A GUIDE FOR INSURANCE BUSINESS IN ITALY

For insurance companies operating under the principle of freedom of services in Italy

2

CONTENTS

PREFACE...............................................................3 I. INSURANCE BUSINESS IN ITALY.........................4 II.DISTRIBUTION OF INSURANCE PRODUCTS......15 III. ANTI-MONEY LAUNDERING...........................20 IV. DATA PRIVACY...............................................23

3

PREFACE

The guide is to provide an overview of the requirements set forth by Italian laws and regulations as they may apply to a foreign insurance company which carries out life/non life business in Italy under the principle of freedom of services. The subjects treated in the guide are not covered exhaustively and this guide is intended only to provide basic information on Italian law without any reference to particular issues concerning specific products. The guide is general and its content is subject to changes. It should be used for general guidance only. Companies or individuals seeking to conduct business in Italy are advised to obtain detailed information on applicable laws and take professional advice before making any decisions.

4

I. INSURANCE BUSINESS IN ITALY 1. OPERATIONS UNDER THE PRINCIPLE OF FREEDOM OF SERVICES An insurance company being based within the European Union (EU) but outside of Italy may operate within the territory of the Italian Republic either under the principle of freedom to provide services (FOS) or under the principle of freedom of establishment (FOE). The FOE enables insurance companies to pursue economic activities in a stable and continuous way in other Member States by establishing agencies, branches or subsidiaries.

In contrast, the FOS enables insurance companies to pursue economic activities in other Member States without establishing agencies, branches or subsidiaries. The FOS principle provides that an insurance business conducted in compliance with the applicable laws of a Member State may be carried out in the same manner and at the same conditions in another Member State, provided that the aforementioned manner and conditions do not conflict with the compulsory rules of the Member State where the activity is carried out under the FOS principle. Due to the applicable “home country control” principle, the insurer pursuing business under the FOS in a foreign Member State remains subject to the laws and regulations of its home Member State. However insurance companies operating under the FOS principle shall comply with the compulsory rules of Italian law, too. Compulsory

5

rules of Italian law are those set forth to protect “general public interest” and that reflect fundamental general principles of the Italian juridical system. 2. SUPERVISORY AUTHORITIES

There are different supervisory authorities in Italy which are competent for insurance matters and connected issues. Three important supervisory authorities are Ivass (“Istituto per la Vigilanza sulle Assicurazioni”), Consob (“Commissione Nazionale per le Società e la Borsa”) and Covip (“Commissione di vigilanza sui fondi pensione”).

2.1. Ivass In Italy supervision functions over the insurance sector are carried out by Ivass, a special national authority. Ivass is an independent authority

which acts in full autonomy in the juridical, financial, accounting, organisation and management field. Its supervision aims at ensuring correct management of insurance and reinsurance companies as well as correct conduct of intermediaries and other insurance sector participants. As of 1 January 2013, Ivass has replaced the former supervisory authority called Isvap (“Istituto per la vigilanza sulle assicurazioni private e di interesse collettivo”). The new authority Ivass is under the control of the Bank of Italy and has have the same supervisory powers Isvap previously had.

Ivass is competent for issuing binding regulations for the insurance sector and has, inter alia, the power to enforce precautionary measures and sanctions. Ivass shall adopt any regulation

6

necessary for a sound and prudent management of insurance companies and for the transparency and fairness in the conduct of the supervised entities. To this end it may also issue appropriate recommendations or interpretations. 2.2. Consob and Covip Other authorities having supervisory and regulatory powers on insurance companies are Consob and Covip. The regulatory and supervisory powers granted to Consob mainly apply to the conclusion and distribution of contracts related to financial products issued by insurance companies. With reference to such products, Consob has supervisory and regulatory powers in the subject-matters, such as transparency, correctness of conduct, compliance with regulations, handling of complaints,

management of conflicts of interest potentially prejudicial to customers, etc. Covip is the competent supervisory authority for pension funds with the task of ensuring the proper functioning of the pension funds system and protecting its participants and their savings. 3. GOVERNING LAW 3.1. Italian Laws and Regulations The local insurance law is mainly governed by the Insurance Code (Legislative Decree no. 209 of September 7, 2005, Regulation no. 35 of 26 May 2010) as well as other Regulations issued by ISVAP, the predecessor of Ivass. In addition, further requirements can be imposed by general laws such as e.g. the Italian Civil Code (Codice Civile, hereafter “C.C”.), Anti-money-laundering

7

Laws (Legislative Decree no. 231 of 21 November 2007, hereafter “AML Law”), the Consumer Code (Legislative Decree no. 206 of 6 September 2005), the Italian Personal Data Protection Code (Legislative Decree no. 196 of 30 June 2003, hereafter “IDPC”) etc. 3. 2. Italian Mandatory Provisions Nonetheless, should the insurance contract be governed by the laws of another State, Italian mandatory provisions shall apply. Such mandatory provisions shall protect the so called “general interest” and reflect general principles of the Italian juridical system. In some cases it might be also advisable to comply with rules and regulations which are not considered mandatory since Italian authorities have the tendency to also apply such rules and regulations to insurance companies operating under the FOS principle.

