ISNP Insurance Certification: Documents & Application Process

ISNP Insurance Certification: Documents & Application Process. India’s insurance sector has moved far beyond branch offices, physical proposal forms and face-to-face policy sales. Customers today expect to compare, purchase, renew and service insurance policies through websites and mobile applications. But an insurance company or intermediary cannot simply build a website, integrate a payment gateway and start selling regulated insurance products online.
Where an insurer or eligible insurance intermediary wants to establish its own digital platform for selling and servicing insurance products, the Insurance Self-Network Platform (ISNP) framework becomes important.
An ISNP Insurance Certification is an electronic platform established with the permission of the Insurance Regulatory and Development Authority of India (IRDAI) for undertaking permitted insurance e-commerce activities. What is commonly referred to in professional practice as “ISNP certification” therefore involves two interconnected aspects: obtaining IRDAI permission for the platform and ensuring that the technology, information-security controls, operational processes and continuing audits satisfy the prescribed regulatory requirements.
For insurers, insurance brokers, corporate agents and web aggregators planning a digital insurance business, understanding this distinction is essential because ISNP approval does not replace the underlying IRDAI registration required to carry on the relevant insurance activity.
What is an Insurance Self-Network Platform?
The concept of an Insurance Self-Network Platform was formally introduced through the IRDAI Guidelines on Insurance E-Commerce dated 9 March 2017, bearing reference IRDA/INT/GDL/ECM/055/03/2017. These guidelines were issued under Section 34 of the Insurance Act, 1938 read with Section 14 of the Insurance Regulatory and Development Authority Act, 1999.
Under the guidelines, an ISNP means an electronic platform set up by an applicant with the permission of IRDAI. An “applicant” includes a registered insurer, an insurance intermediary or another person recognised by the Authority that wishes to establish an ISNP for selling and servicing insurance products.
In practical terms, an ISNP may operate through a desktop website, a mobile-responsive website, a mobile application or a combination of these digital channels. It is intended to facilitate regulated insurance transactions while ensuring that customers receive proper product information, secure transaction facilities and post-sale services.
Who Can Apply for ISNP Permission?
IRDAI's current ISNP FAQ states that an ISNP may be established by insurers and insurance intermediaries such as insurance brokers, corporate agents and insurance web aggregators. A tied individual insurance agent cannot establish an independent ISNP and instead has to use the relevant insurer's platform, where available. This distinction is important. ISNP permission is not designed as an entry route for an ordinary technology company to start selling insurance without first falling within an authorised insurance-distribution structure.
A broker seeking to operate through an ISNP must continue to satisfy the conditions applicable to its broker registration. A corporate agent or web aggregator must similarly stay within the activities and product relationships permitted under its respective IRDAI regulatory framework. Therefore, an applicant should first verify whether its existing Certificate of Registration and scope of permitted activities support the proposed digital insurance model before beginning the ISNP application.
Legal Provisions Governing ISNP
The principal ISNP framework continues to originate from the Guidelines on Insurance E-Commerce, 2017. The guidelines deal with permission to establish an ISNP, application requirements, system controls, code of conduct, platform operations, product display, pricing, proposals, KYC and AML, premium collection, policy issuance, servicing, data protection, grievances, fraud control and reporting obligations. IRDAI continues to maintain ISNP-related resources and the 2017 online application circular in its regulatory materials.
However, businesses should not read the 2017 guidelines in isolation. Several regulations referred to in the original guidelines have subsequently been replaced or consolidated.
For example, policyholder-protection obligations now operate within the IRDAI (Protection of Policyholders’ Interests, Operations and Allied Matters of Insurers) Regulations, 2024, supplemented by the Master Circular on Protection of Policyholders’ Interests, 2024 and the Master Circular on Operations and Allied Matters of Insurers.
Likewise, the earlier commission regulations referred to in the 2017 ISNP guidelines have been superseded. From 1 April 2024, the IRDAI (Expenses of Management, including Commission, of Insurers) Regulations, 2024 govern the current commission framework and expressly repealed the 2023 Payment of Commission Regulations.
Consequently, an ISNP operator must read the original e-commerce requirements together with the subsequently applicable regulations, master circulars and directions.
Application for ISNP Permission – Form ISNP-1
Guideline 4 of the Insurance E-Commerce Guidelines requires an applicant seeking to establish an ISNP to apply in Form ISNP-1. Under Guideline 5, no person may establish an ISNP for undertaking insurance e-commerce activities in India without first obtaining the required permission from IRDAI. The application is accompanied by a non-refundable fee of ?10,000 plus applicable taxes.
IRDAI's ISNP FAQ also confirms the ?10,000 non-refundable fee and provides an online application workflow for existing licensed entities. The application is therefore much more than registration of a website. IRDAI evaluates whether the applicant's regulatory status, management structure, proposed platform, security controls and operational arrangements are suitable for conducting insurance transactions electronically.
Documents Required for ISNP Application
The documents required for an ISNP application may vary depending on the category of the applicant, its existing IRDAI registration and the nature of the proposed digital insurance activities. The purpose of the documentation is to establish that the applicant is legally eligible to operate the platform and that its management, technology systems and operational processes are ready for regulatory review.
The following documents and information are generally relevant:

IRDAI Registration Details:The applicant should provide details of its valid IRDAI registration, including the Certificate of Registration number, validity period and category of registration. These records help establish that the applicant is authorised to undertake the insurance activities proposed through the ISNP.
Registered or Principal Office Details:Complete details of the applicant’s registered office or principal place of business should be provided. The information should be consistent with the records already available with IRDAI and other statutory authorities.
Principal Officer Details:The application should include the name and relevant particulars of the Principal Officer responsible for regulatory and operational compliance. Supporting information relating to the Principal Officer may also be required as part of the application.
Details of the ISNP Management Team:Information regarding persons responsible for managing the ISNP should be maintained and submitted as required. This may include their qualifications, professional experience, conduct, responsibilities and role in technology, compliance, operations or customer servicing.
Corporate and Constitutional Documents:Companies and other corporate applicants should keep their incorporation and constitutional records ready for regulatory verification. These may include the Certificate of Incorporation, Memorandum and Articles of Association and other relevant entity documents.
Details of Directors and Authorised Representatives:Information relating to directors, key managerial personnel or authorised representatives may be required depending on the applicant’s legal structure. Proper authorisation for filing and regulatory correspondence should also be maintained.
Business Activity and Product Details:The applicant should clearly explain the insurance activities proposed to be carried out through the ISNP. Details of insurance products, distribution arrangements and the applicant’s authorised scope of business should be consistent with its existing IRDAI registration.
Technology and Operational Documents:Supporting documents relating to the proposed ISNP technology, internal processes and operational controls may also be required. These documents help demonstrate that the platform is technically capable of conducting insurance transactions in a secure and compliant manner.

