BMA Code Readiness: The Cross-Domain Diagnostic
Five weeks. One evidenced answer for your board across the BMA's cyber and operational resilience codes, Bermuda's privacy law (PIPA) and the BMA's AI governance consultation.
See what you get. Ask for the sample report for a fictional Class 3A carrier: adam@garrison.re
Every regime is rated on its own terms
About 130 test points, drawn from the BMA's own codes, guidance notes and return templates. A code in force, a code that binds in 2028 and a consultation are not the same thing, so they are not rated on the same scale.
Exhibit 1. Four regulatory areas, three rating scales
Every item is reviewed at design level; about 30 anchor items are also tested for operation on a sample, and the report says which is which. Source: Garrison methodology; BMA codes, guidance notes and return templates.
The filing return is checked before a supervisor asks
The BMA has said its 2026 cyber supervision runs through filing return analysis and on-site reviews. Insurers, insurance managers, brokers and agents all answer the same 49 questions in their annual return. We trace each yes to the document or tool behind it. A yes with nothing behind it is reported as a finding, because it is a statement already made to the BMA.
Five questions to ask before your next return is signed
- For every yes in the cyber section, can we name the document or tool that proves it? 1.
- When did we last test recovery of the systems we need to pay claims, not just email? 2.
- Do we hold our insurance manager's current Manager Code confirmation, and has the board seen it? 3.
- Who decides whether a cyber event has significant adverse impact, and could they reach the BMA within 72 hours? 4.
- Where does our policyholders' personal information go outside Bermuda, and what protection have we relied on? 5.
If any answer is "not sure", that is where the diagnostic starts.
The outsourcing rules already apply today
Until the operational resilience code binds in 2028, outsourcing is governed by the Insurance Code of Conduct, the Insurance Manager Code of Conduct and the Insurance Brokers and Insurance Agents Code of Conduct. Every insurer, captives included, must obtain its insurance manager's confirmation that the manager complies with the Manager Code (Insurance Code of Conduct ¶33), and outsourcing contracts must cover legal compliance, cooperation with the BMA and timely access to information (¶78).
We rate these as compliance today, not 2028 readiness. For an insurance manager, that confirmation is something every client's board has to ask for.
Five weeks, with your team's time stated up front
Exhibit 2. How the five weeks run
Your compliance officer spends 4 to 6 days across the five weeks, your IT lead 3 to 4 days, and other interviewees about half a day. Class 4 and group-owned carriers run seven to eight weeks.
Scoped to the firm in front of us
Exhibit 3. What changes by firm type
Banks start fifteen months earlier
Banks and deposit companies come under the BMA's Operational Resilience and Outsourcing Code on 1 January 2027. The same method applies, scoped to the bank: important business services and their impact tolerances; the people, systems, data and suppliers behind each one; scenario tests; exit plans for critical suppliers, including services drawn from the group; and the monitoring behind the 24-hour notice when a service goes outside tolerance.
The output is an independent read of the board's first annual self-assessment, with the evidence behind each answer, ahead of the BMA's first request for it. Trust companies and investment businesses, under the cyber code since February 2023, follow on the same method.
Ask for the one-page brief for your firm type, for carriers, insurance managers, brokers and agents, banks and trust companies, digital asset businesses or administrators: adam@garrison.re
Four deliverables, one of which you keep using to 2028
- Document quality assessment: what exists, what is missing, and what cannot yet be assessed. 1.
- Compliance posture report: a summary for the board, ratings by regime, every finding with its requirement, evidence, impact and recommendation, and the filing-return reconciliation. 2.
- Remediation roadmap: actions in order, with owners, dates and indicative external cost. 3.
- Cross-domain evidence map: an editable workbook with every item, its rating, the evidence behind it and who reviewed it, kept by your team for the 2028 self-assessment. 4.
The protections are written into the engagement letter
- Second review. Every adverse rating is checked by a named reviewer who takes no part in the fieldwork.
- Notifiable events. Anything we see that may need notifying goes in writing, the same day, to your compliance officer and General Counsel. The decision is yours; we never contact a regulator for you.
- Confidentiality. Your data stays in your systems or our encrypted store, never in public AI tools, and is deleted within 30 days of completion.
- Privilege. The engagement can run through your counsel. Our findings are not legal advice.
- Conflicts. No work for a direct competitor in your class and lines for 24 months without your consent.
- We do not mark our own work. If we later help fix what we found, re-testing is done by your internal audit or an independent party.
Optional modules
Technical testing: an accredited tester you contract directly, which we scope, oversee and map to your filing return. AI governance, until the BMA issues final guidance.
The person who scopes it does the work
Adam Wenham leads every diagnostic personally: the interviews, the ratings and the report. He led technology transformation and operational resilience at the Bank of England, working to the UK framework the BMA's operational resilience code shares its foundations with. He spent seventeen years at Credit Suisse and led technology modernisation at StoneX, including the technology side of mergers and acquisitions at both. He is based in Hamilton.
A named second reviewer, who takes no part in the fieldwork, checks every adverse rating, and a contract cyber specialist reviews the cyber anchor items. Both are named, with CVs and conflicts declarations, in the engagement letter.
The questions boards ask before they commission it
- "Our external auditor already covers this." Your auditor tests controls for the financial statements. It does not rate you against the Cyber Code, PIPA or the operational resilience code, or check your filing return. We are not your auditor, so there is no conflict with its work.
- "Our insurance manager handles it." The manager runs the services; your board stays responsible for overseeing them, and must obtain the manager's Manager Code confirmation. We test your oversight, using the manager's assurance pack, not the manager itself.
- "We are group-owned and use the group framework." We map your group framework to the BMA codes rather than replace it, and show the evidence works in Bermuda.
- "Operational resilience is not until 2028." Cyber, PIPA and the outsourcing rules apply today. For 2028, mapping, tolerances and testing take most firms 12 to 18 months, so the working deadline is 2027.
- "What does it cost?" A fixed fee, set at scoping from your class, services and providers, and quoted within five working days. No day rates or expenses, and the fee is credited in full against remediation if you go ahead.
Why one assessment across all four
One outsourcing agreement with an insurance manager is an operational resilience dependency, a Cyber Code third-party risk and a PIPA processor relationship at the same time. Assessed separately, the gaps between them stay invisible; read together, one fix closes several.
Read the analysis. Three regimes, one consultation, one deadline: garrison.re/crossdomain
A 45-minute scoping call, then a fixed fee within five working days: adam@garrison.re
Garrison · Hamilton, Bermuda · adam@garrison.re