Attachment A for SR letter 22-8

Framework for the Supervision of Insurance Organizations

Page 1 of 19

This framework describes the Federal Reserve's approach to consolidated supervision of

supervised insurance organizations. [Footnote 1

- In this framework, a “supervised insurance organization” is a depository institution holding company that is an

insurance underwriting company, or that has over 25 percent of its consolidated assets held by insurance

underwriting subsidiaries, or has been otherwise designated as a supervised insurance organization by Federal

Reserve staff. End of Footnote 1.]

The framework is designed specifically to account for the

unique risks and business profiles of these firms resulting mainly from their insurance business.

The framework consists of a risk-based approach to establishing supervisory expectations,

assigning supervisory resources, and conducting supervisory activities; a supervisory rating

system; and a description of how Federal Reserve examiners work with the state insurance

regulators to limit supervisory duplication.

A. Proportionality - Supervisory Activities and Expectations

Consistent with the Federal Reserve's approach to risk-based supervision, supervisory

guidance is applied, and supervisory activities are conducted, in a manner that is proportionate to

each firm's individual risk profile. This begins by classifying each supervised insurance

organization either as complex or noncomplex based on its risk profile and continues with a riskbased application of supervisory guidance and supervisory activities driven by a periodic risk

assessment. The risk assessment drives planned supervisory activities and is communicated to

the firm along with the supervisory plan for the upcoming cycle. Supervisory activities are

focused on resolving supervisory knowledge gaps, monitoring the safety and soundness of the

firm, assessing the firm's management of risks that could potentially impact its ability to act as a

source of managerial and financial strength for its depository institution(s), and monitoring for

potential systemic risk, if relevant.

1. Complexity Classification and Supervised Activities

The Federal Reserve classifies each supervised insurance organization as either complex

or noncomplex based on its risk profile. The classification serves as the basis for determining

the level of supervisory resources dedicated to each firm, as well as the frequency and intensity

of supervisory activities.

Complex

Complex firms have a higher level of risk and therefore require more supervisory

attention and resources. Federal Reserve dedicated supervisory teams are assigned to execute

approved supervisory plans led by a dedicated Central Point of Contact. The activities listed in

the supervisory plans focus on understanding any risks that could threaten the safety and 

soundness of the consolidated organization or a firm's ability to act as a source of strength for its

subsidiary depository institution(s). These activities typically include continuous monitoring,

targeted topical examinations, coordinated reviews, and an annual roll-up assessment resulting in

ratings for the three rating components. The relevance of certain supervisory guidance may vary

among complex firms based on each firm's risk profile. Supervisory guidance targeted at
Page 2 of 19

smaller depository institution holding companies, for example, may be more relevant for

complex supervised insurance organizations with limited inherent exposure to a certain risk.

Noncomplex

Noncomplex firms, due to their lower risk profile, require less supervisory oversight

relative to complex firms. The supervisory activitiesfor these firms occur primarily during a 

rating examination that occurs no less often than every other year and results in the three

component ratings. The supervision of noncomplex firms relies more heavily on the reports and

assessments of a firm's other relevant supervisors, although these firms may also be subject to

continuous monitoring, targeted topical examinations, and coordinated reviews as appropriate.

The focus and types of supervisory activities for noncomplex firms are also set based on the risks

of each firm.

Factors considered when classifying a supervised insurance organization as either

complex or noncomplex include the absolute and relative size of its depository institution(s), its

current supervisory and regulatory oversight (ratings and opinions of its supervisors, and the 

nature and extent of any unregulated and/or unsupervised activities), the breadth and nature of

product and portfolio risks, the nature of its organizational structure, its quality and level of

capital and liquidity, the materiality of any international exposure, and its interconnectedness

with the broader financial system.

For supervised insurance organizationsthat are commencing Federal Reserve

supervision, the classification as complex or noncomplex is done and communicated during the

application phase after initial discussions with the firm. The firm's risk profile, including the

characteristics listed above, are evaluated by staff of the Board and relevant Reserve Bank before

the complexity classification is assigned by Board staff. Large, well-established, and financially

strong supervised insurance organizations with relatively small depository institutions can be

classified as noncomplex if, in the opinion of Board staff, the corresponding level of supervisory

oversight is sufficient to accomplish its objectives. Although the risk profile is the primary basis

for assigning a classification, a firm is automatically classified as complex if its depository

institution's average assets exceed $100 billion. A firm may request that the Federal Reserve

review its complexity classification if it has experienced a significant change to its risk profile.

The focus, frequency, and intensity of supervisory activities are based on a risk

assessment of the firm completed periodically by the supervisory team and will vary among

firms within the same complexity classification. For each risk described in the Supervisory

Expectations section below, the supervisory team assesses the firm's inherent risks and its

residual risk after considering the effectiveness of its management of the risk. The risk

assessment and the supervisory activities that follow from it take into account the assessments

made by and work performed by the firm's other regulators. In certain instances, Federal

Reserve examiners may be able to rely on a firm's internal audit (if it is rated effective) or

internal control functions in developing the risk assessment.

2. Supervisory Expectations

Supervised insurance organizations are required to operate in a safe and sound manner, to

comply with all applicable laws and regulations, and to possess sufficient financial and 

operationalstrength to serve as a source of strength for their depository institution(s) through a
Page 3 of 19

range of stressful yet plausible conditions. The governance and risk management practices

necessary to accomplish these objectives will vary based on a firm's specific risk profile, size,

and complexity. Guidance describing supervisory expectationsfor safe and sound practices can

be found in Supervision & Regulation (SR) letters published by the Board and other supervisory

material. Supervisory guidance most relevant to a specific supervised insurance organization is 

driven by the risk profile of the firm. Federal Reserve examiners periodically reassess the firm's

risk profile and inform the firm if different supervisory guidance becomes more relevant as a

result of a material change to its risk profile.

