International: Best Practices for EU Insurers Filing US ORSA Summary Reports

As part of Solvency II, which is scheduled to go into effect on 1 January 2016, the European Union will require insurers operating in the EU to conduct and file an Own Risk Solvency Assessment.

Similarly, the National Association of Insurance Commissioners, the leading insurance standard-setting and regulatory support organisation in the United States, promulgated a Risk Management and Own Risk and Solvency Assessment Model Act.

When adopted by a state, this will also require certain US domiciliary insurers licensed in that state to conduct and file an ORSA. EU insurers with entities domiciled in the US may have to file ORSA reports in both the EU and the US.

Material differences

An ORSA is a process by which insurers evaluate their own risks, business plans and capital management. Turning this process into formal reports for regulators is a new challenge facing insurers - especially those that need to file an ORSA in multiple jurisdictions.

Although insurers may be tempted to comply with US ORSA requirements by simply filing their EU ORSA report with US regulators, insurers should proceed with caution, as there are material differences between the two.

For starters, US regulators provide companies with freedom in terms of how to conduct an ORSA, while the EU ORSA requirements are more prescriptive.

Insurers should carefully consider whether they want to disclose all of the information provided to EU regulators to their US counterparts, as confidentiality laws vary in the US from state to state. Before filing a US ORSA, consider the following:

I. Assess whether you are required to file

The US exempts a larger class of insurers from filing ORSA reports than the EU. Under Solvency II, every insurer with €5m in direct premium is required to conduct and file an ORSA.

In the US, however, the threshold amount for direct premiums is significantly higher - $500m for individual insurers. And for insurance groups, more than $1bn of premium is required. Additionally, in the EU both individual and group insurers are required to file an ORSA - but in the US, either a group or an individual insurer files.

II. Understand the purpose

Once an insurer has determined that it must file a US ORSA, it needs to consider what should be included in the report.

In the EU, an ORSA is used as a check on the solvency needs and capital formulas used under Solvency II to determine insurers' solvency capital requirement. Insurers must compare their assessments with the SCR to determine if their risk profile deviates from it.

By contrast, the stated purpose of a US ORSA is to assess enterprise risk management capabilities to provide a group-level perception of risk and capital.

The NAIC ORSA Guidance Manual is deliberately non-prescriptive, because it takes the view that each ORSA will vary depending on risks specific to that insurer. The manual does, however, provide three overarching categories for organising the report:

(1) Description of the Insurer's Risk Management Framework: high-level summary of the insurer's own risk-management framework, including risk appetite, tolerance, limits and internal controls;
(2) Insurer's Assessment of Risk Exposure: insurer's detailed process for assessing qualitative and quantitative risks in normal and stressed environments; and
(3) Group Risk Capital and Prospective Solvency Assessment: a demonstration that current and future capital is sufficient to support the identified risks.

III. Confidentiality considerations

As mentioned above, EU ORSA requirements are far more prescriptive than those in the US. Therefore, more information will likely be included in the ORSA documents prepared for EU regulators than might be required under a US ORSA.

For example, the EU requires insurers to provide detailed, specific information about their capital, operations and risks, including identification of 'own funds' and an assessment of the availability or transferability of these funds.

In contrast, while a US ORSA also requires an assessment of risk capital requirements, it merely provides suggestions of the types of information supporting this assessment which insurers may consider including in their report.

Confidentiality issues

This is important because US confidentiality laws differ from state to state and may be less stringent than those that exist in the EU. Despite strong confidentiality language in the NAIC RMORSA - which would preclude the information contained in an ORSA filing from being disclosed by the regulator pursuant to a subpoena or civil litigation - each state ultimately passes its own ORSA laws. These laws may or may not adopt the confidentiality language of the NAIC RMORSA.

Even if a particular state's ORSA law includes confidentiality provisions, the information contained within the reports could still ultimately be disclosed. Freedom of information laws may already exist in a particular state, and state commissioners are generally entitled to share ORSA filings with other regulators - these are both potential avenues of disclosure.

Insurers should be aware of the possibility that whatever information is contained in their US ORSA filing may be publicly disclosed. Therefore, it is important to carefully evaluate the information included in a US ORSA.

Navigating the logistics of these reports, particularly when filing an ORSA in multiple jurisdictions, is challenging. Armed with the right knowledge, however, insurers can begin to submit their respective reports with comfort and confidence.

Kristi M Robles is an associate in the London office of Nelson Levine de Luca & Hamilton