Brian Morrissey, Head of Insurance, and our insurance team have compiled a collection of KPMG's latest publications and articles which focus on developments in, and issues facing the insurance industry. Also included are recent publications from the CBI, EIOPA, and other European bodies.
KPMG updates
Introduction to Model Risk Management
This is the Thought Leadership series where KPMG Actuarial explore the world of Model Risk Management. Throughout this series KPMG breaks down what Model Risk Management really is, taking a look from a broad industry perspective, and then through the lens of insurance to understand its growing importance within the industry. In this first publication of a four-part series, KPMG explores Model Risk Management from a broad industry perspective.
Consultation on AI in finance
The European Commission recently launched a targeted consultation along with a workshop series to seek input on the use of Artificial Intelligence (AI) in the financial sector. The consultation aims to identify key use cases, benefits, barriers, and risks associated with AI applications in financial services.
The views obtained will support the Commission in their assessment of market developments and risks related to AI and in the implementation of the AI Act, which was published on the 12 July and will enter into force on the 1 August. The KPMG Actuarial team (led by Brian Morrissey, Head of Insurance and Actuarial and Jean Rea, Actuarial Partner) discusses how to respond to the Consultation and the insurance and pensions specific questions.
DORA - 5 steps on your digital resilience journey
With the upcoming Digital Operational Resilience Act (DORA), entities must move from preparation to implementation and take steps towards demonstrating how their practices comply with DORA. Financial entities will need to demonstrate appropriate security and resilience of critical ICT systems and applications to comply with DORA. The level of compliance efforts will vary depending on the size and complexity of your entity.
A risk-based approach, appropriate security and resilience testing are necessary to address potential vulnerabilities and to prove compliance in meeting evidence requirements of the European Supervisory Authorities. By focusing on long-term resilience, entities can establish a resilient foundation, which will aid them in their steps towards DORA compliance.
The KPMG Technology Risk and Cyber teams (led by Jackie Hennessy, Risk Consulting Partner and Dani Michaux, EMA Cyber Leader) share their in-depth views on key actions to help you get ready for DORA.
Central Bank of Ireland updates
New Supervisory Approach
The Central Bank of Ireland (“CBI” or “Central Bank”) announced that it will be making changes to its operating structure and supervisory approach. The Central Bank plans to implement these changes early in 2025.
Under the new operating structure, there will be three directorates responsible for sectoral supervision: a Banking & Payments Directorate, an Insurance Directorate and a Capital Markets & Funds Directorate. All three directorates will have integrated teams responsible for all elements of the Central Bank’s mandate (i.e., consumer and investor protection, safety and soundness, financial stability, and integrity of the system) and supervising risks as they relate to the sector.
There will also be a Horizontal Supervision Directorate working in partnership with the sectoral supervisory teams on a system-wide and thematic basis; this directorate will provide specialist input on key cross-sectoral risks such as conduct, behaviour and culture, anti-money laundering and terrorist financing, financial resilience, operational resilience and technology risks.
In addition, there will be a Supervisory Risk, Analytics and Data Directorate; a Policy and International Directorate; and an Enforcement Directorate.
Application for Authorisation Guidance and Checklists
In July, the Central Bank published a new Guidance on Completing and Submitting (Re)Insurance Authorisation Applications and a new Checklist for Completing and Submitting Life, Non-Life or Captive (Re)Insurance Authorisation Applications. The new Guidance and Checklist is relevant to entities who wish to establish a head office in Ireland to carry out the business of insurance or reinsurance.
Open Data Portal
The Central Bank collects and analyses a wide range of data in support of various aspects of its mandate. This includes data on credit and deposits, mortgage arrears, interest rates, investment funds, securities markets developments, Quarterly Financial Accounts, insurance and pension fund sectors, and the National Claims Information Database. The Central Bank has now developed a new Open Data Portal using international open data standards to make this data easier to access, reuse and redistribute.
Fitness & Probity
In June, the Central Bank published its guidance in respect of the updated PCF application process. The guidance applies to all financial services firms that are to submit an Individual Questionnaire for individuals who are put forward to hold Pre-Approval Controlled Functions (PCFs) through the Central Bank of Ireland Portal.
