Enterprise risk identification, management and reporting are key elements of the NAIC’s Solvency Modernization Initiative (the “NAIC SMI”). Indeed, hardly a day goes by without multiple articles on enterprise risk appearing in online and print publications. Most recently, much of the focus has been in the context of the NAIC’s Own Risk and Solvency Assessment (“ORSA”) initiative, which is anticipated to be effective in 2015. However, another enterprise risk requirement, the Form F Enterprise Risk Report, adopted under the 2010 revisions to the NAIC’s Insurance Holding Company System Regulatory Act (Model 440) and the corresponding Regulation (Model 450) (collectively, the “2010 Model Law”), will become effective as early as 2013 in some states.
With the current focus on ORSA, this article is intended as a reminder of the more imminent Form F enterprise risk reporting (“ERR”) requirement. Additionally, to assist in alleviating continuing confusion regarding the related, but distinguishable, enterprise risk concepts and requirements of ORSA and ERR,1 this article presents a primer on the applicability and exemption provisions of both of these NAIC initiatives.
ORSA vs. ERR – Targets, Applicability & Exemptions
As recently clarified by the NAIC Group Solvency Issues Working Group of the NAIC’s Solvency Modernization Initiative Task Force,2 ORSA and ERR have distinctly different requirements, and exemption from one does not constitute exemption from the other:
- Targets & Applicability:
- ORSA targets regulated entity risk, and the enterprise risk requirements apply to a regulated insurer (whether or not part of an insurance holding company system) or a group of regulated insurers.
- ERR targets non-regulated entity risk of an insurance holding company system (“IHCS”), and the ERR requirement applies to the ultimate controlling person (“UCP”) of an insurer in an IHCS.
- Exemption:
- Exempted from ORSA are (1) individual insurers with annual direct written and unaffiliated assumed premium of less than $500 million and (2) groups of affiliated insurers with group annual direct written and unaffiliated assumed premium of less than $1 billion.3
- If a regulated insurer is part of an IHCS, there are no exemptions from the ERR requirement as set forth in the 2010 Model Law (as indicated below, one state (Texas) has adopted several exemptions).
Thus, UCPs of one or more U.S. domiciled insurers (regardless of individual insurer or group premium volume) should be preparing to comply with the ERR requirement, but also should be monitoring individual state legislative action to determine if any deviations from the 2010 Model Law provisions are enacted.
The 2010 Model Law’s ERR & Related “Windows” Provisions - A Fundamental Change in Focus
The NAIC’s adoption of the 2010 Model Law was the culmination of nearly two years of discussions on how to address concerns that U.S. insurance regulators lacked the necessary authority to oversee and intervene when activities of non-insurance affiliates within an IHCS might pose material risks to an insurer. While the 2010 Model Law includes a number of revisions intended to strengthen existing disclosure and reporting requirements at the regulated insurer level, and in the circumstances of an acquisition or divestiture of control of an insurer, adoption of the ERR requirement and several related provisions marks a fundamental change in focus of IHCS regulation.
Traditional Focus of IHCS Regulation: The traditional focus of IHCS regulation was to build “walls” around an insurer to protect it from abuse by affiliates.4 This “walls” approach included the requirements, now strengthened in the 2010 Model Law, for prior approval by, or prior or post-transaction notification to, relevant insurance regulators on activities or transactions that directly affect an insurer, such as any acquisition of control of an insurer (by stock ownership or otherwise), intercompany transactions involving the insurer, and the payment of dividends by the insurer. Although primarily focused on the insurer, traditional IHCS regulation was not totally devoid of requirements for filing information about the IHCS that did not directly involve the insurer. For example, as part of an insurer’s Form B registration statement, the insurer has been required to file financial statements of the UCP and information about any litigation or administrative proceedings involving the UCP and its directors or executive officers. However, traditional IHCS regulation did not otherwise require the insurer or UCP to point out specified areas of enterprise risk in the IHCS filings or to disclose information on activities of non-insurance affiliates within an IHCS.
