Insurer solvency ratings and due diligence: vetting the company that has to pay

At some point, an international health policy has to do the thing it was bought for: pay a bill that could run into six or seven figures, in a country the payer has no presence in, in a currency they do not hold. The question of which company will actually do that, and whether it can, is separable from every question about benefits, and it is the one almost nobody asks at the quotation stage.

This matters more in international medical insurance than in most retail insurance, because the product is unusually intermediated. The name on the membership card is often a trade name, an administrator or a managing general agent. Behind it sits an underwriter, and often behind that a reinsurer, in a different country under a different regulator. None of that is improper — it is how the market is built — but it means brand recognition is close to useless as a proxy for security.

What follows is how to assess a carrier: what ratings are and are not, who the risk carrier is, which regulator supervises them, and what your recourse looks like if things go wrong.

What a financial strength rating is, and what it is not

Financial strength ratings are opinions issued by rating agencies on an insurer's ability to meet its ongoing insurance obligations. The agencies that recur in insurance regulation are A.M. Best, Standard & Poor's, Fitch, Moody's and Weiss. A.M. Best is the insurance specialist and is the one most frequently cited where an insurance-specific rating is required; the others rate insurers as part of a broader franchise.

Three things a rating does not tell you, all of which people read into it anyway:

• How the insurer handles claims. Solvency and conduct are different subjects. A strongly rated insurer can decline a claim on non-disclosure grounds and be entirely within its rights, and the rating will not move.
• How the insurer prices at renewal. Renewal behaviour on an annually renewable contract is one of the largest financial variables in the product, and no rating captures it. That belongs with annual renewability and guaranteed renewal.
• Whether the policy is enforceable where you live. That is a licensing question, covered in admitted versus non-admitted insurance.

Ratings are also not permanent. They are reviewed, and they move. A rating quoted in a brochure or on a comparison page tells you what was true when the page was written.

The one place a rating is legally load-bearing

Ratings are usually comfort. In one well-known case they are compliance.

The United States exchange visitor regulation at 22 CFR 62.14 requires that the underwriter of a J-1 visitor's health cover carry A.M. Best A− or above, Standard & Poor's A− or above, Weiss B+ or above, Fitch A− or above, or Moody's A3 or above, unless the policy is backed by the visitor's home government, offered through an employer or student group plan, or issued by a federally qualified health maintenance organisation. That sits alongside benefit minimums and cost-sharing caps, and alongside a continuing duty on the programme sponsor to ensure cover is maintained.

There is a practical trap here worth stating plainly. Research for this hub identified at least two carriers widely used for internationally mobile cover sitting exactly at the A.M. Best A− level rather than above it — 4 Ever Life, the underwriter behind the international programmes now branded Blue Cross Blue Shield Global Solutions, and SiriusPoint America, named by IMG as an underwriter. Both were reported at A− at the time of research. Sitting on a floor is not a criticism of either. It does mean that for a rating-gated visa route, the rating must be verified for the actual carrier at the time of application, from the agency, rather than assumed. The other visa tests that sit alongside it are set out in health insurance requirements for visas.

The better question: who carries the risk?

For most buyers, identifying the risk carrier is a more valuable exercise than looking up a rating, because it is the step that makes every other check possible. You cannot look up the right rating, the right licence or the right complaints body until you know which entity you are asking about.

Three real structures, all drawn from current market documentation, show how varied this can be.

A brand, a Belgian intermediary, a UK branch and a French insurer. One international personal health product currently in the market is arranged and administered by an entity registered with the Belgian FSMA, whose UK branch is authorised and regulated by the FCA, while the risk is underwritten by a separate French insurer regulated by the ACPR. Four jurisdictions are implicated by the time you have read the back page: the brand, the intermediary's home regulator, the branch regulator, and the insurer's regulator.

A German MGA, a UK-authorised affiliate and a French mutual. Another current wording describes the product manufacturer and distributor as a managing general agent based in Germany, regulated by BaFin and the local chambers of industry and commerce under the German trade code, with a UK affiliate authorised and regulated by the FCA — and states that the insurer will be either a French mutual governed by the Code de la mutualité or its Portuguese insurance subsidiary supervised by the Portuguese insurance and pension funds authority, as confirmed on the individual certificate of insurance. Note the final clause: which insurer carries your risk is a certificate-level fact, not a brochure-level one.

