EIOPA proposal for Regulatory Technical Standards (RTS) on management of sustainability risks including sustainability risk plans – Part 2

Our recent article presented EIOPA’s RTS proposal regarding the requirements of sustainability risk management with respect to ORSA, governance and key functions within the future, significantly broadened Solvency II framework.

This article will focus on materiality and financial assessment of sustainability risks as well as on proposed metrics, targets, and actions described by the RTS draft.

Materiality assessment

The definition of materiality under Solvency II and the European Sustainability Reporting Standards (ESRS) are aligned in their focus on the potential impact of information on decision-making.

  • Under Solvency II, for public disclosure purposes, materiality means that if an issue is omitted or misstated, it could influence the decision-making or judgment of users of the information, including supervisory authorities. As to financial materiality, sustainability risks can translate in a financial impact on the (re)insurer’s assets and liabilities through existing risk categories, such as underwriting, market, counterparty default or operational risk as well as reputational risk or strategic risk. In other words, they are ‘drivers’ to existing risk categories.
  • Similarly, the ESRS defines materiality as the potential for sustainability-related information to influence decisions that users make on the basis of the undertaking’s reporting. In the context of financial materiality, which is relevant for Solvency II purposes, the ESRS specifies that a sustainability matter is considered material if it could trigger or reasonably be expected to trigger material financial effects on the undertaking. This includes material influence on the undertaking’s development, financial position, financial performance, cash flows, access to finance or cost of capital over the short-, medium- or long-term. The materiality of risks is based on a combination of the likelihood of occurrence and the potential magnitude of the financial effects.

The two frameworks are aligned as material financial effects, as defined by the ESRS, would likely influence the decision-making or judgment of users of the information, including supervisory authorities. This alignment enables undertakings to apply a consistent materiality assessment approach across both Solvency II and ESRS reporting requirements.

Both Solvency II and ESRS do not set a quantitative threshold for defining materiality. The RTS do not specify a threshold for materiality either, considering this should be entity-specific. The undertakings should however define and document clear and quantifiable materiality thresholds, taking into account the above and provide an explanation on the assumptions made for the categorisation into non-material and on how the conclusion on the materiality has been reached. The classification of an exposure or risk as material has bearing on its prudential treatment, as it is a factor that determines whether the risk should be further subject to scenario analysis in the undertaking’s ORSA. The RTS require the undertaking to explain its materiality threshold in the plan: the assumptions for classifying risks as (non-) material in light of the undertaking’s risk appetite and strategy.

The materiality assessment should consider that:

  • Sustainability risks are potential drivers of prudential risk on both sides of the (re)insurers’ balance sheet.
  • Sustainability risks can lead to potential secondary effects or indirect impacts.
  • The exposure of undertakings to sustainability risks can vary across regions, sectors, and lines of business.
  • Sustainability risks can materialise well beyond the one-year time horizon as well as have sudden and immediate impact. Therefore, the materiality assessment necessitates a forwardlooking perspective, including short, medium, and long term. For example, certain geographical locations may not be subject to flood risk today but may be so in the future due to sea level rise. The risk assessment should be performed gross and net of reinsurance, to measure the risk of reliance on reinsurance.

The materiality assessment would consist of a high-level description of the business context of the undertaking considering sustainability risks (‘narrative’) and the assessment of the exposure of the business strategy and model to sustainability risk (‘exposure assessment’), to decide whether a risk could be potentially material. Following this, based on the identification of a potentially material risk, the undertaking would perform an assessment of the potential financial impact (i.e., financial risk assessment, as part of ORSA).

The narrative should describe the business context of the undertaking regarding sustainability risks, and the current strategy of the undertaking. It also describes the long-term outcome, the pathway to that outcome, and the related actions to achieve that outcome (e.g., emissions pathways, technology developments, policy changes and socio-economic impacts).

The narrative would include a view on the broader impact of national or European transition targets on the economy, or the effect of a transition risk throughout the value chain. The narrative should include other relevant sustainability risks than climate, such as risks related to loss of biodiversity, or social and governance risks, as well as interlinkages between sustainability risks (e.g., between climate and biodiversity or climate and social) and spill-over and compounding effects looking beyond specific sustainability risk drivers on particular lines of business.

Sustainability narratives, indicators, and interlinkages

  • Narrative: For example, for climate change undertakings may refer to publicly available climate change pathways (i.e., the Representative Concentration Pathways (RCPs) developed by the Intergovernmental Panel on Climate Change (IPCC); Network for Greening the Financial System (NGFS)) or develop their own climate change pathway.
  • Indicators: Macro-prudential risk indicators or conduct indicators may provide additional insights and help the undertaking form its view on the future development of sustainability risks. Especially over a longer horizon, sustainability risk could have a wider and compounding impact on the economy and interactions between the financial and the real economy would need to be considered. For example, indirect impacts of climate change could lead to increase in food prices, migration, repricing of assets and rising social inequalities. All these indirect drivers will, in turn, impact the real economy as well as the financial sector, even more so as they could also trigger political instability. Macroprudential concerns could include, for example, plausible unfavourable forward-looking scenarios and risks related to the credit cycle and economic downturn, adverse investments behaviours or excessive exposure concentrations at the sectoral and/or country level. For example, EIOPA financial stability and conduct ESG risk indicators can be used to assess the external environment and business context in which climate change-related risks/opportunities can arise for the undertakings, the risk indicators will give an indication of macro-prudential risk in the insurance sector, and potential ESG related developments at sector level to the detriment of consumer protection.
  • Interlinkages: For example, increasing temperatures leading to increased mortality risk affecting health business can potentially create underwriting as well as legal transition risk if the conditions for triggering a liability insurance have been met (e.g. a company failing to mitigate/adapt the risk). But also, a sharp increase in physical risks can lead to public policies focusing on a faster economy transition, leading in turn to higher transition risks. Physical and transition risks can impact economic activities, which in turn can impact the financial system. At the same time, the interconnectedness of the financial sector, and more generally of the economy, can create secondary effects: physical risk reducing the value of property, reducing in turn the value of collateral for lending purposes or increasing the cost of credit insurance, leading to economic slowdown; or physical damage caused by extreme weather events to critical infrastructure increasing the potential for operational/IT risks, amplifying supply chain disruption and disruption to global production of goods.

Based on the narrative, through qualitative and quantitative analyses, undertakings should arrive at an assessment of the materiality of their exposure to sustainability risks. A qualitative analysis could provide insight in the relevance of the main drivers in terms of traditional prudential risks. A quantitative analysis could assess the exposure of assets and underwriting portfolios to sustainability risk.

Exposure assessment

The aim is to identify sustainability risk drivers and their transmission channels to traditional prudential risks (i.e. market risk, counterparty risk, underwriting risk, operational risk, reputational risk and strategic
risk). Additionally, the assessment should provide insight into (direct) legal, reputational or operational risks or potential (indirect) market or underwriting risks, which could arise from investing in or underwriting activities with negative sustainability impacts, or from the undertaking misrepresenting its sustainability profile in public disclosure.

  • Qualitative analysis to help identifying the main drivers of climate change risks:
    • Transition risk drivers include changes in policies, technologies, and market preferences as well as the business activities of investees and commercial policyholders and policyholder preferences. At macro level, it may include consideration of failure of national governments to meet transition targets.
    • Physical risk drivers include level of both acute and chronic physical events associated with different transition pathways and climate scenarios. This involves assessing the impact of physical risks to counterparties (investees, policyholders, reinsurers) as well the insurer’s own operations (e.g.to insurer’s business continuity, also for outsourced services). For climate change-related risks, the assessment should consider the evolution of extreme weather-related events for insurers underwriting natural catastrophe risks (incl. in property and health insurance).
  • Geographical exposure: Identify potential exposure of assets or insured objects to sustainability risk based on, for example, the location of operations, assets or insured objects or supply chain dependencies of investee companies in geographical areas, regions or jurisdictions prone to (physical) climate, other environmental or social risks.
    • Natural catastrophe and environmental risk datahubs such as the Copernicus datasets on land (use) or biodiversity can give an indication of relevant environmental risks across regions.
    • Social risk indicators identify countries or regions that are vulnerable to social risk, measure social inequality or development. These can give an indication on potential social risk exposure of assets or liabilities located in those regions.
  • Economic activity/sector-based exposure: Identify potential exposure of assets or lines of business or insured risks to potential sustainability risks based on the impact of the investee (or supply chain dependencies of the investee) or the policyholder’s economic activity, or their dependency on environmental or social factors. Such assessment should however not only focus on for example, exposures to climate related sectors, but also to other sectors which may be indirectly affected by (transition) risks.
    • Alignment of the economic activity with the climate and environmental objectives and screening criteria set out in the Taxonomy Regulation and Climate, Environmental Delegated Regulations, as supported by the taxonomyrelated disclosures.
    • Biodiversity loss, a high-level exposure assessment of could be carried out using the level of premiums written in economic sectors with a high dependence on ecosystem services and/or a high biodiversity footprint (economic exposure) and the probability of occurrence of the associated nature-related risk factors.
    • Social risks, exposure of assets or liabilities to economic activities in ‘high risk social sectors’, can be identified by referring to the Business and Human Rights Navigator (UN Global Compact), which can help mapping exposure to sectors at high risk of relying on child labour, forced labour, or sectors negatively impacting on equal treatment (incl. restrictions to freedom of association) or on working conditions (inadequate occupational safety and health, living wage, working time, gender equality, heavy reliance on migrant workers) or have negative impacts on indigenous people.

Financial risk assessment

Where the exposure is deemed material, based on the thresholds set by the undertaking, a more detailed evaluation of the financial risks combining quantitative and/or qualitative approaches should inform the financial impact on the undertaking’s balance sheet. Here the assessment should aim to identify the key financial risk metrics and provide a view of the expected impact of such risks under different scenarios and time horizons at various levels of granularity.

Scenarios

When assessing the potential financial impact of material sustainability risks, the RTS sets out that undertakings should specify at a minimum two scenarios that reflect the materiality of the exposure and the size and complexity of the business. One of the scenarios should be based on the narrative
underpinning the materiality assessment. Where relevant, the scenarios should consider prolonged,
clustered, or repeated events
, and reflect these in the overall strategy and business model including
potential stresses linked to the

  • availability and pricing of reinsurance,
  • dividend restrictions,
  • premium increases/exclusions,
  • new business restrictions,
  • or redundancies.

For climate change risks, the Solvency II Directive requires undertakings with a material exposure to climate change risks to specify at least two long term climate change scenarios:

(a) a long-term climate change scenario where the global temperature increase remains below two degrees Celsius;

(b) a longterm climate change scenario where the global temperature increase is significantly higher than two degrees Celsius.

Experience to date shows that the most used scenarios are those designed by NGFS43, IPCC Shared Socioeconomic Pathways (SSPs) or tailor-made scenarios (set by regulators, e.g. for nature-related scenarios or for stress testing purposes.

Time horizons

The time horizon should ensure that the time horizon for analysing sustainability risks is consistent with the undertaking’s long-term commitments. The time horizon should allow to capture risks which may affect the business planning over a short-to-medium term and the strategic planning over a longer term.

The time horizon chosen for the materiality assessment in sustainability risk plan should also enable the integration of the risk assessment process with time horizons applied for the purposes of the ORSA for risk assessment purposes.

Taking the example of the impact of climate change: its impact can materialise over a longer time horizon than the typical 3-5 years (re)insurers’ strategic and business planning time horizons considered in the ORSA. It is argued that ORSA time horizons are too short to integrate the results of such longer-term climate change scenarios. Nevertheless, the ORSA should allow for the monitoring of the materialisation of risks over a longer term. At the same time, climate change-related risks and opportunities can affect the business planning over a short term and the strategic planning over a longer term.

The RTS specify the time horizons for sustainability risk assessment, to promote supervisory convergence and increase the consistency of risk assessment across undertakings and with decisionmaking. For this purpose, the RTS stipulates that the following time horizons for the sustainability risk assessment apply:

  • Short term projection: 1-5 years
  • Medium term projection: 5-15 years
  • Long term projection: min. 15 years

Documentation and data requirements

The sustainability risk assessment should be properly documented. This would include documenting the methodologies, tools, uncertainties, assumptions, and thresholds used, inputs and factors considered, and main results and conclusions reached.

Undertakings’ internal procedures should provide for the implementation of sound systems to collect and aggregate sustainability risks-related data across the institution as part of the overall data governance and IT infrastructure, including to assess and improve sustainability data quality.

Undertakings would need to build on available sustainability data, including by regularly reviewing and
making use of sustainability information disclosed by their counterparties, in particular in accordance with the CSRD or made available by public bodies.

Additional data can be sourced from interaction with investees and policyholders at the time of the
investment or underwriting of the risk
, or estimates obtained from own analysis and external sources.
Undertakings should, where data from counterparties and public sources is not available or has shortcomings for risk management needs, assess these gaps and their potential impacts. Undertakings
should document remediating actions, including at least the following: using estimates or (sectoral) proxies as an intermediate step – the use of such estimates should be clearly indicated – , and seeking to reduce their use over time as sustainability data availability and quality improve; or assessing the need to use services of third-party providers to gain access to sustainability data, while ensuring sufficient understanding of the sources, data and methodologies used by data providers and performing regular quality assurance.

Frequency

The RTS aim to align the frequency of performance of the materiality and financial risk assessments
with, on the one hand, the cycle of the submission of the regular supervisory report to the supervisor ‘at least every three years’, if not stipulated differently by the supervisor, and the requirement for undertakings to assess material risks as part of their ORSA ‘regularly and without any delay following any significant change in their risk profile’.

Significant changes to the undertaking’s risk profile can include material change to its business environment including in relation to sustainability factors, such as significant new public policies or shifts in the institution’s business model, portfolios, and operations.

In addition, for the frequency of the financial risk assessment, the RTS need to consider that undertakings (except for SNCUs) are required to conduct at regular intervals, at a minimum every three years, the analysis of the impact of at least two long-term climate change scenarios for material climate change risks on the undertaking’s business.

Based on these considerations, the RTS set out that the materiality and financial risk assessment should be conducted at least every three years, and regularly and without any delay following any significant change in their risk profile.

Building on the requirements , the RTS specifies that key metrics and the results of the sustainability risk
plan should be disclosed at least every year
or, for smaller and non-complex undertakings, at least every two years or more frequently in case of a material change to their business environment in relation to sustainability factors.

Metrics

Prescribing a list of metrics in sustainability risk plans can help

  • in promoting risk assessment,
  • improve comparability of risks across undertakings,
  • promote supervisory convergence in the monitoring of the risks and
  • enable relevant disclosures.

At the same time, it is important to allow undertakings flexibility in defining their metrics to avoid missing useful undertaking-specific information. Therefore, the RTS describes the key characteristics of the metrics and provides a minimum list of relevant metrics to compute.

Backward-looking (current view) and forward-looking, can be tailored to the undertaking’s business model and complexity, while following key characteristics apply. Metrics should

  • provide a fair representation of the undertakings’ risks and financial position using the most up-to-date information.
  • be appropriate for the identification, measurement, and monitoring of the actions to achieve the risk management targets.
  • be calculated with sufficient granularity (absolute and relative) to evaluate eventual concentration issues per relevant business lines, geographies, economic sectors, activities, and products to quantify and reflect the nature, scale, and complexity of specific risks.
  • allow supervisors to compare and benchmark exposure and risks of different undertakings over different time horizons.
  • be documented to a sufficient level to provide relevant and reliable information to the undertaking’s management and at the same time be used as part of supervisory reporting and, where relevant for public disclosure, ensuring sufficient transparency on the data (e.g. source, limitations, proxies, assumptions) and methodology (e.g. scope, formula) used.

The RTS requires the following minimum current view metrics:

The following list includes optional metrics which could be considered by the undertaking on a voluntary basis to report on the results of scenarios analysis (financial risk assessment) for material sustainability risks.

Targets

Based on the results of the sustainability risk assessment, the undertaking’s risk appetite and long-term
strategy
, the undertaking should set quantifiable targets to reduce or manage material sustainabilityrelated exposure/risks or limits sustainability-related exposure/risks to monitoring prudential risks over the short, medium, and long term.

The undertaking should, based on its risk appetite, specify the type and extent of the material sustainability risks the undertaking is willing to assume in relation to all relevant lines of business, geographies, economic sectors, activities and products (considering its concentration and diversification objectives) and set its risk management targets accordingly.