4. CONCLUSION OF THE INSURANCE CONTRACT The most common way of executing an insurance contract is to sign a hard copy of same. Distance insurance contracts may be created as an electronic file signed by means of a certified electronic or digital signature. Evidence regarding insurance contracts shall be provided in writing. The insurer is obliged to provide a copy of the insurance policy or any other document executed by the insurer upon request of the policyholder. 5. FORMAL ASPECTS OF INSURANCE CONTRACTS 5.1. Language An insurance contract, any document attached to it as well as the related correspondence shall be in Italian unless the parties agreed upon another language.

8

5.2. Drafting Criteria

The contract and any other documents provided by the insurer shall be drafted in a clear and exhaustive manner. Highlighted characters shall be used to draft clauses implying forfeitures, nullity and limitations of coverage or costs to be borne by the policyholder. To this extent the supervisory authorities provide very detailed schemes for all different insurance products. These schemes aim to ensure that the customer is properly informed by giving him the opportunity to evaluate advantages and disadvantages of an insurance product. The documents issued by the insurance company have to be drafted precisely in accordance with the requirements of such schemes and have to include all information requested.

5.3. Unfair Terms The insurance contract can contain so-called “unfair terms” which are terms that directly or indirectly limit or try to limit the counterparty’s rights. Such unfair terms shall be void, whereas the rest of the contract shall remain in effect. Under certain conditions, the unfair term can be approved by the consumer leading to the effectiveness of the unfair term. In this case the unfair term has to be acknowledged in writing by the consumer in order to be effective and enforceable. This leads to an obligation to sign the contract twice: the first signature is to conclude the insurance contract whereas the second signature is for the consumer to expressly acknowledge and approve any unfair terms.

9

6. INVALIDITY OF CONTRACTS 6.1. Void

The insurance contract is subject to limitations and can only be stipulated within a certain legal framework. For example, if the subject-matter of the contract conflicts with the law, public order or prevailing moral principles or mandatory principles, it is deemed null and void by the law. The same applies, if the aim of the contract is impossible to reach, unlawful, not determinable or lacks certain essential elements. 6.2. Voidable If the policyholder provided incorrect declarations or omitted to declare information on essential circumstances for the insurer’s consent with malice or gross negligence, the contract can

be annulled. The insurer may request the annulment of such an insurance contract. 7. TERMINATION AND WITHDRAWAL 7.1. Termination An insurance contract may be regarded as terminated if the risk no longer exists after the execution of the insurance contract. However, the insurance company is entitled to the payment of the premiums due until the date on which the insurer is informed thereof. 7.2. Withdrawal by the Insurance Company In case of incorrect declarations or omitted information provided by the policyholder without malice or gross negligence, the insurance company may withdraw from the insurance

10

contract through a declaration to be sent to the insured. Also, in case the policyholder informs the insurer of the existence of circumstances producing an increase of the insured risk, the insurance company may, inter alia, withdraw from the contract. 7.3. Withdrawal by the Policyholder The policyholder may withdraw from the contract within thirty (30) days from the receipt of the confirmation of its conclusion. In this case the insurer has to reimburse any premium already paid by the policyholder. This does not apply to contracts having a duration of six (6) months or less.

8. OBLIGATIONS ARISING PRIOR AND AFTER THE EXECUTION OF CONTRACT 8.1. Obligations Prior to Execution of Contract The insurance company has to comply with exhaustive information obligations imposed by Italian law. However, the scope and content of such information obligation varies depending on the specific nature and characteristics of the insurance product. The underlying concept of such pre-contractual information obligation is to inform the customer of all characteristics and limitations of the particular insurance product giving him the opportunity to proper evaluate whether the product fits his needs.

