This framework describes the
Federal Reserve’s approach to consolidated supervision of supervised
insurance organizations.
1 The framework
is designed specifically to account for the unique risks and business
profiles of these firms resulting mainly from their insurance business.
The framework consists of a risk-based approach to establishing supervisory
expectations, assigning supervisory resources, and conducting supervisory
activities; a supervisory rating system; and a description of how
Federal Reserve examiners work with the state insurance regulators
to limit supervisory duplication.
Consistent with the Federal Reserve’s
approach to risk-based supervision, supervisory guidance is applied,
and supervisory activities are conducted, in a manner that is proportionate
to each firm’s individual risk profile. This begins by classifying
each supervised insurance organization either as complex or noncomplex
based on its risk profile and continues with a risk-based application
of supervisory guidance and supervisory activities driven by a periodic
risk assessment. The risk assessment drives planned supervisory activities
and is communicated to the firm along with the supervisory plan for
the upcoming cycle. Supervisory activities are focused on resolving
supervisory knowledge gaps, monitoring the safety and soundness of
the firm, assessing the firm’s management of risks that could
potentially impact its ability to act as a source of managerial and
financial strength for its depository institution(s), and monitoring
for potential systemic risk, if relevant.
1. Complexity Classification and Supervised ActivitiesThe Federal Reserve classifies each supervised
insurance organization as either complex or noncomplex based on its
risk profile. The classification serves as the basis for determining
the level of supervisory resources dedicated to each firm, as well
as the frequency and intensity of supervisory activities.
Complex
Complex firms have
a higher level of risk and therefore require more supervisory attention
and resources. Federal Reserve dedicated supervisory teams are assigned
to execute approved supervisory plans led by a dedicated central point
of contact. The activities listed in the supervisory plans focus on
understanding any risks that could threaten the safety and soundness
of the consolidated organization or a firm’s ability to act
as a source of strength for its subsidiary depository institution(s).
These activities typically include continuous monitoring, targeted
topical examinations, coordinated reviews, and an annual roll-up assessment
resulting in ratings for the three rating components. The relevance
of certain supervisory guidance may vary among complex firms based
on each firm’s risk profile. Supervisory guidance targeted at
smaller depository institution holding companies, for example, may
be more relevant for complex supervised insurance organizations with
limited inherent exposure to a certain risk.
Noncomplex
Noncomplex firms, due to their
lower risk profile, require less supervisory oversight relative to complex
firms. The supervisory activities for these firms occur primarily
during a rating examination that occurs no less often than every other
year and results in the three component ratings. The supervision of
noncomplex firms relies more heavily on the reports and assessments
of a firm’s other relevant supervisors, although these firms
may also be subject to continuous monitoring, targeted topical examinations,
and coordinated reviews as appropriate. The focus and types of supervisory
activities for noncomplex firms are also set based on the risks of
each firm.
Factors considered when classifying a supervised insurance
organization as either complex or noncomplex include the absolute
and relative size of its depository institution(s), its current supervisory
and regulatory oversight (ratings and opinions of its supervisors,
and the nature and extent of any unregulated and/or unsupervised activities),
the breadth and nature of product and portfolio risks, the nature
of its organizational structure, its quality and level of capital
and liquidity, the materiality of any international exposure, and
its interconnectedness with the broader financial system.
For supervised insurance organizations
that are commencing Federal Reserve supervision, the classification
as complex or noncomplex is done and communicated during the application
phase after initial discussions with the firm. The firm’s risk
profile, including the characteristics listed above, are evaluated
by staff of the Board and relevant Reserve Bank before the complexity
classification is assigned by Board staff. Large, well-established,
and financially strong supervised insurance organizations with relatively
small depository institutions can be classified as noncomplex if,
in the opinion of Board staff, the corresponding level of supervisory
oversight is sufficient to accomplish its objectives. Although the
risk profile is the primary basis for assigning a classification,
a firm is automatically classified as complex if its depository institution’s
average assets exceed $100 billion. A firm may request that the Federal
Reserve review its complexity classification if it has experienced
a significant change to its risk profile.
The focus, frequency, and intensity of supervisory activities
are based on a risk assessment of the firm completed periodically
by the supervisory team and will vary among firms within the same
complexity classification. For each risk described in the section
“2. Supervisory Expectations” below, the supervisory team
assesses the firm’s inherent risks and its residual risk after
considering the effectiveness of its management of the risk. The risk
assessment and the supervisory activities that follow from it take
into account the assessments made by and work performed by the firm’s
other regulators. In certain instances, Federal Reserve examiners
may be able to rely on a firm’s internal audit (if it is rated
effective) or internal control functions in developing the risk assessment.
2. Supervisory Expectations Supervised insurance organizations are required to operate
in a safe and sound manner, to comply with all applicable laws and
regulations, and to possess sufficient financial and operational strength
to serve as a source of strength for their depository institution(s)
through a range of stressful yet plausible conditions. The governance
and risk-management practices necessary to accomplish these objectives
will vary based on a firm’s specific risk profile, size, and
complexity. Guidance describing supervisory expectations for safe
and sound practices can be found in Supervision & Regulation (SR)
letters published by the Board and other supervisory material. Supervisory
guidance most relevant to a specific supervised insurance organization
is driven by the risk profile of the firm. Federal Reserve examiners
periodically reassess the firm’s risk profile and inform the
firm if different supervisory guidance becomes more relevant as a
result of a material change to its risk profile.
Most supervisory guidance issued by the Board
is intended specifically for institutions that are primarily engaged
in banking activities. Examples of specific practices provided in
these materials may differ from (or not be applicable to) the nonbanking
operations of supervised insurance organizations, including for insurance
operations. The Board recognizes that practices in nonbanking business
lines can be different than those published in supervisory guidance
without being considered unsafe or unsound. When making their assessment,
Federal Reserve examiners work with supervised insurance organizations
and other involved regulators, including state insurance regulators,
to appropriately assess practices that may be different than those
typically observed for banking operations.
