Page 1 of 2 

BOARD OF GOVERNORS

OF THE

FEDERAL RESERVE SYSTEM

WASHINGTON, D.C. 20551 

 

DIVISION OF SUPERVISION AND 

REGULATION

SR 22-8 

September 27, 2022 

TO THE OFFICER IN CHARGE OF SUPERVISION AT EACH FEDERAL RESERVE

BANK AND INSTITUTIONS SUPERVISED BY THE FEDERAL RESERVE

SUBJECT: Framework for the Supervision of Insurance Organizations 

Applicability: This guidance applies to all supervised insurance organizations.1

The Federal Reserve is issuing the attached Framework for the Supervision of Insurance 

Organizations to describe its supervisory approach for supervised insurance organizations. The 

framework is designed to reflect the differences between banking and insurance. 

In summary, the guidance addresses: 

• Proportional application of supervisory guidance, resources, and activities: how 

supervised insurance organizations are categorized as either complex or noncomplex 

based on risk profile, how the application of supervisory guidance is risk-based, and how 

supervisory resources are assigned and supervisory activities are conducted. 

• Supervised insurance organization ratings: the ratings system applied to supervised 

insurance organizations, including the component ratings and rating definitions. 

• Incorporating the work of other supervisors: builds upon other guidance focused on 

the Federal Reserve’s work with other banking regulators and adds transparency 

describing how the work of state insurance regulators is incorporated. 

Reserve Banks are asked to distribute this guidance to supervised insurance organizations 

in their districts, as well as to appropriate supervisory staff. In addition, questions on the 

attached guidance may be sent via the Board’s public website.2

1

 In this letter, a “supervised insurance organization” is a depository institution holding company that is an 

insurance underwriting company, or that has over 25 percent of its consolidated assets held by insurance 

underwriting subsidiaries, or has been otherwise designated as a supervised insurance organization by Federal 

Reserve staff.

2 See http://www.federalreserve.gov/apps/contactus/feedback.aspx. 
Page 2 of 2 

Michael S. Gibson

Director

Division of Supervision and Regulation 

Partially Supersedes: 

• SR letter 12-17/CA letter 12-14, “Consolidated Supervision Framework for Large 

Financial Institutions”

Attachments: 

• Attachment A: Framework for the Supervision of Insurance Organizations 

• Attachment B: SIO Complexity Classification Work Program 

Cross-References: 

• SR letter 21-3/CA letter 21-1, “Supervisory Guidance on Board of Directors’ 

Effectiveness”

• SR letter 16-11, “Supervisory Guidance for Assessing Risk Management at Supervised 

Institutions with Total Consolidated Assets Less than $100 Billion” 

• SR letter 13-19/CA letter 13-21, “Guidance on Managing Outsourcing Risk” 

• SR letter 13-1/CA letter 13-1, “Supplemental Policy Statement on the Internal Audit 

Function and Its Outsourcing” 

• SR letter 11-7, “Guidance on Model Risk Management”

• SR letter 10-6, “Interagency Policy Statement on Funding and Liquidity Risk 

Management”

• SR letter 08-8/CA letter 08-11, “Compliance Risk Management and Oversight at Large 

Banking Organizations with Complex Compliance Profiles”

• SR letter 05-23/CA letter 05-10, “Interagency Guidance on Response Programs for 

Unauthorized Access to Customer Information and Customer Notice”

• SR letter 03-5, “Amended Interagency Guidance on the Internal Audit Function and its 

Outsourcing” 
Attachment A for SR letter 22-8 

Page 1 of 19

Framework for the Supervision of Insurance Organizations

This framework describes the Federal Reserve’s approach to consolidated supervision of 

supervised insurance organizations.1 The framework is designed specifically to account for the 

unique risks and business profiles of these firms resulting mainly from their insurance business. 

The framework consists of a risk-based approach to establishing supervisory expectations, 

assigning supervisory resources, and conducting supervisory activities; a supervisory rating 

system; and a description of how Federal Reserve examiners work with the state insurance 

regulators to limit supervisory duplication.

A. Proportionality – Supervisory Activities and Expectations

Consistent with the Federal Reserve’s approach to risk-based supervision, supervisory 

guidance is applied, and supervisory activities are conducted, in a manner that is proportionate to 

each firm’s individual risk profile. This begins by classifying each supervised insurance 

organization either as complex or noncomplex based on its risk profile and continues with a riskbased application of supervisory guidance and supervisory activities driven by a periodic risk 

assessment. The risk assessment drives planned supervisory activities and is communicated to 

the firm along with the supervisory plan for the upcoming cycle. Supervisory activities are

focused on resolving supervisory knowledge gaps, monitoring the safety and soundness of the 

firm, assessing the firm’s management of risks that could potentially impact its ability to act as a 

source of managerial and financial strength for its depository institution(s), and monitoring for 

potential systemic risk, if relevant. 

Complexity Classification and Supervised Activities

The Federal Reserve classifies each supervised insurance organization as either complex 

or noncomplex based on its risk profile. The classification serves as the basis for determining 

the level of supervisory resources dedicated to each firm, as well as the frequency and intensity 

of supervisory activities. 

Complex 

Complex firms have a higher level of risk and therefore require more supervisory 

attention and resources. Federal Reserve dedicated supervisory teams are assigned to execute 

approved supervisory plans led by a dedicated Central Point of Contact. The activities listed in 

the supervisory plans focus on understanding any risks that could threaten the safety and 

soundness of the consolidated organization or a firm’s ability to act as a source of strength for its 

subsidiary depository institution(s). These activities typically include continuous monitoring, 

targeted topical examinations, coordinated reviews, and an annual roll-up assessment resulting in 

ratings for the three rating components. The relevance of certain supervisory guidance may vary 

among complex firms based on each firm’s risk profile. Supervisory guidance targeted at 

1

 In this framework, a “supervised insurance organization” is a depository institution holding company that is an 

insurance underwriting company, or that has over 25 percent of its consolidated assets held by insurance 

underwriting subsidiaries, or has been otherwise designated as a supervised insurance organization by Federal 

Reserve staff. 
Attachment A for SR letter 22-8 

Page 2 of 19

smaller depository institution holding companies, for example, may be more relevant for 

complex supervised insurance organizations with limited inherent exposure to a certain risk. 

Noncomplex 

Noncomplex firms, due to their lower risk profile, require less supervisory oversight 

relative to complex firms. The supervisory activities for these firms occur primarily during a 

rating examination that occurs no less often than every other year and results in the three 

component ratings. The supervision of noncomplex firms relies more heavily on the reports and 

assessments of a firm’s other relevant supervisors, although these firms may also be subject to 

continuous monitoring, targeted topical examinations, and coordinated reviews as appropriate. 

The focus and types of supervisory activities for noncomplex firms are also set based on the risks 

of each firm.

Factors considered when classifying a supervised insurance organization as either 

complex or noncomplex include the absolute and relative size of its depository institution(s), its 

current supervisory and regulatory oversight (ratings and opinions of its supervisors, and the 

nature and extent of any unregulated and/or unsupervised activities), the breadth and nature of 

product and portfolio risks, the nature of its organizational structure, its quality and level of 

capital and liquidity, the materiality of any international exposure, and its interconnectedness 

with the broader financial system.

For supervised insurance organizations that are commencing Federal Reserve 

supervision, the classification as complex or noncomplex is done and communicated during the 

application phase after initial discussions with the firm. The firm’s risk profile, including the 

characteristics listed above, are evaluated by staff of the Board and relevant Reserve Bank before 

the complexity classification is assigned by Board staff. Large, well-established, and financially 

strong supervised insurance organizations with relatively small depository institutions can be 

classified as noncomplex if, in the opinion of Board staff, the corresponding level of supervisory 

oversight is sufficient to accomplish its objectives. Although the risk profile is the primary basis 

for assigning a classification, a firm is automatically classified as complex if its depository 

institution’s average assets exceed $100 billion. A firm may request that the Federal Reserve 

review its complexity classification if it has experienced a significant change to its risk profile. 

The focus, frequency, and intensity of supervisory activities are based on a risk 

assessment of the firm completed periodically by the supervisory team and will vary among 

firms within the same complexity classification. For each risk described in the Supervisory 

Expectations section below, the supervisory team assesses the firm’s inherent risks and its 

residual risk after considering the effectiveness of its management of the risk. The risk 

assessment and the supervisory activities that follow from it take into account the assessments 

made by and work performed by the firm’s other regulators. In certain instances, Federal 

Reserve examiners may be able to rely on a firm’s internal audit (if it is rated effective) or 

internal control functions in developing the risk assessment. 