11

8.2. Obligations after the Execution of Contract Also after the conclusion of the contract the insurance company is exposed to information obligations. Changes which have impacts on the insurance policy have to be communicated. For example, in case of a transfer, merger or demerger of portfolio the new insurance company shall inform the policyholder and those entitled of the respective event in writing. The relevant communication shall include the corporate name and the registered office of the new insurance company, etc. 8.3. Utilisation of Distance Communication Techniques An insurance company may provide any information to the policyholder utilizing distance communication techniques, provided that a copy

of any communication can be acquired by the policyholder on a durable medium and that the policyholder agreed in advance to use such means of communication. 9. STATUTE OF LIMITATIONS The limitation period of the right to payment of the premium is one (1) year from the date the payment becomes due. With regard to the limitation periods for claims arising from the insurance contract, it is necessary has to distinguish between life insurance contracts and non-life insurance contracts. The limitation period of rights arising from life insurance contracts is ten (10) years, while the limitation period of the rights arising from all other types of insurance and reinsurance contracts is two (2) years.

12

10. COMPLAINTS 10.1. Entitled Persons and Entities All natural and legal persons, consumers and consumer associations and, in general, anyone representing collective interests can lodge a complaint with Ivass against insurance and reinsurance companies, intermediaries and technical experts. 10.2. Addressee Complaints concerning the management of the contractual relationship shall be directly sent to the insurance company, without prejudice to the possibility of bringing such complaints before Ivass in certain cases.

Ivass can be addressed whenever the violation of applicable law is suspected, when an insurance company does not answer a complaint as well as in case of certain complaints regarding cross-border disputes. 10.3. Claim Handling by Ivass Ivass may request the entities to provide data, information or documents. Also, Ivass may request the insurance company to provide clarifications directly to the claimant. In case of complaints against EU-insurance companies, Ivass shall involve the supervisory authority of the home Member State and communicate the outcome of the complaint to the claimant as soon as Ivass receives the necessary information from the foreign supervisory authority.

13

10.4. Cross-border Disputes For the settlement of cross-border disputes, the claimant having his/her residence in Italy may file the complaint either with Ivass or directly with the competent foreign authority by requesting the activation of the FIN-NET procedure. 10.5. Information Obligations of Insurance Companies Each insurance company shall insert, among the information on the handling of complaints, the instructions on how to file a complaint with the company in the pre-contractual information note. It shall specify the office responsible for examining complaints and the relevant contact numbers and addresses. The company shall further insert information on how to file a complaint with Ivass or, in case of an insurance

company with registered office in a different Member State, with the supervisory authority of its home Member State. 11. ADVERTISEMENT OF INSURANCE PRODUCTS 11.1. General Rules The advertisement of an insurance product shall be based on accurate information, comply with the information note and provide the general terms of the relevant products. These principles apply also when advertising is carried out by intermediaries. 11.2. Obligations Advertisement shall clearly indicate the name of the insurance company. Expressions such as "guarantees", "guaranteed" or similar terms can

14

be used only if a guarantee is actually issued by the insurance company. Returns shall be advertised net of any charges envisaged by the procedures for profit sharing. In case the insurance company intends to advertise the maximum payable return, the message shall include the minimum rate of return. If the advertisement is carried out by intermediaries, insurance companies shall ensure that the intermediaries comply with the rules on transparent and accurate advertisement of insurance products. Advertisement prepared by intermediaries is subject to the insurance company’s prior authorisation. 11.3. Powers of Ivass Ivass may require companies and intermediaries to send advertising material on a non-systematic basis. If Ivass suspects that the provisions on

transparency and accuracy have been violated, it may suspend advertising on a precautionary basis. If a violation is ascertained, Ivass shall prohibit the advertising.

15

II. DISTRIBUTION OF INSURANCE PRODUCTS 1. INTRODUCTION The two most common modalities utilized to distribute insurance products by insurance companies operating under the FOS principle are through bank intermediaries as well as through distance communication techniques. Also, Insurance companies operating under the FOS principle may reach agreements with other intermediaries. However, these agreements may only be stipulated within a certain legal framework.