Most supervisory guidance issued by the Board is intended specifically for institutions

that are primarily engaged in banking activities. Examples of specific practices provided in these

materials may differ from (or not be applicable to) the nonbanking operations of supervised

insurance organizations, including for insurance operations. The Board recognizes that practices

in nonbanking business lines can be different than those published in supervisory guidance

without being considered unsafe or unsound. When making their assessment, Federal Reserve

examiners work with supervised insurance organizations and other involved regulators, including

state insurance regulators, to appropriately assess practicesthat may be different than those

typically observed for banking operations.

This section describes general safety and soundness expectations and how the Board has

adapted its supervisory expectationsto reflect the special characteristics of a supervised

insurance organization. The section is organized using the three rating components -

Governance and Controls, Capital Management, and Liquidity Management.

Governance and Controls

The Governance and Controls component rating is derived from an assessment of the

effectiveness of a firm's (1) board and senior management, and (2) independent risk management

and controls. All firms are expected to align their strategic business objectives with their risk

appetite and risk management capabilities; maintain effective and independent risk management

and control functions including internal audit; promote compliance with laws and regulations;

and remain a source of financial and managerial strength for their depository institution(s).

When assessing governance and controls, Federal Reserve examiners consider a firm's risk

management capabilities relative to its risk exposure within the following areas: internal audit,

credit risk, legal and compliance risk, market risk, model risk, and operational risk, including

cybersecurity/information technology and third-party risk.

Governance & Controls expectations

• Despite differences in their business models and the products offered, insurance companies

and banks are expected to have effective and sustainable systems of governance and controls

to manage their respective risks. The governance and controls framework for a supervised

insurance organization should:

o Clearly define roles and responsibilities throughout the organization;

o Include policies and procedures, limits, requirements for documenting decisions, and

decision-making and accountability chains of command; and

o Provide timely information about risk and corrective action for non-compliance or weak

oversight, controls, and management.
Page 4 of 19

• The Board expects the sophistication of the governance and controls framework to be 

commensurate with the size, complexity, and risk profile of the firm. As such, governance

and controls expectations for complex firms will be higher than that for noncomplex firms

but will also vary based on each firm's risk profile.

• The Board expects supervised insurance organizations to have a risk management and control

framework that is commensurate with its structure, risk profile, complexity, activities, and

size. For any chosen structure, the firm's board is expected to have the capacity, expertise,

and sufficient information to discharge risk oversight and governance responsibilitiesin a

safe and sound manner.

In assigning a rating for the Governance and Controls component, Federal Reserve

examiners evaluate:

Board and Senior Management Effectiveness

• The firm's board is expected to exhibit certain attributes consistent with effectiveness,

including: (i) setting a clear, aligned, and consistent direction regarding the firm's strategy

and risk appetite; (ii) directing senior management regarding board reporting; (iii) overseeing

and holding senior management accountable; (iv) supporting the independence and stature of

independent risk management and internal audit; and (v) maintaining a capable board and an

effective governance structure. As the consolidated supervisor, the Board focuses on the

board of the supervised insurance organization and its committees. Complex firms are

expected to take into consideration the Board's guidance on board of directors'

effectiveness. [Footnote 2

- See SR letter 21-3, “Supervisory Guidance on Board ofDirectors' Effectiveness.” End of Footnote 2.]

In assessing the effectiveness of a firm's senior management, Federal

Reserve examiners consider the extent to which senior management effectively and prudently

manages the day-to-day operations of the firm and provides for ongoing resiliency;

implements the firm's strategy and risk appetite; identifies and manages risks; maintains an 

effective risk management framework and system of internal controls; and promotes prudent

risk taking behaviors and business practices, including compliance with laws and regulations

such as those related to consumer protection and the Bank Secrecy Act/Anti-Money

Laundering and Office of Foreign Assets Control (BSA/AML and OFAC). Federal Reserve

examiners evaluate how the framework allows management to be responsible for and manage

all risk types, including emerging risks, within the business lines. Examiners rely to the

fullest extent possible on insurance and banking supervisors' examination reports and

information concerning risk and management in specific lines of business, including relying 

specifically on state insurance regulators to evaluate and assess how firms manage the

pricing, underwriting, and reserving risk of their insurance operations.

Independent Risk Management and Controls

• In assessing a firm's independent risk management and controls, Federal Reserve examiners

consider the extent to which independent risk management effectively evaluates whether the 

firm's risk appetite framework identifies and measures all of the firm's material risks;

establishes appropriate risk limits; and aggregates, assesses and reports on the firm's risk
Page 5 of 19

profile and positions. Additionally, the firm is expected to demonstrate that its internal

controls are appropriate and tested for effectiveness and sustainability.

• Internal Audit is an integral part of a supervised insurance organization's internal control

system and risk management structure. An effective internal audit function plays an essential

role by providing an independent risk assessment and objective evaluation of all key

governance, risk management, and internal control processes. Internal audit is expected to

effectively and independently assess the firm's risk management framework and internal

control systems, and report findings to senior management and to the firm's audit committee.

Despite differencesin business models, the Board expects the largest, most complex

supervised insurance organizations to have internal audit practicesin place that are similar to

those at banking organizations and as such, no modification to existing guidance is required

for these firms. [Footnote 3

- Regulatory guidance provided in SR letter 03-5, “Amended Interagency Guidance on the Internal Audit Function

and its Outsourcing” and SR letter 13-1, “Supplemental Policy Statement on the Internal Audit Function and Its

Outsourcing” are applicable to complex supervised insurance organizations. End of Footnote 3.]

At the same time, the Board recognizes that firms should have an internal

audit function that is appropriate to their size, nature, and scope of activities. Therefore, for

noncomplex firms, Federal Reserve examiners will consider the expectations in the insurance

company's domicile state's Annual Financial Reporting Regulation (NAIC Model Audit

Rule 205), or similar state regulation, to assess the effectiveness of a firm's internal audit

function.

