DEPARTMENT OF THE TREASURY 

FEDERAL INSURANCE OFFICE (FIO) 

FEDERAL ADVISORY COMMITTEE ON INSURANCE (FACI) 

SUMMARY - 6 December 2017 

The Federal Advisory Committee on Insurance (FACI) convened at 1:00pm on 6 December 

2017 in the Cash Room at the US Department of the Treasury, 1500 Pennsylvania Ave., NW, 

Washington, DC, with Daniel Glaser, Chair, presiding. 

In accordance with the provision of the Federal Advisory Committee Act, the meeting was open 

to the public. 

Committee Members Present: 

DANIEL GLASER, President and Chief Executive Officer, Marsh & McLennan Companies, 

Inc., Chair 

LAURA BISHOP, Executive Vice President and Chief Financial Officer, USAA (By proxy, Erin 

Martinko 

KURT BOCK, Chief Executive Officer, COUNTRY Financial (By proxy, Joshua Johnson) 

ELIZABETH BROWN, Associate Professor, College of Business, University of Wisconsin-La 

Crosse 

MARK GRIER, Vice Chairman, Prudential Financial, Inc. 

GEORGE KEISER, Representative, North Dakota House of Representatives 

JAMES (JIM) KELLEHER, Executive Vice President & Chief Legal Officer, Liberty Mutual 

Insurance (Participated by phone) 

SEAN MCGOVERN, Chief Compliance Officer, Head of Government Affairs, XL Catlin 

THEODORE MATHAS, Chairman, President and Chief Executive Officer, New York Life 

Insurance Company (By proxy, George Nichols) 

AL REDMER, Commissioner, Maryland Insurance Administration (By proxy, Robert Baron) 

CHRISTOPHER SWIFT, Chief Executive Officer, The Hartford (By proxy, John Kinney) 

MARIA T. VULLO, Superintendent, New York Department of Financial Services 

KATHERINE WADE, Commissioner, State of Connecticut Insurance Department 

Committee Members Not Attending: 

AMY BACH, Executive Director, United Policyholders 

BIRNY BIRNBAUM, Executive Director, Center for Economic Justice 

QUINCY BRANCH, Chief Executive Officer, Branch Benefits Consultants 

THEODORE (TED) NICKEL, Commissioner, Wisconsin Office of the Commissioner of 

Insurance 

MARGUERITE SALAZAR, Executive Director, Colorado Department of Regulated Industries 

ALSO PRESENT: 

JARED SAWYER, Deputy Assistant Secretary, Financial Institutions Policy, US Department of 

the Treasury 

STEVEN SEITZ, Deputy Director, Federal Insurance Office (FIO) 
LINDSEY BALDWIN, Federal Insurance Office (delegated responsibilities of Designated 

Federal Officer) 

TERRY WILLIAMS, Federal Insurance Office 

WELCOME AND INTRODUCTION: 

FIO Deputy Director, Steven Seitz, welcomed committee members who were able to attend the 

4th FACI meeting of 2017. He gave a brief history of the role of the FACI and its mandate to 

present advice and recommendations to the Federal Insurance Office. He then turned the 

meeting over to Chairman Glaser. 

Chairman Glaser emphasized that FACI helps FIO fulfill its important role. He then thanked all 

members for their contribution. 

Discussion of the New York State Cybersecurity Regulation 

Mr. Glaser introduced FACI Committee Member, Maria Vullo, Superintendent of the New York 

Department of Financial Services (NYDFS), who spoke on the New York state Cybersecurity 

regulation. 

The regulation requires banks, insurance companies and other financial services institutions 

regulated by the NYDFS to establish and maintain a cybersecurity program designed to protect 

consumers’ private data and ensure the safety and soundness of New York’s financial services 

industry. The regulation is the first of its kind at the state level and is similar to the recently 

adopted NAIC insurance data security model law. 

Ms. Vullo explained why a cybersecurity regulation was needed. The reason for the regulation is 

to prevent cybersecurity attacks on the financial services industry. Regulation has two main 

principles: First, to provide minimum standards in order to prevent cybersecurity threats; second 

is the creation of a strong governance framework for the regulated entities in the area of 

cybersecurity. 

[The regulation] sets minimum regulatory standards, it requires a risk-based approach to 

cybersecurity and it’s a scalable approach to accommodate the breadth of the different sizes and 

scales and different businesses of the institutions regulated. We also made sure that the 

standards that we applied were consistent with other laws and standards including NIST, 

HIPPAA, Gramm-Leach-Bliley, etcetera. 

The next provision of the regulation deals with penetration testing and vulnerability assessments. 

Our regulation requires entities to implement certain monitoring and testing as part of the 

program. 

