Executive Summary
- The Kenyan supplier can structure this project as a technical service to the insurer. That conclusion depends on its actual promises and activities: the proposed absence of policyholder contracts, premium handling and flood-risk exposure supports it, while a fixed fee alone establishes no exemption. (Financial Services and Markets Act 2000, ss 19, 22; Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (SI 2001/544), art 10.)
- The insurer should issue the policy and owe every payment due under its terms. An objective index can determine the payment without transferring the insurer’s obligation to the model supplier. For the recommended loss-linked design, the policy should identify the protected interest, insured event and agreed relationship between the benefit and flood-related harm. (FCA Handbook, PERG 6.3.4G; Gatwick Investment Ltd v Liberty Mutual Insurance Europe SE [2026] UKSC 14, [38]–[46].)
- A binding trigger certificate does not automatically require UK insurance-distribution permission. Expert appraisal and specified claims work for an insurer benefit from a statutory exclusion. Binding new cover or advising its purchaser engages different activities. (Regulated Activities Order 2001, arts 21, 25, 39A, 39B, 53.)
- Kenyan law requires a separate assessment. Its insurance-business prohibition reaches companies established under Kenyan law carrying on insurance business abroad, and its licensing categories include claims settling for overseas insurers. UK permission or exclusion does not resolve those Kenyan requirements. (Insurance Act (Kenya), Cap 487, ss 2, 19, 150.)
- A commercial policyholder can fall within the Consumer Duty’s retail market. The insurer must apply the current customer definitions and the separate conditions for exemption from insurance product rules. An index’s technical complexity creates no general exemption. (FCA Handbook, Glossary, “larger commercial customer” and “retail market business”; PRIN 3.2.6R–3.2.7R; PROD 1.4.3R–1.4.3-AR.)
- Real flooding without the agreed trigger can leave the policyholder without a contractual payment. That basis risk must be distinguished from incorrect data, defective calculation and a failed feed. Clear disclosure cannot cure an unsuitable product or rewrite the payment condition. (FCA Handbook, ICOBS 2.2.2R; PROD 4.2.22R–4.2.24R; Gatwick, [38]–[46].)
- The supplier agreement should allocate data and service failures, while the policy preserves the insurer’s payment obligation. A cap in the supplier agreement limits recourse only within its own valid scope; the parties should not assume English law subjects every international licence term to statutory reasonableness review. (Unfair Contract Terms Act 1977, ss 2, 3, 11, 27 and Sch 1.)
- Expansion into delegated claims work or the supplier’s own weather-contingent payments requires a separate launch decision. The latter may involve insurance, reinsurance or derivatives in addition to Kenyan licensing. An insurer’s approval of the software cannot authorise the supplier’s separate financial business. (Regulated Activities Order 2001, arts 10, 85; Insurance Act (Kenya), ss 2, 19.)
The policy must identify the insured promise
The first launch should retain the UK insurer as the risk carrier and use the Kenyan company as a contracted technical supplier. For contractual consistency, the recommended initial product covers premises in England and Wales under English-law policies. The supplier agreement should also choose English law and an express dispute forum. The insurance choice follows the permitted law of the risk’s location; the supplier contract requires its own choice. (Rome I Regulation (EC) No 593/2008, as applicable in UK law, arts 3, 4, 7(3)(a), 22.)
The policyholder pays a premium for the insurer’s promise. Its insured interest may concern ownership of the premises, exposed stock, business income or specified flood-related expenditure. The uncertain event is the agreed flood-related occurrence. The trigger is the contractual measurement that activates the payment scale. The insurer owes that payment when the policy conditions are satisfied. The insurer’s internal payment approval process should implement the promise, without adding an unrestricted discretion to refuse an objectively due payment.
