Insurance Regulatory Unit Resolution No. 58 of 2023 Issuing the Corporate Governance Rules

Insurance Regulatory Unit Resolution No. 58 of 2023
Issuing the Corporate Governance Rules

Article One

The Corporate Governance Rules for Insurance and/or Reinsurance Companies, the texts of which are attached to this Resolution, are hereby issued.

Article Two

The Corporate Governance Rules for Insurance and/or Reinsurance Companies shall apply from 1/1/2025, and all persons subject to them shall regularise their positions during this period.
* Replaced by Resolution No. 59 of 2023 (Kuwait Al-Youm, Issue No. 1663, 26 November 2023).

Chapter One: Overview and Definitions

Overview

These Rules set out the corporate governance requirements of the Insurance Regulatory Unit (hereinafter referred to as “the Unit”) which insurance companies shall meet. The Rules provide a set of relationships between the company’s Board of Directors, Senior Management, customers and other stakeholders; and a structure through which the objectives of the insurance company are set, and the means of attaining those objectives and monitoring performance are determined.
These Rules aim to establish robust standards of corporate governance in the insurance industry in accordance with internationally recognised best practice, and to ensure the stability of the insurance sector through insurance companies that are able to conduct their business in a sound and prudent manner. They are also designed to promote transparency and to promote the legitimate interests of policyholders and other stakeholders.
The corporate governance framework is regarded as the fundamental objective for the protection of the rights of shareholders and stakeholders, and it is through this framework that the general objectives and strategies of companies are set, contributing to establishing the vision and the objectives that achieve sustainability and to presenting the company’s financial position. The governance rules aim to set out the rights of shareholders and stakeholders by establishing a general framework for companies built principally on the principle of fairness and transparency and on an effective control system for obtaining accurate and correct information on the affairs of companies. The Board of Directors elected by the shareholders consists of the persons responsible for setting the vision, mission and objectives of the company, and Senior Management is responsible for achieving the strategies determined by the Board of Directors. The Board of Directors shall treat all shareholders equally, fairly and without any discrimination. The insurance company shall also have a written policy to ensure the protection of the rights of shareholders and stakeholders. Furthermore, the insurance company and the Board of Directors shall take serious steps and measures in order to:
(1) Encourage shareholders, in particular minority shareholders, to participate effectively and to express their views and proposals at the General Meeting.
(2) The Board of Directors shall choose the appropriate place and time for holding the General Meeting so as to facilitate the participation and attendance of shareholders.
(3) Ensure the presence of a sufficient number of members of the Board of Directors and of Senior Management to answer the questions and concerns of shareholders.
The rights of shareholders are as follows:
(1) Electing, removing and replacing the Board of Directors.
(2) Amending the memorandum of association and the articles of association of the company.
(3) Appointing the external auditor.
(4) Being entitled to full disclosure and transparency from the company.
All uses of the term “shall” refer to mandatory requirements which entail regulatory consequences if they are not met, and are denoted by the letter “M”. The other elements (including those using the terms “should” or “may”) are intended to serve as guidance, and are denoted by the letter “G”.

Definitions

Article 1

1. The words and expressions used in these Rules shall have the meanings assigned to them in the Law and its Executive Regulations, which shall be deemed an integral part of these Rules. The following words and expressions shall have the meaning set out opposite each of them, unless the context requires otherwise:
2. Law: Law No. (125) of 2019 on the Regulation of Insurance, as amended.
3. Unit: the Insurance Regulatory Unit. Regulations: the Executive Regulations of Law No. 125 of 2019 on the Regulation of Insurance, as amended.
4. Rules: the Corporate Governance Rules.
5. Persons Subject to the Rules: insurance companies, reinsurance companies, takaful insurance companies and takaful reinsurance companies.
6. Companies Law: Law No. 1 of 2016 Promulgating the Companies Law, as amended.
7. Insurance Company (the Company): a public or closed shareholding company, or a branch of a foreign company, licensed to carry on insurance business or reinsurance business (conventional insurance and takaful insurance) in accordance with the provisions of Law No. 125 of 2019.
8. Takaful Insurance Company: a public or closed shareholding company, or a branch of a foreign company, licensed to carry on takaful insurance business in accordance with the provisions of the Law, without conflict with the provisions of Islamic Sharia and the governing laws and resolutions, and whose objects include carrying on takaful insurance business in accordance with the principles of Islamic Sharia.
9. Board of Directors (the Board): a body of elected or appointed individuals who are ultimately responsible for the governance and oversight of the insurance company. In the case of a branch of a foreign company, it is the authorised manager of that company.
10. Control Function: a function (whether a person, unit or department) in an insurance company that is responsible for providing objective assessment, reporting and/or assurance; this includes the risk management, compliance, actuarial and internal audit functions.
11. Key Persons in Control Functions: the persons responsible for heading the key control functions.
12. Corporate Governance: a set of relationships between the insurance company’s Board of Directors, Senior Management, customers and other stakeholders, and a structure through which the objectives of the insurance company are set, and the means of attaining those objectives and monitoring performance are determined.
13. Corporate Governance Framework: the strategies, policies and processes through which the insurance company is managed and controlled.
14. Senior Management: a group of individuals appointed by the Board of Directors to manage the insurance company on a day-to-day basis in accordance with the strategies, policies and procedures set by the Board of Directors. They are responsible for overseeing the management of the insurance company.
15. Non-Executive Board Member: a board member who is not fully engaged in the management of the insurance company on a full-time basis and does not receive a salary from it. The remuneration received in the capacity of board member shall not be deemed a salary.
16. Independent Board Member: a non-executive board member who is not subject to the influence of any factor that may limit his ability to consider, discuss and take decisions on the affairs of the insurance company impartially and objectively in the interest of the insurance company and in accordance with the applicable laws and regulations. The independent board member shall meet the criteria set out in Article 10 of these Rules.
17. Subsidiary: a company shall be deemed a subsidiary where a person owns more than 50% of its capital or has actual control over it.
18. Associate Company: a company shall be deemed an associate where a person owns, directly or indirectly, more than 20% and less than 50% of its capital, or has significant influence over its decisions.
19. Stakeholders: every natural or legal person having an interest in the person.
20. Related Parties: a natural or legal person or group owning 5% or more of the company’s capital, or having a commercial or family relationship that may influence decision-making.
21. Outsourcing: an arrangement between an insurance company and a service provider, whether internal (within a group) or external, under which the latter performs a process, service or activity that could otherwise have been performed by the company.

