Governance Bites #164: regulatory preparedness, with Jerry Hall

Regulatory change is reshaping governance, and boards can no longer treat compliance as someone else's responsibility. In this episode, Mark Banicevich speaks with Jerry Hall, an international insurance executive and governance expert, about why regulatory preparedness is now a board-level issue. Drawing on experience from the UK, Europe and New Zealand, Jerry Hall explains how directors can move beyond a tick-box approach, ask better questions of management, engage effectively with regulators, and build a culture that delivers strong customer outcomes while reducing regulatory risk. Essential viewing for directors, executives and governance professionals navigating an increasingly complex regulatory environment.
Jerry Hall is a Chartered Accountant (ICAEW) and seasoned CFO with more than 25 years of international leadership across financial services and insurance. His governance experience spans board reporting, audit committees, regulatory compliance, risk oversight and strategic finance across the UK, Middle East and Asia-Pacific. Jerry has led organisations through complex acquisitions, private equity ownership, post-merger integration and multi-jurisdiction regulatory challenges, working closely with regulators in the UK, UAE, Hong Kong and beyond. From building governance frameworks for global start-ups to advising CEOs and boards on regulatory strategy, he brings a practical, board-level perspective on governance, accountability and sustainable organisational growth.
#Governance, #CorporateGovernance, #BoardLeadership, #BoardDirectors, #GovernanceBites, #RegulatoryPreparedness, #Compliance, #RiskManagement, #FinancialServices, #Insurance, #BoardEffectiveness, #CorporateStrategy, #Leadership, #Directors, #GovernanceProfessionals, #FinancialRegulation, #BusinessLeadership, #CustomerOutcomes, #Boardroom, #NewZealandBusiness, #boardcraft, #decisionmaking, #makingadifference, #ceo

Transcript

Copy Transcript Copied

0:00

Hi, my name is Jerry Hall. I'm by trade a chartered accountant, but I've spent most of my life working in insurance. As you can tell from my accent, I'm not from these shores, so I spent most of my time in the UK [United Kingdom]. There I was working for AIG[American International Group] mainly, although a number of other entities, as well. But from a general insurance perspective, I was doing stuff in the UK, across Western Europe, and then quite a lot of regulatory stuff in the [United] States, as well. From there I moved into a very niche part of insurance, which is expat medical insurance. I was headhunted into a PE [private equity] backed business. They'd just bought three businesses, one in Hong Kong, one in Dubai, one in the UK, and they wanted to pull those together. So I was their first global CFO[Chief Financial Officer]. We built that business up and then sold it to Aetna, now CVS, which was very nice. I then did some M&A [mergers and acquisitions] work in the UK around insurance distribution, and then joined another PE-funded business. This time I was employed out of Hong Kong but actually based in Dubai, where I had my teams working. From there we opened businesses up in the UK, in Hong Kong, in China, Singapore, Malaysia, and that sort of thing. Then we finished up there, and my wife is from here [New Zealand], and she wanted to come home. So we've been here for the last eight years or so. I've still been working in insurance. I'm currently the compliance director for a Zurich-based insurance broker. So that keeps me very current in terms of what's going on in the UK, because I was recruited by them to set up their UK branch post-Brexit. So I did that. And I still look after the regulatory side of that. That keeps me up to date with what's going on in the UK. And that's been interesting for me, in the sense that there's a lot of change going on in the insurance industry here. Interestingly enough, from my perspective, a number of the people in the FMA [Financial Markets Authority] are ex-UK regulators, and I can see the parallels of what's going on. The general direction of travel. Might not necessarily be at the same point, but the direction of travel is very similar. So I've just taken an interest in what's going on in insurance here in New Zealand. And so we're going to talk today about regulatory preparedness. Hi, welcome to Governance Bites. My name is Mark Banicevich, and as you just heard, today I have the pleasure of spending time with Jerry Hall. Jerry, thank you very much for giving up your time, particularly as it's actually a Saturday morning here in New Zealand that we're recording this. We're going to talk about regulatory preparedness, and the first question I have

