Marsh McLennan Agency

United States · www.marshmclennanagency.com · 19 vendors

Marsh McLennan Agency (MMA) is a wholly owned subsidiary of Marsh, dedicated to serving the insurance needs of middle-market organizations in the US and Canada. It provides business insurance, employee health & benefits, retirement & wealth, and private client insurance solutions. MMA combines personalized local service with the global resources of its parent company, Marsh McLennan.

Resilience scores

Technology vendors

Insights

Last updated 2026-07-29 · revision 1

19 direct vendors, 230 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Marsh McLennan Agency exhibits medium migration readiness. The company's internal tech stack presents a strong foundation for migration, with significant adoption of cloud-based platforms like Microsoft Azure, Salesforce, Microsoft 365, and Generative AI/LLM. This indicates an existing comfort and investment in modern, scalable infrastructure, which can significantly ease future migration efforts. However, several challenges exist. Key information regarding the regulatory environment and data residency requirements is missing, which could introduce substantial complexities and costs during migration planning and execution. The financial stability (revenue concentration, growth history) is also unknown, impacting the ability to fund a large-scale migration. The assessment of vendor lock-in is hampered by contradictory data ('Total Vendors: 0' vs. 'Total Services: 20' and vendor HQ countries). While vendor geographic diversity exists across two countries (United States, France), the overall vendor landscape and potential for lock-in remain unclear, posing a risk to migration flexibility. The absence of explicit mention of cloud-native architectures like containerization or microservices suggests that some existing applications might still be monolithic, potentially requiring refactoring during migration.

Compliance

11 in-scope frameworks identified; showing 3.

CPRA — Assessment Required

Risk is High because MMA operates extensively in California (San Diego, CA is home to the Chief Revenue Officer and Chief Marketing Officer, indicating significant California operations), processes personal data of California residents at scale, and exceeds all CCPA/CPRA thresholds (annual gross revenues over $25M, processes data of 100,000+ consumers). The CPRA (effective January 1, 2023) expanded CCPA rights and created the California Privacy Protection Agency (CPPA) with dedicated enforcement authority. Fines of up to $7,500 per intentional violation apply. Insurance data has specific CCPA exemptions, but MMA's non-insurance data processing (HR, marketing, website analytics) is fully subject to CCPA/CPRA.

Evidence: https://www.marshmma.com/us/privacy-notice.html, https://www.marshmma.com/us/mma/about-us.html, https://cppa.ca.gov/regulations/, https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100

GDPR (source) — Assessment Required

Marsh McLennan Agency (MMA) is headquartered in the United States and primarily operates across the US and Canada. However, its parent company, Marsh & McLennan Companies (NYSE: MMC), advises clients in 130 countries and has significant EU/EEA operations. MMA itself processes personal data of employees, clients, and partners who may include EU/EEA residents, particularly given the global reach of the Marsh parent entity. The risk is Medium rather than High because MMA's own direct EU operations are not clearly documented, but the parent group's global footprint and shared data infrastructure create a plausible GDPR exposure. Non-compliance penalties can reach €20M or 4% of global annual turnover (~$960M based on Marsh's $24B revenue), making this a material financial risk. Enforcement by EU DPAs against large financial services groups is well-documented.

Evidence: https://www.marshmma.com/us/privacy-notice.html, https://www.marshmma.com/us/mma/about-us.html, https://www.marshmclennan.com/about/privacy.html, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

ISAE 3000 (source) — Assessment Required

ISAE 3000 risk is Low for MMA as a primary regulatory concern. ISAE 3000 is primarily relevant to organizations that provide assurance reports to third parties (e.g., auditors issuing sustainability or controls reports). MMA is an insurance broker and benefits administrator, not an assurance provider. However, MMA's parent company Marsh & McLennan Companies may issue ISAE 3000 reports in connection with ESG disclosures or third-party assurance engagements. The risk is Low because ISAE 3000 non-compliance does not carry direct regulatory penalties for MMA's core business activities, and the framework is not a primary regulatory requirement for insurance brokers.

Evidence: https://www.marshmma.com/us/mma/about-us.html, https://www.iaasb.org/publications/international-standard-assurance-engagements-isae-3000-revised-assurance-engagements-other-audits

Financials

Three-year financials

Financial Resilience Score: 8/10

Marsh McLennan Agency benefits from being a wholly-owned subsidiary of Marsh McLennan (NYSE: MMC), an A-rated S&P 500 parent with consolidated revenue of $24.5B in 2024, operating margin of 22.5%, and net income of $3.76B. This provides MMA with substantial capital access, scale advantages, and cross-sell opportunities with sister businesses Mercer, Oliver Wyman, and Guy Carpenter. The parent's stockholders' equity of $11.58B and consistent double-digit operating income growth reinforce financial stability. MMA's business model is inherently resilient: as a broker/agency, it does not carry underwriting risk on its balance sheet. Its revenue is commission-based and recurring, with high client retention typical of the P&C brokerage industry (industry averages ~90%+). The middle-market focus across Business Insurance, Employee Health & Benefits, Private Client Services, and Retirement & Wealth provides diversification. MMA has grown consistently at high single- to low double-digit organic rates (15% in 2022, 14% in 2023, 10% in 2024), supplemented by 90+ acquisitions since 2008. However, the transformational McGriff acquisition (~$7.75B in November 2024) and Graham Company deal (November 2023) introduce meaningful integration risk. MMC's goodwill exceeded $22B by FY24-end, and parent leverage has increased due to debt issued for McGriff. Additional risks include the softening commercial P&C pricing cycle, interest rate sensitivity on fiduciary investment income, and intense competition for producer talent from Aon, WTW, Gallagher, Brown & Brown, Hub, and Acrisure.

Key strengths: Backed by A-rated S&P 500 parent Marsh McLennan (MMC) with $24.5B revenue and 22.5% operating margin, High client retention (~90%+) and recurring commission-based revenue model, Diversified middle-market book across Business Insurance, Health & Benefits, Private Client, and Retirement, No underwriting risk on balance sheet (broker/agency model), Proven M&A engine with 90+ acquisitions since 2008 founding, Consistent high single- to low double-digit organic growth (10-15% annually), Cross-sell opportunities with Mercer, Oliver Wyman, Guy Carpenter

Risk factors: Integration risk from large McGriff ($7.75B) and Graham Company acquisitions, Elevated goodwill and intangibles at parent level (>$22B by FY24-end), Increased parent leverage from debt-financed McGriff acquisition, Soft commercial P&C pricing cycle in 2024-2025 may compress commission revenue, Interest rate sensitivity on fiduciary investment income, Intense competition for producer talent from Aon, WTW, Gallagher, Brown & Brown, Hub, Acrisure

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report