IRDAI's Penalty Procedure Regulations: The 21-Day Show-Cause Clock and the File You Build Before the Notice

At its 137th Authority Meeting held on 28 July 2026, IRDAI approved the IRDAI (Manner and Procedure for Imposing Penalties) Regulations, 2026, one of seven regulations and amendments cleared at that meeting. The Authority's press release of 29 July 2026 describes the new regulations as providing "a structured process for initiation of proceedings, issuance of show-cause notices and passing of reasoned orders" under the Insurance Act, 1938 and the IRDA Act, 1999.

The timing is the point. The Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025 repriced the penalty side of the Insurance Act, most visibly by lifting the Section 102 ceiling to INR 10 crore, a change covered in detail in our post on the Section 102 penalty ceiling. What the statute did not spell out was the machinery: how a proceeding starts, what a notice must say, how long a firm gets to answer, and how the number is fixed. These regulations are the first codified penalty procedure issued since the SBSR Act reset those ceilings, and they moved fast. The exposure draft was released on 19 June 2026 with stakeholder comments invited by 9 July 2026; the Authority approved the regulations under six weeks after the draft appeared.

This post walks the procedure end to end, then makes a practical argument: the reply window is short enough that the response file has to exist before the notice arrives. The closing section sets out a show-cause readiness pack a principal officer can build this quarter, mapped to the evidence each penalty factor demands.

Proceedings may be initiated on any of six sources, with the Authority recording its reasons in writing:

1. Inspection findings, from an on-site or off-site inspection of the regulated entity.
2. Investigation reports, where the Authority has ordered a focused investigation.
3. Audit findings, including those arising from statutory or concurrent audit.
4. Regulatory oversight, meaning a default noticed through the Authority's ongoing supervision rather than a formal inspection or investigation.
5. Complaints, from policyholders or others.
6. Adjudicating Officer recommendations, feeding the adjudication track back into the Authority's own penalty process.

One structural safeguard sits alongside this. Officers involved in the inspection or investigation function are barred from taking part in the penalty proceeding, so the people who wrote the findings are not the people who decide on them.

For a broking firm the first item is the one that matters most in practice. Inspection is the routine contact point between a broker and the regulator's enforcement apparatus, and the findings letter that closes an inspection is now, formally, a document that can open a penalty proceeding. The mechanics of how inspections reach commission and conduct issues are covered in our post on IRDAI inspections and broker commission penalties; what the new regulations add is a codified bridge from that findings letter to a show-cause notice.

The requirement that reasons be recorded in writing cuts both ways. It disciplines the regulator, because an initiation without recorded reasons is procedurally vulnerable. It also tells the firm something useful: by the time a notice arrives, the Authority has already assembled a documented basis for it. The proceeding does not begin from a blank page on either side, which is exactly why the firm's side of the file cannot begin from one either.

The regulations specify the content of a show-cause notice. It must set out the alleged violation, the legal provisions said to be contravened, the supporting documents relied on, the applicable penalties, the deadline for response, and the option to seek a personal hearing. The response time is ordinarily a minimum of 21 days, extendable on request. One exception applies: in an emergent situation affecting policyholders or the sector, the Authority may set a shorter reply period, recording its reasons in writing.

Each element of that list does work for the noticee. The alleged violation and the cited provisions define the case the firm has to answer, and nothing outside them. The supporting documents tell the firm what the Authority is looking at, which is the starting index for the firm's own evidence gathering. The statement of applicable penalties tells the board, on day one, what the downside range is, which determines who signs off the response and whether counsel is briefed.

The 21 days deserve a sober reading. It is a floor, not a promise of more, and on the ordinary reading of a period stated in days it is calendar days, which puts three weekends inside the window and leaves roughly fifteen working days. The extension is available on request, but it is a discretion exercised by the Authority, not an entitlement the firm can plan around. A response strategy that depends on the extension being granted is not a strategy.

After the written response, a personal hearing is available in two situations: where the noticee requests one, and where the Authority considers a hearing necessary in the interest of justice. The hearing may be held physically or virtually. A firm that files nothing gets neither: where no reply arrives within the period specified, the Authority proceeds ex parte. For most broking firms the request should be close to automatic. A hearing is the one point in the procedure where the firm's explanation is heard rather than read, and where a factual misunderstanding in the notice can be corrected in real time.

The order that follows must be a reasoned one; that is the language of the Authority's own press release, which frames the regulations around "passing of reasoned orders." A reasoned order is also the document any appeal is built on, so the quality of the firm's written response matters twice: once in persuading the Authority, and again in shaping the record an appellate forum will read.

Four consequences follow the order:

• Payment timeline. The penalty must be paid within 45 days, in the manner the order specifies. That is a cash-flow planning number for the finance function, not a negotiation window.
• Publication. A copy of the order is published on the Authority's website, and a brief of the penal action, in press-release form, follows within 30 days. For an intermediary whose business is placed on trust, publication is often the heavier consequence. Insurer partners, corporate clients and competitors read these orders, and a published order arrives with the Authority's reasoning attached.
• Appeal. An aggrieved person may appeal to the Securities Appellate Tribunal within 45 days of receiving the order. That window runs alongside the payment window, so the decision to appeal has to be taken while the penalty is also becoming due.
• Destination of funds. Recovered amounts are credited to the Policyholders' Education and Protection Fund, not to the Authority's own account, which is consistent with the policyholder-protection framing of the penalty factors discussed next.