The Financial Conduct Authority’s (FCA) insurance guidance identifies consideration, an enforceable benefit, an uncertain event and adversity to the protected interest. It examines the substance of the arrangement. A weather index supplies a measurement mechanism; its presence alone resolves neither insurance status nor the existence of an insured interest. (FCA Handbook, PERG 6.3.2G–6.3.4G, 6.5.1G–6.5.4G.)
The strongest objection concerns a payment detached from any adverse effect on the purchaser. A promise to pay on regional rainfall without requiring a protected interest or adverse effect needs a separate insurance and derivatives analysis. For this property product, the recommended wording identifies the exposure, requires defined flood-related harm and uses an agreed benefit schedule. Any loss cap, reconciliation or repayment condition must appear expressly. This design reduces uncertainty while preserving a payment calculation that does not require adjustment of every item of damage.
English law does not supply a universal rule that every insurance payment must equal the precise loss. Gatwick confirms that contractual language governs and that clear terms can produce under- or over-indemnification. The indemnity purpose remains relevant when interpreting an indemnity policy. Feasey supports attention to the particular interest and policy structure, but concerned fixed-benefit personal accident cover and divided the Court of Appeal. Neither decision approves every weather-index promise. An unrestricted fixed-benefit alternative therefore needs a distinct classification of its exact terms. (Gatwick, [38]–[46]; Feasey v Sun Life Assurance Co of Canada [2003] EWCA Civ 885, [71], [80], [97]–[110], [112]–[125], [144]–[192].)
Technical supply depends on the activities performed
The proposed data contract supports a conclusion that the supplier does not effect or carry out insurance as principal. The company promises a model service to the insurer and assumes no obligation to compensate the policyholder for flooding. The UK general prohibition applies to specified activities carried on by way of business in the United Kingdom. The insurer’s regulated insurance undertaking and the supplier’s technical obligation must therefore be identified separately. (Financial Services and Markets Act 2000, ss 19, 22; Regulated Activities Order 2001, arts 10, 75.)
A fixed licence fee does not determine the answer. Consideration for insurance can be embedded in another payment. A licence that also promises a weather-contingent benefit must be assessed as a whole. Conversely, a contractual obligation to correct defective calculations concerns performance of the service and does not necessarily transfer the insured flood risk. (FCA Handbook, PERG 6.5.1G–6.5.4G, 6.6.6G.)
The UK distribution questions arise from the workflow. Arranging can include steps towards concluding insurance, and article 25(2) extends beyond bringing about one identified transaction. Providing factual flood observations to an insurer does not, by itself, amount to advising a policyholder on the merits of a particular policy. If the company builds a quotation process, recommends a specific cover option or exercises authority to conclude policies, those additional functions change the analysis. (Regulated Activities Order 2001, arts 21, 25, 53; FCA Handbook, PERG 5.5.1G–5.5.2G, 5.8.1G–5.8.6G.)
Article 33B excludes certain information-only arrangements where the provider takes no further step to assist conclusion. That exclusion has defined conditions; it is not a general exemption for software businesses. The initial service specification should limit the supplier to observations, model operation and documented calculations, with the insurer responsible for insurance recommendations and policy formation. (Regulated Activities Order 2001, art 33B.)
Kenyan incorporation and overseas servers do not settle UK territorial scope. Relevant facts include where people perform the activity, make arrangements, communicate advice and conclude contracts. Article 72 contains conditional exclusions for overseas persons, but no general exemption from principal insurance business. A UK office, sales staff or direct customer sales process requires assessment before activation. (Financial Services and Markets Act 2000, ss 19, 418; Regulated Activities Order 2001, arts 3, 72; FCA Handbook, PERG 5.12.6G–5.12.10G.)
Kenya distinguishes data exports from insurance business
The supplier cannot avoid Kenyan insurance law merely because the insured premises and purchaser are abroad. Section 19 prohibits unlicensed insurance business and expressly includes insurance business outside Kenya by a company established under Kenyan law. A Nairobi company assuming the flood risk would therefore need to address that provision even if every policyholder were British. (Insurance Act (Kenya), Cap 487, s 19.)