Undertakings shall explain the way the target will be achieved or what is their approach to achieve the
target. Intermediate targets or milestones should allow for the monitoring of progress of the undertaking in addressing the risks. The undertakings should specify the percentage of portfolio covered by targets.

The targets should be consistent with any (transition) targets used in the undertaking’s transition plans and disclosed where applicable. The targets and measures to address the sustainability risks will consider the latest reports and measures prescribed by the European Scientific Advisory Board on climate change, in particular in relation to the achievement of the climate targets of the Union.

Relation between targets, metrics, and actions across transition plans, sustainability risk plans and ORSA, applied to an example for transition risk assessment for climate risk-related investments

Actions

Actions to manage risks should be risk-based and entity-specific.

  • Actions set out in undertakings’ transition plans, for example under CSDDD can inform the sustainability (transition) risk to the undertaking’s business, investment, and underwriting. Such transition plan actions typically involve:
  • Limiting investment in non-sustainable activities/companies Introduction of sustainability criteria in the investment decision.
  • Re-pricing of risks.
  • Integrating sustainability into the investment guidelines.
  • Stewardship, impact investing, impact underwriting.
  • Integrating ESG into the underwriting standards and guidelines of the undertaking.
  • Product development considering the impact on climate change.

The measures in the transition plan and actions to address financial risks arising from the transition need to be integrated into the investment, underwriting and business strategy of the undertaking. They need to be measurable and where actions fail to meet their expressed target, these should be monitored and, where necessary, adjusted.

EIOPA proposal for Regulatory Technical Standards (RTS) on management of sustainability risks including sustainability risk plans

Early december 2024 EIOPA has published its consultation paper on management of sustainability risks and the newly created sustainibility risk plans. Very detailed and far reaching standards for the (re)insurance industry that will be added to the ESRS and CSRD framework and significantly enhance existing Solvency II requirements as part of the broader Solvency II reform (Proposal for a Directive of the European Parliament and of the Council amending Directive 2009/138/EC as regards proportionality, quality of supervision, reporting, long-term guarantee measures, macro-prudential tools, sustainability risks, group and cross-border supervision).

This article covers the new requirements for governance (AMSB, Key Functions) and the framework for the sustainability risk plans. An upcoming article will deal with materiality and financial assessments covered by the RTS draft as well as with the new metrics to be integrated in the extended framework.

Background and rationale

The Solvency II Directive requires undertakings to implement specific plans to address the financial risks from sustainability factors and mandates EIOPA to specify the elements of these plans. Article 44 of the amended Solvency II Directive requires undertakings to develop and monitor the implementation of specific plans, quantifiable targets, and processes to monitor and address the financial risks arising in the short, medium, and long-term from sustainability factors. The Directive mandates EIOPA to specify in regulatory technical standards (RTS) the minimum standards and reference methodologies for the

  • identification,
  • measurement,
  • management,
  • and monitoring

of sustainability risks, the elements to be covered in the plans, the supervision and disclosure of relevant elements of the plans.

According to EIOPA, the RTS apply the following approach:

  • First, the proposed RTS build on the existing prudential requirements and integrate the sustainability risk plans into undertakings’ existing risk management practices. The Solvency II Delegated Regulation as amended in 2022 as well as amendments to the Solvency II Directive already require the management of sustainability risks. Existing policy statements and guidance issued by EIOPA set out supervisory expectations on aspects of sustainability risks management. The elements of the sustainability risk plans feed off these requirements and into the own risk and solvency assessment (ORSA) of material financial risks. The sustainability risk plans will be part of undertakings’ regular supervisory reporting.
  • Second, the RTS ensure a read-across between the undertakings’ sustainability and transition plans. While the sustainability risk plans focus on prudential risks for insurers arising from sustainability factors, the undertakings’ actions to mitigate these risks will need to consider their transition efforts.
  • Third, the RTS enable undertakings, including those that are subject to the Corporate Sustainability Reporting Directive (CSRD), to disclose on sustainability risk in a consistent and efficient manner. The RTS specify the minimum standards and methodologies, including selected risk metrics, for performing and disclosing on prudential sustainability risks, as required by the Solvency II Directive. Insurers subject to CSRD can feed the elements identified for public disclosure as part of the Solvency II Solvency and Financial Condition Report (SFCR), into the disclosure required under CSRD.

Own Risk and Solvency Assessment (ORSA)

Insurers shall integrate sustainability risk assessment in their system of governance, risk management
system and ORSA
, as illustrated below:

  • Risk management function and areas: the risk management function shall identify and assess emerging and sustainability risks. The sustainability risks identified by the risk management function shall form part of the own solvency needs assessment in the ORSA. Undertakings shall integrate sustainability risks in their policies. This includes the underwriting and investment policies, but also, where relevant policies on other areas (e.g. ALM, liquidity, concentration, operational, reinsurance and other risk mitigating techniques, deferred taxes risk management). The underwriting and reserving policy shall include actions by the undertaking to assess and manage the risk of loss resulting from inadequate pricing and provisioning assumptions due to internal or external factors, including sustainability risks. The investment risk management policy shall include actions by the insurance or reinsurance undertaking to ensure that sustainability risks relating to the investment portfolio are properly identified, assessed, and managed.
  • Prudent person investment principle: when identifying, measuring, monitoring, managing, controlling, reporting, and assessing risks arising from investments, undertakings shall take into account the potential long-term impact of their investment strategy and decisions on sustainability factors.
  • Actuarial function: regarding the underwriting policy, the opinion to be expressed by the actuarial function shall at least include conclusions on the effect of sustainability risks.
  • Remuneration policy: The remuneration policy shall include information on how it takes into account the integration of sustainability risks in the risk management system.

Sustainability Risk Plans

Considering the relationship with the ORSA, regular supervisory reporting and public disclosure, the figure below sets out the structure of the sustainability risk assessment and key elements of the plan:

The sustainability risk plans should be sufficiently robust to support insurers’ risk management process and the supervisory review of the risk management. Considering the information that is required in the ORSA (for material risks), the sustainability risk plans reported to the National Supervisory Authority should include as a minimum:

a) Governance arrangements and policies to identify, assess, manage, and monitor material sustainability risks.
b) A sustainability risk assessment consisting of:
I. A materiality assessment.
II. A financial risk assessment.
c) Explanation of the key results obtained from the materiality assessment and from the financial risk assessment, where applicable
d) The risk metrics, where relevant, based on different scenarios and time horizons.
e) Quantifiable targets over the short, medium, and long term to address material risks in line with the undertaking’s risk appetite and strategy.
f) Actions by which the undertaking manages the sustainability risks according to the targets set.

Governance

Business model and strategy

Sustainability risks and opportunities can affect the business planning over a short-to-medium term and the strategic planning over a longer term.

The Administrative, Management, and Supervisory Body (AMSB) should set risk exposure limits, targets, and thresholds for the risks that the undertaking is willing to bear with regards to sustainability risks, taking into account:

  • Short-, medium- and long-term time horizon, considering the impact sustainability risks may have soon, but also over the longer term, to be reflected in the business planning over a short-to-medium term and the strategic planning over a longer term.
  • The impact of sustainability risks on the external business environment that will feed into the (re)insurers’ strategic planning.
  • The undertaking’s exposure to material sustainability risk, across sectors and geographies, the transmission channels across risk categories and lines of business.
  • Qualitative and quantitative results from scenario, sensitivity, and stress testing.

Potentially relevant questions which the undertaking can consider when integrating sustainability risk assessment into its governance are:

How does the AMSB expect that sustainability risks might affect its business?

  • Does the AMSB consider sustainability factors as a risk and/or opportunity? If yes, in what ways might environmental, social or governance factors pose risks to the undertaking’s business in economic or financial terms, or create opportunities? If neither risk nor opportunities seem to exist, why not? Has the undertaking elaborated different strategic options to manage the risks and how they have been developed?
  • Has the AMSB implemented or planned any substantive changes to its business strategy in response to current and potential future sustainability impacts? If yes, what are the key risk drivers that it would consider relevant to its strategy? If not, why not?
  • Is the AMSB concerned about secondary effects or indirect impacts of sustainability on the undertaking’s overall strategy and business model (e.g. any systemic repercussions on the industry or the economy)?
  • What is the undertaking’s time horizon for considering environmental, social or governance risks?

Governance

A. The AMSB

Fitness and propriety. The AMSB is responsible for setting undertakings’ risk appetite and making sure that all risks, and therefore also sustainability risks, if material, are effectively identified, managed, and controlled.

For this, the AMSB should collectively possess the appropriate qualification, experience, and knowledge relevant to assess long-term risks and opportunities related to sustainability risks, which may be obtained or improved through appropriate training.

Effectiveness. To ensure the AMSB effectively executes its responsibilities to identify, manage and control sustainability risks, the AMSB should:

  • be aware of their obligations in the context of the long-term impacts of sustainability risks.
  • be capable of identifying sustainability risks as possible key risks for the undertaking.
  • openly discuss within the AMSB sustainability risks and opportunities.
  • effectively communicate on sustainability risks as possible key risks to in the short and long term.
  • interact with the rest of the organisation by putting sustainability risk as a possible key topic in the day-to-day business.
  • plan and deliver results by considering the impact of sustainability risks and opportunities.
  • take sustainability risks into consideration in the decision-making process.

B. Risk Management and other Key Functions

The risk management function has a vital role in:

Risk identification and measurement: The risk management function will need to ensure that the undertaking effectively identifies how sustainability risks could materialise within each area of the risk management system. It also sets the approach used by undertakings to measure and quantify their exposure to sustainability risks, including understanding the limitations of the methods used, and any gaps the undertaking faces in data and methodologies to assess the risks. Undertakings need to apply relevant tools to identify risks in a proportionate way depending on the nature, scale, and complexity of the risks.

Given the forward-looking nature of the risks and the inherent uncertainty associated with sustainability risks, undertakings will need to use appropriate methodologies and tools necessary to capture the size and scale of the risks. This would imply going beyond using only historical data for the purposes of the risk assessment and depending on the materiality of risk at stake, implement forward-looking technique (i.e. stress testing and scenario analysis), for example by considering also future trends in catastrophe modelling or environmental risk assessment. Science, data, or tools may not yet be sufficiently developed to estimate the risks accurately. As undertakings’ expertise and practices develops, the expectation should be that the approach to identifying and measuring the sustainability risks will mature over time. Hence, the risk management function will need to establish the following:

  • clear policies and procedures for identifying, measure, monitor, managing and report sustainability risks, and the review and approval by the AMSB.
  • qualitative, quantitative or a mix of both approaches to appropriately identify and measure the risks, and any limitations to data and tools.
  • forward-looking analysis of underwriting liabilities or investment portfolios under different future (transition) scenarios, setting out the key data inputs and assumptions as well as gaps and barriers (information, data, scenarios) which complicate undertaking’s efforts to undertake scenario analysis.
  • oversight of any activities performed by the external service providers (e.g. ESG rating providers).

Risk monitoring: The risk management function will need to establish the methodologies, tools, metrics and suitable key risk or performance indicators to monitor the sustainability risks and ensure that risks are consistent with internal limit and its risk appetite. These quantitative and qualitative tools and metrics would aim, for example, at monitoring exposures to climate change-related risk factors which could result from changes in the concentration of the investment or underwriting portfolios, or the potential impact of physical risk factors on outsourcing arrangements and supply chains. The tools and metrics need to be updated regularly to ensure that risks underwritten, or investments made remain in line with undertakings’ risk appetite and support decision making by the AMSB. In addition to that, a list of circumstances which would trigger a review of the strategy for addressing the sustainability risks can be considered as a good practice.

Risk management/mitigation: Risk management measures should be proportionate to the outcome of the materiality assessment. Where material potential impacts of the sustainability risks have been identified, undertaking(s) should identify risk management and mitigating measures. The written policies on the investment and underwriting strategy should include such potential measures. Based on the double materiality principle, the investment and underwriting policy will also consider the financial risks to the balance sheet arising from the impact posed by the underwriting and investment strategy and decisions on sustainability factors. Risk management measures can therefore include measures to help reducing risks caused by climate change, through premium incentives, for example.

The actuarial function shall also consider sustainability risks in its tasks. This would include:

  • concluding on the effect of sustainability risks in the opinion on the underwriting policy. For example, considering the increasing expected losses from physical damage due to increasingly severe and frequent natural catastrophes, the choice of underwriting certain perils, but also the pricing of the perils will need to be considered in a forward-looking manner, having regard to the sustainability of the business strategy.
  • an opinion on the adequacy of the reinsurance arrangements of the undertaking taking special account of the sustainability risks of the undertaking, the undertaking’s reinsurance policy and the interrelationship between reinsurance and technical provisions. The undertaking may consider that in times of increasing losses due to climate change, the reinsurance market may ‘harden’ and increase the cost for primary reinsurance.
  • contributing to the effective implementation of the risk management system, providing the necessary support to the risk management function. For example, considering increasing losses for natural catastrophes due to climate change, the actuarial function will need to contribute to the assessment of the risk and opportunity of underwriting certain natural perils. The actuarial pricing of climate change risks can inform the overall risk management strategy and contribute to the underwriting policy by informing on the risks of underwriting certain perils and the opportunity to invest in prevention measures to reduce the losses. The consideration of climate change in an actuarial risk-based manner should allow for the consideration of incentives in the pricing and underwriting of certain natural hazards, with the view to potentially reduce losses over a longer-term perspective.
  • coordinating the calculation of technical provisions and overseeing the calculation of technical provision, including referring to risks to technical provision driven by sustainability factors.
  • assessing the sufficiency and quality of the data used in the calculation of technical provisions including the validation of relevant sustainability risk input data and comparison of best estimates against experience. The assessment may include expressing a view on data limitations as well as considerations on how to implement a forward-looking view on the risks.

The role of the compliance function regarding sustainability risks would imply, as part of establishing and implementing the compliance policy:

  • assessing legal and legal change risks related to sustainability regulation. Especially as regulatory requirements are building up on sustainability risk management, reporting and disclosure, the compliance with new legal requirements will require attention.
  • providing information on the high-risk areas within the undertaking as regards to the transition policy of the company and legal risk attached to implementing (or not) the transition targets, from a prudential and conduct perspective.
  • identifying potential measures to prevent or address non-compliance. This may require addressing the risk of misrepresentation at entity or product level on the sustainable nature of its risk management or of its product offer.

The internal audit function should consider, where relevant sustainability risks in the preparation and maintaining of internal audit plan. This may include:

  • highlighting high-risk areas to requiring special attention. The potentially increased reliance on external parties as data providers on sustainability risks, or for verification of the sustainability of investments regarding environmental or social objectives, may need particular attention to ascertain the quality of the outsourced activity.
  • coping with follow-up actions in particular recommendations in areas, processes, and activities subject to review.

Functions or committees with special responsibility for sustainability risks. The AMSB may decide to delegate the task of addressing sustainability matters to specific committee(s). Such committees discuss and propose matters to the AMSB for it to take appropriate actions and pass resolutions. It is important to highlight that the responsibility about decisions about material sustainability risks remains with the AMSB. If a (re)insurance undertaking has or intends to set up a function with special responsibility for sustainability risks, its integration with existing processes and interface with key and other functions must be clearly defined. A dedicated sustainability unit or function would therefore be involved, in addition to the risk management function, actuarial function and/or compliance function, whenever the insured risk or investment is sensitive to sustainability risk, e.g., by virtue of the economic sector in which the investment was made, or the geographical location of the insured object.

Misunderstandings regarding the role or extent of the assessment to be made by the sustainability function must be avoided. In other words, it needs to be ascertained whether the function has a mere corporate/communication role (e.g. in dealing with corporate responsibility and reputational risks) or is also intended and equipped for sustainability materiality and financial risk analysis.

Remuneration

Remuneration can be used as a tool for the integration of sustainability risks and incentives for
sustainable investment or underwriting decisions
. The Solvency II Delegated Regulation stipulates that the remuneration policy and remuneration practices shall be in line with the undertaking’s business and risk management strategy, its risk profile, objectives, risk management practices and the long-term interests and performance of the undertaking. It further stipulates that the remuneration policy shall include information on how it takes into account the integration of sustainability risks in the risk management system.

Furthermore, undertakings within the scope of the Sustainable Finance Disclosure Regulation shall include in their remuneration policies information on how those policies are consistent with the integration of sustainability risks, and to publish that information on their websites.