The publication timeline changes the reputational arithmetic. Under an uncodified regime, an adverse outcome could surface unevenly. Under a rule that puts the order on the website and a penal-action brief out within 30 days, every penalty becomes public on a schedule, and the firm's response file is also, in effect, the draft of its public record.

The regulations carry across the factors set out in Section 105E(1) of the Insurance Act, which the Authority weighs when determining penalty quantum:

1. Nature, gravity and duration of the default.
2. Repetitive conduct, whether the same or similar failure has occurred before.
3. Quantifiable disproportionate gain or unfair advantage accruing to the entity from the default.
4. Policyholder losses caused by it.
5. Mitigation efforts made by the entity, including how timely and effective they were.
6. Number of policyholders impacted.
7. Proportionality and deterrence in the penalty itself.
8. Any other factor the Authority considers appropriate.

Read as a list of legal criteria, this is unremarkable. Read as an evidence specification, it is a gift, because each factor tells the firm exactly what a persuasive response has to prove.

Gravity and policyholder loss are answered with facts about impact: how many clients were touched, what they lost, what was made good. Repetitive conduct is answered with the firm's own compliance history, which means the firm needs that history organised before someone else characterises it. Quantifiable unfair gain is answered with commission and remuneration records that reconcile to insurer statements; an unreconciled ledger reads as concealment even when it is only disorder. Mitigation is answered with dated evidence of detection, escalation and cure, not with assertions of good intent. Proportionality is argued from all of the above, anchored against the statutory ceilings the SBSR Act reset.

The factor list is therefore the correct organising structure for the response file. A reply that walks the Authority through each factor, with documents attached, is doing the Authority's analytical work in the firm's preferred order. A reply that argues generally and attaches little leaves the factor analysis to be done from the inspection record alone.

Now put the clock against the task. Suppose a mid-sized broking firm receives a notice alleging commission irregularities across two financial years, citing inspection findings and enclosing extracts from insurer statements. A responsive reply needs, at minimum:

• The placement files for every affected account: mandate letters, quote comparisons, client confirmations, cover notes. In many firms these live partly in a broking system, partly in email, partly in branch-level folders.
• Commission and remuneration records reconciled line by line to insurer statements for the cited periods, including reversals and adjustments. Finance teams routinely need weeks for a two-year reconciliation when it has not been maintained continuously.
• Conduct evidence: training records, board and committee minutes showing oversight, the compliance register entries showing when the issue was first detected and what was done.
• The response itself: a legal and factual submission, reviewed by counsel, signed off by the board or principal officer, filed within the window, with a hearing request included.

Each workstream is feasible in fifteen working days only if the underlying records already exist in retrievable form. If any one of them has to be constructed, the firm faces a forced choice: file a thin reply on time, or request an extension it may not get and signal, in the process, that its records were not in order, which is itself adverse colour on the mitigation factor.

There is also a concurrency problem. The people who must assemble the file (the principal officer, the compliance head, the finance controller) are the same people running the firm's ordinary obligations during those three weeks. Renewals do not pause for a show-cause notice.

The conclusion is not that 21 days is unfair. It is that 21 days is a test of a firm's standing document discipline, administered without warning. The firms that pass will be the ones for which the notice triggers retrieval, not creation.

The practical response is a standing readiness pack, owned by the principal officer, refreshed quarterly, and mapped to the penalty factors. Its components:

1. A violation-and-cure log. Every compliance breach or near-miss, with the date detected, the cure applied, the cure date, and closure evidence. This is the primary exhibit for the mitigation factor and the direct rebuttal to a gravity characterisation. It is the same detection-and-cure discipline the Section 102 per-day mechanic already rewards.
2. A placement file index. Not the files themselves duplicated, but a live index that locates every account's mandate, quotes, confirmations and endorsements, with a tested retrieval standard: any named account's file assembled within 48 hours. Test it quarterly with a random pull.
3. A commission reconciliation, maintained continuously. Brokerage and remuneration reconciled to insurer statements every quarter, with reversals and adjustments explained as they occur. This answers the quantifiable-unfair-gain factor from the firm's own books rather than from the inspector's extracts.
4. A client-impact register. For any incident, a contemporaneous record of how many policyholders were affected, how, and what remediation was offered. This addresses the policyholder-loss and number-affected factors with the firm's own count.
5. A prior-findings file. Every past inspection finding, caution, advisory and its closure evidence, in one place. Repetitive conduct is assessed on history; the firm should hold the authoritative copy of its own.
6. Governance evidence. Board and committee minutes on compliance matters, conduct training records with attendance, and the compliance function's reporting trail. These substantiate that oversight existed before the notice, which is the only time it counts.
7. Response logistics, pre-agreed. Named counsel on standby terms, a designated drafting owner, a board sign-off path that works inside 21 days, and a standing decision to request a personal hearing. The first two days of a notice window should be spent on substance, not on deciding who does what.

Most of this overlaps with disclosure and audit obligations the firm already carries, and the assembly discipline is the same one described in our guide to preparing the intermediary disclosure pack. The marginal cost of maintaining it as a show-cause pack is small. The marginal value, on the day a notice arrives with a 21-day clock attached and a published order 30 days behind the decision, is the difference between answering the Authority's factor list with documents and answering it with adjectives.