Superintendent Vullo noted the importance of monitoring and testing of regulation to ensure that 

threats of a breach are minimized. This is where “Penetration Testing” comes into play. The 

tester poses as an attacker that attempts to gain unauthorized access to a system. This should be 

done at least annually. 
Vulnerability assessment has to be done at least biannually, which is an automated scan of 

systems which would identify vulnerabilities of the systems and devices. When vulnerabilities 

are identified, patches can be employed. 

The regulation also requires an audit trail which means that the institution has to have as part of 

its policy the documentation and logs so that in the event of an attack they can reconstruct 

financial transactions. 

Access controls. Many cyber-attacks are actually internal mistakes by your own employees; To 

adopt effective access controls to protect against unauthorized access is critically important. 

Mr. Glazer commented on the exceptional quality of the Ms. Vullo’s presentation. He then asked 

if there were any questions. 

Mr. McGovern asked if the state of New York had any inquiries from other regulators who are 

thinking about what they can do and whether there’s anything that New York can do to help 

drive a more consistent international implementation of these kinds of measures, because lots of 

regulators are embarking on this journey and the risk for us is we end up being pulled in lots of 

different directions. 

Ms. Vullo explained that the state of New York has many foreign-based institutions with 

branches in New York and there have been some interactions. 

There was a very robust discussion about many stakeholders--federal and state--that was initiated 

by a question from Representative Keiser of North Dakota. 

Mr. Seitz made a point on information sharing between the federal and the state levels and asked 

whether there is a way for the Treasury Department to be helpful increasing information flow in 

this sector. 

Discussion of the Effect of Recent Natural Catastrophes on the Insurance Industry 

Chair Glazer: So by many accounts the third quarter of 2017 will be the costliest quarter for 

insurers and reinsurers on record. Hurricanes Harvey, Irma and Maria, recent wildfires on the 

West Coast, which unfortunately seem to be continuing, and earthquakes in Mexico might total 

$100 billion or more. 

Due to prudent planning US property and casualty insurers and global reinsurers entered the 

2017 hurricane season with a record amount of claims paying capacity. Insurers and reinsurers 

are and continue to be well-positioned to handle such events. 

The entire insurance market: insurers reinsurers, agents, brokers and regulators, should be 

commended for their preparation for and quick response to these catastrophes that affected so 

many in the United States and abroad. 
The effect of these catastrophes may be far-reaching and long-lasting. Chairman Glaser 

introduced Steve Murray, the CEO of Florida Farm Bureau Insurance and John Kinney, The 

Executive Vice President and Chief Claims Officer at The Hartford. 

Mr. Murray: Over 27 million people were impacted by hurricanes Harvey and Irma. There were 

over 8 million homes, housing units affected. To put the recent storms into perspective, Harvey 

and Irma are likely to be the second and third costliest insured US catastrophes ever, larger than 

9/11 and trailing only Katrina. Hurricane Maria comes in just a few places behind, greater than 

Sandy or the Northridge earthquake. The figures for these three storms include actual estimates 

based on insurance company claim reports and the range estimates from RMS, a leading 

modeling firm. 

Despite record storm activity in 2017, primary insurers and reinsurers remain financially strong 

and resilient. While the 2017 catastrophes my ultimately be a capital loss, not merely and 

earnings event, the expected losses are still a small fraction of the surplus of the primary and 

reinsurer’s market, meaning that our industry is still strong and well-positioned to fulfill our 

commitments to consumers. 

Mr. Murray finished his remarks by saying that it is interesting to note in the 2017 hurricanes the 

significant percentage of private flood insurance in place. While the strength of both the private 

and federal flood insurance programs will be necessary for claims payment and the rebuilding 

effort, the private flood coverage provided, mostly commercial, is expected to be several times 

greater than NFIP’s flood losses. In fact, based on the recent closed claims averages for NFIP. 

PCI estimates that the total about from the Harvey claims will be about $8 billion and less than 

$1 billion from Irma. 

Mr. Kinney’s of the Hartford opened by giving a little background of his company and noted that 

it is one of the oldest companies in the industry, with over 18,000 employees, 7,000 of whom are 

in the claims department. 

Mr. Kinney emphasized the unique abilities of the Hartford to be flexible and manage data. At 

the end of the day, to be able to react to changing environments quickly to the data forms the 

basis for your preparation. 

He reminded the committee that after a catastrophe there is a great potential for fraud. He 

mentioned that his company and the government agencies should make an effort to detect fraud. 

Chair Glaser: Noted Executive Order 13772, issued by President Trump, which established the 

policy of his administration to regulate the US Financial system in a manner consistent with a set 

of core principles. Chairman Glaser then introduced Jared Sawyer, the Deputy Assistant 

Secretary for Financial Institutions Policy at the Treasury Department. 

Chairman Glaser noted that, as required by the executive order, the Department of the Treasury 

under the direction of Secretary Mnuchin, submitted to the President a series of reports that 

identify laws, treaties, regulations and other requirements that promote or inhibit regulations and 
other requirements that promote or inhibit regulation of the US financial system from operating 

in a manner consistent with the executive order’s core principles. 