Undertakings will need to take into account both financial and non-financial criteria when assessing
an individual’s performance at certain point of time
: the consideration of sustainability factors is an example of non-financial (or increasingly financial) criteria that could be considered when assessing individual performance. For example, increasingly, for investment professionals, the risk framework should include an assessment of sustainability risks.

From a sustainability perspective, the alignment of the remuneration policy with the institution’s
long-term risk management framework and objectives, seems relevant. In addition, a number of studies concluded that, although it is difficult to prove that short-term strategies result in the destruction of long-term values, in some cases the short-term orientations of managers and investors become self-reinforcing. Therefore, incentives to shift the overall business strategy towards more long-term goals (e.g. promoting ‘patient capital’, increasing the long-term commitments of shareholders or tie managers’ remunerations to long-term performances through training and disclosure of long-term oriented metrics) are relevant in view of the long-term horizon of sustainability risks and opportunities.

The impact of the remuneration policies on the achievement of sound and effective long-term risk
management objectives may be especially relevant when it comes to the variable remuneration of
categories of staff whose professional activities have a material impact on the institution’s risk profile
, taking into account their roles and responsibilities in relation to its sustainability strategy.

Among the currently existing practices across the EU, variable remuneration of employees of (re)insurance undertakings is based on performance and mostly on short-term basis – annual bonuses, or bonuses linked to the business strategy over 3-5 years. The performance of employees would therefore need to be aligned with the longer-term horizon of sustainability risks.

For example, long-term strategy goals such as reducing financed emissions in the investment portfolio or limiting losses in the underwriting of natural catastrophes can be aligned with the remuneration goals horizon, as for example through:

  • Medium-to-short term remuneration incentives linked to achieving set targets in reducing CO2 emissions of investments or linked to reduction of losses through risk prevention initiatives for climate adaptation purposes.
  • Longer-term incentives linked to payment with shares in the company, nudging the executive to take decisions in the long-term interest of the company.

Where the remuneration strategy of the undertaking refers to vague discretionary measures of progress such as ‘improving sustainability’ or ‘driving a robust ESG program’, these should be supported by specific goals or commitments and be measurable, meaningful, and auditable.

How to lead complex change when adopting AI in finance

Change management in AI adoption is not just about technology; it’s about people, data and processes.

The rise of Artificial Intelligence (AI) to solve challenges across business sectors has made it an indispensable tool for finance departments that aim to be more efficient, precise, and insightful. Modern businesses require AI, boards are demanding it, and competitors are implementing it. However, the adoption of AI can be daunting; it necessitates transformational changes within the organization.

Successful change starts with transformational leadership who drive a culture of change within their organization and understand the importance of linking the change initiative with

  • defined business objectives,
  • stakeholder engagement,
  • and strong project management.

Understanding your business objectives

Before you even start to consider which AI technology to adopt, understanding the specific business objectives, and how they support the overall direction of the company, department, or initiative, is critical. Whether becoming more data-driven when it comes to risk assessment, or improving efficiency by streamlining internal audits, having clearly defined objectives will help your organization focus.

Three pillars of change management for AI adoption

People
A comprehensive change program for AI will contain several core people readiness elements to support stakeholders through the journey from awareness of AI to becoming AI advocates. Examples of core people elements include:

  • Early and active engagement from key stakeholders, including both senior management and end users.
  • A strong communications plan that provides relevant and timely information and resources to stakeholders. The communication plan should also include critical initial steps of raising stakeholder awareness and understanding of the AI being applied and its benefits to the end user (what’s in it for me).
  • A comprehensive training program that includes both the understanding of AI and its benefits, and specific training around new processes and technology.

Process

The alignment of business objectives when updating existing processes to incorporate AI is crucial. Mapping your current as-is and future to-be state is a critical exercise to incorporate as part of your implementation and deployment.

Data

To support your AI initiative, understanding your data needs and building a strategy for seamless data integration and transformation is a critical step in implementing and deploying your AI solution.

Questions to ask AI vendors to help establish trust within your firm

Establishing trust in AI algorithms can increase resistance to change. Asking the right questions to AI vendors can support and deepen the awareness and understanding of AI practices within your organization to strengthen your trust of the application. Some key questions include:

  • What certifications or processes do they have in place?
  • Is a third-party algorithm audit possible?
  • Do they have a human-centric principle in their design?

Developing AI advocates within your organization requires several initial steps including

  • building awareness of AI practices,
  • providing a clear understanding of what the technology is doing,
  • and articulating the benefits for the end users (the what’s in it for me).

Overcoming change management obstacles

Address roadblocks with the Change Scorecard

The Change Scorecard provides a diagnostic view of how the change process is going. It links
observed symptoms like frustration or disengagement back to root issues such as lack of
incentives or skills. Once identified, these can be addressed strategically to bring the change
process back on track.

The Change Scorecard

    Build a compelling change vision with a clear understanding of “what’s in
    it for me.”

    Organizations can lessen its resistance to change by providing a clear understanding of
    the change vision, its benefits and success criteria
    . Leverage this short template to craft
    impact statements that articulate

    • what we’re doing,
    • why we’re doing it,
    • and how we know we’ve done it well.

    Communications and the rule of 7

    One of the biggest problems with communication is the assumption that it has taken place, this is why it’s important to follow the “Rule of 7” when communicating: 7 times, 7 ways, 7 different days!

    Don’t forget to include the top questions from stakeholders, including:

    • What is changing?
    • Why are we changing?
    • What is staying the same?
    • What is expected of me?

    People readiness and training

    In order to enact change, the team responsible for making the change must be both willing (understand the benefits and willing to change) and able (have the skills, processes and systems in place to change).
    A robust change management program will ensure that there are both people readiness strategies and training enablement programs to ensure users have what they need to succeed.

    Change champion network and pulse checks

    Establishing a change champion network of super users, especially for teams spread across locations and time zones, is an excellent mechanism to increase support networks and disseminate of information both from the project team to the end users, and from the end users back to the core team. Additionally, Pulse Checks are excellent tools for gauging user sentiment during the transition. Regular check-ins can identify specific pain points and offer opportunities to correct the course. These are not just about gathering data but also serve as moments to clarify misconceptions and provide needed information.

    Towards a European system for natural catastrophe risk management

    EIOPA / ECB December 2024

    Executive Summary

    Increased economic exposure and the growing frequency and severity of natural catastrophes linked to climate change have been driving up the cost of natural catastrophes in Europe. Between 1981 and 2023, natural catastrophes caused around €900 billion in direct economic losses within the EU, with one-fifth of these losses having occurred in the last three years alone. However, over the same period, only about a quarter of the losses incurred from extreme weather and climate-related events in the EU were insured – and this share is declining.

    This “insurance protection gap” is expected to widen further due to the increasing risk posed by climate change. Europe is the fastest-warming continent in the world and increasing climate risk is likely to have implications for both the supply of and demand for insurance if no relevant measures are in place. As the frequency and severity of climate-related events grow, (re)insurance premiums are expected to rise. This will make insurance less affordable, particularly for low-income households. Climate change also increases the unpredictability of these events, which may prompt insurers to stop offering catastrophe insurance in high-risk areas. At the same time, low risk awareness and reliance on government disaster aid further dampen insurance uptake by households and firms.

    Recent events, such as the 2024 flooding in central and eastern Europe and in Spain, have further illustrated the challenges that extreme weather events can pose for the EU and its Member States. These events highlight the importance of emergency preparedness, risk mitigation, and adaptation efforts to prevent and/or minimise the losses from natural disasters, as well as the relevance of national insurance schemes in reducing the economic impact of natural catastrophes. They also bring to the fore the importance of addressing the insurance protection gap and the associated burden on public finances.

    National schemes aim to broaden insurance coverage and encourage risk prevention. Typically, they do so by setting up risk-based (re)insurance structures involving public-private sector coordination for multiple perils (e.g. floods, drought, fires and windstorms). Some of the schemes further support the availability of insurance through mandatory insurance coverage and improve the affordability of insurance through national solidarity mechanisms. At the same time, there are fewer risk diversification opportunities at national than at EU level and reliance on both national and EU public sector outlays has been growing. Therefore, it is beneficial to discuss at EU level how adaptation measures can help in proactively reducing disaster losses and how the sharing of losses between the public and private sectors can help in raising risk awareness and improving risk management before disasters occur.

    Building on existing national and EU structures, the EIOPA and BCE spell out a possible EU-level solution composed of two pillars, firmly anchored in a multi-layered approach:

    • An EU public private reinsurance scheme: this first pillar would aim to increase the insurance coverage for natural catastrophe risk where insurance coverage is low . The scheme would pool private risks across the EU and across perils, with the aim of further increasing diversification benefits at EU level, while incentivising and safeguarding solutions at national level. It could bef unded by risk based premiums from (re)insurers or national schemes , while taking into account potential implications of risk based pricing for market segmentation . Access to the scheme would be voluntary. The scheme would act as a stabilising mechanism over time to achieve economies of scale and diversification for the coverage of high risks at the EU level, similar to an EU public private partnership.
    • An EU fund for public disaster financing: this second pillar would aim at improving public disaster risk management among Member States . Payouts from the fund would target reconstruction efforts following high loss natural disasters, subject to prudent risk mitigation policies, including risk adaptation and climate change mitigation measures. The EU fund would be financed by Member State contributions adjusted to reflect their respective risk profiles. Fund payouts would be condition al on the implementation of concrete risk mitigation measures preagreed under national adaptation and resilience plans. This would incentivise more ambitious risk mitigation at Member State level before and after disasters. Membership would be mandatory for all EU Member States.

    Rising economic losses and climate change

    Economic losses from extreme weather and climate events are increasing and are expected to rise further due to the growing frequency and severity of catastrophes caused by global warming. Between 1981 and 2023, natural catastrophe-related extreme events caused around €900 billion in direct economic losses in the EU, with more than a fifth of the losses occurring in the last three years (2021: €65 billion; 2022: €57 billion; 2023: €45 billion).

    Europe is the fastest-warming continent in the world and the number of climate-related catastrophe events in the EU has been rising, hitting a new record in 2023. Moreover, climate change is already now affecting many weather and climate extremes in every region across the globe and its adverse impacts will continue to intensify. In the EU, all Member States face a certain degree of natural catastrophe risk and the welfare losses are estimated to increase in the absence of relevant measures to improve risk awareness, insurance coverage and adaptation to the rising risks.

    Over the last ten years, the reinsurance premiums for property losses stemming from catastrophes have increased across all major insurance markets. In Europe, property catastrophe reinsurance rates have risen by around 75% since 2017. While there may be various factors affecting reinsurance prices, the increasing frequency and severity of events is likely to trigger further repricing of reinsurance contracts, which can in turn increase prices offered by primary insurers. The rising risks may even prompt insurers to retreat from certain areas or types of risk coverage. Moreover, since insurance policies are typically written for one year only, such repricing or insurance retreat may be abrupt. Reduced insurance offer is justified where risks become excessively high or unpredictable. In particular, insurance cannot palliate for inadequate climate adaptation, spatial planning and (re)building conventions.

    At the same time, take-up of natural catastrophe insurance in the EU is declining among low-income households, thus increasing the pressure on governments to provide support in the event of a natural catastrophe. For instance, the share of low-income consumers with insurance for property damage caused by natural catastrophes has declined from around 14% to 8% since 2022. Affordability and budgetary constraints are the main reason why 19% of European consumers do not buy or renew insurance. Low-income households may also be disproportionately vulnerable to financial stress and are more likely to live in areas with increased exposure to environmental stress or natural catastrophes, due to the affordability of land and housing or limited resources to relocate to safer areas or invest in disaster-resistant housing. Insurance affordability stress might eventually also contribute to housing affordability issues, because if a larger portion of income is spent on insurance, a smaller portion is available for other expenses (e.g. rent). Therefore, solutions should consider vulnerability and consumer protection aspects.

    Lessons from national insurance schemes

    National schemes to supplement private insurance cover for natural catastrophes, such as PPPs, help improve insurance coverage and reduce the insurance protection gap. Looking at the European Economic Area (EEA), the share of insured losses tends to be higher in countries with such national schemes: the average share across countries with a national scheme is around 47%, while it is below 18% for those without a national scheme. Currently, eight EEA Member States have established a national scheme:

    The schemes share the same objective: they all aim to enhance societal resilience against disasters. They typically do so by improving risk awareness and prevention, while increasing insurance capacity through more affordable (re)insurance.

    While the design features vary by scheme, some of them are recurring:

    1. Scope: most national insurance schemes have a broad scope of coverage, which allows them to pool risks across multiple perils and assets. The majority also incorporate a mandatory element, requiring either mandatory offer or mandatory take up of insurance by law .
    2. Structure: the prevalent structure of national schemes is that of a public (re)insurance scheme. Most schemes offer complementary direct (re)insurance and are of a permanent nature.
    3. Payouts and premiums: national schemes are typically indemnity based (i.e. payouts are based on actual losses rather than quantitative/parametric catastrophe thresholds). Premiums are mostly risk based.
    4. Risk transfer and financing: the use of reinsurance by the schemes depends on the availabil ity and the cost of reinsurance, with national schemes increasingly facing issues over affordability. Public financing of the scheme is not an essential design feature.
    5. Risk mitigation and adaptation measures: initiatives to ensure proper coordination between the public and private sectors on risk identification and prevention are now emerging in response to climate change. Private and public sector responsibilities are typically divided, with the private market contributing its insurance expertise and modelling capacity, while the public sector provides the legal basis and operating conditions.

    Lesson 1: an EU solution could cover a wider range of perils and assets across several Member States, thus allowing for greater risk pooling and risk diversification benefits than at a national level. This can be particularly relevant for small countries where a single catastrophe can affect the whole country and for countries without a national insurance scheme. By pooling catastrophe risk across different exposures, regions and uncorrelated perils within a single EU scheme, it may be possible to reap larger risk diversification benefits than could be achieved at national level. This would, in turn, reduce the required capital needed to back the risks and lower the cost of reinsuring them. Mandatory elements to boost the demand for or offer of insurance could further increase the risk diversification benefits and limit adverse selection. However, this would also require a certain degree of harmonisation of existing national practices.

    Lesson 2: an EU-wide solution could include a permanent public-private reinsurance scheme to complement private sector or national initiatives. Setting up a public-private reinsurance scheme, as opposed to a private structure, would have the advantage that it could be accessed by a large range of entities: primary insurers, reinsurers and various national schemes. Therefore, such a scheme would require no harmonisation of existing national practices. Participation in such a scheme would be voluntary, so that the scheme supplements, rather than crowds out, private sector or national initiatives. Making the scheme permanent would allow for pooling risk over time, thus reaping even greater diversification benefits than if risks were pooled only across perils, asset types and Member States.

    Lesson 3: an EU-wide solution could further support affordable risk-based premium setting, owing to the potentially sizeable risk diversification benefits that could be achieved across Member States. Given the significant heterogeneity in the risks faced by policyholders across Member States, flat premiums or premiums capped by law could imply a relatively high level of cross-subsidisation and solidarity, which might be difficult to agree upon at EU level. A risk-based approach at EU level could support additional risk diversification benefits achieved from risk pooling across Member States, time horizons, perils and asset types.

    Lesson 4: since public funding mechanisms for disaster recovery are stretched and reinsurance prices have been rising, an EU solution could aim to finance itself through risk-based premiums and could explore tapping capital markets. In addition to collecting risk-based premiums (see Lesson 3), the scheme could explore tapping the capital markets by issuing catastrophe bonds or other insurance-linked securities. The catastrophe bonds could be indemnity-based or parametric (or both), depending on the further design features of the solution (e.g. whether it would provide indemnity-based or index-based payouts). The extensive risk pooling enabled by the EU solution could also allow for the issuance of catastrophe bonds that could be less risky and more transparent than many other catastrophe bonds, thus attracting a relatively wide set of investors. Ultimately, the EU solution could in principle be set up with no public financing or backstop.

    Lesson 5: an EU solution could support both insurance and public sector initiatives geared towards risk mitigation and adaptation as part of a public-private concerted action. For instance, an EU solution could improve the availability, quality and comparability of data on insured losses across EU countries. It could also support the modelling of risk prevention and the integration of climate scenario analysis into estimates of future losses (both insured and uninsured) from natural disasters. The analysis of EU solutions might further promote the use and development of open-source tools, models and data to enhance the assessment of risks. In this context, care should be taken to prevent further market segmentation or demutualisation based on granular risk analysis, which could widen the insurance protection gap in the medium term.

