rain
This is your blog

The daily Post

New MGA Licensing Requirements in Ontario

On November 6, 2024, Bill 216, the Building Ontario For You Act (Budget Measures), 2024, received Royal Assent.  The Bill implements amendments to Ontario’s Insurance Act (the “Act”) which establish a new licensing regime for managing general agents operating in the life and accident and sickness insurance sectors in Ontario (“MGAs”).

The amendments, when proclaimed in force, will require entities that are acting as MGAs in Ontario, to obtain a separate licence that will be issued by the Financial Services Regulatory Authority of Ontario (“FSRA”).   The amendments specify that a person or entity will be acting as an MGA in Ontario when engaging in any of the following activities, or holding themselves out as doing so:

  1. Recruiting agents or prospective agents.
  2. Screening agents or prospective agents to confirm the agent is suitable to carry on business as an agent.
  3. Providing training to agents.
  4. Supervising or monitoring the activities of agents.
  5. Entering into written agreements with agents who sell or solicit life insurance or accident and sickness insurance.
  6. Recommending agents to insurers to sell or solicit life or accident and sickness insurance.
  7. Transmitting an insurance application or a policy of insurance between an insurer licensed for classes of life or accident and sickness insurance and an agent.
  8. Such other activities and functions as may be prescribed by FSRA rule.

MGAs will be required to establish and maintain a compliance system that is reasonably designed to ensure that the MGA and any of its sub-MGAs and agents comply with the requirements of the Act, its regulations and applicable FSRA rules.  They will also be required to appoint a designated compliance representative.   The Act will also require insurers to establish and maintain their own compliance systems which are designed to ensure that MGAs that have entered into an agreement with the insurer are complying with their requirements under the Act, its regulations and applicable FSRA rules.

Insurers will be required to notify FSRA within 30 days of entering into an agreement with an MGA, and provide FSRA with copies of all agreements that it enters into with MGAs, including any amendments. In the event than an agreement between and insurer and MGA is terminated, the insurer will also be required to notify FSRA within 30 days and provide FSRA with the reason for the termination.

The amendments give FSRA broad rule making power with respect to establishing standards of practice for MGAs, including record keeping requirements, eligibility requirements for MGAs’ compliance representatives, and requirements related to the compliance systems of MGAs and insurers.

The full text of Bill 216 and the amendments to the Act can be found at this link.   The amendments to the Act which will implement the new MGA licensing requirements, will come into force on a date to be named by proclamation of the Lieutenant Governor.   Based on information provided in a consultation paper that the Ontario Ministry of Finance published in July of this year, we anticipate that the new licence requirements will come into force sometime in 2026, following the publication of associated regulations and any related FSRA rules.

Alberta Superintendent of Insurance Issues Bulletin re Motor Vehicle Warranties and Protection Products

On October 18th, 2024, the Alberta Superintendent of Insurance (the “Superintendent“) published Interpretation Bulletin No. 05-2024, titled Motor vehicle warranty contracts, dealership loyalty programs and vehicle protection products (the “Bulletin“).

The Bulletin clarifies the Superintendent’s regulatory view of products commonly marketed by automobile dealerships in conjunction with the sale of motor vehicles. A link to the Bulletin is here – https://www.abcouncil.ab.ca/wp-content/uploads/2024/10/tbf-superintendent-of-insurance-2024-05-bulletin.pdf.

We note that the Superintendent made an announcement on October 21, 2024 regarding a revised bulletin, which has not yet been published on its website.

This follows the issuance by the British Columbia Financial Service Authority of Regulatory Statement No. 24-008 Product Warranty, Vehicle Warranty and Automobile Insurance (the “BC Regulatory Statement“) on April 25, 2024, which advised that the BC regulator considers vehicle warranties to be insurance, and accordingly, they may only be sold by licensed agents (unless an appropriate exemption exists under BC legislation). Unlike Alberta, BC does not have a restricted licensing regime applicable to the sale of these products. A link to the BC Regulatory Statement is here.

The Bulletin applies to three categories of products: (1) motor vehicle warranties, (2) motor vehicle dealership loyalty programs, and (3) motor vehicle protection products.

  1. Motor Vehicle Warranties

The Superintendent distinguishes between manufacturer warranties and third-party warranties. Warranties and extended warranties that are offered by the manufacturer (or a wholly-owned subsidiary) of the vehicle are not insurance and are instead subject to the provisions of the Consumer Protection Act (Alberta). However, the Superintendent states that if the coverage includes any risk, peril, damage or loss beyond those inherent deficiencies in the workmanship or materials arising from the production of the motor vehicle, such products are contracts of insurance.

On the other hand, where a motor vehicle warranty contract is issued by a person (e.g., automotive dealer) other than the motor vehicle manufacturer or its wholly-owned subsidiary, these products are contracts of insurance. There is an exception for warranty contracts issued by a person (e.g., automotive repairer) providing coverage solely for those inherent deficiencies in the workmanship arising from the person’s service or repairs of a motor vehicle, which are not considered insurance.