Supervisory Expectations 

Supervised insurance organizations are required to operate in a safe and sound manner, to 

comply with all applicable laws and regulations, and to possess sufficient financial and 

operational strength to serve as a source of strength for their depository institution(s) through a 
Attachment A for SR letter 22-8 

Page 3 of 19

range of stressful yet plausible conditions. The governance and risk management practices 

necessary to accomplish these objectives will vary based on a firm’s specific risk profile, size, 

and complexity. Guidance describing supervisory expectations for safe and sound practices can 

be found in Supervision & Regulation (SR) letters published by the Board and other supervisory 

material. Supervisory guidance most relevant to a specific supervised insurance organization is 

driven by the risk profile of the firm. Federal Reserve examiners periodically reassess the firm’s 

risk profile and inform the firm if different supervisory guidance becomes more relevant as a 

result of a material change to its risk profile. 

Most supervisory guidance issued by the Board is intended specifically for institutions 

that are primarily engaged in banking activities. Examples of specific practices provided in these 

materials may differ from (or not be applicable to) the nonbanking operations of supervised 

insurance organizations, including for insurance operations. The Board recognizes that practices 

in nonbanking business lines can be different than those published in supervisory guidance 

without being considered unsafe or unsound. When making their assessment, Federal Reserve 

examiners work with supervised insurance organizations and other involved regulators, including 

state insurance regulators, to appropriately assess practices that may be different than those 

typically observed for banking operations. 

This section describes general safety and soundness expectations and how the Board has 

adapted its supervisory expectations to reflect the special characteristics of a supervised 

insurance organization. The section is organized using the three rating components – 

Governance and Controls, Capital Management, and Liquidity Management. 

Governance and Controls 

The Governance and Controls component rating is derived from an assessment of the 

effectiveness of a firm’s (1) board and senior management, and (2) independent risk management 

and controls. All firms are expected to align their strategic business objectives with their risk 

appetite and risk management capabilities; maintain effective and independent risk management 

and control functions including internal audit; promote compliance with laws and regulations; 

and remain a source of financial and managerial strength for their depository institution(s). 

When assessing governance and controls, Federal Reserve examiners consider a firm’s risk 

management capabilities relative to its risk exposure within the following areas: internal audit, 

credit risk, legal and compliance risk, market risk, model risk, and operational risk, including 

cybersecurity/information technology and third-party risk.

Governance & Controls expectations

• Despite differences in their business models and the products offered, insurance companies 

and banks are expected to have effective and sustainable systems of governance and controls 

to manage their respective risks. The governance and controls framework for a supervised 

insurance organization should: 

o Clearly define roles and responsibilities throughout the organization; 

o Include policies and procedures, limits, requirements for documenting decisions, and 

decision-making and accountability chains of command; and 

o Provide timely information about risk and corrective action for non-compliance or weak 

oversight, controls, and management. 
Attachment A for SR letter 22-8 

Page 4 of 19

• The Board expects the sophistication of the governance and controls framework to be 

commensurate with the size, complexity, and risk profile of the firm. As such, governance 

and controls expectations for complex firms will be higher than that for noncomplex firms 

but will also vary based on each firm’s risk profile. 

• The Board expects supervised insurance organizations to have a risk management and control 

framework that is commensurate with its structure, risk profile, complexity, activities, and 

size. For any chosen structure, the firm’s board is expected to have the capacity, expertise, 

and sufficient information to discharge risk oversight and governance responsibilities in a 

safe and sound manner. 

In assigning a rating for the Governance and Controls component, Federal Reserve 

examiners evaluate:

Board and Senior Management Effectiveness 

• The firm’s board is expected to exhibit certain attributes consistent with effectiveness, 

including: (i) setting a clear, aligned, and consistent direction regarding the firm’s strategy 

and risk appetite; (ii) directing senior management regarding board reporting; (iii) overseeing 

and holding senior management accountable; (iv) supporting the independence and stature of 

independent risk management and internal audit; and (v) maintaining a capable board and an 

effective governance structure. As the consolidated supervisor, the Board focuses on the 

board of the supervised insurance organization and its committees. Complex firms are 

expected to take into consideration the Board’s guidance on board of directors’ 

effectiveness.2 In assessing the effectiveness of a firm’s senior management, Federal 

Reserve examiners consider the extent to which senior management effectively and prudently 

manages the day-to-day operations of the firm and provides for ongoing resiliency; 

implements the firm’s strategy and risk appetite; identifies and manages risks; maintains an 

effective risk management framework and system of internal controls; and promotes prudent 

risk taking behaviors and business practices, including compliance with laws and regulations 

such as those related to consumer protection and the Bank Secrecy Act/Anti-Money 

Laundering and Office of Foreign Assets Control (BSA/AML and OFAC). Federal Reserve

examiners evaluate how the framework allows management to be responsible for and manage 

all risk types, including emerging risks, within the business lines. Examiners rely to the 

fullest extent possible on insurance and banking supervisors’ examination reports and 

information concerning risk and management in specific lines of business, including relying 

specifically on state insurance regulators to evaluate and assess how firms manage the 

pricing, underwriting, and reserving risk of their insurance operations. 

Independent Risk Management and Controls 

• In assessing a firm’s independent risk management and controls, Federal Reserve examiners 

consider the extent to which independent risk management effectively evaluates whether the 

firm’s risk appetite framework identifies and measures all of the firm’s material risks; 

establishes appropriate risk limits; and aggregates, assesses and reports on the firm’s risk 

2 See SR letter 21-3, “Supervisory Guidance on Board of Directors’ Effectiveness.”
Attachment A for SR letter 22-8 

Page 5 of 19

profile and positions. Additionally, the firm is expected to demonstrate that its internal 

controls are appropriate and tested for effectiveness and sustainability. 

• Internal Audit is an integral part of a supervised insurance organization’s internal control 

system and risk management structure. An effective internal audit function plays an essential 

role by providing an independent risk assessment and objective evaluation of all key 

governance, risk management, and internal control processes. Internal audit is expected to 

effectively and independently assess the firm’s risk management framework and internal 

control systems, and report findings to senior management and to the firm’s audit committee. 

Despite differences in business models, the Board expects the largest, most complex 

supervised insurance organizations to have internal audit practices in place that are similar to 

those at banking organizations and as such, no modification to existing guidance is required 

for these firms.3 At the same time, the Board recognizes that firms should have an internal 

audit function that is appropriate to their size, nature, and scope of activities. Therefore, for 

noncomplex firms, Federal Reserve examiners will consider the expectations in the insurance 

company’s domicile state’s Annual Financial Reporting Regulation (NAIC Model Audit 

Rule 205), or similar state regulation, to assess the effectiveness of a firm’s internal audit 

function. 

The principles of sound risk management described in the previous sections apply to the entire 

spectrum of risk management activities of a supervised insurance organization, including but not 

limited to:

• Credit risk arises from the possibility that a borrower or counterparty will fail to perform on 

an obligation. Fixed income securities, by far the largest asset class held by many insurance 

companies, is a large source of credit risk. This is unlike most banking organizations, where 

loans generally make up the largest portion of balance sheet assets. Life insurer investment 

portfolios in particular are generally characterized by longer duration holdings compared to 

those of banking organizations. Additionally, an insurance company’s reinsurance 

recoverables/receivables arising from the use of third-party reinsurance and participation in 

regulatory required risk-pooling arrangements expose the firm to additional counterparty 

credit risk. Federal Reserve examiners scope examination work based on a firm’s level of 

inherent credit risk. The level of inherent risk is determined by analyzing the composition, 

concentration, and quality of the consolidated investment portfolio; the level of a firm’s 

reinsurance recoverables, the credit quality of the individual reinsurers, and the amount of 

collateral held for reinsured risks; and credit exposures associated with derivatives, securities 

lending, or other activities that may also have off-balance sheet counterparty credit 

exposures. In determining the effectiveness of a firm’s management of its credit risk, Federal 

Reserve examiners rely, where possible, on the assessments made by other relevant 

supervisors for the depository institution(s) and the insurance company(ies). In its own 

assessment, the Federal Reserve will determine whether the board and senior management 

have established an appropriate credit risk governance framework consistent with the firm’s 

risk appetite; whether policies, procedures and limits are adequate and provide for ongoing 

monitoring, reporting and control of credit risk; the adequacy of management information 

3

 Regulatory guidance provided in SR letter 03-5, “Amended Interagency Guidance on the Internal Audit Function 

and its Outsourcing” and SR letter 13-1, “Supplemental Policy Statement on the Internal Audit Function and Its 

Outsourcing” are applicable to complex supervised insurance organizations. 
Attachment A for SR letter 22-8 

Page 6 of 19

systems as it relates to credit risk; and the sufficiency of internal audit and independent 

review coverage of credit risk exposure. 