The principles of sound risk management described in the previous sections apply to the entire 

spectrum of risk management activities of a supervised insurance organization, including but not

limited to:

• Credit risk arises from the possibility that a borrower or counterparty will fail to perform on 

an obligation. Fixed income securities, by far the largest asset class held by many insurance

companies, is a large source of credit risk. This is unlike most banking organizations, where

loans generally make up the largest portion of balance sheet assets. Life insurer investment

portfolios in particular are generally characterized by longer duration holdings compared to

those of banking organizations. Additionally, an insurance company's reinsurance

recoverables/receivables arising from the use of third-party reinsurance and participation in

regulatory required risk-pooling arrangements expose the firm to additional counterparty

credit risk. Federal Reserve examiners scope examination work based on a firm's level of

inherent credit risk. The level of inherent risk is determined by analyzing the composition,

concentration, and quality of the consolidated investment portfolio; the level of a firm's

reinsurance recoverables, the credit quality of the individual reinsurers, and the amount of

collateral held for reinsured risks; and credit exposures associated with derivatives, securities

lending, or other activities that may also have off-balance sheet counterparty credit 

exposures. In determining the effectiveness of a firm's management of its credit risk, Federal

Reserve examiners rely, where possible, on the assessments made by other relevant

supervisorsfor the depository institution(s) and the insurance company(ies). In its own

assessment, the Federal Reserve will determine whether the board and senior management

have established an appropriate credit risk governance framework consistent with the firm's

risk appetite; whether policies, procedures and limits are adequate and provide for ongoing

monitoring, reporting and control of credit risk; the adequacy of management information
Page 6 of 19

systems as it relates to credit risk; and the sufficiency of internal audit and independent

review coverage of credit risk exposure.

• Market risk arises from exposuresto losses as a result of underlying changes in, for example,

interest rates, equity prices, foreign exchange rates, commodity prices, or real estate prices.

Federal Reserve examiners scope examination work based on a firm's level of inherent

market risk exposure, which is normally driven by the primary business line(s) in which the

firm is engaged as well as the structure of the investment portfolio. A firm may be exposed

to inherent market risk due to its investment portfolio or as result of its product offerings,

including variable and indexed life insurance and annuity products, or asset/wealth

management business. While interest rate risk (IRR), a category of market risk, differs

between insurance companies and banking organizations, the degree of IRR also differs

based on the type of insurance products the firm offers. IRR is generally a small risk for U.S.

property/casualty (P/C) whereas it can be a significant risk factor for life insurers with certain

life and annuity products that are spread-based, longer in duration, may include embedded 

product guarantees, and can pose disintermediation risk. Equity market risk can be

significant for life insurersthat issue guarantees tied to equity markets, like variable annuity

living benefits, and for P/C insurers with large common equity allocations in their investment

portfolios. Generally foreign exchange and commodity risk is low for supervised insurance

organizations but could be material for some complex firms. Firms are expected to have

sound risk management infrastructure that adequately identifies, measures, monitors, and

controls any material or significant forms of market risks to which it is exposed.

• Model risk is the potential for adverse consequences from decisions based on incorrect or

misused model outputs and reports. Model risk can lead to financial loss, poor business and

strategic decision-making, or damage to a firm's reputation. Supervised insurance

organizations are often heavily reliant on models for product pricing and reserving, risk and 

capital management, strategic planning and other decision-making purposes. A sound model

risk management framework helps manage this risk. [Footnote 4

- SR letter 11-7, “Guidance on Model Risk Management” is applicable to all supervised insurance organizations. End of Footnote 4.]

Federal Reserve examiners take into

account the firm's size, nature, and complexity, as well as the extent of use and sophistication

of its models when assessing its model risk management program. Examiners focus on the

governance framework, policies and controls, and enterprise model risk management through

a holistic evaluation of the firm's practices. The Federal Reserve's review of a firm's model

risk management program complements the work of the firm's other relevant supervisors. A

sound model risk management framework includes three main elements: (1) an accurate

model inventory and an appropriate approach to model development, implementation, and 

use; (2) effective model validation and continuous model performance monitoring; and (3) a 

strong governance framework that provides explicit support and structure for model risk

management through policies defining relevant activities, procedures that implement those

policies, allocation of resources, and mechanisms for evaluating whether policies and

procedures are being carried out as specified, including internal audit review. The Federal

Reserve relies on work already conducted by other relevant supervisors and appropriately

collaborates with state insurance regulators on their findings related to insurance models.

With respect to insurance models, the Federal Reserve recognizes the important role played
Page 7 of 19

by actuaries as described in actuarial standards of practice on model risk management. With

respect to the business of insurance, Federal Reserve examiners focus on the firm's

adherence to its own policies and procedures and the comprehensiveness of model validation

rather than technical specifications such as the appropriateness of the model, its assumptions,

or output. Federal Reserve examiners may request that firms provide model documentation

or model validation reports for insurance and bank models when performing transaction

testing.

• Legal risk arises from the potential that unenforceable contracts, lawsuits, or adverse

judgments can disrupt or otherwise negatively affect the operations or financial condition of

a supervised insurance organization.

• Compliance risk is the risk of regulatory sanctions, fines, penalties, or losses resulting from

failure to comply with laws, rules, regulations, or other supervisory requirements applicable

to a firm. By offering multiple financial service products that may include insurance,

annuity, banking, services provided by securities broker-dealers, and asset and wealth

management products, provided through a diverse distribution network, supervised insurance

organizations are inherently exposed to a significant amount of legal and compliance risk.

As the consolidated supervisor, the Board expects firms to have an enterprise-wide legal and

compliance risk management program that covers all business lines, legal entities, and

jurisdictions of operation. Firms are expected to have compliance risk management

governance, oversight, monitoring, testing, and reporting commensurate with their size and

complexity, and to ensure compliance with all applicable laws and regulations. The

principles-based guidance in existing SR letters related to legal and compliance risk is

applicable to supervised insurance organizations. [Footnote 5

- SR letter 08-8, “Compliance Risk Management Programs and Oversight at Large Banking Organizations with

Complex Compliance Profiles” is applicable to complex supervised insurance organizations. For noncomplex firms,

the Federal Reserve will assess legal and compliance risk management based on the guidance in SR letter 16-11,

“Supervisory Guidance for Assessing Risk Management at Supervised Institutions with Total Consolidated Assets

Less than $100 Billion.” End of Footnote 5.]