Scope of Application

Article 2

An insurance company operating as a foreign branch in Kuwait shall appoint a branch manager, who shall have overall executive responsibility for the management of the branch and its compliance with the applicable regulations. The foreign branch shall also submit to the Unit an annual report from the parent company setting out details of its corporate governance framework and the extent of its consistency with the regulatory regime in its home country. The report shall be disclosed to the public and shall indicate, as a minimum, the following:
1) How the Board of Directors or its committees in the home country discuss, analyse and provide direction to the branch operating in Kuwait.
2) The organisational structure, and the responsibilities and duties of each member of Senior Management.
3) How the control functions are exercised in respect of the branch in Kuwait, and their reporting lines to the Board of Directors.
The branch shall not be required to comply with the other requirements of these Rules unless specifically required by the Unit.

Chapter Two: Board of Directors

Board of Directors

Article 3 (M)

The Board of Directors shall:
1- Bear full responsibility for promoting the sustainable growth and financial soundness of the insurance company, and for ensuring appropriate standards of fair treatment, without undue influence from any party.
2- Establish a corporate governance framework documenting the powers, delegations of authority, responsibilities and procedures of the Board of Directors, the Board committees and the Board Secretary. The framework shall also define the oversight role of the Board of Directors over Senior Management.
3- Be responsible for preparing, approving and providing the overall strategy and direction of the insurance company and for overseeing its sound overall management, while leaving the day-to-day management of the insurance company to Senior Management.
4- Ensure that there is a clear and properly documented allocation of roles and responsibilities to the Board as a whole, the Board committees, Senior Management and the key persons in control functions, so as to ensure appropriate oversight and the soundness of the insurance company. In particular, it shall ensure a clear separation between the roles of the Chairman and the Chief Executive Officer, reinforcing the distinction between the roles in terms of accountability for oversight and management.

Article 4 (M)

The Board shall, as a minimum, carry out the following key responsibilities:
(a) Ensuring that appropriate policies and processes are in place relating to the appointment, dismissal and succession of Senior Management, and actively participating in such processes;
(b) Approving the terms of reference of all Board committees;
(c) Approving the risk tolerance, business plans and other initiatives that would, individually or cumulatively, have a material impact on the risk profile of the insurance company;
(d) Ensuring that the knowledge and expertise of Senior Management remain appropriate given the nature of the insurance company’s business and its risks;
(e) Monitoring and ensuring that the Senior Management of the insurance company carries out its duties in accordance with the strategies, policies, risk tolerance, and corporate values and culture set by the Board of Directors;
(f) Adopting a written remuneration policy and overseeing its implementation, which shall not induce excessive or unwarranted risk-taking and shall be consistent with the company’s culture, objectives, strategies, defined risk appetite and the long-term interests of the insurance company, while giving due regard to the interests of policyholders and other stakeholders;
(g) Meeting regularly with Senior Management to discuss and review any decisions taken, regarding the information and explanations provided by Senior Management in respect of the business and operations of the insurance company.
(h) Interacting regularly with any committee of the Board of Directors and with the other key functions established by the Board, proactively requesting information from them and challenging that information where necessary;
(n) Promoting sustainability through environmental, social and governance considerations in the business strategies of the insurance company;
(i) Overseeing and approving the recovery, resolution and business continuity plans of the insurance company to restore its financial strength and maintain critical operations and services when it comes under stress;
(k) Promoting effective and timely communication between the insurance company and the Unit on matters that affect or may affect the safety and soundness of the insurance company;
(l) Promoting a sound corporate culture within the insurance company that supports ethical and professional conduct. In this context, the Board of Directors shall:
(1) Take the lead in setting the appropriate tone from the top, starting with the Board of Directors, and ensure that these values are properly communicated throughout the insurance company. In this regard, the Board of Directors shall take into account the interests of policyholders, contracting parties and other relevant stakeholders.
(2) Establish codes of business conduct and oversee their implementation in order to manage any potential risks relating to reputation or improper or illegal activity, such as false financial reporting and fraud, money laundering, bribery and corruption.
(3) Establish policies and processes that promote transparency and facilitate open communication, and oversee their implementation, whereby employees are able to report concerns or information about illegal or unethical conduct, directly or indirectly, to the Board of Directors confidentially and without fear of retaliation (for example, a whistleblowing policy and detailed guidance material as set out in Annex 1).
(m) Ensuring that the insurance company discloses relevant and comprehensive information in a timely manner, so as to give policyholders, contracting parties and other stakeholders a clear view of its business activities, risks, performance and financial position.

Article 5 (M)

The Board of Directors shall review whether Senior Management is properly implementing the relevant policies and processes, as set by the Board, and whether they are operating as intended. For this purpose, the Board of Directors shall receive reports at least quarterly, and such reports may include internal or independent external reports, as appropriate.

Article 6 (M)

The insurance company shall ensure that the Board of Directors and its committees are provided with adequate resources to perform their duties, and that the Board has the authority to obtain comprehensive and timely information relating to the management of the insurance company, including direct access to the relevant persons within the company to obtain information, such as Senior Management and the key persons in control functions.

Composition of the Board of Directors

Article 7 (M)

The number of members of the Board of Directors of an insurance company shall not be less than five, and the number of independent board members shall not be less than two and shall not exceed half of the members of the Board of Directors.