This section describes general safety and soundness expectations
and how the Board has adapted its supervisory expectations to reflect
the special characteristics of a supervised insurance organization.
The section is organized using the three rating components—Governance
and Controls, Capital Management, and Liquidity Management.
Governance and Controls
The
Governance and Controls component rating is derived from an assessment
of the effectiveness of a firm’s (1) board and senior management,
and (2) independent risk management and controls. All firms are expected
to align their strategic business objectives with their risk appetite
and risk-management capabilities; maintain effective and independent
risk management and control functions including internal audit; promote
compliance with laws and regulations; and remain a source of financial
and managerial strength for their depository institution(s). When
assessing governance and controls, Federal Reserve examiners consider
a firm’s risk-management capabilities relative to its risk exposure
within the following areas: internal audit, credit risk, legal and
compliance risk, market risk, model risk, and operational risk, including
cybersecurity/information technology and third-party risk.
Governance and Controls Expectations
- Despite differences in their business models and the
products offered, insurance companies and banks are expected to have
effective and sustainable systems of governance and controls to manage
their respective risks. The governance and controls framework for
a supervised insurance organization should:
- o clearly define roles and responsibilities
throughout the organization;
- o include policies and procedures, limits, requirements
for documenting decisions, and decisionmaking and accountability chains
of command; and
- o provide timely information about risk and
corrective action for noncompliance or weak oversight, controls, and
management.
- The Board expects the sophistication of the governance
and controls framework to be commensurate with the size, complexity,
and risk profile of the firm. As such, governance and controls expectations
for complex firms will be higher than that for noncomplex firms but
will also vary based on each firm’s risk profile.
- The Board expects supervised insurance organizations
to have a risk management and control framework that is commensurate
with its structure, risk profile, complexity, activities, and size.
For any chosen structure, the firm’s board is expected to have
the capacity, expertise, and sufficient information to discharge risk
oversight and governance responsibilities in a safe and sound manner.
In assigning a rating for the Governance and
Controls comonent, Federal Reserve examiners evaluate:
Board and Senior Management Effectiveness
- The firm’s board is expected to exhibit certain
attributes consistent with effectiveness, including: (i) setting a
clear, aligned, and consistent direction regarding the firm’s
strategy and risk appetite; (ii) directing senior management regarding
board reporting; (iii) overseeing and holding senior management accountable;
(iv) supporting the independence and stature of independent risk management
and internal audit; and (v) maintaining a capable board and an effective
governance structure. As the consolidated supervisor, the Board focuses
on the board of the supervised insurance organization and its committees.
Complex firms are expected to take into consideration the Board’s
guidance on board of directors’ effectiveness.2 In assessing the effectiveness of a firm’s senior management,
Federal Reserve examiners consider the extent to which senior management
effectively and prudently manages the day-to-day operations of the
firm and provides for ongoing resiliency; implements the firm’s
strategy and risk appetite; identifies and manages risks; maintains
an effective risk-management framework and system of internal controls;
and promotes prudent risk taking behaviors and business practices,
including compliance with laws and regulations such as those related
to consumer protection and the Bank Secrecy Act/Anti-Money Laundering
and Office of Foreign Assets Control (BSA/AML and OFAC). Federal Reserve
examiners evaluate how the framework allows management to be responsible
for and manage all risk types, including emerging risks, within the
business lines. Examiners rely to the fullest extent possible on insurance
and banking supervisors’ examination reports and information
concerning risk and management in specific lines of business, including
relying specifically on state insurance regulators to evaluate and
assess how firms manage the pricing, underwriting, and reserving risk
of their insurance operations.
Independent Risk Management and Controls
- In assessing a firm’s independent risk management
and controls, Federal Reserve examiners consider the extent to which
independent risk management effectively evaluates whether the firm’s
risk appetite framework identifies and measures all of the firm’s
material risks; establishes appropriate risk limits; and aggregates,
assesses and reports on the firm’s risk profile and positions.
Additionally, the firm is expected to demonstrate that its internal
controls are appropriate and tested for effectiveness and sustainability.
- Internal audit is an integral part of a supervised
insurance organization’s internal control system and risk-management
structure. An effective internal audit function plays an essential
role by providing an independent risk assessment and objective evaluation
of all key governance, risk management, and internal control processes.
Internal audit is expected to effectively and independently assess
the firm’s risk-management framework and internal control systems,
and report findings to senior management and to the firm’s audit
committee. Despite differences in business models, the Board expects
the largest, most complex supervised insurance organizations to have
internal audit practices in place that are similar to those at banking
organizations and as such, no modification to existing guidance is
required for these firms.3 At the same time, the Board recognizes that firms should have an
internal audit function that is appropriate to their size, nature,
and scope of activities. Therefore, for noncomplex firms, Federal
Reserve examiners will consider the expectations in the insurance
company’s domicile state’s Annual Financial Reporting
Regulation (NAIC Model Audit Rule 205), or similar state regulation,
to assess the effectiveness of a firm’s internal audit function.
The principles of sound risk management described
in the previous sections apply to the entire spectrum of risk-management
activities of a supervised insurance organization, including but not
limited to:
- Credit risk arises from the possibility that
a borrower or counterparty will fail to perform on an obligation.