Applicants should ensure that all information submitted in the ISNP application is accurate, current and consistent with their existing IRDAI registration. Any mismatch in regulatory details, management information or proposed business activities may result in clarification requests and delay the approval process.
Information-Security and Technology Documents
The technical compliance file is one of the most important components of an ISNP application.
Guideline 14 requires the platform to be protected against unauthorised access, alteration, destruction, disclosure or dissemination of records and data. It also requires secure communication networks, standard encryption formats, adequate disaster-recovery arrangements, robust firewall and intrusion-detection systems and appropriate information-security management controls.
Accordingly, an applicant should maintain documentation explaining its IT architecture, cybersecurity controls, encryption standards, access-management process, firewall arrangements, intrusion-detection capability, backup systems and disaster-recovery plan.
The guidelines also require disaster recovery at a location different from the existing location. The platform must have mechanisms protecting policyholder privacy and must maintain suitable procedures and timelines for pre-sale and post-sale activities.
A detailed Standard Operating Procedure covering both IT and non-IT activities should therefore be prepared before launch.
Website, Domain and Server Requirements
The ISNP cannot be treated as a generic marketing website.
Under Guideline 14, the ISNP's website domain must be registered and its hosting servers are required to be located within India. The platform must also be capable of making the information displayed, processes followed and mechanisms implemented available for regulatory verification and scrutiny.
The website itself must prominently disclose the applicant's legal name, geographical address, telephone and electronic contact details, Certificate of Registration number and validity, registration category and information explaining how policyholders may file complaints.
Applicants should therefore complete a regulatory content audit of the website or mobile app before the final certification process.
Step-by-Step ISNP Application Process
Obtaining permission to establish and operate an Insurance Self-Network Platform involves regulatory, technical and operational review. The applicant should ensure that its existing IRDAI registration permits the proposed insurance activities and that the digital platform is capable of meeting the prescribed security, consumer-protection and operational requirements.
The ISNP application process can broadly be understood through the following steps:
Step 1: Verify IRDAI Registration and Eligibility
The applicant must first hold an appropriate and valid registration issued by IRDAI. The insurance activities proposed through the ISNP should remain within the scope permitted under the applicant’s existing registration, as ISNP permission does not independently expand the applicant’s regulatory authority.
Step 2: Register on the ISNP Portal
The eligible applicant can proceed with registration on the designated ISNP portal using its existing IRDAI licence or registration details. After successful registration, the applicant receives the necessary login credentials and information relating to the prerequisites for submitting the ISNP application.
Step 3: Complete the ISNP Application
After accessing the portal, the applicant must complete the prescribed application by providing details regarding its business, regulatory registration, Principal Officer, management team and proposed digital platform. All information should be accurate and consistent with the records already available with IRDAI.
Step 4: Submit Form ISNP-1 and Application Fee
The application for establishing an ISNP is made in Form ISNP-1 along with the prescribed supporting information. The application is accompanied by a non-refundable fee of ?10,000 plus applicable taxes, and a printable version of the submitted application may be generated after successful online submission.
Step 5: Respond to IRDAI Clarifications
IRDAI may seek additional documents, explanations or clarification regarding the applicant’s business model, technology infrastructure or compliance arrangements. Where necessary, the Authority may also require representatives of the applicant to provide further information or appear for regulatory interaction.
Step 6: Complete Deficiencies in the Application
If the application is incomplete, the applicant may be required to provide the missing information within the prescribed period. Under the Insurance E-Commerce Guidelines, a period of 15 days is contemplated for completion of deficiencies, and failure to provide the required information may affect further processing of the application.
Step 7: Regulatory Review by IRDAI
Once all necessary documents and information have been submitted, IRDAI examines whether the applicant satisfies the applicable regulatory requirements. The Guidelines provide that the Authority should endeavour to decide the application within 60 days from receipt of all complete information and documents.
Step 8: Set Up the ISNP Platform
After the applicable regulatory stage, the applicant is required to establish the proposed ISNP in accordance with the technical and operational specifications submitted to IRDAI. The platform should incorporate appropriate cybersecurity, data protection, customer servicing, grievance handling, payment and record-maintenance systems.
Step 9: Obtain Required System Certification
IRDAI’s ISNP guidance provides for the applicant to complete the platform setup and obtain certification through the recognised certification process within the prescribed period, generally 60 days from the relevant approval or readiness stage. The certification process is important because it verifies that the platform’s systems, controls, security arrangements and operational processes are capable of supporting regulated insurance e-commerce activities.
Step 10: Begin Operations and Maintain Continuous Compliance
After completing the prescribed regulatory and certification requirements, the ISNP may commence permitted insurance e-commerce activities. However, approval is not the end of compliance, as the operator must continue meeting cybersecurity, audit, reporting, policyholder-protection, KYC, AML and other applicable IRDAI requirements. The ISNP operator should also maintain proper records of transactions, customer complaints, system audits, regulatory filings and internal reviews so that the platform remains compliant throughout its operation.
ISNP Security Certification and Annual Audit
Technology certification is not a one-time exercise.
Guideline 11 requires the controls, systems, procedures and safeguards of the ISNP to be reviewed at least once every year by an external Certified Information Systems Auditor (CISA), a Chartered Accountant holding DISA (ICAI), or a CERT-In expert, at the applicant's cost.
The applicant is also required to maintain compliance with an appropriate information-security management system standard of the International Organization for Standardization or International Electrotechnical Commission, or an equivalent standard, supported by annual review.
Audit reports and the information-security management review must be placed before the Board or an appropriate Board sub-committee. Material adverse findings affecting ISNP operations or causing financial loss to policyholders must be reported to IRDAI along with an action plan.
This requirement should now also be viewed alongside the IRDAI Information and Cyber Security Guidelines, 2023, which remain an important cybersecurity framework for regulated insurance entities.