    A possible EU approach

    An EU-level system could rest on two pillars, building on existing national and EU structures:

    1. Pillar 1: EU public private reinsurance scheme. Establishing an EU public private reinsurance scheme would serve to increase the insurance coverage for natural catastrophe risk. The scheme would pool private risks across the EU, perils and over time to achieve economies of scale and diversification at the EU level.
    2. Pillar 2: EU public disaster financing. The second pillar would look to improve public disaster risk management in Member States through EU contributions to public reconstruction efforts following natural disasters, subject to prudent risk mitigation policies, including adaptation and climate change mitigation measures

    The EU public-private reinsurance scheme could help to provide households and businesses with affordable insurance protection against natural catastrophe risks, while also providing incentives for risk prevention. Embedded in the ladder of intervention, the design features of the scheme build on the five lessons learned from the analysis of the national schemes. The scheme seeks to (i) ensure coverage of a broad range of natural catastrophe risks, (ii) fulfil a complementary role to national and private market solutions, (iii) rely on risk-based pricing, (iv) reduce dependence on public financing in the long term, and (v) support concerted action on risk mitigation and adaptation.

    The EU reinsurance scheme could seek to transfer part of the risks to capital markets via instruments such as catastrophe bonds. The market for these products is less developed in the EU than in North America. Part of the reason is the smaller scale of the issuances. The EU scheme could explore the feasibility of a pan-European catastrophe bond covering more perils than the bonds currently issued. This would serve the dual purpose of expanding the catastrophe bond market and bringing more niche risks directly to capital markets investors. The investors, in return, could benefit from the additional diversification offered by exposure to these risks relative to the risks currently covered.

    Risk pooling is a fundamental concept in insurance, grounded in the law of large numbers. As independent risks are added to an insurer’s portfolio, the results become less volatile. For example, in a pool of insured vehicles, the actual number of accidents each year converges with the expected number as the size of the pool increases. In terms of capital, reduced volatility means lower capital needs and costs for the same level of protection. More diversified insurers can therefore offer cover at a lower price and given the level of capital, provide a higher level of protection.

    The underlying risk (annual expected loss) remains unchanged when pooling risks together. However, the cost of covering or transferring the risk (cost of capital), along with the cost of information and operating costs, decreases with diversification and risk pooling. Operational costs are lower due to economies of scale, as they are shared among all participants in the pool. The cost of information is also lower , as the time and money required to obtain information can be shared among participants.

    Solvency II requires insurers to hold sufficient capital to withstand a loss occurring with a
    probability of 1 in 200 years.
    In an example, using the Moody’s RMS Europe NatCat Climate HD
    model, and based on the current insured landscape, the pooled portfolio shows a reduction of
    around 40% in the 1 in 200 year return period losses (RPL) compared to the sum of individual
    values for countries
    . This reduction might be even larger if penetration of flood insurance increases. A similar analysis conducted by the World Bank, provid ing a framework for estimating the impact of pooling risks on policyholder premiums , supports these conclusions.

    The EU disaster financing component would provide a complementary mechanism that governments could tap when managing natural catastrophe losses. Natural catastrophes can lead to significant costs for governments, including damage to key public infrastructure. The EU disaster financing component would help governments to manage a share of these expenses following a major disaster, thus supplementing their national budgetary expenditure. The component would cover damages caused to key public infrastructure that is inefficient or too costly to insure privately, with a view to supporting resilient reconstruction efforts and public space adaptation. Clear rules on contributions and conditions on the disbursement of the funds should encourage ex ante risk prevention by governments, to minimise the emergency relief and residual private risks that the government may need to cover following a major event.

    Greenwashing in Insurance – How Regulators Design a Framework

    In 2023, EIOPA has published several recommandations and progress reports, the most insightful being:

    • Advice to the European Commission on Greenwashing – EIOPA-BoS-23/157 – 01 June 2023
    • Consultation Paper on the Opinion on sustainability claims and greenwashing in the insurance and pensions sectors – EIOPA-BoS-23/450 – 17 November 2023

    Both documents contain highly important information and guidelines towards a future framework for the industry, a framework probably to be applicable no later than 2025.

    As outlined in both papers, EIOPA addresses these guidelines in close cooperation with the two other ESA in charge of financial services supervision, EBA and ESMA. It’s advice summarizes this interconnectedness with a « Sustainable Finance Investment Value Chain » chart:

    The Advice to the EC defines the meaning of « Sustainibility Claims« , the critical item to be addressed to analyse any kind of greenwashing activity within this value chain.

    ‘Sustainability claims’ are claims that state or imply that an entity or product ‘benefits’ the environment or society. The type of ‘benefit’ is varied and includes:

    • positively impacting sustainability factors;
    • not impacting sustainability factors;
    • minimizing negative impacts on sustainability factors;
    • minimizing the impact of climate change on society (this includes climate adaptation measures).

    This understanding of ‘sustainability claims’ is consistent with the definition of “environmental claims” as defined in the EC proposed Directive as regards empowering consumers for the green transition which would amend the Unfair Commercial Practices Directive (UCPD): “‘environmental claim’ means any message or representation […], which states or implies that a product or trader has a positive or no impact on the environment or is less damaging to the environment than other products or traders, respectively, or has improved their impact over time”. ‘Sustainability claims’ as understood by EIOPA extends it to also cover social aspects.

    Misleading sustainability claims can deceive consumers into buying products that are not aligned with their preferences, or into buying products from a pension or insurance provider that misleadingly portrays itself an entity with sustainability credentials. In such cases, consumers’ investments or premiums are re-routed away from sustainability factors.

    Further, greenwashing occurrences erode consumers’ trust in providers’ ability to positively impact environmental or social factors. While EIOPA has not identified to date any major greenwashing cases in the insurance and pension sectors, because cases emerged in other sectors there may be already a general mistrust from consumers in relation to sustainability claims which can be made by providers. The EU-wide Eurobarometer survey carried out by EIOPA in June 2022 shows that 62% of EU consumers do not trust the sustainability claims made by insurance undertakings or distributors, while a similar percentage (63%) says that sustainability claims about insurance products are often misleading. Consumer representatives in their response to the ESA Joint CfE in January 2023 also reported limited trust in insurers and pension providers sustainability claims.

    Additionally, misleading sustainability claims do not allow consumers as well as broader society to hold providers accountable for their environmental and social impact. This unaccountability might embolden providers to make misleading sustainability claims to gain a competitive advantage over other providers, after which these other providers might follow suit to close the competitive advantage, leading to more greenwashing occurrences.

    Where and How Greenwashing Occurs in the Insurance and Pension Sectors

    EIOPA differentiates seven major fields (three specific stages for insurers, three for IORPs and one common stage for both types of organizations) within the insurance and pensions lifecycle chart:

    The major difference among insurers and IORPs are the reference to « products » and « schemes », taking into account the still highly heterogenous pension market and pension scheme providers within the EU.

    In relation to the stages of the insurance and pensions lifecycle, respondents to the ESA Joint CfE provided views on the likelihood of the occurrence of greenwashing:

    Declared likelihood shows that Marketing and Sales a clearly fingerpointed as they are considered « highly likely » to be subject to greenwashing. Without neglecting the other stages and especially the entity model and management clearly in the drivers’ seat of the other stages’ behaviour, let’s focus on the product delivery issues:

    • Marketing: main fields of potential greenwashing have their origins in the risks related to terminology and non-textual imagery.
    • Sales: information asymmetry or misleading information/disclosure as well as risks related to unsuitable product due to poor advice, incentives and distributors’ training are cited as potentially important and critical

    Tackling Greenwashing

    EIOPA regularly conducts surveys with the NCA to evaluate maturity and action plans as long as the framework is not in place.

    Results are for the time being relatively mitigated as the large majority of NCA (21) didn’t identify greenwashing issues yet due to missing criteria to be applied and inexisting client related investigations. However, NCA reporting first actions are using several techniques EIOPA will probably evaluate and adopt for the future framework:

    Very interesting also the survey results on the potential use of Suptech to deal with the enormous need to analyze data on products, sales and marketing practices:

    Next Steps

    Based on additional analyses, discussions and evidence that emerges by the delivery of the final report (May 2024), EIOPA will further refine its view on the definition of greenwashing, its impacts and risks (particularly on potential financial stability risk implications), as well as on how greenwashing can occur in the insurance and pensions lifecycle. To further exemplify the latter, EIOPA might develop case studies showing how greenwashing can emerge in practice.

    EIOPA will also provide further considerations on the supervision of greenwashing, particularly in relation to any new greenwashing-related supervisory experiences and practices, as well as in relation to greenwashing-related supervisory and enforcement measures, if any.

    Finally, EIOPA will further develop the list of issues it has already identified in the regulatory framework and based on those issues it will propose improvements – by way of recommendations – to the regulatory framework relevant to the insurance and pension sectors, including to Level 1 legislation. However as requested by the CfA, EIOPA will not make any proposals that would imply modifications of the Corporate Sustainability Reporting Directive (CSRD).

    Digital Skills, Mindset, and Divide

    Digital transformation doesn’t stop creating surprise, admiration, innovation … but also deception and divide. In 2023, Gen AI has taken the lead regarding use, high speed engagement, discovery, and implementation.

    How Tech Executives Rank Other C-suite Leaders’ Digital Skills and Mindset

    They give the highest marks for proficiency and mindset (the ability to imagine digital solutions)
    to chief marketing, strategy and operations officers and CEOs among non-tech roles – and rank legal
    and HR leaders lowest
    , on average. Several potential reasons could explain this « gap »:

    • one of it probably being the traditionally less developed business partnership among CTO/CIO functions and HR and especially Legal departments as these functions either work with robust legacy or with low or no IT solutions to produce their output;
    • another root cause of underestimated « mindset » and « proficiency » might be stronger compliance requirements usually existing for HR and Legal functions, requirements natively less open for technical disruption;
    • finally, both functions are frequently « (dis)qualified » by IT management as being too « open to shadow IT » solutions.

    Three-Quarters of CEOs Have Tried ChatGPT Since Its Launch

    A third of chief executives who have used the tool for work used it for writing and communication. More than 20% have employed it for general research, followed by market research and presentations (13% each).

    Definitely a great start compared to significantly lower C-level adoption of previous IT innovations and disruptions. However, given the extremely broad potential among all other functions within an organization, from front lines to back office and all support functions, it’s critical to involve executives and boards in all inititiatives identified or to be identified as critical and potentially disruptive and/or transformative for the organizations future.

    Otherwise, the risk to underestimate value and underallocate investments could be huge (e.g. past experience with social network, IoT, data science … too often considered being « for their kids or for freaks » than for their organizations and business).

    As Executives Laud AI, Consumers in the U.K., Canada and U.S. Express Fear

    More than half of consumers in all three countries chose “complex” and “threatening” to describe AI, while “effective” was the least-selected word.

    Not really a surprise as Big Tech is considered being a cunsumer unfriendly « oligopoly » after the skyrocketing of their market capitalization since Covid.

    Fastly growing data privacy issues and cyber security incidents naturally add concerns regarding this technological disruption mainly built on Big Data and AI usage most consumers didn’t imagine prior to ChatGPT going mainstream.

    How to Cope With Global Digital Divides

    At least four digital infrastructures are emerging as ideology splits the world — in China, the U.S., the EU, and Russia. After three decades of global consistency for multinational companies, this shift has radical implications for business.

    The number of national policies restricting data flows or access more than doubled from 2017 to 2021. With AI regulation following the same path, hoping this divided world will “return to normal” is futile. And a purely tactical C-suite response to one digital policy at a time is too costly.

    To reduce risks to growth, executive leaders should instead view geopolitical and digital tensions strategically while reacting to measures in specific jurisdictions. That means:

    • Adjusting local enterprise technology architectures, operating models and corporate structures as needed
    • Exiting the market as the final resort if following the steps outlined in Figure 1 does not sufficiently mitigate operational risks

    Assess Country Dependency Risk — Including Sovereign Data and Digital Strategies

    Executive leaders should first determine the business impact of geopolitical and digital risks in a country — including regulations — and consider appropriate mitigating steps. For example, some
    multinational enterprises that continued to operate in Russia after February 2022 had to adjust their technology stack when one or more of their technology suppliers left the country.

    Many multinational organizations are assessing the potential for a similar problem to arise in other regions of high tension. They also now need to manage China’s Personal Information Protection Law (PIPL) and India’s new Digital Personal Data Protection Act (passed in August 2023 but not yet effective) while remaining compliant with the EU’s general data protection regulation (GDPR).

    Because digital technology is central to business, digital regulations affect almost everything a company does (as well as nearly all consumers and public-sector activities). Executive leaders must, therefore, take a broad view of how their enterprise uses data (see Figure 2).

    Evaluate your digital risk in a country using Figure 2 as a guide. Take each element as a potential risk area you need to gauge due to one or more sovereign data and digital regulations. While this process will depend on where and how your company operates, a standardized assessment across all elements will help you make consistent, actionable changes faster at a strategic level.

    Executive leaders addressing the enterprisewide impact of increasing digital regulations should:

    • Identify the business scenarios and outcomes that are hardest to govern because of, for example,
      geographic and organizational diversity, complexity and autonomy.
    • Consider establishing a virtual team to govern data and analytics throughout business functions and across geographies to address one of these situations. Using this connected governance framework will involve creating a proof of concept to test the benefits, risks and impacts associated with the scenario.

    Prudential Treatment of Sustainability Risks

    December 13, 2023, EIOPA has published a Consultation Paper regarding potential amendments of the prudential treatment of sustainibility risks (EIOPA-BoS-23-460). The expected Article 304a of the Solvency II Directive mandates EIOPA to assess the potential for a dedicated prudential treatment of assets or activities associated substantially with environmental or social objectives, or harm to such objectives, and to assess the impact of proposed amendments on insurance and reinsurance undertakings in the European Union. EIOPA is required to submit a corresponding report to the Commission.

    A discussion paper outlining the scope, methodologies, and data sources for the analysis has been published in 2022 as the first outcome of EIOPA’s work under this mandate. This consultation paper is the second outcome, based on the discussion paper’s public feedback received, together with the feedback received from the Platform on Sustainable Finance and the European Banking Authority (EBA). It will form the basis of the report envisaged to be submitted to the Commission after consulting the European Systemic Risk Board (ESRB).

    EIOPA decided to focus its analyses on the following three conceptual areas that are considered to be appropriate for a risk-based analysis:

    • The first area of the analysis is dedicated to the potential link between prudential market risks in terms of equity, spread and property risk and transition risks.
    • The second area of the analysis focuses on the potential link between non-life underwriting risks and climate-related risk prevention measures, since the prudential treatment of assets or activities as referred to in the mandate includes insurance undertakings’ underwriting activities.
    • The third area of the analysis is related to the potential link between social risks and prudential risks, including market and underwriting risks.

    As a kind of « disclaimer » EIOPA states that « since sustainable finance is an area characterized by an ongoing progress regarding data availability and risk modelling, certain natural limitations of the analysis exist at this stage« :

    • Firstly, the sample size of certain asset portfolios for the analysis is relatively small due to general data constraints that can hardly be overcome. Further to this, the limited sample size covered in the present analysis might not reflect the overall insurers’ exposure to transition risks, which could also materialize from indirectly held assets.
    • Secondly, since legally binding transition plans of firms, for instance in relation to the Corporate Sustainability Reporting Directive (CSRD), are not yet available, reliable firm-specific characteristics affecting the (long-term) transition risk exposures of firms are difficult to obtain as further input data for the analysis. In this respect, a sectoral classification approach is generally not able to model firm-specific transition risk characteristics, which would require a firm-level approach instead.
    • Thirdly, technical challenges for the analysis exist in isolating transition risks from other risk drivers, such as the impact of the Covid-19 shock on asset prices, which is an important determinant for the backward-looking analysis, but not for the forward-looking analysis.
    • Fourthly, the exact extent to which credit ratings reflect transition risks remains unclear at this stage, making it challenging in the case of the prudential treatment of spread risk in the Standard Formula whether a dedicated treatment would be justified.

    By acknowledging the methodological limitations in the context of assessing sustainability risks from a prudential perspective, EIOPA, at this stage, does not recommend policy options in all areas studied in this consultation paper, and does not express a preference between the options proposed as regards equity and spread risk in relation to transition risk exposures.