The Fundamental Change in Focus: As a result of “lessons learned”5 from the recent financial crisis, the ERR requirement and several related provisions of the 2010 Model Law are intended to add “windows” to group supervision of an IHCS where regulators are able to “assess the enterprise risk within a holding company system and its impact or contagion upon the insurers within that group.”6 Thus, when adopted by the states, the 2010 Model Law will significantly expand the scope of state insurance regulatory authority over IHCSs via reporting requirements and examination authority over controlling persons and non-insurance affiliates.
The ERR Requirement - Form F Enterprise Risk Report: The 2010 Model Act includes a new annual report that must be filed by the UCP of an insurer that is subject to Form B registration statement filing.7 The new Form F Enterprise Risk Report is designated as a confidential document in which a UCP must “identify the material risks within the insurance holding company system that could pose enterprise risk to the insurer.”8 For this purpose, “enterprise risk” is broadly (indeed, some claim ambiguously) defined as “any activity, circumstance, event or series of events involving one or more affiliates of an insurer that, if not remedied promptly, is likely to have a material adverse effect upon the financial condition or liquidity of the insurer or its insurance holding company system as a whole, including, but not limited to, anything that would cause the insurer’s Risk-Based Capital to fall into company action level . . . or would cause the insurer to be in hazardous financial condition . . . .”9
Within the Form F, the UCP must provide information, to the best of its knowledge and belief, on ten different areas of IHCS operations that could potentially pose enterprise risk to the regulated insurer:
- Business plan of the IHCS and a summary of strategies for the next 12 months.
- Material developments on strategy, internal audit findings, compliance or risk management affecting the IHCS.
- Any developments in investigations, regulatory activities or litigation that may have a significant impact on the IHCS.
- Identification of the IHCS capital resources and material distribution patterns.
- Information on corporate or parental guarantees throughout the IHCS and the expected source of liquidity if guarantees are called upon.
- Material activities or developments of the IHCS that, in the opinion of senior management, could adversely affect the IHCS.
- Any material concerns raised by any supervisory college about the IHCS in the previous year.
- Actual negative movement, or discussions with rating agencies that may cause negative movement, in the credit ratings and individual insurer financial strength ratings assessment of the IHCS.
- Any acquisition or divestiture of insurance affiliates and reallocation of existing financial or insurance entities within the IHCS.
- Any change of shareholders of the IHCS exceeding 10% of voting securities.
If any of the requested information is disclosed on the regulated insurer’s filed Form B, it need not be disclosed by the UCP on the Form F. In addition, if the UCP does not disclose information in response to any of ten areas of inquiry (and such information is not otherwise disclosed in the insurer’s Form B), the UCP must include a statement affirming that, to the best of its knowledge and belief, it has not identified any enterprise risk subject to disclosure. Further, if an IHCS has filed similar information with the SEC or is not domiciled in the U.S., the UCP may attach the appropriate SEC form or public audited financial statement filed in its country of domicile in lieu of fully completing the Form F, but must set forth specific references in the Form F on where the requested information is disclosed on such documents.
Finally, as part of any acquisition of control of an insurer that requires a Form A acquisition of control filing, an acquiring person is required to: (1) agree to provide a Form F annually; (2) acknowledge that it and all subsidiaries within its control in the IHCS will provide any information requested by the domestic insurer’s regulator to evaluate enterprise risk to the insurer being acquired; and (3) file a Form F within 15 days after the end of the month in which the acquisition occurs.
Related “Windows” Provisions: The 2010 Model Act includes additional “windows” to assist regulators in determining and evaluating enterprise risk posed by an IHCS:
- Form B – Financial Statements of Non-Insurance Affiliates: As part of insurer registration requirements, regulators are given the authority to require an insurer to file, as part of the Form B registration statement, financial statements of its non-insurance affiliates if so requested by the regulator. This requirement may be satisfied by providing the most recent financial statement filed with the SEC by the parent corporation.