Products That Can Be Offered on an ISNP
An ISNP cannot display any insurance product merely because it is commercially attractive. Only products that are validly permitted under the applicable regulatory and product-approval framework may be offered. The insurer is responsible for its approved products, while an intermediary can offer only those products it is permitted to distribute under the regulations governing that category of intermediary.
A registered insurer's ISNP ordinarily displays its own products. An intermediary's ISNP may display products of insurers with which it is legally permitted to transact. Importantly, an intermediary must not improperly favour a particular insurer. Product recommendations may be made on the basis of the customer's need analysis rather than undisclosed commercial preferences.
Pre-Sale Information and Customer Transparency
Digital distribution does not dilute the duty to explain insurance products. The ISNP must provide customers with clear information regarding the intended consumer segment, principal characteristics of the product, coverage and options, exclusions and limitations, premium and charges, cancellation rights and any time limitation attached to the information displayed.
The objective is to ensure that the convenience of online purchase does not result in mis-selling or reduced disclosure. Electronic proposal processes should therefore be designed around informed customer decision-making rather than simply minimising the number of clicks required to complete a transaction.
KYC, AML and Prevention of Money Laundering
Guideline 15 places responsibility on the ISNP for complying with applicable Know Your Customer and Anti-Money Laundering requirements. This obligation has to be read together with the current IRDAI AML/CFT framework and the Prevention of Money Laundering Act, 2002 and rules made thereunder. The Insurance E-Commerce Guidelines themselves prohibit conduct contrary to PMLA requirements.
Digital onboarding should therefore incorporate approved identity verification, customer due diligence, record keeping and suspicious-transaction controls wherever applicable. An ISNP is not an exemption from KYC merely because the customer journey is fully digital.
Collection of Insurance Premium – Section 64VB
One particularly important statutory provision is Section 64VB of the Insurance Act, 1938.
The ISNP Guidelines expressly require market participants to comply with Section 64VB(1), which deals with receipt of premium before assumption of risk in the circumstances governed by that provision. Electronic premium payments may be facilitated using permitted digital payment channels and appropriate insurer payment gateways.
The payment architecture should ensure appropriate reconciliation, acknowledgement and transfer of premiums, while avoiding structures that could conflict with insurance law or payment-system requirements.
Commission and Remuneration
The original 2017 guidelines referred to the commission regulations then in force. That reference must now be understood in light of the current framework. From 1 April 2024, commission forms part of the consolidated regime under the IRDAI (Expenses of Management, including Commission, of Insurers) Regulations, 2024. These regulations require insurers to maintain a Board-approved commission policy and keep commissions within the applicable expense-of-management framework. Therefore, an ISNP cannot be used as a mechanism for paying disguised technology fees, incentives or remuneration that would circumvent insurance commission rules.
Customer Data, Privacy and Cybersecurity
An ISNP processes highly sensitive commercial and personal information, including identity details, contact information, financial information, insurance requirements and, in many health-insurance transactions, health-related information. Guideline 15 of the operational provisions places a direct duty on the platform to keep personal information confidential, prevent misuse, protect records against manipulation and continuously review security safeguards.
India's broader privacy landscape has also changed significantly. The Digital Personal Data Protection Rules, 2025 were notified in November 2025, with different substantive provisions of the DPDP Act and Rules entering into force on a phased timetable. Major operational provisions relating to notice, consent and processing are scheduled according to that statutory transition period. Accordingly, ISNP operators should build privacy compliance into their systems now rather than waiting until every remaining provision becomes operational.
Grievance Redressal and Post-Sale Servicing
ISNP compliance does not stop after a policy is sold. The platform must provide procedures, processes and timelines for post-sale servicing. It must also maintain a mechanism for dealing with policyholder grievances and for issues such as duplicate premium debits.
These requirements should presently be read with the IRDAI (Protection of Policyholders’ Interests, Operations and Allied Matters of Insurers) Regulations, 2024 and the 2024 Master Circular on policyholder protection. A digital platform should therefore allow customers to raise grievances, track their requests and access appropriate escalation channels without forcing them into an entirely offline process.
Fraud Detection Policy
Every ISNP must maintain a proactive fraud-detection policy approved by its Board of Directors. The policy is expected to address detection and identification of fraud, follow-up action against persons involved, cooperation among market participants and maintenance or sharing of relevant fraud-related information in accordance with the applicable legal framework. Fraud controls are particularly important in digital insurance because online impersonation, identity misuse, manipulated documents, unauthorised transactions and payment fraud can occur at scale.
Annual Compliance Certificate and Reporting
The compliance burden continues after the platform becomes operational. Guideline 22 requires the Chief Executive Officer and Compliance Officer to file an annual compliance certificate with IRDAI confirming compliance of the platform's displayed information, processes, procedures and other mechanisms with the guidelines.
The applicant must also submit reports required by IRDAI and immediately report relevant regulatory or supervisory action taken by government or other regulatory authorities. IRDAI retains the power to inspect or investigate documents, records and communications relating to the platform.
Validity and Revocation of ISNP Permission
For an insurance intermediary, ISNP permission is ordinarily valid for as long as the intermediary's underlying Certificate of Registration remains valid. In the case of an insurer, permission generally continues unless revoked. IRDAI may revoke permission where platform activities are against policyholder interests, inconsistent with orderly development of the insurance industry, contrary to the ISNP Code of Conduct or in violation of applicable insurance laws, regulations, guidelines or directions. An opportunity of being heard is contemplated before revocation under the original guidelines.
Recent Regulatory Developments Relevant to ISNP in 2026
There has been a broader restructuring of India's digital insurance regulation even though the core ISNP framework continues to trace back to 2017.
In 2024, IRDAI notified the Bima Sugam – Insurance Electronic Marketplace Regulations, 2024, creating a regulatory framework for a broader insurance electronic marketplace. Bima Sugam should not automatically be confused with or treated as a replacement for an insurer's or intermediary's own ISNP; the two arise from different regulatory mechanisms.
