Company: FRFXF
Filing Date: 2025-10-09
Form Type: F-10/A
Source: 0001104659-25-098335
Chunk: 84

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-10-09
Form: F-10/A
Chunk 84
---
 infrastructure sectors or subsectors, including the “financial services sector” (the “sector-based criterion”). CISA currently considers the insurance business to be included in “financial services” for purposes of designated critical infrastructure and Fairfax and/or certain insurance subsidiaries thereof may become subject to CIRCIA requirements — including reporting requirements.

For reporting purposes, the proposed regulations define a substantial cyber incident to include: (i) incidents that lead to the substantial loss of confidentiality, integrity, or availability of systems; (ii) serious impact on the safety and resiliency of operational systems and processes; (iii) disrupt the ability to engage in business operations or deliver services; or (iv) any unauthorized access to systems or nonpublic information that is facilitated or caused by a compromise of a third-party data hosting provider (e.g. cloud provider) or a supply chain compromise. The proposed regulations also establish record retention requirements for background material supporting the filing of the report. The proposed regulations would also give CISA power to subpoena companies it believes are not reporting a substantial cybersecurity incident or ransomware. If CISA believes a company is not appropriately responding to a subpoena, it could refer the matter to the

<div align='center'>51</div>

TABLE OF CONTENTS

Department of Justice. Although CIRCIA requires a final rule to be published within 18 months of the publication of the proposed rule (October 4, 2025), CISA announced on September 4, 2025 that it would delay the publication of the final rule to May 2026.

#### Regulation of Holding Company Systems
While insurance in the U.S. is regulated primarily on a legal-entity basis, the NAIC has increased its focus on risks presented by an insurer’s holding company system. In 2010, the NAIC adopted revisions to the Model Insurance Holding Company System Regulatory Act and the Insurance Holding Company System Model Regulation (together, the “

#### Revised Model Holding Company Act and Regulation
”) that include, among other amendments, a requirement for the ultimate controlling person of every insurer to file an enterprise risk report annually. “Enterprise risk” is defined as any activity, circumstance, event or series of events involving one or more affiliates of an insurer that, if not remedied promptly, is likely to have a material adverse effect upon the financial condition or liquidity of the insurer or its insurance holding company system as a whole. The Revised Model Holding Company Act and Regulation have been substantively adopted in each of our operating insurance subsidiaries’ domiciliary states.

In 2012