Senior Executive Accountability Regime
On 1 July, the Senior Executive Accountability Regime (SEAR) came into effect. The Central Bank published 'Senior Executive Accountability Regime (SEAR) Systems “How To” Guide' which in-scope firms should refer to when submitting Statements of Responsibilities and/or their Management Responsibilities Map via the Central Bank Portal and the European Central Bank (ECB) Information Management System (IMAS) Portal.
Implementing DORA in European financial services
On 1 July, the Central Bank published a speech given by the Director of Financial Regulation, Policy and Risk at the Central Bank and Chair of the Joint European Supervisory Authorities (ESAs) Sub-Committee on Digital Operational Resilience, Gerry Cross, at the Institute of International Finance and Amazon Web Services entitled “Implementing DORA – Achieving enhanced digital operational resilience in European financial services”.
On the very tight implementation timelines, Mr Cross noted that “while legal requirements remain legal requirements, there is often merit in seeing the value in a committed journey by firms and supervisors from initial implementation and compliance to a richer, more fully achieved implementation over time”.
Review of F&P Regime
On 11 July, the Central Bank published a report on the independent review of its Fitness and Probity (F&P) regime. The review was conducted by Andrea Enria, the former Chair of the European Central Bank (ECB) Supervisory Board. The consultation involved engagement with stakeholders, including all relevant industry associations, individual firms, legislative and policymaking bodies, as well as staff in the Central Bank and other Irish authorities.
An analysis of good practices at other supervisory authorities in the EU, the UK and Australia was a key element of the review. The review concluded that the conduct of the F&P regime at the Central Bank is broadly in line with peer regulators in different jurisdictions across a number of dimensions:
- Standards are comparable and robust supervisory judgement is utilised;
- Statistics on outcomes (approvals, withdrawals of applications, refusals) are in line with other supervisory authorities and do not signal either a particular stringency or leniency of the process; and,
- Timelines are well aligned with the target service standards and generally faster than in other countries.
The review also highlighted the need for targeted improvements in process consistency across firms of different sizes which are operating in different financial sectors. The recommendations focus on three areas:
- Clarity of supervisory expectations,
- Governance of the process, and the fairness, and
- Efficiency and transparency of the process.
The review identified several areas in which the operation of the F&P regime could be improved including the creation of a new unit to bring together all F&P work. The recommendations of the review will be implemented over the coming months and should be in place by the end of the year.
European Insurance and Occupational Pensions Authority Updates
Cross-Border Co-operation
On July 1, the European Insurance and Occupational Pensions Authority (EIOPA) issued an amended ‘Decision of the Board of Supervisors (BoS) on the Collaboration of the Insurance Supervisory Authorities of the Member States of the European Economic Area (EIOPA-BoS-24/273) whereby a new Annex II is added. The new Annex II deals with the cooperation and exchange of information between insurance supervisory authorities in the event of (re)insurance undertakings’ cross-border conversions, mergers and divisions under the new Mobility Directive (Directive (EU) 2019/2121). A related EIOPA press release explains that supervisory co-operation involves:
- Active and early engagement between supervisors in the departure and destination countries.
- A structured transfer of supervisory information and knowledge about the relocation of undertakings that aims to safeguard the interests of policyholders and beneficiaries throughout and after the transition.
- Supervisory authorities potentially being provided with technical assistance and expertise by EIOPA during the transition, particularly in complex cases or where specific guidance is required.
Opinion on supervision of Captive Insurers
On 2 July, EIOPA published an ‘Opinion on the Supervision of Captives’, regarding the supervision of captive (re)insurance undertakings with a focus on intra-group transactions, governance and prudent person principle. The opinion outlines the supervisory expectations of competent authorities while considering the specificities of captive (re)insurer’s business models.
Symmetric adjustment of the equity capital charge for Solvency II
On 3 July, EIOPA published its most recent technical information on the symmetric adjustment of the equity capital charge for Solvency II with reference to the end of June 2024.
Solvency II Relevant Risk-Free Interest Rate Term Structures
On 3 July, EIOPA published its most recent technical information relating to risk-free interest rate (RFR) term structures with reference to the end of June 2024.
Rates for duration calculation in financial stability reporting
On July 3, EIOPA published the shifted risk-free interest rate (RFR) term structures. The shifted RFR term structures aim to ensure consistent calculation of the option-adjusted duration. The next update is planned for January 2025.
