The FMA's July 2026 thematic review offers a clear assessment of operational resilience across New Zealand's insurance sector. Its central observation is that, for many insurers, progress has been "stronger at a policy level than in operational execution." Frameworks and plans are largely in place; the emerging test is whether critical services, systems and provider arrangements work as intended when disruption occurs.
For insurers, the review marks a shift from having resilience arrangements in place to proving they work in practice. The sector has engaged seriously with the agenda: two-thirds of the insurers covered by the Conduct of Financial Institutions (CoFI) regime took part on a voluntary basis, and the FMA described a broadly positive level of engagement and progress towards operational maturity. Every respondent reported an established risk management framework and a documented business continuity plan, and of the insurers that have invoked their plans in a live disruption, 95% rated their effectiveness at 4 or 5 out of 5.
The harder task is demonstrating that critical services can withstand disruption and recover within acceptable timeframes. The FMA expects resilient practices to be embedded consistently, supported by clear evidence that arrangements are sound, regularly tested and effective in practice. Because those services depend on core platforms, data and specialist providers, this is a shared execution challenge for insurers and their technology partners.
This next phase changes the nature of the work. Demonstrating resilience depends not only on an insurer's internal arrangements, but also on the performance of the core platforms, data and service providers supporting critical operations. The FMA observes that resilience outcomes for many firms are "closely tied to the continued performance, availability, and resilience of third-party providers". Technology-provider performance must therefore form part of the evidence insurers can produce.
The technology core
Technology and information security recorded the lowest maturity score of the areas the FMA assessed, and the causes are largely structural. All respondents rely heavily on critical technology systems, and more than 90% describe those systems as moderately or significantly customised. Nearly three-quarters (74%) use systems more than ten years old for core operations, and more than 70% consider their critical systems difficult to replace.
Insurers were clear about why replacement is so difficult. They cited the investment required to replace highly customised platforms, the difficulty of replicating existing functionality, the complexity of integration within global operating models, a limited pool of suitable vendors, and incompatibility between modern platforms and legacy insurance policies.
The last of these is especially acute in life and health insurance. Policies frequently outlast the platforms that administered them, carrying terms, options and pricing structures from products long closed to new business. Migrating that book safely is a significant undertaking, and a measured approach is appropriate.
Age alone does not determine risk. Many long-standing systems remain well governed and dependable. The exposures the FMA draws attention to are more specific: supportability, vendor end-of-life, and reliance on a small number of individuals with specialist knowledge. Insurers are expected to maintain clear oversight of these exposures, while providers play a critical role by setting the support horizon and upgrade path for the platforms they supply.
Modernisation without disruption
The review also offers some reassurance. Insurers reported no adverse impacts from underinvestment in critical technology or cyber security over the past twelve months. Every respondent reported having sufficient financial resources to invest in operational resilience and technology, and most described sustained investment in modernisation, cloud migration and cyber security. These are positive indicators, but they are self-reported and do not remove the need to demonstrate that systems can recover effectively under stress.
The constraint, then, is not simply commitment. It is execution risk: replacing a core platform can introduce significant operational and customer risk if the migration is poorly sequenced or governed. Insurers therefore need an approach that reduces existing exposure without concentrating new risks in a single transformation event.
The FMA's guidance here is pragmatic. It notes that insurers "may reduce transformation risk by pursuing phased upgrades rather than large-scale replacements." This aligns with our approach to modernisation: allowing new capabilities to operate alongside existing systems so that risk can be retired progressively rather than concentrated in a single cutover.
The threat environment adds urgency: the FMA expects advances in frontier AI to increase both the speed at which vulnerabilities can be exploited and the potential scale of disruption.
Third-party dependency and exit readiness
Outsourcing is now integral to how insurers operate. More than 90% of respondents outsource key functions. Of those, 61% outsource critical technology systems, and 71% of all respondents rely on providers based overseas. Three-quarters of those that outsource rate their reliance on external providers at 4 or 5 out of 5.
The FMA found that many outsourcing agreements lack comprehensive provisions for performance monitoring, remedies for non-performance, and termination. It also highlighted the need for credible exit readiness. These are reasonable expectations, and in our view, they apply as much to providers as to insurers. A provider supporting critical operations should offer clear service measures, defined remedies, and a documented exit pathway as standard terms, not as concessions to be negotiated.