Fixed income securities, by far the largest asset class held by many
insurance companies, is a large source of credit risk. This is unlike
most banking organizations, where loans generally make up the largest
portion of balance sheet assets. Life insurer investment portfolios
in particular are generally characterized by longer duration holdings
compared to those of banking organizations. Additionally, an insurance
company’s reinsurance recoverables/receivables arising from
the use of third-party reinsurance and participation in regulatory
required risk-pooling arrangements expose the firm to additional counterparty
credit risk. Federal Reserve examiners scope examination work based
on a firm’s level of inherent credit risk. The level of inherent
risk is determined by analyzing the composition, concentration, and
quality of the consolidated investment portfolio; the level of a firm’s
reinsurance recoverables, the credit quality of the individual reinsurers,
and the amount of collateral held for reinsured risks; and credit
exposures associated with derivatives, securities lending, or other
activities that may also have off-balance sheet counterparty credit
exposures. In determining the effectiveness of a firm’s management
of its credit risk, Federal Reserve examiners rely, where possible,
on the assessments made by other relevant supervisors for the depository
institution(s) and the insurance company(ies). In its own assessment,
the Federal Reserve will determine whether the board and senior management
have established an appropriate credit risk governance framework consistent
with the firm’s risk appetite; whether policies, procedures,
and limits are adequate and provide for ongoing monitoring, reporting,
and control of credit risk; the adequacy of management information
systems as it relates to credit risk; and the sufficiency of internal
audit and independent review coverage of credit risk exposure.
- Market risk arises from exposures to losses
as a result of underlying changes in, for example, interest rates,
equity prices, foreign exchange rates, commodity prices, or real estate
prices. Federal Reserve examiners scope examination work based on
a firm’s level of inherent market risk exposure, which is normally
driven by the primary business line(s) in which the firm is engaged
as well as the structure of the investment portfolio. A firm may be
exposed to inherent market risk due to its investment portfolio or
as result of its product offerings, including variable and indexed
life insurance and annuity products, or asset/wealth management business.
While interest rate risk (IRR), a category of market risk, differs
between insurance companies and banking organizations, the degree
of IRR also differs based on the type of insurance products the firm
offers. IRR is generally a small risk for U.S. property/casualty (P/C)
whereas it can be a significant risk factor for life insurers with
certain life and annuity products that are spread-based, longer in
duration, may include embedded product guarantees, and can pose disintermediation
risk. Equity market risk can be significant for life insurers that
issue guarantees tied to equity markets, like variable annuity living
benefits, and for P/C insurers with large common equity allocations
in their investment portfolios. Generally foreign exchange and commodity
risk is low for supervised insurance organizations but could be material
for some complex firms. Firms are expected to have sound risk-management
infrastructure that adequately identifies, measures, monitors, and
controls any material or significant forms of market risks to which
it is exposed.
- Model risk is the potential for adverse consequences
from decisions based on incorrect or misused model outputs and reports.
Model risk can lead to financial loss, poor business and strategic
decision-making, or damage to a firm’s reputation. Supervised
insurance organizations are often heavily reliant on models for product
pricing and reserving, risk and capital management, strategic planning
and other decision-making purposes. A sound model risk management
framework helps manage this risk.4 Federal
Reserve examiners take into account the firm’s size, nature, and
complexity, as well as the extent of use and sophistication of its
models when assessing its model risk-management program. Examiners
focus on the governance framework, policies and controls, and enterprise
model risk management through a holistic evaluation of the firm’s
practices. The Federal Reserve’s review of a firm’s model
risk-management program complements the work of the firm’s other
relevant supervisors. A sound model risk-management framework includes
three main elements: (1) an accurate model inventory and an appropriate
approach to model development, implementation, and use; (2) effective
model validation and continuous model performance monitoring; and
(3) a strong governance framework that provides explicit support and
structure for model risk management through policies defining relevant
activities, procedures that implement those policies, allocation of
resources, and mechanisms for evaluating whether policies and procedures
are being carried out as specified, including internal audit review.
The Federal Reserve relies on work already conducted by other relevant
supervisors and appropriately collaborates with state insurance regulators
on their findings related to insurance models. With respect to insurance
models, the Federal Reserve recognizes the important role played by
actuaries as described in actuarial standards of practice on model
risk management. With respect to the business of insurance, Federal
Reserve examiners focus on the firm’s adherence to its own policies
and procedures and the comprehensiveness of model validation rather
than technical specifications such as the appropriateness of the model,
its assumptions, or output. Federal Reserve examiners may request
that firms provide model documentation or model validation reports
for insurance and bank models when performing transaction testing.
- Legal risk arises from the potential that unenforceable
contracts, lawsuits, or adverse judgments can disrupt or otherwise
negatively affect the operations or financial condition of a supervised
insurance organization.
- Compliance risk is the risk of regulatory sanctions,
fines, penalties, or losses resulting from failure to comply with
laws, rules, regulations, or other supervisory requirements applicable
to a firm. By offering multiple financial service products that may
include insurance, annuity, banking, services provided by securities
broker-dealers, and asset and wealth management products, provided
through a diverse distribution network, supervised insurance organizations
are inherently exposed to a significant amount of legal and compliance
risk. As the consolidated supervisor, the Board expects firms to have
an enterprise-wide legal and compliance risk-management program that
covers all business lines, legal entities, and jurisdictions of operation.
Firms are expected to have compliance risk-management governance,
oversight, monitoring, testing, and reporting commensurate with their
size and complexity, and to ensure compliance with all applicable
laws and regulations. The principles-based guidance in existing SR
letters related to legal and compliance risk is applicable to supervised
insurance organizations.5 For both complex and noncomplex firms, Federal Reserve examiners
rely on the work of the firm’s other supervisors. As described
in section “C. Incorporating the Work of Other Supervisors,”
the assessments, examination results, ratings, supervisory issues,
and enforcement actions from other supervisors will be incorporated
into a consolidated assessment of the enterprise-wide legal and compliance
risk-management framework.
- o Money laundering, terrorist financing and other
illicit financial activity risk is the risk of providing criminals
access to the legitimate financial system and thereby being used to
facilitate financial crime. This financial crime includes laundering
criminal proceeds, financing terrorism, and conducting other illegal
activities. Money laundering and terrorist financing risk is associated
with a financial institution’s products, services, customers,
and geographic locations. This and other illicit financial activity
risks can impact a firm across business lines, legal entities, and
jurisdictions. A reasonably designed compliance program generally
includes a structure and oversight that mitigates these risks and
supports regulatory compliance with both BSA/AML OFAC requirements.