The Superintendent also confirms in the Bulletin that motor vehicle warranty insurance falls under the class “equipment warranty insurance” as defined in the Classes of Insurance Regulation, and is therefore included in the restricted insurance type “equipment warranty insurance” as defined by the Alberta Insurance Council in this specification from 2020.

  1. Motor Vehicle Dealership Loyalty Programs

The Superintendent describes dealership warranty programs as products where the price is typically described as a membership fee, and a dealership discount is provided to consumers on a future replacement motor vehicle should an event occur that results in damage or total loss of the original motor vehicle. Discount values can vary and are based on several factors including, but not limited to, the type of loss, the sale price of the original motor vehicle, and motor vehicle age at the time of purchase. Such products indemnify consumers for part of the cost of purchasing a replacement motor vehicle only on the happening of a certain risk or peril, such as theft or collision. Accordingly, these loyalty programs are insurance, and must be developed, sold, and underwritten in compliance with the Insurance Act (Alberta) (the Act). Debt waivers (commonly referred to as GAP insurance) remain not insurance. However other types of GAP Insurance are treated as insurance. GAP Insurance is defined by the Alberta Insurance Council in this specification from 2020.

  1. Motor Vehicle Protection Products

The Superintendent provides the following examples of vehicle protection products (which it defines as VPPs) that are considered insurance under the Act.

  • Deductible reimbursement and/or monetary credits given in the event of loss, damage, or theft of a motor vehicle;
  • Non-manufacturer tire and rim warranties providing for tire and rim replacement (warranties provided by the motor vehicle manufacturer for tires and rims included in the motor vehicle’s assembly are excluded and are not considered insurance).
  • Glass protection products promising to pay some or all of the cost of a windshield replacement;
  • Products intended to deter theft that include a promise to make a payment in the event of the theft and/or non-recovery of the motor vehicle (or part thereof), such as theft-deterrent etching or tagging and catalytic converter anti-theft devices, that include a promise to pay if the product fails;
  • Key fob replacement coverage; and
  • Payment for a motor vehicle rental provided in conjunction with a VPP that is insurance.

Roadside service plans, or motor vehicle service plans that provide solely for planned maintenance or routine service of a motor vehicle, or minor repairs that are routine to the ownership of a motor vehicle, are not contracts of insurance.

The Superintendent further clarifies that whether a service plan contract is considered insurance or not will depend on whether the service relates directly to wear and tear due to the use of the item as opposed to damage from an external risk such as collision or theft. If the service/repair provided is for reasonable and expected wear and tear, it is likely not insurance.

The key distinction between whether a product is considered insurance or not is whether the product pays an amount or provides something of value in the event of loss or damage resulting from a fortuitous event, rather than a defect in the quality of the product or reasonable wear and tear.

Penalties

Failure to comply with the requirements of the Act in Alberta may result in an administrative penalty of up to $25,000 for each contravention. A person convicted under section 786 of the Act may also be subject to a fine of up to $200,000 (and if of a continuing nature, each day or part of a day constitutes a separate offence).

If you have questions regarding the Bulletin and its application to your business practices, you can reach out to a member of our team.

 

RIBO Holds Town Hall re Mandatory Disclosures Guidance RIBO-002

The Registered Insurance Brokers of Ontario (“RIBO“) held a virtual town hall on Thursday, October 17 to clarify its expectations for disclosure set out in the new guidance Mandatory Disclosures Guidance RIBO-002 released in April 2024 (the “Guidance“), and to answer questions relating to the Guidance. A link to the Guidance is here.

Some key takeaways from the Guidance and the town hall are:

  • RIBO emphasized that mandatory disclosures must be made no later than at the time of the quote. This is a change from previous guidance which provided that disclosure must be at the point of sale.
  • Although Regulation 991: General requires disclosure in writing, verbal disclosure – if done correctly – can be more meaningful to consumers. If verbal disclosure is provided, the Guidance provides that brokers must follow up in writing to confirm the information that was disclosed.
  • A written follow-up can be made by sending PDF copies of the disclosures, or by including links to the documents in an email.
  • Any material change to compensation arrangements should be brought to consumers’ attention on an ongoing basis and at renewal. This can be done by sending links, provided that the broker highlights the relevant information in the email. A link by itself without any explanation or highlighting will be considered not sufficient by RIBO.
  • There is no requirement to obtain written confirmation from the client that they have received the disclosure. However, obtaining written confirmation may make sense and work within a broker’s internal processes and workflows.
  • The commission disclosure requirements apply to commissions received from MGAs as well as from insurers. Brokers must disclose commissions received from all markets, not only insurers. The presenters invited brokers to contact RIBO if they would like to see MGA specific disclosure guidance.

RIBO began enforcing the disclosure and record-keeping requirements set out in the Guidance as of October 1, 2024. Compliance will be enforced by RIBO through its spot-check program and by investigations. RIBO advised that records of disclosure that are difficult to locate or understand, or disclosure that is unclear or vague, will be treated as “non-compliant”.

A recording of the presentation and a copy of the slide deck will be posted on the RIBO site in the coming weeks.

If you have questions regarding the Guidance and its application to your business practices, you can reach out to a member of our team.

