Section 102 After the SBSR Act: The Rs 10 Crore Penalty Ceiling and What It Means for Broking Firms

The number a broking board should have registered from the Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025 is not on the licensing side, where the perpetual-registration change drew the headlines. It is on the penalty side. The Act amended Section 102 of the Insurance Act, 1938, lifting the maximum penalty for the contraventions that section governs from the earlier INR 1 crore ceiling to INR 10 crore, while retaining the per-day mechanic underneath it. The amendment has effect from the Act's commencement on 5 February 2026.

The daily rate is the part that gives the ceiling its teeth. Section 102 has long been drafted so that a contravention attracts a penalty measured per day for as long as it continues, subject to an overall cap. Under the earlier version, that cap was INR 1 crore. Under the amended section, it is INR 10 crore. The mechanism did not change; the roof over it rose by an order of magnitude.

This post is about what that does to a broking firm as an institution: how a board should oversee conduct risk when the downside just multiplied, what conduct training and the compliance function have to become, and where professional indemnity cover does and does not help. It is not about the inspection process that surfaces a contravention, which is a separate subject, nor about the conduct rules that bind individual advisors. It is about firm-level penalty arithmetic and the governance that has to answer it.

Section 102 is the general penalty provision for a defined set of failures to comply with the Act, the regulations under it, and IRDAI's directions. It is not a bespoke fine for one kind of wrongdoing; it is the backstop that gives many of the Act's obligations their consequence.

The drafting worked, in the earlier version, on a whichever-is-less logic: a person who failed to comply was liable to a penalty extending to INR 1 lakh for each day the failure continued, or a fixed ceiling, whichever was less. That structure has two components worth separating, because they behave differently.

The daily rate is a duration meter. It converts the length of a breach into money. A failure fixed the day it is noticed accrues little; a failure that runs for months accrues steadily, day after day, until it is cured or the cap is reached.

The ceiling is the backstop. It exists precisely for the long-running breach, because without a cap the daily meter would run to implausible sums. The ceiling is the number the meter climbs toward and stops at.

What the SBSR Act changed is the second component. The daily meter is intact. The backstop moved from INR 1 crore to INR 10 crore. The practical consequence is that a breach now has to run far longer, or the same length at a far higher effective exposure, before the cap protects the firm from further accrual. The very thing many firms are worst at, duration, is the thing the higher ceiling most punishes.

Boards tend to read a penalty ceiling as a single scary figure and stop there. The more useful reading is the arithmetic that gets you to it, because that arithmetic is where governance can actually intervene.

Consider how a contravention typically behaves in a broking firm. It is rarely a single dramatic act. It is more often a condition that persists: a disclosure not made, a direction not implemented, a filing obligation not met, a control that was supposed to operate and did not. The firm is frequently unaware of it while it runs, which is exactly why it runs. The duration meter does not care whether the firm knew. It counts days.

Under the old ceiling, a firm had a crude comfort: however long a breach ran, the exposure was bounded at INR 1 crore. That bound was low enough that some firms, consciously or not, treated certain contraventions as a manageable line item. The tenfold increase removes that comfort. A long-running breach can now accrue toward a number large enough to be existential for a mid-sized broking firm, and the accrual is a function of the one variable the firm controls but often fails to manage: how fast it detects and cures.

The governance implication is precise and, unusually for compliance, actionable. The single most valuable capability a firm can build against Section 102 exposure is speed to detection and cure. Every day shaved off the interval between a breach starting and the firm fixing it is a day the meter does not run. A board that cannot influence whether a breach happens can absolutely influence how long it lasts, and under the amended section that lever is worth ten times what it was.

The statutory ceiling changed in February. In June, IRDAI issued the exposure draft of the IRDAI (Insurance Intermediaries) (Amendment) Regulations, 2026, dated 19 June 2026, with comments closed on 10 July 2026. Part of what that draft does is bring the subordinate intermediary regulations into line with the amended Act, so the conduct and disclosure obligations that Section 102 backs are stated coherently at the regulation level.

Two points of accuracy matter here, because both are commonly mangled.

First, the draft is an alignment exercise, not the origin of the higher ceiling. The ceiling comes from the amended Section 102. Reading the draft as the source of the penalty change gets the hierarchy backwards: primary statute sets the ceiling, subordinate regulation aligns the obligations underneath it.

Second, and worth stating plainly against the misreadings in circulation: this draft does not grant brokers perpetual registration (the Act did that, separately), and it does not introduce an INR 10,000 corporate-agent registration fee. Neither claim is what the disclosure amendment is about.

What the draft does contain, and what connects it to the penalty exposure, is a set of hard obligations that become Section 102-backed once in force: a separate financial-statement schedule splitting intermediation revenue from other receipts from insurers, submission of audited financial statements with the auditor's report to IRDAI by 30 September each year, and website publication of those statements. Read against a per-day ceiling, the 30 September deadline is instructive. A filing obligation with a fixed date is exactly the kind of obligation where duration accrues cleanly: miss the date, and each day late is a countable day. A firm that historically signed its audit close to the outer statutory limit now has a duration-metered deadline sitting on the same date. The draft is not in force, but it signals the direction, and the direction is more fixed-date obligations with a higher-ceilinged consequence behind them.

A penalty ceiling is a board-level number, and a tenfold increase in it should change board-level behaviour, not just compliance-team behaviour. The connection is direct: the board is where the firm's tolerance for conduct risk is set, and the amended Section 102 has repriced that risk.

