Handing insurance work to an outside team isn’t the hard part. Certificate requests, billing questions and claims intake move to an insurance BPO every day, and the technology behind it is rarely what goes wrong.
It goes wrong at two points. The first is on a call, when an outsourced agent answers a question that state law reserves for a licensed person. The second is in a conference room, when your carrier’s compliance team opens the vendor file and asks for evidence nobody prepared.
In September 2026 we read nine of the leading Google results for this term, searching from the US in English. All nine describe services. None says what a vendor-risk reviewer will ask for, and only one mentions that some of the work needs a license. This guide covers both lines.
What is insurance BPO?
Insurance BPO (business process outsourcing) is the practice of handing defined insurance operations — claims intake, policy servicing, underwriting support, document processing and customer contact — to a third-party provider that runs them under your rules. Carriers, MGAs, agencies and brokers all use it, and each hands over something different.
| Who’s outsourcing | Work usually handed over | Where the licensing line tends to fall | Who reviews the vendor |
|---|---|---|---|
| Carriers | Claims processing, policy administration, first notice of loss intake | Coverage decisions on claims | Third-party risk and security teams |
| MGAs | Policy servicing, renewals | Quoting, binding, recommendations | Your team, plus the carrier whose paper you write |
| Independent agencies | Service calls, billing questions | Anything that describes coverage | Usually the principal |
| Brokers | Paperwork chasing, data entry | Advice and product comparison | Your clients’ procurement teams |
What gets outsourced, and which side of the line it sits on
One process family often holds tasks on both sides of the licensing line, which service menus leave out.
The table uses Florida’s statute, covered below, as its reference. Other states draw the line differently, so read the last column as a question for your compliance team.
| Process | Typical outsourced tasks | Needs a license? (Florida reference) |
|---|---|---|
| Claims processing | First notice of loss intake, status updates | Intake and status: generally no. Coverage decisions: adjuster work |
| Policy administration | Endorsement entry, cancellations, reinstatements | Generally no, if nobody interprets the policy |
| Policy servicing | Certificate of insurance requests, ID cards, address changes | Generally no |
| Underwriting support | Loss runs, inspection scheduling | Gathering: no. Completing the application: listed as solicitation |
| Renewals | Reminders, missing-paperwork follow-up | Reminders: no. Recommending a product: yes |
| Document processing | Indexing, data extraction, mailroom | No |
The same holds in property and casualty and in life lines.
The licensing line is written into statute, and it breaks on the call
What the statute actually says
Florida’s insurance code spells the line out. Section 626.112(1)(b) requires a license as an agent, service representative, customer representative or limited customer representative “in order to engage in the solicitation of insurance” (Florida Statutes, 2026). Solicitation means trying to persuade someone to buy an insurance product by, among other things:
- Describing the benefits or terms of insurance coverage, including premiums or rates of return
- Distributing an invitation to contract to prospective purchasers
- Making general or specific recommendations as to insurance products
- Completing orders or applications for insurance products
- Comparing insurance products, advising as to insurance matters, or interpreting policies or coverages
Subsection (3) adds that no one may act as an adjuster for a class of business they aren’t licensed and appointed for. California’s Insurance Code §1631 is shorter and just as firm: a person “shall not solicit, negotiate, or effect contracts of insurance” without a valid license from the commissioner.
Other states word this differently, with their own exceptions. This is an operator’s reading, not legal advice; check the rules in every state your contacts come from.
Which contacts sit on which side
Most contacts fall cleanly on one side. Decide the rest before launch, not mid-call.
| The caller says | Side of the line | What the agent does |
|---|---|---|
| ”Can you send a certificate of insurance to my landlord?” | Service | Handles it |
| ”Someone rear-ended me an hour ago.” | Intake is service; the coverage call isn’t | Takes the facts, says a licensed adjuster reviews coverage |
| ”When will my claim payment arrive?” | Service | Gives status from the record |
| ”Am I covered if my basement floods?” | Interpreting coverage | Transfers to a licensed person |
| ”Should I raise my deductible at renewal?” | A recommendation | Transfers to a licensed person |
| ”Can you fill in the application for me?” | Completing an application | Transfers to a licensed person |
| ”Why did my premium go up?” | Gray zone: explaining terms can count as describing coverage | Treat as licensed until counsel says otherwise |
Train one written transfer sentence. “That’s one for our licensed team, and I’m putting you through now” costs nothing; “I can’t answer that” costs customer satisfaction.
Where the line actually breaks
The contract is clean. The call isn’t.
At renewal, a policyholder asks whether the higher deductible is a good idea. At the roadside, a claimant asks whether they’re covered. A helpful agent answers both: the first answer is a product recommendation on Florida’s list, the second a coverage call that belongs to a licensed adjuster.
That drift happens on a small share of calls. A review sample of a few calls per agent a month will rarely land on one. What works is reviewing every conversation against a rubric that flags coverage language — “you’re covered,” “that should be fine,” “I’d go with” — and routing each hit to someone who can act. Our guide to call center quality assurance software explains why sampling misses rare, repeated errors. The same rule applies to automation: an AI voice agent explaining a policy exclusion is still explaining a policy exclusion.
For the agency-side version, see our answering service for insurance agencies.
The vendor file your carrier’s compliance team will ask for
New York’s cybersecurity regulation for financial services, 23 NYCRR Part 500, applies to anyone operating under a license or similar authorization under New York’s Banking Law, Insurance Law or Financial Services Law. That takes in insurers, agencies and brokers licensed there. Section 500.11, last amended in November 2023 (New York Department of Financial Services, 2023), requires them to keep written policies for third-party service providers: unaffiliated companies whose services give them access to nonpublic information. A BPO answering your policyholders fits that definition.