• Market risk arises from exposures to losses as a result of underlying changes in, for example, 

interest rates, equity prices, foreign exchange rates, commodity prices, or real estate prices. 

Federal Reserve examiners scope examination work based on a firm’s level of inherent 

market risk exposure, which is normally driven by the primary business line(s) in which the 

firm is engaged as well as the structure of the investment portfolio. A firm may be exposed 

to inherent market risk due to its investment portfolio or as result of its product offerings, 

including variable and indexed life insurance and annuity products, or asset/wealth 

management business. While interest rate risk (IRR), a category of market risk, differs 

between insurance companies and banking organizations, the degree of IRR also differs 

based on the type of insurance products the firm offers. IRR is generally a small risk for U.S. 

property/casualty (P/C) whereas it can be a significant risk factor for life insurers with certain 

life and annuity products that are spread-based, longer in duration, may include embedded 

product guarantees, and can pose disintermediation risk. Equity market risk can be 

significant for life insurers that issue guarantees tied to equity markets, like variable annuity 

living benefits, and for P/C insurers with large common equity allocations in their investment 

portfolios. Generally foreign exchange and commodity risk is low for supervised insurance 

organizations but could be material for some complex firms. Firms are expected to have 

sound risk management infrastructure that adequately identifies, measures, monitors, and 

controls any material or significant forms of market risks to which it is exposed.

• Model risk is the potential for adverse consequences from decisions based on incorrect or 

misused model outputs and reports. Model risk can lead to financial loss, poor business and 

strategic decision-making, or damage to a firm’s reputation. Supervised insurance 

organizations are often heavily reliant on models for product pricing and reserving, risk and 

capital management, strategic planning and other decision-making purposes. A sound model 

risk management framework helps manage this risk.4

 Federal Reserve examiners take into 

account the firm’s size, nature, and complexity, as well as the extent of use and sophistication 

of its models when assessing its model risk management program. Examiners focus on the 

governance framework, policies and controls, and enterprise model risk management through 

a holistic evaluation of the firm’s practices. The Federal Reserve’s review of a firm’s model 

risk management program complements the work of the firm’s other relevant supervisors. A 

sound model risk management framework includes three main elements: (1) an accurate 

model inventory and an appropriate approach to model development, implementation, and 

use; (2) effective model validation and continuous model performance monitoring; and (3) a 

strong governance framework that provides explicit support and structure for model risk 

management through policies defining relevant activities, procedures that implement those 

policies, allocation of resources, and mechanisms for evaluating whether policies and 

procedures are being carried out as specified, including internal audit review. The Federal 

Reserve relies on work already conducted by other relevant supervisors and appropriately 

collaborates with state insurance regulators on their findings related to insurance models. 

With respect to insurance models, the Federal Reserve recognizes the important role played 

4

 SR letter 11-7, “Guidance on Model Risk Management” is applicable to all supervised insurance organizations. 
Attachment A for SR letter 22-8 

Page 7 of 19

by actuaries as described in actuarial standards of practice on model risk management. With 

respect to the business of insurance, Federal Reserve examiners focus on the firm’s 

adherence to its own policies and procedures and the comprehensiveness of model validation 

rather than technical specifications such as the appropriateness of the model, its assumptions, 

or output. Federal Reserve examiners may request that firms provide model documentation 

or model validation reports for insurance and bank models when performing transaction 

testing. 

• Legal risk arises from the potential that unenforceable contracts, lawsuits, or adverse 

judgments can disrupt or otherwise negatively affect the operations or financial condition of 

a supervised insurance organization. 

• Compliance risk is the risk of regulatory sanctions, fines, penalties, or losses resulting from 

failure to comply with laws, rules, regulations, or other supervisory requirements applicable 

to a firm. By offering multiple financial service products that may include insurance, 

annuity, banking, services provided by securities broker-dealers, and asset and wealth 

management products, provided through a diverse distribution network, supervised insurance 

organizations are inherently exposed to a significant amount of legal and compliance risk. 

As the consolidated supervisor, the Board expects firms to have an enterprise-wide legal and 

compliance risk management program that covers all business lines, legal entities, and 

jurisdictions of operation. Firms are expected to have compliance risk management 

governance, oversight, monitoring, testing, and reporting commensurate with their size and 

complexity, and to ensure compliance with all applicable laws and regulations. The 

principles-based guidance in existing SR letters related to legal and compliance risk is 

applicable to supervised insurance organizations.5

 For both complex and noncomplex firms, 

Federal Reserve examiners rely on the work of the firm’s other supervisors. As described in 

section C, Incorporating the Work of Other Supervisors, the assessments, examination 

results, ratings, supervisory issues, and enforcement actions from other supervisors will be 

incorporated into a consolidated assessment of the enterprise-wide legal and compliance risk 

management framework.

o Money laundering, terrorist financing and other illicit financial activity risk is the risk of 

providing criminals access to the legitimate financial system and thereby being used to 

facilitate financial crime. This financial crime includes laundering criminal proceeds, 

financing terrorism, and conducting other illegal activities. Money laundering and 

terrorist financing risk is associated with a financial institution’s products, services, 

customers, and geographic locations. This and other illicit financial activity risks can 

impact a firm across business lines, legal entities, and jurisdictions. A reasonably 

designed compliance program generally includes a structure and oversight that mitigates 

these risks and supports regulatory compliance with both BSA/AML OFAC 

requirements. Although OFAC regulations are not part of the BSA, OFAC compliance 

programs are frequently assessed in conjunction with BSA/AML. Supervised insurance 

5

 SR letter 08-8, “Compliance Risk Management Programs and Oversight at Large Banking Organizations with 

Complex Compliance Profiles” is applicable to complex supervised insurance organizations. For noncomplex firms, 

the Federal Reserve will assess legal and compliance risk management based on the guidance in SR letter 16-11, 

“Supervisory Guidance for Assessing Risk Management at Supervised Institutions with Total Consolidated Assets 

Less than $100 Billion.” 
Attachment A for SR letter 22-8 

Page 8 of 19

organizations are not defined as financial institutions under the BSA and, therefore, are 

not required to have an AML program, unless the firm is directly selling certain insurance 

products. However, certain subsidiaries and affiliates of supervised insurance 

organizations, such as insurance companies and banks, are defined as financial 

institutions under 31 U.S.C. 5312(a)(2) and must develop and implement a written 

BSA/AML compliance program as well as comply with other BSA regulatory 

requirements. Unlike banks, insurance companies’ BSA/AML obligations are limited to 

certain products, referred to as covered insurance products.6 The volume of covered 

products, which the Financial Crimes Enforcement Network (FinCEN) has determined to 

be of higher risk, is an important driver of supervisory focus. In addition, as U.S. 

persons, all supervised insurance organizations (including their subsidiaries and affiliates) 

are subject to OFAC regulations. Federal Reserve examiners assess all material risks that 

each firm faces, extending to whether business activities across the consolidated 

organization, including within its individual subsidiaries or affiliates, comply with the 

legal requirements of BSA and OFAC regulations. In keeping with the principles of a 

risk-based framework and proportionality, Federal Reserve supervision for BSA/AML 

and OFAC primarily focuses on oversight of compliance programs at a consolidated level 

and relies on work by other relevant supervisors to the fullest extent possible. In the 

evaluation of a firm’s risks and BSA/AML and OFAC compliance program, however, it 

may be necessary for examiners to review compliance with BSA/AML and OFAC 

requirements at individual subsidiaries or affiliates in order to fully assess the material 

risks of the supervised insurance organization. 

