While speaking at the 24th Annual Financial CEO conference in London, Charlotte Gerken of PRA outlined the ongoing and upcoming policy work on insurance risk management. This includes a consultation paper on the prudent person principle and a supervisory statement on liquidity risk management. She also explained that PRA is thinking about capital treatment and reporting aspects in terms of addressing the cyber risk and is planning to issue a supervisory statement in the area of outsourcing and third-party risk management.
Ms. Gerken outlined the recent guidance issued and the work being in the area of liquidity management, highlighting that much of the response to complex or unmodelable risks is not quantitative but qualitative, which is the domain of the prudent person principle. In the context of Solvency II the prudent person principle sets high level, qualitative standards. Therefore, in response to increasing supervisory concerns, PRA published a consultation paper which sets out proposals for a supervisory statement that clarifies how PRA expects firms to implement the prudent person principle. PRA also published a supervisory statement on liquidity risk management for insurers and updated the existing supervisory statement on illiquid unrated assets to take into account increasing levels of investment in income-producing real estate. All three pieces of guidance concern fundamental risk management principles and how PRA expects firms to put them into practice.
She then discussed technology as the new source of risk and opportunity, highlighting the growing demand for cyber insurance. Solvency II does not mention cyber risk at all, so there is a space for firms—and regulators—to fill. However, the basic framework for dealing with these kinds of business risks is already well-established. PRA is looking at incorporating this relatively new risk into its existing approach. This means thinking about capital treatment and reporting and working with industry to facilitate a move to more explicit coverage, standardization of contracts, and remove barriers to data sharing.
According to Ms. Gerken, the bigger unknowns for PRA are arising from the changes in business models; for instance, the increasing risk of cloud outsourcing. Insurers are increasingly using third-party data storage and processing, development infrastructure, and software delivery. PRA has surveyed insurers in this area and is analyzing the results. PRA is also planning to issue a new supervisory statement on outsourcing in the near future. The supervisory statement is intended to provide a one-stop source of reference on outsourcing and third-party risk management, bringing together the previously issued guidance. PRA is also finalizing policy proposals to require firms to improve their operational resilience, including making it clear how PRA expects them to identify important business services on which they rely.
Some technology developments are creating less tractable risks, for example, machine learning. Hedging models are being built using neural networks rather than financial mathematics. These models are black boxes, producing results that are fundamentally unexplainable. Traditional models to which risk management principles are applied are built on known logic and it is possible to determine the key variables affecting results and sensitivity of the results to changes in those variables. Machine learning poses challenges for a traditional risk management framework based on identifying and analyzing key risks and dependencies. This gives rise to questions regarding how can a firm’s Board satisfy itself of the model’s prudence and appropriateness. Regulators are also struggling to understand what a governance and disclosure framework looks like for a model that cannot be explained.
Related Link: Speech
Keywords: Europe, UK, Insurance, Liquidity Risk, Solvency II, Cyber Risk, Cloud Outsourcing, Fintech, Regtech, PRA
Previous ArticleBoE Publishes Draft and Corrective Versions of Banking XBRL Taxonomy
FCA and PRA in the UK, FED in the US, and the authorities in Singapore have fined Goldman Sachs for risk management failures in connection with the 1Malaysia Development Berhad (1MDB).
BCBS announced that OSFI and the Bank of Canada hosted the 21st International Conference of Banking Supervisors (ICBS) virtually on October 19-22, 2020.
FCA proposed guidance on how firms should continue to seek to help customers who hold insurance and premium finance products and may be in financial difficulty because of COVID-19, after October 31, 2020.
EBA issued an opinion on prudential treatment of the legacy instruments as the grandfathering period nears an end on December 31, 2021.
ESRB published the fifth issue of the EU Non-bank Financial Intermediation Risk Monitor 2020 (NBFI Monitor).
HM Treasury announced that the new Financial Services Bill has been introduced in the Parliament.
APRA announced that it has increased the minimum liquidity requirement of Bendigo and Adelaide Bank for failing to comply with the prudential standard on liquidity.
PRA published the consultation paper CP17/20 to propose changes to certain rules, supervisory statements, and statements of policy to implement elements of the Capital Requirements Directive (CRD5).
US Agencies adopted a final rule that applies to advanced approaches banking organizations and aims to reduce interconnectedness in the financial system as well as to reduce contagion risks associated with the failure of a global systemically important bank (G-SIB).
US Agencies (FDIC, FED, and OCC) adopted a final rule that implements the net stable funding ratio (NSFR) for certain large banking organizations.