Company: AHL
Filing Date: 2025-04-29
Form Type: F-1/A
Source: 0001628280-25-020463
Chunk: 346

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-04-29
Form: F-1/A
Chunk 346
---
 will have regard to such companies’ compliance with the Insurance Act (in addition to compliance with the Companies Act) in its assessment of compliance with the economic substance requirements. For those Aspen entities subject to the ESA, we expect that the filings will continue to meet the ESA requirements.

#### Amendments to Insurance Code of Conduct
In August 2022, the BMA published various revisions to the Insurance Code of Conduct (the “Insurance Code”), which became effective on September 1, 2022. Aspen Group and Aspen Bermuda have been required to be compliant with the bulk of the amended Insurance Code since September 1, 2023. These revisions are intended to ensure that the Insurance Code remains aligned with international standards and able to address emerging issues. Overall, the amendments aim to improve and enhance the Insurance Code and its application, while at the same time, incorporating various housekeeping changes intended to simplify the document.

The BMA will continue to assess an insurer’s compliance with the Insurance Code based on the nature, scale and complexity of the insurer’s operations. The BMA does not prescribe the exact manner in which regulated insurers can demonstrate compliance with the Insurance Code and expects individual insurers to use their best judgment when determining what is proportional to their individual circumstances.

<div align='center'>233</div>

#### Privacy and Cyber Security Laws
PIPA regulates how any organization in Bermuda may use personal information. PIPA became fully operative on January 1, 2025 and applies to all of our Bermuda entities, including the Aspen Group, Aspen Bermuda and Peregrine. From this date, organizations in Bermuda are required to comply with a combination of principle-based and prescriptive rules for the use of personal information. Prescriptive rules for in scope organizations (i.e., those that use personal information, noting “use” is broadly defined) include a requirement to only use personal information where a legal condition applies, a requirement to appoint a data privacy officer, a requirement to provide all individuals with a privacy notice that must contain at a minimum certain required information and requirement to understand and comply with individual rights around access, rectification and erasure.

In addition, the Insurance Amendment Act of 2020 became operative in August 2020 and requires entities regulated by the BMA to provide notice to the BMA of certain cybersecurity events. As a result, the BMA’s Insurance Sector Operational Cyber Risk Management Code of Conduct (“Cyber Risk Code”), which includes a series of minimum and recommended cybersecurity standards, became effective on January 1, 2021. The Cyber Risk