On 26 August, SSP, a global provider of technology systems and solutions across the insurance industry, suffered a power outage at its datacentre, knocking the cloud-based service offline for two weeks. Brokers were left unable to access services on SSP's Pure Broking platform, leaving them unable to process renewals or take out new business.
Many news reports have highlighted the fact that the broker community may be at risk of enforcement action by the Financial Conduct Authority (FCA).
Commenting on the outage, BLM professional indemnity partner Alex Traill said: "It has been widely reported in the insurance industry press that it remains unclear when all brokers affected by the SSP outage will have their software restored, and that brokers have suffered losses as a result. The extent and scope of these losses will inform both the exposure of brokers to potential claims and the likelihood of them securing a recovery for their losses. In the meantime, there are three issues that brokers should consider: recoverability of any business interruption losses, exposure to claims from policyholders for their losses and action taken by the FCA."
- Recoverability of business interruption losses: brokers reliant on the cloud-based system to arrange insurance for policyholders have reported an inability to do so during the SSP outage. As such, brokers should carefully examine their contracts with SSP and/or any third party deemed responsible to assess whether they provide for compensation for the losses incurred. In addition, whilst claims in negligence are also a potential route to recoverability of losses, brokers run the risk of courts classing at least a proportion of their losses (not least, brokers' potential earnings from policy renewals) as "consequential", which they are notoriously reluctant to award subject to certain exceptions.
- Exposure to claims from policyholders: brokers reliant on SSP's software for reporting and handling insurance claims, and rendered unable to do so, should also be alert to the possibility of policyholders pursuing them for applicable losses suffered during the outage throughout this period.
- Response of the FCA: the FCA issued guidance in July 2016 for those firms it regulates (including brokers) who outsource to the cloud and other third-party IT services. Of particular note, this stipulates that firms should have in place appropriate arrangements to ensure that they can continue to function and meet their regulatory obligations in the event of an unforeseen interruption of the outsourced services. In doing so, firms should consider the likelihood and impact of an unexpected disruption to the continuity of their operations; document their strategy for maintaining continuity of their operations; regularly update and test arrangements to ensure their effectiveness; and put in place arrangements to ensure the regulator has access to data in the event of disruption. Should the FCA deem brokers to have fallen short of this guidance, the FCA has the authority to take enforcement action against said brokers.
BIBA has openly said that it would take a lead in facilitating constructive discussions about what has occurred and next steps for its members. Steve White, BIBA Chief Executive said: “As the trade body of many affected brokers it is essential that we take the lead in navigating these issues and addressing the long term solutions on their behalf. Once the current problems have subsided we feel it is also important for all of our members that we ascertain the robustness of the systems, risk management and disaster recovery of the other leading broker software houses and this is already on our agenda.”