• Operational risk is the risk of loss resulting from inadequate or failed internal processes, 

people, and systems, or from external events. Operational resilience is the ability to maintain 

operations, including critical operations and core business lines, through a disruption from 

any hazard. It is the outcome of effective operational risk management combined with 

sufficient financial and operational resources to prepare, adapt, withstand, and recover from 

disruptions. A firm that operates in a safe and sound manner is able to identify threats, 

respond and adapt to incidents, and recover and learn from such threats and incidents so that 

it can prioritize and maintain critical operations and core business lines, along with other 

operations, services and functions identified by the firm, through a disruption. 

o Cybersecurity/information technology risks are a subset of operational risk and arise 

from operations of a firm requiring a strong and robust internal control system and risk 

management oversight structure. Information Technology (IT) and Cybersecurity 

(Cyber) functions are especially critical to a firm’s operations. Examiners of financial 

institutions, including supervised insurance organizations, utilize the detailed guidance on 

mitigating these risks in the Federal Financial Institutions Examination Council’s 

6

 “Covered products” means a permanent life insurance policy, other than a group life insurance policy; an annuity 

contract, other than a group annuity contract; or any other insurance product with features of cash value or 

investment. 31 CFR 1025.100(b). “Permanent life insurance policy” means an agreement that contains a cash value 

or investment element and that obligates the insurer to indemnify or to confer a benefit upon the insured or 

beneficiary to the agreement contingent upon the death of the insured. 31 CFR 1025.100(h). “Annuity contract” 

means any agreement between the insurer and the contract owner whereby the insurer promises to pay out a fixed or 

variable income stream for a period of time. 31 CFR 1025.100(a). 
Attachment A for SR letter 22-8 

Page 9 of 19

(FFIEC) IT Handbooks. In assessing IT/Cyber risks, Federal Reserve examiners assess 

each firm’s: 

 Board and senior management for effective oversight and support of IT management; 

 Information/cyber security program for strong board and senior management support, 

integration of security activities and controls through business processes, and 

establishment of clear accountability for security responsibilities; 

 IT operations for sufficient personnel, system capacity and availability, and storage 

capacity adequacy to achieve strategic objectives and appropriate solutions; 

 Development and acquisition processes’ ability to identify, acquire, develop, install, and 

maintain effective IT to support business operations; and 

 Appropriate business continuity management processes to effectively oversee and 

implement resilience, continuity, and response capabilities to safeguard employees, 

customers, assets, products, and services. 

Complex and noncomplex firms are assessed in these areas. All supervised insurance 

organizations are required to notify the Federal Reserve of any computer-security 

notification incidents.

7

o Third party risk is also a subset of operational risk and arises from a firm’s use of service 

providers to perform operational or service functions. These risks may be inherent to the 

outsourced activity or be introduced with the involvement of the service provider. When 

assessing effective third party risk management, Federal Reserve examiners evaluate 

eight areas: 1) third party risk management governance, 2) risk assessment framework, 3) 

due diligence in the selection of a service provider, 4) a review of any incentive 

compensation embedded in a service provider contract, 5) management of any contract or 

legal issues arising from third party agreements, 6) ongoing monitoring and reporting of 

third parties, 7) business continuity and contingency of the third party for any service 

disruptions, and 8) effective internal audit program to assess the risk and controls of the 

firm’s third party risk management program.8

Capital Management 

The Capital Management rating is derived from an assessment of a firm’s current and 

stressed level of capitalization, and the quality of its capital planning and internal stress testing. 

A capital management program should be commensurate with a supervised insurance 

organization’s complexity and risk profile. In assigning this rating, the Federal Reserve 

examiners evaluate the extent to which a firm maintains sound capital planning practices through 

effective governance and oversight, effective risk management and controls, maintenance of 

updated capital policies and contingency plans for addressing potential shortfalls, and 

incorporation of appropriately stressful conditions into capital planning and projections of capital 

positions. The extent to which a firm’s capital is sufficient to comply with regulatory 

7

 SR letter 22-4, “Contact Information in Relation to Computer-Security Incident Notification Requirements”

applies to all supervised insurance organizations.

8

 SR letter 13-19, “Guidance on Managing Outsourcing Risk” applies to all supervised insurance organizations. 
Attachment A for SR letter 22-8 

Page 10 of 19

requirements, to support the firm’s ability to meet its obligations, and to enable the firm to 

remain a source of strength to its depository institution(s) in a range of stressful, but plausible, 

economic and financial environments is also evaluated. 

Insurance company balance sheets are typically quite different from those of most 

banking organizations. For life insurance companies, investment strategies may focus on cash 

flow matching to reduce interest rate risk and provide liquidity to support their liabilities, while 

for traditional banks, deposits (liabilities) are attracted to support investment strategies. 

Additionally, for insurers, capital provides a buffer for policyholder claims and creditor 

obligations, helping the firm absorb adverse deviations in expected claims experience, and other 

drivers of economic loss. The Board recognizes that the capital needs for insurance activities are 

materially different from those of banking activities and can be different between life and 

property and casualty insurers. Insurers may also face capital fungibility constraints not faced by 

banking organizations. 

In assessing a supervised insurance organization’s capital management, the Federal 

Reserve relies to the fullest extent possible on information provided by state insurance 

regulators, including the firm’s own risk and solvency assessment (ORSA) and the state 

insurance regulator’s written assessment of the ORSA. An ORSA is an internal process 

undertaken by an insurance group to assess the adequacy of its risk management and current and 

prospective capital position under normal and stress scenarios. As part of the ORSA, insurance 

groups are required to analyze all reasonably foreseeable and relevant material risks that could 

have an impact on their ability to meet obligations. 

The Board expects supervised insurance organizations to have sound governance over 

their capital planning process. A firm should establish capital goals that are approved by the 

board of directors, and that reflect the potential impact of legal and/or regulatory restrictions on 

the transfer of capital between legal entities. In general, senior management should establish the 

capital planning process, which should be reviewed and approved periodically by the board. The 

board should require senior management to provide clear, accurate, and timely information on 

the firm’s material risks and exposures to inform board decisions on capital adequacy and 

actions. The capital planning process should clearly reflect the difference between the risk 

profiles and associated capital needs of the insurance and banking businesses. 

A firm should have a risk management framework that appropriately identifies, measures, 

and assesses material risks and provides a strong foundation for capital planning. This 

framework should be supported by comprehensive policies and procedures, clear and wellestablished roles and responsibilities, strong internal controls, and effective reporting to senior 

management and the board. In addition, the risk management framework should be built upon 

sound management information systems. 

As part of capital management, a firm should have a sound internal control framework 

that helps ensure that all aspects of the capital planning process are functioning as designed and 

result in an accurate assessment of the firm’s capital needs. The internal control framework 

should be independently evaluated periodically by the firm’s internal audit function. 

The governance and oversight framework should include an assessment of the principles 

and guidelines used for capital planning, issuance, and usage, including internal post-stress 

capital goals and targeted capital levels; guidelines for dividend payments and stock repurchases; 
Attachment A for SR letter 22-8 

Page 11 of 19

strategies for addressing capital shortfalls; and internal governance responsibilities and 

procedures for the capital policy. The capital policy should reflect the capital needs of the 

insurance and banking businesses based on their risks, be approved by the firm’s board of 

directors or a designated committee of the board, and be re-evaluated periodically and revised as 

necessary. 

A strong capital management program will incorporate appropriately stressful conditions 

and events that could adversely affect the firm’s capital adequacy and capital planning. As part 

of its capital plan, a firm should use at least one scenario that stresses the specific vulnerabilities 

of the firm’s activities and associated risks, including those related to the firm’s insurance 

activities and its banking activities.

Supervised insurance organizations should employ estimation approaches to project the 

impact on capital positions of various types of stressful conditions and events, and that are 

independently validated. A firm should estimate losses, revenues, expenses, and capital using 

sound methods that incorporate macroeconomic and other risk drivers. The robustness of a firm’s 

capital stress testing processes should be commensurate with its risk profile. 

Liquidity Management 

The Liquidity Management rating is derived from an assessment of the supervised 

insurance organization’s liquidity position and the quality of its liquidity risk management 

program. Each firm’s liquidity risk management program should be commensurate with its 

complexity and risk profile. 

The Board recognizes that supervised insurance organizations are typically less exposed 

to traditional liquidity risk than banking organizations. Instead of cash outflows being mainly 

the result of discretionary withdrawals, cash outflows for many insurance products only result 

from the occurrence of an insured event. Insurance products, like annuities, that are potentially 

exposed to call risk generally have product features (i.e., surrender charges, market value 

surrenders, tax treatment, etc.) that help mitigate liquidity risk. 