2. DISTRIBUTION THROUGH BANK INTERMEDIARIES/ POSTE ITALIANE 2.1. Requirements Intermediary banks enrolled with Section D of the RUI may distribute insurance policies provided that the policies distributed by the above intermediaries are exclusively standardized insurance policies. Only policies having pre-determined clauses and guarantees which are not modifiable by the intermediaries may be distributed. Insurance companies may allow the intermediary banks to issue policies directly at their premises as long as the contractual terms and conditions set forth by the insurance company cannot be modified. If the intermediaries can issue the insurance policies through electronic means, adequate protection

16

must be implemented to prevent any interference caused by the intermediaries themselves. 2.2. Distribution of Non-standardized Insurance Policies Non-standardized insurance policies may be distributed by intermediaries enrolled with Section D (inter alia, intermediary banks) only inside the intermediaries’ premises and provided that the individuals in charge of distribution are enrolled with Section A of the RUI which is dedicated to insurance company agents. 2.3. Information Obligation All of the information, including advertising and promotional messages provided to clients and prospective clients shall be correct, clear and not

misleading; the insurance company shall provide clients and prospective client adequate information so that they are able to understand the nature of the product as well as the risks connected thereto so that they are able to make an informed decisions. 3. DISTRIBUTION THROUGH DISTANCE COMMUNICATION TECHNIQUES 3.1. Definition Distance communication techniques are those means which may be used for the conclusion of the contract without the simultaneous physical presence of the insurance company and the policyholder.

17

3.2. Scope of Application The insurance company may not market insurance contracts at distance without the express prior consent of the policyholder. Furthermore, the absence of a reply or dissent may not be construed as consent on the part of the policyholder. When promoting and marketing insurance contracts at distance it is prohibited to use procedures preventing certain categories of policyholders from contacting the insurance company. Advertising and placement through distance communications techniques shall not be performed. If they have already commenced, they shall cease immediately if the client expressly dissents thereto. For this purpose, the

client shall be duly informed on the possibility of refusing such communications. 3.3. Call-center An insurance company may use a call-center, provided that, inter alia, the staff is employed by the insurance company itself or, in case the staff is not employed by the insurance company, the latter shall assume full responsibility for their work. In such cases the insurance company shall appoint one of its employees as the person in charge of the coordination and supervision of the promotion and marketing of insurance contracts through the call-center. 3.4. Distribution by Telephone In case of distance sale of insurance contracts by telephone, the insurance company shall, inter

18

alia: a) if the caller is the insurance company, declare in a clear and unequivocal fashion its corporate name and the commercial purpose of the call; b) provide, subject to the consent of the policyholder, inter alia, the following information: (i) the identification code or the name of the person in contact with the policyholder and the relationship of the latter with the insurance company; (ii) a description of the main features of the insurance contract; (iii) the total premium to be paid by the policyholder to the insurance company for the insurance contract, including the taxes paid by the insurance company on behalf of the policyholder etc.; c) inform the policyholder that further information is available upon request and indicate the nature of such additional information.

3.5. Online Distribution An EU-insurance company shall ensure that its web-site contains, inter alia, the following items in a clear and visible fashion: (a) the insurance company’s name and registered office in its home Member State; (b) the insurance company’s telephone and telefax numbers and email address; (c) the declaration that the insurance company is duly authorized to operate in Italy and the number of enrolment with the register of insurance companies kept by Ivass. If the information is provided through a website and it is not addressed personally to a client, the following conditions, inter alia, must be met: (i) the use of the website shall be appropriate in consideration of the context of the relation with the client; (ii) the client shall specifically agree with such modalities for the receipt of the

19

information; (iii) the website address and the access point to information within the website shall be clearly indicated.

20

III. ANTI-MONEY LAUNDERING

1. INTRODUCTION Insurance companies operating in Italy under the FOS principle are generally subject to the laws and regulations of their home country and shall only comply with the compulsory rules of Italian law, i.e. those protecting general public interest. Even though the AML Law is not indicated as a regulation of general public interest by Ivass on its website, it should not be fully disregarded. Since anti-money laundering is a very sensitive and important matter with a long history it seems advisable for insurance companies operating under the FOS principle to at least comply with the very basic provisions of the AML Law.

2. CUSTOMER DUE DILIGENCE OBLIGATIONS

2.1. Conduction of Customer Due Diligence

A customer due diligence has to be performed in case a continuous relationship is established, in case of a transaction whose value is equal to or higher than € 15.000, if there is a suspicion of money laundering or terrorist financing as well as if there are doubts about the veracity or adequacy of customer identification data obtained previously.

2.2. Required Activities The customer and beneficial owner have to be identified. If a continuous relationship is established, information about its purpose and intended nature has to be obtained and the relationship has to be monitored.