Although OFAC regulations are not part of the BSA, OFAC compliance
programs are frequently assessed in conjunction with BSA/AML. Supervised
insurance organizations are not defined as financial institutions
under the BSA and, therefore, are not required to have an AML program,
unless the firm is directly selling certain insurance products. However,
certain subsidiaries and affiliates of supervised insurance organizations,
such as insurance companies and banks, are defined as financial institutions
under 31 U.S.C. 5312(a)(2) and must develop and implement a written
BSA/AML compliance program as well as comply with other BSA regulatory
requirements. Unlike banks, insurance companies’ BSA/AML obligations
are limited to certain products, referred to as covered insurance
products.6 The volume
of covered products, which the Financial Crimes Enforcement Network
(FinCEN) has determined to be of higher risk, is an important driver
of supervisory focus. In addition, as U.S. persons, all supervised
insurance organizations (including their subsidiaries and affiliates)
are subject to OFAC regulations. Federal Reserve examiners assess
all material risks that each firm faces, extending to whether business
activities across the consolidated organization, including within
its individual subsidiaries or affiliates, comply with the legal requirements
of BSA and OFAC regulations. In keeping with the principles of a risk-based
framework and proportionality, Federal Reserve supervision for BSA/AML
and OFAC primarily focuses on oversight of compliance programs at
a consolidated level and relies on work by other relevant supervisors
to the fullest extent possible. In the evaluation of a firm’s
risks and BSA/AML and OFAC compliance program, however, it may be
necessary for examiners to review compliance with BSA/AML and OFAC
requirements at individual subsidiaries or affiliates in order to
fully assess the material risks of the supervised insurance organization.
- Operational risk is the risk of loss resulting
from inadequate or failed internal processes, people, and systems,
or from external events. Operational resilience is the ability to
maintain operations, including critical operations and core business
lines, through a disruption from any hazard. It is the outcome of
effective operational risk management combined with sufficient financial
and operational resources to prepare, adapt, withstand, and recover
from disruptions. A firm that operates in a safe and sound manner
is able to identify threats, respond and adapt to incidents, and recover
and learn from such threats and incidents so that it can prioritize
and maintain critical operations and core business lines, along with
other operations, services and functions identified by the firm, through
a disruption.
- o Cybersecurity/information
technology risks are a subset of operational risk and arise from
operations of a firm requiring a strong and robust internal control
system and risk management oversight structure. Information technology
(IT) and cybersecurity (cyber) functions are especially critical to
a firm’s operations. Examiners of financial institutions, including
supervised insurance organizations, utilize the detailed guidance
on mitigating these risks in the Federal Financial Institutions Examination
Council’s (FFIEC) IT Handbooks. In assessing IT/cyber risks,
Federal Reserve examiners assess each firm’s:
- board and senior management for effective oversight
and support of IT management;
- information/cyber security program for strong board
and senior management support, integration of security activities
and controls through business processes, and establishment of clear
accountability for security responsibilities;
- IT operations for sufficient personnel, system capacity
and availability, and storage capacity adequacy to achieve strategic
objectives and appropriate solutions;
- development and acquisition processes’ ability
to identify, acquire, develop, install, and maintain effective IT
to support business operations; and
- appropriate business continuity management processes
to effectively oversee and implement resilience, continuity, and response
capabilities to safeguard employees, customers, assets, products,
and services.
- Complex and noncomplex firms are assessed in these
areas. All supervised insurance organizations are required to notify
the Federal Reserve of any computer-security notification incidents.7
- o Third party risk is also
a subset of operational risk and arises from a firm’s use of
service providers to perform operational or service functions. These
risks may be inherent to the outsourced activity or be introduced
with the involvement of the service provider. When assessing effective
third party risk management, Federal Reserve examiners evaluate eight
areas: (1) third-party risk-management governance, (2) risk-assessment
framework, (3) due diligence in the selection of a service provider,
(4) a review of any incentive compensation embedded in a service provider
contract, (5) management of any contract or legal issues arising from
third-party agreements, (6) ongoing monitoring and reporting of third
parties, (7) business continuity and contingency of the third party
for any service disruptions, and (8) effective internal audit program
to assess the risk and controls of the firm’s third-party risk-management
program.8
Capital Management
The Capital Management rating is derived from an assessment of a
firm’s current and stressed level of capitalization, and the
quality of its capital planning and internal stress testing. A capital
management program should be commensurate with a supervised insurance
organization’s complexity and risk profile. In assigning this
rating, the Federal Reserve examiners evaluate the extent to which
a firm maintains sound capital planning practices through effective
governance and oversight, effective risk management and controls,
maintenance of updated capital policies and contingency plans for
addressing potential shortfalls, and incorporation of appropriately
stressful conditions into capital planning and projections of capital
positions. The extent to which a firm’s capital is sufficient
to comply with regulatory requirements, to support the firm’s
ability to meet its obligations, and to enable the firm to remain
a source of strength to its depository institution(s) in a range of
stressful, but plausible, economic and financial environments is also
evaluated.
Insurance company balance sheets are typically quite different
from those of most banking organizations. For life insurance companies,
investment strategies may focus on cash flow matching to reduce interest
rate risk and provide liquidity to support their liabilities, while
for traditional banks, deposits (liabilities) are attracted to support
investment strategies. Additionally, for insurers, capital provides
a buffer for policyholder claims and creditor obligations, helping
the firm absorb adverse deviations in expected claims experience,
and other drivers of economic loss. The Board recognizes that the
capital needs for insurance activities are materially different from
those of banking activities and can be different between life and
property and casualty insurers. Insurers may also face capital fungibility
constraints not faced by banking organizations.
