Customer Due Diligence Framework

Purpose and scope

1. This framework sets out the customer due diligence (CDD) measures TEGO Platform Ltd (“TEGO”) applies as a reporting person under the Financial Intelligence and Anti-Money Laundering Act 2002 (“FIAMLA”).
2. It applies to every customer who applies for general insurance through TEGO’s online platform, whether a natural person or a legal person, and to any person acting on a customer’s behalf or paying the premium.
3. TEGO sells exclusively online. Every relationship is therefore treated as non-face-to-face, and identity is verified electronically for every customer, without exception.
4. No application, document or payment confirmation is submitted to a partner insurer until CDD is complete and the file has been cleared under section 8.

Legal and regulatory basis

Governance

1. The Board of TEGO approves this framework before it takes effect, and reviews it at least once a year or whenever the law, the FSC’s guidance or TEGO’s business materially changes.
2. Staff with access to customer files receive AML/CFT training on joining and at least annually, with attendance recorded.
3. The operation of this framework is subject to periodic independent review, and the findings are reported to the Board.

Risk-based approach

TEGO assesses money laundering and terrorist financing risk at business level and for each customer, following the risk-based approach in Chapter 4 of the FSC AML/CFT Handbook.

Inherent risk of the business

• Product. Motor and other general insurance, with no investment element, no cash value and no surrender value.
• Channel. Online and non-face-to-face, mitigated by electronic identity verification with liveness detection for every customer.
• Payment. Card or bank payment only. TEGO does not accept cash. Premium refunds are made only to the account that paid.
• Geography. Customers resident in Mauritius, insuring risks located in Mauritius.

Customer risk rating

Each customer is rated when CDD is performed, and re-rated whenever new information changes the picture.

Identification and verification

Natural persons

1. TEGO collects the customer’s full name, date of birth, nationality, National Identity Card or passport number, residential address, email address and mobile number.
2. Identity is verified electronically, using a reliable and independent verification service, through the following checks, all of which must pass:
   • Document authenticity. The identity document is captured and examined for template, security features, fonts, data consistency, the machine-readable zone where present, and signs of alteration.
   • Liveness. A live image of the customer is captured and tested for presentation attacks, including printed photographs, screen replays, masks and synthetic images.
   • Face match. The live image is compared one-to-one with the photograph on the identity document.
   • Data match. Name and date of birth extracted from the document are compared with the details the customer entered.
   • Device and network. The session is checked for indicators of fraud, such as anonymising networks or repeated attempts from one device.
3. The name of the account holder that pays the premium is compared with the verified customer. Where they differ, the payer is identified and verified as a person acting on the customer’s behalf, and the file is rated at least medium.
4. The vehicle registration document and driving licence are compared with the verified identity and with the details given in the application.

Legal persons

1. TEGO obtains the certificate of incorporation and business registration number, verifies the company’s registration, and identifies its directors and beneficial owners.
2. The individual applying on the company’s behalf is verified under clause 5.2, and their authority to act for the company is confirmed.
3. Beneficial owners are identified and reasonable measures are taken to verify their identity, using information obtained from a reliable source.

Timing

Enhanced due diligence

Enhanced due diligence (EDD) applies to every customer rated higher under section 4. The file is held and does not reach an insurer until TEGO has reviewed and cleared it.

Triggers

• A confirmed or possible match against sanctions lists, or identification as a politically exposed person (PEP), a family member or a close associate
• A verification check that failed, or passed only after repeated attempts
• A premium paid by a third party whose connection to the customer is unclear
• A discrepancy between documents and application that the customer cannot explain
• A non-resident customer, or a link to a jurisdiction identified as high risk
• A premium above the threshold set by TEGO or required by the partner insurer

Measures

• Additional documentary evidence of identity and residential address
• Information on the source of funds used to pay the premium
• Senior management approval before a relationship with a PEP is accepted
• A written record of the review, the evidence considered and the reason for the decision

Screening and monitoring

1. Every customer, and every identified payer, director and beneficial owner, is screened at onboarding against applicable sanctions lists, including United Nations Security Council sanctions, and against PEP data.
2. Verified customers remain under ongoing screening for the duration of the policy, so that a later designation is detected without waiting for renewal.
3. Possible matches are resolved by TEGO against the customer’s verified identity before any further action. A false positive is documented; a true match is handled under sections 6 and 8.
4. CDD is refreshed at renewal, when the customer’s details change, and whenever TEGO has doubts about the accuracy of information previously obtained.
5. Mid-term cancellations, refund requests and changes of payer are monitored for patterns inconsistent with the customer’s profile.

Outcomes and reporting

Reliance by partner insurers

1. A partner insurer may rely on TEGO to perform CDD under section 17D of FIAMLA and regulation 21 of the FIAML Regulations 2018. Under section 17D, the insurer remains responsible for its own compliance.
2. Reliance is governed by a written agreement with each insurer before the first application is submitted. The agreement records the CDD standard applied, the insurer’s own EDD triggers and thresholds, and the arrangements below.
3. With every submitted application, TEGO provides the CDD information immediately: the verified identity details, the result of each check and the risk rating.
4. Copies of identification data and supporting documents are made available to the insurer on request and without delay, for the full record-keeping period.
5. TEGO is regulated and supervised by the FSC for AML/CFT purposes, and permits each insurer to test and audit the procedures in this framework.

The verification report

Each submitted application carries a report containing:

• Verified identity details and the identity document type and number
• The result, date and time of each check in clause 5.2, and of screening
• The payer-name comparison and the document cross-checks
• The customer risk rating and, where EDD applied, the review notes and decision
• A reference that retrieves the underlying evidence: document images and the live image

Verification provider

1. The electronic checks in clause 5.2 and the screening in section 7 are performed by an independent identity verification service provider, Didit, acting as a processor on TEGO’s instructions. The decision to accept a customer remains TEGO’s.
2. Before go-live, and at least annually, TEGO performs due diligence on the provider covering information security certifications, where data is processed and stored, sub-processors, and presentation-attack detection standards.
3. Before go-live, TEGO confirms in writing that the provider supports the Mauritian National Identity Card, and tests it on genuine documents.
4. TEGO retains its own copy of every verification result and its evidence. The provider is not relied upon as the record keeper, so records remain complete and available if the provider changes.
5. Verification outcomes, including pass, referral and false-rejection rates, are monitored monthly by TEGO. An alternative provider is identified so the service can be moved without interrupting CDD.

Record keeping

In accordance with section 17F of FIAMLA, TEGO keeps:

Records are retrievable without delay for the FSC, the FIU and relying insurers. When the retention period ends, records are deleted unless a legal hold applies.

Data protection

1. Personal data collected under this framework is processed to meet TEGO’s legal obligations under FIAMLA, and in accordance with the Data Protection Act 2017. Customers are told what is collected, why, and for how long, before verification begins.
2. Identity document images and live facial images are treated as sensitive data. A data protection impact assessment is completed before processing begins.
3. Data is encrypted in transit and at rest. Access is limited by role to staff who need it, and every view, download and deletion is logged.
4. Only the data this framework requires is collected. Verification evidence is used for CDD and for no other purpose.
5. Processing by the verification provider is governed by a written processor agreement, including safeguards for any transfer of personal data outside Mauritius.
6. Personal data breaches are handled under TEGO’s incident procedure, including notification to the Data Protection Commissioner as the Act requires.