    Potential link between prudential market risks in terms of equity, spread and property risk and transition risks

    The challenging question arises as to whether to rely on historic asset price data to conduct an empirical risk analysis (backward-looking) or to use model-based risk assessments, typically in terms of stress scenarios (forward-looking), or a combination of both.

    The feedback EIOPA received to its 2022 discussion paper (« Discussion paper on physical climate change risks ») overall support for the methodologies outlined regarding the forward-looking analysis. Some respondents mentioned that the use of a model-based assessment can be subject to technical bias due to the model assumptions taken, and corresponding findings should be treated with caution regarding the conclusion on potential prudential implications. Several respondents suggested focussing only on a forward-looking assessment, since historic time series data might not be able to show a potential materialization of transition risks.

    EIOPA considers forward-looking model-based risk assessments to offer valuable insights into the potential impact of transition risks on asset prices, particularly since historical asset price data may not fully reflect the dynamic nature of environmental externalities and the complexities of transitioning to a low-carbon economy. Market sentiment, technological advancements, regulatory changes, and societal awareness of climate issues can significantly influence transition risks in the future. A comprehensive model-based approach can complement historical data analysis and provide a holistic view of how transition risks may materialize in asset prices.

    A forward-looking assessment requires models and assumptions regarding the future developments of climate change and the transition to a carbon neutral economy. In particular, uncertainty surrounds the nature and timing of policy actions, technological change and the extent to which financial markets are already reflecting a transition scenario in asset prices. In other words, the results and conclusions obtained can be quite sensitive to the choices adopted for such parameters and assumptions. To capture such uncertainty, researchers make use of scenario analysis to analyse a broad range of future states of the world.

    A number of supervisory authorities – both at national and European level – have developed climate change scenarios to assess the exposure of financial institutions to climate risks in terms of transition risks. EIOPA studied several analyses of climate transition scenarios developed by ACPR/Banque de France, DNB, ECB/ESRB as well as EIOPA/2DII to build a conceptual framework for the forward-looking analysis presented in this section. EIOPA’s discussion paper in 2022 briefly summarised these studies21, whereof the main conclusions are:

    • The assessments make use of different scenarios. ECB/ESRB and ACPR/Banque de France use as a basis the climate scenarios developed by the Network for Greening the Financial System (NGFS), DNB developed its own bespoke shock scenario and the EIOPA/2DII sensitivity analysis makes use of transition scenarios developed by the International Energy Agency (IEA);
    • The analyses use two ways to measure the impact of disorderly transition scenarios by either comparing them with the baseline results for an orderly transition or with the current, no policy change pathways;
    • The forward-looking assessments employ several models to translate high-level climate scenarios into pathways for equity and corporate bond prices at sector level using either the NACE breakdown of economic activities or – in case of the EIOPA/2DII sensitivity analysis – fifteen climate-policy relevant activities;
    • The assessments exhibited substantial differences in exposures to transition risk for the various economic activities and technologies. On the one hand, equity exposures to mining and power generation would be fully stranded in the DNB combined policy and technology shock scenario. On the other hand, equity exposures to renewable energy would double in value in the EIOPA/2DII late and sudden policy shock scenario.

    A mapping of the Transition Vulnerability Factors (TVFs) developed by the DNB on the NGFS’s transition risk scenarios to assess the potential exposure of economic activities to transition risks from a forward-looking and risk-oriented perspective. The TVFs capture the sensitivity of stock returns to forward-looking scenario-specific excess market returns, for instance in case of a rise in carbon prices or a technological shock. Based on this mapping exercise, the economic activities that seem to be particularly exposed to transition risk from a forward-looking perspective are the following:

    • B05-09 – Mining and quarrying (coal, lignite, crude petroleum, natural gas, etc.);
    • C19 – Petrochemical;
    • C22 – Manufacture of rubber and plastic products;
    • C23 – Manufacture of non-metallic mineral products;
    • C24 – Manufacture of basic metals;
    • D35 – Utilities (electricity, gas, steam and air conditioning supply);
    • H50 – Water transport and
    • H51 – Air transport.

    It is important to differentiate economic activities that might be able to follow a transition to a low carbon economy in the future from those which might not. Indeed, in terms of carbon footprint, sectors related to the extraction, production, processing, transportation and reselling of fossil fuels will hardly be able to reduce their carbon emission levels as it is directly linked with their activity. In this regard, the Platform on Sustainable Finance (PSF) states that “the Platform recognizes there are other economic activities for which no technological possibility of improving their environmental performance to avoid significant harm exists across all objectives and which might be thought of as ‘Always Significantly Harmful’ activities”, referring particularly to economic activities B5 (Mining of coal and lignite), B8.92 (Extraction of peat) and D35.11 (Power generation from solid fossil fuels). According to article 19(3) of the taxonomy regulation, power generation activities that use solid fossil fuels do not qualify as environmentally sustainable economic activities.

    Three possible types of transition scenarios can be envisaged in the coming decade:

    • An orderly type of transition scenario in which there is no or little impact on the real economy and financial sector. This type of scenarios consists of a timely and predictable path to a carbon-neutral economy with companies gradually adjusting their business models and capital stock to this new reality. An orderly transition is considered to be the baseline scenario in the ACPR and ECB/ESRB transition stress tests.
    • A disorderly type of transition scenario where there is a substantial impact on the real economy and – through their asset exposures to carbon-intensive sectors – the financial sectors. This type of scenarios tends to be characterised by unexpected, sudden and delayed actions to achieve carbon-neutrality. A disorderly scenario is generally considered to be a low probability, but yet plausible event.
    • A type of scenario where there is no transition or an insufficient transition to a carbon-neutral economy. Such a type of scenarios is also bound to have substantial negative impacts on the real economy and financial sector. Not due to transition risk, but as a consequence of a further increase in (acute) physical risks, like floods, fires and storms that may damage production facilities and disrupt supply chains.26 However, such risk differentials will materialise in another dimension, i.e. depending on the geographical location of companies rather than their carbon sensitivity.

    Given that a disorderly transition poses the biggest transition risk, a prudential forward-looking VaR-analysis should focus on transition risk differentials relating to a disorderly scenario. Since it is difficult to estimate the probability of such a scenario, it is proposed to assess its impact under various annual probabilities of occurrence, e.g. ranging from 0.5% to 4.5% per year. To put these annual probabilities into a longer-term perspective, assume for example that the probability of an orderly transition amounts to 50% during the coming decade. The annual probabilities of 0.5-4.5% will then translate in a cumulative probability of 5-30% after 10 years, leaving a cumulative probability of no (or insufficient) transition of 20-45%.

    Equity Risk: Backward-Looking Results

    Results of the Broad Portfolio Allocation Approach

    Results of the Narrow Portfolio Allocation Approach : CPRS (Climate Policy Relevant Sectors) – based Portfolio Allocation)

    Overall, the fossil fuel sector shows a differentiated risk profile relative to the other sectors in terms of the highest VaR (-56.5%) in the relevant time period from 2010-2021. This sector includes the following NACE codes: B5, B6, B8.92, B9.1, C19, D35.2, H49.5, G46.71, which mainly relate to activities associated with the extraction of crude oil, natural gas and the mining of coal. A large number of studies underline that these activities, due to their inherent carbon intensity and limited potential to transition, tend to be more exposed to transition risks, as European economies gradually converge towards the objectives set out by the 2015 Paris Climate Agreement and the EU Green Deal.

    Equity Risk: Forward-Looking Results

    The forward-looking analysis uses the projected equity shocks for the different economic sectors being distinguished in:

    • the sudden (1) and delayed (2) transition scenarios of ACPR;
    • the policy shock (3), technology shock (4) and double (or combined) shock (5) scenarios of DNB;
    • the delayed transition (6) scenario of ESRB/ECB;
    • the disorderly transition (7) and ‘too little, too late’ (8) scenarios of IAIS.

    In the Monte Carlo simulations, if a disorderly transition scenario materialises, a probability of 1/8 is attached to each of these eight specific scenarios occurring.

    Equity Risk Differentials (Monte Carlo)

    Spread Risk: Backward-Looking Results

    Since the aggregation of various different economic activities into high-level portfolios as regards transition risk exposures appears suboptimal for assessing the potential for a risk differential, the assessment focuses on the narrow portfolio approach, in particular regarding fossil fuel-related bonds.

    Spread Risk: Forward-Looking Analysis

    In line with the forward-looking analysis for equity risk, the transition return shocks for corporate bonds for the different economic activities are derived from the disorderly transition scenarios of ACPR (sudden and delayed transition scenarios), DNB (policy, technology and double shock scenarios), ESRB/ECB (delayed transition scenario) and IAIS (disorderly and ‘too little, too late’ scenarios). In the Monte Carlo simulations, if a disorderly transition scenario materialises, a probability of 1/8 is attached to each of these eight specific scenarios occurring.

    Spread Risk Differentials (Monte Carlo)

    Stocks and Bonds: EIOPA’s Potential Policy Options

    Based on the detailed analysis, EIOPA describes and evaluates three potential options for both asset classes:

    Equity Risk (options and EIOPA’s evaluation)

    • Option 1: “no change”-option
    • Option 2: treating fossil fuel-related stocks as Type II (stocks listed outside EEA and OCDE markets) equity, i.e., a capital charge of 49% rather than 39% for Type I equities;
    • Option 3: a dedicated supplementary capital requirement to the current equity risk calibration with supplementary capital charge to the current Standard Formula’s risk charge of 39%, in case of Type I equities, could lie in the range up to 17% in additive terms, i.e., 39%+17%=56%. Regarding the role of participations or long-term equity, exclusion criteria for fossil fuel-related activities or a potentially higher capital requirement may be needed to limit incentives to re-classify Type I/II stocks as participations for the sake of SCR reduction.

    Spread Risk (options and EIOPA’s evaluation)

    • Option 1: no change option.
    • Option 2: a rating downgrade of bonds related to fossil fuel activities,
    • Option 3: a dedicated supplementary capital requirement to the current spread risk calibration, up to 5% in additive terms, which corresponds to an increase in the capital requirements of up to 40% relative to the bond portfolio’s current capital requirement.

    An impact assessment conducted by EIOPA shows a very low impact of the proposed policy options on the solvency ratio of the undertakings (cumulated range equity and spread on Germany’s and France’s solvency ratios from -0.21 to -1.71%p) mainly due to the undertakings’ limited exposure to directly held fossil fuel-related assets. The low impact on the undertakings’ solvency ratio thereby suggests a limited impact on the asset allocations of undertakings in terms of potentially triggering fire-sales of fossil fuel-related assets that could contribute to systemic risks in the financial system. Moreover, it is important to note that besides capital charges, insurers take further criteria for their investment decisions into account, such as objectives in terms of duration and cash flow matching between assets and liabilities, further limiting the potential of the proposed policy options to trigger material re-allocations in the undertakings’ asset portfolios. It is therefore concluded that the proposed policy options would not materially contribute to systemic risks in the financial system.

    Property Risk and Energy Efficiency

    Regarding property risk, the Standard Formula in Solvency II currently foresees a shock to the market value of buildings of 25%. The shock has been calibrated as the annual 99.5%-Value-at-Risk (VaR) of monthly total return real estate indices and does not distinguish between commercial or residential real estate.

    To study the potential effect of energy efficiency on property risk, EIOPA proposed in its discussion paper to construct property price indices based on samples of buildings with the same energy performance level, while controlling for major property characteristics typically driving the market value of a building. The energy performance-related price indices track the average price series of a specified reference building over time, and allow to calculate the corresponding annual returns. From a prudential perspective on property risk, a comparison of the annual Value-at-Risk values at the 99.5% confidence level across the energy performance-related price indices can provide evidence on a potential energy performance-related risk differential for property risk.

    The two main variables of interest for the analysis are the building’s energy performance and its market value. EIOPA suggested in its discussion paper to use the building’s energy performance certificate (EPC) as a categorical measure of its level of energy efficiency. In this regard, the energy performance of a building is defined as the amount of energy needed to meet the building’s energy demand associated with a typical use of the building in terms of heating, cooling, ventilation, hot water and lighting. The EPCs typically range from A+ (most efficient) to H (least efficient), and using EPCs as a determinant for transition risk exposures was broadly supported in the public consultation. Moreover, energy performance certificates are also used as measure for the energy performance of buildings under the corresponding technical screening criteria of the EU Taxonomy.

    The building’s market value, measured for the analysis as a building’s advertised sales price, is scaled by the building’s size (typically the square meter of living area for residential buildings) to reduce selection bias and to raise comparability of prices across buildings. Due to the impact of inflation on the market value of buildings, the building’s sales price in a given year is deflated for the analysis.

    A range of factors can typically influence a building’s market value, such as location and age, and should be controlled for when grouping comparable buildings together to construct the house price indices. Generally, grouping data in relation to multiple house characteristics to reach homogeneous groups for comparison can materially limit the number of available price observations to construct respective price indices. In particular, residential buildings are typically infrequently sold during their lifetime, constraining materially the scope of building-specific time series data that could be used to track pricing effects. Therefore, a general tradeoff between complexity (granularity) in terms of building characteristics to construct homogeneous groups of buildings and the sample size arises, and a sufficient balance needs to be found.

    To study the effect of a building’s level of energy efficiency on property risk from a backward-looking perspective, energy performance-specific property price indices based on the German residential housing market and advertisement data have been constructed.

    The findings of EIOPA’s backward and forward-looking analysis together with a risk differentials based sensitivity study show an inconsistent effect of the level of energy efficiency on property risk in terms of the 99.5% Value-at-Risk of annual property returns. In contrast, the forward-looking analysis finds an increase in the riskiness of properties with energy labels F and G, i.e. the two least energy-efficient classes of property.

    Since the quantitative findings from a backward- and forward-looking perspective show mixed evidence, EIOPA cannot conclude whether a dedicated prudential treatment of energy efficiency under the property risk sub-module in Solvency II’s Standard Formula could be justified.

    As the analysis is subject to various data limitations that could not have been overcome by means of the public consultation of EIOPA’s discussion paper in 2022, EIOPA suggests a repetition of the analysis, particularly in context of the developments of the Energy Performance of Buildings Directive (EPBD), which aims for a consistent assessment of the energy efficiency of buildings in the EU and for improving corresponding data availability. It can therefore be expected that more data suitable for a property risk analysis as regards energy efficiency will be available in future.

    Non-Life Underwriting and Climate Change Adaptation

    The expected growth in physical risk exposures and insurance claims due to climate change will increase risk-based premium levels over time, potentially impairing the mid- to long-term affordability and availability of insurance products with coverage against climate-related hazards. Moreover, the increased frequency and severity of natural disasters and extreme weather events associated with climate change can make it more difficult for insurers to predict the likelihood of future losses accurately and to price insurance products appropriately.

    Climate-related adaptation measures are defined as structural and non-structural measures and
    services that are implemented by (re)insurance undertakings or policyholders ex-ante to a loss event, which reduce the policyholder’s physical risk exposure to climate-related hazards through

    • lowering the frequency of climate-related losses or
    • lowering the intensity of climate-related losses in an underwriting pool.

    Climate-related adaptation measures can differ substantially regarding their form and ability to protect against climate-related hazards. Specific examples of climate-related adaptation measures discussed in the insurance context comprise:

    • measures related to a building’s structure like water-resistive walls, windows and doors or non-return valves on main sewer pipes against flood risk,
    • external building measures such as sandbags against flood risk,
    • heat- and fire-resistive construction materials for buildings against exterior fire exposures,
    • the irrigation of crop fields against drought risk and heat waves and
    • non-structural measures such as forecasting and warning systems (e.g., SMS) to enable policyholders to protect their goods in advance of severe weather events.

    From a risk-based perspective, a clear link between climate-related adaptation measures and insurance premiums is given, as adaptation measures aim to reduce the policyholders’ physical risk exposures and insured losses associated with climate change, and thereby contribute directly to reducing the actuarial fair premium of an insurance contract. In contrast, climate-related mitigation measures focus on actions to reduce greenhouse gas emissions, for which a direct risk-based link to the actuarial fair premium does not necessarily exist. For instance, while motor insurance products focusing on electric vehicles contribute to reducing the emission levels associated with an underwriting pool, the lower emission levels do not directly affect the loss profile of the underwriting pool in terms of the frequency and intensity of claims. Therefore, climate-related mitigation measures are excluded from the scope of this analysis.

