Insurer authorisation and prudential rules

This guide covers the prudential side of being an insurer or reinsurer — getting authorised and staying financially sound. It applies UK-wide. The conduct side — how you treat customers — is in insurer conduct and accountability rules; work through both. Friendly societies and mutual insurers carry the same FSMA dual-regulated regime in substance, with some tailoring for their constitutions.

Get authorised as a dual-regulated firm

You cannot carry on insurance business without permission: effecting and carrying out contracts of insurance are PRA-regulated activities, so authorisation is led by the Prudential Regulation Authority, with the FCA's consent — you deal with both regulators from day one. Carrying on a regulated activity without authorisation is a criminal offence — see the consequences of unauthorised business.

Reinsurers are authorised the same way

Reinsurance — insuring other insurers — is itself effecting and carrying out contracts of insurance, so a pure reinsurer needs the same PRA-led Part 4A permission and prudential supervision. If you accept risk through the Lloyd's market instead, the market has its own structure — see accessing the Lloyd's of London insurance market.

Hold capital to the Solvency UK standard

Once authorised, your balance sheet is supervised continuously. The Solvency UK regime — the reformed successor to Solvency II — sets your capital requirements, governance standards and reporting to the PRA.

Life insurers: ring-fence the long-term fund

If you write life or other long-term business, the assets backing long-term policyholder liabilities have their own protections — separation from general business, restrictions on use, and with-profits governance where relevant. If your pension products are used by employers for automatic enrolment, the qualifying-scheme requirements also apply — see the qualifying-scheme section of run an occupational pension scheme; the rest of that guide is for trust-based schemes.

Meet operational resilience requirements

Insurers must identify their important business services, set impact tolerances for disruption, and be able to stay within them — a joint FCA and PRA regime. Cyber risk is central to it: see cyber security for financial services firms.

Next steps

Work through your conduct-side duties in insurer conduct and accountability rules, make sure the shared duties in run a compliant insurance or pension business are in place, then confirm everything with the insurance and pension compliance checklist.