Which Conduct Rules Apply to Regulated Content

An agency pitching a Bermuda reinsurer will, at some point, be told that everything needs to go through compliance. What is much rarer is anyone specifying which framework compliance will be reviewing against, and the assumption that there is one universal answer causes more delay than the review itself.

There is no single Bermuda Monetary Authority advertising rule. There are several sector-specific codes with different definitions, different obligations, and a split inside the insurance code that most published commentary misses entirely. Getting this right at the start changes a review cycle from a rewrite into a check.

What follows is an orientation to which framework applies where, what the underlying standard actually asks, and how to draft so that review is fast. It is general information rather than legal or compliance advice, and the applicable framework for any specific entity should be confirmed with Bermuda counsel and that entity's own compliance function.

Different licences, different codes

The Bermuda Monetary Authority supervises insurance, investment business, banking and deposit companies, fund administration, corporate service providers and digital asset business. Each of those sits under its own conduct framework.

For insurers, the relevant instrument is the Insurance Code of Conduct, revised in August 2022 and issued under section 2BA of the Insurance Act 1978. It binds insurers registered under section 4 of that Act, and its conduct-of-business provisions sit at section 8, which covers communications with policyholders being fair, clear and not misleading, and addresses advertisements specifically. Compliance deadlines were staggered: section 8 from March 2023, and the governance, risk management and outsourcing sections from September 2023.

Investment business providers operate under a separate advertising code alongside a general business conduct code, with its own definition of advertisement that expressly reaches internet and electronic media. Banks and deposit companies have their own code again.

These are not interchangeable. It is worth naming the specific error here because we encountered it directly: research material prepared for this article took an advertising provision from the banking code and applied it by analogy across insurers, funds and administrators, on the reasoning that similar principles presumably apply throughout. The source that did this labelled it as inference, which was honest. It is still not a safe foundation for a compliance position, and a reviewer will spot the mismatch immediately.

The split inside the insurance code

This is the finding that matters most for anyone marketing a wholesale Bermuda platform, and it runs opposite to the direction most commentary points.

The revised Insurance Code of Conduct does not apply its conduct-of-business provisions uniformly. It bifurcates, deliberately, between the retail and non-retail arenas. The reasoning given in analysis of the revision is that the inequalities of bargaining strength and sophistication that characterise markets for products sold to individuals and small businesses are not replicated in the wholesale sector, so the same protective apparatus is not required.

Commentary on the revised Code notes that the remainder of section 8 applies to insurers writing domestic retail business.

Consider what that means for the Bermuda market as it actually is. The register carried 1,210 insurers and reinsurers at the end of 2025, and the overwhelming majority of the premium volume is wholesale: reinsurance, captives, insurance-linked securities and life reinsurance written for cedants in the United States and Asia. That is precisely the arena where the retail conduct provisions are not designed to bite.

So the claim, common in agency material, that every piece of marketing content produced by a BMA-regulated entity must pass the Insurance Code of Conduct advertising provisions is an overclaim. The obligations attaching to a domestic retail insurer selling motor cover in Hamilton are not automatically the obligations attaching to a wholesale reinsurer writing catastrophe treaties for US cedants.

Two cautions on how far to take this. First, the bifurcation does not mean wholesale entities operate without conduct expectations. The Code sits within a broader supervisory framework, non-compliance with the Code is a factor the Authority weighs when assessing whether an insurer conducts its business in a sound and prudent manner, and misleading statements about a regulated business carry consequences well beyond any single code. Second, and more practically, we have not verified precisely which subsections fall on which side of the retail line, so the correct statement is that the framework is bifurcated and the applicable obligations depend on licence class and business written. That statement is accurate. A more specific mapping would need confirmation from Bermuda counsel.

What the standard is actually testing

Underneath the framework question sits a standard that operates the same way in most conduct regimes, and it is more demanding than it first appears.

Fair, clear and not misleading is assessed on the impression created, not on the literal accuracy of each sentence read in isolation.

That distinction is where most problems originate. A claim can be composed entirely of true statements and still fall short, through selecting a favourable period without disclosing the selection, comparing against a benchmark that is never named, presenting an exceptional outcome as representative, or omitting the qualification that makes the figure meaningful.

Marketing teams tend to test claims for accuracy. Reviewers test them for impression. The gap between those two tests is where a draft comes back covered in comments.