Exit planning is where the greatest complexity lies. Insurers told the FMA that outsourced technology services were generally easier to transition between providers, yet more than 70% regard their critical systems as difficult to replace. The distinction is important: changing the operator of an existing system may be considerably simpler than replacing the system itself, because the deeper dependency resides in the data, configuration, and product rules accumulated over many years. Providers should be able to set out, in practical terms, how a client's policies and data would be transitioned if the relationship were to end.
Evidencing recovery
Almost all respondents (97%) test their business continuity plans through scenario walkthroughs. These exercises are valuable: they confirm roles, decision rights, and escalation paths. Live recovery testing provides a different order of evidence. It demonstrates whether core platforms are restored within acceptable timeframes, whether data reconciles, whether integrations re-establish, and whether customers and advisers receive the information they need.
Live testing of core platforms typically involves the provider, which makes it a natural area for closer collaboration. The review found that only 6% of respondents use external expertise to help design and implement their test scenarios. Providers, however, observe how their platforms perform under stress across multiple client environments, and that insight should be shared as a matter of course.
The FMA also wants testing outcomes to be followed through consistently. In our experience, the most valuable exercises are those that surface something to resolve. An issue identified, remediated, and reflected in the plan is precisely the evidence the regulator is looking for.
Recovery time merits greater prominence as a measure. In assessing incident materiality, most insurers consider the number of customers affected, regulatory and reputational consequences and financial cost. Fewer than a quarter cited factors such as service continuity, incident duration, or recovery time. Australia offers a useful comparison: the Australian Prudential Regulation Authority (APRA) standard CPS 230, in force since July 2025, requires regulated insurers to maintain critical operations within defined tolerance levels through severe disruption and to manage the service providers on which those operations depend. The FMA has said this thematic review will inform its future regulatory strategy, although it has not stated that New Zealand will adopt the Australian approach. Even so, insurers and providers that can evidence recovery against defined tolerances will be better prepared for closer supervisory scrutiny.
Questions for insurers and their technology partners
These questions are best worked through jointly:
- When was core policy administration last recovered on live systems, and how long did recovery take?
- Where do critical services depend on a single platform, provider or individual?
- If a provider relationship ended, how would policy data and product rules be transitioned, and has that process been rehearsed?
- What did the most recent recovery test identify, and what changed as a result?
- How is resilience being designed into the next technology decision, rather than addressed after the fact?
- The FMA makes this last point explicitly, recommending that resilience be built into future technology decisions.
The practical implication is not that every insurer should replace its core platform. It is that each insurer should be able to explain which dependencies create the greatest exposure, what evidence demonstrates recovery capability, and how those exposures will be reduced over time. That creates room for several responses: stronger testing and controls, clearer provider obligations, targeted upgrades, or phased modernisation where the underlying risk justifies it.
The AMS perspective
As a provider of core policy administration platforms, AMS is part of the dependency landscape described in the review. Our platforms administer more than 40% of New Zealand's life insurance policies on behalf of some of the country's largest insurers. That makes operational resilience a practical obligation for us, not just a market opportunity. We need to be able to show clients how our platforms recover, how risks are managed, and how their data and policies could be transitioned if circumstances changed.
AMS Protego illustrates how phased modernisation can work in practice. This enterprise SaaS policy administration platform can bring modern and traditional policies into a single environment, giving insurers a pathway for books that might otherwise remain on legacy platforms because of their complexity. Its relevance to the FMA's findings is practical: it addresses the incompatibility between modern platforms and legacy policies without assuming that every book can or should be moved through a single large-scale replacement.
We conduct an annual end-to-end recovery exercise with our clients. We move AMS Protego to the disaster recovery environment, operate it from there, then return it to the primary environment, with clients engaged throughout.
Our platforms are built and supported in New Zealand by specialists in this market's products and regulation, with the security expertise and resources of the global Volaris Group behind them.
Insurers should expect a high standard from every provider of critical services, AMS included: transparent performance measures, defined remedies, active participation in live recovery testing, and a credible, documented approach to exit. These should be treated as core elements of a resilient service relationship.
The sector has established the foundations of operational resilience, and the FMA has been clear about the next phase. Demonstrating resilience in practice requires tested platforms, transparent provider relationships and resilience built into every technology decision. Insurers remain accountable for the outcome, while critical technology partners must be able to provide credible evidence of their contribution.
The FMA's review gives insurers and their technology partners a useful basis for a more specific conversation: which services matter most, what evidence exists that they can recover, which dependencies should be reduced first, and what role each provider should play in proving resilience over time.
We are happy to share what we are learning through platform recovery exercises, legacy-book modernisation and work with New Zealand insurers.
Read the FMA's July 2026 report, Operational resilience thematic: findings and insights (insurance).