NigeriaNational Insurance Commission Guidelines for Insurtech Operations in Nigeria, licensing, technology security, lead management and limits on automated claims rejection
Guidelines for Insurtech Operations in Nigeria, August 2025
In force since .
An AI sector rules rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Licensing, Security, Governance, Disclosure, Consent
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Filed with regulator
As of .
What it requires
- It reaches you if you carry on insurtech business in Nigeria, whether as a standalone insurtech that offers insurance products or services directly to consumers or as a partnering insurtech that collaborates with insurance institutions, or if you are an insurance institution that partners with an insurtech (paragraphs 1.2, 2.1 and 13.3). Do not commence or carry on any class of insurtech business without being registered or authorized by the Commission (paragraph 1.2).
- Have and implement a secure technology framework with proper access controls, and a technology security policy approved by your Board in line with the Commission's Technology Guidelines and subject to the Commission's approval (paragraphs 9.1 and 9.1.2). Uniquely identify all users of critical devices on your networks, link customer registration to authorized identification systems such as the National Identification Number, an international passport or a driver's licence, and require a minimum two-factor authentication process for all users to have access to your services (paragraph 9.1.4).
- Introduce logical access controls in the technology infrastructure deployed and test them using periodic penetration testing. Establish a resilient framework for periodic data backup and recovery, business continuity and data and software management (paragraphs 9.1.5 and 9.1.6). Allow only authorized staff to update information on your website or other channels, subject critical updates to dual verification and two-step authentication, and document the maintenance evidence to the Commission on or before January 31 of the succeeding year (paragraph 9.1.3).
- Maintain an effective Lead Management System and ensure that leads are recorded and monitored through it where required (paragraph 13.1(x)). Deploy an independent technology firm to audit the Lead Management System, the domain and the entire operations at least once a year, and submit the audit report to the Commission not later than three months from December 31 of every year (paragraph 9.2(viii) and (ix)).
- Do not rely completely on Artificial Intelligence systems to decline claims without human intervention (paragraph 12.1(iv)). Do not launch products or use dynamic pricing without actuarial support or prior approval from the Commission (paragraph 12.1(iii)). Do not use interface design tactics that mislead users into purchasing or renewing an insurance policy (paragraph 12.1(viii)). Do not share personal data without explicit consent (paragraph 12.1(vii)).
- Disclose prominently on your home page that the visitor's particulars could be shared with insurers or other insurance operators, provide an option for consent to disseminate user information to selected insurance operators, do not transmit a client's data to any operator other than the ones the client prefers, and transmit the client's KYC data to the insurance institution immediately and not later than three days of the visit to the website, in a secure manner (paragraphs 9.2 and 13.2).
- Obtain prior approval from the Commission before placing any advertisement on your website or other channels, and do not display ratings, rankings, endorsements or bestsellers of insurance products on your website (paragraphs 11.2(c) and 13.2(iii)). Seek the Commission's prior approval before engaging service providers or third-party vendors and before changing the location of the servers hosting your domain (paragraph 18.3(iii)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
The Guidelines preserve criminal proceedings against any person who acts as an insurtech without holding a valid licence, and allow the Commission to compound the offence by accepting such sums of money as it deems fit.
Who enforces it
Enforcement body
The National Insurance Commission, which may cancel the licence granted to an insurtech, impose administrative sanctions and compound an offence
What this law does
The National Insurance Commission issued the Guidelines for Insurtech Operations in Nigeria in exercise of the powers conferred by the National Insurance Commission Act 1997 and the Insurance Act 2003, to establish a uniform set of rules, regulations and standards for the conduct of insurtech business in Nigeria. No person may commence or carry on any class of insurtech business without being registered or authorized by the Commission.
The Guidelines for Insurtech Operations in Nigeria are effective from , and all insurance institutions and insurtech firms operating under any agreement must comply within thirty days of that date. An insurtech must have and implement a secure technology framework with proper access controls. A minimum two-factor authentication process is required for all users to have access to the services provided by an insurtech.
An insurtech must introduce logical access controls in the technology infrastructure deployed, and test them using periodic penetration testing. An insurtech must deploy an independent technology firm to audit its Lead Management System, domain and entire operations at least once a year, and submit the audit report to the Commission not later than three months from December 31 of every year.
An insurtech must maintain an effective Lead Management System and ensure that leads are recorded and monitored through it where required. Unsupervised automated claims rejections are a non-permissible activity for an insurtech, described as complete reliance on Artificial Intelligence systems to decline claims without human intervention.
Launching products or using dynamic pricing without actuarial support or prior approval from the National Insurance Commission is a non-permissible activity for an insurtech. Interface design tactics that mislead users into purchasing or renewing an insurance policy, described as dark patterns, are a non-permissible activity for an insurtech. An insurtech must not display ratings, rankings, endorsements or bestsellers of insurance products on its website.
An insurtech must obtain prior approval from the Commission before placing any advertisement on its website or other channels. Where an insurtech distributes or markets insurance products, it must disclose prominently on the home page that the visitor's particulars could be shared with insurers or other insurance operators, and provide an option for consent to disseminate user information to selected insurance operators.
An insurtech that distributes or markets insurance products must transmit the data of a client's KYC to the insurance institution immediately, but not later than three days of the visit to the website. The National Insurance Commission may cancel the licence granted to an insurtech or take any other action as deemed appropriate on the observation of any infraction or non-compliance with the Guidelines.
The National Insurance Commission shall impose administrative sanctions on an insurtech for identified inappropriate actions or inactions or corporate misconduct. Without prejudice to criminal proceedings against a person who acts as an insurtech without holding a valid licence, the National Insurance Commission may compound the offence by accepting such sums of money as it deems fit.
The text of the Nigerian Insurance Industry Reform Act, 2025 published by the National Insurance Commission provides that a person shall not commence or carry on web, internet or electronic based insurance or related business unless licensed by the Commission, and that the Commission shall issue regulations for such business in Nigeria.
The text of the Nigerian Insurance Industry Reform Act, 2025 published by the National Insurance Commission defines Regulations to mean regulations, guidelines and code of conduct.
When LexLint raises it
When your app profile says your app is an insurer.