Define your role before looking for an insurance rule, then map compulsory cover and distribution duties

Business insurance compliance in England is a collection of legal, regulatory and contractual duties rather than one licence or checklist. The relevant rules change with the role being performed: buying insurance, underwriting it, advising, arranging, comparing, publishing, advertising, handling claims or processing personal information.

This planning guide was fact-checked on 5 September 2026 for teams preparing 2027 activity. Several FCA Handbook sections changed in June or July 2026. The specifics this guide works from are:

• FCA Handbook ICOBS 2.2, with July 2026 guidance on claims that suggest a cheaper premium, savings or lower cost.
• FCA Handbook ICOBS 2, ICOBS 5 and PROD 4: conduct rules, demands and needs, and product governance.
• The Data (Use and Access) Act and its commencement regulations, which determine when each provision starts to apply.
• ICO guidance under revision, including the April 2026 lawful-basis guidance and the data-sharing code flagged for review.

What to take away

Currency: No 2027-specific rule change alters the core duties in this guide. The 2026 FCA and ICO updates change detail, guidance and dates, not the framework.

Defining the role before applying an insurance rule

Map the complete journey from first advert to claim. Name every legal entity and record who:

One brand may conceal several firms. A publisher can move from general information into a regulated activity through what its forms, ranking, handoff or remuneration actually do. Describing a recommendation as "guidance" does not determine the perimeter.

The FCA's authorisation page for general insurance intermediaries covers proposed intermediaries, London market firms and price-comparison websites. It asks applicants to relate permissions to customers, distribution, client money and the business plan. Use it as an orientation point, then obtain perimeter analysis for each journey.

Worked example: one comparison-site journey. A comparison site lists commercial combined cover for small shops and earns a fee when a user submits an enquiry. The same journey touches several roles:

Record the entity, permission, owner and evidence for every row that applies.

Check compulsory cover in the operating business

GOV.UK says an employer generally needs Employers' Liability insurance when it takes on staff.

The duty sits in the Employers' Liability (Compulsory Insurance) Act 1969 and the Employers' Liability (Compulsory Insurance) Regulations 1998 made under it. It applies to employers in England, Scotland and Wales, and Northern Ireland has separate legislation.

Cover must be at least five million pounds and must come from an insurer authorised for that class of business. The employer must hold the certificate of insurance and make it available to staff, and the Health and Safety Executive enforces the duty.

The 1998 Regulations exempt some employers. Government departments, local authorities, police authorities and other public bodies are exempt. Employers are also exempt for employees who are close relatives, such as a spouse or civil partner, a parent, grandparent, child, grandchild, brother or sister.

A company whose only employee owns at least half of its issued share capital is exempt as well.

Territorially, the compulsory cover responds to employment in Great Britain. A member of staff based abroad permanently falls outside the statutory minimum, so check whether the policy is extended for overseas work.

Do not decide employment status from labels alone. Record the relationship, work location and exemption analysis. If the facts are uncertain, obtain employment and insurance advice before assuming a worker sits outside the requirement.

For road use, section 143 of the Road Traffic Act 1988 makes it an offence to use a motor vehicle on a road or other public place without a qualifying policy in force, and GOV.UK's vehicle insurance guidance states that third-party insurance is the legal minimum. The policy still needs the correct use, vehicle, driver and business arrangement. A personal policy should not be assumed to include commercial journeys.

Other requirements may come from sector legislation, a regulator, professional body, licence or commercial contract. Locate the controlling record for the precise activity and jurisdiction.

Treat the policy as a legal contract

The Insurance Act 2015 contains provisions for non-consumer insurance on fair presentation, knowledge, breach remedies, warranties, terms unrelated to loss and fraudulent claims. It also contains application and contracting-out provisions. Read the enacted text with the current contract and specialist advice.

A business should maintain a disclosure process that can be reconstructed. Assign owners for activities, finance, staff, contracts, property, claims and technology. Record who was asked, which systems were searched, what changed, how estimates were calculated and what the insurer clarified.