    The prudential requirements for non-life underwriting risks in Solvency II’s Standard Formula comprise three main modules:

    • the premium – refers to future claims arising during and after the period of the solvency assessment (covered but not incurred, e.g., in relation to the provision for unearned premiums) – and reserve – refers to past risks and claims that have already materialized (provision for outstanding claims) – risk module,
    • the catastrophe module – potential losses from extreme and rare tail events, which are expected to happen more frequently and becoming more intense due to climate change – and
    • the lapse – instantaneous loss of 40% of the in-force business – risk module.

    As per EIOPA, Particularly the first two modules can be considered materially sensitive to climate change and its impact on the frequency and intensity of severe weather- and natural catastrophe events. This statement can be challenged as we believe that increasing non affordability of insurance might well have an impact on lapse risk and feed-back on the consultation paper might well add it as being material.

    Premium Risk

    Premium risk in the Standard Formula is treated by means of a factor-based approach. In particular, the standard deviation of the underwriting pool’s loss ratio, which basically relates to the ratio of claims incurred to premiums earned, is driving the premium risk from a prudential perspective. The capital charge is determined to be consistent with the 99.5% percentile of the loss ratio’s distribution to cover unexpected shocks to the claims and premiums of the insurance undertaking in a given year.

    Since climate change and its impact on physical risks materializes dynamically over time, for instance due to the dependance on changes in (global) temperature levels which in turn depend on greenhouse gas emission levels, historic data might not be an appropriate predictor of future trends, making it difficult for insurers to accurately predict the likelihood of future claims.

    Climate-related adaptation measures can reduce the frequency and severity of weather- and climate-related losses in an underwriting pool and thereby smooth the claim’s distribution and lower the standard deviation of the loss ratio. In that regard, the risk of mispricing insurance policies due to climate change could be reduced, as the adaptation measures limit the potential for claims realizing in a given year to deviate materially from the expected outcome on which the premium level of the underwriting pool has been set before. The volume measure in terms of the net premiums earned is the second factor in the Standard Formula to determine premium risk from a prudential perspective and can be interpreted as a measure to scale the overall level of premium risk and the corresponding capital charge for the individual insurance undertaking. As the premium level of an underwriting pool is based on the expected volume of claims in a given year, the volume measure covers the expected losses.

    Reserve Risk

    Reserve risk captures the risk that the absolute level of claims provisions for an underwriting pool could be mis-estimated, i.e., that reserves are not sufficient to settle down the claims that occurred already in the past. As for premium risk, reserve risk is supposed to cover small to medium loss events and not tail events.

    The prudential reserve risk is measured by means of a volume measure (net provisions for claims outstanding) and a parameter for standard deviation for the claim payments. Climate-related adaptation measures are expected to reduce the volume measure in terms of the net provisions for claims outstanding. Hence, the expected effect of adaptation measures on insurance reserves will be captured by the volume measure. The variation of costs to settle down claims that have already occurred in the past, however, does not seem to be materially affected by the fact of implementing climate-related adaptation measures in insurance products. Therefore, it is not expected that climate-related adaptation measures will have an impact on the standard deviation parameter driving reserve risk and is therefore studied only qualitatively.

    Natural Catastrophe Risk

    Under Solvency II, undertakings can take the risk reducing effect of climate-related adaptation measures into account when applying a suitable internal natural catastrophe model for estimating the corresponding capital requirements, but not under the Standard Formula. However, the effects of climate-related adaptation measures on the solvency capital requirements for natural catastrophe risk are difficult to predict, as they depend substantially on the catastrophe model used, the climate-related hazard considered, the risk characteristics of the adaptation measure modelled and the localisation of the risk exposure. Moreover, for example large-scale and expensive adaptation measures like flood-resistant walls might raise materially the value of a building, and thereby raise the sum insured, which in turn will raise the corresponding solvency capital requirement for natural catastrophe risk.

    EIOPA focus un Premium Risk

    Given the early stage of the EU insurance market regarding the implementation of adaptation measures in insurance products, particularly since current measures usually implemented are rather small-scale measures less effective against tail events captured by the natural catastrophe risk charge, but more effective against small and medium loss events captured by the premium risk charge EIOPA focuses its quantitative analysis on premium risk. Reserve risk and natural catastrophe risk are studied by means of qualitative questions that have been raised in the data collection with insurance undertakings in 2022. Future work could look more deeply into the quantitative influence of adaptation measures on the solvency capital requirements for natural catastrophe risk given further market progress in implementing adaptation measures in insurance products has been achieved providing sufficient data as regards their impact on claims related to tail events.

    In order to study the influence of climate-related adaptation measures on premium risk, the annual loss ratios are calculated, both for portfolios with and without adaptation measures based on the 33 responses including data for 15 million policyholders of EIOPA’s 2022 consultation. Data is grouped into three main categories of climate-related adaptation measures for illustrative reasons:

    • Hail nets, tempered glass and garages, which have a conceptually similar effect against hail risk – referred to as the “Hail protection”-group
    • Weather warning systems (e.g. SMS, e-mail, etc.) – referred to as the “Warning systems”-group
    • Other adaptation measures (e.g. building codes) – referred to as the “other adaptation”-group

    Standard deviation on Premium Risk

    EIOPA’s Summary and Policy Recommendation

    The sample for the analysis is very small, as it comprises only eleven underwriting pools. The EU insurance market is at a relatively early stage regarding the implementation of climate-related adaptation measures as defined in this exercise, which naturally limits the amount of potential data to be studied. In this regard, the Standard Formula’s requirement of at least five years of data for the assessment of the standard deviation parameter further constrained the scope of underwriting pools eligible for the analysis. Therefore, it is likely that the data sample studied does not fully capture the effects of adaptation measures, particularly in context of potential variations in terms of adaptation measures, climate perils, spatial exposures, etc.

    At this stage, EIOPA does not recommend changing the prudential treatment of premium risk in context of climate-related adaptation measures. Due to the importance of climate-related risk prevention to ensure the long-term availability and affordability of non-life insurance products, EIOPA suggests a repetition of the analysis, provided that the availability of data has improved resulting from further market developments in this regard. In addition, an extension of the prudential analysis to the solvency capital requirements for natural catastrophe risk is suggested.

    Social Risks and Impacts from a Prudential Perspective

    EIOPA provides an initial analysis of the Pillar II and III requirements under Solvency II, to identify potential areas for further work. Given the material lack of social-related data and risk models regarding the social aspects of investment and underwriting activities of insurers, EIOPA did not conduct a Pillar I-related assessment in response to the mandate.

    Social sustainability factors.

    Social sustainability factors are commonly referred to in respect of “social and employee matters, respect for human rights, and anti-corruption and anti-bribery matters”.

    SFDR (Sustainable Finance Disclosure Regulation) lists the following families of factors also used in the ESRS (European Sustainable Reporting Standards):

    Social Impacts

    The SFDR social adverse impacts include aspects as gender pay gaps between female and male employees, lack of workplace accident prevention policies, human rights policy or of a diligence process to identify, prevent, mitigate and address adverse human rights impacts.

    The Social Taxonomy Report issued by the Platform on Sustainable Finance identifies as examples of socially harmful economic activity the involvement with certain kinds of weapons or the production and marketing of cigarettes.

    Social Risks

    Social risks refer to (financial) risks including those deriving from dependencies on human and social resources and those affecting working conditions and living standards, communities and consumers / end-users.

    Social risks can arise from (macro-level) socio-economic developments as well as from entities or individual behaviour.

    They can transmit into society

    • directly (e.g. events causing unemployment, health or security issues (such as pandemics, cyber threats)),
    • indirectly (‘second order’, e.g. rising price levels leading to financial distress, the risk of unemployment spreading into health or safety risks) and
    • through spill-over impacts (‘contagion’) affecting, for example, the financial system (e.g. unemployment leading to mortgage defaults, resulting in increased mortgage insurance pay outs and causing potential financial sector stability issues).

    These risks can then transmit into risks for (re)insurance activities. For example, economic difficulties could lead to a decrease in the ability of citizens and companies to insure themselves or to pay their premiums.

    Social Transition and Physical Risks

    Social transition risk can result from the misalignment of economic activities with changes in policy, technology, legal requirements or consumer preferences which aim at addressing social negative impacts, such as for example inadequate working conditions or discrimination.

    While social risks are primarily non-physical in nature, they can also give rise to physical / mental health consequences, especially when they affect working, safety and living conditions. Social risks related to inequality, discrimination, or human rights abuses can also for example lead to social conflicts which may have physical consequences in the form of property damage resulting from violence.

    Social Risks for Insurers from a Prudential Perspective

    Social risks can translate into prudential risks in the form of underwriting, market, operational (incl. legal) or reputational risks.

    Pillar I Prudential Treatment

    To perform a quantitative analysis to assess the potential for dedicated capital charges related to social risks, in line with risk- and evidence-based principles, would require large (international) consensus on appropriate definitions of risk channels as well as comprehensive and granular data on social risk factors in conjunction with appropriate risk models, which are not available to date. Hence, EIOPA does not conduct a Pillar I-related analysis in response to the expected mandate.

    Pillar II Prudential Treatment

    This chapter of EIOPA’s consultation clearly favours ORSA as being today’s most appropriate tool to deal with Social Risk Management. We agree with this initial strategy as it will enable regulators to build a real framework potentially impacting Pillar I and III within the next two to three years. However, based on the recent experience with ORSA, it would be useful to guide (re)insurance undertakings once the first ORSA reports including these issues filed to NCA. A Dry Run ORSA including these new criteria – like the one we experienced prior to 2016 – could be a good strategy to meet expectations.

    High level social risk materiality assessment

    (Re)insurers can conduct a high level (qualitative) social risk materiality assessment based on exposure to geographies, sectors or lines of business. The materiality of the exposure would form a proxy to vulnerability and materiality of the risk, in a first step of a risk materiality assessment.

    • Social risk – geographical exposure. For example, the Allianz social risk index118 identifies countries that are most vulnerable to systemic social risk. Indicators providing measures for social inequality or development can also provide indications on geographical exposure to social risks, such as the World Bank’s World Development Indicators featuring among others social indicators on labor, health, gender; the Gini index measures the distribution of income across a population; the UNDP human development indicator summarizes achievement in key dimensions of human development across countries.
    • Social risk – sectoral exposure. The exposure of assets or liabilities to economic activities in ‘high social risk sectors’. For example, the Business and Human Rights Navigator (UN Global Compact) can help mapping exposure to sectors at high risk of relying on child labour, forced labour, or sectors negatively impacting on equal treatment (incl. restrictions to freedom of association) or on working conditions (inadequate occupational safety and health, living wage, working time, gender equality, heavy reliance on migrant workers) or have negative impacts on indigenous people. For these issues, the Navigator identifies industry-specific risk factors, aiming to illustrate the issue for certain sectors such as agriculture, fashion & apparel, mining, travel & tourism. The navigator also identifies due diligence steps that companies can take to eliminate the specific social risks in their operations and supply chains. Information on the social sustainability of the economic activity the insurer is underwriting or investing in, can be sourced from companies’ corporate reporting on social risks and impacts under the Corporate Sustainability Reporting Directive (CSRD), as will be implemented by the European Sustainability Reporting Standards.
    • Social risk – insurance lines of business exposure. Some insurance lines of business may be particularly exposed to social risks. For example, the PSI ESG Underwriting Guide for Life and Health Insurance123 and the Geneva Association’s heat map of potential ESG risks in property and casualty underwriting124 identify social factors that may (negatively/positively affect) health or life and non-life insurance risks. Social adversity and lifestyle behaviour is known to affect health and with it, potential health insurance claims. Workers’ compensation claims are likely to be at risk of an employer’s poor work force policies. Other social/societal factors, such as housing insecurity or lack of education can influence (in)directly the outcome of workers’ compensation claims.

    Practices for Mitigating Social Risks & Impacts: The Investment Strategy and Decisions

    • Limiting investment in or divesting from socially non-sustainable activities/companies: The exclusion of an investee harming social objectives from the investment portfolio can follow the identification of a socially harmful activity, based on two sources: internationally agreed conventions (e.g., certain kinds of weapons) or research on the detrimental effects of certain activities (e.g., detrimental effect of tobacco use). Thresholds for investments in such companies can be set, or exclusions from investments in these sectors pursued. Minimum social safeguards can serve as a guiding principle.
    • Impact investing and stewardship:
      • The (impact) investment strategy would direct investments at economic activities aiming to achieve explicitly social goals. For example, the funding of health research, through targeted investments in dedicated undertakings or investment in financial literacy programs may contribute to social objectives to improve living standards or access to relevant products to secure financial safety.
      • Engagement and voting on sustainability matters (as part of a stewardship approach) can aim to influence firms of which (re)insurers are shareholders. This supposes the (re)insurer can persuade the investee to act on social objectives and requires a certain degree of influence or leverage that the (re)insurer can reasonably exercise. (Re)insurers can use their engagement and voting rights to improve performance of those companies against the social objectives.
      • A ‘best-in-class strategy’ would consist in selecting investee companies with excellent social performance, regardless of the sector which they belong to. Such an investment approach can support companies to transition to a more socially sustainable business model. (Re)insurers can seek to ensure that those firms they invest in measure up to social objectives, especially in ‘high risk’ sectors, ensuring, for example that they provide appropriate wages, or that they operate safe working environments.
      • Such risk mitigating or adaptation actions can be informed by considering the SFDR principal adverse impacts of the investee companies’ activities. The so-called ‘minimum social safeguards’ as referred to in the Taxonomy Regulation can also provide a minimum standard for implementing a social prudent person principle for investments, in line with Solvency II.

    Practices for Mitigating Social Risks & Impacts: The Underwriting Strategy and Decisions

    • Limiting underwriting of socially non-sustainable activities: Similar to investments, insurers could opt not to insure companies (belonging to a sector) known for unsustainable or harmful social practices in its own operations or value chain, or negatively impacting communities or consumers.
    • Impact underwriting and services: Through targeted underwriting activity, products and services, insurers could bring additional social benefits that directly contribute to the realization of social objectives for end-users and consumers as well as for affected communities (directly or through the value chain). There may be scope for insurers, through their underwriting strategy and decisions, to incentivize policyholders to manage losses arising from social risks. This may be through the provision of services or the potential reduction of premia for risk reducing measures taken by the policyholder, consistent with actuarial risk-based principles. Via underwriting, insurers could also ensure their product offerings and distribution practices consider the demands and needs of a diverse range of clients. Through their underwriting they need to ensure exclusions do not unfairly target and discriminate consumers with non-normative traits and/or vulnerable consumers.
      • For example:
        • The integration of social risk mitigants into, for example, surety bond underwriting for infrastructure projects can also contribute to reducing losses from underwriting due to social risks.
        • Risk mitigants can be part of underwriting conditions for workers’ compensation policies requiring companies to impact on the health of their workers through the pay they provide, the security of contracts they offer, and through the provision of benefits such as sick pay, parental leave, health insurance and other health-related schemes.
        • The establishment of sectoral risk sharing capacities at local, regional or national level, where applicable with government involvement, can contribute to social risk mitigation, for example by improving risk assessment for communities and societies and reducing losses from socio-economic risk events.

    Pillar III Prudential Treatment

    Considering the nascent reporting requirements on social risks and impacts under SFDR and CSRD, EIOPA is not proposing at this stage to develop additional (prudential Pillar III) reporting or disclosure requirements regarding social risks and impacts in Solvency II. Further analysis would be required as to whether quantitative prudential reporting requirements could inform the corresponding prudential treatment of (re)insurers assets and liabilities.

    DORA: What the new European Framework for Digital Operational Resilience means for Business

    On 10 November 2022, the European Parliament voted to adopt a new EU regulation on digital operational resilience for the
    financial sector (DORA)
    . With obligations under DORA coming into effect late in 2024 or early 2025 at the latest, in this briefing we take a closer look at its impact and consider what the regulation will mean for firms, their senior managers and operations and what firms should be doing now in preparation for day one compliance.

    What is DORA?

    Aimed at harmonising national rules around operational resilience and cybersecurity regulation across the EU, DORA establishes uniform requirements for the security of network and information systems of companies and organisations operating in the financial sector as well as critical third parties which provide services related to information communication technologies (ICT), such as cloud platforms or data analytics services.

    DORA creates a regulatory framework on digital operational resilience whereby all in-scope firms need to make sure that they can withstand, respond to, and recover from, all types of ICT-related disruptions and threats. ICT is defined broadly to include digital and data services provided through ICT systems to one or more internal or external users, on an ongoing basis.

