Consumer fintechLicence required

Insurtech platform testing

FintechAssuranceLabs tests insurtech platforms, the category of products like Lemonade, Root, and Next Insurance, from quote to claim payment. Test scope covers rating engines against approved rate versions, underwriting rules and adverse action notices, policy changes and cancellations, claim deadlines, and MGA premium remittance, with evidence a carrier or insurance supervisor can review.

What breaks in insurtech premium and claims flows

In the MGA model, the insurtech collects the premium, keeps a commission, and remits the net premium to the carrier, the licensed insurer that holds the risk. Claims are paid from the carrier's funds, often through the MGA. Each defect below repeats on every policy the rule touches.

Rate version picked by quote date instead of policy effective date. A rate revision applies to policies effective on or after 1 March. February quotes for policies starting on 5 March bind at the old rates, so premium, commission, and net premium are wrong on each policy. In California, rates for the lines under Proposition 103, including auto, must be approved by the commissioner before use (Insurance Code 1861.01(c)), and each affected policy is re-rated and refunded or rebilled.
Consumer report tier applied with no adverse action notice. The underwriting service reads a credit-based insurance score, places the applicant in a higher premium tier, and sends no notice because nothing was declined. The Fair Credit Reporting Act counts an increase in any charge for insurance, existing or applied for, as adverse action (15 U.S.C. 1681a(k)(1)(B)(i)). A user of the report then gives notice, the reporting agency's contact details, and the consumer's rights (1681m(a)). Willful noncompliance exposes the insurer to actual damages or statutory damages of not less than $100 and not more than $1,000 for each consumer (1681n(a)(1)(A)).
Commission taken on the wrong premium base. The contract sets commission on premium only, but the bordereau job calculates it on a total that includes policy fees and premium tax, so each monthly remittance to the carrier is short. The NAIC Managing General Agents Act (Model 225), the model for state MGA laws, requires the MGA to render accounts detailing all transactions and remit funds due at least monthly (Section 4B) and to hold funds collected for the insurer in a fiduciary capacity (Section 4C). The insurer may terminate the contract for cause and suspend underwriting authority while the dispute is open (Section 4A).
Claim deadline timer that restarts on a status change. A document request sets the claim back to "open" and restarts the clock, so claims pass the regulatory date with no decision. In California, the insurer acknowledges a notice of claim within 15 calendar days (10 CCR 2695.5(e)(1)), accepts or denies within 40 calendar days of proof of claim, and pays accepted amounts within 30 calendar days (2695.7(b) and (h)). Delayed payments also lower the loss ratio behind an MGA's share of interim profits, which Model 225 Section 4L defers for one year on property and five years on casualty business where the MGA controls claim payments or reserves.
Sex still reaches the EU premium through a legacy factor. The quote form no longer asks for sex, but the rating engine reads the value from an imported customer profile and a legacy tariff table applies a factor to it. In Test-Achats (C-236/09), judged on 1 March 2011, the Court of Justice declared the derogation in Article 5(2) of Directive 2004/113/EC invalid from 21 December 2012. Article 5(1) remains: the use of sex as a factor in premiums and benefits shall not result in differences in individuals' premiums and benefits. Every contract priced with the factor is re-priced.

Licence flag and the evidence carriers and supervisors ask for

Insurtech carries a licence flag: the carrier holds the insurer licence, and an insurtech that distributes or underwrites for it holds a producer licence or an intermediary registration. Sources on this page were checked on 2026-09-16.

United States

In California, a company transacts a class of insurance only after admission through a certificate of authority (Insurance Code 700(a)), and a person who solicits, negotiates, or effects insurance contracts holds a licence from the commissioner (1631). Under Model 225, an MGA is a licensed producer (Section 3) and works under a written contract whose underwriting guidelines include the basis of the rates charged (Section 4F). The insurer reviews the MGA's underwriting and claims operations on site at least semi-annually (Section 5C).

In New York, any person licensed under the Insurance Law is a covered entity under the cybersecurity regulation (23 NYCRR 500.1(e)). Each covered entity submits a certification of material compliance or an acknowledgment of noncompliance by 15 April every year (500.17(b)(1)).

Evidence carriers and state examiners request:

rating test records per approved rate version, with quote, bind, and policy effective dates;
adverse action notice logs for each underwriting decision that used a consumer report;
claim timer logs from notice of claim to acknowledgment, decision, and payment;
bordereau reconciliations from policy premium to commission, fees, taxes, and net premium remitted;
test results for the controls a New York licensee certifies under Part 500.

