MACAU SAR, CHINA Law and Practice Contributed by: Carlos Eduardo Coelho, MdME
Enactment of the Other New Guidelines Published in 2025 Following the implementation of the IIAO, the AMCM introduced a series of new regulatory guidelines in 2025 to further strengthen governance, licensing and professional standards within the insurance interme- diaries sector. These include the Guidelines on Application Require- ments for Insurance Brokers, Corporate Agents and Individual Agents, which set out the procedures, documentation and qualification criteria for obtain- ing authorisation to conduct insurance intermediary activities in Macau. The Guideline on the Appointment of Responsible Officers and Risk Analysts establishes detailed requirements for the designation, roles and responsibilities of key personnel responsible for com- pliance, risk management and operational oversight within insurance entities. Additionally, the Guidelines on Fit-and-Proper Assess- ment for Responsible Officers provide a framework for evaluating the integrity, competence, financial soundness and professional conduct of individuals holding critical management and control functions. These measures collectively aim to enhance corporate governance, promote accountability and ensure that insurance intermediaries operate with professional- ism, integrity and in full compliance with the regulatory standards set by the AMCM. Guidelines on Referral Arrangements Referral arrangements, where third parties introduce clients to insurers or intermediaries, are increasingly common in Macau, particularly for Mainland China cli- ents. These partnerships offer opportunities for busi- ness growth and diversification but also pose risks such as unlicensed activities, unauthorised sales, and mis-selling. Regulators have responded: in September 2025, Hong Kong’s Insurance Authority introduced caps on referral fees to curb excessive payments and mitigate misconduct risks. This has prompted some referral businesses to shift towards Macau, where regulations remain more flexible. To address this, the AMCM issued the Guidelines on Regulatory Requirements for Life Insurance Referral Business, effective 20 November 2025. These guide-
ruptions, data breaches or provider insolvencies) to the AMCM. For cross-border outsourcing, insurers must consider additional risks related to jurisdiction, regulatory access and data transfer, and must inform clients where applicable. As a transitional measure, outsourcing agreements entered into before the effective date are covered by a grandfathering arrangement. While exempt from immediate compliance, insurers must review these agreements within 12 months to ensure alignment with the guideline’s key principles and make neces- sary adjustments within a timeframe agreed with the AMCM. As part of a related initiative, the AMCM has also issued the Guideline on Cloud Outsourcing for the Insurance Sector (effective 1 May 2025), which com- plements the general outsourcing framework by intro- ducing specific requirements for cloud-based opera- tions. The guideline applies to all licensed insurers, reinsurers and pension fund managers, and encom- passes all major cloud service models (SaaS, PaaS, IaaS) as well as deployment types (public, private, hybrid and community). Insurers must carry out enhanced due diligence on cloud service providers (CSPs), assessing their finan- cial stability, technical capability, information security standards, business continuity measures, and com- pliance with regulatory obligations. Contracts should clearly stipulate data location, security controls, audit rights and exit strategies. Insurers are further required to establish strong governance structures, compre- hensive risk management frameworks and continuous oversight of their cloud outsourcing activities. Significant cloud outsourcing arrangements must be reported to the AMCM within 30 days, and the guide- line reinforces data protection obligations, including adherence to Macau’s Personal Data Protection Law. The board and senior management retain ultimate accountability for ensuring that cloud outsourcing does not compromise operational resilience or regula- tory compliance. Existing cloud outsourcing arrange- ments are granted a 12-month grandfathering period, during which insurers must review and align them with the new requirements.
323 CHAMBERS.COM
Powered by FlippingBook