- Examination Authority: The examination provisions were expanded to give insurance regulators authority to examine an insurer’s affiliates in order to ascertain the financial condition of the insurer, “including the enterprise risk to the insurer by the ultimate controlling party, or by any entity or combination of entities within the insurance holding company system, or by the insurance holding company system on a consolidated basis.”10 As part of this expanded authority, the regulated insurer may be ordered to produce not only information in its possession, but also information obtainable by the insurer “under contractual relationships, statutory obligations or other methods."11 If the insurer fails to produce such information without a reason acceptable to the regulator, the insurer may be subject to fines or suspension or revocation of its license. Further, the regulator is granted the authority to compel production by issuing subpoenas, examining persons under oath, and seeking a court order to enforce subpoenas, under penalty of contempt.
Status of State Adoption or Introduction of the ERR Requirement: Currently (as of 4/28/2012), six states (listed by general effective date) have adopted ERR requirements that are essentially the same as the 2010 Model Law, except as otherwise specifically noted below:
- Rhode Island: Statutory provisions were effective 5/27/2011, except the Form F Enterprise Risk Report will not be effective until 7/1/2013, and corresponding regulations and reporting forms were effective 4/12/2012.
- Texas: Statutory provisions were effective 9/1/2011, except the Form F Enterprise Risk Report will not be effective until 7/1/2013. No regulations or reporting forms have been proposed to date. Differences from the ERR requirement of the 2010 NAIC Model include the following:
- Graduated Filing Implementation & Allowance for Requests for Exemption: The Form F filing requirement has a graduated implementation date based on premium size of an insurer (ranging from 7/1/2013 to 1/1/2016). Insurers in the smallest premium category (i.e. total direct or assumed annual premiums of $300 million or more but less than $500 million) may request exemption from the Form F filing requirement by demonstrating undue financial or organizational hardship.
- Specified Exemptions: Exempted from the Form F filing are UCPs of insurers with total direct or assumed annual premiums of less than $300 million as well as UCPs of certain insurers organized before 1910 and those owned by charitable foundations or trusts.
- West Virginia: Statutory provisions will be effective 7/1/2012 and corresponding regulations and reporting forms were effective 4/20/2012, except the Form F Enterprise Risk Report will not be effective until 7/1/2013.
- Indiana: Statutory provisions will be effective 7/1/2012, except the Form F Enterprise Risk Report will not be effective until the first filing date after 6/30/2013. No regulations or reporting forms have been proposed to date.
- Kentucky: Statutory provisions were enacted 4/11/2012 and will be effective 90 days after the Legislature adjourns, except the Form F Enterprise Risk Report will not be effective until 7/15/2014. No regulations or reporting forms have been proposed to date.
- Nebraska: Statutory provisions will be effective 1/1/2013. No regulations or reporting forms have been proposed to date.
Eight additional state legislatures have proposed legislation that include the ERR requirement (including, with the exception of Florida, the NAIC’s specified definition of “enterprise risk”):
- California: SB 1448 (introduced 2/24/2012).
- Connecticut: SB 411 (introduced 3/8/2012).
- Florida: HB 311 (introduced 1/10/2012).
- Illinois: SB 2877 (introduced 2/1/2012).
- Kansas: HB 2508 (introduced 1/23/2012).
- Louisiana: HB 970 (introduced 3/12/2012) & HB 1191 (introduced 4/4/2012).
- Oklahoma: SB 1618 (introduced 2/6/2012).
- Pennsylvania: SB 1464 (introduced 3/29/2012).
Conclusion
Adoption of the same or substantially similar provisions of the NAIC Insurance Holding Company System Regulatory Act (Model 440) and corresponding Regulation (Model 450) are required for state accreditation. With respect to the 2010 Model Law, the current “Draft Proposal for Substantially Similar Provisions”12 includes virtually all of revisions in the 2010 Model Law, including the ERR requirement and specified definition of “enterprise risk.” Thus, assuming all states choose to retain their current NAIC accreditation, insurers and their UCPs should be preparing to comply with the ERR requirement within the next several years,13 and, in some states, as early as next year.
However, preparations for implementation of the ERR requirement are likely to be complicated by any individual state deviations from the 2010 Model Law as well as the Form F’s use of undefined terms (i.e. “material distribution pattern”) and imprecision in the reporting standards themselves. UCPs and regulated insurers both would be well served to pay close attention to specific ERR provisions enacted by the states and any clarifications or guidance regarding the ERR requirement as may be offered by regulators in the future.