The insurers have been ordered to overhaul compensation structures, strengthen sales oversight and submit externally reviewed remediation plans by November.
External committee linked sums to 159 current and former staff and 794 customers, and said it found structural failings in sales management, culture, and governance.
The exercise aims to help insurers further strengthen cyber risk management frameworks and keep pace with increasingly severe and sophisticated cyber threats.
The companies argue the regulator failed to assess the acquisition as part of their broader strategic alliance, including distribution and brand licensing arrangements.