OSFI RELEASES DRAFT CULTURE AND BEHAVIOUR RISK GUIDELINE

On February 28, 2023, the Office of the Superintendent of Financial Institutions (OSFI) released a draft of its proposed Culture and Behaviour Risk Guideline.  The aim of this Guideline is to ensure that Federally Regulated Financial Institutions (FRFIs) are actively considering the implications of culture within their organizations, and how culture impacts behaviour and decision making.

In a letter that it sent to FRFIs and federally regulated pension plans in March 2022, OSFI had signalled its intent to focus more specifically on the impact that culture has on those organizations.  This follows a trend that has been developing globally, as financial institution regulators in several other countries have started to focus more intently on organization culture and the impact that it has on risk and decision making within financial institutions.

The draft Guideline states that OSFI expects FRFIs to:

  1. Define a desired culture and continuously develop and improve the culture to support their purpose, strategy, effective management of risks, and resilience; and
  2. Continuously evaluate and respond to behaviour risks that can affect the FRFI’s overall safety and soundness.

Culture is defined in the draft Guideline as “the commonly held values, mindsets, beliefs and assumptions that guide both what is important and how people should behave in an organization.”

The draft Guideline is described as principles-based and outcomes-focused in recognition that every FRFI’s culture is unique.  OSFI states that it expects FRFIs to design, govern and manage culture and behaviour in accordance with the FRFI’s size, nature, scope, complexity of operations, strategy, and risk profile.

The draft Guideline identifies three expected outcomes and related principles for FRFIs to attain and adopt in their sound management of culture and behaviour risks.  The three expected outcomes are:

Outcome 1:  Culture and behaviour are designed and governed through clear accountabilities and oversight.

Outcome 2:  Desired culture and expected behaviours are proactively promoted and reinforced.

Outcome 3: Risks emerging from behavioural patterns are identified and proactively managed.

The principles discussed in the draft Guideline emphasize the importance of ensuring that FRFIs define their desired culture to align with the purpose and strategy of the FRFI and create proper incentives to promote desired outcomes and behaviours.  They also emphasize the importance of identifying, monitoring, and managing risks which arise from behavioural patterns that do not align with the desired culture and expected behaviours.

OSFI has invited interested stakeholders to submit comments on the draft Guideline until May 31, 2023, and has indicated that the final Guideline will be issued by the end of 2023.  More information regarding the draft Guideline can be found by clicking here.

Alberta Reduces Regulatory Charges for Unlicensed Insurance

On May 31, 2022, the Alberta government passed Bill 16: Insurance Amendment Act, 2022.  Among other things, the amendments under this Act:

  • reduce the current regulatory charge for purchasing unlicensed insurance from 50% of the premium payable for unlicensed insurance to 10%;
  • reduce the 50% financial penalty for the late payment of all charges and tax on unlicensed insurance, to 10%; and
  • more closely align the Alberta Insurance Act with other Canadian jurisdictions.

The Superintendent of Insurance in Alberta has also recently issued an Interpretation Bulletin 07-2022 on unlicensed insurance in Alberta, which replaces Interpretation Bulletin 02-2017 and provides updated clarification on the requirements for disclosure of unlicensed insurance in accordance with the new amendments to the Alberta Insurance Act.

FSRA’s New Supervisory Framework for Life and Health Agents Means More Proactive Supervision

New Supervisory Framework

On March 29, 2022, the Financial Services Regulatory Authority of Ontario (“FSRA“) announced the launch of the first Life and Health Agent Supervisory Framework (the “Framework“). The Framework represents FSRA’s new, proactive approach to supervising the sale of life and health insurance and is the first ever supervision framework for life and health agents in Ontario. Click here for the full text of the Framework.

Before the launch of the Framework, FSRA and its predecessor’s approach to the supervision of life agents was reactive. Supervision and enforcement focused mainly on those agents who self-declared non-compliance or were in response to complaints against specific agents[1]. Now, FSRA has established a dedicated Life and Health Insurance Agent Unit (the “LAU“) which helped develop the Framework and, going forward, will be responsible for implementing and scaling the Framework, setting target examination volumes and integrating industry best practices into the Framework.

Has anything changed?

The regulatory requirements applicable to insurers and agents remain the same and the Framework does not change any of the legal or licensing requirements applicable to life and health agents under the Insurance Act (Ontario) (the “Act“), Regulation 347/04 (the “Regulation“), or the CCIR and CISRO’s Conduct of Insurance Business and Fair Treatment of Customers Guidance (the “FTC Guidance“). Nor does the Framework alter the insurer’s ultimate responsibility for oversight of agent conduct. The legislation and FSRA still require insurance companies “to ensure that agents comply with the Insurance Act, the regulations and agent licensing requirements” and that insurers “must complete due diligence when delegating functions to managing general agents, such as agent screening and oversight”[2]. What has changed is that FSRA is now taking a proactive approach to supervising and enforcing compliance with these requirements and has dedicated more resources to the supervision of the sale of life and health insurance.