For both complex and noncomplex firms,

Federal Reserve examiners rely on the work of the firm's other supervisors. As described in

section C, Incorporating the Work of Other Supervisors, the assessments, examination

results, ratings, supervisory issues, and enforcement actions from other supervisors will be

incorporated into a consolidated assessment of the enterprise-wide legal and compliance risk

management framework.

o Money laundering, terrorist financing and other illicit financial activity risk is the risk of

providing criminals access to the legitimate financial system and thereby being used to

facilitate financial crime. This financial crime includes laundering criminal proceeds,

financing terrorism, and conducting other illegal activities. Money laundering and

terrorist financing risk is associated with a financial institution's products, services,

customers, and geographic locations. This and other illicit financial activity risks can

impact a firm across business lines, legal entities, and jurisdictions. A reasonably

designed compliance program generally includes a structure and oversight that mitigates

these risks and supports regulatory compliance with both BSA/AML OFAC

requirements. Although OFAC regulations are not part of the BSA, OFAC compliance

programs are frequently assessed in conjunction with BSA/AML. Supervised insurance
Page 8 of 19

organizations are not defined as financial institutions under the BSA and, therefore, are

not required to have an AML program, unless the firm is directly selling certain insurance 

products. However, certain subsidiaries and affiliates of supervised insurance

organizations, such as insurance companies and banks, are defined as financial

institutions under 31 U.S.C. 5312(a)(2) and must develop and implement a written

BSA/AML compliance program as well as comply with other BSA regulatory

requirements. Unlike banks, insurance companies' BSA/AML obligations are limited to

certain products, referred to as covered insurance products. [Footnote 6

- “Covered products” means a permanent life insurance policy, other than a group life insurance policy; an annuity

contract, other than a group annuity contract; or any other insurance product with features of cash value or

investment. 31 CFR 1025.100(b). “Permanent life insurance policy” means an agreement that contains a cash value

or investment element and that obligates the insurer to indemnify or to confer a benefit upon the insured or

beneficiary to the agreement contingent upon the death ofthe insured. 31 CFR 1025.100(h). “Annuity contract”

means any agreement between the insurer and the contract owner whereby the insurer promises to pay out a fixed or

variable income stream for a period oftime. 31 CFR 1025.100(a). End of Footnote 6.]

The volume of covered

products, which the Financial Crimes Enforcement Network (FinCEN) has determined to

be of higher risk, is an important driver of supervisory focus. In addition, as U.S.

persons, all supervised insurance organizations (including their subsidiaries and affiliates)

are subject to OFAC regulations. Federal Reserve examiners assess all material risks that

each firm faces, extending to whether business activities across the consolidated

organization, including within its individual subsidiaries or affiliates, comply with the

legal requirements of BSA and OFAC regulations. In keeping with the principles of a

risk-based framework and proportionality, Federal Reserve supervision for BSA/AML

and OFAC primarily focuses on oversight of compliance programs at a consolidated level

and relies on work by other relevant supervisors to the fullest extent possible. In the

evaluation of a firm's risks and BSA/AML and OFAC compliance program, however, it

may be necessary for examiners to review compliance with BSA/AML and OFAC 

requirements at individualsubsidiaries or affiliates in order to fully assess the material

risks of the supervised insurance organization.

• Operational risk is the risk of loss resulting from inadequate or failed internal processes,

people, and systems, or from external events. Operational resilience is the ability to maintain

operations, including critical operations and core business lines, through a disruption from

any hazard. It is the outcome of effective operational risk management combined with

sufficient financial and operational resources to prepare, adapt, withstand, and recover from

disruptions. A firm that operates in a safe and sound manner is able to identify threats,

respond and adapt to incidents, and recover and learn from such threats and incidents so that

it can prioritize and maintain critical operations and core business lines, along with other

operations,services and functions identified by the firm, through a disruption.

o Cybersecurity/information technology risks are a subset of operational risk and arise

from operations of a firm requiring a strong and robust internal control system and risk

management oversight structure. Information Technology (IT) and Cybersecurity

(Cyber) functions are especially critical to a firm's operations. Examiners of financial

institutions, including supervised insurance organizations, utilize the detailed guidance on 

mitigating these risks in the Federal Financial Institutions Examination Council's
Page 9 of 19

(FFIEC) IT Handbooks. In assessing IT/Cyber risks, Federal Reserve examiners assess

each firm's:

Board and senior management for effective oversight and support ofIT management;

Information/cyber security program for strong board and senior management support,

integration ofsecurity activities and controls through business processes, and

establishment of clear accountability for security responsibilities;

IT operations for sufficient personnel, system capacity and availability, and storage

capacity adequacy to achieve strategic objectives and appropriate solutions;

Development and acquisition processes' ability to identify, acquire, develop, install, and

maintain effective IT to support business operations; and

Appropriate business continuity management processes to effectively oversee and

implement resilience, continuity, and response capabilities to safeguard employees,

customers, assets, products, and services.

Complex and noncomplex firms are assessed in these areas. All supervised insurance

organizations are required to notify the Federal Reserve of any computer-security

notification incidents. [Footnote 7

- SR letter 22-4, “Contact Information in Relation to Computer-Security Incident Notification Requirements”

applies to all supervised insurance organizations. End of Footnote 7.]

o Third party risk is also a subset of operational risk and arises from a firm's use of service

providers to perform operational or service functions. These risks may be inherent to the

outsourced activity or be introduced with the involvement ofthe service provider. When

assessing effective third party risk management, Federal Reserve examiners evaluate

eight areas: 1) third party risk management governance, 2) risk assessment framework, 3)

due diligence in the selection of a service provider, 4) a review of any incentive

compensation embedded in a service provider contract, 5) management of any contract or

legal issues arising from third party agreements, 6) ongoing monitoring and reporting of

third parties, 7) business continuity and contingency ofthe third party for any service

disruptions, and 8) effective internal audit program to assess the risk and controls ofthe

firm's third party risk management program. [Footnote 8

- SR letter 13-19, “Guidance on Managing Outsourcing Risk” applies to all supervised insurance organizations. End of Footnote 8.]

Capital Management

The Capital Management rating is derived from an assessment of a firm's current and

stressed level of capitalization, and the quality ofits capital planning and internal stress testing.