The 2024 policyholder-protection regulations, 2024 expenses and commission regulations, and the 2023 cyber-security guidelines also materially affect how an ISNP should currently be operated.
In February 2025, IRDAI also introduced the Bima-ASBA facility relating to one-time UPI mandates for blocking premium amounts for issuance of life and health insurance policies, reflecting the regulator's continuing movement toward more secure and customer-friendly digital premium processes.
For 2026 compliance planning, entities should therefore avoid relying only on an old ISNP checklist. The platform should be evaluated against the current insurance, cybersecurity, policyholder-protection, commission, AML and emerging data-protection framework.
Conclusion
ISNP certification is not merely a technical certificate for an insurance website. It represents a complete regulatory framework governing how insurance can be digitally marketed, sold, paid for and serviced.
An applicant must first hold the appropriate underlying IRDAI authorisation, apply for permission through Form ISNP-1, pay the prescribed fee and demonstrate that its digital infrastructure, management, cybersecurity controls, customer processes, product disclosures and operational safeguards meet regulatory expectations.
Once operational, compliance becomes continuous. Annual security review, Board oversight, fraud monitoring, customer-data protection, grievance handling, KYC and AML compliance, proper premium collection, appropriate commission structures, record maintenance and annual compliance certification all remain important.
For insurers and intermediaries building digital distribution channels in 2026, the most effective approach is therefore to treat ISNP approval as a combination of regulatory licensing, technology governance, cybersecurity, consumer protection and continuing compliance rather than as a one-time registration.
Businesses should also periodically review their ISNP architecture against newer IRDAI regulations and circulars because a platform originally built around the 2017 framework may require operational changes to remain aligned with today's regulatory environment.
Compliance Calendar LLP can assist insurers and insurance intermediaries with ISNP applicability assessment, documentation, Form ISNP-1 preparation, regulatory-process coordination, compliance documentation, cybersecurity-readiness requirements and post-approval compliance planning.
Legal position reviewed up to 23 September 2026. Entity-specific eligibility and documentation should be verified against the applicant's category of IRDAI registration and the latest directions applicable at the time of filing.
Frequently Asked Questions on ISNP Insurance Certification
1. What is ISNP in insurance?
ISNP stands for Insurance Self-Network Platform and refers to an electronic platform permitted by IRDAI for insurance e-commerce activities.It enables eligible insurers and insurance intermediaries to sell and service insurance products digitally.The platform may operate through a website, mobile application or other approved electronic channel.ISNP permission does not replace the underlying IRDAI registration required to conduct insurance business.
2. Who can apply for ISNP permission?
Eligible insurers and certain IRDAI-registered insurance intermediaries can apply for permission to establish an ISNP.This may include insurance brokers, corporate agents and insurance web aggregators, subject to applicable regulations.The applicant must hold a valid IRDAI registration and remain within the permitted scope of its activities.Individual tied insurance agents generally cannot establish an independent ISNP.
3. Which form is required for an ISNP application?
An applicant seeking permission to establish an ISNP is required to submit Form ISNP-1.The application contains details about the applicant, regulatory registration, Principal Officer and persons managing the platform.Technical, security, operational and compliance-related information must also be provided as applicable.IRDAI may seek additional information or clarification before granting permission.
4. What is the application fee for ISNP permission?
The prescribed non-refundable application fee for establishing an ISNP is generally ?10,000 plus applicable taxes.The fee is submitted along with the application in the manner prescribed by IRDAI.Applicants should ensure that the application is complete before submission to avoid unnecessary regulatory queries.Professional, audit or technology-certification costs are separate from the regulatory application fee.
5. What documents are required for ISNP certification?
Applicants generally require their IRDAI registration details, entity documents and information about the Principal Officer and management team.They should also maintain IT architecture, cybersecurity policies, disaster-recovery plans and operational Standard Operating Procedures.Website details, security controls, product-distribution arrangements and customer-servicing procedures may also be examined.The exact documentation depends on the applicant's regulatory category and proposed digital insurance activities.
6. Is an information-security audit mandatory for an ISNP?
Yes, the ISNP framework requires periodic review of information-security systems, procedures and safeguards.The review must generally be conducted at least annually by an eligible external information-systems or cybersecurity auditor.The audit examines data protection, access controls, network security, disaster recovery and other technology safeguards.Material adverse findings should be appropriately addressed and reported in accordance with IRDAI requirements.
7. Can an ISNP sell all types of insurance products?
An ISNP can offer only those insurance products that are permitted under applicable IRDAI regulations and product frameworks.An insurer may offer its approved products, while an intermediary must remain within its authorised distribution arrangements.The platform cannot use ISNP permission to undertake activities beyond its underlying Certificate of Registration.Product presentation should also comply with disclosure, suitability and policyholder-protection requirements.
8. What are the cybersecurity requirements for an ISNP?
An ISNP must maintain appropriate controls against unauthorised access, data alteration, disclosure, destruction and cyber threats.The platform should use secure communication, encryption, firewalls, intrusion-detection mechanisms and appropriate access controls.Adequate backup and disaster-recovery arrangements are also important components of the regulatory framework.Current IRDAI information and cybersecurity requirements should be considered along with the original ISNP Guidelines.
9. Does an ISNP need to comply with KYC and AML requirements?
Yes, digital insurance distribution does not remove KYC and Anti-Money Laundering obligations.The applicant must comply with applicable IRDAI AML/CFT requirements and the Prevention of Money Laundering framework.Appropriate identity verification, customer due diligence, record retention and transaction-monitoring systems should be implemented.These controls should form an integral part of the digital insurance onboarding process.
10. Is ISNP permission permanent?
For an insurance intermediary, ISNP permission is generally linked with the validity of its underlying IRDAI registration.The platform must continue complying with applicable regulations, guidelines and directions throughout its operations.IRDAI may take regulatory action or revoke permission where serious violations or policyholder-interest concerns arise.Continuous audits, regulatory reporting and compliance monitoring are therefore essential after approval.

