Insurtech is one of the more active corners of South African fintech. Apps offer device and gadget cover at checkout. Platforms compare and sell funeral, car and pet policies online. Some startups price cover using telematics or other data, and others build embedded insurance into a retailer’s or lender’s customer journey.
The technology is new, but the law that applies to it is not. In South Africa, carrying on insurance business, giving advice on insurance products and acting as an intermediary are all regulated activities. A business that designs a clever product but gets its regulatory model wrong can find itself conducting insurance business without a licence, which can be a criminal offence, or earning fees it is not allowed to earn.
The framework is also moving. In April 2026, Cabinet approved the Conduct of Financial Institutions (COFI) Bill for submission to Parliament. COFI is intended to create a single, activity-based conduct framework for the financial sector, including insurers, and is expected to change how many fintechs are licensed over time. For now, though, insurtechs must work within the current legislation.
The legal framework in brief
Three sets of laws do most of the work:
- The Insurance Act 18 of 2017, which came into force on 1 July 2018, deals with the prudential regulation of insurers. Only a person licensed under that Act may conduct insurance business. Licences are granted by the Prudential Authority, which sits within the South African Reserve Bank.
- The Long-term Insurance Act 52 of 1998 and the Short-term Insurance Act 53 of 1998, which still contain important conduct rules, including the regulations on binder agreements and the Policyholder Protection Rules.
- The Financial Advisory and Intermediary Services Act 37 of 2002 (FAIS), which requires anyone who gives advice on, or renders intermediary services in relation to, insurance policies and other financial products to be an authorised financial services provider (FSP), or a representative of one. FSP licences are granted by the Financial Sector Conduct Authority (FSCA).
Health cover raises additional questions under the Medical Schemes Act 131 of 1998, and products that look like medical scheme business need specific advice.
Which business model are you running?
The licence you need depends on what your business actually does, not on what it calls itself.
1. You carry the risk: an insurer or microinsurer licence
If your business promises to pay out when an uncertain event happens, in return for a premium, and the risk sits on your balance sheet, you are likely conducting insurance business. You will need a licence from the Prudential Authority.
The Insurance Act introduced a microinsurance licence aimed at financial inclusion. It allows smaller insurers to write simpler, lower-value products, such as funeral, personal accident or device cover, with lower minimum capital than a full insurer. Microinsurance products are subject to restrictions, including that they may not include investment or savings components. Even so, capital, governance, actuarial and reporting requirements apply, and the licensing process takes time.
2. You partner with an insurer: cell captives
Many insurtechs do not want to become insurers. A common route is a third-party cell captive arrangement. A licensed cell captive insurer issues the policies, and the insurtech holds a cell, putting up capital and sharing in the underwriting profit or loss of its book. This lets the business build its own product and brand while relying on the insurer’s licence. The shareholder and cell agreements are central, and the insurer will impose its own governance and reporting requirements.
3. You act on the insurer’s behalf: binder agreements
An insurer may mandate another party, under a binder agreement, to perform certain functions on its behalf, such as entering into or renewing policies, setting policy wording or premiums within agreed limits, or settling claims. Binder holders are typically underwriting management agencies or intermediaries. The binder regulations limit who may hold a binder, which functions can be delegated and the fees that may be paid. Binder holders generally also need to be authorised FSPs.
4. You sell or recommend cover: an FSP licence
A platform that recommends policies, compares products, collects information to arrange cover or helps customers with claims is likely rendering advice or intermediary services under FAIS. That requires an FSP licence for the right product categories, or an arrangement under which the platform’s staff act as representatives of a licensed FSP.
Embedded insurance often falls here. A retailer or app that offers cover at checkout, and earns a fee or commission for doing so, must be structured carefully. Commission and fees in insurance are regulated, and marketing or outsourcing arrangements that are really disguised commission can breach the rules.
5. You only provide technology
A pure technology provider that licenses software to insurers or FSPs, without dealing with customers or receiving product-linked remuneration, may not need a licence of its own. The insurer’s outsourcing obligations will still apply to the arrangement, and the line between providing technology and rendering intermediary services can be thin.
Conduct rules that apply whichever model you choose
Licensing is only the first step. Insurtechs must also deal with:
- Treating customers fairly and the Policyholder Protection Rules, including disclosure, cooling-off rights, claims handling and complaints processes;
- product design that delivers fair value and does not exclude the very risks customers think they are covered for;
- premium collection rules, including who may receive premiums and how they must be held;
- the Protection of Personal Information Act 4 of 2013 (POPIA), especially where pricing relies on health, location or behavioural data; and
- FSCA conduct standards and reporting obligations.
Regulatory engagement and the sandbox
The Intergovernmental Fintech Working Group (IFWG), which includes the Prudential Authority, the FSCA and other regulators, runs an Innovation Hub. It includes a regulatory guidance unit, where innovators can ask how the rules apply to their model, and a regulatory sandbox for testing products under supervision. Engaging early can save time and avoid building a product on the wrong regulatory footing.
A practical checklist for insurtech founders
- Map exactly who carries the risk, who deals with the customer and who is paid for what.
- Decide whether you will be the insurer, partner through a cell captive, act under a binder or operate as an intermediary.
- Confirm which licence or authorisation each entity in the structure needs, and the product categories involved.
- Check that every fee, commission and revenue share is permitted under the insurance and FAIS rules.
- Put proper agreements in place with your insurer partner, covering outsourcing, data, claims, premiums and termination.
- Build Policyholder Protection Rules and POPIA requirements into your customer journey from the start.
- Consider approaching the IFWG Innovation Hub if your model does not fit neatly into existing categories.
- Monitor the COFI Bill and plan for changes to licensing.
How O’Reilly Law can help
We advise fintech and insurtech businesses on how to structure their products within South African financial services regulation. We assist with regulatory analysis, FSP licence applications, cell captive, binder and outsourcing agreements, distribution and embedded insurance arrangements, platform terms and POPIA compliance. Where specialist actuarial or prudential input is needed, we work alongside your other advisers.
Contact us to discuss the regulatory structure for your insurtech product.
Related reading: Payments businesses and the National Payment System Act: what fintechs need to know · Lending, BNPL and the National Credit Act: who must register?
This article is general information and not legal advice. Correct as at November 2026.