Federal Reserve examiners tailor the application of existing supervisory guidance on 

liquidity risk management to reflect the liquidity characteristics of supervised insurance 

organizations. 9

 For example, guidance on intra-day liquidity management would only be 

applicable for supervised insurance organizations with material intra-day liquidity risks. 

Additionally, specific references to liquid assets may be more broadly interpreted to include 

other asset classes such as certain investment-grade corporate bonds. 

The scope of the Federal Reserve’s supervisory activities on liquidity risk is influenced 

by each firm’s individual risk profile. Traditional property and casualty insurance products are 

typically short duration liabilities backed by short-duration, liquid assets. Because of this, they 

typically present lower liquidity risk than traditional banking activities. However, some nontraditional life insurance and retirement products create liquidity risk through features that allow 

payments at the request of policyholders without the occurrence of an insured event. Risks of 

certain other insurance products are often mitigated using derivatives. Any differences between 

collateral requirements related to hedging and the related liability cash flows can also create 

9 See SR letter 10-6, “Interagency Policy Statement on Funding and Liquidity Risk Management.”
Attachment A for SR letter 22-8 

Page 12 of 19

liquidity risk. The Board expects firms significantly engaged in these types of insurance 

activities to have correspondingly more sophisticated liquidity risk management programs. 

A strong liquidity risk management program includes cash flow forecasting with 

appropriate granularity. The firm’s suite of quantitative metrics should effectively inform senior 

management and the board of directors of the firm’s liquidity risk profile and identify liquidity 

events or stresses that could detrimentally affect the firm. The metrics used to measure a firm’s 

liquidity position may vary by type of business. 

Federal Reserve examiners rely to the fullest extent possible on each firm’s ORSA, which 

requires all firms to include a discussion of the risk management framework and assessment of 

material risks, including liquidity risk. 

Supervised insurance organizations are expected to perform liquidity stress testing at 

least annually and more frequently, if necessary, based on their risk profile. The scenarios used 

should reflect the firm’s specific risk profile and include both idiosyncratic and system-wide 

stress events. Stress testing should inform the firm on the amount of liquid assets necessary to 

meet net cash outflows over relevant time periods, including at least a one-year time horizon. 

Firms should hold a liquidity buffer comprised of highly liquid assets to meet stressed net cash 

outflows. The liquidity buffer should be measured using appropriate haircuts based on asset 

quality, duration, and expected market illiquidity based on the stress scenario assumptions. 

Stress testing should reflect the expected impact on collateral requirements. For material life 

insurance operations, Federal Reserve examiners will rely to the greatest extent possible on 

information submitted by the firm to comply with the National Association of Insurance 

Commissioners’ (NAIC) liquidity stress test framework.

The fungibility of sources of liquidity is often limited between an insurance group’s legal 

entities. Large insurance groups can operate with a significant number of legal entities and many 

different regulatory and operational barriers to transferring funds among them. Regulations 

designed to protect policyholders of insurance operating companies can limit the transferability 

of funds from an insurance company to other legal entities within the group, including to other 

insurance operating companies. Supervised insurance organizations should carefully consider 

these limitations in their stress testing and liquidity risk management framework. Effective 

liquidity stress testing should include stress testing at the legal entity level with consideration for 

intercompany liquidity fungibility. Furthermore, the firm should be able to measure and provide 

an assessment of liquidity at the top-tier depository institution holding company in a manner that 

incorporates fungibility constraints. 

The enterprise-wide governance and oversight framework should be consistent with the 

firm’s liquidity risk profile and include policies and procedures on liquidity risk management. 

The firm’s policies and procedures should describe its liquidity risk reporting, stress testing, and 

contingency funding plan. 

B. Supervisory Ratings 

Supervised insurance organizations are expected to operate in a safe and sound manner, 

to comply with all applicable laws and regulations, and to possess sufficient financial and 

operational strength to serve as a source of strength for their depository institution(s) through a 

range of stressful yet plausible conditions. Supervisory ratings and supervisory findings are used 
Attachment A for SR letter 22-8 

Page 13 of 19

to communicate the assessment of a firm. Federal Reserve examiners periodically assign one of 

four ratings to each of the three rating components used to assess supervised insurance 

organizations. The rating components are Capital Management, Liquidity Management, and 

Governance & Controls. The four potential ratings are Broadly Meets Expectations, 

Conditionally Meets Expectations, Deficient-1, and Deficient-2. To be considered “well 

managed,” a firm must receive a rating of Conditionally Meets Expectations or better in each of 

the three rating components. Each rating is defined specifically for supervised insurance 

organizations with particular emphasis on the obligation that firms serve as a source of financial 

and managerial strength for their depository institution(s). High-level definitions for each rating 

are below, followed by more specific rating definitions for each component. 

Broadly Meets Expectations. The supervised insurance organization’s practices and capabilities 

broadly meet supervisory expectations. The holding company effectively serves as a source of 

managerial and financial strength for its depository institution(s) and possesses sufficient 

financial and operational strength and resilience to maintain safe-and-sound operations through a 

range of stressful yet plausible conditions. The firm may have outstanding supervisory issues 

requiring corrective actions, but these are unlikely to present a threat to its ability to maintain 

safe-and-sound operations and unlikely to negatively impact its ability to fulfill its obligation to 

serve as a source of strength for its depository institution(s). These issues are also expected to be 

corrected on a timely basis during the normal course of business. 

Conditionally Meets Expectations. The supervised insurance organization’s practices and 

capabilities are generally considered sound. However, certain supervisory issues are sufficiently 

material that if not resolved in a timely manner during the normal course of business, may put 

the firm’s prospects for remaining safe and sound, and/or the holding company’s ability to serve 

as a source of managerial and financial strength for its depository institution(s), at risk. A firm

with a Conditionally Meets Expectations rating has the ability, resources, and management 

capacity to resolve its issues and has developed a sound plan to address the issue(s) in a timely 

manner. Examiners will work with the firm to develop an appropriate timeframe during which it 

will be required to resolve that supervisory issue(s) leading to this rating. 

Deficient-1. Financial or operational deficiencies in a supervised insurance organization’s 

practices or capabilities put its prospects for remaining safe and sound, and/or the holding 

company’s ability to serve as a source of managerial and financial strength for its depository 

institution(s), at significant risk. The firm is unable to remediate these deficiencies in the normal 

course of business, and remediation would typically require it to make material changes to its 

business model or financial profile, or its practices or capabilities. A firm with a Deficient-1 

rating is required to take timely action to correct financial or operational deficiencies and to 

restore and maintain its safety and soundness and compliance with laws and regulations. 

Supervisory issues that place the firm’s safety and soundness at significant risk, and where 

resolution is likely to require steps that clearly go beyond the normal course of business – such 

as issues requiring a material change to the firm’s business model or financial profile, or its 

governance, risk management or internal control structures or practices – would generally 

warrant assignment of a Deficient-1 rating. There is a strong presumption that a firm with a 

Deficient-1 rating will be subject to an enforcement action. 

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s 

practices or capabilities present a threat to its safety and soundness, have already put it in an 
Attachment A for SR letter 22-8 

Page 14 of 19

unsafe and unsound condition, and/or make it unlikely that the holding company will be able to 

serve as a source of financial and managerial strength to its depository institution(s). A firm with 

a Deficient-2 rating is required to immediately implement comprehensive corrective measures 

and demonstrate the sufficiency of contingency planning in the event of further deterioration. 

There is a strong presumption that a firm with a Deficient-2 rating will be subject to a formal 

enforcement action.

Definitions for the Governance and Controls Component Rating

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues, 

the supervised insurance organization’s governance and controls broadly meet supervisory 

expectations, supports maintenance of safe-and-sound operations, and supports the holding 

company’s ability to serve as a source of financial and managerial strength for its depository 

institutions(s). Specifically, the firm’s practices and capabilities are sufficient to align strategic 

business objectives with its risk appetite and risk management capabilities; maintain effective 

and independent risk management and control functions, including internal audit; promote 

compliance with laws and regulations; and otherwise provide for the firm’s ongoing financial 

and operational resiliency through a range of conditions. The firm’s governance and controls 

clearly reflect the holding company’s obligation to act as a source of financial and managerial 

strength for its depository institution(s).