Article 8 (M)

The Rules on Compliance with Professional Ethics, Competence and Integrity shall apply to the members of the Board of Directors, and the members of the Board of Directors shall collectively possess the relevant expertise as necessary to provide effective leadership, direction and oversight of the business of the insurance company so as to ensure that it is conducted in a sound and prudent manner.

Article 9 (M)

The formal and perceived independence of the members of the Board of Directors shall be ensured in order to promote objectivity in the Board’s decision-making. To this end, the members of the Board of Directors shall avoid personal relationships, financial interests or business that conflict with the interests of the insurance company.

Article 10 (M)

An independent board member shall, from the start of nomination and throughout the term of membership, meet the following conditions:
(a) The combined holding of the independent member and the holdings of any of his first-degree relatives, directly or indirectly, shall not exceed 1% of the shares of the insurance company.
(b) The independent member shall not have a first-degree relationship with any of the members of the Board of Directors or Senior Management of the insurance company or the insurance group.
(c) He shall not have been an employee of the insurance company or of another member of the insurance group, or of any of the major shareholders of the insurance company or the insurance group, or of a company subject to acquisition by the insurance company or the insurance group, during the two years preceding his application for nomination to membership of the Board of Directors.
(d) He shall not have been a partner in the insurance company’s external audit firm or a member of the audit team of the insurance company, or a member of its insurance group, nor have a close first-degree relationship with the partner responsible for the external audit engagement, during the two years preceding his application for nomination to membership of the Board of Directors.
(e) The independent member shall not receive from the insurance company any salary or sum of money other than what is received as payment for membership of the Board of Directors, dividends in his capacity as a shareholder, claim payments under insurance policies with the insurance company, or a distribution of surplus due to him as a participant in the takaful insurance company.
(f) The membership of independent members shall not exceed two terms.
The independent member shall immediately disclose to the Board of Directors any change in his circumstances that may affect his status as an independent member. In such a case, the Board of Directors shall review his appointment as an independent member and notify the Unit in writing of its decision to confirm or change his status.

Board Meetings

Article 11 (M)

The Board shall hold at least six meetings a year, and members attending remotely by audio or video communication shall be deemed present for the purposes of this paragraph.

Article 12 (G)

A member of the Board of Directors should attend meetings in person whenever possible. If the member is unable to attend in person, he may attend remotely where possible, and the insurance company should make the technical arrangements to facilitate this.

Article 13 (G)

If a member of the Board of Directors fails to attend half of the meetings of the Board and/or its committees without an acceptable excuse, the Unit may consider this a ground for withdrawing his individual approval as a member of the Board.

Article 14 (M)

The insurance company shall ensure that the minutes of the meetings of the Board of Directors and its committees are documented clearly and accurately.

Chairman of the Board

Article 15 (M)

The Board of Directors shall select a non-executive member as Chairman of the Board, and the Chairman of the Board of Directors shall not hold the position of chairman of any committee of the Board.

Article 16 (M)

The insurance company shall define the role of the Chairman of the Board of Directors within its corporate governance framework. Furthermore, in addition to the general duties of members of the Board of Directors and the duties specified in the Companies Law, the duties of the Chairman of the Board of Directors shall include, without limitation, the following:
(a) approving the agenda of the meeting of the Board of Directors; and
(b) ensuring that sufficient time is allocated to the discussion of agenda items, particularly those involving strategic decisions or decisions relating to policies of significant importance.

Board Committees

Article 17 (G)

The Board of Directors may delegate certain activities or tasks associated with its roles and responsibilities to committees of the Board. Notwithstanding such delegation, the Board as a whole retains ultimate responsibility for the delegated activities or tasks, and for decisions taken on the basis of any advice or recommendations provided by the persons or committees to which the tasks were delegated.

Article 18 (M)

As a minimum, the Board of Directors shall establish four committees: the Nominations Committee, the Remuneration Committee, the Risk Committee and the Audit Committee.
(G) However, the Board of Directors may:
– combine the Nominations Committee and the Remuneration Committee;
– establish additional committees, provided that this is exercised under well-defined mandates, with the ability to monitor and take full responsibility for their activities. In all cases, each committee of the Board of Directors shall assume the responsibilities assigned to it as set out in Annex 2. It may also be delegated additional responsibilities at the discretion of the Board of Directors.

Article 19 (M)

A committee of the Board may include persons who are not members of the Board of Directors, whether from within or outside the company, provided that all necessary procedures and policies are adopted for the persons engaged from outside the company,
but the following conditions shall be observed:
(a) it shall comprise at least three members;
(b) it shall have a majority of non-executive members of the Board of Directors;
(c) it shall be chaired by a non-executive member of the Board of Directors; and
(d) it shall comprise members who possess the skills, knowledge and experience relevant to the responsibilities assigned to it;
(e) its membership shall include an independent member;
(f) neither the Chairman of the Board of Directors nor an executive member shall chair any committee of the Board.
A committee of the Board may seek external professional advice, where necessary for the performance of its role, at the expense of the insurance company, after obtaining the approval of the Board.

Article 20 (G)

The Board of Directors should consider the occasional rotation of members and chairmen of committees, or term limits for serving on a committee, in order to avoid undue concentration of power and to promote fresh perspectives.

Article 21 (G)

All committees of the Board of Directors should submit periodic reports to the Board on their activities, the performance of their tasks and the decisions taken.

Conflicts of Interest

Article 22 (M)

The Board shall establish a written policy for addressing any actual or potential conflicts of interest with and among its members. As a minimum, the policy shall:
(a) identify the circumstances that constitute, or may give rise to, conflicts of interest;
(b) clearly define the process by which members may inform the Board of Directors of any change in their circumstances that may give rise to a conflict of interest;
(c) identify those responsible for maintaining up-to-date records of conflicts of interest for each member; and
(d) set out how any non-compliance with the policy is to be addressed.

Article 23 (M)

A member of the Board of Directors shall disclose to the Board the nature and extent of his interest in any material transaction or arrangement, and if such material transaction or arrangement is under deliberation during a meeting of the Board, he/she shall be absent during such deliberations.