In assessing a supervised insurance organization’s
capital management, the Federal Reserve relies to the fullest extent
possible on information provided by state insurance regulators, including
the firm’s own risk and solvency assessment (ORSA) and the state
insurance regulator’s written assessment of the ORSA. An ORSA
is an internal process undertaken by an insurance group to assess
the adequacy of its risk management and current and prospective capital
position under normal and stress scenarios. As part of the ORSA, insurance
groups are required to analyze all reasonably foreseeable and relevant
material risks that could have an impact on their ability to meet
obligations.
The Board expects supervised insurance organizations to
have sound governance over their capital planning process. A firm
should establish capital goals that are approved by the board of directors,
and that reflect the potential impact of legal and/or regulatory restrictions
on the transfer of capital between legal entities. In general, senior
management should establish the capital planning process, which should
be reviewed and approved periodically by the board. The board should
require senior management to provide clear, accurate, and timely information
on the firm’s material risks and exposures to inform board decisions
on capital adequacy and actions. The capital planning process should
clearly reflect the difference between the risk profiles and associated
capital needs of the insurance and banking businesses.
A firm should have a risk-management
framework that appropriately identifies, measures, and assesses material
risks and provides a strong foundation for capital planning. This
framework should be supported by comprehensive policies and procedures,
clear and well-established roles and responsibilities, strong internal
controls, and effective reporting to senior management and the board.
In addition, the risk-management framework should be built upon sound
management information systems.
As part of capital management, a firm should have a sound
internal control framework that helps ensure that all aspects of the
capital planning process are functioning as designed and result in
an accurate assessment of the firm’s capital needs. The internal
control framework should be independently evaluated periodically by
the firm’s internal audit function.
The governance and oversight framework should include
an assessment of the principles and guidelines used for capital planning,
issuance, and usage, including internal post-stress capital goals
and targeted capital levels; guidelines for dividend payments and
stock repurchases; strategies for addressing capital shortfalls; and
internal governance responsibilities and procedures for the capital
policy. The capital policy should reflect the capital needs of the
insurance and banking businesses based on their risks, be approved
by the firm’s board of directors or a designated committee of
the board, and be re-evaluated periodically and revised as necessary.
A strong capital management program will incorporate appropriately
stressful conditions and events that could adversely affect the firm’s
capital adequacy and capital planning. As part of its capital plan,
a firm should use at least one scenario that stresses the specific
vulnerabilities of the firm’s activities and associated risks,
including those related to the firm’s insurance activities and
its banking activities.
Supervised insurance organizations should employ estimation
approaches to project the impact on capital positions of various types
of stressful conditions and events, and that are independently validated.
A firm should estimate losses, revenues, expenses, and capital using
sound methods that incorporate macroeconomic and other risk drivers.
The robustness of a firm’s capital stress testing processes
should be commensurate with its risk profile.
Liquidity Management
The Liquidity Management
rating is derived from an assessment of the supervised insurance organization’s
liquidity position and the quality of its liquidity risk-management
program. Each firm’s liquidity risk-management program should
be commensurate with its complexity and risk profile. The Board recognizes
that supervised insurance organizations are typically less exposed
to traditional liquidity risk than banking organizations. Instead
of cash outflows being mainly the result of discretionary withdrawals,
cash outflows for many insurance products only result from the occurrence
of an insured event. Insurance products, like annuities, that are
potentially exposed to call risk generally have product features (i.e.,
surrender charges, market value surrenders, tax treatment, etc.) that
help mitigate liquidity risk.
Federal Reserve examiners tailor the application of existing
supervisory guidance on liquidity risk management to reflect the liquidity
characteristics of supervised insurance organizations.
9 For example, guidance on intraday liquidity management would
only be applicable for supervised insurance organizations with material
intraday liquidity risks. Additionally, specific references to liquid
assets may be more broadly interpreted to include other asset classes
such as certain investment-grade corporate bonds.
The scope of the Federal Reserve’s supervisory
activities on liquidity risk is influenced by each firm’s individual
risk profile. Traditional property and casualty insurance products
are typically short duration liabilities backed by short-duration,
liquid assets. Because of this, they typically present lower liquidity
risk than traditional banking activities. However, some nontraditional
life insurance and retirement products create liquidity risk through
features that allow payments at the request of policyholders without
the occurrence of an insured event. Risks of certain other insurance
products are often mitigated using derivatives. Any differences between
collateral requirements related to hedging and the related liability
cash flows can also create liquidity risk. The Board expects firms
significantly engaged in these types of insurance activities to have
correspondingly more sophisticated liquidity risk-management programs.
A strong liquidity risk-management program includes cash
flow forecasting with appropriate granularity. The firm’s suite
of quantitative metrics should effectively inform senior management
and the board of directors of the firm’s liquidity risk profile
and identify liquidity events or stresses that could detrimentally
affect the firm. The metrics used to measure a firm’s liquidity
position may vary by type of business.
Federal Reserve examiners rely to the fullest extent possible
on each firm’s ORSA, which requires all firms to include a discussion
of the risk-management framework and assessment of material risks,
including liquidity risk.
Supervised insurance organizations are expected to perform
liquidity stress testing at least annually and more frequently, if
necessary, based on their risk profile. The scenarios used should
reflect the firm’s specific risk profile and include both idiosyncratic
and system-wide stress events. Stress testing should inform the firm
on the amount of liquid assets necessary to meet net cash outflows
over relevant time periods, including at least a one-year time horizon.
Firms should hold a liquidity buffer comprised of highly liquid assets
to meet stressed net cash outflows. The liquidity buffer should be
measured using appropriate haircuts based on asset quality, duration,
and expected market illiquidity based on the stress scenario assumptions.
Stress testing should reflect the expected impact on collateral
requirements. For material life insurance operations, Federal Reserve
examiners will rely to the greatest extent possible on information
submitted by the firm to comply with the National Association of Insurance
Commissioners’ (NAIC) liquidity stress test framework.