for you on this topic is: 3:04

why should boards see regulatory preparedness as a governance issue, rather than just a compliance exercise to be dealt with in the business? Yeah, that's an interesting question. If you look back at the UK, we had something called "treating customers fairly", which came in around 2006. That was quite a big change for us. TCF[Treating Customers Fairly] in terms of principles is pretty similar to what CoFI[Conduct of Financial Institutions] is. Not quite as advanced as that, but similar in concept. So this, not quite coming out of nowhere, but it was a big change to how everything was done. So we sat around looking at this when it came out,

and our response was: 3:51

okay, fine, there's a whole stack of compliance issues here, we'll employ a compliance director. Off you go, you do that. If anyone comes knocking, they have to talk to him. And that was really the experience in the UK. So treating customers fairly became almost a tick-box exercise. People would prepare their programmes, because they were required to, and they'd tick a few boxes, and that would be it. Obviously the regulator became aware of this and wasn't particularly comfortable with it, and where we finally ended up was something called "consumer duty". Consumer duty is, the fundamental requirement is that you have a regulatory requirement to ensure your customers get the best possible outcome. It's a high standard. So, okay, but great the devil's in the detail. What the hell does that mean? Because there's all sorts of ways you can get around that, one would think. But what they require you to do is: the board has to produce an annual report, where they say whether they are comfortable that the business has or has not ensured customers get the best possible outcome. Okay, well, a report's a pain in the arse, but it's a report. You can obviously produce that. But they specify that, of course, you can have qualitative data in the report, and they want to see that, but you must have quantitative data to back up your view that customers are getting the best possible treatment. Wow. So this is a huge piece of work, and I had to do it for our UK branch, and I'm just actually starting my fourth report now. But when it first came out, the industry was running around with their hair on fire, because no one knew how to do this. So I attended goodness knows how many webinars, talked to advisers, legal people, lots of consultants, because it was such a big thing to do. But we got through it, and we got it done. The key piece, though, is that the board has to sign off on it. When I was looking at the changes here, I was having a look at the fair conduct programme under CoFI, and I thought, okay, that's got some similarities. And it became clear, just from reading around and in conversations with various people, the concept behind that is the direction of travel. So you don't have the full requirement of the consumer duty report here, but the direction of travel is that the board has to be responsible. If you go to thirty thousand feet with the board, their job is oversight. And that's fine. Back in the day, a lot of the compliance stuff was producing big reports, masses and masses of data, and you'd file that in. Well, the board at that stage needed to know that it's been done, but it's really not much more than that. Whereas where regulation has got to now, across the UK, across Australia, and now here in New Zealand, is it's much more running through the DNA of the business. If you're then on the board, and your job is to oversee the business, which is what it is, then you need to know about this stuff. That's why it's moved, in my view, much more into the target zone of stuff the board's got to look at. Yeah, that makes sense. What distinguishes then, a boardroom that's genuinely well prepared for this major regulatory change, from one that's just ticking boxes? Well, I think this is the big step change, really. This stuff is quite complex. If you look at the Contracts of Insurance Act [2024], there are six work streams, and they cover everything. They cover policy wording. They cover how you adjust claims. They cover the quantum of claims and what can be claimed. Just everything. So this isn't a, we need a new report on your solvency every quarter. This is much, much bigger than that. So I think there's a, if I was on a board, I would be comfortable getting into the detail of this stuff, because you're going to have to know that detail. It's not to say everyone on the board has to be an expert. That's ridiculous, and that's not a requirement. But you've got to have somebody on the board who does know this stuff, or is paying attention to it. So that, you can't have the information just fed up to you by management. You've got to know something about that, as well, because this is impacting on every aspect of the business. Yeah. So where is it best to draw the line between the board's responsibility for being prepared for this regulatory change, and management's role in implementing it? Yeah, so this is an interesting one. Obviously management, they're the guys at the coalface. They're having to deal with this, as well as a whole number of other things, as well. And we've all been there. I've been there lots of times. Certainly when the TCF stuff came out in the UK, as I said. Our view was: look, we're running the business, this is just a tick-box exercise over there. You can still take that view if you want to. And that is a perfectly reasonable strategy to take. But it runs quite a high risk, and it could go wrong quite unpleasantly. So I think there's another strategy, which is actually to get in with the regulators, which is what I've done around the world, historically. You need to talk to the regulator and understand what it is that they're actually looking for. Then if you know that, it makes it a lot easier. So, coming back to your question, is it management who's doing that, or is it the board? I think it's a bit of both, to be honest. Yes. Management needs to have a good relationship with their regulator. We have communications going on all the time. I talk to the FCA [Financial Conduct Authority] pretty regularly, and we're a tiny operation, but there's always something that will come up. They'll have a new request. There'll be something I don't understand. I just pick up the phone and have a chat with them. Easy. Okay. From the board's perspective, you don't want the board getting into the nitty-gritty. That's absolutely not their job, but oversight is. So ideally the board, or someone on the board, would have a more strategic discussion with the regulator. What's the direction of travel? I keep using that phrase, but I think it's appropriate. What are you looking for? Where in this particular, or how does that apply? Actually, no, that piece of regulation, really, it's not a big thing for us, because we don't do that. Yes. Do you agree? You can have quite a good idea of where the regulator's coming from for your business, the one that you're overseeing, but you can leave the day-to-day stuff to management to actually implement it. That leads me on to the next question, actually. Your management team are going to be giving you assurances to say, "We've done all this work. Things are rosy." What can the board do to get comfort that management's assurances aren't overly optimistic? Well I think that that's all part, I don't think that is particularly compliance-specific. Your job as a board member, management will come, and they will present their board pack, they'll present their numbers, and you will be questioning them on that. You'll be questioning them on how the business is going, strategic developments, things they want to do. How are we doing on the budget? How do you see things going? Is there a new area? Compliance just falls into that. Yes. "Oh, okay. And do we have..." But just to come at it from a slightly different angle, bear in mind insurance is a highly regulated industry. So you have all of the normal commercial requirements that you have in a business anyway, but then you've got a regulatory overlay that's becoming more and more burdensome. So as a director, you still need to, I'm not in any way, shape or form saying that compliance is number one item on your list. It's not. You need to know how the business is doing commercially. But you can't ignore the compliance angle. No. So you've got to, in the same way that you would question the directors - management, I'm sorry - in terms of how we're doing against budget. What's the P&L [profit and loss] looking like? Have we got any balance sheet exposures that we should be worried about? You will have a relationship with them, and knowledge, to be able to question what they're saying about that. You need that same sort of knowledge to be able to question them when they say, "Oh, no, compliance, it's all good." Great, really pleased to hear that. Now, how are we doing with our policy wording? It's that sort of thing. Which actually leads me nicely on to my next question. If we take the life insurance industry, or the insurance industry generally in New Zealand, we've got changes around the Conduct of Financial Institutions, or CoFI. We've got the Contracts of Insurance Act [2024]. We've got, in banking, the Deposit Takers Act [2023]. All these changes that are happening over the next twelve to eighteen months. What questions should boards be asking management to check that the business is ready for these changes?