Board Effectiveness

Article 24 (M)

The Board of Directors shall review its performance, including the preparation of Key Performance Indicators (KPIs) and the evaluation of the performance of the Board of Directors and its committees and of Senior Management, at least annually, to ascertain whether the members, collectively and individually, remain effective in discharging the roles and responsibilities assigned to them, and to identify opportunities to improve the performance of the Board as a whole.

Article 25 (G)

The Board should implement appropriate measures to address any deficiencies identified, including any training programmes for members of the Board.

Article 26 (G)

The Board may also consider using external expertise from time to time to conduct the performance evaluation where appropriate, in order to enhance the objectivity and integrity of the evaluation process.

Board Secretary

Article 27 (M)

The Board Secretary is responsible for supporting the effective performance of the Board. As a minimum, the Board Secretary shall perform the following tasks:
(a) advising the Board of Directors on governance matters;
(b) facilitating the effective flow of information between the Board of Directors, the committees of the Board and Senior Management;
(c) maintaining the records and documents of the meetings of the Board of Directors, including records of voting on draft resolutions of the Board, and ensuring that the minutes are approved and signed as required under the Companies Law;
(d) ensuring that the Board has appropriate advice to ensure that its decisions comply with the relevant legislation; and
(e) preparing for the meetings of the General Meeting;
(f) coordinating with the Chairman of the Board of Directors on the meetings of the Board, their agenda, venue and timing, and notifying the members of the Board of Directors of the date of Board meetings a maximum of three working days before the date of the meeting; except for emergency meetings, for which the invitation to convene the meeting shall be sent at the time and all necessary procedures shall be taken to hold such meetings.

Article 28 (M)

The Board shall approve the appointment and removal of the Board Secretary.

Chapter Three: Senior Management

Senior Management

Article 29 (M)

The Board of Directors appoints Senior Management, which is accountable for implementing the decisions of the Board of Directors and is responsible for directing and overseeing the operations of the insurance company. Senior Management includes the Chief Executive Officer and his deputy/deputies, and the executive managers and their deputies, or equivalent job titles, who are entrusted with the task of managing the insurance company, and the Board of Directors shall define their powers.

Article 30 (M)

Senior Management shall:
(a) carry out the day-to-day operations of the insurance company effectively and in accordance with the insurance company’s culture, objectives and business strategies for achieving those objectives, in line with the long-term interests and viability of the insurance company;
(b) promote sound risk management, compliance and the fair treatment of customers;
(c) provide the Board of Directors with adequate and timely information to enable the Board to carry out its duties and functions, including monitoring and reviewing the performance of the insurance company, its risk exposures and the performance of Senior Management; and
(d) maintain adequate and orderly records of the internal organisation of the insurance company;
(e) prepare, review and audit the quarterly, semi-annual and annual financial statements and reports and submit them to the Board of Directors.

Article 31 (M)

Senior Management shall implement appropriate systems and controls, in accordance with the risk tolerance and the established values of the company and the risk appetite approved by the Board of Directors and/or the Risk Committee, consistent with internal policies and processes. These systems and controls shall include the following:
(a) processes for engaging persons of appropriate competence and integrity to perform tasks under the supervision of Senior Management;
(b) clear lines of accountability and channels of communication between persons in Senior Management and key persons in control functions;
(c) appropriate procedures for delegating Senior Management functions, and for monitoring whether the delegated functions are carried out effectively and properly;
(d) standards and codes of conduct for Senior Management and other employees to promote a sound corporate culture, and their effective implementation on an ongoing basis;
(e) appropriate channels of communication, including clear reporting lines and provisions for implementing the whistleblowing policy, between the individuals performing Senior Management functions and the Board of Directors, and their effective application;
(f) strategies for effective communication between the insurance company, the Unit and stakeholders, including identifying the matters that should be disclosed and the party to whom disclosure should be made.

Article 32 (M)

Senior Management shall facilitate the oversight role of the Board of Directors by providing relevant, accurate and timely information to the Board, enabling it to oversee the management and operations of the insurance company, to evaluate policies and to determine whether the insurance company is operating in an appropriate control environment.

Control Functions

Article 33 (M)

The insurance company shall have, as part of its overall corporate governance framework, an effective system of internal controls, including effective Risk Management, Compliance, Actuarial and Internal Audit Functions.
However, the existence of these control functions does not relieve the Board of Directors or Senior Management of their respective governance and related responsibilities.

Article 34 (M)

The system of internal controls shall ensure effective and efficient operations, adequate control of risks, prudent conduct of business, reliability of reported financial and non-financial information (both internal and external), and compliance with laws, regulations and supervisory requirements, as well as the internal rules and decisions of the insurance company. The system shall be designed and operated to assist the Board of Directors and Senior Management in fulfilling their respective responsibilities for the management and control of the insurance company.

Article 35 (G)

The system of internal controls should cover all operational activities of the insurance company and should be an integral part of the company’s day-to-day operations. The controls should form a coherent system that is assessed and improved regularly as necessary.

Article 36 (M)

The control functions shall be subject to periodic review either by the Internal Audit Function (for control functions other than internal audit) or by an objective external reviewer.

Article 37 (G)

The appointment, performance evaluation, remuneration, discipline and removal of the head of a control function may be made with the approval of, or after consultation with, the Board of Directors or the relevant committee of the Board. For the Head of the Internal Audit Function, the appointment, performance evaluation, remuneration, discipline and dismissal may be made by the Board of Directors, its Chairman or the Audit Committee.

Article 38 (M)

The Board of Directors shall approve the authority and responsibilities of each control function so as to allow each control function to have the authority and independence necessary to be effective.
The head of each control function shall have direct access to the Board of Directors or to the relevant Board committee.
Each control function shall avoid conflicts of interest; where any conflict persists and cannot be resolved with Senior Management, such disagreements shall be escalated to the Board of Directors for resolution.