A capital management program should be commensurate with a supervised insurance

organization's complexity and risk profile. In assigning this rating, the Federal Reserve

examiners evaluate the extent to which a firm maintains sound capital planning practices through

effective governance and oversight, effective risk management and controls, maintenance of

updated capital policies and contingency plans for addressing potential shortfalls, and

incorporation of appropriately stressful conditions into capital planning and projections of capital

positions. The extent to which a firm's capital is sufficient to comply with regulatory
Page 10 of 19

requirements, to support the firm's ability to meet its obligations, and to enable the firm to

remain a source of strength to its depository institution(s) in a range of stressful, but plausible,

economic and financial environments is also evaluated.

Insurance company balance sheets are typically quite different from those of most

banking organizations. For life insurance companies, investment strategies may focus on cash

flow matching to reduce interest rate risk and provide liquidity to support their liabilities, while

for traditional banks, deposits (liabilities) are attracted to support investment strategies.

Additionally, for insurers, capital provides a buffer for policyholder claims and creditor

obligations, helping the firm absorb adverse deviations in expected claims experience, and other

drivers of economic loss. The Board recognizes that the capital needs for insurance activities are

materially different from those of banking activities and can be different between life and 

property and casualty insurers. Insurers may also face capital fungibility constraints not faced by 

banking organizations.

In assessing a supervised insurance organization's capital management, the Federal

Reserve relies to the fullest extent possible on information provided by state insurance

regulators, including the firm's own risk and solvency assessment (ORSA) and the state 

insurance regulator's written assessment of the ORSA. An ORSA is an internal process

undertaken by an insurance group to assess the adequacy of its risk management and current and 

prospective capital position under normal and stress scenarios. As part of the ORSA, insurance

groups are required to analyze all reasonably foreseeable and relevant material risks that could

have an impact on their ability to meet obligations.

The Board expects supervised insurance organizations to have sound governance over

their capital planning process. A firm should establish capital goals that are approved by the

board of directors, and that reflect the potential impact of legal and/or regulatory restrictions on

the transfer of capital between legal entities. In general, senior management should establish the 

capital planning process, which should be reviewed and approved periodically by the board. The

board should require senior management to provide clear, accurate, and timely information on 

the firm's material risks and exposures to inform board decisions on capital adequacy and 

actions. The capital planning process should clearly reflect the difference between the risk

profiles and associated capital needs of the insurance and banking businesses.

A firm should have a risk management framework that appropriately identifies, measures,

and assesses material risks and provides a strong foundation for capital planning. This

framework should be supported by comprehensive policies and procedures, clear and wellestablished roles and responsibilities, strong internal controls, and effective reporting to senior

management and the board. In addition, the risk management framework should be built upon 

sound management information systems.

As part of capital management, a firm should have a sound internal control framework

that helps ensure that all aspects of the capital planning process are functioning as designed and 

result in an accurate assessment of the firm's capital needs. The internal control framework

should be independently evaluated periodically by the firm's internal audit function.

The governance and oversight framework should include an assessment of the principles

and guidelines used for capital planning, issuance, and usage, including internal post-stress

capital goals and targeted capital levels; guidelines for dividend payments and stock repurchases;
Page 11 of 19

strategies for addressing capital shortfalls; and internal governance responsibilities and 

procedures for the capital policy. The capital policy should reflect the capital needs of the

insurance and banking businesses based on their risks, be approved by the firm's board of

directors or a designated committee of the board, and be re-evaluated periodically and revised as

necessary.

A strong capital management program will incorporate appropriately stressful conditions

and events that could adversely affect the firm's capital adequacy and capital planning. As part

of its capital plan, a firm should use at least one scenario that stresses the specific vulnerabilities

of the firm's activities and associated risks, including those related to the firm's insurance

activities and its banking activities.

Supervised insurance organizations should employ estimation approaches to project the

impact on capital positions of various types of stressful conditions and events, and that are

independently validated. A firm should estimate losses, revenues, expenses, and capital using

sound methods that incorporate macroeconomic and other risk drivers. The robustness of a firm's

capital stress testing processes should be commensurate with its risk profile.

Liquidity Management

The Liquidity Management rating is derived from an assessment of the supervised

insurance organization's liquidity position and the quality of its liquidity risk management

program. Each firm's liquidity risk management program should be commensurate with its

complexity and risk profile.

The Board recognizes that supervised insurance organizations are typically less exposed

to traditional liquidity risk than banking organizations. Instead of cash outflows being mainly

the result of discretionary withdrawals, cash outflows for many insurance products only result

from the occurrence of an insured event. Insurance products, like annuities, that are potentially

exposed to call risk generally have product features (i.e., surrender charges, market value 

surrenders, tax treatment, etc.) that help mitigate liquidity risk.

Federal Reserve examiners tailor the application of existing supervisory guidance on 

liquidity risk management to reflect the liquidity characteristics of supervised insurance

organizations. [Footnote 9

- See SR letter 10-6, “Interagency Policy Statement on Funding and Liquidity Risk Management.” End of Footnote 9.]

For example, guidance on intra-day liquidity management would only be

applicable for supervised insurance organizations with material intra-day liquidity risks.

Additionally, specific references to liquid assets may be more broadly interpreted to include

other asset classes such as certain investment-grade corporate bonds.

The scope of the Federal Reserve's supervisory activities on liquidity risk is influenced

by each firm's individual risk profile. Traditional property and casualty insurance products are

typically short duration liabilities backed by short-duration, liquid assets. Because of this, they 

typically present lower liquidity risk than traditional banking activities. However, some nontraditional life insurance and retirement products create liquidity risk through features that allow

payments at the request of policyholders without the occurrence of an insured event. Risks of

certain other insurance products are often mitigated using derivatives. Any differences between

collateral requirementsrelated to hedging and the related liability cash flows can also create
Page 12 of 19

liquidity risk. The Board expects firms significantly engaged in these types of insurance

activitiesto have correspondingly more sophisticated liquidity risk management programs.