Kenya’s definition of index-based insurance is directly relevant. It describes payment triggered and quantified by an index, designed to compensate expected losses or costs without necessarily providing an indemnity. That statutory recognition does not license a data company to underwrite the product. The technical supplier’s proposed promise concerns accurate service performance; an undertaking to pay because the index moves would require fresh analysis under the insurance-business definitions. (Insurance Act (Kenya), s 2, definitions of “insurance business” and “index-based insurance”.)
The more immediate Kenyan exposure may arise from professional services. Section 150 requires licensing for listed insurance activities carried on in Kenya. The definition of claims-settling agent expressly covers claims under policies issued by an insurer in Kenya or abroad. Section 150 also includes loss adjustment, insurance surveys and risk management among its licensed categories. A person who negotiates or settles the UK carrier’s claims from Nairobi cannot rely on the absence of Kenyan policyholders. (Insurance Act (Kenya), ss 2, 150.)
The initial statement of work should therefore describe the technical outputs precisely. Producing rainfall observations and executing an agreed formula should be separated from surveying particular insured risks, advising on insurance arrangements or determining settlement. If the actual service falls within a licensed category, changing its name to analytics does not change the function. The insurance-business definition also includes business incidental to insurance business. The strongest objection to the proposed classification is therefore a supplier that effectively designs the insurance protection or exercises claims judgment while the insurer merely accepts its output. (Insurance Act (Kenya), s 2.)
The Insurance Professionals Act 2025 adds a separate professional-practice regime. Its description of practice includes claims settling, risk management and insurance consulting; section 41 addresses transition to practising certificates. Bespoke advice on cover, premiums or the insurance use of a threshold can require this assessment even without claims authority. The parties should allocate any covered professional work to persons meeting the applicable requirements before that work begins. A technology contract should not assume that a company-level insurance assessment resolves the status of the individuals performing those functions. (Insurance Professionals Act (Kenya), No 5 of 2025, ss 20–25, 41.)
Kenya’s Insurance (Products) Guidelines apply to insurers and intermediaries registered under its Insurance Act. Within that scope, piloting a new product requires the prescribed no-objection letter and sale requires product approval. The parties should identify the responsible regulated product provider before adding an insurance role. Signing a software licence cannot supply the required product approval. (Insurance (Products) Guidelines 2022, Gazette Notice 3641, paras 3, 6(3).)
Delegated authority turns on the certificate and the decision
The supplier’s output can have three different legal effects. A model report supplies evidence. A binding expert certificate conclusively determines a specified technical issue under agreed terms. A delegated claims decision exercises authority given by the insurer to resolve an existing claim. The documents should identify which effect applies, because “binding trigger certificate” can conceal materially different powers.
A certificate that records an agreed rainfall value does not itself make the supplier an insurer. Article 39B excludes professional expert appraisal and specified loss-adjusting or claims-management activities for a relevant insurer from article 39A. A relevant insurer includes a person with permission to effect or carry out insurance. The exclusion means that insurer-side claims management does not automatically require insurance-distribution permission under article 39A. It does not dispose of other regulated activities performed alongside it. (Regulated Activities Order 2001, arts 39A, 39B; FCA Handbook, PERG 5.7.1G–5.7.8G.)
The outcome changes if a certificate binds new cover. Entering insurance contracts as the insurer’s agent engages article 21, and arranging their conclusion engages article 25. Advice to a purchaser about the merits of a particular policy engages article 53. Assistance to a claimant in administering and performing its insurance contract needs its own article 39A assessment. The insurer-side exclusion cannot simply be carried across to claimant representation. Mere provision of evidence to a claimant also should not be equated automatically with regulated assistance. (Regulated Activities Order 2001, arts 21, 25, 39A, 39B, 53; FCA Handbook, PERG 5.5.1G–5.5.2G, 5.7.1G–5.7.7G, 5.8.1G–5.8.3AG.)