Four Components of the Framework

The Framework sets out the processes and key supervisory components that FSRA will use and consists of the following four key components:

  1. Life agent risk profiling
  2. Life agent examinations
  3. Communications and enforcement actions
  4. Reporting

 

  1. Life Agent Risk Profiling

The agent profiling process will focus on agents with the highest risks. Higher risk agents will be identified using FSRA’s internal data captured through licensing applications, licensing renewals, consumer complaints, the submission of the Life Agent Reporting Form (“LARF“) by insurers, and life agent enforcement activity reported by other regulatory bodies across Canada[3].

  1. Life Agent Examinations

Once a life agent has been identified with a higher risk profile and is referred to LAU through agent licensing management or consumer complaints management, LAU will then begin an ad hoc examination of the identified agent. During the pilot, FSRA developed a six-step examination process which consisted of (i) notice of examination and questionnaire, (ii) review and assessment of questionnaire including confirmation of compliance processes for FINTRAC and applicable privacy and data security legislation, (iii) requesting client files, (iv) file review, (v) agent interview, and (vi) a report on the findings and escalation for review if appropriate.

Based on the results of the pilot, FSRA determined that these steps were an effective method for determining compliance. Please see Appendix A of the Framework for a detailed description of the ad hoc examination process. This examination process will be used to test and verify the agent’s compliance with the Act, the regulations and FTC Guidance.

  1. Communications and Enforcement

The communications and enforcement component of the Framework means FSRA’s communication with the agent upon completion of the examination. The communication component will be performed by way of a closing letter confirming the outcome of the examination. This closing letter will confirm whether there were any contraventions of the Act, regulations or the FTC Guidance, or any other contraventions of business practices that are beyond FSRA’s jurisdiction. If the LAU concludes there were contraventions of the Act, the regulations or the FTC Guidance, the closing letter will also state whether the contraventions will be escalated to FSRA’s Legal and Enforcement Unit or a Regulatory Discipline Officer for enforcement action.

  1. Reporting

The reporting component includes the publication of reports and industry notices. Such reports and notices are intended to contribute to public confidence in FSRA and the life insurance industry generally by promoting transparency, disclosing information and deterring deceptive or fraudulent conduct by life agents.

During the pilot, FSRA published its Second Annual LARF Report dated May 10, 2021. In the Framework, FSRA discloses the outcomes of the pilot to the industry and the public. FSRA also published two industry notices which provided notice to the industry of the outcomes of examinations where FSRA identified potential consumer harm. In one case, an agent had altered clients’ work and study visas during the application process. These alterations were discovered by the insurer during the underwriting process and the agent was immediately terminated. In the second notice, the agent was found to have terminated insurance policies soon after receiving commission and the examination revealed that the agent had engaged in this same activity with other managing general agencies over several years, using the same pool of clients each time. Both industry notices confirmed insurers’ existing obligations under the Regulation to maintain a compliance system and report agents who are not suitable.

Although FSRA has become more proactive in its supervision of agents’ conduct of business, FSRA still expects insurers to oversee and monitor agent and managing general agency conduct. In both industry notices, FSRA reminded life and health insurance companies of their role in ensuring agents comply with legal obligations and meet high business conduct standards.

Conclusion

Based on the outcomes of its pilot project, FSRA has concluded that life agents in Ontario need to improve their overall business practices and that the insurers who are obligated to monitor the intermediaries authorized to sell their products need to review their life agent compliance programs. As FSRA implements and scales the Framework, FSRA intends to consult with the industry on integrating best practices enforcement into the Framework in support of the fair treatment of customers. FSRA also plans to consult with its stakeholders about what examination volume would be considered reasonable and proportionate within the Ontario marketplace.

[1] See pages 29 and 121 of the International Monetary Fund’s Country Report No. 14/72 – Canada Financial Sector Assessment Program ,dated March 2014.

[2] See FSRA Industry Notice titled FSRA Requires Insurers to Monitor Agent Conduct dated February 17, 2021, for more information.

[3] In 2009, FSRA’s predecessor, the Financial Services Commission of Ontario and Québec’s Autorité des marches financier implemented a common web based system to harmonize complaint data reporting requirements across Canada, except for British Columbia.

Incentive Management Guidance related to Sale and Servicing of Insurance Products in Canada

On February 17, 2022, the Canadian Council of Insurance Regulators (“CCIR”) and the Canadian Insurance Services Regulatory Organizations (“CISRO”) released proposed guidance on incentive management related to the sale and servicing of insurance products (the “Proposed Guidance”).

The Proposed Guidance applies to insurers and intermediaries that pay compensation (monetary or non-monetary) and/or design incentive arrangements related to the sales and servicing of all insurance products, and provides CCIR’s and CISRO’s expectations with respect to the design and management of such arrangements.

The Proposed Guidance ensures that insurers and intermediaries develop incentive arrangements that achieve the fair treatments of customers and is intended to complement the joint guidance released by CCIR and CISRO in September 2018 (the “FCT Guidance”). The FCT Guidance sets out CCIR’s and CISRO’s expectations (to the extent of their respective authority) relating to the conduct of insurance business and fair treatment of actual and potential customers of insurance products.

The Proposed Guidance is described as being principles-based, providing insurers and intermediaries with the discretion to develop appropriate strategies, based on the nature, size and complexity of their business activities, that relate to governance, design and management of incentive arrangements, risks of unfair outcomes to customers and post-sale controls. Below is a summary of the objectives and principles set out in the Proposed Guidance.