The obligation sits with the regulated business, not the BPO, so the evidence has to be something you can file.
| What §500.11 says your policy must address | Evidence to ask the BPO for | What a thin answer sounds like |
|---|---|---|
| (a)(1) Identifying and assessing the provider’s risk | Which of your systems agents touch, and what nonpublic information they see | ”Our agents only use your systems” |
| (a)(2) Minimum cybersecurity practices | The written policy set, with its last review date | A marketing page |
| (a)(3) Due diligence on those practices | A completed questionnaire, plus the right to verify on site | ”We’re certified,” with no report or entity named |
| (a)(4) Periodic reassessment | A reassessment cadence and notice of material changes | Silence after signature |
| (b)(1) Access controls, including multi-factor authentication | MFA on every agent login, unique accounts | Shared logins on a busy floor |
| (b)(2) Encryption in transit and at rest | Named algorithms and protocol versions | ”Bank-grade encryption” |
| (b)(3) Notice of a cybersecurity event | A notification clause with a defined window | ”We’ll tell you right away” |
| (b)(4) Representations and warranties on security policies | Contract language | Nothing in the contract |
Four more questions come up in nearly every review:
- Recording retention: can you set how long calls are kept, to match your own schedule?
- Location: where does the data live, and where do agents sit? Offshore delivery can be sound, but the answer belongs in the file.
- Liability: does the provider carry errors-and-omissions coverage, and will it show proof?
- Audit reports: if a vendor mentions SOC 2, ask whether it’s Type I or Type II and which legal entity it covers.
If you’ve outsourced in healthcare, this file does the job the business associate agreement does there, as our healthcare call center outsourcing guide covers.
How to compare insurance BPO companies
Most provider lists rank by size, which says nothing about which side of the licensing line a provider is built for. Sort by that first.
| Provider type | Typically built for | Licensed staff | Usual pricing |
|---|---|---|---|
| Large IT and BPO firms | Policy administration platforms and claims management run as managed services | Often, for specific lines | Multi-year contracts |
| Licensing and compliance specialists | Producer onboarding, license renewals, appointments | Compliance staff, not front-line agents | Per producer or transaction |
| Licensed agency-style providers | Quoting, binding, licensed service calls | Yes, which is why you’d hire them | Per hour or per policy |
| Contact center outsourcers | Inbound service, intake, billing | Ask directly | Per hour, minute or seat |
| AI voice and answering services | After-hours intake, simple status | No | Per minute or monthly |
Where Callnovo.ai fits
Callnovo.ai is a contact center outsourcer working in 65+ languages (human agents), and in insurance we’re built for the service side of the line. Our agents handle certificate requests, billing questions, first notice of loss intake and claim status. Anything that describes coverage, recommends a product or completes an application goes to your licensed staff, using the transfer sentence you approve.
Against the vendor file above:
- Access: multi-factor authentication is enforced, every agent has a unique account, and access follows a formal joiner, mover and leaver process.
- Encryption: TLS 1.2 or higher in transit, AES-256 at rest, SRTP for voice.
- Records: tamper-evident audit logs kept for 2 years; call recordings kept 90 days by default, configurable from 30 days to 7 years.
- Location: data resides in the US by default. No personal devices on the floor, 24/7 CCTV, and on-site audits are welcome.
- Liability: US$2M in errors-and-omissions coverage — here’s why we show clients that policy.
- Review: automated QA reviews 100% of the conversations handled on our HeroDash platform, using a rubric that can flag coverage language. Work that moves off the platform, including some human-handled escalations, isn’t covered by that review.
- Frameworks: our program is aligned with ISO 27001 and SOC 2 framework practices.
We don’t publish a standard breach-notification window; write yours into every shortlisted vendor’s contract, ours included.
Rates are public: AI voice at US$0.15 a minute, chat at US$0.15 a session, a shared team from US$650 a month with 1,500 minutes, dedicated agents from US$5.80 an hour. Accounts start at half a seat and scale to 200+. See our published pricing. For a dedicated team, agents are typically live in 5 days, with system integration planned separately. The wider model is on our BPO outsourcing page.
Two reasons to hire someone else
- Most of the work is quoting and binding. Hire a provider built around licensed producers. We’re built around the service side and the handoff.
- You need claims decided, not just taken in. A provider that employs licensed adjusters will serve you better than one that routes to yours.
10 questions before you sign
Five questions test the licensing line, five test the vendor file.
- Which contacts are your agents trained to transfer to a licensed person? If the answer is “anything complicated,” nobody has mapped the line.
- What exactly do agents say when they transfer? If there’s no written sentence, every agent improvises one.
- How do you catch coverage language on service calls? If the answer is a monthly sample, most of it goes unseen.
- Which states’ rules did you use to draw the line? One state for a national book of business leaves gaps.
- Do your bots follow the same transfer rules as your agents? If automation has its own script, it has its own line.
- Which of our systems will your agents touch, and what nonpublic information will they see?
- Will you enforce MFA on every agent login and name your encryption standards?
- What cybersecurity-event notification window will you put in the contract?
- How long are recordings and audit logs kept, and can we set the recording period?
- Which audit reports or certifications do you hold, and which legal entity do they cover?
A provider that answers all ten without a follow-up meeting has run insurance BPO programs before. One that can’t is learning on your customer experience.
References
- Florida Statutes §626.112 (2026), License and appointment required — subsections (1)(b) and (3). http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0600-0699/0626/Sections/0626.112.html
- California Insurance Code §1631. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=INS§ionNum=1631
- N.Y. Comp. Codes R. & Regs. tit. 23, §500.1 and §500.11, Third party service provider security policy — adopted March 1, 2017; amended November 1, 2023. https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.11
- Callnovo public pricing, 2026. https://callnovo.ai/pricing/