The fungibility of sources of liquidity
is often limited between an insurance group’s legal entities.
Large insurance groups can operate with a significant number of legal
entities and many different regulatory and operational barriers to
transferring funds among them. Regulations designed to protect policyholders
of insurance operating companies can limit the transferability of
funds from an insurance company to other legal entities within the
group, including to other insurance operating companies. Supervised
insurance organizations should carefully consider these limitations
in their stress testing and liquidity risk-management framework. Effective
liquidity stress testing should include stress testing at the legal
entity level with consideration for intercompany liquidity fungibility.
Furthermore, the firm should be able to measure and provide an assessment
of liquidity at the top-tier depository institution holding company
in a manner that incorporates fungibility constraints.
The enterprise-wide governance and
oversight framework should be consistent with the firm’s liquidity
risk profile and include policies and procedures on liquidity risk
management. The firm’s policies and procedures should describe
its liquidity risk reporting, stress testing, and contingency funding
plan.
B. Supervisory Ratings Supervised insurance organizations are expected to operate
in a safe and sound manner, to comply with all applicable laws and
regulations, and to possess sufficient financial and operational strength
to serve as a source of strength for their depository institution(s)
through a range of stressful yet plausible conditions. Supervisory
ratings and supervisory findings are used to communicate the assessment
of a firm. Federal Reserve examiners periodically assign one of four
ratings to each of the three rating components used to assess supervised
insurance organizations. The rating components are Capital Management,
Liquidity Management, and Governance and Controls. The four potential
ratings are Broadly Meets Expectations, Conditionally Meets Expectations,
Deficient-1, and Deficient-2. To be considered “well managed,”
a firm must receive a rating of Conditionally Meets Expectations or
better in each of the three rating components. Each rating is defined
specifically for supervised insurance organizations with particular
emphasis on the obligation that firms serve as a source of financial
and managerial strength for their depository institution(s). High-level
definitions for each rating are below, followed by more specific rating
definitions for each component.
Broadly Meets
Expectations. The supervised insurance organization’s practices
and capabilities broadly meet supervisory expectations. The holding
company effectively serves as a source of managerial and financial
strength for its depository institution(s) and possesses sufficient
financial and operational strength and resilience to maintain safe-and-sound
operations through a range of stressful yet plausible conditions.
The firm may have outstanding supervisory issues requiring corrective
actions, but these are unlikely to present a threat to its ability
to maintain safe-and-sound operations and unlikely to negatively impact
its ability to fulfill its obligation to serve as a source of strength
for its depository institution(s). These issues are also expected
to be corrected on a timely basis during the normal course of business.
Conditionally Meets Expectations. The supervised
insurance organization’s practices and capabilities are generally
considered sound. However, certain supervisory issues are sufficiently
material that if not resolved in a timely manner during the normal
course of business, may put the firm’s prospects for remaining
safe and sound, and/or the holding company’s ability to serve
as a source of managerial and financial strength for its depository
institution(s), at risk. A firm with a Conditionally Meets Expectations
rating has the ability, resources, and management capacity to resolve
its issues and has developed a sound plan to address the issue(s)
in a timely manner. Examiners will work with the firm to develop an
appropriate timeframe during which it will be required to resolve
that supervisory issue(s) leading to this rating.
Deficient-1. Financial or operational deficiencies in a supervised
insurance organization’s practices or capabilities put its prospects
for remaining safe and sound, and/or the holding company’s ability
to serve as a source of managerial and financial strength for its
depository institution(s), at significant risk. The firm is unable
to remediate these deficiencies in the normal course of business,
and remediation would typically require it to make material changes
to its business model or financial profile, or its practices or capabilities.
A firm with a Deficient-1 rating is required to take timely action
to correct financial or operational deficiencies and to restore and
maintain its safety and soundness and compliance with laws and regulations.
Supervisory issues that place the firm’s safety and soundness
at significant risk, and where resolution is likely to require steps
that clearly go beyond the normal course of business—such as
issues requiring a material change to the firm’s business model
or financial profile, or its governance, risk management or internal
control structures or practices—would generally warrant assignment
of a Deficient-1 rating. There is a strong presumption that a firm
with a Deficient-1 rating will be subject to an enforcement action.
Deficient-2. Financial or operational deficiencies
in a supervised insurance organization’s practices or capabilities
present a threat to its safety and soundness, have already put it
in an unsafe and unsound condition, and/or make it unlikely that the
holding company will be able to serve as a source of financial and
managerial strength to its depository institution(s). A firm with
a Deficient-2 rating is required to immediately implement comprehensive
corrective measures and demonstrate the sufficiency of contingency
planning in the event of further deterioration. There is a strong
presumption that a firm with a Deficient-2 rating will be subject
to a formal enforcement action.
Definitions
for the Governance and Controls Component Rating:
Broadly Meets Expectations. Despite the potential existence
of outstanding supervisory issues, the supervised insurance organization’s
governance and controls broadly meet supervisory expectations, supports
maintenance of safe-and-sound operations, and supports the holding
company’s ability to serve as a source of financial and managerial
strength for its depository institutions(s). Specifically, the firm’s
practices and capabilities are sufficient to align strategic business
objectives with its risk appetite and risk-management capabilities;
maintain effective and independent risk management and control functions,
including internal audit; promote compliance with laws and regulations;
and otherwise provide for the firm’s ongoing financial and operational
resiliency through a range of conditions. The firm’s governance
and controls clearly reflect the holding company’s obligation
to act as a source of financial and managerial strength for its depository
institution(s).
