General requirements for the business organisation; product approval process

(1) Insurance undertakings must have a business organisation that is effective and proper and appropriate to the nature, scale, and complexity of their activities. In addition to complying with the laws, regulations, and supervisory requirements to be observed by insurance undertakings, the business organisation must ensure a sound and prudent management of the undertaking. This includes, in addition to complying with the requirements of this Division, in particular an appropriate, transparent organisational structure with a clear allocation and an appropriate segregation of responsibilities, and an effective internal communication system.
(1a) Undertakings that design insurance products for sale must maintain, operate, and regularly review a process for the internal approval of each individual insurance product, or of each material change to existing insurance products, for distribution (product approval process). The process must ensure that a specified target market is identified for each insurance product before it is distributed to customers. In identifying the target market, all relevant risks to the specified target market must be assessed. It must be ensured that the intended distribution strategy is consistent with the specified target market. As part of an appropriate business organisation, undertakings must ensure that the insurance products are distributed to the specified target market.
(1b) Undertakings must regularly review the insurance products. In doing so, they must take into account all events that could materially affect the potential risk to the specified target market, and must at least assess whether the insurance product continues to meet the needs of the specified target market and whether the intended distribution strategy remains appropriate.
(1c) Undertakings that design insurance products must make available to all distributors all appropriate information on the insurance product and the product approval process, including the specified target market of the insurance product. Where an undertaking distributes insurance products that it did not itself design, or advises on such insurance products, it must have appropriate arrangements in place to obtain the information named in the first sentence and to understand the characteristics and the specified target market.
(1d) Subsections (1a) to (1c) do not apply to insurance products consisting of insurance for large risks within the meaning of section 210(2) of the Insurance Contract Act, or to reinsurance undertakings.
(2) The management board must ensure that the business organisation is reviewed internally on a regular basis.
(3) Undertakings must draw up written internal policies, which are subject to the prior approval of the management board and whose implementation must be ensured. The policies must, at a minimum, set out requirements for risk management, the internal control system, internal audit, and, where relevant, the outsourcing of functions and activities. They must be reviewed at least once a year. They must be adjusted accordingly where there are material changes to the areas or systems to which they relate.
(4) Undertakings must take appropriate measures, including the development of contingency plans, to ensure the continuity and regularity of their activities.
(5) The organisational and procedural arrangements, and the internal control system, must be documented in a manner comprehensible to third parties. The documentation must be retained for six years; section 257(3) and (5) of the Commercial Code applies correspondingly.
(6) Undertakings must provide a process, in accordance with the Whistleblower Protection Act, for internal reports that enables employees, while preserving the confidentiality of their identity, to report potential or actual infringements 1. of this Act, 2. of statutory instruments issued under this Act, 3. of Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (market abuse regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC, and 2004/72/EC (OJ L 173, 12.6.2014, p. 1), 4. of Regulation (EU) No 1286/2014 of the European Parliament and of the Council of 26 November 2014 on key information documents for packaged retail and insurance-based investment products (PRIIPs) (OJ L 352, 9.12.2014, p. 1; L 358, 13.12.2014, p. 50), as amended from time to time, 5. of provisions in respect of which a report to an external body within the meaning of the Whistleblower Protection Act also comes into consideration, and any criminal acts within the undertaking, to an appropriate body.