For parametric insurance delegated authority in the UK, the practical document is a schedule of decisions. It should distinguish calculation, correction, coverage interpretation, settlement, waiver and authority to bind a policy. The schedule should name the decision-maker, monetary or other limits, referral conditions and records for each permitted function. The supplier must obtain the required authority before exercising it, and any regulated function requires an applicable permission or exemption as well as contractual appointment.
A later claims delegation can therefore be viable, even where the output determines payment. The insurer remains the policy debtor, and its outsourced functions remain subject to the applicable insurer controls. Kenyan licensing and professional-practice requirements must be satisfied independently. Delegating the same act can have an excluded UK distribution status and a Kenyan service-provider licence and applicable professional credentials without any contradiction. (Insurance Act (Kenya), ss 2, 150; Insurance Professionals Act (Kenya), ss 20–25, 41; PRA Rulebook, Conditions Governing Business, 7.1–7.8.)
An own-payment promise changes the business
The supplier should exclude an independent weather-contingent payment from its initial licence. If it undertakes to pay the purchaser when the index moves, it assumes a financial obligation beyond the performance of its software. A promise to protect the insurer against its portfolio exposure may be reinsurance. A promise to a premises owner may be insurance. An independent cash-settled index contract also raises derivatives questions. The identity of the purchaser, protected exposure, payment condition and settlement terms determine the classification.
Article 85(1)(b) of the Regulated Activities Order addresses contracts intended to secure profit or avoid loss by reference to fluctuations in an index or another factor designated in the contract. Its fixed-outcome provisions and Schedule 2 also address specified derivatives, including climatic variables. The insurance exclusion in article 85(2)(d) is limited to “qualifying contracts of insurance”, a defined category concerned with certain long-term insurance. It supplies no blanket exclusion for general commercial flood cover. (Regulated Activities Order 2001, arts 3, 85(1)–(4B), Sch 2, Pt 1, para 10; FCA Handbook, PERG 2.6.23G–2.6.24AG.)
A weather payment is not automatically a regulated derivative. The analysis must identify the investment and dealing activity, establish the business and UK territorial tests, and determine whether an exclusion applies. Transactions with an authorised institutional counterparty can raise different exclusions from a product offered directly to premises owners. Nor does the purchaser’s insurance authorisation establish that every proposed derivative transaction is within its permissions. (Financial Services and Markets Act 2000, ss 19, 22; Regulated Activities Order 2001, arts 14, 16, 72, 85.)
Before this variant is offered, the supplier should obtain separate Kenyan insurance and capital-markets classifications alongside the UK assessment. If the undertaking is insurance business, Kenya’s section 19 overseas-business rule remains material. Calling the payment a licence warranty cannot remove it. A service indemnity should consequently respond to defined supplier breach and resulting loss; an obligation to fund all index payouts regardless of breach requires separate product classification before agreement. (Insurance Act (Kenya), ss 2, 19.)
Commercial customers require a current conduct assessment
The insurer should classify the intended policyholders before choosing the distribution and product-approval process. Incorporation does not place a business outside the Consumer Duty. The FCA’s insurance scope uses current definitions of larger commercial customers and specialist risks, with separate conditions for particular rule exclusions. Ordinary commercial flood cover does not become a specialist-risk contract merely because its trigger is technically complex. (FCA Handbook, Glossary, “larger commercial customer”, “specialist risks contracts”, “retail market business”; PRIN 3.2.6R–3.2.7R.)
For an enterprise, the larger-commercial definition excludes micro-enterprises and small businesses. A micro-enterprise has fewer than ten employees and annual turnover or balance-sheet total not exceeding €2 million. The relevant small-business definition requires that the enterprise is not a micro-enterprise, has turnover below £6.5 million and has either fewer than fifty employees or a balance-sheet total below £5 million. Applicable aggregation rules can bring linked enterprises into the calculation. These alternatives and strict thresholds matter when classifying a group of commercial premises owners. (FCA Handbook, Glossary, “micro-enterprise”, “small business”, “larger commercial customer”.)