  1. Governance

Objective – CCIR and CISRO expect insurers and intermediaries’ governance and business culture to place fair treatment of customers at the center of decisions concerning the way incentive arrangements are designed and managed.

Board and senior management have the ultimate responsibility to design, approve, implement, and monitor appropriate strategies, policies, procedures and controls that align with the overall risk appetite and culture of the organization, as it relates to incentive arrangements and fair treatment of customers.

Senior management should also consider working closely with risk management, compliance, legal and any other teams to determine any changes required to manage risks related to fair treatment of customers.

  1. Design and Management of Incentive Arrangements

Objective – CCIR and CISRO expect insurers and intermediaries to design and implement

incentive arrangements that include criteria ensuring fair treatment of customers.

Incentive arrangements should be designed in accordance with the following objectives:

  • be consistent with the level of service expected and provided throughout a product’s life cycle;
  • ensure that performance targets and criteria are clearly defined, measurable and are aligned to ensure fair treatment of customers; and
  • the cost of the product to the customer does not vary based on the distribution method.

The method and manner of implementation of incentive arrangements and the role that management plays in the process are equally important. In addition to managing potential conflicts of interest, management is also advised to take steps to identify and correct what it views as inappropriate practices against customers as a result of incentive arrangements.

  1. Risk of Unfair Outcomes to Customers

Objective – CCIR and CISRO expect insurers and intermediaries to regularly identify and assess the risks of unfair outcomes to customers that may arise from incentive arrangements so that either appropriate controls can be introduced, or the incentive arrangements can be adjusted.

Insurers and intermediaries are expected to review their incentive arrangements regularly and, if appropriate, consider changes to such arrangements that may result in unfair outcomes to customers.

  1. Post-sale Controls

Objective – CCIR and CISRO expect insurers and intermediaries to establish effective post-sale controls to identify inappropriate sales resulting from incentive arrangements.

Effective post-sale controls should enable insurers and intermediaries to determine whether there are any unsuitable sales resulting from specific incentive arrangements, to identify any significant risks in connection with the unfair outcome to customers and mitigate such risks, as necessary.

Examples of Incentive Arrangements that May Undermine Fair Treatment of Customers

The Proposed Guidance also includes an appendix which provides examples of incentive arrangements components which, without proper design, management and post-sale controls, may increase the risk of unfair outcomes for customers. Among others, CCIR and CISRO, identify the following examples of incentive arrangements that may raise concerns:

  • agreements between insurers and intermediaries incentivizing intermediaries’ conduct that could be inconsistent with fair treatment of customers;
  • bonus rates that increase with predetermined sales volumes;
  • excessive cross-selling incentives;
  • lifetime vesting of renewal commissions to intermediaries which can result in eventual client orphaning;
  • commissions linked to premium levels or investment amounts;
  • arrangements that create exit fees or penalties for customers;
  • performance criteria focused on meeting quantitative targets, which do not effectively align with interests of customers; and
  • chargeback mechanisms that may influence an intermediary to advise a customer to retain a product that does not meet the customer’s needs.

Interested parties are invited to submit comments related to the Proposed Guidance until April 4, 2022.

OSFI ISSUES FINAL REINSURANCE GUIDELINES

On February 11, 2022, the Office of the Superintendent of Financial Institutions (“OSFI“) issued final versions of its revised Guideline B-3 Sound Reinsurance Practices and Procedures (“New Guideline B-3“) and Guideline B-2 Property and Casualty Large Exposures and Investment Concentration (“New Guideline B-2“) (together, New Guideline B-3 and New Guideline B-2 are the “New Guidelines“), marking the completion of Phase II of OSFI’s review of reinsurance practices which began with the publication of its Reinsurance Framework Discussion Paper in 2018 (the “Discussion Paper”).

The New Guidelines will not be effective until January 2025 and the current in-force guideline B-3 that was published in December 2010 (“In-force Guideline B-3”) will remain effective until that time. OSFI plans to hold information sessions in the coming months to help federally regulated insurers (“FRIs“) better understand OSFI’s expectations under the New Guidelines.

The remaining Phase of OSFI’s review of reinsurance contemplates possible changes to the MCT and LICAT capital guidelines, though no firm dates or timing for such changes have been released to date.

NEW GUIDELINE B-3

The “key principles” established under In-force Guideline B-3 which apply to all FRIs are substantially the same as those set out in New Guideline B-3 and the changes are primarily clarifications and amplifications of OSFI’s existing expectations. Having said that, FRIs will still need to begin adjusting current actuarial and compliance processes to meet OSFI’s expectations for stress testing, due diligence and monitoring of reinsurance counterparties under New Guideline B-3.

A summary of the key clarifications and changes in New Guideline B-3 is set out below.