India’s insurance sector has moved far beyond branch offices, physical proposal forms and face-to-face policy sales. Customers today expect to compare, purchase, renew and service insurance policies through websites and mobile applications. But an insurance company or intermediary cannot simply build a website, integrate a payment gateway and start selling regulated insurance products online.

Where an insurer or eligible insurance intermediary wants to establish its own digital platform for selling and servicing insurance products, the Insurance Self-Network Platform (ISNP) framework becomes important.

An ISNP Insurance Certification is an electronic platform established with the permission of the Insurance Regulatory and Development Authority of India (IRDAI) for undertaking permitted insurance e-commerce activities. What is commonly referred to in professional practice as “ISNP certification” therefore involves two interconnected aspects: obtaining IRDAI permission for the platform and ensuring that the technology, information-security controls, operational processes and continuing audits satisfy the prescribed regulatory requirements.

For insurers, insurance brokers, corporate agents and web aggregators planning a digital insurance business, understanding this distinction is essential because ISNP approval does not replace the underlying IRDAI registration required to carry on the relevant insurance activity.

What is an Insurance Self-Network Platform?

The concept of an Insurance Self-Network Platform was formally introduced through the IRDAI Guidelines on Insurance E-Commerce dated 9 March 2017, bearing reference IRDA/INT/GDL/ECM/055/03/2017. These guidelines were issued under Section 34 of the Insurance Act, 1938 read with Section 14 of the Insurance Regulatory and Development Authority Act, 1999.

Under the guidelines, an ISNP means an electronic platform set up by an applicant with the permission of IRDAI. An “applicant” includes a registered insurer, an insurance intermediary or another person recognised by the Authority that wishes to establish an ISNP for selling and servicing insurance products.

In practical terms, an ISNP may operate through a desktop website, a mobile-responsive website, a mobile application or a combination of these digital channels. It is intended to facilitate regulated insurance transactions while ensuring that customers receive proper product information, secure transaction facilities and post-sale services.

Who Can Apply for ISNP Permission?

IRDAI's current ISNP FAQ states that an ISNP may be established by insurers and insurance intermediaries such as insurance brokers, corporate agents and insurance web aggregators. A tied individual insurance agent cannot establish an independent ISNP and instead has to use the relevant insurer's platform, where available. This distinction is important. ISNP permission is not designed as an entry route for an ordinary technology company to start selling insurance without first falling within an authorised insurance-distribution structure.

A broker seeking to operate through an ISNP must continue to satisfy the conditions applicable to its broker registration. A corporate agent or web aggregator must similarly stay within the activities and product relationships permitted under its respective IRDAI regulatory framework. Therefore, an applicant should first verify whether its existing Certificate of Registration and scope of permitted activities support the proposed digital insurance model before beginning the ISNP application.

Legal Provisions Governing ISNP

The principal ISNP framework continues to originate from the Guidelines on Insurance E-Commerce, 2017. The guidelines deal with permission to establish an ISNP, application requirements, system controls, code of conduct, platform operations, product display, pricing, proposals, KYC and AML, premium collection, policy issuance, servicing, data protection, grievances, fraud control and reporting obligations. IRDAI continues to maintain ISNP-related resources and the 2017 online application circular in its regulatory materials.

However, businesses should not read the 2017 guidelines in isolation. Several regulations referred to in the original guidelines have subsequently been replaced or consolidated.

For example, policyholder-protection obligations now operate within the IRDAI (Protection of Policyholders’ Interests, Operations and Allied Matters of Insurers) Regulations, 2024, supplemented by the Master Circular on Protection of Policyholders’ Interests, 2024 and the Master Circular on Operations and Allied Matters of Insurers.

Likewise, the earlier commission regulations referred to in the 2017 ISNP guidelines have been superseded. From 1 April 2024, the IRDAI (Expenses of Management, including Commission, of Insurers) Regulations, 2024 govern the current commission framework and expressly repealed the 2023 Payment of Commission Regulations.

Consequently, an ISNP operator must read the original e-commerce requirements together with the subsequently applicable regulations, master circulars and directions.

Application for ISNP Permission – Form ISNP-1

Guideline 4 of the Insurance E-Commerce Guidelines requires an applicant seeking to establish an ISNP to apply in Form ISNP-1. Under Guideline 5, no person may establish an ISNP for undertaking insurance e-commerce activities in India without first obtaining the required permission from IRDAI. The application is accompanied by a non-refundable fee of ?10,000 plus applicable taxes.

IRDAI's ISNP FAQ also confirms the ?10,000 non-refundable fee and provides an online application workflow for existing licensed entities. The application is therefore much more than registration of a website. IRDAI evaluates whether the applicant's regulatory status, management structure, proposed platform, security controls and operational arrangements are suitable for conducting insurance transactions electronically.

Documents Required for ISNP Application

The documents required for an ISNP application may vary depending on the category of the applicant, its existing IRDAI registration and the nature of the proposed digital insurance activities. The purpose of the documentation is to establish that the applicant is legally eligible to operate the platform and that its management, technology systems and operational processes are ready for regulatory review.

The following documents and information are generally relevant:

IRDAI Registration Details:
The applicant should provide details of its valid IRDAI registration, including the Certificate of Registration number, validity period and category of registration. These records help establish that the applicant is authorised to undertake the insurance activities proposed through the ISNP.
Registered or Principal Office Details:
Complete details of the applicant’s registered office or principal place of business should be provided. The information should be consistent with the records already available with IRDAI and other statutory authorities.
Principal Officer Details:
The application should include the name and relevant particulars of the Principal Officer responsible for regulatory and operational compliance. Supporting information relating to the Principal Officer may also be required as part of the application.
Details of the ISNP Management Team:
Information regarding persons responsible for managing the ISNP should be maintained and submitted as required. This may include their qualifications, professional experience, conduct, responsibilities and role in technology, compliance, operations or customer servicing.
Corporate and Constitutional Documents:
Companies and other corporate applicants should keep their incorporation and constitutional records ready for regulatory verification. These may include the Certificate of Incorporation, Memorandum and Articles of Association and other relevant entity documents.
Details of Directors and Authorised Representatives:
Information relating to directors, key managerial personnel or authorised representatives may be required depending on the applicant’s legal structure. Proper authorisation for filing and regulatory correspondence should also be maintained.
Business Activity and Product Details:
The applicant should clearly explain the insurance activities proposed to be carried out through the ISNP. Details of insurance products, distribution arrangements and the applicant’s authorised scope of business should be consistent with its existing IRDAI registration.
Technology and Operational Documents:
Supporting documents relating to the proposed ISNP technology, internal processes and operational controls may also be required. These documents help demonstrate that the platform is technically capable of conducting insurance transactions in a secure and compliant manner.