ESAs - DORA
On July 17, the ESAs published their second batch of policy materials under the Regulation on digital operational resilience for the financial sector (DORA), consisting of the following:
- Final report on draft regulatory technical standards (RTS) and implementing technical standards (ITS) on the content, format, templates and timelines for reporting major information and communication technology (ICT) related incidents and significant cyber threats.
- Final report on draft RTS on the harmonisation of conditions enabling the conduct of the oversight activities under DORA. These RTS relate to the criteria for determining the composition of the joint examination team (JET).
- Final report on draft RTS on the harmonisation of conditions enabling the conduct of the oversight activities.
- Final report on draft RTS specifying elements related to threat-led penetration tests (TLPT).
- Final report on joint guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents.
- Final report on joint guidelines on the oversight co-operation and information exchange between the ESAs and the competent authorities.
The guidelines have been adopted by the Boards of Supervisors of the three ESAs and the final draft technical standards have been submitted to the European Commission (EC) for adoption. The expected date of application of the technical standards and guidelines is 17 January 2025.
Framework for systemic cyber incidents
On July 17, the ESAs announced they will establish an EU systemic cyber incident co-ordination (EU-SCICF) in the context of DORA. The framework will enable a holistic financial sector response to a cyber threat that may pose a risk to financial stability by strengthening co-ordination amongst financial bodies and relevant bodies within the EU and internationally. A factsheet was published with further details on the structure, how it will work and how it will be set up.
UK Updates
Insurance multi-firm review of outcomes monitoring under the Consumer Duty
On 26 June, the Financial Conduct Authority (FCA) published a review which sets out the key findings from the FCA's review of larger insurance firms’ approaches to outcomes monitoring under the Duty.
Solvency II: Matching Adjustment Permissions
On 6 June, the Prudential Regulation Authority (PRA) published a statement of policy which sets out the PRA’s approach to granting MA permissions, as well as variations to those permissions and the circumstances in which the PRA may take the decision to revoke a firm’s MA permission. It also sets out how the PRA will assess the ongoing performance of the MA permissions framework.
Solvency II: Bank of England/Ipsos Inflation Attitudes Survey
On 14 June 2024, the PRA published their quarterly survey, conducted by Ipsos, which assesses public attitudes to inflation, opinions about the Bank and awareness of our work.
Other European and International Supervisory Authority Updates
Solvency II equivalence decision for US
On 21 June, the Commission Delegated Decision (EU) 2024/1763 on the renewal of the determination that the solvency regime applicable to US-based (re)insurance undertakings is provisionally equivalent to that laid down in the Solvency II Directive (2009/138/EC) was published in the Official Journal of the European Union.
The Solvency II Directive provides that provisional equivalence granted under Article 227 of the Solvency II Directive is subject to renewals for further periods of ten years where certain specified criteria continue to be met. The provisional equivalence granted to the US (among other non-EU jurisdictions) under Commission Delegated Decision ((EU) 2015/2290) expires on 1 January 2026.
The Delegated Decision will renew the US provisional equivalence for ten years from 1 January 2026 to 31 December 2035. Provisional equivalence under Article 227 would be relevant to the calculation of group SCR.
EU AI Act
On 12 July, the Official Journal of the European Union (OJEU) published the regulation of the European Parliament (EP) and of the Council of the European Union (CoEU) on harmonised rules on artificial intelligence (AI Act) and will enter force 20 days later. The AI Act will enter force on 1 August 2024. Most provisions will start to apply on 2 August 2026 but some rules will apply earlier:
- Prohibited AI systems will be banned from 2 February 2025.
- Penalties and the rules on general-purpose AI models will apply from 2 August 2025
IAIS Newsletter June 2024
On 1 July, the International Association of Insurance Supervisors (‘IAIS’) published its newsletter for June 2024. The newsletter included areas of focus for the IAIS and updates on the work that is currently carried out by the association.
Climate Risk Supervisory Guidance
On 15 July, the International Association of Insurance Supervisors (IAIS) published its fourth consultation on climate risk in the insurance sector. This is the last of a series of four consultations on proposed changes to guidance relating to various insurance core principles (ICPs). The IAIS seeks views on proposed changes to ICP guidance and supporting material to reflect climate risk:
- Draft application paper on public disclosure and supervisory reporting of climate risk. This draft paper provides supervisors with advice on how ICP 9 (Supervisory Review and Reporting) and ICP 20 (Public Disclosure) may be applied in the context of climate-related risk. It is important for supervisors to consider the issues of climate-related financial disclosure and supervisory reporting holistically to ensure that adequate information is shared with policyholders, market participants and supervisors.