Fair presentation, one example. A proposal asks whether any director has been convicted of an offence involving dishonesty in the past five years. The form is answered no. If the insurer later finds a relevant conviction, the remedy depends on the nature of the breach.

A deliberate or reckless breach allows the insurer to avoid the contract and keep the premium. A careless breach brings a proportionate remedy: the contract is treated as if the insurer had known the truth and set the terms or premium it would have set, with any claim reduced accordingly.

Record who checked the answer, when, and against what.

Present information in an organised way. Separate fact, forecast and uncertainty. Do not bury a significant circumstance in an unstructured document collection or assume that last year's answer remains accurate.

Understand distribution responsibilities

FCA Handbook ICOBS 2 deals with general conduct matters, including customer categories, communications, record-keeping and the rule to act honestly, fairly and professionally in the customer's best interests. Application differs across provisions and customers.

ICOBS 5 covers demands and needs and advised sales. Its current text requires an insurance distributor to specify demands and needs from customer information before conclusion and ensure a proposed contract is consistent with them. Where advice is provided, further suitability and explanation requirements may apply.

An operational file should retain the customer facts, demands-and-needs statement, service status, market scope, quotation, policy documents and recommendation explanation where relevant. A regulated firm cannot use a generic website persona as the individual assessment.

Manufacturers and distributors may also fall within FCA Handbook PROD 4. Its insurance product-governance rules address target markets, compatibility, fair value, distribution arrangements, information flows, monitoring and remediation. Determine which duties attach to each party and how evidence is exchanged.

Control business insurance advertising

Insurance adverts can be financial promotions. The FCA's approval overview explains the section 21 restriction of the Financial Services and Markets Act 2000 at a high level: an invitation or inducement communicated in business must generally be issued by an authorised person, lawfully approved or fall within an exemption.

Do not assume that editorial format, a business audience or an affiliate label removes the restriction. Analyse the content, communicator, recipient, product and call to action. Confirm the authorised firm and approver permission where approval is relied upon.

FCA Handbook ICOBS 2.2 applies its clear, fair and not misleading requirement to covered insurance communications and promotions. July 2026 guidance specifically addresses claims suggesting cheaper premium, savings or lower cost. The basis, expected customer outcome and significant limitations need proper prominence.

Non-broadcast advertising must also be checked against the CAP Code. Section 14 says financial offers should be understandable to their audience and addresses the nature of the contract, limitations, expenses, penalties, charges and withdrawal information. Technical FCA-controlled matters and general advertising issues should be routed to the correct reviewer.

Build a claim register before copywriting. For each benefit, price, saving, coverage statement or comparison, record the evidence, sample, date, scope, qualification and owner. Prevent publication when a qualification contradicts the headline or appears only after the user has acted.

Separate editorial work from regulated influence

A publisher should disclose paid placement, affiliate relationships and provider-supplied claims. Commercial payment must not be allowed to silently alter inclusion, order or conclusions. Each named provider needs a current first-party record and, where relevant, a verified FCA Register entry.

Reviews should state the method, date, documents examined and limitations. Do not claim first-hand testing when none occurred. A provider statement about service speed is not independent performance evidence; label it and look for a compatible public measure.

Keep internal linking editorially controlled. For draft sites, store intended article identifiers without live links until the destination exists and has passed review. This prevents an unfinished page from being presented as supporting evidence.

Govern personal information throughout the chain

A corporate customer can still supply personal information about directors, employees, drivers, claimants or contacts. Map every field from collection to insurer, broker, comparison partner, software provider, analytics service and archive.

The ICO's April 2026 lawful-basis guidance says a valid basis must be identified and documented before processing. Purposes and the basis belong in the privacy information. If the purpose changes, the original decision must be reconsidered.

Do not collapse quotation, policy administration, fraud work, claim handling, analytics and direct marketing into one vague purpose. Test necessity and transparency separately. PECR and the ICO's direct-marketing guidance may add rules for email, text, calls and tracking.

