Global Directors’ and Officers’ Survey Report 2026 – Crime

Regulatory enforcement trends shaping the insurance industry: A 2026 outlook

The global insurance industry finds itself at a pivotal juncture. Regulatory enforcement is intensifying across jurisdictions, driven by converging pressures: rapid technological advancement, evolving consumer expectations, geopolitical instability and a decisive shift by regulators from prescriptive, rules-based oversight towards outcomes-focused supervision. Between 2020 and 2025, insurers incurred more than $215 million in penalties tied primarily to sales practices failures, cybersecurity gaps, and disclosure deficiencies, signaling a structural evolution in how regulators evaluate risk and compliance maturity.

As a result, understanding the trajectory of enforcement is no longer merely a matter of regulatory housekeeping. It is a strategic imperative. Authorities worldwide are not only broadening the scope of their scrutiny but deploying more sophisticated supervisory tools and expecting firms to demonstrate, with credible evidence, that their products, pricing and conduct deliver fair outcomes in practice.

It is therefore no surprise that 65% of respondents to the Global Directors’ and Officers’ Survey 2026 ranked the risk of “regulatory breach” as a significant concern for their businesses, placing it fifth on the ranking of risks for directors and officers.

Key enforcement themes

Conduct, culture and governance

Across nearly every major jurisdiction, culture and governance have risen to the top of the regulatory enforcement agenda. Regulators increasingly view deficiencies in firm culture as a root cause of conduct failures, with enforcement action now extending to systemic governance shortcomings. Global enforcement surveys rank culture and governance among the top three enforcement areas across the United Kingdom, the Netherlands, Switzerland, Germany, Hong Kong and Singapore.

Individual accountability regimes are gaining particular traction. In the U.K., the Financial Conduct Authority’s (the “FCA”) Consumer Duty has cemented an outcomes-focused approach, with the regulator already confirming investigations into six potential breaches of its fair value rules. Anticipated reforms to the Senior Managers and Certification Regime are expected to simplify requirements whilst extending the regime's reach.

In the Asia and Pacific regions, Hong Kong and Singapore have introduced senior manager accountability regimes for financial services, Taiwan launched a similar framework for banking in January 2025 and national anti-corruption agencies in Indonesia, Malaysia, India, China, and Australia have bolstered their investigative powers.

In the Middle East, the UAE's integration of the Insurance Authority into the Central Bank of the UAE has unified insurance regulation under a broader financial supervisory mandate, with the landmark 2025 Insurance Law introducing enhanced penalties of up to AED 1 billion.

Data privacy, cybersecurity and technology-related enforcement

Data privacy and cybersecurity enforcement has intensified markedly across all regions. Concern over massive data breaches and the misuse of personal data has spurred governments worldwide to enact stricter laws and public trust in institutions' ability to protect private data continues to erode. Businesses these days hold vast quantities of sensitive personal information, this translates into expectations for robust data management systems, encryption, strong access controls and regular security audits.

Cyberattack and data loss are ranked more highly than regulatory breach alone (they are ranked at two and three globally), the regulatory landscape that is evolving to address and mitigate these risks brings with it additional regulatory risk and exposure. The regulatory response has been rapid and cross-jurisdictional. In the EU, the Digital Operational Resilience Act came into effect in January 2025, mandating that insurers satisfy operational resilience requirements covering cyber risk management and third-party oversight. State regulators in the United States, led by New York, continue to enforce stringent cybersecurity regulations and the NAIC has been developing frameworks for third-party data and predictive models.

In the Asia and Pacific regions, cybercrime has become a board-level concern, with Malaysia's Cyber Security Act 2024 mandating compulsory reporting of cyber incidents and Australia's Cyber Security Act 2024 introducing mandatory ransomware reporting obligations.

In the Middle East, the Qatar Financial Centre, Dubai International Financial Centre and Abu Dhabi International Financial Centre achieved mutual data protection adequacy recognition as of January 2026, streamlining cross-border data transfers between these financial centres.

ESG and greenwashing enforcement

Although environmental, social and governance (ESG) related risks may have fallen out of popular discussion and do not fall within the top seven risks (indeed climate change is only ranked in the top seven for the Middle East region), ESG remains a key focus of regulators in many jurisdictions and therefore cannot be overlooked. ESG compliance continues to present a complex enforcement landscape marked by significant jurisdictional divergence. In the EU, the European Insurance and Occupational Pensions Authority (“EIOPA”) has identified the supervision of sustainability risks and sustainability claims as a central priority for 2026, with particular emphasis on identifying greenwashing. The Corporate Sustainability Reporting Directive and Corporate Sustainability Due Diligence Directive impose comprehensive disclosure requirements, albeit with political pressure to simplify the most onerous elements.

In the United States, anti-ESG sentiment has led to the Securities and Exchange Commission pausing enforcement of climate-related disclosure rules, whilst more than 20 states have passed legislation limiting ESG considerations in investment decisions involving state assets.

In the Asia and Pacific regions, jurisdictions including China, Hong Kong, Singapore, Japan and Australia have introduced or strengthened mandatory ESG disclosures and greenwashing litigation — particularly in Australia — is expected to increase. The challenge of navigating these divergent expectations across international business models is acute, demanding flexible compliance strategies that accommodate expansive EU requirements alongside the more fragmented approaches emerging elsewhere.

Consumer protection and fair treatment

Consumer protection stands at the heart of the enforcement agenda globally, with regulators shifting from procedural compliance towards measurable consumer fairness. Businesses are expected to demonstrate that products are suitable, transparent and aligned with customer needs throughout the product lifecycle, with the emphasis firmly on real-world outcomes rather than process-based metrics.