Conditionally Meets Expectations. Certain material financial or operational weaknesses in a 

supervised insurance organization’s governance and controls practices may place the firm’s 

prospects for remaining safe and sound through a range of conditions at risk if not resolved in a 

timely manner during the normal course of business. Specifically, if left unresolved, these 

weaknesses may threaten the firm’s ability to align strategic business objectives with its risk 

appetite and risk-management capabilities; maintain effective and independent risk management 

and control functions, including internal audit; promote compliance with laws and regulations; or 

otherwise provide for the firm’s ongoing resiliency through a range of conditions. Supervisory 

issues may exist related to the firm’s internal audit function, but internal audit is still regarded as 

effective.

Deficient-1. Deficiencies in a supervised insurance organization’s governance and controls put 

its prospects for remaining safe and sound through a range of conditions at significant risk. The 

firm is unable to remediate these deficiencies in the normal course of business, and remediation 

would typically require a material change to the firm’s business model or financial profile, or its 

governance, risk management or internal control structures or practices. 

Examples of issues that may result in a Deficient-1 rating include, but are not limited to: 

• The firm may be currently subject to, or expected to be subject to, informal or formal 

enforcement action(s) by the Federal Reserve or another regulator tied to violations of laws 

and regulations that indicate severe deficiencies in the firm’s governance and controls. 

• Significant legal issues may have or be expected to impede the holding company’s ability to 

act as a source of financial strength for its depository institution(s). 

• The firm may have engaged in intentional misconduct. 
Attachment A for SR letter 22-8 

Page 15 of 19

• Deficiencies within the firm’s governance and controls may limit the credibility of the firm’s 

financial results, limit the board or senior management’s ability to make sound decisions, or 

materially increase the firm’s risk of litigation. 

• The firm’s internal audit function may be considered ineffective. 

• Deficiencies in the firm’s governance and controls may have limited the holding company’s 

ability to act as a source of financial and/or managerial strength for its depository 

institution(s).

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s 

governance and controls present a threat to its safety and soundness, a threat to the holding 

company’s ability to serve as a source of financial strength for its depository institution(s), or 

have already put the firm in an unsafe and unsound condition. 

Examples of issues that may result in a Deficient-2 rating include, but are not limited to: 

• The firm is currently subject to, or expected to be subject to, formal enforcement action(s) by 

the Federal Reserve or another regulator tied to violations of laws and regulations that 

indicate severe deficiencies in the firm’s governance and controls. 

• Significant legal issues may be impeding the holding company’s ability to act as a source of 

financial strength for its depository institution(s).

• The firm may have engaged in intentional misconduct. 

• The holding company may have failed to act as a source of financial and/or managerial 

strength for its depository institution(s) when needed. 

• The firm’s internal audit function is regarded as ineffective.

Definitions for the Capital Management Component Rating: 

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues, 

the supervised insurance organization’s capital management broadly meets supervisory 

expectations, supports maintenance of safe-and-sound operations, and supports the holding 

company’s ability to serve as a source of financial strength for its depository institution(s). 

Specifically:

• The firm’s current and projected capital positions on a consolidated basis and within each of 

its material business lines/legal entities comply with regulatory requirements and support its 

ability to absorb potential losses, meet obligations, and continue to serve as a source of 

financial strength for its depository institution(s);

• Capital management processes are sufficient to give credibility to stress testing results and 

the firm is capable of producing sound assessments of capital adequacy through a range of 

stressful yet plausible conditions; and 

• Potential capital fungibility issues are effectively mitigated, and capital contingency plans 

allow the holding company to continue to act as a source of financial strength for its 

depository institution(s) through a range of stressful yet plausible conditions. 
Attachment A for SR letter 22-8 

Page 16 of 19

Conditionally Meets Expectations. Capital adequacy meets regulatory minimums, both currently 

and on a prospective basis. Supervisory issues exist but these do not threaten the holding 

company’s ability to act as a source of financial strength for its depository institution(s) through 

a range of stressful yet plausible conditions. Specifically, if left unresolved, these issues: 

• May threaten the firm’s ability to produce sound assessments of capital adequacy through a 

range of stressful yet plausible conditions; and/or 

• May result in the firm’s projected capital positions being insufficient to absorb potential 

losses, comply with regulatory requirements, and support the holding company’s ability to 

meet current and prospective obligations and continue to serve as a source of financial 

strength to its depository institution(s).

Deficient-1. Financial or operational deficiencies in a supervised insurance organization’s 

capital management put its prospects for remaining safe and sound through a range of plausible 

conditions at significant risk. The firm is unable to remediate these deficiencies in the normal 

course of business, and remediation would typically require a material change to the firm’s 

business model or financial profile, or its capital management processes. 

Examples of issues that may result in a Deficient-1 rating include, but are not limited to: 

• Capital adequacy currently meets regulatory minimums although there may be uncertainty 

regarding the firm’s ability to continue meeting regulatory minimums. 

• Fungibility concerns may exist that could challenge the firm’s ability to contribute capital to 

its depository institutions under certain stressful yet plausible scenarios. 

• Supervisory issues may exist that undermine the credibility of the firm’s current capital 

adequacy and/or its stress testing results.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s 

capital management present a threat to the firm’s safety and soundness, a threat to the holding 

company’s ability to serve a source of financial strength for its depository institution(s), or have 

already put the firm in an unsafe and unsound condition. 

Examples of issues that may result in a Deficient-2 rating include, but are not limited to: 

• Capital adequacy may currently fail to meet regulatory minimums or there is significant 

concern that the firm will not meet capital adequacy minimums prospectively. 

• Supervisory issues may exist that significantly undermine the firm’s capital adequacy metrics 

either currently or prospectively. 

• Significant fungibility constraints may exist that would prevent the holding company from 

contributing capital to its depository institution(s) and fulfilling its obligation to serve as a 

source of financial strength. 

• The holding company may have failed to act as source of financial strength for its depository 

institution when needed. 

Definitions for the Liquidity Management Component Rating:
Attachment A for SR letter 22-8 

Page 17 of 19

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues, 

the supervised insurance organization’s liquidity management broadly meets supervisory 

expectations, supports maintenance of safe-and-sound operations, and supports the holding 

company’s ability to serve as a source of financial strength for its depository institutions(s). The 

firm generates sufficient liquidity to meet its short-term and long-term obligations currently and 

under a range of stressful yet plausible conditions. The firm’s liquidity management processes, 

including its liquidity contingency planning, support its obligation to act as a source of financial 

strength for its depository institution(s). Specifically:

• The firm is capable of producing sound assessments of liquidity adequacy through a range of 

stressful yet plausible conditions; and 

• The firm’s current and projected liquidity positions on a consolidated basis and within each 

of its material business lines/legal entities comply with regulatory requirements and support 

the holding company’s ability to meet obligations and to continue to serve as a source of 

financial strength for its depository institution(s).

Conditionally Meets Expectations. Certain material financial or operational weaknesses in a 

supervised insurance organization’s liquidity management place its prospects for remaining safe 

and sound through a range of stressful yet plausible conditions at risk if not resolved in a timely 

manner during the normal course of business. 

Specifically, if left unresolved, these weaknesses:

• May threaten the firm’s ability to produce sound assessments of liquidity adequacy through a 

range of conditions; and/or 

• May result in the firm’s projected liquidity positions being insufficient to comply with 

regulatory requirements and support the firm’s ability to meet current and prospective 

obligations and to continue to serve as a source of financial strength to its depository 

institution(s).

Deficient-1. Financial or operational deficiencies in a supervised insurance organization’s 

liquidity management put the firm’s prospects for remaining safe and sound through a range of 

stressful yet plausible conditions at significant risk. The firm is unable to remediate these 

deficiencies in the normal course of business, and remediation would typically require a material 

change to the firm’s business model or financial profile, or its liquidity management processes.

Examples of issues that may result in a Deficient-1 rating include, but are not limited to: 

• The firm is currently able to meet its obligations but there may be uncertainty regarding the 

firm’s ability to do so prospectively. 

• The holding company’s liquidity contingency plan may be insufficient to support its 

obligation to act as a source of financial strength for its depository institution(s). 

• Supervisory issues may exist that undermine the credibility of the firm’s liquidity metrics and 

stress testing results.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s 

liquidity management present a threat to its safety and soundness, a threat to the holding 
Attachment A for SR letter 22-8 

Page 18 of 19

company’s ability to serve as a source of financial strength for its depository institution(s), or 

have already put the firm in an unsafe and unsound condition. 

