercially rational, and entirely appropriate.
But the BMA has now asked a question that many carriers have not yet answered:
The BMA put outsourcing and resilience in one code
The BMA's Operational Resilience and Outsourcing Code — issued September 2025, effective March 2028 for insurance entities — couples operational resilience with outsourcing governance in a single regulatory instrument. The PRA in the UK treats them separately. The BMA chose not to. That choice reflects a market reality: in Bermuda, operational resilience and outsourcing are the same conversation because outsourcing is the operating model.
The code's ambition is broader than outsourcing alone — it covers the full spectrum of operational resilience, from internal processes to technology to people. But the outsourcing dimension is where Bermuda's market faces its most distinctive challenge. The code requires carriers to assess not just the service quality of their outsourced providers but their operational resilience under stress. The question is no longer "does our insurance manager deliver on time?" It is "what happens to our important business services if our insurance manager suffers a significant operational disruption?"
That question — applied to every critical third-party relationship — is the third-party risk management programme that most carriers have not yet built.
Performance is only the first of three layers
Third-party risk management in Bermuda's insurance market operates across three layers, each with distinct regulatory implications.
Layer 1: Operational Performance
This is what most carriers manage today — service level agreements, performance reviews, regular reporting. The insurance manager delivers underwriting administration on time. The TPA processes claims within target. The cloud provider maintains uptime. This layer is necessary but no longer sufficient. The OpRes Code assumes performance management is already in place. It asks for something more.
Layer 2: Operational Resilience
Can the third party continue to deliver critical services during a disruption? This requires a fundamentally different assessment from performance monitoring. It requires understanding the third party's own business continuity plans, their disaster recovery capabilities, their communication protocols during disruption, their staff dependencies, their technology architecture, and their own third-party dependencies. An insurance manager that performs excellently under normal conditions but has never tested its disaster recovery plan is a resilience risk the carrier must identify and manage.
Layer 3: Regulatory Compliance
Does the third party comply with the same regulatory obligations the carrier faces? Under PIPA, a carrier remains responsible for personal information processed by its insurance manager. Under the Cyber Code, a carrier must assess the cyber risk associated with its outsourced IT providers. Under the AI governance guidance, a carrier must govern AI use cases across its entire operation — including AI deployed by third parties. The carrier cannot outsource the regulatory obligation alongside the operational function.
A few providers carry much of the market
Bermuda's outsourcing market is concentrated. A small number of insurance managers serve a significant proportion of carriers. A handful of IT providers support the majority of the market's technology infrastructure. Two or three cloud platforms host most of the industry's data.
This concentration creates a systemic risk that extends beyond any individual carrier. If a major insurance manager suffers a significant operational disruption, multiple carriers lose operational capability simultaneously. The BMA is not assessing this risk carrier by carrier — it is assessing it at the market level. The OpRes Code's requirement for carriers to evaluate third-party resilience is, in part, the BMA's mechanism for understanding the market's aggregate exposure to third-party concentration.
A carrier's third-party risk assessment should therefore include not just "can this provider recover from a disruption?" but "if this provider fails, how many other carriers are affected, and does the BMA have visibility of that aggregate exposure?"
The carrier that raises this question proactively — rather than waiting for the BMA to ask it — demonstrates the kind of systemic awareness that distinguishes genuine governance from compliance formality.
The insurance manager is the outsourcing that matters most
The insurance manager relationship deserves particular attention because it is the most comprehensive outsourcing arrangement in Bermuda's market. An insurance manager may perform underwriting administration, policy issuance, claims processing, regulatory reporting, financial accounting, and INTEGRA submission preparation — functions that collectively represent the carrier's core operational infrastructure.
Under the OpRes Code,
each of these functions that qualifies as an important business service must be mapped to the resources that support it — including the insurance manager's technology, people, and processes. The carrier must set impact tolerances for each important business service and test whether those tolerances can be maintained during a disruption to the insurance manager's operations.
Under PIPA,
the carrier must have a data processing agreement with the insurance manager that addresses personal information handling, breach notification (enabling the carrier to notify the Privacy Commissioner without undue delay), data return and destruction, and cross-border transfer adequacy.
Under the Cyber Code,
the carrier must assess the insurance manager's cyber risk management controls — including data classification, access management, incident response, and business continuity testing.
Under the AI governance guidance,
if the insurance manager uses AI in any of the functions it performs on the carrier's behalf, the carrier must understand what AI is being used, how it affects the services provided, and whether the insurance manager's governance of that AI meets the standard the BMA expects of the carrier.
The carrier that manages them through four separate assessment processes — each conducted by a different person, at a different time, using a different methodology — will produce four inconsistent pictures of the same risk.
A proportionate programme fits the carrier's size
Third-party risk management does not require every carrier to build an enterprise-grade programme with dedicated staff and specialised software. Proportionality applies here as it does across the OpRes Code: the programme should reflect the nature, scale, and complexity of the carrier's outsourcing arrangements.
Class 3A Carrier
For a Class 3A carrier with one insurance manager, one IT provider, and one cloud platform, the programme might consist of a structured annual assessment of each provider across the four regulatory domains, a documented escalation process for identified gaps, and a tested communication protocol for disruption events. This can be managed by one person — or by a fractional compliance officer — using a structured assessment framework.
Class 4 Carrier
For a Class 4 carrier with multiple insurance managers across jurisdictions, dozens of technology vendors, and complex cross-border data flows, the programme requires dedicated governance, automated monitoring, and regular scenario testing that includes third-party failure scenarios.
The common element is integration. Whether the programme is managed by one person or a team, it must assess operational performance, operational resilience, and regulatory compliance as a unified framework — not as three separate exercises conducted by three separate functions reporting to three separate committees.
Three questions test whether a board is ready
Three questions that will determine whether a carrier's third-party risk management is ready for the OpRes Code deadline:
Question One
For each critical third-party relationship, can you demonstrate that the provider's operational resilience has been assessed — not just their service quality? If the answer is "we have SLAs," the assessment has not been conducted. SLAs measure performance under normal conditions. The OpRes Code requires assessment of resilience under stress.
Question Two
Do your data processing agreements with third parties satisfy PIPA, the Cyber Code, and the OpRes Code simultaneously? If the agreements predate January 2025 — when PIPA came fully into force — they almost certainly do not. Legal counsel — particularly firms with specialist insurance regulatory practices in Bermuda — should review these agreements against the current code requirements. Updating these agreements is not a legal formality. It is the contractual foundation of the carrier's regulatory compliance across multiple instruments.
Question Three
Do you know what AI your third parties use in the services they provide to you? If the insurance manager uses AI in underwriting administration, if the claims TPA uses AI in fraud detection, if the cloud provider uses AI in security monitoring — these are AI use cases that the BMA's guidance expects the carrier to govern. The inventory must extend beyond the carrier's own walls.
About the author. Adam Wenham is the founder of Garrison, a Bermuda firm that provides senior technology leadership to Bermuda's regulated firms: covering technology seats, running programmes, bringing in specialists and getting firms ready for the BMA's technology codes. He led technology transformation and operational resilience at the Bank of England, held senior roles across operations, engineering, architecture, innovation and change during seventeen years at Credit Suisse, and led the technology modernisation function at StoneX. At both Credit Suisse and StoneX he led the technology side of mergers and acquisitions. He began his career at Barclays, where he ran the technology for the move of BZW's 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf. adam@garrison.re
Garrison · Hamilton, Bermuda · adam@garrison.re
Practitioner analysis, not legal advice. More at garrison.re/analysis