MGA exceeded authority limit: tracing the breach back to the bind

When an MGA exceeds its authority limit, it binds a risk larger, riskier or longer than its binding authority agreement allows, and the insurer whose paper it used is exposed to a loss it never agreed to carry. Most such breaches are not found when they happen. They are found when a claim arrives on a risk the insurer did not know it held, or when an auditor happens to pull the right file. This page tells one breach backwards, from the claim to the bind, at a fictional surety MGA. Its pattern follows a real English court case in which bonds above a coverholder's limit were reported within the limit, a random audit of 14 files found nothing, and the truth emerged only when beneficiaries claimed. At each step we mark what a line-by-line check would have seen. Botminds' Binding Authority Compliance runs that check on every bordereau the night it lands; this page is also honest about the step where no bordereau check can help.

Everything about Kestwick Bond Underwriting, its carrier Thornmere Insurance Company, its people and its bonds is invented for this page. The court record, the auditing standard and the statutes are real and linked.

Month 20: the claim that shows the MGA exceeded its authority limit

The breach becomes visible the day a beneficiary calls on a bond. Kestwick wrote contract surety bonds for Thornmere under a binding authority with three limits: $1.5 million any one bond, $4 million any one principal, and a maximum term of three years unless specially accepted. In month 20 a contractor defaults, and its customer calls on a performance bond. Thornmere's claims team opens the file and finds a bond for $4.2 million, signed by Kestwick in Thornmere's name. Thornmere's records show $1.5 million.

That is the order in which the real case unfolded. In Markel, the High Court found that the coverholder had written bonds above the binder's financial limits, and that the insurers learned of it when claims came in. One insurer was contacted by a beneficiary about a claim on bonds written in breach of the limits; Markel "then learnt that a bond had been written in breach of the financial limits" when a firm the coverholder had appointed to handle a claim, itself in breach of the binder, got in touch (Markel International v Surety Guarantee Consultants [2008] EWHC 1135 (Comm)). The court's annex listed 33 bonds written above the agreed limits between February and November 2005.

What happens when an MGA exceeds its authority? Month 19 back to month 14

Once the first over-limit bond surfaces, the insurer has to find the rest, and that is much harder than finding the first. Thornmere's oversight team now knows its bordereaux understated at least one bond. It does not know which others. It seizes Kestwick's files under the agreement's access clause, reconciles bond numbers, premiums and beneficiaries, and suspends Kestwick's authority while it works.

The model law gives it the tools for those steps: the right to access and copy all of the MGA's records, the right to end the contract for cause and to suspend the MGA's underwriting authority while a dispute over the cause runs (NAIC Model #225, §4A, §4D). It also makes the investigation the regulator's business. The model treats the MGA's acts as the insurer's and lets the MGA be examined as if it were the insurer; Florida's statute uses the same words (Fla. Stat. § 626.7452). So a breach that reaches a pattern is not only a commercial dispute. It is something the insurer may have to explain to its examiners.

Month 14: why do audits miss authority breaches?

Audits miss authority breaches for two reasons: a sample may not include the breaching files, and the files may not show the breach. At month 14, Thornmere's semi-annual on-site review of Kestwick picks 14 bond files at random. Every one is within the limits. The report notes no significant issues with the bordereaux.

The real audit in Markel was the same size and reached the same conclusion. The auditor reported no significant issues with the bordereaux of risks bound and premium settled, and the bonds issued for sums above the limits went undiscovered (the court's words are quoted in audit sampling methods). The court found the files had been arranged to hide them: in their place were documents purporting to be bonds within the limits. On why the auditor missed them, the judge allowed for both explanations:

The reason why the true Markel bonds were not found must have been either that the auditor saw the dummy bonds and the Templeton bonds or, possibly, that the sample bonds did not include those which breached the limits.

Markel International v Surety Guarantee Consultants [2008] EWHC 1135 (Comm), footnote 5

The second explanation is ordinary arithmetic. The auditing standard for public-company audits defines sampling as applying a procedure to fewer than all the items, and warns that the smaller the sample, the greater the risk it misleads (PCAOB AS 2315). A random sample of 14 files from a book of 200 bonds is more likely than not to miss every breach if fewer than ten of them are bad.

The first explanation, doctored files, is the harder one, and it limits every method that reads only what the delegate supplies. The same standard says so: an auditor can test every transaction and still miss a material misstatement, and its own example, that confirming the receivables on the books cannot reveal the ones left off, is exact for this case (quoted in bordereaux software). Checking reported bonds cannot, by itself, reveal unreported or misreported ones.

How are binder breaches found? Months 2 to 13, line by line

Binder breaches are found in one of three ways: from the bordereau, if it reports the risk truthfully; from internal inconsistencies in the bordereau, if it does not; or from outside data, such as claims, bank statements or the beneficiary, when both fail. Kestwick's monthly bordereaux for months 2 to 13 are where the first two had their chance.

In month 2, Kestwick's underwriter emails Thornmere: "Principal wants 4.2 on this one, can we go above 1.5?" Nobody at Thornmere named in the binder replies. Kestwick binds anyway. If the month 2 bordereau reports the bond at $4.2 million, a line check catches it the morning the file lands: the bond is 280% of the any-one-bond limit, and the search for written agreement finds a question, not an answer. That is the clean case, and on the fictional sample book in Binding Authority Compliance, it is the common one: row 287 on Larkspur's September bordereau was reported truthfully at $9.14 million against a $7.5 million line, and the only trace of agreement was an unanswered email.