I think you've got to be looking at: 14:13

okay, presumably we have an implementation plan, we know what we need to do, and how we're going to do it. How are we getting on? It's like any large project. It's like a big IT [information technology] project, or whatever. What's the plan? How are we doing against it? Do we see any big red lights? Have we got some problems coming our way that we need to deal with? That sort of thing. It's monitoring a project, basically. Right. Nice, easy answer. Great, thank you. With the shift towards principles-based regulation, which we're getting a lot of in New Zealand, and embedding good customer outcomes into the culture of the company, how should boards satisfy themselves that standard is being reached? Yeah, this is a really interesting one. My experience with the Swiss broker that I work with was really interesting, in that, consumer duty when came out, it was frightening in terms of what it was requiring. "My goodness. How on earth are we going to do this?" And I was looking at, there was one particular requirement that you make sure that the products you're selling are appropriate for your customers. And I'm looking at that thinking, "My goodness, we've got to produce a report that the directors sign off on this,"that says the products are appropriate. And we've got to provide quantitative proof on that."How on earth are we going to do this?" I was sitting with the CEO [Chief Executive Officer] talking about it, and he said, "Just explain that again." I said, "Well, we've got to somehow make sure,"we've got to demonstrate that our policyholders are getting the best, most appropriate products for them." And he said, "Well, it's easy." He's Swiss, so that was my attempt at a Swiss accent. He said, "We do that all the time. Whenever the insurers come out with a new product,"I personally sit down and review that product. And if it doesn't work, it's got the wrong exclusions,"or not the right benefits, I won't sell it. And I'll pick up the phone to the insurer,"and I'll say, 'This doesn't work for the following reasons.'" I said, "We're already doing it. Fantastic! Fantastic!"

