Nimbus Direct Insurance Business Plan › Section 10 › Regulatory & Compliance Strategy

10.1 South African Regulatory Framework

South Africa operates a Twin Peaks financial regulation model
implemented under the Financial Sector Regulation Act 9 of 2017.
Nimbus’s South African operations will be supervised by two principal
authorities:

• Prudential Authority (PA) — operating within the
  administration of the South African Reserve Bank, the PA supervises the
  financial soundness of insurers under the Insurance Act 18 of 2017 and
  prescribes the Solvency Assessment and Management (SAM) regulatory
  regime, which has been in effect since 1 January 2018.
• Financial Sector Conduct Authority (FSCA) —
  successor body to the Financial Services Board, the FSCA supervises
  market conduct, treating-customers-fairly outcomes, and intermediary
  conduct under the Conduct of Financial Institutions framework.

Insurance Licensing

Nimbus Insurance Company (Pty) Ltd will apply to the Prudential
Authority for a non-life insurance licence under Section 23 of the
Insurance Act 18 of 2017. The licence application will be submitted in
two phases:

1. Phase A submission (Months 0–3): preliminary engagement and
   prudential pre-application meetings with the PA Insurance Supervision
   Division.
2. Phase B submission (Months 3–9): formal application including the
   Business Plan, three-year Own Risk and Solvency Assessment (ORSA),
   governance framework, capital plan, fit-and-proper assessments of key
   persons, and detailed risk management framework.
3. Licence grant (Months 9–12): expected timeline based on recent
   precedent for new entrants of similar complexity.

SAM Solvency Framework

Under SAM, Nimbus must hold capital equal to or in excess of the
Solvency Capital Requirement (SCR), calculated on a 1-in-200-year,
1-year value-at-risk basis using either the Standard Formula or an
approved Internal Model. Nimbus will adopt the Standard Formula from Day
1, with Internal Model development commencing in Year 3. Coverage of the
SCR by Tier 1 own funds is targeted at not less than 150% at all times —
well above the 100% regulatory minimum — providing meaningful buffer
against adverse experience.

Figure 10.1

10.2 Botswana Regulatory Framework

Nimbus’s Botswana subsidiary will be supervised by the Non-Bank
Financial Institutions Regulatory Authority (NBFIRA) under the Insurance
Industry Act, 2015 and its supporting regulations. NBFIRA’s prudential
regime is broadly aligned with IAIS Insurance Core Principles, though
with a less granular capital standard than SAM. Nimbus will, however,
voluntarily adopt SAM-equivalent capital management at the Group level
to provide a single, consistent risk and capital framework across both
operating subsidiaries.

10.3 Other Material Regulations

• Protection of Personal Information Act (POPIA),
  2013 — full compliance from Day 1; appointed Information
  Officer; data-minimisation, lawful-processing, and breach-notification
  frameworks embedded in operating policies.
• Financial Intelligence Centre Act (FICA), 2001 (amended
  2017) — AML, CFT and customer-due-diligence controls aligned
  with FATF recommendations and FIC supervisory expectations.
• Companies Act 71 of 2008 — King IV Corporate
  Governance principles fully applied on an apply-and-explain basis;
  B-BBEE Codes of Good Practice with a target Level 4 rating by Year
  3.
• Insurance Sector Code (Financial Sector Charter)
  — meaningful contribution to transformation targets including ownership,
  management control, skills development, enterprise and supplier
  development.
• Forthcoming CoFI Bill — Nimbus will monitor the
  Conduct of Financial Institutions Bill and design conduct policies in
  anticipation of commencement, expected in 2026–2027.

10.4 Compliance Operating Model

Compliance and risk are integrated under the office of the Chief Risk
& Compliance Officer (CRCO), with three lines of defence:

• First line — business-unit ownership of risk and
  compliance; embedded business risk and compliance officers in
  underwriting, claims, finance, marketing and technology.
• Second line — independent Compliance Function,
  Risk Management Function, and Actuarial Function reporting to the CRCO;
  Compliance Officer registered with the FSCA.
• Third line — Internal Audit Function reporting
  directly to the Board Audit & Risk Committee; co-sourced model for
  the first three years to leverage external specialist capacity
  (preferred provider: KPMG Internal Audit Services).

Confidential — this business plan is provided to prospective investors and lenders for evaluation purposes only and may not be reproduced or distributed without the written consent of Nimbus Direct Insurance Group (Pty) Ltd.