Created using remix-ide: Realtime Ethereum Contract Compiler and Runtime. Load this file by pasting this gists URL or ID at https://remix.ethereum.org/#version=soljson-v0.5.0+commit.1d4f565a.js&optimize=false&gist=

SimpleRiskTransfer.sol

pragma solidity ^0.5.0;

contract SimpleRiskTransfer {
    
    modifier onlyRiskPool(bytes32 _metaDataHash) {
        require(riskOrders[_metaDataHash].riskPool == msg.sender);
        _;
    }
    
    modifier onlyCustomer(bytes32 _metaDataHash) {
        require(riskOrders[_metaDataHash].customer == msg.sender);
        _;
    }
    
    event OrderCreated(address _customer, bytes32 _metaDataHash);
    event OrderQuoted(address _riskPool, bytes32 _metaDataHash, bytes32 _quoteHash);
    event QuoteRefused(address _customer, bytes32 _metaDataHash);
    event QuoteAccepted(address _customer, bytes32 _metaDataHash);
    event RiskBound(address _riskPool, bytes32 _metaDataHash);
    
    enum orderState {initial, open, quoted, applied, bound}
    
    struct riskOrder {
        orderState state;
        address customer;
        address riskPool;
        bytes32 quoteHash;
    }

    mapping (bytes32 => riskOrder) public riskOrders;
    
    /**
     * @dev Creates a Risk Order.
     * @param _metaDataHash is a IPFS hash which points to some policy/risk metadata.
     */
    
    function createOrder(bytes32 _metaDataHash) public {
        require(riskOrders[_metaDataHash].state == orderState.initial);
        riskOrders[_metaDataHash].state = orderState.open;
        riskOrders[_metaDataHash].customer = msg.sender;
        emit OrderCreated(msg.sender, _metaDataHash);
    }
    
    /**
     * @dev Adds a Quote to a risk order.
     * @param _metaDataHash Identifier of the order
     * @param _quoteHash e.g. IPFS hash to quote metadata
     */
    function quoteOrder(bytes32 _metaDataHash, bytes32 _quoteHash) public {
        require(riskOrders[_metaDataHash].state == orderState.open);
        riskOrders[_metaDataHash].state = orderState.quoted;
        riskOrders[_metaDataHash].quoteHash = _quoteHash;
        riskOrders[_metaDataHash].riskPool = msg.sender;
        emit OrderQuoted(msg.sender, _metaDataHash, _quoteHash);
    }
    
    /**
     * @dev Refuses a Quote. Risk Order is reinitialized.
     * @param _metaDataHash Identifier of the order
     */
    function refuseQuote(bytes32 _metaDataHash) public onlyCustomer(_metaDataHash) {
        require(riskOrders[_metaDataHash].state == orderState.quoted);
        riskOrders[_metaDataHash].state = orderState.open;
        riskOrders[_metaDataHash].quoteHash = 0x0;
        riskOrders[_metaDataHash].riskPool = address(0x0);
        emit QuoteRefused(msg.sender, _metaDataHash);
    }
    
    /**
     * @dev Customer applies for Policy.
     * @param _metaDataHash Identifier of the order
     */
    
    function acceptQuote(bytes32 _metaDataHash) public onlyCustomer(_metaDataHash) {
        require(riskOrders[_metaDataHash].state == orderState.quoted);
        require(riskOrders[_metaDataHash].customer == msg.sender);
        riskOrders[_metaDataHash].state = orderState.applied;
        emit QuoteAccepted(msg.sender, _metaDataHash);
    }
    
    /**
     * @dev Risk Pool accepts request.
     * @param _metaDataHash Identifier of the order
     */
    
    function bindRisk(bytes32 _metaDataHash) public onlyRiskPool(_metaDataHash) {
        require(riskOrders[_metaDataHash].state == orderState.applied);
        require(riskOrders[_metaDataHash].riskPool == msg.sender);
        riskOrders[_metaDataHash].state = orderState.bound;
        emit RiskBound(msg.sender, _metaDataHash);
    }
    
}

SimpleRiskTransferWithToken.sol

pragma solidity ^0.5.0;

import "./SimpleRiskTransfer.sol";

contract IERC721 {
    /**
     * we only need a small subset of the interface 
     */
     
    function mint(address to, uint256 tokenId) public returns (bool);
}


contract SimpleRiskTransferWithToken is SimpleRiskTransfer {

    IERC721 policyToken;
    
    constructor(IERC721 _policyToken) public {
        policyToken = _policyToken;
    }

    /**
     * @dev Risk Pool accepts request.
     * @param _metaDataHash Identifier of the order
     */
    
    function bindRisk(bytes32 _metaDataHash) public onlyRiskPool(_metaDataHash) {
        super.bindRisk(_metaDataHash);
        policyToken.mint(msg.sender, uint256(_metaDataHash));
    }
    
}