The policy outlives every contract behind it

In 2022 our contract with Gemmaldi Informatica for hosting, operating and maintaining the life policy ledger was due to expire in March 2023. Gemmaldi offered a ten-year renewal at €4.3 million a year, down from €5.0 million. Exit assistance was limited to six months at daily rates, and the draft gave us no right to rehearse a migration. The ledger held 391,000 in-force contracts, including every segregated-fund policy carrying a minimum credited rate.

The chief financial officer favoured the ten-year offer, and the saving was genuine. I was worried about committing until 2033 to one operator of our most important obligations, with no tested route out and terms already short of DORA's coming expectations. Having worked at Gemmaldi until 2006, I declared that history, and the chief risk officer co-chaired the evaluation.

I proposed five years with a two-year option at €4.9 million a year. The contract added a written exit plan, a full extraction rehearsal in its second year, audit and access rights for Corvelline and our supervisor, prior notice of sub-contractors, incident notification within four hours and named knowledge transfer for six roles. Against the ten-year price, we gave up €3.0 million over five years. The risk committee supported the proposal and the board approved it in December 2022.

In the September 2024 rehearsal, the full ledger was extracted, loaded and reconciled in an independent environment in twelve days, against twenty planned. We found seventeen undocumented batch interfaces and corrected the exit plan. When DORA applied in January 2025, the register entry for Gemmaldi needed two contractual clarifications rather than a renegotiation.

The decision changed how the board discusses suppliers: directors now ask for the cost of leaving beside the cost of staying. I also made a costly omission. The rehearsal first excluded the valuation feed to our actuarial models, and adding it later cost €210,000. Next time I would define exit scope with actuarial and finance colleagues before the first draft, not after the test.

In early 2023, eleven Corvelline specialists maintained the product rules and year-end revaluation programs for our closed savings books. Their average age was fifty-nine, and five expected to retire by the end of 2026. Covering for them with contractors at about €850 a day had cost €1.5 million in 2022. The logic for 214 legacy variants lived largely in code and in those colleagues' memories.

I proposed hiring six engineering graduates into a two-year paired programme and writing a rulebook, signed off by the actuarial function, for every variant with live policies. The cost was €1.3 million over two years. To fund it within budget, I deferred moving our analytics warehouse to the cloud by nine months. The head of data and analytics objected with good reason: her team had promised faster reporting to finance. The chief financial officer asked why we would invest in skills for a platform we meant to leave. My answer was that leaving would take years, the policies would stay in force for decades, and we could not migrate rules we were unable to describe.

The graduates rotated through product changes, revaluation runs and incident support, each beside a specialist.

The rulebook covered all 214 variants after fourteen months. It found nine variants where code and policy conditions disagreed. With the actuarial function we corrected them: 2,140 policyholders received €312,000 in additional credited amounts, and we reported the matter to the board. In December 2025 the year-end revaluation ran without external contractors for the first time, and 2025 contractor spending fell to €0.6 million. Five of the six graduates remain with us. The warehouse migration finished in July 2025, nine months later than first planned.

I would change two things. I would recruit career-changers as well as graduates, because two strong applicants were rejected for lacking a recent degree. And I would place actuaries inside the pairs from the start, rather than asking them to review finished documents.

On 14 October 2025, our monitoring flagged logins to twenty-three broker portal accounts from unfamiliar networks, using passwords reused from breaches elsewhere. One session viewed the records of forty-one policyholders, including addresses and contract values, before we suspended the accounts. The portal had 1,900 users across 420 broker firms, and multi-factor authentication was optional; about a third used it. December, when many savers make their pension contributions for the year, was seven weeks away.

The data-protection officer concluded that the access was notifiable under GDPR. We notified the Italian data-protection authority within seventy-two hours and wrote to the forty-one policyholders. Against DORA's major-incident criteria it fell short; we recorded that classification and reported it to the risk committee.

The commercial director proposed phasing in compulsory authentication from February, after the December peak, to avoid disrupting brokers at their busiest. His concern was fair: a portal brokers could not use would send business to other insurers. I recommended making it mandatory for every user by 2 November, nineteen days after detection. The reused passwords could be tried again at any moment, and December would concentrate the access an attacker wanted. The chief executive accepted my recommendation.

We gave up convenience and money. We staffed a temporary helpdesk of eight people, supplied hardware keys to firms that could not use phone apps and opened a secure upload route for brokers not yet enrolled. The additional cost was €240,000. Some brokers were angry, and two firms complained formally.

By 1 December, 97.8 per cent of users had enrolled. December portal submissions reached 94 per cent of the previous December's volume, and most of the shortfall arrived in January. We have seen no further account takeover.

What I would do differently is uncomfortable. When we rebuilt the portal in 2021, I agreed to leave the second factor optional because brokers asked for it. That was my decision and it was wrong; correcting it during an incident cost far more than requiring it then.