- Draft supporting material on macroprudential and group supervisory issues and climate risk. This document provides further advice, illustrations, recommendations, and examples of good practice to supervisors on how ICP 24 (Macroprudential Supervision) may be implemented in the context of climate-related risk drivers. It builds on the existing application paper on macroprudential supervision.
The IAIS plans to hold a public background session on the draft documents on 27 August 2024 and comments on the drafts can be submitted until 30 September 2024.
Corporate Sustainability Reporting Regulations 2024
On 5 July, the European Union (Corporate Sustainability Reporting) Regulations 2024 were signed into law by the Minister for Enterprise, Trade and Employment Minister Peter Burke and will come into effect on 6 July. The Regulations will require large and listed companies to report sustainability information in accordance with the European Sustainability Reporting Standards within the directors' report. The reporting is to also include an auditor’s opinion with limited assurance and reported digitally. Minister Burke noted the benefit the regulations will have on companies and all relevant stakeholders:
“These Regulations provide a helpful structure to companies for preparing sustainability reporting in a clear and consistent way, that gives the relevant information to investors, consumers, and other stakeholders, whilst minimising unnecessary burdens on companies.”
EIOPA Q&A Updates
Please see below for EIOPA’s response to recent queries which have been raised by the public for further clarification on the Solvency II requirements. The Solvency II requirements may change or become more prescriptive over time.
17 June: QRT S.04.03, S.04.04, S.04.05
EIOPA clarified in Q&A (#3079) that:
- S.04.03 shall include underwriting entity codes for the Head Office and any Branch located in a non-EEA country.
- In S.04.04, consistently with S.04.03, business should be reported as underwritten by the head office and the branch located in the non-EEA country.
- Template S.04.05 should be reported. This template has an associated materiality threshold so that country-by-country reporting is only necessary for 95% of the business, with the remaining business grouped as “other countries".
18 June: QRT S.04.04
EIOPA clarified in Q&A (#3073) that if a company has a business outside Europe this is also to be reported, with the specifics of how the business is written determining which templates are required. If the business is written by a third country branch, countries outside of Europe will be included in both the location of underwriting and location of risk views. If business outside Europe is written directly (e.g. fronted business on a non-admitted basis), it may be that the non-European countries are only included on a location of risk basis.
18 June: QRT S.04.04
EIOPA clarified in Q&A (#3039) that the location of underwriting for QRT S.04.04 for Co-insurance contracts should show the country of the underwriting entity.
18 June: QRT S.14.03
EIOPA clarified in Q&A (#3037) that for the purpose of C0060 in template S.14.03, the expression of contingent business interruption includes any type of business interruption risk that affects the policyholders.
18 June: QRT S.14.03
EIOPA clarified in Q&A (#3036) that for the purpose of C0040 in template S.14.03, if two commercial products have the same Product Identification and the same set of lines of business, but refer to different risk coverages, then there will be as many line identifier reported as needed to reflect the number risk coverages. Products within the same Product Identification that do not share the same risk coverages cannot be aggregated and therefore should have different Product Group Codes.
18 June: QRT S.14.03
EIOPA clarified in Q&A (#3035) the reporting field C0030 in S.14.03 allows only a single selection. However, in exceptional cases (that need to be assessed on a case by case basis) where the same product code identifies products with multiple product identifications, multiple rows may be filled in reporting the same product code, but different product identifications or lines of business. In exceptional cases, mostly related to non-proportional reinsurance contracts, the amounts included in fields from C0060 to C0140 could be provided as an estimation.
18 June: QRT S.08.01
EIOPA clarified in Q&A (#3014) that spot positions should be reported in template S.06.02 (list of assets). The template S.08.01 is limited to derivatives reporting only.
18 June: QRT S.06.02
EIOPA clarified in Q&A (#2983) that item C0293 Bail-in rules, is to be reported also with "Yes" for CIC 7 referred to insurance life products.
18 June: QRT S.06.04
EIOPA clarified in Q&A (#2850) that the full value of the property should be taken into account in the KPI.
Further information
For more on any of the items above, or any Insurance-related queries, contact Brian Morrissey, Head of Insurance. We'd be delighted to hear from you.