Managing risks through reinsurance versus risks from the use of reinsurance

  • Although the first key principle in New Guideline B-3 is the same as in the In-force Guideline B-3, New Guideline B-3 distinguishes between OSFI’s expectations for managing risks through reinsurance and managing the risks arising from the use of The scope of an FRI’s reinsurance risk management policy (“RRMP“) should be expanded to include the risks that arise out of the use of reinsurance itself.
  • OSFI expressly acknowledges that reinsurance may be used for purposes not directly linked to mitigation of an FRI’s risks and that OSFI will review reinsurance arrangements based on the risk impact to the FRI.
  • Specifically, OSFI clarifies that, where risks insured in Canada are ceded by a foreign FRI back to the foreign FRI’s home office through affiliated reinsurers, OSFI will generally not recognize or grant credit for that foreign FRI’s reinsurance arrangements.

Stress Testing

  • Under the first key principle, both In-force Guideline B-3 and New Guideline B-3 state that an assessment of the adequacy and effectiveness of an FRI’s reinsurance arrangements may require stress testing of exceptional but plausible scenarios to determine if reinsurance arrangements adequately mitigate losses in accordance with the FRI’s risk appetite.
  • However, New Guideline B-3 provides more clarity and detail concerning OSFI’s expectations for stress testing and assessing reinsurance counterparty risk, as follows:
    • stress testing to assess counterparty risk should be considered at an aggregate level (e.g., group of affiliated counterparties);
    • counterparty risk should be assessed from the perspective of both going-concern and gone-concern scenarios of its reinsurers;
    • the process for assessing counterparty risk should be consistent regardless of whether counterparties are affiliated or non-affiliated;
    • the FRI should consider its total exposure to a counterparty as part of its assessment of counterparty risks;
    • an FRI should establish appropriate counterparty concentration limits applicable to both individual counterparties and to groups of affiliated counterparties; and
    • FRIs must maintain a record of the stress testing performed on its reinsurance program and provide copies to OSFI upon request.

Due Diligence

  • Under the second key principle in New Guideline B-3, OSFI’s expectations of an FRI’s due diligence on its reinsurance counterparties are substantially the same as under In-force Guideline B-3, with the added qualification that the level of due diligence should be “sufficient”.
  • In addition to the level of due diligence being commensurate with the FRI’s aggregate exposure to a reinsurance counterparty, OSFI has clarified that it now expects the level of due diligence with respect to a reinsurance counterparty should not be any less thorough if the counterparty is an affiliate of the FRI

New expectations for clauses in reinsurance contracts

In-force Guideline B-3 modifies the language of the insolvency clauses set out under the fourth key principle that OSFI expects to see in all reinsurance contracts. OSFI still expects that FRIs ensure all reinsurance contracts contain an insolvency clause which requires the reinsurer to continue to make full payments to the FRI without any reduction resulting solely from the FRI’s insolvency. However, New Guideline B-3 adds that, where the reinsurer is within the same corporate group as the ceding FRI, OSFI expects the reinsurance contract to contain a clause stipulating that “all reinsurance receivables are to be paid directly to the FRI-cedant in Canada, or to a person acting for, or on behalf of, the FRI-cedant in Canada”. The effect is that, where the reinsurer is an affiliate of the ceding FRI, this clause would apply whether or not the FRI-cedant is solvent or insolvent.

NEW GUIDELINE B-2

In the Discussion Paper, OSFI indicated that OSFI’s concerns with the current reinsurance framework were more prominent in the property and casualty (“P&C“) sector and that, as a result of its review of the existing reinsurance framework, there may be important changes to prudential limits and restrictions and capital adequacy for P&C FRIs.

New Guideline B-2, which applies to P&C FRIs on an individual and a consolidated basis, sets out OSFI’s expectations for P&C FRIs with respect to: (i) the losses they could withstand from a single large insurance exposure; (ii) the failure of an individual unregistered insurance counterparty; and (iii) investment concentration. Please see below for a high-level summary of OSFI’s expectations set out in New Guideline B-2.

Gross Underwriting Limit Policy

In addition to having an RRMP that meets OSFI’s expectations set out in New Guideline B-3, P&C FRIs are expected to have a Gross Underwriting Limit Policy (“GUWP“) which should:

  • define what constitutes a “Single Insurance Exposure[1]” for each class of insurance;
  • establish limits by class of insurance regarding the level of gross insurance risk that the P&C FRI is willing to accept in respect of a maximum loss related to a Single Insurance Exposure; and
  • be reviewed by senior management at least once a year.

OSFI expects that the determination of the acceptable maximum loss on a Single Insurance Exposure should be made without regard to the probability of the loss event using approaches that are risk-based and forward-looking, and not solely based on past losses.

In New Guideline B-2, OSFI expects P&C FRIs to consider the following in determining its Single Insurance Exposure for each class of insurance:

Property The aggregated insurance exposures on in-force policies at a single location, including any exposures subject to the location.
Credit The aggregated insurance exposures on in-force policies to any one single buyer or group of connected buyers.
Surety The aggregated insurance exposures on in-force bonds to any one single contractor or group of connected contractors.
Title The aggregated insurance exposures on in-force policies related to the legal title for a single location.

 

P&C FRIs will also be expected to provide OSFI, at OSFI’s request, with all information with respect to their large Single Insurance Exposures. OSFI may also, at its discretion, advise a P&C FRI to use specific criteria or an approach to determine and measure its maximum loss on a Single Insurance Exposure.