PROD 4 contains the FCA’s rules for insurance product design and distribution. For ordinary commercial flood cover, the larger-commercial-customer exemption requires a product used only for contracts whose purchase is arranged by a larger commercial customer, directly or through an agent. No individual policyholder or relevant policy stakeholder may, in that context, be acting outside a trade, business or profession. A policy stakeholder is an individual other than a policyholder who must pay under a contractual or statutory obligation. The payment relates to the premium and any other distribution costs because of the individual’s interest or benefit in the insured subject matter. The obligation must not arise solely from the individual’s trade or profession. Smaller enterprises buying their own policies under a mixed-target product cannot take the exemption merely because some buyers are larger businesses. (FCA Handbook, PROD 1.4.3R(1)(b), 1.4.3-AR; Glossary, “policy stakeholder”.)
When PROD 4 applies, the insurer must approve the product before marketing, identify its target market and test whether it meets that market’s needs. Outsourcing design does not remove the manufacturer’s responsibility. For this product, testing should examine the likelihood and scale of unpaid flood losses, false triggers, data outages and the total customer price. Fair value requires analysis of the benefits and limitations relative to the price. Disclosure of an index mismatch cannot rescue a product that fails the applicable product tests. (FCA Handbook, PROD 4.2.1R, 4.2.11R, 4.2.14AR, 4.2.14CR, 4.2.14ER, 4.2.15R, 4.2.22R–4.2.24R.)
Fair communications remain material for larger commercial customers even where other ICOBS requirements fall away. For customers within the relevant scope, demands-and-needs and claims-handling duties also apply. The insurer should describe the policy’s measured condition, maximum benefit and uninsured mismatch without promising payment for every flooded property. (FCA Handbook, ICOBS 1 Annex 1, Pt 2, 2.1R(1)(c); ICOBS 2.2.2R, 5.2.2R, 5.2.2BR, 8.1.1R.)
The index specification must address errors and outages
The insurer should approve one versioned index specification that both contracts incorporate where relevant. It should identify the data source, permitted use rights, measurement location or grid, units, observation window and time zone. The calculation must state the threshold, rounding, aggregation and payout scale. A rainfall threshold and a modelled flood-depth threshold can respond differently to the same event; the policy must identify the measure it actually uses.
The supplier should retain source observations, timestamps, model versions and the calculation path for every certificate. The agreement should allocate responsibility for source licences, sensor maintenance and external-data dependencies. Corrections need a defined cut-off and a rule for late observations, revised measurements and already-paid claims. Changes to the model during a policy term should follow an agreed approval and version-control process, because changing the algorithm can change the insured promise.
A missing feed needs a contractual response before the first policy is sold. Specify an ordered fallback, the conditions for using it and the independent evidence needed to reconstruct the agreed measurement. The fallback method should test the same insured condition, with any change in measurement basis disclosed in the policy. Treating an unavailable observation as zero would otherwise convert a service outage into an apparent absence of flooding.
These technical provisions are recommended contractual safeguards. Applicable product rules require proportionate testing and approval, but do not prescribe one universal sensor, grid or fallback formula. The insurer should commission validation sufficiently independent of the model’s developer to challenge calibration, data gaps and manipulation risks. The record should explain the selected geography, historical event sample, measurement errors and limits of prediction. Customer and event evidence should inform later product reviews. (FCA Handbook, PROD 4.2.2R, 4.2.22R–4.2.24R, 4.2.34R, 4.2.34DR.)