    DORA forms part of the EU’s Digital Finance Package (DFP), which aims to develop a harmonised European approach to digital finance that fosters technological development and ensures financial stability and consumer protection. The DFP also includes legislative proposals on markets in cryptoassets (MiCA), distributed ledger technology and a digital finance strategy.

    Who will need to comply with DORA?

    DORA will apply to financial entities, including:

    • credit institutions,
    • payment institutions,
    • e-money institutions,
    • investment firms,
    • cryptoasset service providers (authorised under MiCA) and issuers of asset-referenced tokens,
    • central securities depositories,
    • central counterparties,
    • trading venues,
    • trade repositories,
    • managers of alternative investment funds and management companies,
    • data reporting service providers,
    • insurance and reinsurance undertakings,
    • insurance intermediaries,
    • reinsurance intermediaries and ancillary insurance intermediaries,
    • institutions for occupational retirement pensions,
    • credit rating agencies,
    • administrators of critical benchmarks,
    • crowdfunding service providers and
    • securitisation repositories (Financial Entities).

    DORA will also apply to ICT third-party service providers which the European Supervisory Authorities (the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA), acting through their Joint Committee) (ESAs) designate as « critical » for Financial Entities (Critical ICT Third-Party Providers) through a newly established oversight framework.

    The ESAs would make this designation based on a set of qualitative and quantitative criteria, including:

    • the systemic impact on the stability, continuity or quality of financial services in the event that the ICT third-party
      provider faced a large-scale operational failure to provide its services;
    • the systemic character or importance of Financial Entities that rely on the ICT third-party service provider;
    • the degree of reliance of those Financial Entities on the services provided by the ICT third-party service provider in
      relation to critical or important functions of those Financial Entities; and
    • the degree of substitutability of the ICT third-party service provider.

    Any ICT third-party service provider not designated as critical would have the option to voluntarily « opt in » to the oversight. The ESAs may not make a designation in relation to certain excluded categories of ICT third–party service providers, including where Financial Entities are providing ICT services

    • to other Financial Entities,
    • to ICT third–party service providers delivering services predominantly to the entities of their own group or
    • to those providing ICT services solely in one Member State to financial entities that are active only in that Member State.

    What are the key obligations?

    DORA introduces targeted rules on ICT risk management capability, reporting and testing, in a way which enables Financial Entities to withstand, respond to and recover from ICT incidents. In principle, some of the requirements imposed by DORA, such as for ICT risk management, are already reflected to a certain extent in existing EU guidance (for example, the EBA Guidelines on ICT and security risk management).

    The proposals include requirements relating to:

    • ICT risk management

    DORA sets out key principles around internal controls and governance structures. A Financial Entity’s management body will be expected to be responsible for defining, approving, overseeing and being continuously accountable for a firm’s ICT risk management framework as part of its overall risk management framework. As part of the ICT risk management framework, Financial Entities need to maintain resilient ICT systems, revolving around specific functions in ICT risk management such as

    • identification of risks,
    • protection and prevention,
    • detection,
    • response and recovery and
    • stakeholder communication.
    • Reporting of ICT-related incidents

    DORA aims to create a consistent incident reporting mechanism, including a management process to detect, manage and notify ICT-related incidents. Incidents deemed « major » would need to be reported to competent authorities within strict time frames, including initial notifications « without delay » on the same day or next day by using mandatory reporting templates. In some cases, communication to service users or customers may be required.

    • Testing

    As part of the ICT risk management framework, DORA requires Financial Entities to adopt a robust and comprehensive digital operational resilience testing programme covering ICT tools, systems and processes. Certain Financial Entities must carry out advanced testing of their ICT tools, systems and processes at least every three years using threat-led penetration tests.

    • Information sharing

    DORA contains provisions which should facilitate the sharing, among Financial Entities, of cyber threat information and intelligence, including

    • indicators of compromise,
    • tactics,
    • techniques and procedures,
    • cyber security alerts and
    • configuration tools

    to strengthen digital operational resilience.

    • Localisation

    Financial Entities will only be permitted to make use of the services of a third-country Critical ICT Third-Party Provider if such provider establishes a subsidiary in the EU within 12 months following its designation as a Critical ICT Third-Party Provider.

    A simplified set of ICT risk framework requirements will apply to certain Financial Entities, including small and non-interconnected investment firms and payment institutions exempted under the Second Payment Services Directive. Such entities will need to comply with a reduced set of requirements under DORA, including the requirement to put in place and maintain a sound and documented risk management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of all ICT risks, including for the protection of relevant physical components and infrastructures.

    What should firms be doing now to prepare?

    Although it is not expected that DORA will apply to in-scope entities until late 2024 (see below), firms should now begin
    considering the steps that they will need to take to ensure day one compliance
    . These include:

    • Scope out impact

    Taking a risk-based approach reflective of their size, nature, scale and the complexity of their services and operations, Financial Entities should begin to scope out the impact of DORA on their business. Firms should carry out a comprehensive gap analysis of their existing ICT-risk management processes against the new requirements introduced by DORA to identify any aspects of their existing processes that will be impacted by the new requirements and develop detailed implementation plans setting out the steps that will need to be taken to effect relevant changes. As part of this, Financial Entities should ensure that they have in place appropriate:

    (i) capabilities to enable a strong and effective ICT risk management environment;

    (ii) mechanisms and policies for handling all ICT-related incidents and reporting major incidents; and

    (iii) policies for the testing of ICT systems, controls and processes and the management of ICT third-party risk.

    This process will be iterative as some of the more detailed requirements of DORA will be further developed through technical standards to be published by the ESAs in due course.

    • Critical ICT Third-Party Providers

    Critical ICT Third-Party Providers will be required to have in place comprehensive, sound and effective rules, procedures, mechanisms and arrangements to manage the ICT risks which they may pose to Financial Entities. Although DORA provides that the designation mechanism (pursuant to which the ESAs may designate an ICT third-party service provider as « critical ») must not be used until the Commission has adopted a delegated act specifying further details on the criteria to be used in making such an assessment (to be adopted within 18 months after the date on which DORA enters into force), it is expected that certain categories of providers, such as cloud computing service providers who provide ICT services to Financial Entities, will be designated as Critical Third-Party Providers.

    Consequently, such providers may wish to begin the task of benchmarking their existing systems, controls and processes against existing guidelines, such as the EBA Guidelines on ICT and security risk management and Guidelines on outsourcing arrangements, to the extent required, to identify areas that require further investment and maturity. They will also need to consider whether new and existing contracts give them sufficient flexibility to comply with new regulatory rules, orders and directions, even if this would otherwise be inconsistent with their contractual obligations. As set out above, certain categories of ICT third-party service providers are expressly excluded from the designation mechanism, including Financial Entities providing ICT services to other Financial Entities, ICT intra-group service providers and ICT third-party service providers providing ICT services solely in one Member State to Financial Entities that are only active in that Member State.

    • Third Country Critical ICT – Third-Party Providers – Subsidiarisation

    The EU subsidiarisation requirement that will apply to third country Critical ICT Third-Party Providers is one that will necessitate early engagement between such providers and the Financial Entities that they serve. While it is not clear what role the EU subsidiary must play in the provision of services to the relevant Financial Entity (e.g. whether the provider must act as contractual counterparty), Recital 58 of DORA indicates that the requirement to set up a subsidiary in the EU does not prevent ICT services and related technical support from being provided from facilities and infrastructures located outside the EU. Nevertheless, where a relevant third country ICT third-party provider that is likely to be designated as « critical » indicates that it does not intend to establish a subsidiary in the EU, even following a designation as such by the ESAs, Financial Entities may wish to commence the process of identifying alternative providers, since they will not be permitted to obtain ICT services from a third country Critical ICT Third-Party Provider that fails to establish a subsidiary in the EU within 12 months following its designation as critical.

    Companies that consider they are likely to be classified as Critical ICT Third-Party Providers that do not already have an establishment or subsidiary located in the EU should begin to consider now which Member State would be most appropriate to establish a new subsidiary in, taking into account their business operations and the various applicable legal requirements.

    • Documentation impact

    As noted above, DORA sets out core contractual rights in relation to several elements in the performance and termination of contracts with a view to enshrine certain minimum safeguards underpinning the ability of Financial Entities to monitor effectively all risk emerging at ICT third-party level. Some contractual requirements set out in DORA are mandatory and will need to be included in contracts, if not already reflected. Others take the form of principles and recommendations and may require negotiation between the relevant parties. Early mapping and engagement in this respect will be important. Additionally, parties may wish to consider benchmarking their existing contractual arrangements against relevant requirements set out in DORA, as well as existing standard contractual clauses developed by EU institutions.

    For example, Recital 55 of DORA notes that « the voluntary use of contractual clauses developed by the Commission for cloud computing services may provide comfort for Financial Entities and ICT third-party providers by enhancing the level of legal certainty on the use of cloud computing services in full alignment with requirements and expectations set out by the financial services regulation ».

    As the industry awaits more detailed technical standards to be developed and published by the relevant ESAs, as well as DORA compromise/Level 1 text, in-scope entities may consider using existing guidelines such as the EBA Guidelines on ICT and security risk management and Guidelines on outsourcing arrangements as useful benchmarking tools in preparation for day one compliance.

    How does DORA interact with NIS2?

    The second iteration of the Security of Network and Information Systems Directive (NIS2) aims to strengthen security requirements and provide further harmonisation of Member States’ cybersecurity laws, replacing the original NIS Directive of 2016 (NIS1). Its timeline is similar to that for DORA, with a provisional agreement among EU institutions reached in May 2022, and its adoption confirmed in a European Parliament plenary session vote on 10 November 2022. NIS2 significantly extends the scope of NIS1 by adding new sectors, including « digital providers » such as social media platforms and online marketplaces, for example, but importantly also introduces uniform size criteria for assessing whether certain financial institutions (and other entities) fall within its scope. NIS2 sets out cybersecurity risk management and reporting obligations for relevant organisations, as well as obligations on cybersecurity information sharing, so there is some overlap in coverage with DORA.

    However, this has been addressed during the legislative process to ensure that financial entities will have full clarity on the different rules on digital operational resilience that they need to comply with when operating within the EU. NIS2 specifically provides that any overlap will be addressed by DORA being considered as lex specialis (ie a more specific law that will override the more general NIS2 provisions).

    How does DORA compare with international developments?

    The introduction of DORA in the EU reflects a global focus on operational resilience and strengthening cybersecurity standards in the wake of ever-increasing digitalisation of financial services and increasingly sophisticated cyber incidents. For example, in March 2021, the Basel Committee on Banking Supervision issued its Principles for operational resilience, as well as an updated set of Principles for the sound management of operational risk (PSMOR), which aim to make banks better able to withstand, adapt to and recover from severe adverse events.

    In October 2022, following a G20 request, the Financial Stability Board (FSB) published a consultation on Achieving Greater Convergence in Cyber Incident Reporting, recognising that timely and accurate information on cyber incidents is crucial for effective incident response and recovery and promoting financial stability and with a view to ensuring that financial institutions operating across borders are not subject to multiple conflicting regimes. The FSB proposals include recommendations to address the challenges to achieving greater international convergence in cyber incident reporting, work on establishing common terminologies related to cyber incidents and a proposal to develop a common format for incident reporting exchange.

    Following its departure from the EU, the UK has introduced a Financial Services and Markets Bill (the UK Bill) which includes proposals to regulate cloud service providers and other critical third parties supplying services to UK regulated firms and financial market infrastructures. HM Treasury would have powers to designate service suppliers as ‘critical’ and the UK regulators would have new powers to directly oversee designated suppliers, which would be subject to new minimum resilience standards. While the proposals have the same ambitions as, and there are similarities with, the requirements under DORA, there are a number of key differences between them.

    For example, the proposed enforcement regime under DORA for Critical ICT Third-Party Providers is very different from the equivalent regime proposed by the UK Bill. Under DORA, the ESAs will be designated as « Lead Overseers », but with the power only to make ‘recommendations’ to Critical ICT Third-Party Providers, in contrast to the ability for UK regulators to make rules applying to, or to give directions to, critical third parties subject to the UK Bill, with the ability to issue sanctions for non-compliance. Under DORA, non-compliance by a Critical ICT Third-Party Provider with recommendations gives the Lead Overseer the ability to notify and publicise such non-compliance and « as a last resort » the option to require Financial Entities to temporarily suspend services provided by such provider until the relevant risks identified in the recommendations have been addressed.

    This means that the liability and contractual issues for Critical ICT Third-Party Providers providing services in the EU will be different than for those providing services in the UK, and that contracts for each will need to be considered and negotiated carefully.

    Next steps and legislative timeline

    Following adoption of DORA by the European Parliament plenary session on 10 November 2022, the regulation is now passing through the final technical stages of the formal procedure for European legislation. The text still needs to be formally approved by the Council of the EU before being published in the Official Journal, which is expected in December 2022 or January 2023.

    DORA will come into effect on the twentieth day following the day on which it is published in the Official Journal. It will apply, with direct effect, 24 months from the date on which it enters into force. Therefore, it is expected that DORA will apply to in-scope firms from late 2024 or early 2025 at the latest.

    Where to start on your ESG journey

    Where to start on your ESG journey

    Initiating your company’s commitment to reporting its environmental, social, and governance (ESG) metrics can prove a daunting task. But keep in mind: It’s a marathon, not a sprint.

    “You don’t have to be perfect on Day 1, Your suppliers and stakeholders want to see progress.”

    If your company is at this stage—perhaps bracing for the climate-related disclosure rule proposal put forward by the Securities and Exchange Commission (SEC) in March—a roadmap for getting your ESG efforts off the ground could look like this:

    Transparency and annual reporting: “Start by identifying all the things your company is doing on ESG and build a baseline, that will give you an indication of how mature your program is today. Most likely you’re doing a lot already.”

    Peer benchmarking: Where are your competitors in their ESG journeys? Have any of them experienced public success or failure you can learn from? From this exercise, your company can set realistic expectations of where it wants to be to keep pace with the competitive landscape.

    Materiality assessment: “Understanding the materiality drivers for your industry or industries, depending on how your company is structured, is helpful”. The Sustainability Accounting Standards Board (SASB) offers a materiality map that provides guidance for 77 different industries. “Having something at the bottom doesn’t mean it’s not important and you stop doing it, but it helps you focus on the top tier, those are the items you need to set public goals on.” External materiality assessments also add credibility. »

    Strategy framework: You know what your peers are doing, you know what’s important to the company and its investors— now is when you build out your strategy. “What does ESG mean for us?” “What are we trying to achieve?” ESG means different things for different companies, but “there’s also some fundamental truths about what ESG is and how and who ESG is serving—the stakeholders involved in your business.” Particularly for compliance professionals, serving shareholders is a natural strategic goal to build around.

    Goal setting/resetting: During the peer benchmarking stage, you might note some of the milestones your competitors are striving toward. Their goals can help shape your own. “Do you want to be with the group where you’re just managing expectations, or do you want to compete or lead? It doesn’t happen overnight; you have to go through it step-by-step and build your goals for the long term to move the needle on this. If you’re setting carbon-neutral or net-zero deadlines, be realistic. “Put something out there that is achievable but not too easy”.

    Implementing and measuring: This is the most important step because “it’s not in your hands anymore, You have to depend on your cross-functional teams … they will be the ones doing the work and implementing the initiatives.” Legal, human resources, operations, and other departments each have a part to play. You set up a dashboard to track how it was progressing on its key performance indicators on a quarterly basis. “We didn’t wait until the annual report to find out how we did”.

    Improvement and adjustment: ESG reporting is a cycle, as evidenced by the arrow in the roadmap image. Going through these steps each year will help ensure a business is tailoring its objectives to continue to serve the most important piece of the puzzle. “This (ESG) is about the people, this is not about the processes, procedures, or requirements. It’s about the people—inspiring the people, collaborating cross-functionally, getting that momentum. That will help you move a lot faster.”

    ESG: Adapting businesses should look beyond what is financially material

    Environmental, as many would expect, covered climate-related elements, including carbon, energy, water, waste, and circularity. Diversity and inclusion, workplace safety, data privacy and protection, and customers and community fell under social. Governance claimed ethical business practices, board structure, disclosures and reporting, and executive compensation.

    While ESG is comprised of just three words, it represents a lot more, encompassing many aspects of how businesses can operate efficiently, ethically, and more financially sound. “Sometimes you have to take out some of the buzzwords that cause people to lock in to certain thinking and open it up. One way to do that is to call it strategic nonfinancial materiality.”