Examples of issues that may result in a Deficient-2 rating include, but are not limited to: 

• Liquidity shortfalls may exist within the firm that have prevented the firm, or are expected to 

prevent the firm, from fulfilling its obligations, including the holding company’s obligation 

to act as a source of financial strength for its depository institution(s). 

• Liquidity adequacy may currently fail to meet regulatory minimums or there is significant 

concern that the firm will not meet liquidity adequacy minimums prospectively for at least 

one of its regulated subsidiaries. 

• Supervisory issues may exist that significantly undermine the firm’s liquidity metrics either 

currently or prospectively. 

• Significant fungibility constraints may exist that would prevent the holding company from 

supporting its depository institution(s) and fulfilling its obligation to serve as a source of 

financial strength. 

• The holding company may have failed to act as source of financial strength for its depository 

institution when needed. 

C. Incorporating the Work of Other Supervisors

Similar to the approach taken by the Federal Reserve in its consolidated supervision of 

other firms, the oversight of supervised insurance organizations relies to the fullest extent 

possible, on work performed by other relevant supervisors. Federal Reserve supervisory 

activities are not intended to duplicate or replace supervision by the firm’s other regulators and 

Federal Reserve examiners typically do not specifically assess firms’ compliance with laws 

outside of its jurisdiction, including state insurance laws. The Federal Reserve collaboratively 

coordinates with, communicates with, and leverages the work of the Office of the Comptroller of 

the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), Securities and Exchange 

Commission (SEC), Financial Crimes Enforcement Network (FinCEN), Internal Revenue 

Service (IRS), applicable state insurance regulators, and other relevant supervisors to achieve its 

supervisory objectives and eliminate unnecessary burden. 

Existing statutes specifically require the Board to coordinate with, and to rely to the 

fullest extent possible on work performed by the state insurance regulators. The Board and all 

state insurance regulators have entered into Memorandums of Understanding (MOU) allowing 

supervisors to freely exchange information relevant for the effective supervision of supervised 

insurance organizations. Federal Reserve examiners take the actions below with respect to state 

insurance regulators to support accomplishing the objective of minimizing supervisory

duplication and burden, without sacrificing effective oversight: 

• Routine discussions (at least annually) with state insurance regulatory staff with greater 

frequency during times of stress;

• Discussions around the annual supervisory plan, including how best to leverage work 

performed by the state and potential participation by state insurance regulatory staff on 

relevant supervisory activities;
Attachment A for SR letter 22-8 

Page 19 of 19

• Consideration of the opinions and work done by the state when scoping relevant examination 

activities;

• Documenting any input received from the state and considering the assessments of and work 

performed by the state for relevant supervisory activities;

• Sharing and discussing with the state the annual ratings and relevant conclusion documents 

from supervisory activities;

• Collaboratively working with the states and the NAIC on the development of policies that 

affect insurance depository institution holding companies; and

• Participating in supervisory colleges.

The Federal Reserve relies on the state insurance regulators to participate in the activities 

above and to share proactively their supervisory opinions and relevant documents. These 

documents include the annual ORSA,

10 the state insurance regulator’s written assessment of the 

ORSA, results from its examination activities, the Corporate Governance Annual Disclosure, 

financial analysis memos, risk assessments, material risk determinations, material transaction 

filings (Form D), the insurance holding company system annual registration statement (Form B), 

submissions for the NAIC liquidity stress test framework, and other state supervisory material. 

If the Federal Reserve determines that it is necessary to perform supervisory activities related to 

aspects of the supervised insurance organization that also fall under the jurisdiction of the state 

insurance regulator, it will communicate the rationale and result of these activities to the state 

insurance regulator.

10 See NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual (December 2017) at

https://content.naic.org/sites/default/files/publication-orsa-guidance-manual.pdf. 
Attachment B for SR letter 22-8 

1 

SIO Complexity Classification Work Program

Overview

Consistent with the Federal Reserve’s approach to risk-based supervision, supervisory resources are assigned, and 

supervisory activities are conducted, in a manner that is proportionate to each organization’s risk profile. For 

supervised insurance organizations (SIOs), this begins by classifying each organization as either complex or 

noncomplex. The complexity classification serves as the basis for determining the level of supervisory resources 

needed to supervise each SIO effectively, as well as the frequency and scope of supervisory activities.

The purpose of this work program is to support the vetting of an SIO’s risk profile and the assignment of a complex 

or noncomplex classification. At a high level, the work program assists the relevant Federal Reserve Bank in

deciding whether to recommend to the Board that a dedicated supervisory team would be necessary to achieve the 

Federal Reserve’s supervisory objectives – to ensure that supervised organizations comply with rules and 

regulations, and that they operate in a safe and sound manner. The supervisory framework for SIOs described in 

SR letter 22-8, “Framework for the Supervision of Insurance Organizations” recognizes that large, well-established, 

and financially strong SIOs with relatively small depository institutions can be classified as noncomplex if the 

Board considers the corresponding level of supervisory oversight sufficient to accomplish these objectives. 

Complex SIOs: Complex organizations have a higher level of risk and therefore require more supervisory 

attention and resources. Federal Reserve Bank dedicated supervisory teams are assigned to execute approved 

supervisory plans led by a dedicated Central Point of Contact. The activities listed in the supervisory plans focus 

on understanding any of the organization’s risks that could threaten the safety and soundness of the consolidated 

organization or an organization’s ability to act as a source of strength for its depository institution(s). These 

activities typically include continuous monitoring, targeted topical examinations, coordinated reviews, and an 

annual roll-up assessment resulting in ratings for the three rating components. The focus, frequency, and 

intensity of supervisory activities are based on the organization’s unique risk profile and, therefore, can vary 

among complex SIOs. The relevance of certain supervisory guidance also may vary among complex SIOs based 

on each organization’s unique risk profile. Supervisory guidance targeted at smaller depository institution

holding companies, for example, may be more relevant for complex SIOs with limited inherent exposure to a 

certain risk.

For those organizations classified as complex, this work program also supports decisions related to the composition 

of the dedicated supervisory team, including the number and expertise of the examiners. 

Noncomplex SIOs: Noncomplex organizations, due to their lower risk profile, require less supervisory oversight 

relative to complex firms. The supervisory activities for these firms occur primarily during a rating examination

that occurs no less than every other year and results in the assignment of the three component ratings. Although 

these organizations are subject to topical target examinations, continuous monitoring, and coordinated reviews as 

appropriate, the supervision of noncomplex firms relies more heavily on the reports and assessments of the 

organization’s other relevant supervisors. The focus and types of supervisory activities for noncomplex firms are 

also set based on its unique risks. 

Size of Depository Institution

The total assets of the SIO’s depository institution(s), both in absolute terms and relative to the organization’s total 

assets, can materially influence the ability of the SIO to act as a source of financial strength during times of stress. 

The larger the depository institution, on both an absolute and relative basis, the more likely an SIO will be 

classified as complex. 
Attachment B for SR letter 22-8 

2 

Consistent with the approach taken for other supervised portfolios, the Federal Reserve will automatically classify 

as complex any SIO with banking assets in excess of $100 billion. For SIOs with less than $100 billion in banking 

assets, size is considered along with other factors to arrive at a holistic view of the organization’s risk profile. 

1. Please complete the table below using GAAP values, if available. Use statutory values for the insurance 

operations and to estimate total consolidated assets if GAAP values and not available. 

Business Assets Accounting Basis

Banking

Life insurance (general account)

P&C insurance

Insurance separate account 

Other insurance

[Other business 1]

[Other business 2]

Total Consolidated Assets

3rd party assets under management

Assets under administration

2. Describe the historical and planned growth trend for the consolidated organization and for each business line 

listed above.

3. Describe how the information above influences the resources needed to effectively supervise the SIO.

Regulatory Oversight 

The Federal Reserve relies to the greatest extent possible on the work of the SIO’s other supervisors. While it is 

important for Federal Reserve supervisory staff to understand the risks emanating from the insurance and banking 

activities of an SIO and how these risks impact the consolidated organization, the assessment of these businesses is 

typically left primarily to the state insurance regulator(s) and functional banking regulator (usually the OCC) 

respectively. By statutory mandate, the Federal Reserve is required to rely to the fullest extent possible on the 

work performed by the state insurance regulators. Particularly for SIOs with subsidiary depository institutions less 

than $100 billion in total assets, examiners rely heavily on the work of the OCC to assess the organization’s 

banking operations. Therefore, the nature and materiality of the organization’s non-insurance and non-banking 

activities heavily influences the need for Federal Reserve supervisory resources. SIOs with non-insurance and 

non-banking activities that have a low probability of negatively influencing the organization’s ability to act as a 

source of strength for its depository institution(s) typically require fewer resources to effectively supervise and so 

are more likely to be considered non-complex.
Attachment B for SR letter 22-8 

3 

Less-than-satisfactory ratings, significant supervisory issues, or outstanding enforcement actions from any of the 

SIO’s supervisors is a sign of elevated risk and potential challenges to it serving as a source of managerial and/or 

financial strength for its depository institution(s). Even after the classification determination is made, supervisory 

ratings and opinions will continue to influence the focus, frequency, and intensity of supervisory activities. 