21

2.3. Identification of Natural Person If the natural person is present, identification and verification shall be performed on the basis of valid identity documents. Should the natural person be absent, identification and verification shall be performed on the basis of additional documents, data or information and by adopting supplementary measures. Also, it shall be ensured that the first payment relating to the transaction is made through an account in the customer’s name with a credit institution. 2.4. Identification of Company The company’s identity shall be verified through e.g., an excerpt from the companies’ register. Information necessary to identify and verify the identity of the company’s representative(s) with

signatory powers shall be verified as well as the existence of such powers. 2.5. Identification of Beneficial Owner

The beneficial owner’s identification shall be verified at the same time as the customer’s identification. Adequate measures shall be adopted in order to have knowledge of the control structure. 2.6. Simplified Customer Due Diligence It is not necessary to conduct customer due diligence activities, with the exclusion of reporting suspicious activities, inter alia, if the customer is subject to the obligations imposed by the AML Law.

22

3. REPORTING OBLIGATIONS Suspicious transactions suggesting that money laundering or terrorist financing is being or has been carried out or attempted must be reported to the Financial Intelligence Unit. Suspicion may arise from the characteristics, size or nature of the transaction or from any other circumstance ascertained as a result of the activities performed and taking into account the economic capacity and the activity the interested person is engaged in. 4. TRAINING AND SANCTIONS Measures for an adequate training of staff and collaborators should be adopted to ensure the correct application of the AML Law.

The AML Law provides for sanctions which may vary from fines (from a minimum of € 100 up to € 500.000 or more when the fine is equal to a percentage of the sum transferred) to imprisonment.

23

IV. DATA PRIVACY

1. INTRODUCTION It seems advisable to apply at least the basic rules of the Italian Data Privacy Code (“IDPC”) to insurance companies operating under the FOS principle, notwithstanding the applicability of the “home country principle”. The competent authority in charge for verifying compliance with data privacy regulations is the Data Protection Authority (“Garante per la Protezione dei Dati Personali”). 2. PROCESSING OF PERSONAL DATA “Personal data” is any information, including a personal identification number, through which a natural person can be identified, even indirectly.

Information referring to legal entities, bodies or associations is not covered. Protection includes all operations, carried out with or without the help of electronic or automated means, concerning the collection, recording, organization, keeping, interrogation, elaboration, modification, selection, retrieval, comparison, utilization, interconnection, blocking, communication, dissemination, erasure and destruction of data. 2.1. Consent of Data Subject As a general rule, the consent of the data subject is required to process his/her personal data. The consent shall be deemed effective only if, inter alia, it is given freely and documented in writing with regard to a clearly identified processing operation.

24

However, consent is not required while performing standard business activities, i.e. the performance of a contract to which the data subject is party or the fulfilment of specific requests by the data subject prior to entering into a contract. Also, the consent of the data subject is not required for personal data processing necessary for the execution of an insurance contract. 2.2. Processing of Sensitive Data When processing sensitive data further activities are required. “Sensitive data” is defined as personal data allowing the disclosure of racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, philosophical, political or trade-unionist

nature as well as personal data disclosing health and sex life. If data processing regards sensitive data, the consent of the data subject shall be in writing. Exceptions from that principle are only made in the presence of prevailing interests. Also, the Data Protection Authority’s prior authorization is required. However, the Data Protection Authority may issue a general authorization for specific activities or categories of business allowing the processing of sensitive data, except for data disclosing sex life.

25

2.3. Data Subject’s Rights The data subject is entitled, inter alia, to:

- request to transform the data into an anonymous form, update, supplement and delete his/her personal data;

- object, on legitimate grounds, to the processing of his/her personal data;

- object to the processing of personal data where processing is carried out for marketing or commercial purposes.

2.4. Information Obligation before Processing Personal Data The person has to be informed in advance, in writing or verbally, that his/her data will be processed. The notice shall contain, inter alia:

- the purposes and modalities of the data processing;

- the obligatory or voluntary nature of providing the requested data;

- the consequences if data is not provided; - the entities to which the data may be

communicated, or that receive the data in their capacity as data processors and the scope of the dissemination of the said data;

- the rights as per Article 7 IDPC; - the identification of the data controller.

2.5. Notification of Data Protection Authority Data controllers are required to notify the Data Protection Authority when processing higher-risk categories of data. These include genetic and biometric data, data processed for the purpose of analysing or profiling individuals as well as credit-related information.

26

For more information please contact us: Giovanna Aucone Partner and Head of the Insurance Department E.: aucone@pglegal.it OFFICES Milan Rome Via Sant’Andrea, 3 Via Lisbona, 11 20121 Milan 00198 Rome T. +39 02 76013359 T. +39 06 884 1535 F. +39 02 760 27478 F. +39 06 884 2094 Please follow us on Twitter│Facebook│Linkedin