The question then would be: 16:34

are you writing it down and keeping evidence that you're doing it? And that was the change we had to make. Right. You're already doing it. Just document it. And we were good on that one. Yeah. So a lot of this stuff sounds scary, but again, it's just about engaging with it. A lot of the time, okay, again, if you stand back and say, "Okay, what's the regulator saying?" They're saying they want you to deal with the customer on a fair basis. Well, you want to be dealing with them on a fair basis, because you want them to renew. So you're probably doing a lot of this stuff anyway. Yeah. It's not as - although, and your point is well made. New Zealand's trying to do a massive amount of change in a much shorter time. We did it over twenty-three years in the UK; you're doing it over five here. So it sounds very challenging, and in a lot of respects, there's a lot of stuff to be gone through, but actually, you're probably doing a lot of this stuff anyway. So it's a question of saying, "Okay, we do this. The requirement is that. Well, we're not quite meeting that,"but the reason why we're not meeting that is because we don't need to meet that, because it's not relevant for our product."Fine. Done." Yeah. So it's about engaging. Right, great. What are the biggest mistakes you see boards making when preparing for this significant regulatory change? So, when I was, when I was working in a couple of MGAs[managing general agents], international MGAs, and we had offices internationally, but obviously you get changes going on in places like the UK. The problem was that some of the guys on the board were only interested in the commercial side of things. Because they're the PE guys, they put the money in. "We only want to know," They want a return. Yeah. And that doesn't really work. So the board does have to be aware of this stuff. Back in the day it didn't matter so much, but the regulators are a lot more, I wouldn't say aggresive, that's unfair, but they're switched on to this stuff. They put these requirements out there for a reason, and they want to know that they're being done. So you can't ignore it. You can't just treat it as, "Oh yeah, it's something over there. If management says it's fine, that's great." It's more all-pervasive than that. Yes. So as we're getting this increased complexity of regulation in these industries, do boards themselves need different skills and experience represented? I think that's, I think the answer is, "yes." And if you go through some of the FMA's documentation, certainly around the fair conduct programme, they pretty much say that. Or at least imply it very heavily. But again, people are on boards for a reason. They're bringing specific skill sets there. I think it's a sledgehammer if you say that all board members need to be one hundred per cent up to speed on the latest compliance changes. That's ridiculous. But you do need a number, even if it's only one. But you need somebody on the board who's aware of the significance of this stuff, because, again, coming back to my point, it's a heavily regulated industry, and the regulators can shut you down. Yes, yeah. And I mean I've had, not quite that experience. We were part of, one of the entities I worked with, we were part of a larger group within the UK. And we actually had the unannounced visit by the regulator.