Information-Security and Technology Documents

The technical compliance file is one of the most important components of an ISNP application.

Guideline 14 requires the platform to be protected against unauthorised access, alteration, destruction, disclosure or dissemination of records and data. It also requires secure communication networks, standard encryption formats, adequate disaster-recovery arrangements, robust firewall and intrusion-detection systems and appropriate information-security management controls.

Accordingly, an applicant should maintain documentation explaining its IT architecture, cybersecurity controls, encryption standards, access-management process, firewall arrangements, intrusion-detection capability, backup systems and disaster-recovery plan.

The guidelines also require disaster recovery at a location different from the existing location. The platform must have mechanisms protecting policyholder privacy and must maintain suitable procedures and timelines for pre-sale and post-sale activities.

A detailed Standard Operating Procedure covering both IT and non-IT activities should therefore be prepared before launch.

Website, Domain and Server Requirements

The ISNP cannot be treated as a generic marketing website.

Under Guideline 14, the ISNP's website domain must be registered and its hosting servers are required to be located within India. The platform must also be capable of making the information displayed, processes followed and mechanisms implemented available for regulatory verification and scrutiny.

The website itself must prominently disclose the applicant's legal name, geographical address, telephone and electronic contact details, Certificate of Registration number and validity, registration category and information explaining how policyholders may file complaints.

Applicants should therefore complete a regulatory content audit of the website or mobile app before the final certification process.

Step-by-Step ISNP Application Process

Obtaining permission to establish and operate an Insurance Self-Network Platform involves regulatory, technical and operational review. The applicant should ensure that its existing IRDAI registration permits the proposed insurance activities and that the digital platform is capable of meeting the prescribed security, consumer-protection and operational requirements.

The ISNP application process can broadly be understood through the following steps:

Step 1: Verify IRDAI Registration and Eligibility

The applicant must first hold an appropriate and valid registration issued by IRDAI. The insurance activities proposed through the ISNP should remain within the scope permitted under the applicant’s existing registration, as ISNP permission does not independently expand the applicant’s regulatory authority.

Step 2: Register on the ISNP Portal

The eligible applicant can proceed with registration on the designated ISNP portal using its existing IRDAI licence or registration details. After successful registration, the applicant receives the necessary login credentials and information relating to the prerequisites for submitting the ISNP application.

Step 3: Complete the ISNP Application

After accessing the portal, the applicant must complete the prescribed application by providing details regarding its business, regulatory registration, Principal Officer, management team and proposed digital platform. All information should be accurate and consistent with the records already available with IRDAI.

Step 4: Submit Form ISNP-1 and Application Fee

The application for establishing an ISNP is made in Form ISNP-1 along with the prescribed supporting information. The application is accompanied by a non-refundable fee of ?10,000 plus applicable taxes, and a printable version of the submitted application may be generated after successful online submission.

Step 5: Respond to IRDAI Clarifications

IRDAI may seek additional documents, explanations or clarification regarding the applicant’s business model, technology infrastructure or compliance arrangements. Where necessary, the Authority may also require representatives of the applicant to provide further information or appear for regulatory interaction.

Step 6: Complete Deficiencies in the Application

If the application is incomplete, the applicant may be required to provide the missing information within the prescribed period. Under the Insurance E-Commerce Guidelines, a period of 15 days is contemplated for completion of deficiencies, and failure to provide the required information may affect further processing of the application.

Step 7: Regulatory Review by IRDAI

Once all necessary documents and information have been submitted, IRDAI examines whether the applicant satisfies the applicable regulatory requirements. The Guidelines provide that the Authority should endeavour to decide the application within 60 days from receipt of all complete information and documents.

Step 8: Set Up the ISNP Platform

After the applicable regulatory stage, the applicant is required to establish the proposed ISNP in accordance with the technical and operational specifications submitted to IRDAI. The platform should incorporate appropriate cybersecurity, data protection, customer servicing, grievance handling, payment and record-maintenance systems.

Step 9: Obtain Required System Certification

IRDAI’s ISNP guidance provides for the applicant to complete the platform setup and obtain certification through the recognised certification process within the prescribed period, generally 60 days from the relevant approval or readiness stage. The certification process is important because it verifies that the platform’s systems, controls, security arrangements and operational processes are capable of supporting regulated insurance e-commerce activities.

Step 10: Begin Operations and Maintain Continuous Compliance

After completing the prescribed regulatory and certification requirements, the ISNP may commence permitted insurance e-commerce activities. However, approval is not the end of compliance, as the operator must continue meeting cybersecurity, audit, reporting, policyholder-protection, KYC, AML and other applicable IRDAI requirements. The ISNP operator should also maintain proper records of transactions, customer complaints, system audits, regulatory filings and internal reviews so that the platform remains compliant throughout its operation.

ISNP Security Certification and Annual Audit

Technology certification is not a one-time exercise.

Guideline 11 requires the controls, systems, procedures and safeguards of the ISNP to be reviewed at least once every year by an external Certified Information Systems Auditor (CISA), a Chartered Accountant holding DISA (ICAI), or a CERT-In expert, at the applicant's cost.

The applicant is also required to maintain compliance with an appropriate information-security management system standard of the International Organization for Standardization or International Electrotechnical Commission, or an equivalent standard, supported by annual review.

Audit reports and the information-security management review must be placed before the Board or an appropriate Board sub-committee. Material adverse findings affecting ISNP operations or causing financial loss to policyholders must be reported to IRDAI along with an action plan.