Insurance Exposure Limit

The New Guideline B-2 also sets insurance exposure limits that apply to the direct business written by P&C FRIs and the assumed business from any affiliated company where that affiliated company is a P&C FRI and is a direct writer of that business. A P&C FRI’s Net Retention[2] plus its Largest Net Counterparty Unregistered Reinsurance Exposure[3] should not, at any time, exceed the following limits for a maximum loss on a Single Insurance Exposure:

Insurance Companies 1)     100 percent of a P&C FRI’s Total Capital Available[4] where any entity in the P&C FRI’s control chain is:

a)     a widely held company; and/or

b)     a regulated financial institution; or

2)     25 percent of Total Capital Available otherwise.

 

Foreign Branches 100% of Net Assets Available[5].

 

OSFI expects that the Largest Net Counterparty Unregistered Reinsurance Exposure to a given counterparty, or group of affiliated counterparties, should be measured on a gross and a net basis (i.e., both before and after the recognition of any eligible counterparty risk mitigation (CRM) technique, including by means of the use of excess collateral or letters of credit[6]).

Investment Concentration

New Guideline B-2 provides that a P&C FRIs investment in any one entity or group of affiliated companies should not exceed the following limit:

Insurance Companies 5% of the company’s assets
Foreign Branches 5% of the company’s assets in Canada

 

For Foreign Branches, “assets in Canada” means the total value of assets under the control of the Minister of Finance (vested in trust in Canada), as reported on the balance sheet of the regulatory return filed with OSFI. These limits should also consider other investments or commitments not shown on the FRI’s balance sheet, such as options, futures, forward contracts and unfunded portions of committed loans.

OSFI’S NEXT STEPS 

OSFI still expects Boards of Directors of all FRIs to apply the New Guidelines within the context of their supervisory and oversight obligations set out in OSFI’s Corporate Governance Guideline and all FRIs will be staying tuned for the feedback that comes from industry information sessions in the coming months. The publication of the New Guidelines brings Phase II of OSFI’s review of reinsurance practices to a conclusion and we will be staying tuned for any changes to the MCT or LICAT guidelines as part of Phase III.

Footnotes

[1] In Annex 1 of New Guideline B-2, OSFI permits FRIs to define “Single Insurance Exposure” for themselves, stating that: “P&C FRIs can define what constitutes a Single Insurance Exposure within their GUWP.

[2] This term is defined in New Guideline B-2 as follows: “The amount of insurance exposure which a P&C FRI retains net for its own account and does not pass on to another insurer (or reinsurer). Any reinstatement premiums should be included in the Net Retention value.”

[3] This term is defined in the New Guideline B-2 as follows: “The largest amount of ceded unregistered reinsurance on an insurance exposure provided by a (re)insurance group (e.g., Affiliated Company counterparties that are part of a (re)insurance group). This amount should be on a net basis; that is, after recognition of any eligible CRM technique.”

[4] This term is defined in New Guideline B-2 as follows: “For a P&C FRI that is a company, the consolidated total available capital of a company as defined for the purpose of calculating the Minimum Capital Test (MCT) / Mortgage Insurer Capital Adequacy Test (MICAT).”

[5] This term is defined in New Guideline B-2 as follows: “For a P&C FRI that is a foreign branch, the net assets available as defined for the purposes of calculating the Branch Adequacy of Assets Test (BAAT).”

[6] New Guideline B-2 states that: “The limit on the use of letters of credit for unregistered reinsurance with a given counterparty, or group of Affiliated Company counterparties, including any letters of credit that are part of excess collateral, is 30% and is measured against the value of the insurance exposure.”

 

OSFI Consultation on Draft Guideline B-13 – Technology and Cyber Risk Management

The Office of the Superintendent of Financial Institutions (“OSFI”) launched a three-month public consultation on Draft Guideline B‑13, Technology and Cyber Risk Management (the “Proposed Guideline”) on November 9, 2021, and is inviting comments on the Proposed Guideline until February 9, 2022.

The Proposed Guideline has been released as part of OSFI’s Strategic Plan 2019 – 2022 and puts into action some of the themes set out is OSFI’s discussion paper Developing Financial Sector Resilience in a Digital World, published in September 2020.

The Proposed Guideline sets out OSFI’s expectations for sound technology and cyber risk management across five domains and, once finalized, would apply to all federally regulated financial institutions (“FRFIs”). However, consistent with OSFI’s other guidance on outsourcing, risk management and incident reporting, OSFI recognizes that the application of its expectations should be commensurate with the size, nature, scope and complexity of operations and the risk profile of each FRFI.

The five domains of OSFI’s expectations, and their respective desired outcomes, are as follows:

Domains for Sound Management of Technology and Cyber Risk Outcomes
1. Governance and Risk Management Technology and cyber risks are governed through clear accountabilities and structures, and comprehensive strategies and frameworks
2. Technology Operations A technology environment that is stable, scalable and resilient. The environment be kept current and supported by robust and sustainable technology operating processes
3. Cyber Security A secure technology posture that maintains the confidentiality, integrity and availability of the FRFI’s technology assets
4. Third-Party Provider Technology and Cyber Risk Reliable and secure technology and cyber operations from third-party providers
5. Technology Resilience Technology services be delivered, as expected, through disruption

OSFI recommends that the Proposed Guideline be considered in conjunction with other OSFI guidance, as well as other guidance issued by other authorities applicable to the FRFI’s operating environment. OSFI references, in particular, the OSFI Guideline E-21 (Operational Risk Management), OSFI Guideline B-10 (Outsourcing), OSFI Cyber Security Self-Assessment Tool, OSFI Technology and Cyber Security Incident Reporting Advisory, alerts, advisories and other communications issued by the Canadian Centre for Cyber Security, and recognized frameworks and standards for technology operations and information security.