The FCA's approach in the U.K. exemplifies this trend. Claims handling has emerged as a key supervisory lever, with the FCA's response to the which super-complaint on home and travel insurance leading to intensified scrutiny of outsourced claims processes, delegated authority models and remuneration arrangements. Distribution chains are receiving heightened attention as regulators seek to ensure shared responsibility for customer outcomes across all participants.

In the United States, state regulators continue to focus on sales practices, disclosure issues and auto insurance overcharges, particularly in climate-impacted states. In the Middle East, the UAE's 2025 Insurance Law has unified consumer protection through the independent complaints resolution unit “Sanadak”.

In Hong Kong, the Insurance Authority has reviewed insurers' complaints handling and the design and sale of participating insurance policies, signalling a more interventionist regulatory posture across the Asia and Pacific regions.

Anti-money laundering and sanctions compliance

Anti-money laundering remains a foundational enforcement priority globally. In the U.K., the FCA has recently issued multi-million-pound financial penalties on banks for defective AML systems, including governance gaps, weak risk assessments and compliance infrastructure that failed to scale with business growth. In the EU, the new Authority for anti-money laundering and countering the financing of terrorism is expected to begin supervisory activities in 2026, with AMLA to be fully operational by 2028.

In the Asia and Pacific regions, Hong Kong's Insurance Authority imposed its first-ever AML fines on two insurers, marking a significant enforcement milestone. Australia's 2024 AML/CTF Amendment Bill is expanding the scope of the legislation through 2025 and 2026. In the Middle East, the reimplementation of stringent U.S. sanctions and heightened KYC requirements have complicated compliance and the UAE has assumed the presidency of the Middle East and North Africa Financial Action Task Force, prioritising improved preparedness and tackling emerging financial crime threats. Sanctions compliance more broadly remains a key priority, with the FCA confirming a robust approach to breaches and the U.S. Department of Justice expanding its whistleblower programme to include tips on customs and tariff fraud.

Geopolitical instability, trade tensions and regulatory fragmentation

Geopolitical risk has become a structural feature of the 2026 enforcement landscape, rather than a series of isolated shocks. Geopolitical risk has entered the top seven risks for directors and officers for the first time; and clearly this risk cannot be untangled from overarching regulatory risks. Ongoing conflicts, expanding sanctions regimes, trade tensions and shifting alliances are directly affecting markets, capital flows and operating environments. Regulators are responding with heightened scrutiny and new enforcement tools. Economic instruments such as tariffs, sanctions, technology restrictions and investment screening are increasingly deployed to advance geopolitical objectives, with cascading consequences for compliance.

The escalation of the Iran conflict in early 2026, leading to the sustained closure of the Strait of Hormuz, through which roughly 20 million barrels of crude oil previously flowed daily, has fundamentally recalibrated various markets giving rise to sweeping challenges for businesses across multiple operational themes. This has naturally led to increased regulatory risk with sanctions enforcement continuing to intensify across jurisdictions.

The U.K. has announced new Iran-related sanctions designations in 2026, including asset freezes and travel bans targeting senior officials and Iran Revolutionary Guard Corp members, whilst the EU has imposed restrictive measures against additional persons and entities. Western sanctions regimes and Chinese blocking legislation, which restricts Chinese entities from complying with foreign sanctions, mean that companies operating across Asia-Pacific may find themselves caught between conflicting obligations, an area that may gain enforcement momentum as geopolitical tensions develop.

In the United States, the Department of Justice has formed a new Market, Government, and Consumer Fraud Unit to investigate tariff non-compliance, including misclassification of goods and country-of-origin disputes, and has expanded its whistleblower programme to cover customs and tariff fraud. National security considerations are also increasingly used by authorities to scrutinise M&A transactions, with a year-on-year uptick in ex-U.S. trade compliance enforcement since 2022.

In the Middle East, the reimplementation of stringent U.S. sanctions and heightened KYC requirements have further complicated compliance for insurers operating in or trading with the region. Disrupted supply chains, intensified conflict zones, and the influx of sophisticated financial instruments into the Gulf's financial centres all elevate the importance of robust screening, due diligence and transaction monitoring. For insurers specifically, these dynamics transform geopolitical risk from a background consideration into an active underwriting, claims and compliance challenge, demanding continuous monitoring, scenario-based planning and close coordination across legal, risk and operational functions.

Artificial intelligence (AI) and algorithmic decision-making

The use of AI has become a growing area of opportunity, as well as a growing area of potential risk. Regulators have generally encouraged the use of AI whilst making clear that safeguards, human oversight and accountability frameworks must keep pace with deployment.

In the United States, the approach to regulation has been disparate and largely left to State-level intervention with Colorado's comprehensive AI anti-discrimination requirements present a particularly demanding compliance standard and market conduct examinations specifically examining AI usage are expected to commence imminently.

In the EU, EIOPA has identified supporting the supervision of AI use as a main priority for 2026, and the EU's AI Act will be generally effective from 2026, adding a further compliance layer. The FCA in the U.K. intends to publish an evaluation report from its AI Live Testing initiative by the end of 2026, which will further shape regulatory expectations for AI use in the regulated sector.

The results of the Global Directors’ & Officers’ Liability Insurance Survey 2026 show that in North America, and organizations in the service sector, are starting to rank AI-risk increasingly highly. We discuss AI-related risk in a separate article.

Looking ahead

The regulatory enforcement environment in 2026 is characterised by heightened expectations, broader jurisdictional reach and growing sophistication in supervisory tools.

The themes of consumer fairness, AI governance, operational resilience and ESG integrity are not passing trends but structural features of the new regulatory landscape. Businesses that invest proactively in governance, technology and compliance infrastructure will be best positioned to navigate this environment, not merely to avoid penalties, but to build the trust of regulators, stakeholders and the market alike.