A strong liquidity risk management program includes cash flow forecasting with

appropriate granularity. The firm's suite of quantitative metrics should effectively inform senior

management and the board of directors of the firm's liquidity risk profile and identify liquidity

events or stresses that could detrimentally affect the firm. The metrics used to measure a firm's

liquidity position may vary by type of business.

Federal Reserve examiners rely to the fullest extent possible on each firm's ORSA, which

requires all firms to include a discussion of the risk management framework and assessment of

material risks, including liquidity risk.

Supervised insurance organizations are expected to perform liquidity stress testing at

least annually and more frequently, if necessary, based on their risk profile. The scenarios used

should reflect the firm's specific risk profile and include both idiosyncratic and system-wide

stress events. Stress testing should inform the firm on the amount of liquid assets necessary to

meet net cash outflows over relevant time periods, including at least a one-year time horizon.

Firms should hold a liquidity buffer comprised of highly liquid assets to meet stressed net cash

outflows. The liquidity buffer should be measured using appropriate haircuts based on asset

quality, duration, and expected market illiquidity based on the stress scenario assumptions.

Stress testing should reflect the expected impact on collateral requirements. For material life

insurance operations, Federal Reserve examiners will rely to the greatest extent possible on 

information submitted by the firm to comply with the National Association of Insurance

Commissioners' (NAIC) liquidity stress test framework.

The fungibility of sources of liquidity is often limited between an insurance group's legal

entities. Large insurance groups can operate with a significant number of legal entities and many

different regulatory and operational barriers to transferring funds among them. Regulations 

designed to protect policyholders of insurance operating companies can limit the transferability

of funds from an insurance company to other legal entities within the group, including to other

insurance operating companies. Supervised insurance organizations should carefully consider

these limitations in their stress testing and liquidity risk management framework. Effective

liquidity stress testing should include stress testing at the legal entity level with consideration for

intercompany liquidity fungibility. Furthermore, the firm should be able to measure and provide

an assessment of liquidity at the top-tier depository institution holding company in a manner that

incorporates fungibility constraints.

The enterprise-wide governance and oversight framework should be consistent with the

firm's liquidity risk profile and include policies and procedures on liquidity risk management.

The firm's policies and procedures should describe its liquidity risk reporting, stress testing, and

contingency funding plan.

B. Supervisory Ratings

Supervised insurance organizations are expected to operate in a safe and sound manner, 

to comply with all applicable laws and regulations, and to possess sufficient financial and 

operationalstrength to serve as a source of strength for their depository institution(s) through a 

range of stressful yet plausible conditions. Supervisory ratings and supervisory findings are used
Page 13 of 19

to communicate the assessment of a firm. Federal Reserve examiners periodically assign one of

four ratings to each of the three rating components used to assess supervised insurance

organizations. The rating components are Capital Management, Liquidity Management, and

Governance & Controls. The four potential ratings are Broadly Meets Expectations,

Conditionally Meets Expectations, Deficient-1, and Deficient-2. To be considered “well

managed,” a firm must receive a rating of Conditionally Meets Expectations or better in each of

the three rating components. Each rating is defined specifically for supervised insurance

organizations with particular emphasis on the obligation that firms serve as a source of financial

and managerialstrength for their depository institution(s). High-level definitionsfor each rating

are below, followed by more specific rating definitionsfor each component.

Broadly Meets Expectations. The supervised insurance organization's practices and capabilities

broadly meet supervisory expectations. The holding company effectively serves as a source of

managerial and financial strength for its depository institution(s) and possesses sufficient

financial and operationalstrength and resilience to maintain safe-and-sound operations through a 

range of stressful yet plausible conditions. The firm may have outstanding supervisory issues 

requiring corrective actions, but these are unlikely to present a threat to its ability to maintain

safe-and-sound operations and unlikely to negatively impact its ability to fulfill its obligation to

serve as a source of strength for its depository institution(s). These issues are also expected to be

corrected on a timely basis during the normal course of business.

Conditionally Meets Expectations. The supervised insurance organization's practices and

capabilities are generally considered sound. However, certain supervisory issues are sufficiently

material that if not resolved in a timely manner during the normal course of business, may put

the firm's prospects for remaining safe and sound, and/or the holding company's ability to serve

as a source of managerial and financial strength for its depository institution(s), at risk. A firm

with a Conditionally Meets Expectations rating has the ability, resources, and management

capacity to resolve its issues and has developed a sound plan to address the issue(s) in a timely

manner. Examiners will work with the firm to develop an appropriate timeframe during which it

will be required to resolve that supervisory issue(s) leading to this rating.

Deficient-1. Financial or operational deficiencies in a supervised insurance organization's

practices or capabilities put its prospects for remaining safe and sound, and/or the holding

company's ability to serve as a source of managerial and financial strength for its depository

institution(s), at significant risk. The firm is unable to remediate these deficienciesin the normal 

course of business, and remediation would typically require it to make material changes to its 

business model or financial profile, or its practices or capabilities. A firm with a Deficient-1

rating is required to take timely action to correct financial or operational deficiencies and to

restore and maintain its safety and soundness and compliance with laws and regulations.

Supervisory issues that place the firm's safety and soundness at significant risk, and where

resolution is likely to require steps that clearly go beyond the normal course of business - such

as issues requiring a material change to the firm's business model or financial profile, or its

governance, risk management or internal control structures or practices - would generally

warrant assignment of a Deficient-1 rating. There is a strong presumption that a firm with a

Deficient-1 rating will be subject to an enforcement action.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization's

practices or capabilities present a threat to its safety and soundness, have already put it in an
Page 14 of 19

unsafe and unsound condition, and/or make it unlikely that the holding company will be able to

serve as a source of financial and managerial strength to its depository institution(s). A firm with

a Deficient-2 rating is required to immediately implement comprehensive corrective measures

and demonstrate the sufficiency of contingency planning in the event of further deterioration.

There is a strong presumption that a firm with a Deficient-2 rating will be subject to a formal

enforcement action.