Each of the five domains contains related prescriptive principles which are reproduced below.  The Proposed Guideline contains further discussion related to each of these principles which expand on OSFI’s expectations for FRFIs in connection with meeting the requirements in each domain.

Domain 1 – Technology and Cyber Governance and Risk Management

Principle 1 – Accountability and Organizational Structure

Senior Management should assign responsibility for managing technology and cyber risks to senior officers. It should also ensure an appropriate organizational structure and adequate resourcing are in place for managing technology and cyber risks across the FRFI.

Principle 2 –Technology and Cyber Strategy

The FRFI should define, document, approve and implement a strategic technology and cyber plan(s). The plan(s) should align with the FRFI’s business strategy and set goals and objectives that are measurable and evolve with changes in the FRFI’s technology and cyber environment.

Principle 3 – Technology and Cyber Risk Management Framework

The FRFI should establish a technology and cyber risk management framework. The framework should set out a risk appetite for technology and cyber risks and define what processes and requirements the FRFI utilizes to identify, assess, manage, monitor and report on technology and cyber risks.

Domain 2 – Technology Operations

Principle 4 – Technology Architecture

The FRFI should implement a technology architecture framework with supporting processes to ensure solutions are built in line with business, technology and security requirements.

Principle 5 – Technology Asset Management

The FRFI should maintain an updated inventory of all technology assets supporting business processes or functions. The FRFI’s asset management process should address classification of assets to facilitate risk identification and assessment, record configurations to ensure asset integrity, provide for the safe disposal of assets at the end of their life cycle and monitor and manage technology currency.

Principle 6 – Technology Project Management

The FRFI should ensure that effective processes are in place to govern and manage technology projects, from initiation to closure, to ensure that project outcomes are aligned with business objectives and are achieved within the FRFI’s risk appetite.

Principle 7 – System Development Life Cycle

The FRFI should implement a System Development Life Cycle framework for the secure development, acquisition and maintenance of technology systems that perform as expected in support of business objectives.

Principle 8 – Change and Release Management

The FRFI should establish and implement a technology change and release management process and supporting documentation to ensure changes to technology assets are documented, assessed, tested, approved, implemented and verified in a controlled manner that ensures minimal disruption to the production environment.

Principle 9 – Patch Management

The FRFI should implement patch management processes to ensure controlled and timely application of patches across its technology environment to address vulnerabilities and flaws.

Principle 10 – Incident and Problem Management

The FRFI should effectively detect, log, manage, resolve, monitor and report on technology incidents and minimize their impacts.

Principle 11 – Technology Service Measurement and Monitoring

The FRFI should develop service and capacity standards and processes to monitor operational management of technology ensuring business needs are met.

Domain 3 – Cyber Security

Principle 12 – Identify

The FRFI should maintain a range of practices, capabilities, processes and tools to identify and assess cyber security for weaknesses that could be exploited by external and insider threat actors.

Principle 13 – Defend

The FRFI should design, implement and maintain multi-layer, preventive cyber security controls and measures to safeguard its technology assets.

Principle 14 – Detect

The FRFI should design, implement and maintain continuous security detection capabilities to enable monitoring, alerting, and enable forensic cyber security incident investigations.

Principle 15 – Respond, Recover and Learn

The FRFI should triage, respond to, contain, recover and learn from cyber security incidents impacting its technology assets, including incidents originating at third-party providers.

Domain 4 – Third-Party Provider Technology and Cyber Risk (TPP”)

Principle 16 – General

The FRFI should ensure that effective controls and processes are implemented to identify, assess, manage, monitor, report and mitigate technology and cyber risks throughout the TPP’s life cycle, from due diligence to termination/exit.

Domain 5 – Technology Resilience

Principle 17 – Disaster Recovery

The FRFI should establish and maintain an Enterprise Disaster Recovery Framework to support its ability to deliver technology services through disruption and operate within its risk tolerance.

Principle 18 – Testing of Disaster Recovery

The FRFI should perform scenario testing on disaster recovery capabilities to confirm its technology services operate as expected through disruption.

OSFI is inviting public comments on the Proposed Guideline which must be submitted by February 9, 2022.

OSFI is particularly interested in feedback on:

  • the clarity of OSFI’s expectations as set out in the Proposed Guideline;
  • the application of these expectations in relation with a financial institution’s size, nature, scope, and complexity of operations;
  • the balance between principles and prescriptiveness in OSFI’s expectations; and
  • any other suggestions that may contribute to OSFI’s mandate, while also allowing institutions to compete and take reasonable risks.

Contact Us