Tawanda Musarurwa
The Insurance and Pensions Commission (IPEC) has ordered every insurer, pension fund, broker and medical aid society to build tested plans that can withstand cyberattacks, floods, black-outs and market shocks.
This takes effect on January 1, and full compliance will be required by mid-2027.
IPEC issued its guidelines on business continuity, disaster recovery and contingency planning on November 5 under Circular 45 of 2026.
The guidelines cover life assurers, short-term insurers, microinsurers, funeral assurers, reinsurers, brokers, pension funds, administrators and medical aid funds.
IPEC Commissioner Dr Grace Muradzikwa said the arrangements are meant to ensure the continuity of critical business operations and services while safeguarding policy-holders, members and beneficiaries.
According to IPEC, companies must map their critical functions such as claims payment, pension payroll and treatment pre-authorisation.
They must also set maximum tolerable downtime and data-recovery targets and keep back-up facilities geographically separate from primary sites.
Plans must be tested at least once a year, with results reported to the board. Senior management must file quarterly updates to IPEC as evidence of preparedness.
An independent review will be required every two years, with guidelines also setting tight reporting clocks.
Policyholders must be told of a material disruption within 24 hours, while IPEC must be notified promptly. A full post-incident report will be due within 14 working days of activating a plan.