European Union

An insurer needs prior authorisation from its home supervisor under Article 14(1) of Solvency II, Directive 2009/138/EC. Insurance intermediaries register with a competent authority in their home Member State under Article 3(1) of the Insurance Distribution Directive (EU) 2016/97 (IDD). The Digital Operational Resilience Act covers insurance undertakings and intermediaries in Article 2(1)(n) and (o), and Article 2(3) excludes intermediaries that are micro, small, or medium-sized enterprises and the small insurers in Article 4 of Solvency II; see DORA testing requirements. Evidence a supervisor or carrier can request:

the insurance product information document for each non-life product, with the content listed in IDD Article 20(8), including premium payment means and contract term;
the demands and needs record captured before each contract, and proof that the proposed contract matches it (IDD Article 20(1));
the product approval process with its target market (IDD Article 25(1));
rating tests that show premiums do not vary by sex;
for underwriting decisions based solely on automated processing, the route to human intervention and contest under GDPR Article 22(3); see GDPR testing requirements.

Insurtech test scenarios

Rate version selection. Quotes created before a rate change and bound after it, and renewals versus new business.
Premium instalments. An annual premium split into monthly instalments, with the rounding remainder placed as the terms state (banker's rounding guide).
Mid-term endorsements. A coverage change on day 137 of a 365-day term, with pro rata premium and recalculated commission (prorated billing guide).
Cancellation and return premium. Pro rata and short-rate refunds per the policy terms, and commission clawback on the next bordereau.
Underwriting decisions. Knockout answers, referral thresholds, a consumer report with no hit, and a report timeout, each with the decision and the notice it produces.
Claims workflow. First notice of loss through acknowledgment, document requests, partial acceptance, and payment, with timers checked at every status change. A payment above the MGA's settlement authority waits for carrier approval (Model 225 Section 4M(4)).
Failed premium payment. A card decline, retries during the grace period, and a cancellation notice for non-payment sent on the state's notice schedule.
Bordereaux. Premium and claims bordereau totals equal the policy ledger, and a late endorsement lands in the correct month.
EU distribution checks. The product information document and the demands and needs step appear before bind, and a changed sex value leaves the premium unchanged. Financial calculation testing covers premium, commission, and refund arithmetic.

Integrations and protocols to cover

Rating engines. Versioned rate tables imported from actuarial files, and rating APIs that carry the effective date on every call.
Carrier and MGA data exchange. ACORD XML and AL3 policy messages, and bordereau files in CSV or spreadsheet templates agreed with the carrier.
Third-party underwriting data. Credit-based insurance score APIs, motor vehicle and claims history reports, and telematics SDKs for usage-based pricing.
Premium payments. Card-on-file charges through a card processor; stored card numbers are cardholder data, see how we handle cardholder data. ACH debits as Nacha PPD and WEB entries in the US, and SEPA Direct Debit collections as ISO 20022 pain.008 files in the EU.
Claim payouts. ACH credits, push-to-card payments, and ISO 20022 pain.001 credit transfers, with idempotency keys on retried payouts.
Policy administration and documents. Policy administration and claims system APIs, and document generation for policies and notices. Insurance platform testing covers these carrier and MGA integrations end to end.

Standards

Services

Guides

Sample deliverable

Sample, synthetic data

rule and threshold test matrixRule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules

Rule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules
Rule ID	Rule and reference	Test values below, at, and above the boundary	Expected outcome	Actual outcome	Result
TM-STR-01	Transaction monitoring structuring rule: open an alert when one customer makes two or more cash deposits on one business day, each below USD 10,000.00, that total more than USD 10,000.00. Built on 31 CFR 1010.313(b): multiple currency transactions shall be treated as a single transaction if the institution knows they are by or on behalf of any person and total more than $10,000 during any one business day	Below: two cash deposits totalling USD 9,999.99; at: two cash deposits totalling USD 10,000.00; above: two cash deposits totalling USD 10,000.01	The USD 9,999.99 and USD 10,000.00 totals open no structuring alert; the USD 10,000.01 total opens a structuring alert and a currency transaction report flag	The USD 9,999.99 and USD 10,000.00 totals opened no structuring alert; the USD 10,000.01 total opened a structuring alert and a currency transaction report flag	Passed, 3 of 3 test values, run 2026-09-14
SAN-SCORE-01	Sanctions name-match score threshold: open a screening alert and hold the payment when the name match score against a sanctions list entry is 85 or higher. Configured screening policy; no regulation sets the score	Below: match score 84; at: match score 85; above: match score 86, each for a synthetic customer name against a synthetic list entry	Match score 84 opens no alert; match scores 85 and 86 open a screening alert and hold the payment	Match scores 84 and 85 opened no alert and released the payment; match score 86 opened a screening alert and held the payment	Failed: the comparator uses greater than 85 instead of 85 or higher; defect DEF-2210, critical severity, blocks release
CBK-DL-13.1	Chargeback response deadline for Visa Dispute Condition 13.1 (Merchandise/Services Not Received): block submission of the response package after the network time limit. Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition, section 11.2.3, Table 11-2: the Dispute Response time limit is 30 calendar days from the Dispute Processing Date, with listed regional exceptions for some domestic transactions	Below: calendar day 29 after the Dispute Processing Date; at: calendar day 30; above: calendar day 31, all dates counted in UTC	Calendar days 29 and 30 accept the response package for submission; calendar day 31 blocks submission and marks the dispute case as expired	Calendar days 29 and 30 accepted the response package for submission; calendar day 31 blocked submission and marked the dispute case as expired	Passed, 3 of 3 test values, run 2026-09-14
COL-CALL-01	Regulation F call frequency: block a further collection call to a person about a particular debt after seven calls within seven consecutive days. 12 CFR 1006.14(b)(2)(i)(A) and (b)(2)(ii): subject to the exclusions in (b)(3), a debt collector is presumed to comply if it places a telephone call to a particular person about a particular debt not more than seven times within seven consecutive days, and is presumed to violate the rule if it places calls in excess of that frequency	Below: sixth call to one person about one debt within seven consecutive days; at: seventh call; above: eighth call	The sixth and seventh calls are placed; the eighth call is blocked by the dialer and rescheduled after the seven-consecutive-day period	The sixth and seventh calls were placed; the eighth call was blocked by the dialer and rescheduled after the seven-consecutive-day period	Passed, 3 of 3 test values, run 2026-09-14
EXP-RCPT-01	Expense policy receipt threshold: require a receipt before submission of a non-lodging expense of USD 75.00 or more. 26 CFR 1.274-5(c)(2)(iii)(A)(2): except as provided in (c)(2)(iii)(B), documentary evidence is required for any expenditure other than lodging of $75 or more, except that documentary evidence for transportation charges is not required if not readily available	Below: meal expense of USD 74.99; at: meal expense of USD 75.00; above: meal expense of USD 75.01	The USD 74.99 meal expense submits without a receipt; the USD 75.00 and USD 75.01 meal expenses are blocked until a receipt is attached	The USD 74.99 and USD 75.00 meal expenses submitted without a receipt; the USD 75.01 meal expense was blocked until a receipt was attached	Failed: the rule uses greater than USD 75.00 instead of USD 75.00 or more; defect DEF-2213, medium severity, fix scheduled for the next release and does not block this release
MD-ENT-01	Market data non-professional subscriber entitlement: grant the non-professional entitlement only to a natural person who is not registered or qualified in any capacity with the SEC, the CFTC, any state securities agency, or any securities exchange or association; not engaged as an investment adviser under Section 202(a)(11) of the Investment Advisers Act of 1940, whether or not registered; and not employed by an exempt bank or organization to perform functions that would require registration. Nasdaq Equity 7, Section 147(d)(4)(A), as quoted in SEC Release No. 34-94466 of 18 March 2022	Below: natural person with no registration and no adviser role; at: natural person acting as an unregistered investment adviser; above: subscriber account opened in a company name	Only the natural person with no registration and no adviser role receives the non-professional entitlement; the unregistered investment adviser and the company account receive the professional entitlement	The natural person with no registration and the unregistered investment adviser received the non-professional entitlement; the company account received the professional entitlement	Failed: the status attestation checks registration only, so subscriber counts reported to the exchange are wrong; defect DEF-2211, high severity, blocks release
CLM-AUTO-01	Claim auto-approval limit: approve a claim without adjuster review when the payable amount after the deductible is XTS 2,500.00 or less. Configured claims authority limit; no regulation sets the amount	Below: payable amount of XTS 2,499.99; at: payable amount of XTS 2,500.00; above: payable amount of XTS 2,500.01	The XTS 2,499.99 and XTS 2,500.00 claims are approved automatically and queued for payment; the XTS 2,500.01 claim goes to adjuster review with no payment queued	The XTS 2,499.99 and XTS 2,500.00 claims were approved automatically and queued for payment; the XTS 2,500.01 claim went to adjuster review with no payment queued	Passed, 3 of 3 test values, run 2026-09-14

Rule IDs, defect IDs, customers, claims, and run dates are synthetic, USD appears only where a regulation states the threshold in USD while configured limits use XTS (the ISO 4217 test code), and rule references were checked on 2026-09-16 against eCFR, the Visa Core Rules and Visa Product and Service Rules of 18 April 2026, and SEC Release No. 34-94466.

Questions

What is an MGA?

An MGA, or managing general agent, is an insurance agent or firm that manages and underwrites business on behalf of an insurer, often with authority to bind policies and settle claims. Under the NAIC Managing General Agents Act, an MGA must hold a producer licence and work under a written contract with the insurer that sets underwriting guidelines and remittance terms.

What is insurtech?

Insurtech is the use of software to sell, price, underwrite, and service insurance, from online quote and bind to automated claims handling. Many insurtech companies distribute and underwrite policies as an MGA or agency for a licensed insurer that holds the risk, and some insurtech companies hold their own insurer licence.

What is underwriting and how does it work?

Insurance underwriting is the decision to accept or decline a risk and to set its premium and terms. An underwriting system applies the insurer's guidelines to application answers and third-party reports, then accepts, declines, refers the case to a human underwriter, or assigns a rating tier that sets the premium.

Scope your insurtech release testing

Send your lines of business, carrier and MGA setup, and target markets, and we return a test scope for rating, underwriting, claims, and remittance flows with the evidence each one needs.

Scope your testing