This requirement should now also be viewed alongside the IRDAI Information and Cyber Security Guidelines, 2023, which remain an important cybersecurity framework for regulated insurance entities.

Products That Can Be Offered on an ISNP

An ISNP cannot display any insurance product merely because it is commercially attractive. Only products that are validly permitted under the applicable regulatory and product-approval framework may be offered. The insurer is responsible for its approved products, while an intermediary can offer only those products it is permitted to distribute under the regulations governing that category of intermediary.

A registered insurer's ISNP ordinarily displays its own products. An intermediary's ISNP may display products of insurers with which it is legally permitted to transact. Importantly, an intermediary must not improperly favour a particular insurer. Product recommendations may be made on the basis of the customer's need analysis rather than undisclosed commercial preferences.

Pre-Sale Information and Customer Transparency

Digital distribution does not dilute the duty to explain insurance products. The ISNP must provide customers with clear information regarding the intended consumer segment, principal characteristics of the product, coverage and options, exclusions and limitations, premium and charges, cancellation rights and any time limitation attached to the information displayed.

The objective is to ensure that the convenience of online purchase does not result in mis-selling or reduced disclosure. Electronic proposal processes should therefore be designed around informed customer decision-making rather than simply minimising the number of clicks required to complete a transaction.

KYC, AML and Prevention of Money Laundering

Guideline 15 places responsibility on the ISNP for complying with applicable Know Your Customer and Anti-Money Laundering requirements. This obligation has to be read together with the current IRDAI AML/CFT framework and the Prevention of Money Laundering Act, 2002 and rules made thereunder. The Insurance E-Commerce Guidelines themselves prohibit conduct contrary to PMLA requirements.

Digital onboarding should therefore incorporate approved identity verification, customer due diligence, record keeping and suspicious-transaction controls wherever applicable. An ISNP is not an exemption from KYC merely because the customer journey is fully digital.

Collection of Insurance Premium – Section 64VB

One particularly important statutory provision is Section 64VB of the Insurance Act, 1938.

The ISNP Guidelines expressly require market participants to comply with Section 64VB(1), which deals with receipt of premium before assumption of risk in the circumstances governed by that provision. Electronic premium payments may be facilitated using permitted digital payment channels and appropriate insurer payment gateways.

The payment architecture should ensure appropriate reconciliation, acknowledgement and transfer of premiums, while avoiding structures that could conflict with insurance law or payment-system requirements.

Commission and Remuneration

The original 2017 guidelines referred to the commission regulations then in force. That reference must now be understood in light of the current framework. From 1 April 2024, commission forms part of the consolidated regime under the IRDAI (Expenses of Management, including Commission, of Insurers) Regulations, 2024. These regulations require insurers to maintain a Board-approved commission policy and keep commissions within the applicable expense-of-management framework. Therefore, an ISNP cannot be used as a mechanism for paying disguised technology fees, incentives or remuneration that would circumvent insurance commission rules.

Customer Data, Privacy and Cybersecurity

An ISNP processes highly sensitive commercial and personal information, including identity details, contact information, financial information, insurance requirements and, in many health-insurance transactions, health-related information. Guideline 15 of the operational provisions places a direct duty on the platform to keep personal information confidential, prevent misuse, protect records against manipulation and continuously review security safeguards.

India's broader privacy landscape has also changed significantly. The Digital Personal Data Protection Rules, 2025 were notified in November 2025, with different substantive provisions of the DPDP Act and Rules entering into force on a phased timetable. Major operational provisions relating to notice, consent and processing are scheduled according to that statutory transition period. Accordingly, ISNP operators should build privacy compliance into their systems now rather than waiting until every remaining provision becomes operational.

Grievance Redressal and Post-Sale Servicing

ISNP compliance does not stop after a policy is sold. The platform must provide procedures, processes and timelines for post-sale servicing. It must also maintain a mechanism for dealing with policyholder grievances and for issues such as duplicate premium debits.

These requirements should presently be read with the IRDAI (Protection of Policyholders’ Interests, Operations and Allied Matters of Insurers) Regulations, 2024 and the 2024 Master Circular on policyholder protection. A digital platform should therefore allow customers to raise grievances, track their requests and access appropriate escalation channels without forcing them into an entirely offline process.

Fraud Detection Policy

Every ISNP must maintain a proactive fraud-detection policy approved by its Board of Directors. The policy is expected to address detection and identification of fraud, follow-up action against persons involved, cooperation among market participants and maintenance or sharing of relevant fraud-related information in accordance with the applicable legal framework. Fraud controls are particularly important in digital insurance because online impersonation, identity misuse, manipulated documents, unauthorised transactions and payment fraud can occur at scale.

Annual Compliance Certificate and Reporting

The compliance burden continues after the platform becomes operational. Guideline 22 requires the Chief Executive Officer and Compliance Officer to file an annual compliance certificate with IRDAI confirming compliance of the platform's displayed information, processes, procedures and other mechanisms with the guidelines.

The applicant must also submit reports required by IRDAI and immediately report relevant regulatory or supervisory action taken by government or other regulatory authorities. IRDAI retains the power to inspect or investigate documents, records and communications relating to the platform.

Validity and Revocation of ISNP Permission

For an insurance intermediary, ISNP permission is ordinarily valid for as long as the intermediary's underlying Certificate of Registration remains valid. In the case of an insurer, permission generally continues unless revoked. IRDAI may revoke permission where platform activities are against policyholder interests, inconsistent with orderly development of the insurance industry, contrary to the ISNP Code of Conduct or in violation of applicable insurance laws, regulations, guidelines or directions. An opportunity of being heard is contemplated before revocation under the original guidelines.

Recent Regulatory Developments Relevant to ISNP in 2026

There has been a broader restructuring of India's digital insurance regulation even though the core ISNP framework continues to trace back to 2017.

In 2024, IRDAI notified the Bima Sugam – Insurance Electronic Marketplace Regulations, 2024, creating a regulatory framework for a broader insurance electronic marketplace. Bima Sugam should not automatically be confused with or treated as a replacement for an insurer's or intermediary's own ISNP; the two arise from different regulatory mechanisms.