Article 39 (G)

The authority and responsibilities of each control function should be set out in writing and form part of the insurance company’s governance documents. The head of each control function should review this matter periodically and submit proposals for any changes to Senior Management and the Board of Directors for approval, where appropriate.

Article 40 (M)

The head of a control function shall not have responsibilities in the operational business of the company.

Risk Management Function

Article 41 (M)

The insurance company shall have an effective Risk Management Function, overseen by the Risk Committee, capable of assisting the insurance company to:
(a) identify, assess, monitor, mitigate and report on its key risks in a timely manner; and
(b) promote and sustain a sound risk culture.
(c) define and ensure the effectiveness and efficiency of the risk management system, and implement the risk management strategy approved by the Board of Directors.
(d) develop a consistent risk management plan and corrective actions for emerging risks.

Article 42 (M)

The Risk Management Function shall have direct access to the Board of Directors or its Risk Committee and shall submit written reports to them, as required by those bodies, on matters such as:
(a) an assessment of risk positions and risk exposures and the steps being taken to manage them;
(b) an assessment of changes in the insurance company’s risk profile relative to risk tolerance;
(c) an assessment of pre-set risk limits, where appropriate;
(d) risk management issues arising from strategic matters, such as corporate strategy, mergers and acquisitions, and major projects and investments, where appropriate;
(e) an assessment of risk events and the identification of appropriate remedial actions.

Article 43 (M)

The Head of the Risk Management Function shall have the authority and the obligation to inform the Board promptly of any circumstance that may have a material effect on the insurance company’s risk management system.

Article 44 (M)

The Risk Management Function shall establish, implement and maintain appropriate mechanisms and activities, including:
(a) assisting the Board of Directors and Senior Management in carrying out their respective responsibilities, including by providing specialist analyses and performing risk reviews;
(b) identifying the individual and aggregated risks (actual, emerging and potential) of the insurance company;
(c) assessing, aggregating or monitoring the identified risks effectively, or helping to manage or address them, including assessing the insurance company’s capacity to absorb risk with due regard to the nature, probability, duration, correlation and potential severity of risks;
(d) obtaining and maintaining an aggregated view of the insurance company’s risk profile at the legal entity level and/or at the group level;
(e) developing a forward-looking assessment of the insurance company’s risk profile;
(f) assessing the internal and external risk environment on an ongoing basis in order to identify and assess potential risks as early as possible;
(g) conducting stress testing and scenario analysis on a regular basis; and
(h) regularly submitting written reports to Senior Management, key persons in control functions, the Board of Directors and the Risk Committee on the insurance company’s risk profile, details of the risk exposures facing the insurance company, and related mitigation actions, as appropriate.

Compliance Function

Article 45 (M)

The insurance company shall have an effective Compliance Function, overseen by the Audit Committee and the Board of Directors, capable of assisting the insurance company to:
(a) meet its legal, regulatory and supervisory obligations; and
(b) promote and sustain a compliance culture, including through monitoring compliance with internal policies.
(c) monitor and develop the level of compliance of the company’s policies with external laws, regulations and rules and the relevant legislation.

Article 46 (M)

The Compliance Function shall have direct access to Senior Management, key persons in control functions, the Board of Directors and the Audit Committee, and shall submit written reports to them on matters such as:
(a) an assessment of the key compliance risks the insurance company faces and the steps being taken to address them;
(b) an assessment of how the various parts of the insurance company (for example, divisions, major business units and product areas) are performing against compliance standards and goals;
(c) any compliance issues involving management or persons in positions of major responsibility within the insurance company, or any material compliance issues involving any other person or unit of the insurance company, and in each case any related investigations or other actions being taken;
(d) financial fines or other disciplinary actions taken by any regulatory or supervisory authority in respect of the insurance company or any of its employees.
(e) reports on anti-money laundering, combating the financing of terrorism and combating the financing of the proliferation of weapons of mass destruction.

Article 47 (M)

The Head of the Compliance Function shall have the authority and the obligation to inform the Chairman of the Board of Directors promptly and directly in the event of any major non-compliance by a member of management, Senior Management or an employee of the company, or any material non-compliance by the insurance company with an external obligation, if in either case he believes that Senior Management or other persons in authority at the insurance company are not taking the necessary corrective action and that a delay would be detrimental to the insurance company or its policyholders.

Article 48 (G)

The Compliance Function should establish, implement and maintain appropriate mechanisms and activities for a number of purposes, including:
(a) promoting and sustaining an ethical corporate culture that values responsible conduct and compliance with internal and external obligations;
(b) identifying, assessing, reporting on and addressing key legal and regulatory obligations, including obligations to the Unit, and the risks associated therewith;
(c) ensuring that appropriate policies, processes and controls are in place, implemented and monitored in respect of key areas of legal, regulatory and ethical obligations;
(d) providing regular training on key legal and regulatory obligations, particularly for employees in positions of high responsibility or who are involved in high-risk activities;
(f) addressing compliance shortcomings and violations, including ensuring that adequate disciplinary action is taken and that any necessary reports are made to the Unit; and
(g) conducting regular self-assessments of the Compliance Function and compliance processes, and implementing or monitoring required improvements.
(j) ensuring the effectiveness of work on anti-money laundering and combating the financing of terrorism, and developing the internal policy in this regard.

Actuarial Function

Article 49 (M)

The insurance company shall appoint a person registered with the Unit to be its actuary. Responsibility for appointing the actuary rests with the Board of Directors. In discharging this responsibility, the Board shall ensure that the appointment of the particular actuary complies with the requirements set out in these Rules and any other instructions issued by the Unit.
The insurance company shall notify the Unit of such appointment.

