Financial Market Commission

CMF publishes for consultation regulation on service externalization for insurance, reinsurance companies

The regulation aims to set forth principles and minimum requirements for insurance and reinsurance companies to identify, assess, monitor, and control risks derived from externalizing services.

August 14, 2025 - The Financial Market Commission published for consultation today a regulation establishing instructions on service externalization for insurance and reinsurance companies. The proposal aims to strengthen the supervisory work conducted by the Commission on this matter. It establishes a risk assessment framework through a regulation supplementing General Rule No. 454 of May 2021 on operational risk management and cybersecurity.

The proposal considers both the local banking industry's experience and that of other jurisdictions serving as models for Chile on insurance-related matters, as well as international recommendations. Its main elements are as follows:

Effectively identify and manage externalization-related risks, including operational; strategic; reputational; compliance; and business continuity risks.
Classify externalized activities by their materiality and criticalness through quantitative and qualitative criteria.
Implement robust supervision and auditing mechanisms to guarantee adequate rendering of externalized services and compliance with current regulations.
Ensure business continuity through companies' own contingency plans and requirements for providers to also have adequate, proven plans in place in case of externalized services' failure.
Strengthen cybersecurity and information security, particularly for externalized services dealing with sensitive or critical data for companies' operations.
Include clear, enforceable contract clauses defining minimum service levels.
Avoid and manage concentration and technological dependence risks while keeping risk management as companies' responsibility. Externalization must not mean loss of control nor weakening of companies' internal governance and compliance systems.
Facilitate access by the CMF to externalized operations and information, including remote or on-site supervision abroad, pursuant to established regulatory requirements.

Interested parties can access the Regulations Under Consultation section of the CMF website until September 30, 2025 to review the proposal in detail and submit their comments.