The insurer must classify and control its reliance on the supplier
For the recommended launch, the insurer should be a UK Solvency II firm with the permissions for the intended cover. This selects the prudential category to which the cited Prudential Regulation Authority (PRA) rules apply. Its procurement assessment should distinguish buying an external data product from outsourcing an activity it would otherwise perform. The PRA expressly identifies purchased geospatial data and off-the-shelf machine-learning models as possible non-outsourcing arrangements. An ongoing service that operates the insurer’s trigger and claims function can require a different conclusion. (PRA Supervisory Statement SS2/21, November 2024, paras 2.1–2.6.)
For outsourced critical or important functions, the PRA rules require continuing insurer responsibility, due diligence and written terms. They also require timely prior notification to the PRA, access and cooperation, and arrangements that preserve service and supervision. Notification is not a general requirement to obtain regulator approval for every software purchase. The importance assessment should examine how a failure would affect payment obligations, policyholders and the insurer’s ability to comply. (PRA Rulebook, Conditions Governing Business, 7.1–7.8.)
The contract should support actual access to evidence in Kenya. It should address subcontractors, data locations, audit, incident notice, recovery arrangements and exit. Source code or equivalent reproducible calculation materials may be needed where replacement otherwise becomes impossible. Confidentiality and intellectual-property clauses should permit the access required by the insurer and its supervisors. The parties should test whether those rights can be exercised through each supplier and data-source contract.
Material third-party dependencies still need proportionate controls when they fall outside outsourcing. Operational-resilience rules require the in-scope insurer to identify important business services, set limits on tolerable disruption, called impact tolerances, map dependencies and test disruption. A feed that disables payment to many insured businesses must be assessed within that service. The practical test is whether the insurer can reconstruct the trigger calculation and meet policy obligations during supplier failure and after termination. (PRA Rulebook, Insurance Operational Resilience, 2.1–2.6, 4.1, 5.1–5.3; SS2/21, paras 2.5–2.6, chs 6–10.)
Flood loss and a failed trigger produce different claims
Where the agreed index is accurate but remains below the threshold, a premises owner can suffer real loss without a policy payment. This is basis risk: the difference between the contractual measure and the insured’s actual experience. If the policy clearly makes that threshold a condition, the court should apply the agreed promise. Broad references to flood protection cannot safely substitute for precise operative wording. (Gatwick, [38]–[46]; Wood v Capita Insurance Services Ltd [2017] UKSC 24, [10]–[15].)
A claim based on misleading sales statements or defective product design is a separate question. Applicable FCA duties can require appropriate product testing and fair communications without converting every uninsured loss into a contractual benefit. If a false statement induced the contract, the elements and defences of misrepresentation require their own assessment. The insurer should preserve the proposal, sales material and version of the disclosure received by the customer. (FCA Handbook, ICOBS 2.2.2R; PROD 4.2.22R–4.2.24R; Misrepresentation Act 1967, s 2.)
An erroneous index raises a different issue. The policy may refer to the underlying objectively measured condition, a specified published value, or a certificate subject to correction. Those choices determine whether a corrected reading establishes an existing payment obligation or changes a contractually conclusive value. The insurer should apply the correction and dispute provisions, investigate the source error and preserve evidence of what a correct calculation would have produced. Supplier fault alone does not decide the policy’s meaning.
If the feed fails entirely, the insurer should activate the agreed fallback. A service-level breach does not prove that the insured event occurred, and an unavailable value does not prove that it did not. The chosen alternative evidence must establish the contract’s condition under the agreed method. A policy with no outage mechanism exposes both parties to an avoidable dispute about whether performance can be established.
The converse case also requires precise wording. If the trigger occurs but anticipated loss does not, a harm condition or indemnity cap may prevent or limit payment. A valid fixed-benefit promise may instead require the scheduled amount once its conditions are met. The insurer should not introduce an actual-loss condition only after the event, nor ignore one expressly included in the contract. Gatwick’s treatment of clear under- or over-indemnifying language supports construction of the agreed obligation, without deciding the classification of every parametric product. (Gatwick, [41]–[46].)
