Lessons From IRDAI's September 2026 Enforcement Orders: Outsourcing, Vendor Due Diligence and Bancassurance Grievances

Between 7 and 10 September 2026, IRDAI issued three penalty orders and a delegation notification that, read together, say a lot about where policy servicing breaks down in India. None of them concerned a headline claim dispute. All of them concerned the plumbing: who an insurer hands work to, how a bank handles complaints and renewals, and whether a product was sold to someone who could use it.

• ICICI Lombard General Insurance was fined Rs 1 crore by an order dated 7 September 2026 for lapses in outsourcing, vendor selection and due diligence, record maintenance, internal controls and governance under the IRDAI (Outsourcing of Activities by Indian Insurers) Regulations, 2017. IRDAI also issued advisories on unallocated premium and delays in free-look cancellations (Sarthak Advocates Insurance Law Brief, Aug-Sep 2026; Kotak Neo, Sep 2026).
• IndusInd Bank, acting as a corporate agent, was penalised (reported at Rs 1 crore) for an inadequate grievance redressal mechanism, and cautioned on renewal notices, disclosures and website display. The press release is dated 9 September 2026.
• Canara HSBC Life was fined Rs 1 crore by an order dated 10 September 2026 for mis-selling a deferred annuity to an 88-year-old customer.
• On 10 September 2026, IRDAI notification F. No. IRDAI/DoP/13/227/2026 delegated specified penalty and direction powers under the Insurance Act, 1938 (TaxGuru, Sep 2026).

For a corporate buyer or a broker, the useful question is not "which insurer got fined" but "which of these failure modes sits inside my own programme". This post turns each order into questions you can put to your insurer, your bank partner or your own operations team. It does not re-explain the outsourcing rules themselves; for that, see our guide to IRDAI outsourcing governance for insurers.

Most commercial and group policyholders deal with an insurer's brand but are served by someone else. Claims intake may run through an outsourced desk, group health is administered by a TPA, policy documents and endorsements may be processed by a back-office vendor, and the customer helpline is often a contracted call centre. The ICICI Lombard order is a reminder that the regulator holds the insurer responsible for how those vendors are chosen, checked and recorded, and that weaknesses there are treated as governance failures rather than as minor process slips.

From the buyer's side, the practical risk is not the penalty. It is that the person handling your claim file or your endorsement request works for an entity your insurer may not have vetted properly, under records the insurer may not be able to reconstruct when something goes wrong.

Questions to ask at placement or renewal

1. Which activities on this policy are handled by a third party: claims intake, survey coordination, document processing, call centre, TPA administration?
2. Who are those vendors, and when was each last reviewed by the insurer?
3. Where are records of my policy, endorsements and claim correspondence held, and can the insurer produce a full file on request?
4. If a vendor changes mid-term, how and when will I be told?

For group health, the TPA is the most visible outsourced function. Our note on TPA selection for corporate health programmes covers what to evaluate there. The point here is wider: the same diligence logic applies to every vendor touching your policy, not just the TPA.

Ask your broker to record the answers in the placement file. If a servicing failure later turns into a dispute, a written record of who was meant to do what, and when you were told about changes, is far more useful than recollection.

The advisories that accompanied the ICICI Lombard order, on unallocated premium and delays in free-look cancellations, are easy to skip past. They should not be. Both describe money that has left the customer but has not yet been matched to cover or refunded.

Unallocated premium is premium the insurer has received but has not tied to a specific policy. For a corporate buyer, this typically shows up as a payment made against a renewal or an endorsement that sits in a suspense account because the remittance details did not match, the proposal was incomplete, or the processing vendor did not close the loop. Until it is allocated, the buyer may assume cover is in force when the insurer's systems do not yet reflect it.

What to check in your own programme

• Reconcile every premium payment against an issued policy or endorsement number, not just against a bank debit.
• Set a short internal deadline (for example, a few working days) after payment by which the policy document or endorsement must be received, and escalate if it is not.
• For group schemes with frequent additions and deletions, ask the insurer for a periodic statement of any premium held unallocated against your account.

Free-look delays matter less on commercial covers, which generally do not carry a free-look period, but they matter for retail and employee-facing products distributed through employer or bank channels. If your organisation facilitates voluntary top-ups or individual products for employees, slow refunds become an employee-relations problem that lands on HR, not on the insurer.

IRDAI cautioned IndusInd Bank on renewal notices, alongside disclosures and website display. The order concerned a bank acting as a corporate agent, but the operational lesson applies to any channel that sits between the insurer and the policyholder.

