Resources Categories
INDUSTRY FACT FILE · INSURANCE INTERMEDIARIES
Industry Overview: Insurance Intermediaries and Insurtech in India
The types of intermediaries and digital insurance platforms, how they are regulated, who buys cybersecurity inside them and why each needs a distinct approach.
|
In this document 1. Why intermediary cybersecurity matters now 2. The ecosystem at a glance 3. Categories of intermediaries and insurtech players 4. IRDAI's 2026 cyber security guidelines and intermediaries 5. Government, insurer and private participants 6. Who buys cybersecurity inside an intermediary 7. Why each intermediary type needs a different approach 8. How Codec Networks works with intermediaries |
|
Sector scope Sector: insurance intermediaries and insurtech — brokers, corporate agents, web aggregators, third-party administrators (TPAs), insurance repositories and digital insurance platforms. Primary service proposition: cyber audits, IRDAI-aligned platform assessments, API security, claims platform testing and vendor risk. Insurers and reinsurers themselves are covered in the separate Insurance & Reinsurance fact file. |
1. Why intermediary cybersecurity matters now
Intermediaries sit between insurers and customers. They collect identity, KYC, health and payment details, advise on cover, connect to insurers' quote, issuance and claims systems and, in the case of TPAs, process health claims on insurers' behalf. Many are lean, fast-growing digital businesses—which makes them attractive targets and, for insurers, an important source of third-party risk.
|
6 Apr 2026 IRDAI's revised guidelines issued, covering intermediaries |
6 hours To report cyber incidents to CERT-In |
6-monthly External PT by CERT-In empanelled auditors |
May 2027 Most DPDP obligations take effect |
IRDAI's revised Information and Cyber Security Guidelines, issued on 6 April 2026 and replacing the 2023 guidelines, apply to insurers and to intermediaries including insurance brokers, corporate agents, web aggregators and TPAs, with compliance required from the current financial year.
|
Key takeaway For an intermediary, cybersecurity is a licence condition, a sales requirement and a trust signal. Insurers increasingly ask distribution and claims partners for audit evidence before—and during—a partnership. |
2. The ecosystem at a glance
Figure 1: India's insurance intermediary and insurtech ecosystem.
3. Categories of intermediaries and insurtech players
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Insurance brokers |
Direct, reinsurance and composite brokers advising and placing cover for individuals and businesses |
Indian private firms, bank and corporate groups, global broking groups |
IRDAI registration as a broker; IRDAI 2026 cyber guidelines |
|
Corporate agents |
Banks, NBFCs and other companies that distribute policies of partner insurers |
Banks, NBFCs, cooperative banks and corporates |
IRDAI registration as a corporate agent; IRDAI 2026 cyber guidelines |
|
Web aggregators |
Online comparison platforms that display products and generate leads for insurers |
Venture-backed and private digital companies |
IRDAI registration as a web aggregator; IRDAI 2026 cyber guidelines |
|
Third-party administrators (TPAs) |
Process health claims, manage cashless services and hospital networks for insurers |
Private and insurer-promoted companies |
IRDAI registration as a TPA; IRDAI 2026 cyber guidelines |
|
Insurance repositories |
Hold policies in electronic insurance accounts for policyholders |
Entities promoted by depositories and market institutions |
IRDAI registration as a repository; IRDAI cyber requirements |
|
Digital insurance platforms |
Insurtech distribution, embedded insurance and API-led platforms, typically operating under a broker, corporate agent or web aggregator licence |
Startups and digital arms of larger groups |
Licence under which they operate; insurers' partner requirements |
|
Individual distributors |
Agents and POSPs who sell through insurers and intermediaries |
Individuals |
Outside direct scope; insurers ensure a minimum security framework |
4. IRDAI's 2026 cyber security guidelines and intermediaries
|
Area |
What it means for intermediaries (as reported) |
|
Applicability |
The 2026 guidelines apply to intermediaries including insurance brokers, corporate agents, web aggregators and TPAs, with compliance required from the current financial year Insurers must also ensure that agents, POSPs and individual surveyors follow a minimum security framework |
|
Audit and reporting |
Cyber security audits by CERT-In empanelled auditors Compliance reports submitted within 30 days of audit completion, according to published summaries |
|
Testing |
External penetration testing at least once every six months, using grey-box or white-box methods, by a CERT-In empanelled auditor |
|
Incident reporting |
Cyber incidents reported to CERT-In within six hours of noticing them, as required by the CERT-In Directions |
|
Cloud and vendors |
Cloud providers empanelled by MeitY with valid STQC audit status; data erasure on termination Vendor contracts with right-to-audit and approval for sub-outsourcing; supervised privileged access |
|
Data protection |
Measures for DPDP Act compliance, classification of personal data and encryption of confidential information |
|
Verify the circular These points summarise the 6 April 2026 guidelines as reported in public sources. The exact audit frequency, auditor eligibility and reporting route for each intermediary category should be confirmed against the official IRDAI circular. |
5. Government, insurer and private participants
- IRDAI registers and regulates intermediaries under the Insurance Act, 1938 and the IRDA Act, 1999.
- Insurers depend on intermediaries for distribution and claims services and remain accountable for the policyholder data they share.
- Banks and NBFCs act as corporate agents and are also supervised by the RBI for their own cyber controls.
- Hospitals, surveyors and loss assessors connect to TPAs and insurers in the claims process.
- Private insurtechs compete on digital experience, comparison and embedded insurance.
6. Who buys cybersecurity inside an intermediary
|
Stakeholder |
What they care about |
What they buy |
|
Founder, CEO and Board |
Licence standing, insurer partnerships, reputation |
Audits, Board reporting, crisis exercises |
|
Principal officer and compliance |
IRDAI requirements and reporting deadlines |
Gap assessments, audits, compliance reports |
|
CTO and engineering |
Platform availability, secure releases, APIs |
Application and API testing, secure SDLC |
|
CISO or IT head |
Control effectiveness, incidents, monitoring |
VAPT, managed SOC, incident response |
|
Partnerships and alliances |
Insurer due-diligence questionnaires |
Audit evidence, certifications, partner reviews |
|
Claims operations (TPAs) |
Claims continuity and fraud |
Claims platform testing, ransomware resilience |
|
Data protection lead |
Customer and health data, DPDP readiness |
Privacy programme, DLP, consent reviews |
7. Why each intermediary type needs a different approach
|
Intermediary type |
Highest-consequence risk |
Starting point for assurance |
|
Insurance broker |
BEC and premium diversion, corporate client data |
Email security, finance-process testing, audit |
|
Corporate agent |
Customer data shared with insurers, staff misuse |
Integration and access reviews, insider monitoring |
|
Web aggregator |
Mass data exposure through APIs and lead flows |
API security testing, data minimisation, external PT |
|
TPA |
Ransomware and medical data leakage |
Claims platform testing, SOC, backup and BCP/DR drills |
|
Insurance repository |
Account takeover and integrity of e-policies |
Authentication testing, infrastructure VAPT, monitoring |
|
Digital insurance platform |
API, cloud and AI-assistant exposure |
API and cloud reviews, AI security testing |
8. How Codec Networks works with intermediaries
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For intermediaries we deliver cyber audits and gap assessments against IRDAI's 2026 guidelines, six-monthly external penetration testing, platform and API security testing, claims platform testing for TPAs, vendor risk assessments and managed SOC.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026, including reported summaries of IRDAI's 2026 guidelines and CERT-In and MeitY publications. Confirm obligations against the official IRDAI circular before making compliance decisions.