Expert determination should have a defined technical remit
An independent expert can resolve whether the specified observations and formula produce the certified value. The policy should state how the expert is appointed, what evidence each party may submit, whether reasons are required and the timetable. A supplier agreement alone cannot establish what the policyholder has agreed to treat as conclusive; the relevant policy terms must address the certificate’s effect.
English law gives contractual expert determinations substantial finality within their agreed remit. The court ultimately determines the expert’s jurisdiction. The distinction between a mistake within that remit and a material departure from instructions can decide whether a determination stands. A “final and binding” label does not itself settle every boundary dispute, and legal mistakes do not create a general appeal right. (Barclays Bank plc v Nylon Capital LLP [2011] EWCA Civ 826, [21]–[23], [28]–[37]; Premier Telecom Communications Group Ltd v Webb [2014] EWCA Civ 994, [8]–[13].)
The recommended clause should reserve insurance coverage and contractual construction to the courts, while giving the expert specified measurement and calculation questions. It should define any manifest-error exception and preserve challenges for fraud or material departure from the mandate. The certifier should be independent where the dispute concerns the supplier’s own error. The parties also need a process for appointing a replacement if their chosen expert cannot act.
The policy and supplier contract should coordinate evidence and time limits while keeping their different disputes distinct. Payment of an undisputed policy sum should proceed without awaiting recovery from the supplier. Eligible complainants may also have access to the Financial Ombudsman Service; a company is not automatically excluded. The applicable eligibility and jurisdiction conditions determine that route, and it should not be presented as a universal commercial-insurance forum. (FCA Handbook, DISP 2.7.3R.)
Parametric trigger provider liability for data and calculation errors
The insurer should bear the policy debt, while the supplier answers for breach of its own agreed service obligations. Supplier duties should cover the specified data quality, calculation method, correction process and service availability. The insurer should retain responsibility for selecting the exposure, approving the policy and validating the product. This allocation gives each party a defined performance obligation and a record against which fault can be assessed.
If the supplier sends an incorrect value, the insurer’s recourse depends on the obligation breached and the resulting recoverable loss. For negligence based on a contractual assumption of responsibility, the duty’s purpose, causation and contractual remoteness test matter. A voluntary corrective payment is not automatically irrecoverable. (URS Corporation Ltd v BDW Trading Ltd [2025] UKSC 21, [27]–[33], [57]–[61].)
A payment already owed under the policy is not automatically a loss caused by the supplier. A wrongful refusal may instead generate correction costs, dispute costs and liability for delayed payment. The contract should distinguish those consequences from voluntary payments outside the policy or losses caused by the insurer’s own validation decisions. A negotiated indemnity can allocate specified exposures, but should identify its trigger, defence rights and treatment of shared fault.
For the proposed English-law policy, section 13A of the Insurance Act 2015 requires the insurer to pay sums due within a reasonable time, including time to investigate and assess. An insurer with reasonable grounds to dispute a claim does not breach that duty merely by withholding payment during the dispute. Its conduct in handling the claim can still affect whether it breached the duty. Commercial contracting out is subject to sections 16A and 17; deliberate or reckless breach cannot be excluded through the permitted route. The insurer’s dispute with its supplier does not itself replace these policy obligations. (Insurance Act 2015, ss 13A, 16A, 17.)
International supplier contracts need negotiated liability limits
The supplier cap should reflect credible error and outage scenarios, the scope of available insurance cover and the cost of replacement. Separate treatment may be justified for confidentiality, data protection, intellectual-property infringement or deliberate misconduct. The parties should check professional indemnity and cyber cover against their promised services, territorial scope, exclusions and claims conditions. No particular cap or insurance limit follows merely from the annual licence fee.