    It’s important to think of sustainability initiatives in terms of strategic nonfinancial materiality when it comes to the “tragedy of the commons,” a popular term in environmental science. “When we come across something we can use with no associated cost, we historically 100 percent of the time overuse and mismanage it. If something is common, we manage to mess it up.”

    Examples of this include the atmosphere, oceans, and low earth orbit. Prudent corporations can innovate their thinking by getting ahead of an issue and “band[ing] together with industry [or] with other people who use those commons.” One way to think about this, is the term “double materiality,” which is often associated with the European Union’s Nonfinancial Reporting Directive. Double materiality calls for companies to consider their impact on society and the environment in addition to how sustainability issues affect the company.

    “In the United States, we’re very well focused on financial materiality.” Also worth considering is “dynamic materiality,” a term utilized by the World Economic Forum that encourages companies to track certain factors year-over-year that might not be material now but could be in the future as the environment changes rapidly.

    “These are dynamically material risks. You may still not know anything about them, but it is important to track them potentially as emerging risks, so, innovate how you look at not just what’s a snapshot material now but what are those things that are likely to be material soon.”

    Regarding social, it’s suggested to contemplate news stories over the last few years that have changed how we deal with employees as an example. “They didn’t happen in a continuity, one day you weren’t talking about it, the next day it was on the front page and didn’t go off. Those are dynamically material things that drastically change, and you should be able to look for them.”

    The Securities and Exchange Commission’s (SEC) proposed climate-related disclosure rule released in March puts forward a similar process, asking companies “to report items that aren’t financially material but are risks nonetheless. This is new, and it’s going to affect the assurance functions,” including

    • internal audit,
    • enterprise risk management,
    • and trade compliance.

    “Assurance functions rely on governance and rules, and as we do this, we are going to expand that governance. When you do, you can expand assurance.”

    Under the SEC’s proposal, assurance—first limited, then reasonable—is required for Scope 1 and 2 greenhouse gas emissions disclosures outside of the financial statements for accelerated and large accelerated filers. There is no initial attestation requirement for Scope 3 disclosures, which are also subject to a safe harbor provision for affected registrants.

    Regarding internal audit, “Maybe we can apply more automation [and] more data analytics to those areas. There is going to be more governance and rigor applied. Maybe more of our creative aspects and our more human and complex audits can go to other places because if greenhouse gas emissions are going to be extremely rigorized, similar to financials, maybe that can be a robotic process automation.”

    Hidden Opportunities of Aligning Ethics and Compliance with ESG

    ESG is rapidly evolving from grass-roots activism into a top down, board-driven mandate. It’s no mystery why, given that ESG assets make up a third of total global assets under management and are expected to surpass $50 trillion by 2025. ESG investing (also known as “impact investing”) was born of a growing awareness that long-term financial performance of businesses is inextricably intertwined with environmental, social, and governance factors. It has gained considerable traction as research suggests that companies with high ESG ratings tend to outperform their counterparts.

    As a result, companies are moving beyond “check the box” ESG disclosures, to instead build out substantive ESG programs, identify appropriate quantitative and qualitative metrics to measure and validate their ESG initiatives, and distinguish themselves with “AAA” ESG ratings. Corporations are devoting significant capital, time, and resources to embedding environmental, social and governance factors into their business strategies and preparing annual ESG disclosures. Because ethics and compliance is so tightly woven into the social and governance elements of ESG, ethics and compliance officers are uniquely poised to support this broader effort in a number of ways.

    THE OVERLAP BETWEEN E&C AND ESG

    While ESG is strongly associated with environmental initiatives such as lowering carbon footprint, social and governance factors have achieved equal prominence. “Social” and “governance” define a company’s corporate citizen persona—or how it behaves—which is the heart and soul of ethics and compliance and, increasingly, a key factor in market valuation.

    Ensuring a company behaves responsibly and ethically is both the mission of a Chief Ethics and Compliance Officer and the purpose of an ESG program. CECOs therefore have oversight of much of the infrastructure that supports social responsibility and prevents corruption, such as

    • internal controls,
    • Code of Conduct and policies,
    • workplace health and safety,
    • data protection and privacy,
    • whistleblower hotlines, workforce training,
    • and prevention of fraud, bribery and money laundering.

    Ethics and compliance is mission critical because it is the reputational guardian of the company, the first line of defense against ethical fading. Thanks in large part to the lightning speed of today’s news cycle and the instantaneous impact of social media, corporate malfeasance scandals can have massive immediate impact on reputation and by extension valuation. It’s not unusual for news of bad corporate behavior to be accompanied by an immediate 20-30% drop in market cap. For a $3 billion company, that can equate to a one-day loss of $1 billion.

    WHY SHOULD CECOS ALIGN WITH ESG?

    It’s early days for ESG, relatively speaking, and best practices for building, quantifying, and disclosing ESG programs are rapidly evolving. As companies move towards transparency and begin walking the talk by aligning corporate culture to the stated ESG values, the historical function of E&C rolls up naturally to support these efforts. Opportunities abound for ethics and compliance leaders who join the challenge to improve their company’s ESG report card:

    1. Board visibility: Boards have come to recognize that robust ESG programs not only attract investors, but also offer a framework to mitigate business risk and future proof the company. Boards are now dedicating agenda time to embedding ESG into company strategy and risk mitigation. As a result, the head or coordinator of a company’s ESG program often reports to the board.
    2. More funding: A traditional ethics and compliance framework is often insufficient to meet the broader mandate of ESG. The top accounting and consulting firms are investing in building capability and capacity for ESG advisory services, and CECOs should be doing likewise internally. By tying ethics and compliance programming to ESG, E&C officers can tap into a bigger budget pool.
    3. Organizational clout: ESG planning and disclosure requires holistic engagement across the organization. By ensuring ethics and compliance is a strong complement of, and contributor to, the high-visibility high-value ESG initiative, CECOs can break organizational silos and increase the intrinsic value of ethics and compliance (and their roles) in the process.

    Anchoring Climate Change Risk Assessment in Core Business Decisions in Insurance

    Key messages:

    1. The development of decision-relevant climate change risk assessment with a holistic approach requires an exploratory, iterative and adaptive process that will take time. A holistic approach
      considers physical, transition and litigation risks and their interactions at different time horizons in the short and long term. It considers both sides of the balance sheet, as well as interactions across business functions and decision feedback loops to assess the materiality of risks and develop potential actions to address them. Importantly, some re/insurers that have advanced further in this iterative process have found it beneficial to anchor the assessment in overarching decision areas that link both sides of the balance sheet. While re/insurers in all business lines have started exploring the materiality of physical and transition climate change risks on each side of the balance sheet, for life & health re/insurers in particular, more research is required to assess the attributions and materiality of climate change to their underwriting exposures – including longevity, mortality and morbidity –over various time horizons. As research in this field progresses, the ability both to assess life & health re/insurer liability exposures and perform more holistic assessments will improve.
    2. An analysis of regulatory developments since June 2021 and a survey conducted by The Geneva Association reveal that the regulatory and supervisory priorities and approaches are increasingly aligned with earlier GA task force recommendations related to climate change risk assessment and scenario analysis.
    3. Responses from 11 regulatory bodies to a Geneva Association Survey shed light on the regulatory objectives and priorities that can help guide climate change risk assessment exercises within and across jurisdictions. Our analysis has revealed the top four regulatory priorities:
      • policyholder protection,
      • the insurer’s financial health,
      • corporate governance and strategy,
      • the insurability/affordability of insurance solutions,
      • financial stability,
      • raising risk awareness,
      • addressing data/risk assessment services and environmental stewardship.
    4. Company boards and executive management need to consider the following four key issues to drive the process towards a more holistic approach that would produce decision-useful information:
      • Board oversight and executive management buy-in for company-wide engagement, along with appropriate resource allocation to build these capabilities, are important;
      • The coordination and execution of climate change risk assessment require an internally established, company-specific mandate with clear accountability;
      • Central to this process is the development of overarching decision-relevant questions for the board and the C-suite (a list based on the GA survey of regulatory and standard-setting bodies is included);
      • Company-relevant business use cases should be designed and utilised to guide the iterations of climate change risk assessment.
    5. A 10-step template provided in this report can help companies design business use cases to frame the analysis, engage experts from relevant business functions across the balance sheet, and mine and utilise the same data and tools across the company. It is important to start simple by exploring the impacts of each climate change risk type, on each side of the balance sheet, considering short- and long-term time horizons. With each iteration, companies can build up the level of complexity by assessing the interactions of physical, transition and litigation risks and exploring how these risks are manifested within and across business functions. Of note:
      • This process should consider internal business functions and their interactions as well as external drivers that impact issues relevant to the business use case, by risk type and time horizon;
      • Materiality analysis is at the heart of climate change risk assessment, allowing focus on the
        areas most impacted by climate change risks and identifying priorities for a deeper dive and
        resource allocation;
      • As part of the design and implementation of business use cases, the company should seek to
        identify metrics to measure and monitor the risks and track the impacts of the measures taken to manage them;
      • This resource-intensive process will take time and present challenges that will need to be addressed, ranging from overtime and the availability of data for the given region to internal experience and expertise, and the availability of best practices. In this report, we offer three examples of business use cases to demonstrate these points.
    6. The use of forward-looking scenario analysis needs to be further explored, depending on the issue being considered. Scenario analysis is a tool for conducting a forward-looking assessment of risks and opportunities, where the company can systematically explore individual or combined factors and make strategic decisions in the face of significant uncertainties. Scenario analysis may be used for a range of applications, for example:
      • Testing the resilience of a company’s business model to climate change-related risks;
      • Assessing the implications of possible actions a company can take;
      • Stress-testing the company’s business model under extremely adverse conditions.
    7. Through strong industry collaboration, re/insurers should conduct an analysis of existing data challenges, gaps and needs, and define priority areas and requirements for the future development of tools. More work is required by re/insurers and regulatory bodies to identify gaps in data, to converge on best practices and build a robust toolbox for forward-looking climate change risk analyses. Since 2021, several organisations have offered an assessment of the gaps in climate change risk data and tools in the current landscape, with a focus on certain applications or segments in the financial sector. The journey towards a holistic approach could lead re/insurers to address such gaps over time, not least in emissions data, asset locations and supply chain data. Note that life & health re/insurers still face challenges when it comes to identifying the types of data that would allow the extraction of climate change attribution and liability exposures.
    8. Importantly, company leadership should seek to harmonise and align their net-zero target-setting
      activities using ‘inside-out’ analysis with efforts to assess the resilience of their business model to
      climate change risks using ’outside-in’ approaches for developing viable targets, transition strategy and plans
      . In fact, a growing number of critics are calling out the misalignment of net-zero pledges with what the companies can actually deliver and the possibility of greenwashing, which could lead to potential reputational and climate litigation risks or even regulatory action.
    9. Robust intra- and inter-sectoral collaboration is the only way to expedite the development and convergence of good practices, meaningful baseline requirements for decision-useful climate change risk assessments and disclosures that would allow for cross-company comparisons. To this end, we acknowledge and deeply appreciate the growing proactive collaboration and engagement
      across the insurance industry and with key regulatory and standard-setting bodies in the financial sector.

    Context

    In 2020, The Geneva Association (GA) launched its task force on climate change risk assessment with the aim of advancing and accelerating the development of holistic methodologies and tools for conducting forward-looking climate change risk assessment. These efforts have intended not only to support primary insurance and reinsurance companies and regulatory bodies with innovation in this area, but also to demonstrate the benefits of industry-level collaboration to help expedite the development and convergence of best practices.

    In its first two reports, the GA task force highlighted the complexities associated with the development of forward-looking climate change risk assessment methodologies and tools. It stressed the need to develop methodologies for holistic climate change risk modelling and scenario analysis for both sides of the balance sheet, using a combination of qualitative and quantitative approaches. The GA task force also highlighted the implications of physical and transition risks for the insurance industry, with a focus on the challenges of quantitative scenario analysis approaches. The conclusion was that the prescriptive quantitative regulatory exercises to date, which were conducted to raise awareness, have outlived their
    purpose
    . More specifically, these resource-intensive exercises do not provide decision-useful information given the significant uncertainties associated with the transition to a carbon-neutral economy (e.g. uncertainties associated with public policy, market and technology risks). Finally, the GA task force called on regulatory bodies to clarify their regulatory objectives and explain how their exercises would deliver decision-useful information. It also stressed the need for convergence on baseline regulatory requirements for analysis and reporting across jurisdictions. To this end, it encouraged stronger collaboration between regulatory bodies within and across jurisdictions, as well as with the insurance industry, to enable the sharing of lessons learned and access to broader expertise, in the aim of expediting the convergence of best practices.

    Since June 2021, there have been several developments on the policy, technology, regulatory and scientific fronts, with implications for companies’ climate change risk assessment.

    The evolving regulatory landscape for climate change risk assessment

    Between June 2021 and May 2022, certain regulators launched new initiatives and published guidelines. A synthesis of these developments reveals the need for regulatory bodies to:

    • Acknowledge the limitations of current tools, models and data for long-term quantitative scenario analysis (as evidence, the 2021 Bank of England Climate Biennial Exploratory Scenarios experiment concluded that projections of climate change losses are uncertain; the view that scenario analysis is still in its infancy, with notable data gaps; and the increasing recognition among some regulatory bodies that quantitative approaches can and should be complemented with qualitative assessments, especially over a longer time horizon);
    • Stress the need to consider multiple scenarios representing different plausible pathways of transition or physical risks, and expand benchmark scenarios (typically NGFS) with sectoral and geographical granularity considerations;
    • Recognise the principle of proportionality, with expectations linked to the size and organisational complexity of the company;
    • Stress the importance of materiality in supervisory expectations for quantitative assessments as well as robust governance of climate change risks, with a need for transparency, particularly in relation to re/insurer investments in carbon-intensive sectors.

    As of July 2022, there are still variations in the approaches used by regulators. Regulators agree, however, that this could impede comparisons across companies and jurisdictions as well as the ability to assess broader systemic economic and social impacts. Importantly, the International Association of Insurance Supervisors (IAIS) is working on promoting a globally consistent supervisory response to climate change, with a focus on three areas:

    • standards,
    • data
    • and scenario analysis,

    by providing guidance to regulatory bodies. The Financial Stability Board (FSB) is also issuing guidance on supervisory and regulatory approaches across borders and sectors to address market fragmentation and potential sources of systemic risk. Finally, the development of a global baseline for sustainability reporting standards with a focus on climate change, by the ISSB, aims to translate them further into harmonised inter-jurisdictional standards.

    Strategic importance of aligning inside-out and outside-in climate risk assessment approaches

    Companies are conducting two types of climate risk assessment:

    • Inside-out analysis: This includes assessing the impact of the company’s actions on the climate by setting their climate targets (e.g. net zero targets) based on a variety of science-based approaches, such as those introduced by the UN Net-Zero Asset Owner Alliance (UN NZAOA) and the Science-Based Targets initiative (SBTi). For example, the UN-convened Net-Zero Alliances uses 1.5°C-compatible pathways, which may be far more ambitious than what companies and the real economy can deliver. In fact, the UN NZAOA has warned that the global economy does not move as is required by science, leading to a widening gap between companies’ climate targets and the real economy. Net-zero targets need to take this widening gap into account as this misalignment could lead to other financial and non-financial risks for the company, including reputation risk. This is further exacerbated by the fact that climate science is still evolving.
    • Outside-in analysis: This involves assessing the resilience of the company’s business model to climate change risks, which is the focus of this report. It is important to emphasise that the development of the company’s strategy, transition plan and related actions cannot be done solely using inside-out analysis. Conducting outside-in analysis is critical, enabling the company to assess not only the impacts of climate change risks and their interactions, but also the implications of the possible range of activities under different scenarios on the firm’s business model. Of note, the inside-out view puts greater emphasis on ‘impact’ – which has a clear political component and should be grounded in materiality assumptions, which is the central objective of the outside-in analysis.

    In summary, companies should seek to harmonise and align inside-out with outside-in climate change risk assessment efforts (Figure 1). In fact, a growing number of critics are calling out the misalignment of net-zero pledges by the financial sector, in light of their already committed investments in carbon-intensive sectors for the years to come. Critics are also raising the possibility of greenwashing, which could lead to potential climate litigation risk. Regarding the latter, some regulators are developing KPIs to assess and monitor the existence and level of greenwashing as part of their efforts to incorporate climate change factors into their regulatory mandate.