Definitions for the Governance and Controls Component Rating

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues,

the supervised insurance organization's governance and controls broadly meet supervisory

expectations, supports maintenance of safe-and-sound operations, and supports the holding

company's ability to serve as a source of financial and managerial strength for its depository

institutions(s). Specifically, the firm's practices and capabilities are sufficient to align strategic

business objectives with its risk appetite and risk management capabilities; maintain effective

and independent risk management and control functions, including internal audit; promote

compliance with laws and regulations; and otherwise provide for the firm's ongoing financial

and operational resiliency through a range of conditions. The firm's governance and controls

clearly reflect the holding company's obligation to act as a source of financial and managerial

strength for its depository institution(s).

Conditionally Meets Expectations. Certain material financial or operational weaknesses in a

supervised insurance organization's governance and controls practices may place the firm's

prospects for remaining safe and sound through a range of conditions at risk if not resolved in a

timely manner during the normal course of business. Specifically, if left unresolved, these

weaknesses may threaten the firm's ability to align strategic business objectives with its risk

appetite and risk-management capabilities; maintain effective and independent risk management

and control functions, including internal audit; promote compliance with laws and regulations; or

otherwise provide for the firm's ongoing resiliency through a range of conditions. Supervisory

issues may exist related to the firm's internal audit function, but internal audit is still regarded as

effective.

Deficient-1. Deficienciesin a supervised insurance organization's governance and controls put

its prospects for remaining safe and sound through a range of conditions at significant risk. The

firm is unable to remediate these deficiencies in the normal course of business, and remediation

would typically require a material change to the firm's business model or financial profile, or its

governance, risk management or internal control structures or practices.

Examples of issues that may result in a Deficient-1 rating include, but are not limited to:

• The firm may be currently subject to, or expected to be subject to, informal or formal

enforcement action(s) by the Federal Reserve or another regulator tied to violations of laws

and regulations that indicate severe deficiencies in the firm's governance and controls.

• Significant legal issues may have or be expected to impede the holding company's ability to

act as a source of financial strength for its depository institution(s).

• The firm may have engaged in intentional misconduct.
Page 15 of 19

• Deficiencies within the firm's governance and controls may limit the credibility of the firm's

financial results, limit the board or senior management's ability to make sound decisions, or

materially increase the firm's risk of litigation.

• The firm's internal audit function may be considered ineffective.

• Deficiencies in the firm's governance and controls may have limited the holding company's

ability to act as a source of financial and/or managerial strength for its depository

institution(s).

Deficient-2. Financial or operational deficiencies in a supervised insurance organization's

governance and controls present a threat to its safety and soundness, a threat to the holding

company's ability to serve as a source of financial strength for its depository institution(s), or

have already put the firm in an unsafe and unsound condition.

Examples of issues that may result in a Deficient-2 rating include, but are not limited to:

• The firm is currently subject to, or expected to be subject to, formal enforcement action(s) by 

the Federal Reserve or another regulator tied to violations of laws and regulations that

indicate severe deficiencies in the firm's governance and controls.

• Significant legal issues may be impeding the holding company's ability to act as a source of

financial strength for its depository institution(s).

• The firm may have engaged in intentional misconduct.

• The holding company may have failed to act as a source of financial and/or managerial

strength for its depository institution(s) when needed.

• The firm's internal audit function is regarded as ineffective.

Definitions for the Capital Management Component Rating:

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues,

the supervised insurance organization's capital management broadly meets supervisory

expectations, supports maintenance of safe-and-sound operations, and supports the holding

company's ability to serve as a source of financial strength for its depository institution(s).

Specifically:

• The firm's current and projected capital positions on a consolidated basis and within each of

its material business lines/legal entities comply with regulatory requirements and support its

ability to absorb potential losses, meet obligations, and continue to serve as a source of

financial strength for its depository institution(s);

• Capital management processes are sufficient to give credibility to stress testing results and

the firm is capable of producing sound assessments of capital adequacy through a range of

stressful yet plausible conditions; and

• Potential capital fungibility issues are effectively mitigated, and capital contingency plans

allow the holding company to continue to act as a source of financial strength for its

depository institution(s) through a range of stressful yet plausible conditions.
Page 16 of 19

Conditionally Meets Expectations. Capital adequacy meets regulatory minimums, both currently

and on a prospective basis. Supervisory issues exist but these do not threaten the holding

company's ability to act as a source of financial strength for its depository institution(s) through

a range of stressful yet plausible conditions. Specifically, if left unresolved, these issues:

• May threaten the firm's ability to produce sound assessments of capital adequacy through a

range of stressful yet plausible conditions; and/or

• May result in the firm's projected capital positions being insufficient to absorb potential

losses, comply with regulatory requirements, and support the holding company's ability to

meet current and prospective obligations and continue to serve as a source of financial

strength to its depository institution(s).

Deficient-1. Financial or operational deficiencies in a supervised insurance organization's

capital management put its prospects for remaining safe and sound through a range of plausible

conditions at significant risk. The firm is unable to remediate these deficiencies in the normal 

course of business, and remediation would typically require a material change to the firm's

business model or financial profile, or its capital management processes.

Examples of issues that may result in a Deficient-1 rating include, but are not limited to:

• Capital adequacy currently meets regulatory minimums although there may be uncertainty

regarding the firm's ability to continue meeting regulatory minimums.

• Fungibility concerns may exist that could challenge the firm's ability to contribute capital to

its depository institutions under certain stressful yet plausible scenarios.

• Supervisory issues may exist that undermine the credibility of the firm's current capital

adequacy and/or its stress testing results.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization's

capital management present a threat to the firm's safety and soundness, a threat to the holding

company's ability to serve a source of financial strength for its depository institution(s), or have

already put the firm in an unsafe and unsound condition.

Examples of issues that may result in a Deficient-2 rating include, but are not limited to:

• Capital adequacy may currently fail to meet regulatory minimums or there is significant

concern that the firm will not meet capital adequacy minimums prospectively.

• Supervisory issues may exist that significantly undermine the firm's capital adequacy metrics

either currently or prospectively.

• Significant fungibility constraints may exist that would prevent the holding company from

contributing capital to its depository institution(s) and fulfilling its obligation to serve as a 

source of financial strength.

• The holding company may have failed to act as source of financial strength for its depository

institution when needed.

