Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 139

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 4
Chunk 139
---
 are generally between 1% and 2% of annual premium written in the state. Some states also require licensed and admitted insurers to participate in various state residual market mechanisms whose goal is to provide affordability and availability of insurance to those clients who may not otherwise be able to obtain insurance, including, for example catastrophe insurance in high-risk areas. If losses exceed the funds, the pool is available to pay those losses. The pools have the ability to assess insurers to provide additional funds to the pool. The amounts of the assessment for each company are normally based upon the proportion of each insurer’s (and in some cases the insurer’s and its affiliates’) written premium for coverages similar to those provided by the pool, and are frequently uncapped.

Cybersecurity and Privacy Laws and Regulations. Federal and state laws and regulations require financial institutions, including insurers, to protect, among other things, the security and confidentiality of personally identifiable information and nonpublic personal information, to notify customers and other individuals about their policies and practices relating to their collection and disclosure of customer information and their practices relating to protecting the security and confidentiality of that information, and to notify regulators and consumers in the event of certain data breaches affecting personal information. Federal and state laws and regulations also regulate the ability of financial institutions to make telemarketing calls and to send unsolicited e-mail or fax messages to consumers and customers. The Gramm-Leach-Bliley Act (“ GLBA”) requires financial institutions to implement administrative, technical, and physical safeguards to ensure the confidentiality, integrity, security, and proper disposal of nonpublic personal information, as well as limitations on the re-disclosure and re-use of such information.

In 2017, cybersecurity rules took effect for financial institutions, insurers and certain other companies supervised by the New York Department of Financial Services (the “ NYDFS Cybersecurity Regulation”), such as AAIC, which is licensed in New York. The NYDFS Cybersecurity Regulation imposes significant regulatory requirements intended to protect the confidentiality, integrity and availability of information systems, and the information stored within, such as requirements regarding governance, incident planning, training, data management, system testing and regulator notification in the event of certain cybersecurity events. On November 1, 2023, NYDFS announced its adoption of the second amendment of the NYDFS Cybersecurity Regulation, which includes updated requirements related to: governance; controls to prevent unauthorized access to information systems, such as password controls and monitoring; risk and vulnerability assessment requirements; notification requirements; and cybersecurity training. We anticipate that the NYDFS will continue