The 2024 policyholder-protection regulations, 2024 expenses and commission regulations, and the 2023 cyber-security guidelines also materially affect how an ISNP should currently be operated.

In February 2025, IRDAI also introduced the Bima-ASBA facility relating to one-time UPI mandates for blocking premium amounts for issuance of life and health insurance policies, reflecting the regulator's continuing movement toward more secure and customer-friendly digital premium processes.

For 2026 compliance planning, entities should therefore avoid relying only on an old ISNP checklist. The platform should be evaluated against the current insurance, cybersecurity, policyholder-protection, commission, AML and emerging data-protection framework.

Conclusion

ISNP certification is not merely a technical certificate for an insurance website. It represents a complete regulatory framework governing how insurance can be digitally marketed, sold, paid for and serviced.

An applicant must first hold the appropriate underlying IRDAI authorisation, apply for permission through Form ISNP-1, pay the prescribed fee and demonstrate that its digital infrastructure, management, cybersecurity controls, customer processes, product disclosures and operational safeguards meet regulatory expectations.

Once operational, compliance becomes continuous. Annual security review, Board oversight, fraud monitoring, customer-data protection, grievance handling, KYC and AML compliance, proper premium collection, appropriate commission structures, record maintenance and annual compliance certification all remain important.

For insurers and intermediaries building digital distribution channels in 2026, the most effective approach is therefore to treat ISNP approval as a combination of regulatory licensing, technology governance, cybersecurity, consumer protection and continuing compliance rather than as a one-time registration.

Businesses should also periodically review their ISNP architecture against newer IRDAI regulations and circulars because a platform originally built around the 2017 framework may require operational changes to remain aligned with today's regulatory environment.

Compliance Calendar LLP can assist insurers and insurance intermediaries with ISNP applicability assessment, documentation, Form ISNP-1 preparation, regulatory-process coordination, compliance documentation, cybersecurity-readiness requirements and post-approval compliance planning.

Legal position reviewed up to 23 September 2026. Entity-specific eligibility and documentation should be verified against the applicant's category of IRDAI registration and the latest directions applicable at the time of filing.

Frequently Asked Questions on ISNP Insurance Certification

1. What is ISNP in insurance?

ISNP stands for Insurance Self-Network Platform and refers to an electronic platform permitted by IRDAI for insurance e-commerce activities.
It enables eligible insurers and insurance intermediaries to sell and service insurance products digitally.
The platform may operate through a website, mobile application or other approved electronic channel.
ISNP permission does not replace the underlying IRDAI registration required to conduct insurance business.

2. Who can apply for ISNP permission?

Eligible insurers and certain IRDAI-registered insurance intermediaries can apply for permission to establish an ISNP.
This may include insurance brokers, corporate agents and insurance web aggregators, subject to applicable regulations.
The applicant must hold a valid IRDAI registration and remain within the permitted scope of its activities.
Individual tied insurance agents generally cannot establish an independent ISNP.

3. Which form is required for an ISNP application?

An applicant seeking permission to establish an ISNP is required to submit Form ISNP-1.
The application contains details about the applicant, regulatory registration, Principal Officer and persons managing the platform.
Technical, security, operational and compliance-related information must also be provided as applicable.
IRDAI may seek additional information or clarification before granting permission.

4. What is the application fee for ISNP permission?

The prescribed non-refundable application fee for establishing an ISNP is generally ?10,000 plus applicable taxes.
The fee is submitted along with the application in the manner prescribed by IRDAI.
Applicants should ensure that the application is complete before submission to avoid unnecessary regulatory queries.
Professional, audit or technology-certification costs are separate from the regulatory application fee.

5. What documents are required for ISNP certification?

Applicants generally require their IRDAI registration details, entity documents and information about the Principal Officer and management team.
They should also maintain IT architecture, cybersecurity policies, disaster-recovery plans and operational Standard Operating Procedures.
Website details, security controls, product-distribution arrangements and customer-servicing procedures may also be examined.
The exact documentation depends on the applicant's regulatory category and proposed digital insurance activities.

6. Is an information-security audit mandatory for an ISNP?

Yes, the ISNP framework requires periodic review of information-security systems, procedures and safeguards.
The review must generally be conducted at least annually by an eligible external information-systems or cybersecurity auditor.
The audit examines data protection, access controls, network security, disaster recovery and other technology safeguards.
Material adverse findings should be appropriately addressed and reported in accordance with IRDAI requirements.

7. Can an ISNP sell all types of insurance products?

An ISNP can offer only those insurance products that are permitted under applicable IRDAI regulations and product frameworks.
An insurer may offer its approved products, while an intermediary must remain within its authorised distribution arrangements.
The platform cannot use ISNP permission to undertake activities beyond its underlying Certificate of Registration.
Product presentation should also comply with disclosure, suitability and policyholder-protection requirements.

8. What are the cybersecurity requirements for an ISNP?

An ISNP must maintain appropriate controls against unauthorised access, data alteration, disclosure, destruction and cyber threats.
The platform should use secure communication, encryption, firewalls, intrusion-detection mechanisms and appropriate access controls.
Adequate backup and disaster-recovery arrangements are also important components of the regulatory framework.
Current IRDAI information and cybersecurity requirements should be considered along with the original ISNP Guidelines.

9. Does an ISNP need to comply with KYC and AML requirements?

Yes, digital insurance distribution does not remove KYC and Anti-Money Laundering obligations.
The applicant must comply with applicable IRDAI AML/CFT requirements and the Prevention of Money Laundering framework.
Appropriate identity verification, customer due diligence, record retention and transaction-monitoring systems should be implemented.
These controls should form an integral part of the digital insurance onboarding process.

10. Is ISNP permission permanent?

For an insurance intermediary, ISNP permission is generally linked with the validity of its underlying IRDAI registration.
The platform must continue complying with applicable regulations, guidelines and directions throughout its operations.
IRDAI may take regulatory action or revoke permission where serious violations or policyholder-interest concerns arise.
Continuous audits, regulatory reporting and compliance monitoring are therefore essential after approval.