The clean case in Binding Authority Compliance: an over-limit risk caught next morning

If the bordereau reports $1.5 million instead, the line check on the limit passes. The question is whether anything else on the line gives it away. In Markel the court found the bordereaux misstated more than amounts: Canadian bonds written in December 2005 did not appear on the bordereaux until April 2006, and their territory was stated as the UK rather than Canada. Misreporting tends to leave traces in fields other than the one it targets.

The table is the honest version of the case for checking every line. Where a delegate reports what it bound, an every-line check turns a 20-month discovery into a next-morning one. Where it lies about one field, cross-checks on other fields often catch it. Where it lies about everything and hides the money, no bordereau check helps; that is fraud, and finding it takes the kind of evidence an English court relied on in a 2022 case, where accountants compared the coverholder's premium bordereaux with its bank statements and found the premium had been substantially under-declared. Working beside the tools you have describes that case and how the premium side is reconciled.

Can a regulator examine an MGA?

Yes. Under the NAIC model act an MGA may be examined as if it were the insurer, and states that follow the model, such as Florida, say the same in statute. Texas, which wrote its own MGA law, provides that an MGA shall submit to an examination of its financial condition and compliance "As the commissioner considers necessary" (Tex. Ins. Code § 4053.107). Examiners can also reach the MGA through the insurer, by asking for its MGA contracts, its review reports and its evidence of oversight.

That is why a breach the insurer did not find is worse than one it found and handled. An examiner who learns of Kestwick's bonds from the insurer's own breach file, with dates, decisions and the suspension, sees oversight working. One who learns of them from a guaranty fund, a receiver or a court sees the opposite. A file that holds up sets out what that breach file should contain.

Breaches per 1,000 risks by coverholder in Binding Authority Compliance

What is an authority limit in insurance?

An authority limit is the largest or riskiest piece of business someone may commit the insurer to without asking first. Inside an insurer it is written into each underwriter's letter of authority, the subject of underwriting authority levels, and why authority limits are established covers the risks those letters cap. For an MGA or coverholder the limits are in the binding authority agreement, and the model law requires at least eight of them: maximum premium volume, rate basis, permitted risks, maximum limits of liability, exclusions, territory, cancellation terms and maximum policy period.

The difference between the two is timing. An employee who exceeds a letter of authority usually does so inside the insurer's own systems, where a referral rule can stop the bind. An MGA binds in its own systems, and the insurer sees the result only on the next bordereau. Every MGA authority limit is therefore checked after the fact, which is why the gap between bind and check, not the existence of the limit, decides how much a breach costs.

What is a special acceptance?

A special acceptance is the insurer's agreement, given in advance and in the form the binder requires, to a risk the binder would otherwise not allow. The Markel binder had one: the maximum bond period was "3 years (unless specially accepted)", and some aggregate limits could be exceeded where "first agreed" with Markel. The court read those provisions strictly. It held that "The Binding Authority does not expressly contemplate that any other limits may be exceeded by agreement", and found that Markel's underwriter had no actual authority to exceed the per-bond financial limit.

Two practical rules follow. A special acceptance should exist before the bind, in writing, from someone the binder names. And it should be findable later, because the insurer's monitoring has to tell a permitted exception from a breach. Binding Authority Compliance's referral matcher counts agreement only when it is in writing from an underwriter named in the binder's schedule, and quotes what it found either way; a question asking for an exception, like Kestwick's month 2 email, is recorded as a question. What one breach costs follows the money once a breach is confirmed, and Binding Authority Compliance shows the checks on the sample binder.

Questions people ask

Can an MGA exceed its authority with the underwriter's verbal approval?

Only if the binder allows it, and most require written agreement. In Markel the court found the insurer's underwriter had no actual authority to exceed the per-bond limit and had not been held out as having any, beyond the variations the binder itself contemplated.

What is the first thing an insurer should do when it finds an MGA exceeded its limit?

Establish the facts on the record: the risk, the clause, the figures and whether any written agreement exists. Then decide the risk (keep, co-insure or cancel) and the relationship (notice, restriction or suspension), each with a named decider. The model law lets the insurer suspend underwriting authority while a dispute over cause for termination runs.

How long do authority breaches go undetected?

As long as the gap between the bind and the next check that could see it. With every line checked, that is the bordereau lag, a few weeks; with sampled on-site reviews at least twice a year, a breach the sample misses can run until a claim. In Markel the over-limit bonds were written from February 2005 and came to light after August 2006.

Does checking every bordereau line catch fraud?

Some of it. It catches breaches reported truthfully and many that leave traces in other fields, such as premium, dates, territory or claims. It cannot reveal business that was never reported or reported falsely in every field; the PCAOB's standard makes the same point about unrecorded items, and that needs outside evidence.

Who is liable when an MGA exceeds its authority limit?

Toward the policyholder the insurer usually stands behind the policy; between insurer and MGA, the MGA and, where they acted dishonestly, its people. In Markel, three individuals were held liable for conspiracy and another for procuring a breach of contract, while the coverholder itself was in liquidation.