Three changes belong at board level.

First, conduct risk earns a standing agenda line. Under a INR 1 crore ceiling, a board could reasonably treat regulatory penalty exposure as a compliance-report footnote. Under INR 10 crore, the potential loss is material to the firm's capital and continuity, which makes it a board matter by definition. The board should see, on a fixed cadence, the firm's open contraventions, near-misses, and the age of each unresolved item, because age is the variable the ceiling punishes.

Second, detection-and-cure speed becomes a governed metric. Since the arithmetic rewards fast cure above almost everything else, the board should ask for and track a specific number: the median and worst-case interval between a breach arising and being cured across the firm's compliance log. A board that governs that interval is governing the one lever that most directly limits Section 102 exposure.

Third, the tone-from-the-top on conduct hardens. A tenfold penalty ceiling is a policy signal that the regulator intends conduct obligations to be taken as first-order. A board that treats them as second-order is misaligned with the environment its firm operates in, and that misalignment is itself a governance finding waiting to be made.

None of this requires new committees. It requires the board to move conduct-risk exposure to the centre of its attention, in proportion to a downside that grew by an order of magnitude while nothing else about the firm changed.

If the board sets tolerance, the compliance function and conduct training are where tolerance becomes daily behaviour, and both have to absorb the repricing.

On conduct training, the shift is from awareness to specificity. General "treat customers fairly" training does little to shorten the detection-and-cure interval that the ceiling punishes. What helps is training that makes staff able to recognise the specific breach conditions that run long: a disclosure that should have been made and was not, a direction that arrived and was not implemented, a filing that slipped. Training that teaches people to spot and escalate these early is training that shaves days off the meter. Firms should also make clear, in training, that raising a suspected breach fast is rewarded rather than penalised, because a culture that hides breaches lengthens their duration, which is the expensive property.

On the compliance function, the amended section argues for two capabilities in particular. The first is a live breach register with ageing, so that the age of every open item is visible and the oldest items get attention first, because they are the ones accruing. The second is a cure-tracking discipline: every identified breach carries a named owner, a target cure date, and evidence of closure, so that cure is a managed event rather than a hope. This is unglamorous infrastructure, and it is exactly the infrastructure that a per-day ceiling makes economically compelling. A firm that can demonstrate a short, well-governed detection-and-cure cycle has both a lower expected penalty and, when a contravention is assessed, a credible account of a firm that manages its obligations seriously.

The instinct, on seeing a tenfold penalty ceiling, is to reach for more insurance. Here the honest answer is more useful than the reflexive one, and it has two halves.

The half that matters most: a regulatory penalty is generally not what professional indemnity cover pays. Professional indemnity, the cover a broker must maintain as a registration condition, responds to third-party claims arising from professional negligence, errors, and omissions. Fines and penalties imposed by a regulator are, as a matter of standard policy construction and public-policy principle, typically excluded. Buying a higher professional indemnity limit does not create a pot that settles a Section 102 penalty. A board that responds to the amended ceiling by simply increasing its professional indemnity limit has probably not bought what it thinks it bought, and should read its own policy's fines-and-penalties and regulatory-action wording before assuming otherwise.

The half that still matters: the conduct environment that produces Section 102 exposure often produces third-party claims alongside it, and those claims are what professional indemnity does respond to. A firm whose controls have weakened enough to attract a regulatory penalty is frequently the same firm facing client claims for the same underlying failures. So the amended ceiling is a reasonable prompt to re-test professional indemnity adequacy against the firm's grown revenue and risk profile, not because the policy will pay the fine, but because the same weakness that risks the fine risks the claims the policy is for. Separately, directors' and officers' cover is where a board should check how its own liability is treated, reading the regulatory-action and penalty exclusions carefully, since coverage for regulatory matters is narrow where it exists at all.

The conclusion for a broking board: insurance is a supporting control here, not the answer. The answer to a higher penalty ceiling is fewer, shorter breaches, which is a governance and controls problem, not a placement problem.

Turning the amended Section 102 into a concrete board response, without overbuilding:

1. Put conduct-risk exposure on the board agenda on a fixed cadence. The board should see open contraventions, near-misses, and the ageing of each unresolved item at every regular meeting, framed as a material exposure now that the ceiling is INR 10 crore.
2. Govern the detection-and-cure interval as a metric. Ask for the median and worst-case time from breach arising to breach cured, and treat shortening it as the primary lever against Section 102 exposure, because the penalty is duration-metered.
3. Run a live breach register with ageing and named cure owners. Every open item has an owner, a target date, and closure evidence. The oldest items get attention first, since they accrue the most.
4. Recast conduct training around the long-running breach conditions. Teach staff to recognise and escalate the specific failures that run long (missed disclosures, unimplemented directions, slipped filings), and make fast escalation culturally safe.
5. Read the insurance for what it actually covers. Confirm that professional indemnity and directors' and officers' wordings are understood not to fund regulatory penalties, re-test professional indemnity adequacy against grown revenue for the client claims that do fall to it, and stop treating higher limits as a substitute for controls.
6. Track the intermediary disclosure draft's fixed dates. If the 30 September audited-filing obligation is notified, treat it as a duration-metered deadline and build the audit calendar to clear it with margin, because a missed fixed date is the cleanest way to run a per-day meter.

The amended Section 102 did not change what a broking firm must do. It changed what it costs to do those things slowly. A board that internalises that (that the exposure now scales with duration against a INR 10 crore roof) will invest in the one capability that matters, which is fixing things fast.