Renewal-notice failures are where servicing lapses become coverage gaps. On an annual commercial policy (fire, marine open covers, liability, group health) a missed or late notice can mean the renewal is not negotiated in time, the buyer pays late, and there is a window in which a loss falls outside cover. On group health and group term covers, a lapse affects every member at once.

Where the notice chain breaks

1. The intermediary relies on the insurer's system to send the notice, and the insurer relies on the intermediary.
2. Contact details on file belong to someone who has left the client organisation.
3. The notice goes out, but without the claims experience, revised terms or premium needed to act on it.
4. Bank channels bundle insurance renewal reminders with other product communications that customers learn to ignore.

Brokers handling large books should run renewals from their own system rather than depending on insurer reminders. Our piece on renewal calendar automation for brokers sets out how to structure that.

The core finding against IndusInd Bank was an inadequate grievance redressal mechanism. Banks distribute a large share of retail life and health insurance and a meaningful share of SME commercial covers, often bundled with loans, current accounts or trade finance. When a customer complains, the bank is frequently the first point of contact, and the bank's grievance process is expected to work as a regulated intermediary's process, not as a general banking complaints queue.

For corporate buyers who source cover through their banking relationship (common for SME fire, stock and machinery covers tied to working-capital limits) this order is a prompt to ask a few direct questions:

• Who at the bank owns insurance complaints, and is it a separate desk from general banking grievances?
• What turnaround does the bank commit to on an insurance complaint, and how is it escalated to the insurer?
• Are renewal, premium and claim-status communications for the policy coming from the bank, the insurer or both?

For brokers and corporate agents, the lesson is that the grievance process is now an enforcement surface in its own right. Our guide to conduct risk in bancassurance covers the sales-side controls; the IndusInd order shows that post-sale handling is examined just as closely. Brokers looking at their own complaint workflows can use our note on grievance redressal and Bima Bharosa workflows.

The Canara HSBC Life penalty of Rs 1 crore concerned a deferred annuity sold to an 88-year-old customer. It is a retail case, but it belongs in an operations discussion because suitability failures are usually process failures: a sales journey that does not stop when the customer profile and the product do not fit.

For corporate buyers and brokers, the parallel is any situation where an insurance product reaches people through an employer or bank channel without anyone checking fit. Examples include voluntary benefit add-ons offered to employees, credit-linked covers attached to business loans, and retiree or post-retirement benefits sold to former employees. If your organisation lends its name or its payroll to the distribution, a mis-sale reflects on you even if the regulatory penalty falls on the insurer or intermediary.

A simple control

Before endorsing any voluntary or credit-linked product to employees or customers, ask the distributor to show the suitability check built into the sales journey: what information is collected, what triggers a stop or escalation, and who reviews exceptions. If the answer is that the bank or insurer handles it, ask to see it rather than accept the assurance.

The 10 September 2026 notification, F. No. IRDAI/DoP/13/227/2026, delegates specified penalty and direction powers under the Insurance Act, 1938. The notification itself is narrow: it allocates who within the regulator may exercise particular powers. Its practical effect for regulated entities is that enforcement decisions on those matters do not all need to travel to the top of the authority.

It is reasonable to expect that, where powers have been delegated, routine enforcement matters may be processed with less queueing than before. That is an inference, not something the notification states, and intermediaries should watch the pattern of orders over the coming months rather than assume a specific timeline.

What it does mean is that brokers, corporate agents and insurers should treat inspection observations and show-cause notices as live matters from the day they arrive. The response window is short, and our explainer on the IRDAI show-cause notice and 21-day response procedure covers how to prepare a response.

Taken together, the September orders point to four operational areas worth reviewing this quarter.

1. Servicing map. For each material policy, list who performs claims intake, administration, document processing and helpline support, and when the insurer last reviewed each vendor.
2. Premium reconciliation. Match every payment to an issued policy or endorsement; chase anything unallocated within days, not at the next renewal.
3. Renewal ownership. Keep your own renewal calendar and confirm in writing who initiates each renewal, especially on bank-sourced and group covers.
4. Grievance and suitability evidence. If you are an intermediary, make sure your complaint log, escalation trail and suitability checks would stand up to inspection without rework. If you are a buyer, ask your bank or broker to show you theirs.

None of these steps is expensive. Each one closes a gap that, in September 2026, cost a regulated entity Rs 1 crore and, more importantly for the policyholder, created the conditions for a service failure or an uninsured loss.