Article 50 (M)

The insurance company shall have an effective Actuarial Function capable of evaluating and providing advice on, at least, technical provisions, premium and pricing activities, capital adequacy, reinsurance and compliance with the relevant legal and regulatory requirements. In addition to the duties specified in the Law and the Executive Regulations of the Unit, the responsibilities of the actuary shall include, without limitation:
(a) reviewing, evaluating and advising on the company’s policy on actuarial matters, procedures and controls.
(b) preparing the actuarial calculations.
(c) reviewing and evaluating the solvency margin and the financial and technical position of the company.
(d) reviewing, evaluating and making recommendations on the company’s investment policy
(e) reviewing and evaluating the validity and accuracy of data and information on matters relating to the calculation of technical provisions.
(f) reviewing, evaluating and advising on reinsurance arrangements and strategy in order to maintain the financial position of the company.
(g) reviewing and evaluating the company’s general policy on insurance products, in addition to designing and developing the pricing policy and reviewing the terms and limitations of insurance policies and contracts.

Article 51 (M)

The Actuarial Function shall have direct access to the Board of Directors or to one of its relevant committees and shall submit periodic reports to it on matters such as:
(a) any circumstance that may have a material effect on the insurance company from an actuarial perspective.
(b) the adequacy of technical provisions and other liabilities.
(c) stress testing and capital adequacy assessment with regard to the prospective solvency position of the insurance company.
(d) any other matters determined by the Board.

Internal Audit Function

Article 52 (M)

The insurance company shall have an effective Internal Audit Function capable of providing the Board of Directors with independent assurance in respect of the quality and effectiveness of the insurance company’s corporate governance framework.

Article 53 (M)

The Internal Audit Function shall be independent from Senior Management and from other control functions, and shall not be involved in the operations of the company.
Ultimate responsibility for the Internal Audit Function rests with the Board of Directors and the Audit Committee, not with Senior Management.

Article 54 (M)

The Board shall grant the Internal Audit Function appropriate authority, including the authority to:
(a) access and review any records or information of the insurance company which the Internal Audit Function deems necessary to carry out an audit or other review;
(b) undertake, on the Internal Audit Function’s own initiative, a review of any area or any function consistent with its mandate;
(c) require an appropriate management response to an internal audit report, including the development of a suitable remediation, mitigation or other follow-up plan as needed; and
(d) decline to carry out an audit or review, or to take on any other responsibilities requested by Senior Management, if the Internal Audit Function believes that this is inconsistent with its mandate or with the strategy and audit plan approved by the Board of Directors. In any such case, the Internal Audit Function shall inform the Board of Directors or the Audit Committee and seek their guidance.

Article 55 (M)

The Head of the Internal Audit Function shall report to the Chairman of the Audit Committee.
The reports of the Internal Audit Function shall cover matters such as:
(a) the annual or other periodic internal audit plan, detailing the proposed areas of audit focus, and any significant modifications to the approved plan;
(b) any factors that may be adversely affecting the independence, objectivity or effectiveness of the Internal Audit Function;
(c) material findings from internal audits or reviews conducted; and
(d) the extent of the insurance company’s compliance with agreed corrective or risk mitigation measures in response to identified control deficiencies, weaknesses or failures, compliance breaches or other lapses.

Article 56 (M)

In addition to periodic reporting, the Head of the Internal Audit Function shall be authorised to communicate directly with the Chairman of the Audit Committee and to meet periodically with the Chairman of the Audit Committee or the Chairman of the Board of Directors without the presence of Senior Management.

Article 57 (M)

The Internal Audit Function shall carry out the activities necessary to fulfil its responsibilities, and these activities include:
(a) establishing, implementing and maintaining a risk-based internal audit plan to examine and evaluate the alignment of the company’s processes with its risk culture;
(b) monitoring and evaluating the adequacy and effectiveness of the company’s policies, processes, documentation and controls, at the legal entity level and at the group level, and in any of its individual subsidiaries, business units, business areas or departments, or at the level of other organisational units;
(c) reviewing the levels of compliance by employees, organisational units and third parties with the applicable laws, regulations, supervisory requirements, policies, processes and controls, including those involving reporting;
(d) evaluating the reliability, integrity and effectiveness of the information provided by management, and of the means used to identify, measure, classify and report such information;
(e) monitoring that the risks identified are effectively addressed through the internal control system;
(f) evaluating the means of safeguarding the assets of the insurance company, policyholders and contracting parties and, where appropriate, verifying the existence of such assets and the extent of segregation in respect of such assets;
(g) monitoring and evaluating the effectiveness of the insurance company’s control functions, in particular the Risk Management and Compliance Functions; and
(h) coordinating with the external auditors, to the extent required by the Board of Directors and consistent with applicable laws, and evaluating the quality of the external auditor’s performance.

Outsourcing

Article 58 (M)

Where outsourcing is adopted, the Board of Directors and Senior Management shall remain responsible for the functions or activities that are outsourced or whose work is supported through outsourcing.

Article 59 (G)

Outsourcing should not increase any material risk to the company or adversely affect the company’s ability to manage its risks and meet its legal and regulatory obligations.

Article 60 (M)

The Board shall have an appropriate outsourcing policy that sets out the internal audit and the approvals required, and provides guidance on issues and considerations relating to contractual and other risks.
This includes limits on the overall level of activities outsourced by the insurance company and on the number of activities that may be outsourced to the same service provider.

Article 61 (M)

Outsourcing relationships shall be governed by written contracts that clearly describe all material aspects of the outsourcing arrangement, including the rights, responsibilities and expectations of all parties, and the protection of the confidentiality of information and non-disclosure.

Article 62 (G)

When entering into or changing outsourcing arrangements, the Board of Directors and Senior Management should consider, among other things, the following:
(a) the extent to which the insurance company’s risk profile and business continuity are affected by the outsourcing;
(b) the service provider’s governance, risk management and internal controls, and its ability to comply with applicable laws and regulations;
(c) the service provider’s capability and financial sustainability; and
(d) succession issues, to ensure a smooth transition when the outsourcing arrangement is terminated or changed.

Article 63 (G)

When selecting a service provider, the Board of Directors or Senior Management should be satisfied as to the expertise, knowledge and skills of that provider.

