Through Resolution SS.SG. No. 231 dated October 29, 2025 (the \u201cResolution\u201d), the Superintendency of Insurance updated the regulatory framework applicable to the issuance of insurance policies and other insurance coverage instruments in electronic format, abolishing Resolution SS.SG. No. 136\/2018.<\/p>\n\n\n\n
This measure forms part of the ongoing digital transformation process within the insurance sector and the implementation of Law No. 6822\/2021, which regulates trust services for electronic transactions and recognizes the legal validity of the qualified electronic signature, equating it to a handwritten signature.<\/p>\n\n\n\n
As of the Resolution\u2019s effective date, no new policies may be issued using facsimile signatures, which will be replaced by secure digital mechanisms. In other words, electronic policies must be signed using a qualified electronic signature by the authorized representatives of the insurance company. <\/p>\n\n\n\n
The Resolution sets forth the minimum conditions that insurance companies must comply with to issue policies in electronic format. Insurers that have not yet been authorized to do so must notify the Superintendency at least 10 business days in advance of their decision to issue electronic policies, submitting the list of authorized signatories, the qualified electronic signature certificates, and the report issued by the information technology department.<\/p>\n\n\n\n
Policyholders must indicate in the insurance proposal the electronic means through which they wish to receive the policy. Should a printed copy be requested, it must include a secure verification code allowing for the authentication of the digital document.<\/p>\n\n\n\n
Insurers must implement systems that enable the verification of the existence and validity of electronic policies, such as QR codes, tools for validating qualified electronic signature certificates, or accessible online consultation platforms.<\/p>\n\n\n\n
The Resolution further requires insurers to maintain adequate technological infrastructure, cybersecurity measures, data backup and recovery procedures, and to conduct periodic assessments of technological risks.<\/p>\n\n\n\n