Monday morning, nine o'clock: 20:27

"We're here to see you." And they'd actually hit all of the entities in the group. And they were specifically focusing on client money. The other entities in the group didn't have the required level of control. We were fine, because we had an agreement in place with the insurers, so when we take the money in, that's the same as the insurer having received it. Right. We explained it to the regulators."Well, we don't believe that." "Here are the documents," - "Here's the contract." -"here you go, we've got everything in place." And they were like, "All right then, bye." So, again, it's important, I think, to engage with these requirements. They are there, somebody on the board has to be aware of what they are, just so you have everything in place, and you don't have any, we like to have no risk management. You just want, you know, everything's fine, no shocks. Yes. So having somebody keeping up to date with this stuff is, as you say, tremendously important. Are there any particular skill sets that suddenly a board needs, around risk management, and those sorts of things, that are more essential to a board these days that may not have been? I'm not sure, because a lot of this stuff, these changes are about changing the emphasis on the way things are done. So it's more about the culture of the business. But by dint of the fact that board members are on the board, they understand the business, they know how it works. I don't think there's any particular requirement there. But you do still, you need to have, and board members would have this anyway, I guess, but that ability to hear about a change and say, "Hang on, how does that impact?" So, okay, we've got to handle claims differently now, between consumers and non-consumers, for example, under the Contracts of Insurance Act change. Okay, that's fine. So there's all sorts of work that's got to be done in the claims department to make sure we've got two different routes for handling claims. That's fine, that's fine. But, hang on, have we told the reinsurers that? What's the impact on our reinsurance programme? Does that invalidate our treaty? Do we need to...? So you need that kind of thinking, whereby,"Oh, I hear what you're telling me, Mr Manager, about the change, and how you've got that in,"and you've made the tactical changes to make sure that you're doing that. That's great."But have we thought about the wider impact of that?" Yes. But I think that's a sort of skill that a board member would have anyway. But that's really that sort of elliptical thinking, if you like. Yeah, right. If you were chairing a New Zealand financial services board today, what are three things that you'd insist on seeing at every board meeting, just to make sure that the organisation is genuinely prepared for regulatory change? Well, for me, the primary thing is always going to be the commercials. So the first item on any agenda: how are we doing as a business? Because nothing else matters, basically. If you haven't got that bit right, you're in trouble. Yes. So you want to see that. You want to understand where the business sits strategically. But, unfortunately, in the top three, I think compliance does come now. There's so much change going on, and the downsides for getting it wrong. It's pretty interesting. In the various conversations I've had with people, I've got the impression pretty strongly, and backed up by some of the documents they've produced, that the regulator is going to be looking at this from day one. It's not something that goes live and we'll get around to checking up on it in a couple of years. Now whether they can, to what extent they do that, and what that actually means, well, we don't know. Yeah. But you need to be aware of that. You've got to be prepared. Yeah. So, in terms of your original question: What would I be looking at? I think number three is probably going to be compliance. I want to know the business is fine, I want to know where we stand, and then how we're doing with the compliance changes. What do they mean for the business? Have we planned this out? Have we thought about how it fits, and how it might impact us in the round, as opposed to just in the tactical side of how the business runs? Right. So in the compliance and regulation space, you might want to see a pipeline of what's in and what's coming. You'd probably want to see some sort of project plan about how well it's being implemented, and then some reporting around how well it's, the implemented change is embedded in the business. That's right, that's right. And that first point that you made there, you want to hear what change is coming, and how the business, how the management is looking at that. But you also want to have your own body of knowledge to be able to sense-check that. To make sure that they have got everything. And that's not going to be a binary in and out thing. But just, have we really thought through what the requirements are? What's it mean? Let's talk about that. So I think you're right. You want to make sure everyone's on the same page in terms of what the changes are. Then, how are we doing against the plan for that? And then, how are we, once we are up and running on it, what are our regulatory requirements? What are our business commercial requirements? And how are we going to get ourselves comfortable, every board meeting, that actually, all of this is going according to plan? Yeah. One final question for you. What advice would you give to an organisation that's facing significant regulatory change? To the board. If you're coming in to advise a board, what advice would you give them? This is significant. The changes that are coming are big changes in the way that the industry runs. So that, of itself, means that it is a significant issue that you need to consider. However, you're not the first people to do this. It's been done in other very similar

regimes. And it's interesting: 26:52

the Contracts of Insurance Act refers to UK legislation quite often. So there is a body of, people have done this. Yes. You can have a look and talk to people to see how it's gone in other territories. And that should help you to manage this. But you can't ignore this. It's significant. Great, Jerry, great conversation. Thank you so much for your time. Excellent. Look forward to catching up again soon. We'll see you next episode. Thank you. Thank you for watching this episode of Governance Bites. We have more episodes on YouTube and your favourite podcast channel, where I interview directors and experts on various topics relating to boards of directors and governance. We'd love to see you back, and please like, subscribe, and share the videos and podcasts.