Conditionally Meets Expectations. Certain material financial or operational weaknesses in a supervised
insurance organization’s governance and controls practices may
place the firm’s prospects for remaining safe and sound through
a range of conditions at risk if not resolved in a timely manner during
the normal course of business. Specifically, if left unresolved, these
weaknesses may threaten the firm’s ability to align strategic
business objectives with its risk appetite and risk-management capabilities;
maintain effective and independent risk management and control functions,
including internal audit; promote compliance with laws and regulations;
or otherwise provide for the firm’s ongoing resiliency through
a range of conditions. Supervisory issues may exist related to the
firm’s internal audit function, but internal audit is still
regarded as effective.
Deficient-1. Deficiencies
in a supervised insurance organization’s governance and controls
put its prospects for remaining safe and sound through a range of conditions
at significant risk. The firm is unable to remediate these deficiencies
in the normal course of business, and remediation would typically
require a material change to the firm’s business model or financial
profile, or its governance, risk management or internal control structures
or practices.
Examples of issues that may result
in a Deficient-1 rating include, but are not limited to:
- The firm may be currently subject to, or expected
to be subject to, informal or formal enforcement action(s) by the
Federal Reserve or another regulator tied to violations of laws and
regulations that indicate severe deficiencies in the firm’s
governance and controls.
- Significant legal issues may have or be expected to
impede the holding company’s ability to act as a source of financial
strength for its depository institution(s).
- The firm may have engaged in intentional misconduct.
- Deficiencies within the firm’s governance and
controls may limit the credibility of the firm’s financial results,
limit the board or senior management’s ability to make sound
decisions, or materially increase the firm’s risk of litigation.
- The firm’s internal audit function may be considered
ineffective.
- Deficiencies in the firm’s governance and controls
may have limited the holding company’s ability to act as a source
of financial and/or managerial strength for its depository institution(s).
Deficient-2. Financial
or operational deficiencies in a supervised insurance organization’s
governance and controls present a threat to its safety and soundness,
a threat to the holding company’s ability to serve as a source
of financial strength for its depository institution(s), or have already
put the firm in an unsafe and unsound condition.
Examples of issues that may result in a Deficient-2 rating include,
but are not limited to:
- The firm is currently subject to, or expected to
be subject to, formal enforcement action(s) by the Federal Reserve
or another regulator tied to violations of laws and regulations that
indicate severe deficiencies in the firm’s governance and controls.
- Significant legal issues may be impeding the holding
company’s ability to act as a source of financial strength for
its depository institution(s).
- The firm may have engaged in intentional misconduct.
- The holding company may have failed to act as a source
of financial and/or managerial strength for its depository institution(s)
when needed.
- The firm’s internal audit function is regarded
as ineffective.
Definitions for the Capital Management Component
Rating:
Broadly Meets
Expectations. Despite the potential existence of outstanding
supervisory issues, the supervised insurance organization’s
capital management broadly meets supervisory expectations, supports
maintenance of safe-and-sound operations, and supports the holding
company’s ability to serve as a source of financial strength
for its depository institution(s). Specifically:
- the firm’s current and projected capital positions
on a consolidated basis and within each of its material business lines/legal
entities comply with regulatory requirements and support its ability
to absorb potential losses, meet obligations, and continue to serve
as a source of financial strength for its depository institution(s);
- capital management processes are sufficient to give
credibility to stress testing results and the firm is capable of producing
sound assessments of capital adequacy through a range of stressful
yet plausible conditions; and
- potential capital fungibility issues are effectively
mitigated, and capital contingency plans allow the holding company
to continue to act as a source of financial strength for its depository
institution(s) through a range of stressful yet plausible conditions.
Conditionally Meets
Expectations. Capital adequacy meets regulatory minimums, both
currently and on a prospective basis. Supervisory issues exist but
these do not threaten the holding company’s ability to act as
a source of financial strength for its depository institution(s) through
a range of stressful yet plausible conditions. Specifically, if left
unresolved, these issues:
- may threaten the firm’s ability to produce sound
assessments of capital adequacy through a range of stressful yet plausible
conditions; and/or
- may result in the firm’s projected capital
positions being insufficient to absorb potential losses, comply with
regulatory requirements, and support the holding company’s ability
to meet current and prospective obligations and continue to serve
as a source of financial strength to its depository institution(s).
Deficient-1. Financial
or operational deficiencies in a supervised insurance organization’s
capital management put its prospects for remaining safe and sound
through a range of plausible conditions at significant risk. The firm
is unable to remediate these deficiencies in the normal course of
business, and remediation would typically require a material change
to the firm’s business model or financial profile, or its capital
management processes.
Examples of issues that may
result in a Deficient-1 rating include, but are not limited to:
- Capital adequacy currently meets regulatory minimums
although there may be uncertainty regarding the firm’s ability
to continue meeting regulatory minimums.
- Fungibility concerns may exist that could challenge
the firm’s ability to contribute capital to its depository institutions
under certain stressful yet plausible scenarios.
- Supervisory issues may exist that undermine the credibility
of the firm’s current capital adequacy and/or its stress testing
results.
Deficient-2. Financial
or operational deficiencies in a supervised insurance organization’s
capital management present a threat to the firm’s safety and
soundness, a threat to the holding company’s ability to serve
a source of financial strength for its depository institution(s),
or have already put the firm in an unsafe and unsound condition.
Examples of issues that may result in a Deficient-2
rating include, but are not limited to:
- Capital adequacy may currently fail to meet regulatory
minimums or there is significant concern that the firm will not meet
capital adequacy minimums prospectively.
- Supervisory issues may exist that significantly undermine
the firm’s capital adequacy metrics either currently or prospectively.
- Significant fungibility constraints may exist that
would prevent the holding company from contributing capital to its
depository institution(s) and fulfilling its obligation to serve as
a source of financial strength.
- The holding company may have failed to act as source
of financial strength for its depository institution when needed.