Activities that exist outside of legal entities with regulatory oversight can often increase the risks of the 

consolidated organization. 

1. Describe the organization’s activities currently subject to no or limited regulatory oversight, including the 

materiality of the risks associated with these activities (examples include financial advisory services, 

distribution, investment origination/structuring, and some captive reinsurance arrangements).

2. If currently supervised by the Federal Reserve, describe the organization’s current ratings and any outstanding 

or recently closed supervisory issues (enforcement actions, matters requiring attention (MRAs), and matters 

requiring immediate attention (MRIAs)). 

3. Describe, if applicable, the current ratings and supervisory opinions of the organization’s other regulators 

(state insurance regulators, OCC, FDIC, state banking regulators, SEC, international regulators, etc.). 

Describe any outstanding supervisory issues. 

4. Describe any recent changes in the supervisory ratings assigned to the organization by its regulators.

5. Describe how the information above influences the resources needed to effectively supervise the SIO.

Product and Portfolio Risks 
Attachment B for SR letter 22-8 

4 

The composition of an SIO’s assets and liabilities, including off-balance sheet exposures, is a major driver of 

supervisory focus. Traditional insurance liabilities that are supported with high-quality assets require less 

regulatory oversight, which is typically provided primarily by state insurance regulators. Liabilities tied to 

sophisticated hedging programs or that are otherwise complex and assets that are of low quality, illiquid, or overly 

concentrated, increase an SIO’s risks. The quality of an SIO’s asset-liability management program is also 

considered when evaluating this factor.

1. Describe the insurance products currently sold by the organization and provide product liability balances as of 

the most recent year-end. Describe the key risks associated with the organization’s insurance business and the 

organization’s use of reinsurance. 

2. Describe the banking products sold by the organization and provide product balances as of the most recent 

year-end. Describe the key risks associated with the organization’s banking business.

3. Describe the non-insurance/non-banking products sold by the organization and provide product balances as of 

the most recent year-end. Describe the key risks associated with these products.

4. Describe the organization’s sources of market risk, including its use of derivatives (for hedging and other 

purposes). 

5. Describe the organization’s investment guidelines and risk appetite statement for credit risk. Provide a 

breakout of the organization’s investment portfolio as of the most recent year-end, including by asset type and 

rating. Describe any recent changes to the organization’s investment mix.

6. Describe the organization’s off-balance sheet exposure and the risks associated with this exposure.
Attachment B for SR letter 22-8 

5 

7. Describe the organization’s use of third parties for operational purposes and for risk management.

8. Describe the organization’s IT infrastructure and its exposure to IT and Cyber risks.

9. Describe how the information above influences the resources needed to effectively supervise the SIO.

Organizational Structure 

As a consolidated supervisor, the Federal Reserve must understand and be able to assess risks throughout the 

organization. An intricate organizational structure can increase and/or mask certain risks. The intricacy of an 

SIO’s organizational structure is determined by considering the number, type, and location of its legal entities; 

guarantees and other arrangements, including reinsurance, between legal entities; and the purpose for the SIO’s 

legal entity structure. 

1. Describe the structure of the organization, including the legal entity structure, the board committee structure, 

senior management committee structure, and where in the organization risks are managed.

2. Describe any potential challenges (reporting, regulatory, etc.) related to the organization’s ownership 

structure. 

3. Describe any statutory limitations on the organization’s investments in noninsurance subsidiaries.

4. Describe the organization’s use of internal (captive) reinsurance, internal financing, and affiliate guarantees.
Attachment B for SR letter 22-8 

6 

5. Describe the organization’s internal shared services arrangements and other intra-group activities between 

among the organization’s subsidiaries.

6. Describe the organization’s ability to identify, aggregate, and report risk exposures and risk concentrations 

across business lines and legal entities.

7. Describe how the information above influences the resources needed to effectively supervise the SIO.

Quality and Level of Capital 

A key expectation is that the SIO act as a source of financial strength for its depository institution(s). Sufficient 

capital available to be deployed, if necessary, is essential in fulfilling this role. The Federal Reserve will consider 

the SIO’s capital level, any limits to deploying capital to support its depository institution(s), and its prior support 

of its subsidiaries during periods of financial stress. 

1. Provide a five-year history of the regulatory capital metric applicable for each of the organization’s significant 

legal entities subject to a regulatory capital regime. Describe any cases of unusual over or under 

capitalization.

2. Describe the organization’s use of leverage (financial and operational), including where the leverage is issued 

and any concerns regarding the organization’s ability to service its debt.

3. Describe the organization’s capital planning process, including the involvement by its board.
Attachment B for SR letter 22-8 

7 

4. Describe the organization’s capital stress testing framework, including its capital contingency plans if 

available. 

5. Describe the organization’s capital resources and capital targets.

6. Describe the organization’s access to capital markets.

7. Describe any legal contingencies tied to capital within the organization, including any restrictions related to 

capital fungibility between legal entities, particularly as they relate to the depository institution. 

8. Describe how the information above influences the resources needed to effectively supervise the SIO.

Quality and Level of Liquidity

A key requirement is that the SIO can act as a source of financial strength for their depository institution(s). 

Sufficient liquidity available to be deployed, if necessary, is essential in fulfilling this role. The Federal Reserve 

will consider the SIO’s liquidity level, any limits to deploying liquidity to support its depository institution(s), and 

its prior support of its subsidiaries during periods of financial stress. 

1. Describe the organization’s liquidity position using relevant regulatory metrics, metrics used by the 

organization to manage its liquidity, and/or any industry-standard liquidity metrics relevant for the 

organization’s business lines.

2. Describe the sufficiency of the organization’s level of liquidity given its risk profile.
Attachment B for SR letter 22-8 

8 

3. Describe the organization’s liquidity planning and contingency funding plan, if available. 

4. Describe any instances of the organizations’ prior support of its subsidiaries during periods of stress.

5. Describe the organization’s framework for liquidity risk management, including liquidity stress testing, risk 

tolerance, and reporting to senior management and the board. 

6. Describe the organization’s funding structure, including its reliance on short-term funding, and its access to 

and use of secondary market funding sources. 

7. Describe any restrictions related to liquidity fungibility between legal entities, particularly as they relate to the 

depository institution.

8. Describe how the information above influences the resources needed to effectively supervise the SIO.

International Exposure 

While geographic diversification can be a benefit, international operations present unique challenges. These 

include challenges that arise from differences in accounting standards, regulatory frameworks, and legal 

requirements. An SIO with international operations that materially contribute to its risk profile is more likely to be 

considered complex. 
Attachment B for SR letter 22-8 

9 

1. Has the organization been designated as an internationally active insurance group (IAIG) by its group-wide 

insurance supervisor?

2. Describe the organization’s international business activities, including the countries and products in which it is 

active. 

3. Describe the risks associated with the organization’s international operations and the materiality of these risks 

relative to the broader organization. 

4. Describe how the information above influences the resources needed to effectively supervise the SIO.

Interconnectedness 

The Federal Reserve also monitors supervised institutions for potential systemic risk, or interconnectedness with 

the broader financial system. An SIO whose failure could contribute to increased instability in the overall 

financial system of the United States will more likely be considered complex. 

1. Describe any potential concerns related to the organization’s systemic interconnectedness with the broader 

financial system.

2. Describe how the information above influences the resources needed to effectively supervise the SIO.
Attachment B for SR letter 22-8 

10

Other Factors for Consideration

Describe any risk factors not identified above that have contributed to the Reserve Bank’s complexity 

classification proposal. Include in the description how these additional factors influence the resources needed to 

effectively supervise the SIO.

Conclusion

Describe the Reserve Bank’s proposed complexity classification. The proposal should be supported by the 

information above and should be focused on the resources needed to effectively supervise the organization given 

its risk profile.