National System of State-Based Insurance Regulation
The backbone of insurance regulation in the United States is the National Association of Insurance Commissioners (NAIC).
The NAIC is the U.S. standard-setting and regulatory support organization created and governed by the chief insurance regulators from:
- All 50 states
- The District of Columbia
- Five U.S. territories
Through the NAIC:
- State insurance regulators develop model laws and regulations
- Best practices and regulatory standards are established
- Peer review and coordination among states occur
- Regulatory oversight is strengthened across state lines
NAIC members, working together with the NAIC’s centralized resources, form the national system of state-based insurance regulation in the United States. While the NAIC does not directly regulate insurers or producers, its models heavily influence state insurance laws, including those adopted in Colorado.
Common Exam Traps
- “The NAIC regulates insurers directly.”
- False. The NAIC does not regulate insurers or producers. States do.
- “The NAIC issues insurance licenses.”
- False. Licensing is handled by individual states.
- “The NAIC is a federal agency.”
- False. It is a state-based organization governed by state insurance regulators.
Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act (GLBA) reshaped the financial services industry by repealing the parts of the Glass-Steagall Act of 1933 that kept commercial banks and securities firms apart.
GLBA:
- Allows consolidation of banks, investment firms, and insurance companies
- Permits financial institutions to engage in multiple lines of business, including insurance
- Establishes a framework that divides regulatory authority between federal and state regulators
From an insurance perspective, GLBA is especially important because it also introduced federal privacy and information security requirements for financial institutions, including insurers and producers.
McCarran-Ferguson Act
The McCarran-Ferguson Act of 1945 formally declared that insurance regulation is the responsibility of the states, not the federal government.
Key impacts of the McCarran-Ferguson Act:
- Confirms state authority to regulate insurance
- Grants insurers a limited exemption from federal antitrust laws, as long as the activity is regulated by state law
- Preserves the state-based regulatory system still in use today
This law explains why insurance producers must comply with individual state insurance codes, including Colorado’s, rather than a single federal insurance regulator.
Fair Credit Reporting Act
The Fair Credit Reporting Act (FCRA, 15 U.S.C. 1681) regulates consumer reporting agencies and the use of consumer reports, such as credit reports, MIB records and investigative reports, including in insurance underwriting.
- When an insurer requests an investigative consumer report, it must disclose that to the consumer within 3 days of the request
- When an insurer takes adverse action based on a consumer report, it must notify the consumer and identify the reporting agency. The consumer then has 60 days to request a free copy of the report and may dispute inaccurate information
Privacy Act of 1974
The federal Privacy Act of 1974 governs how federal agencies handle personal information. It does not apply to private insurers. An insurer’s use of an applicant’s personal information is governed by the FCRA, the Gramm-Leach-Bliley Act and state insurance privacy law.
In states that adopted the NAIC’s Insurance Information and Privacy Protection Model Act, an authorization to collect personal information signed with an application is valid for no more than 30 months for life, health or disability insurance and one year for property or casualty insurance.
Under the same model act, a person told of an adverse underwriting decision may ask in writing, within 90 business days of the notice, for the specific reasons for it, which must be given within 21 business days of the request.
Telemarketing
The National Do Not Call Registry is a list of telephone numbers whose owners do not want to receive telemarketing calls. Telemarketers may not call registered numbers without the person’s permission or an established business relationship, and unsolicited sales calls:
- May be made only between 8 a.m. and 9 p.m. in the recipient’s local time
- Must give the caller’s name, the name of the company the call is made for, and a telephone number or address at which that company can be contacted
CAN-SPAM
A commercial email must:
- Be identified clearly as an advertisement
- Carry accurate header information and a subject line that is not deceptive
- Include the sender’s valid physical postal address
- Offer a way to opt out, and the sender must honor an opt-out within 10 business days