Claim as commonly drafted	Why it creates exposure	Defensible alternative
Leading provider in the market	No stated basis, no measurement, no period. Unverifiable by construction	State the measure, rank and source: position by a named metric, in a named ranking, for a named year
Fastest formation timeline available	Comparative superlative with an unstated comparison set and no evidence of the alternatives	Give your own typical range with the sample and period behind it, and let the reader compare
Clients typically see returns of X	Typically implies a distribution that is rarely calculated, and often rests on the best case	Describe one named engagement with its period, scope and measurement basis, and say it is one case
Fully compliant with all requirements	Absolute assurance about a moving target, and an invitation to be tested on the one exception	Name the specific frameworks addressed and the date of the most recent assessment
Guaranteed visibility in AI search	A guarantee of an outcome controlled entirely by third-party systems	Commit to method and deliverables: panel, cadence, dated captures, corrections made
The most secure option for your data	Comparative security claim with no benchmark and no assessment behind it	List the specific controls, certifications held and their dates of issue
Trusted by leading institutions	Implied endorsement without consent, and leading carries no definition	Name clients only with written permission, or describe the sector and engagement type without naming

Why AI-optimised content raises the stakes

Conduct obligations attach to what the entity publishes, regardless of how it was drafted. Using AI tools to produce content changes nothing about the obligation.

What does change is the mechanics of how the content gets consumed, and this is a genuine and underappreciated risk.

Content written to be extractable, which is the entire point of structuring for AI retrieval, is content designed to have sections lifted out and reused independently. That is the goal. It also means a passage can be reproduced without whatever qualification sat two paragraphs below it, or in the footer, or on a separate disclosures page.

An accurate claim, separated from its qualification, becomes a misleading impression. Not through anyone's bad faith, but through the retrieval mechanism working as designed.

The response is structural rather than legal. Qualifications belong inside the passage they qualify. If a figure requires a period, a basis and a caveat to be fair, all three go in the same sentence or the sentence immediately adjacent, not in a disclaimer block at the bottom of the page. Content built this way reads slightly more heavily to a human. It survives extraction intact, which is the trade worth making in a regulated context.

Claims about the regulatory environment carry the same exposure

Most claim governance focuses on performance claims, because those are the ones that feel risky. In this market the more common failure is a statement about the regulatory environment itself, and it fails for a boring reason: it was true when it was written.

Three examples, all recent enough that content published two years ago is now wrong.

The tax position. Bermuda introduced a 15 per cent corporate income tax under legislation assented to in December 2023, applying to fiscal years beginning on or after 1 January 2025, for businesses forming part of multinational groups with annual revenue of EUR 750 million or more. Businesses below that threshold remain outside income tax. Any content still describing Bermuda without qualification as a jurisdiction with no corporate income tax is now describing a position that changed at the start of 2025.

Recovery planning. Section 6G of the insurance legislation, introduced by amendments effective 30 May 2024, with recovery plan rules operative from 1 May 2025 for designated commercial insurers and groups. This one carries an additional trap: it is frequently described as a blanket obligation on all classes 3A, 3B, 4, C, D and E. In fact the Authority designates which insurers are in scope, guided by thresholds including a three-year rolling average of USD 10 billion in total assets or USD 5 billion in gross written premium. Updated guidance followed in March 2026. Saying every commercial insurer must maintain an approved recovery plan overstates it.

Equivalence and recognition. Bermuda has held full third-country equivalence under the European solvency regime since March 2016, and holds reciprocal jurisdiction and qualified jurisdiction status with the United States state insurance regulators' association. True, and routinely over-extended, because the Authority does not apply a solvency-equivalent regime to captives and captive classifications are unaffected by the jurisdiction's equivalence status. A captive marketing page claiming solvency equivalence is drawing on a real fact to produce a false impression.

All three belong in the same claims ledger as performance figures, with a review date attached. Regulatory facts do not decay gradually. They are correct until a commencement date, and wrong the following morning.

Two examples of overclaim taken from research prepared for this article

Rather than describing this failure mode abstractly, here are two instances found in material assembled during research for this piece. Both are the kind of thing that would have shipped without an evidence check.

The first took a provision from the banking code of conduct and applied it by analogy to insurers, funds and administrators, on the reasoning that similar principles presumably apply across supervised sectors. The source labelled it as inference, which was honest. It is still not a basis for a compliance position, and a reviewer would catch the mismatch immediately.

The second extended a genuine requirement beyond its actual scope. A regulator notice introducing police clearance certificates for key persons at anti-money-laundering regulated institutions, effective 1 October 2026, was extended into a claim that remote agency personnel with administrative access must observe the same vetting protocol. The underlying notice is real and correctly dated. The extension is not in it.

That second pattern is the more dangerous of the two, and it is worth naming precisely. An invented conclusion stacked on top of a verified fact passes a surface check. The reader confirms the fact, finds it accurate, and extends that confidence to the conclusion. A claims ledger catches it, because the ledger asks what the source says rather than whether the source exists.

Making review fast rather than painful

The practical bottleneck in regulated marketing is rarely disagreement about whether a claim is acceptable. It is that reviewers have to reconstruct where each assertion came from before they can assess it.

A claims ledger moves that work upstream to the person who already has the answer. Every performance or comparative claim in a draft gets a row: the claim verbatim, the named source with its date, the basis of measurement, the qualifications that must travel with it, and then the reviewer's decision and date once review happens.