Article 64 (G)

Outsourcing arrangements should be subject to periodic reviews.
Senior Management shall ensure that it receives periodic reports on the outsourced activities, and shall report to the Board of Directors where necessary.

External Auditors

Article 65 (M)

The Board of Directors (acting, where appropriate, through its Audit Committee) shall ensure that there is adequate governance and oversight of the external audit process.

Article 66 (G)

The Board of Directors should ensure, in respect of the external audit process, that the insurance company:
(a) applies robust processes for approving, or recommending for approval, the appointment, reappointment, removal and remuneration of the external auditor;
(b) applies robust processes for monitoring and evaluating the independence of the external auditor, and for ensuring that the appointed external auditor has the necessary knowledge, skills, expertise, integrity and resources to conduct the external audit and meet any additional regulatory requirements;
(c) monitors and evaluates the effectiveness of the external audit process throughout the audit cycle;
(d) investigates the circumstances relating to the resignation or removal of the external auditor, and ensures that prompt action is taken to mitigate any identified risks to the integrity of the financial reporting process;
(e) reports to the Unit on the circumstances relating to the resignation or removal of the external auditor.

Article 67 (M)

The external auditor shall be registered and listed in the Unit’s registers, as required under Part Nine of the Executive Regulations, and shall satisfy any other requirements of that Law.

Article 68 (M)

The Board of Directors shall oversee the external audit process, and shall ensure and promote an effective relationship with the external auditor.

Article 69 (G)

The Board should ensure the following in the external audit process:
(a) that the terms of appointment of the external auditor are clear and appropriate to the scope of the audit and the resources required to conduct the audit, and specify the level of audit fees payable;
(b) that the external auditor bears a specific responsibility, under the terms of appointment, to perform the audit in accordance with International Standards on Auditing;
(c) that the external auditor adheres to internationally accepted ethical and professional standards;
(d) that appropriate policies and processes are in place to ensure the independence of the external auditor, including:
(1) restrictions on, and conditions for, the provision of non-audit services, subject to the approval of the Board of Directors;
(2) periodic rotation of members of the audit team and/or the audit firm, as appropriate; and
(3) safeguards to eliminate or reduce the identified measures relating to the independence of the external auditor to an acceptable level;
(e) that there is sufficient dialogue with the external auditor on the scope and timing of the audit in order to understand risk issues, information on the insurance company’s operating environment relevant to the audit, and any areas in which the Board of Directors may request specific procedures to be carried out by the external auditor, whether as part of or as an extension of the audit engagement; and
(f) that the external auditor has unrestricted access to information and persons within the insurance company as necessary to conduct the audit.

Article 70 (M)

To enable the Board of Directors to discharge its oversight responsibilities and to enhance the quality of the external audit, it shall have effective communication with the external auditor through its Audit Committee, which shall include:
(a) regular meetings between the Audit Committee and the external auditor during the audit cycle, including 4 meetings, at least annually, without the presence of Senior Management; and
(b) prompt reporting of any information relating to internal control weaknesses or deficiencies of which the external auditor becomes aware.

Article 71 (M)

The Board of Directors shall require the external auditor to report to the Board on all relevant findings. Accordingly, it shall require Senior Management to take the necessary corrective action in a timely manner to address the findings and recommendations of the external audit.

Article 72 (M)

Reports prepared by the external auditor for the insurance company (for example, management letters) shall be made available to the Unit by the insurance company or the external auditor.

Article 73 (M)

The external auditor shall notify the Unit, without the need for prior consent from the insurance company, of matters that are likely to be of material significance, such as serious fraud, suspected serious fraud and regulatory breaches, or other significant audit findings identified during the audit process. In such case, the external auditor shall bear no liability for any information disclosed to the Unit in good faith.

Article 74 (G)

The Unit may request that a further audit be carried out by a different external auditor where necessary.

Takaful Companies

Article 75 (M)

In addition to the rules set out in other parts of these Rules, takaful companies shall observe the following:
(a) The Board of Directors is the principal body responsible for promoting compliance with Islamic Sharia, and shall ensure that the overall business activities are in conformity with Sharia principles and consistent with any Sharia governance requirements issued by the Unit.
(b) The takaful insurance company shall establish a Sharia Supervisory Board, composed of at least three Sharia specialists who are experts in the jurisprudence of Islamic financial transactions and familiar with insurance business from an Islamic perspective. The Sharia Supervisory Board shall exercise the powers and perform the duties set out in the Law, the Executive Regulations and the Companies Law, and in its charter approved by the company’s Board of Directors.
(c) The Board of Directors shall clearly define its relationship with the company’s Sharia Supervisory Board through the approved charter of the Sharia Supervisory Board and the approved charter of the Board. While the Sharia Supervisory Board has responsibilities in respect of Sharia matters, the Board remains responsible for the direction and oversight of the company’s business.
(d) The committees of the Board of Directors shall take into account compliance with the provisions of Islamic Sharia in the company’s activities. For example, the Risk Management Committee shall take into account the risk of Sharia non-compliance in its assessments and reviews, and the audit committees shall ensure that the relevant aspects are covered in the internal Sharia audit work.
(e) The company’s internal control system shall include an internal Sharia Audit Function. (This may, but is not required to, form part of the Internal Audit Function.) In this regard, the following shall be observed:
(1) The auditor shall coordinate with and submit quarterly reports, at least annually, to the Sharia Supervisory Board, covering at a minimum any identified instances of non-compliance, as well as any areas of risk of non-compliance with the provisions of Islamic Sharia.
(2) Where the two functions are separate, the Sharia Audit Function shall cooperate with the Internal Audit Function to ensure that the scope of their activities is not affected by the separation of their duties, and to avoid any potential conflict between the audit plans of the two functions.