Definitions for the Liquidity Management Component Rating:
Page 17 of 19

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues,

the supervised insurance organization's liquidity management broadly meets supervisory

expectations, supports maintenance of safe-and-sound operations, and supports the holding

company's ability to serve as a source of financial strength for its depository institutions(s). The

firm generates sufficient liquidity to meet its short-term and long-term obligations currently and

under a range of stressful yet plausible conditions. The firm's liquidity management processes,

including its liquidity contingency planning, support its obligation to act as a source of financial

strength for its depository institution(s). Specifically:

• The firm is capable of producing sound assessments of liquidity adequacy through a range of

stressful yet plausible conditions; and

• The firm's current and projected liquidity positions on a consolidated basis and within each

of its material business lines/legal entities comply with regulatory requirements and support

the holding company's ability to meet obligations and to continue to serve as a source of

financial strength for its depository institution(s).

Conditionally Meets Expectations. Certain material financial or operational weaknesses in a

supervised insurance organization's liquidity management place its prospects for remaining safe 

and sound through a range of stressful yet plausible conditions at risk if not resolved in a timely

manner during the normal course of business.

Specifically, if left unresolved, these weaknesses:

• May threaten the firm's ability to produce sound assessments of liquidity adequacy through a 

range of conditions; and/or

• May result in the firm's projected liquidity positions being insufficient to comply with

regulatory requirements and support the firm's ability to meet current and prospective

obligations and to continue to serve as a source of financial strength to its depository

institution(s).

Deficient-1. Financial or operational deficiencies in a supervised insurance organization's

liquidity management put the firm's prospects for remaining safe and sound through a range of

stressful yet plausible conditions at significant risk. The firm is unable to remediate these

deficiencies in the normal course of business, and remediation would typically require a material

change to the firm's business model or financial profile, or its liquidity management processes.

Examples of issues that may result in a Deficient-1 rating include, but are not limited to:

• The firm is currently able to meet its obligations but there may be uncertainty regarding the

firm's ability to do so prospectively.

• The holding company's liquidity contingency plan may be insufficient to support its 

obligation to act as a source of financial strength for its depository institution(s).

• Supervisory issues may exist that undermine the credibility of the firm's liquidity metrics and

stress testing results.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization's

liquidity management present a threat to its safety and soundness, a threat to the holding
Page 18 of 19

company's ability to serve as a source offinancial strength for its depository institution(s), or

have already put the firm in an unsafe and unsound condition.

Examples ofissues that may result in a Deficient-2 rating include, but are not limited to:

• Liquidity shortfalls may exist within the firm that have prevented the firm, or are expected to

prevent the firm, from fulfilling its obligations, including the holding company's obligation

to act as a source offinancial strength for its depository institution(s).

• Liquidity adequacy may currently fail to meet regulatory minimums or there is significant

concern that the firm will not meet liquidity adequacy minimums prospectively for at least

one ofits regulated subsidiaries.

• Supervisory issues may exist that significantly undermine the firm's liquidity metrics either

currently or prospectively.

• Significant fungibility constraints may exist that would prevent the holding company from

supporting its depository institution(s) and fulfilling its obligation to serve as a source of

financial strength.

• The holding company may have failed to act as source offinancial strength for its depository

institution when needed.

C. Incorporating the Work of Other Supervisors

Similar to the approach taken by the Federal Reserve in its consolidated supervision of

other firms, the oversight ofsupervised insurance organizations relies to the fullest extent

possible, on work performed by other relevant supervisors. Federal Reserve supervisory

activities are not intended to duplicate or replace supervision by the firm's other regulators and

Federal Reserve examiners typically do not specifically assess firms' compliance with laws

outside ofits jurisdiction, including state insurance laws. The Federal Reserve collaboratively

coordinates with, communicates with, and leverages the work ofthe Office ofthe Comptroller of

the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), Securities and Exchange

Commission (SEC), Financial Crimes Enforcement Network (FinCEN), Internal Revenue

Service (IRS), applicable state insurance regulators, and other relevant supervisors to achieve its

supervisory objectives and eliminate unnecessary burden.

Existing statutes specifically require the Board to coordinate with, and to rely to the

fullest extent possible on work performed by the state insurance regulators. The Board and all

state insurance regulators have entered into Memorandums ofUnderstanding (MOU) allowing

supervisors to freely exchange information relevant for the effective supervision ofsupervised

insurance organizations. Federal Reserve examiners take the actions below with respect to state

insurance regulators to support accomplishing the objective ofminimizing supervisory

duplication and burden, without sacrificing effective oversight:

• Routine discussions (at least annually) with state insurance regulatory staffwith greater

frequency during times ofstress;

• Discussions around the annual supervisory plan, including how best to leverage work

performed by the state and potential participation by state insurance regulatory staff on

relevant supervisory activities;
Page 19 of 19

• Consideration of the opinions and work done by the state when scoping relevant examination

activities;

• Documenting any input received from the state and considering the assessments of and work

performed by the state for relevant supervisory activities;

• Sharing and discussing with the state the annual ratings and relevant conclusion documents

from supervisory activities;

• Collaboratively working with the states and the NAIC on the development of policies that

affect insurance depository institution holding companies; and

• Participating in supervisory colleges.

The Federal Reserve relies on the state insurance regulators to participate in the activities

above and to share proactively their supervisory opinions and relevant documents. These

documentsinclude the annual ORSA, [Footnote 10

- See NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual (December 2017) at

https://content.naic.org/sites/default/files/publication-orsa-guidance-manual.pdf. End of Footnote 10.]

the state insurance regulator's written assessment of the

ORSA, results from its examination activities, the Corporate Governance Annual Disclosure,

financial analysis memos, risk assessments, material risk determinations, material transaction

filings (Form D), the insurance holding company system annual registration statement (Form B),

submissionsfor the NAIC liquidity stress test framework, and other state supervisory material.

If the Federal Reserve determines that it is necessary to perform supervisory activities related to

aspects of the supervised insurance organization that also fall under the jurisdiction of the state

insurance regulator, it will communicate the rationale and result of these activities to the state

insurance regulator.