THE Insurance and Pensions Commission (IPEC) has ordered every insurer, pension fund, broker and medical aid society to build tested plans that can withstand cyberattacks, floods, blackouts and market shocks.
Full compliance is required by mid-2027.
IPEC issued its Guidelines on Business Continuity, Disaster Recovery and Contingency Planning on November 5 under Circular 45 of 2026. They cover life assurers, short-term insurers, microinsurers, funeral assurers, reinsurers, brokers, pension funds, administrators and medical aid funds.
They take effect on January 1, with a transition period to June 30, 2027.
IPEC Commissioner Dr Grace Muradzikwa said the arrangements are meant to “ensure the continuity of critical business operations and services” while safeguarding policyholders, members and beneficiaries.
According to IPEC, companies must map their critical functions, such as claims payment, pension payroll and treatment pre-authorisation. For each, they must set maximum tolerable downtime and data-recovery targets and keep backup facilities geographically separate from primary sites.
Plans must be tested at least once a year, with results reported to the board. An independent review is required at least every two years. Entities must keep four documented policies: business continuity, disaster recovery, crisis communication and third-party resilience. The guidelines also set tight reporting clocks. Policyholders must be told of a material disruption within 24 hours, while IPEC must be notified promptly.
A full post-incident report is due within 14 working days of activating a plan. Senior management must file quarterly updates to IPEC as evidence of preparedness.
Boards must approve the framework and fund it. The guidelines state that “Protecting policyholders, members and beneficiaries during disruptions is a core obligation.”
Firms must publish grace-period and lapse-protection policies for declared emergencies and keep benefit payments flowing. Medical aid societies must keep pre-authorisation running and apply enhanced safeguards to members’ health data. The rules also target outsourcing. The guidelines warn that “Outsourcing a function does not relieve a regulated entity of responsibility for its continuity.”
Asset managers, fund administrators, claims administrators and cloud providers are explicitly in scope.
Contracts must carry continuity requirements, audit rights and incident-notification duties and firms must keep a third-party risk register and manage concentration risk. Cloud backups holding Zimbabwean data must comply with the Cyber and Data Protection Act. The guidelines arrive in a sector that has already survived one of the worst monetary collapses on record.
Hyperinflation in 2008 wiped out the real value of life policies and retirement savings and the Zimbabwean dollar was effectively demonetised when the country adopted a multi-currency system in 2009. Many pre-2009 policyholders and pensioners lost value.
More turbulence followed. The country moved from the 2009 multi-currency regime through bond notes, the RTGS dollar and a reintroduced Zimbabwe dollar to ZiG in April 2024, and a governance body says these shifts have fuelled valuation uncertainty in insurance.
The Zimbabwe Association of Pension Funds has said that the National Development Strategy acknowledges that the 2009 and 2019 currency changes eroded confidence in pensions and that an actuarial estimate puts the cost of compensation at almost the industry’s total net asset value.-herald