Content goes to compliance with the ledger attached. The review becomes a check against stated evidence rather than an investigation, and the audit trail exists as a by-product rather than as an archaeology project a year later.

Three practices sit alongside it. Establish the applicable framework before drafting begins, not after the first review. Build the qualification into the passage rather than into a disclaimer, for the extraction reason above. And route claims about the regulatory environment itself, statements about supervisory requirements, equivalence recognitions or tax treatment, through the same ledger as performance claims, because those carry equivalent exposure and are more likely to go stale.

On review timelines, and why we will not give you a number

A final point, and it is a small illustration of a larger discipline.

Four separate research sources compiled for this article were asked how long compliance review typically takes in Bermuda financial services. All four declined to provide a figure. One stated that any universal turnaround claim would be invented. A fifth source did offer a specific range of working days and marked it uncertain, attributing it to a publisher we were unable to identify as a real organisation.

Four refusals to guess outweigh one guess that admits it is guessing. So the honest position is that review cycles in regulated finance run in weeks rather than days, that the interval varies considerably by entity, by content type and by whether external counsel is involved, and that the number you should plan against is the one your own compliance function gives you.

That is a less satisfying answer than a benchmark. In a document written for readers whose job is checking claims, it is also the only answer that would survive them checking it.

Tessar Napitupulu writes about producing marketing content inside regulated environments, including claim governance and the interaction between extraction-optimised content and conduct standards, in Cited or Silent, available as a free gated edition, with retailer editions on Amazon, Google Play and Apple Books.

---

Frequently Asked Questions

Which BMA code applies to our marketing content?

It depends on your licence, and there is no single answer that covers every regulated entity. Insurers registered under the Insurance Act fall under the Insurance Code of Conduct, revised in August 2022 and issued under section 2BA of that Act. Investment business providers fall under a separate advertising code and a separate general business conduct code. Banks and deposit companies fall under their own code. The definitions, obligations and the meaning of advertisement differ between them, so the first step is always establishing which framework governs your entity rather than applying one clause universally.

Do the advertising rules apply to a wholesale reinsurer the same way as to a domestic insurer?

No, and this is the distinction most commentary misses. The revised Insurance Code of Conduct deliberately separates the rules applying in the retail and non-retail arenas, on the reasoning that the imbalances of bargaining strength and sophistication present in markets serving individuals and small businesses are not replicated in the wholesale sector. Analysis of the revised Code notes that the remainder of section 8 applies to insurers writing domestic retail business. A wholesale reinsurer, a captive and a domestic retail insurer therefore do not carry identical conduct-of-business obligations.

What does fair, clear and not misleading actually require?

The Insurance Code of Conduct addresses communications with policyholders being fair, clear and not misleading within its conduct-of-business section, which also covers advertisements specifically. In practice the standard operates on the impression created rather than on the literal truth of each sentence, which means a technically accurate claim can still fall short if it produces a misleading overall impression through selective presentation, omitted qualifications or unrepresentative examples. Non-compliance with the Code is a factor the Bermuda Monetary Authority considers when assessing whether an insurer is conducting its business in a sound and prudent manner.

Can we publish performance figures in marketing content?

Figures that are accurate, dated, sourced and presented with their basis stated are generally the safest form of claim, because they can be checked. The exposure comes from presentation rather than from the numbers themselves: selecting a favourable period without saying so, comparing against an unstated benchmark, presenting a single outcome as typical, or omitting the qualifications that make the figure meaningful. A useful internal test is whether a reader could reconstruct the claim from the source you cited. If not, something material has been left out.

Does AI-generated or AI-optimised content change our conduct obligations?

The obligations are unchanged, and the practical risk profile is different. Conduct rules attach to what the entity publishes, regardless of how it was drafted. What changes is that content structured for extraction is more likely to be lifted out of context and reproduced without its surrounding qualifications, which is precisely how an accurate claim becomes a misleading impression. The design response is to keep qualifications inside the passage they qualify rather than in a separate disclaimer section.

Who should review marketing content before publication?

Whoever carries the conduct obligation, which in a regulated entity is generally the compliance function rather than the marketing team or the agency. A workable arrangement is that the agency drafts with the applicable framework identified in advance, maintains a claims ledger recording every performance and comparative claim with its source, and submits content for review with that ledger attached. The review is then a check against evidence rather than a rewrite from scratch.

How long should we allow for compliance review?

Longer than a marketing calendar assumes, and we will not quote a number. Four separate research sources compiled for this project declined to give a turnaround figure for Bermuda financial services compliance review, with one stating that any universal claim would be invented. A single source did offer a figure and marked it uncertain, from a publisher we could not identify. The honest planning position is that review cycles in regulated finance run in weeks rather than days, and that the interval should be established with your own compliance function rather than assumed from a benchmark.

---