Definitions for the Liquidity Management Component
Rating:
Broadly Meets
Expectations. Despite the potential existence of outstanding
supervisory issues, the supervised insurance organization’s
liquidity management broadly meets supervisory expectations, supports
maintenance of safe-and-sound operations, and supports the holding
company’s ability to serve as a source of financial strength
for its depository institutions(s). The firm generates sufficient
liquidity to meet its short-term and long-term obligations currently
and under a range of stressful yet plausible conditions. The firm’s
liquidity management processes, including its liquidity contingency
planning, support its obligation to act as a source of financial strength
for its depository institution(s). Specifically:
- The firm is capable of producing sound assessments
of liquidity adequacy through a range of stressful yet plausible conditions;
and
- The firm’s current and projected liquidity positions
on a consolidated basis and within each of its material business lines/legal
entities comply with regulatory requirements and support the holding
company’s ability to meet obligations and to continue to serve
as a source of financial strength for its depository institution(s).
Conditionally Meets
Expectations. Certain material financial or operational weaknesses
in a supervised insurance organization’s liquidity management
place its prospects for remaining safe and sound through a range of
stressful yet plausible conditions at risk if not resolved in a timely
manner during the normal course of business.
Specifically,
if left unresolved, these weaknesses:
- may threaten the firm’s ability to produce sound
assessments of liquidity adequacy through a range of conditions; and/or
- may result in the firm’s projected liquidity
positions being insufficient to comply with regulatory requirements
and support the firm’s ability to meet current and prospective
obligations and to continue to serve as a source of financial strength
to its depository institution(s).
Deficient-1. Financial
or operational deficiencies in a supervised insurance organization’s
liquidity management put the firm’s prospects for remaining
safe and sound through a range of stressful yet plausible conditions
at significant risk. The firm is unable to remediate these deficiencies
in the normal course of business, and remediation would typically
require a material change to the firm’s business model or financial
profile, or its liquidity management processes.
Examples of issues that may result in a Deficient-1 rating include,
but are not limited to:
- The firm is currently able to meet its obligations
but there may be uncertainty regarding the firm’s ability to
do so prospectively.
- The holding company’s liquidity contingency
plan may be insufficient to support its obligation to act as a source
of financial strength for its depository institution(s).
- Supervisory issues may exist that undermine the credibility
of the firm’s liquidity metrics and stress testing results.
Deficient-2. Financial
or operational deficiencies in a supervised insurance organization’s
liquidity management present a threat to its safety and soundness,
a threat to the holding company’s ability to serve as a source
of financial strength for its depository institution(s), or have already
put the firm in an unsafe and unsound condition.
Examples of issues that may result in a Deficient-2 rating include,
but are not limited to:
- Liquidity shortfalls may exist within the firm that
have prevented the firm, or are expected to prevent the firm, from
fulfilling its obligations, including the holding company’s
obligation to act as a source of financial strength for its depository
institution(s).
- Liquidity adequacy may currently fail to meet regulatory
minimums or there is significant concern that the firm will not meet
liquidity adequacy minimums prospectively for at least one of its
regulated subsidiaries.
- Supervisory issues may exist that significantly undermine
the firm’s liquidity metrics either currently or prospectively.
- Significant fungibility constraints may exist that
would prevent the holding company from supporting its depository institution(s)
and fulfilling its obligation to serve as a source of financial strength.
- The holding company may have failed to act as source
of financial strength for its depository institution when needed.
C. Incorporating the Work of Other
Supervisors Similar to the approach
taken by the Federal Reserve in its consolidated supervision of other
firms, the oversight of supervised insurance organizations relies
to the fullest extent possible, on work performed by other relevant
supervisors. Federal Reserve supervisory activities are not intended
to duplicate or replace supervision by the firm’s other regulators
and Federal Reserve examiners typically do not specifically assess
firms’ compliance with laws outside of its jurisdiction, including
state insurance laws. The Federal Reserve collaboratively coordinates
with, communicates with, and leverages the work of the Office of the
Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation
(FDIC), Securities and Exchange Commission (SEC), Financial Crimes
Enforcement Network (FinCEN), Internal Revenue Service (IRS), applicable
state insurance regulators, and other relevant supervisors to achieve
its supervisory objectives and eliminate unnecessary burden.
Existing statutes specifically require
the Board to coordinate with, and to rely to the fullest extent possible
on work performed by the state insurance regulators. The Board and
all state insurance regulators have entered into memorandums of understanding
(MOU) allowing supervisors to freely exchange information relevant
for the effective supervision of supervised insurance organizations.
Federal Reserve examiners take the actions below with respect to state
insurance regulators to support accomplishing the objective of minimizing
supervisory duplication and burden, without sacrificing effective
oversight:
- routine discussions (at least annually) with state
insurance regulatory staff with greater frequency during times of
stress;
- discussions around the annual supervisory plan, including
how best to leverage work performed by the state and potential participation
by state insurance regulatory staff on relevant supervisory activities;
- consideration of the opinions and work done by the
state when scoping relevant examination activities;
- documenting any input received from the state and
considering the assessments of and work performed by the state for
relevant supervisory activities;
- sharing and discussing with the state the annual
ratings and relevant conclusion documents from supervisory activities;
- collaboratively working with the states and the NAIC
on the development of policies that affect insurance depository institution
holding companies; and
- participating in supervisory colleges.
The Federal Reserve relies on the state insurance
regulators to participate in the activities above and to share proactively
their supervisory opinions and relevant documents. These documents
include the annual ORSA,
10 the state insurance regulator’s written assessment of
the ORSA, results from its examination activities, the Corporate Governance
Annual Disclosure, financial analysis memos, risk assessments, material
risk determinations, material transaction filings (Form D), the insurance
holding company system annual registration statement (Form B), submissions
for the NAIC liquidity stress test framework, and other state supervisory
material. If the Federal Reserve determines that it is necessary to
perform supervisory activities related to aspects of the supervised
insurance organization that also fall under the jurisdiction of the
state insurance regulator, it will communicate the rationale and result
of these activities to the state insurance regulator.
Issued by the Board September 28, 2022 (SR-22-8).