A trade name over a licensee over an underwriter. In the US-anchored segment, the GeoBlue name has been described as the trade name for the international health programmes of Worldwide Insurance Services, an independent licensee of the Blue Cross Blue Shield Association, with the underwriting carried out by 4 Ever Life. The brand carries enormous recognition; the risk carrier is a company most members would not name unprompted.

None of these structures is unusual or objectionable. They are the normal consequence of selling insurance across borders under differing licensing regimes — the mechanics of which are set out in who carries the risk: underwriters, MGAs and fronting.

Which regulator, and which complaints route

Once you know the entities, the regulatory map follows — and it is frequently not the map customers expect.

The Belgian-intermediary product referred to above directs complaints to the Financial Ombudsman Service for UK-based customers and to the French insurance mediation service for everyone else, after an internal complaints process with published acknowledgement and response timescales. Its data protection route splits the same way: the UK Information Commissioner's Office for UK members, and the Belgian data protection authority for members elsewhere. The German MGA structure directs data protection questions to a data protection officer in Paris.

Read that as a member living in Kuala Lumpur or Lagos and the point becomes concrete. Your complaints route may run to a mediator in a country you have never lived in, about a contract sold by an entity in a second country, underwritten in a third. That is not a failure of the product. It is a fact about it, and it is much better learned in advance than during a dispute. If you are already in one, declined IPMI claims and how to appeal sets out the escalation sequence.

What happens if the carrier fails or exits

Two different events get confused here, and only one of them is rare.

Insolvency is rare. Where it happens, whatever policyholder protection exists is a function of the regulator supervising the risk carrier, not of where the policyholder lives, and such arrangements are generally limited to policies written within that regulatory perimeter. Many jurisdictions have no comparable arrangement at all. This is one of the more concrete reasons the admitted question matters: an admitted policy sits inside a local protection framework where one exists, and a non-admitted one does not.

Market exit and portfolio transfer are common. Insurers withdraw from segments, sell books of business, rebrand and migrate customers to other carriers with some regularity, and the international health market has seen several such events in recent years. From the member's side these usually arrive as correspondence rather than crisis, but they raise a specific set of continuity questions — underwriting terms, renewal dates, networks, policy numbers and complaints routes — dealt with in when your insurer is acquired or rebranded.

A due-diligence checklist

Ten questions. The first four are the ones that most often produce a surprise.

1. Who is the risk carrier? Name the underwriting entity from the policy wording or certificate, not the website.
2. Who is the administrator or MGA? Name the entity handling claims and correspondence, and note that it may have delegated authority to decline as well as to pay.
3. Which regulator authorises the risk carrier, and in which country? Get the register entry or reference number.
4. Is the risk carrier admitted where I live? Check the register maintained by the insurance regulator in your country of residence, and any separate health-specific register.
5. What is the current financial strength rating, from which agency, and as at what date? Check the carrier, not the brand.
6. What is the internal complaints process, and what are the published timescales?
7. Which ombudsman or mediation body applies to me specifically? These are often split by the member's location.
8. Is there any policyholder protection arrangement, and does my policy fall inside it?
9. What happens to my cover on a portfolio transfer? Ask specifically whether underwriting terms, accrued moratorium time and renewal dates carry across.
10. Where does my medical data go, and who is the controller? Covered in medical records and data protection across borders.

For comparing the products themselves rather than the entities behind them, our existing IPMI plans compared guide covers the major providers, and the wider protection hub sets the context.

These details change, and you must check them

Ratings are reviewed and revised. Regulatory perimeters change. Underwriting entities are replaced, sometimes without any change to the brand or the benefits, and the insurer named on a certificate issued three years ago may not be the insurer named on next year's. Regulatory requirements that reference ratings — the J-1 floor among them — are themselves subject to amendment.

Everything above reflects research current as at July 2026, drawn from policy wordings, product information documents and regulator and agency publications. Verify the current rating with the agency directly, verify the licence with the regulator's own register, and ask the insurer in writing to confirm the underwriting entity for your specific policy before relying on any of it.