English statutory reasonableness controls are conditional. Where applicable, the Unfair Contract Terms Act restricts negligence exclusions and exclusions in standard written terms, and addresses resources and insurance when assessing a monetary cap. Its insurance-contract and intellectual-property provisions limit the reach of those controls. Section 27 also excludes the relevant controls where English law applies only by the parties’ choice and another country’s law would otherwise govern. A Kenyan service provider makes that question material under Rome I’s service-contract rule. The parties should negotiate the cap directly rather than depend on a later assumption that it will be invalid. (Unfair Contract Terms Act 1977, ss 2, 3, 11, 27(1), Sch 1, para 1(a), (c); Rome I, art 4(1)(b), (2)–(4).)
Data protection follows the information and processing roles
Rainfall readings and corporate premises coordinates are not automatically personal data. The question is whether information relates to an identified or identifiable individual. Linking an address to a sole trader, household, claimant or contact can change the answer. The initial data map should identify what reaches Kenya, who can access it and whether individual records are necessary for calculating the index. (UK GDPR, art 4(1); Data Protection Act (Kenya), No 24 of 2019, s 2.)
If the supplier processes personal data on the insurer’s instructions, the parties need the applicable processor terms and security measures. If it decides its own purposes for reusing identifiable claims data, its controller status requires separate assessment. Remote access from Kenya can also engage the UK international-transfer rules. The transfer arrangement must satisfy the current statutory route. Under article 46 of the UK General Data Protection Regulation (UK GDPR), the exporter must provide the required safeguards. Acting reasonably and proportionately, it must consider that protection after transfer will not be materially lower than the applicable UK standard. A security clause alone does not meet those requirements. (UK GDPR, arts 4(1)(7)–(8), 28, 32, 44A, 46(1A), (2), (6)–(7).)
The Kenyan establishment must also address Kenyan data-protection duties where it processes personal data. Property details can be sensitive personal data under Kenyan law when they concern an individual. The service design should minimise identifiable material, allocate incident reporting and prohibit incompatible reuse. Those choices reduce the information needed across borders while preserving the event evidence required for payment. (Data Protection Act (Kenya), ss 2, 4, 25, 30, 41–43.)
The supplier should determine and satisfy its Kenyan controller or processor registration obligations before processing personal data. Returning personal records from Nairobi to the UK is a separate outward transfer under Kenyan law. Section 48 requires an applicable transfer basis; section 49(1) requires consent and confirmation of appropriate safeguards for processing sensitive personal data outside Kenya. UK safeguards should therefore be coordinated with the Kenyan obligations. (Data Protection Act (Kenya), ss 18, 48, 49(1).)
Additional functions need a separate launch decision
The initial commercial agreement should authorise only the technical service described in its statement of work. For a parametric insurance technology provider, regulation follows the functions actually performed, including those embedded in software. The insurer should retain policy formation and claims authority until a separate delegation is agreed and the applicable UK and Kenyan conditions are met. (Regulated Activities Order 2001, arts 10, 21, 25, 39A, 39B, 53; Insurance Act (Kenya), ss 19, 150.)
Before policies are offered, the insurer should approve the insured exposure and payment architecture, classify the target customers and record its product assessment. The agreed index specification should then connect the policy, data licence and service-level agreement. Validation should test both severe flooding that misses the trigger and an outage at the decision point. Those tests establish whether the proposed wording and operating process produce the intended result before customers depend on them. (FCA Handbook, PROD 4.2.1R, 4.2.22R–4.2.24R.)
The signed package should include the index specification, data and service terms, validation record and coordinated dispute provisions. The insurer’s supplier assessment should address access, continuity and exit under the rules applicable to that relationship. Corporate signatories should have authority to grant the necessary data rights and accept the operational obligations. Neither party should infer a professional licence or product approval from execution of those commercial documents.
A later delegation schedule should identify each additional decision and its legal basis before activation. An own-payment product requires a separate insurance, reinsurance or derivatives assessment. The parties should record its classification and any applicable permission, exemption or exclusion before the supplier undertakes to pay.