Article 76 (M)

The Sharia Supervisory Board shall submit a report to the Board of Directors at least quarterly on the results of the internal Sharia audit, which shall also include the opinion of the Sharia Supervisory Board on the extent to which it approves the Sharia compliance of the company’s business, any observations in that respect, the steps taken to rectify any instances of non-compliance, where possible, and the steps taken to prevent their recurrence. If the Sharia Supervisory Board finds that appropriate steps have not been taken, it shall submit its objection in writing to the Chairman of the Board of Directors.

Article 77 (G)

It is recommended that the takaful insurance company have an external Sharia audit process within its Sharia governance framework, to verify that the internal Sharia audit has been carried out appropriately and that its findings have been duly recorded by the Sharia Supervisory Board.

Article 78 (M)

Where a takaful insurance company proposes to distribute the takaful underwriting surplus to participants, it shall obtain a report from the appointed or contracted actuary on the implications of the proposal, and the Board of Directors or its Risk Management Committee shall consider that report before the distribution.

General Rules

Article 79

The Rules on Compliance with Professional Ethics, Competence and Integrity issued by the Unit shall apply with respect to the following:
1. Fitness and propriety.
2. Training.
3. Transparency and disclosure.
4. Positions subject to registration.

Chapter Four: Penalties

Penalties and Legal Measures

Article 80

Persons Subject to the Rules who commit a violation of the Rules shall be penalised in accordance with Law No. 125 of 2019 on the Regulation of Insurance, its Executive Regulations and their amendments, and any resolutions or circulars issued by the Unit in this regard.

Annex No. (1)
Whistleblowing Policy and Guidelines

Purpose

The purpose of the whistleblowing policy is to encourage employees to report matters without the risk of victimisation, discrimination or subsequent detriment. The policy shall apply to all employees working at the insurance company. It should be designed to protect whistleblowers from any threat or harm if they report a detected incident of breach.

Mechanisms and Procedures

The whistleblowing policy shall set out clear mechanisms and procedures to ensure that concerns are properly reported, investigated and appropriately addressed. The policy shall call upon all employees to act responsibly so as to preserve the reputation of the company, and the insurance company shall recognise this mechanism as an important enabler in managing sound governance practices. An individual who knowingly makes false statements or disclosures may be subject to disciplinary action.
Employees shall attempt to resolve misconduct issues by reporting them directly to their supervisor or to the next level of management wherever possible, as required. However, where an employee is not comfortable reporting to the supervisor or does not feel that the complaint is being dealt with appropriately, the employee shall report the issue to the Head of the Internal Audit Function. If the employee is not comfortable reporting it to someone within the company, he may submit a report directly to a member of the Audit Committee or to the Chairman of the Board of Directors. The contact details of these individuals are circulated to employees annually. As an option, the whistleblower may communicate with the Unit by following the conditions set out in Article 299 of the Executive Regulations. The confidentiality of the identity of whistleblowers is always protected by the Unit.

Annex No. (2)
Responsibilities of the Board Committees

Nominations Committee

(a) Supporting the Board of Directors in the performance of its functions in the following matters relating to the Board, Senior Management and the Board Secretary:
1-Appointments and removals
2-Composition
3-Performance evaluation and development
4-Fit and proper assessments
(b) Meetings are held as needed, and not less than once a year.

Remuneration Committee

(a) Supporting the Board in the performance of its functions relating to remuneration, by overseeing the formulation and implementation of the insurance company’s remuneration policy.
(b) Periodically reviewing the remuneration of board members, in particular as to whether the remuneration remains appropriate to the contribution of each member, taking into account the level of expertise, the commitment and the responsibilities undertaken.
(c) Meetings are held as needed, and not less than once a year.

Risk Management Committee

(a) Supporting the Board of Directors in ensuring that the management of risk exposures and outcomes affecting the insurance company is handled effectively. More specifically, the Committee is responsible for formulating the policies and frameworks for identifying, monitoring and managing the material risks affecting the company, within the framework of the main risk categories of financial, insurance, operational and corporate risks.
(b) The Committee may oversee investment-related activities, in cases where the Board of Directors has not established an Investment Committee.
(c) Meetings are held on a regular basis and as needed, such that the Committee meets at least four times a year.

Audit Committee

a. Supporting the Board of Directors in ensuring that there is a reliable and transparent financial reporting process within the insurance company.
b. Overseeing the effectiveness of the insurance company’s Internal Audit Function. At a minimum, this shall include the following:
(1) Reviewing and approving the audit scope, procedures and frequency;
(2) Reviewing key audit reports and ensuring that Senior Management takes the necessary corrective action in a timely manner to address control weaknesses and non-compliance with laws, regulatory requirements and policies, as well as other issues identified by internal audit and the other control functions;
(3) Considering significant disagreements between the Head of the Internal Audit Function and the rest of the Senior Management team, irrespective of whether they have been resolved, in order to identify any impact such disagreements may have on the audit process or its findings; and
(4) Establishing a mechanism for evaluating the performance and effectiveness of the Internal Audit Function.
c. Enhancing the quality of the insurance company’s audit by exercising oversight over the external auditor. At a minimum, this shall include the following:
(1) Making recommendations to the Board of Directors on the appointment, removal and remuneration of the external auditor;
(2) Monitoring and assessing the independence of the external auditor, including approving the provision of non-audit services by the external auditor;
(3) Monitoring and assessing the effectiveness of the external audit, including holding meetings with the external auditor, at least annually, without the presence of Senior Management; and
(4) Ensuring that Senior Management takes the necessary corrective action in a timely manner to address the findings and recommendations of the external auditor.
d. Reviewing all transactions with related parties and informing the Board of Directors of them.
e. Monitoring compliance with the Board’s conflicts of interest policy.
f. Reviewing the findings of inspections carried out by the supervisory authorities and the actions taken by the Compliance Officer and Senior Management in that regard, and considering submitting recommendations to the Board of Directors.
g. Meetings are held on a regular basis and as needed, such that the Committee meets at least twice a year.

Issued on 6 November 2023 and published in the Official Gazette Kuwait Al-Youm on 12 November 2023.