Health information and other defined categories receive additional protection. The ICO's special category data guide explains the need for both a UK GDPR Article 6 basis and an Article 9 condition. Schedule 1 to the Data Protection Act 2018 sets the detailed conditions and, in some cases, requires an appropriate policy document.

Distinguish controllers, joint controllers and processors by actual decisions. The ICO's data-sharing code covers sharing between controllers and notes the different framework for processors. The page is currently flagged for review after legislative change, so log the version used.

Minimise fields, restrict access, secure transfer, govern suppliers, set retention and test correction, access, deletion and incident workflows. Free-text boxes and document uploads deserve special care because users can provide more sensitive information than requested.

Reconcile insurance with commercial contracts

Customer and supplier contracts can specify cover type, limit, insured parties, territory, duration, notification, waiver, subrogation, evidence and conduct after a claim. Extract each requirement into a clause schedule and compare it with the actual policy.

The contract requirement and policy response may diverge. A minimum limit does not cap liability unless the contract says so effectively. A certificate does not amend the wording. An obligation to maintain cover for years may need a run-off plan, especially where the policy responds to claims made and notified rather than an event during the original work.

Do not agree additional-insured status, waiver of subrogation, primary wording or claim-control terms until the insurer confirms what can be endorsed. Commercial and insurance advisers should reconcile competing notification and settlement duties before signature.

The Third Parties (Rights against Insurers) Act 2010 can be relevant when an insured with a liability becomes insolvent. Whether rights transfer and what can be recovered depends on statutory and contractual facts. Avoid presenting it as a universal direct claim against an insurer.

The compliance control matrix

Create a row for every material obligation:

Distinguish a legal requirement from regulator guidance, an advertising-code rule, recommended practice and a commercial promise. Each carries a different authority and consequence.

Operate publication-day and change controls

Before publishing a compliance article or promotional page, reopen every rule, official figure, provider status, price and policy feature. Record the reviewer and date. Legal material should be checked by an appropriately qualified person, and financial-promotion copy by the accountable authorised firm where necessary.

After release, monitor for Handbook updates, legislation commencement, ICO revisions, provider or approver status changes, withdrawn products, pricing changes and complaints that reveal misunderstanding. Pause affected pages while material uncertainty is assessed.

Keep an immutable copy of the approved version and the evidence pack. When making a correction, state what changed and propagate it to syndicated, social, email and affiliate versions.

Common failure points

Compliance breaks when teams copy a rule without its application section, use "UK" and "England" interchangeably, treat guidance as a guarantee, hide commercial influence or let a partner alter approved text.

Set explicit stop conditions: missing permission, unknown insurer, unverified price, ambiguous approval, absent legal review, unsupported comparison, unexplained sensitive data or a mismatch between contract and policy. The commercial deadline does not resolve any of them.

The final compliance position should remain conditional and dated. A sound process identifies which facts make a rule applicable, who confirmed those facts and what evidence demonstrates the control.

Before you act

Common questions

How do I know which rules apply to my business?

Map the complete journey from first advert to claim, then name every legal entity and record who designs, promotes, arranges, recommends, holds money, decides personal information purposes and handles claims. The relevant rules change with the role being performed, so obtain perimeter analysis for each journey.

What insurance must an employer have?

GOV.UK says an employer generally needs Employers' Liability insurance when it takes on staff. The duty sits in the Employers' Liability (Compulsory Insurance) Act 1969: at least five million pounds of cover from an authorised insurer, with exemptions for public bodies, close relatives of the employer and single-employee companies that meet the shareholding test.

It applies to employment in Great Britain, and the employer must make the certificate available to staff.

What must an insurance distributor do before selling?

ICOBS 5 requires an insurance distributor to specify demands and needs from customer information before conclusion and ensure a proposed contract is consistent with them. Where advice is provided, further suitability and explanation requirements may apply. Retain the customer facts, demands-and-needs statement, service status, market scope and recommendation explanation.

Official sources

• FCA Handbook ICOBS 2 general matters
• FCA Handbook ICOBS 5 client needs