While speaking at the 24th Annual Financial CEO conference in London, Charlotte Gerken of PRA outlined the ongoing and upcoming policy work on insurance risk management. This includes a consultation paper on the prudent person principle and a supervisory statement on liquidity risk management. She also explained that PRA is thinking about capital treatment and reporting aspects in terms of addressing the cyber risk and is planning to issue a supervisory statement in the area of outsourcing and third-party risk management.
Ms. Gerken outlined the recent guidance issued and the work being in the area of liquidity management, highlighting that much of the response to complex or unmodelable risks is not quantitative but qualitative, which is the domain of the prudent person principle. In the context of Solvency II the prudent person principle sets high level, qualitative standards. Therefore, in response to increasing supervisory concerns, PRA published a consultation paper which sets out proposals for a supervisory statement that clarifies how PRA expects firms to implement the prudent person principle. PRA also published a supervisory statement on liquidity risk management for insurers and updated the existing supervisory statement on illiquid unrated assets to take into account increasing levels of investment in income-producing real estate. All three pieces of guidance concern fundamental risk management principles and how PRA expects firms to put them into practice.
She then discussed technology as the new source of risk and opportunity, highlighting the growing demand for cyber insurance. Solvency II does not mention cyber risk at all, so there is a space for firms—and regulators—to fill. However, the basic framework for dealing with these kinds of business risks is already well-established. PRA is looking at incorporating this relatively new risk into its existing approach. This means thinking about capital treatment and reporting and working with industry to facilitate a move to more explicit coverage, standardization of contracts, and remove barriers to data sharing.
According to Ms. Gerken, the bigger unknowns for PRA are arising from the changes in business models; for instance, the increasing risk of cloud outsourcing. Insurers are increasingly using third-party data storage and processing, development infrastructure, and software delivery. PRA has surveyed insurers in this area and is analyzing the results. PRA is also planning to issue a new supervisory statement on outsourcing in the near future. The supervisory statement is intended to provide a one-stop source of reference on outsourcing and third-party risk management, bringing together the previously issued guidance. PRA is also finalizing policy proposals to require firms to improve their operational resilience, including making it clear how PRA expects them to identify important business services on which they rely.
Some technology developments are creating less tractable risks, for example, machine learning. Hedging models are being built using neural networks rather than financial mathematics. These models are black boxes, producing results that are fundamentally unexplainable. Traditional models to which risk management principles are applied are built on known logic and it is possible to determine the key variables affecting results and sensitivity of the results to changes in those variables. Machine learning poses challenges for a traditional risk management framework based on identifying and analyzing key risks and dependencies. This gives rise to questions regarding how can a firm’s Board satisfy itself of the model’s prudence and appropriateness. Regulators are also struggling to understand what a governance and disclosure framework looks like for a model that cannot be explained.
Related Link: Speech
Keywords: Europe, UK, Insurance, Liquidity Risk, Solvency II, Cyber Risk, Cloud Outsourcing, Fintech, Regtech, PRA
Previous ArticleBoE Publishes Draft and Corrective Versions of Banking XBRL Taxonomy
ESAs published the final draft implementing technical standards on reporting of intra-group transactions and risk concentration of financial conglomerates subject to the supplementary supervision in EU.
EBA published the annual report on asset encumbrance of banks in EU.
FED updated the reporting form and instructions for the FR Y-9C report on consolidated financial statements for holding companies.
EBA issued a consultation paper on the guidelines on monitoring of the threshold and other procedural aspects of the establishment of intermediate EU parent undertakings, or IPUs, as laid down in the Capital Requirements Directive.
EC published Regulation 2021/25 that addresses amendments related to the financial reporting consequences of replacement of the existing interest rate benchmarks with alternative reference rates.
BIS published a bulletin, or a note, that examines the cyber threat landscape in the context of the pandemic and discusses policies to reduce risks to financial stability.
HM Treasury, also known as HMT, has updated the table containing the list of the equivalence decisions that came into effect in UK at the end of the transition period of its withdrawal from EU.
EBA published an erratum for technical package on phase 1 of the reporting framework 3.0.
APRA updated a frequently asked question (FAQ), for authorized deposit-taking institutions, on the measurement of credit risk weighted assets.
ECB published a letter from Andrea Enria, the Chair of the Supervisory Board of ECB, answering questions raised by the President of the Bundestag (the German federal parliament) on how ECB assesses the financial stability of the euro area in the context of the significant level of nonperforming loans.