The third and most recent report addressed the asset management and insurance industries with 

specific examination of the regulatory structure of financial entities and products in these 

industries. 

Published in October, the Asset Management and Insurance Report makes a number of 

recommendations regarding insurance regulation, including a number of directives aimed to 

increase the transparency and coordination of US insurance regulators and policymakers, 

especially with respect to international insurance matters. 

The report also calls for policy makers and regulators to improve efforts to address cybersecurity 

concerns, the establishment of the National Association of Registered Agents and Brokers, the 

establishment of a Long-Term Care Insurance Task Force, and to renew considerations of the 

merit of an activities-based approach to addressing systemic risk, among other things. 

Mr. Jared Sawyer, Deputy Assistant Secretary for Financial Institutions Policy at the Department 

of the Treasury. Highlighted the number of new developments from the Federal Insurance Office 

and Treasury as it relates to insurance this year. Most notably the Executive Order Report and 

several recommendations in the insurance. Mr. Sawyer also detailed Treasury’s FSOC Report 

which made a number of recommendations that are applicable to the insurance industry.

Also, as part of Executive Order 13772, the President directed the Secretary of the Treasury to 

evaluate the existing financial regulatory framework and ensure that it was consistent with those 

core principles. And if we found that there were areas where there were inconsistencies or 

misalignment, we were to make certain recommendations. 

Those core principles focused on ideas like ensuring that consumers have choice in the 

marketplace, making sure that investors have access to products and choices and are protected, 

making sure that American firms are competitive internationally and rightsizing and harmonizing 

our regulatory framework. 

Now this undertaking across the three reports that we’ve published so far as it relates to the 

executive order have covered banks, credit unions, our capital markets and then asset 

management insurance with a fourth report planned for early next year focused on non-banks, 

fin-tech and other types of innovation. 

The way we’ve approached these reports is to meet with a wide variety of stakeholders that 

encompass market participants, consumer groups, thin thanks, legal experts and other interested 

parties in an open-door approach because we really want to hear from all sides on how the 

regulatory framework aligns with those core principles, how it’s working. This is a good time--

several years post-crises--to do a stop and study of how things have progressed. 
The first report came out in June and focused on banks and credit unions. The second report 

came out in October on the Capital Markets. A lot of attention [was placed] on how regulation 

affects the functioning of our markets. 

Mr. Sawyer noted that the United States has the largest asset management and the largest 

insurance sector on the globe and that this is a testament to the regulatory framework we 

currently have, but believes in evaluating that regulatory framework and noted that Treasury did 

find some areas where things can be rightsized or tweaked to be even more effective and 

efficient. 

The Asset Management and Insurance Report largely focused on four themes: ensuring 

appropriate evaluation of systemic risk and solvency; promoting efficient regulation and 

government processes; strengthening US engagement in international forums; and, promoting 

economic growth and informed choices. 

As part of those five pillars Treasury focused on making sure that FIO can be a federal insurance 

expert for the other parts of the Federal Government. So when it did a due diligence in its 

analysis of the Federal Government and all the insurance programs outside of health insurance 

Treasury found a number of areas where we can be a resource to other federal agencies. 

 

What comes to mind is the National Flood Insurance Program, particularly when they are 

exploring ways to look at credit risk transfer purchasing reinsurance. Treasury has a team that is 

well-steeped in the reinsurance market and can provide assistance to other federal programs. 

Obviously, there is a huge role for FIO and this Department in particular in administering the 

Terrorism Risk Insurance Program (TRIP), so we make a number of recommendations on how 

that process can be improved: public notice, more transparency when evaluating certain events 

that might trigger the program’s features. 

Cyber insurance and cybersecurity are two issues of critical importance. Cybersecurity is one of 

the top priorities of the Secretary. Treasury has a role from a cybersecurity operational 

standpoint as the sector-specific coordinator for cybersecurity-related issues and focus of 

attention not on setting standards, but advancing best practices, establishing better information 

flows, better communication processes, making sure that companies are ready to respond and 

recover if they ultimately have an event. Treasury hosts a number of simulated exercises to 

provide a healthy forum for companies to test run their communications, both public and private 

and amongst the sector themselves. 

On data security or cybersecurity generally in setting the standards Treasury is supportive of the 

NAIC’s work in establishing a data security standard through the model law process, but 

something to really stress in that area is cyber is certainly a national issue and there is certainly a 

lot of interest on Capitol Hill and amongst federal regulators on setting a national standard. 

Treasury is supportive of the states taking action here, and so we urge a harmonized and 

consistent and quickly-implemented data security standard in all 50 states. Treasury also 

advocates if that’s not achieved within five years that Congress should take some action because 

this is a national issue. 
Mr. Sawyer then discussed Treasury’s FSOC Report, noting that the concept of shifting to an 

activities-based approach is an important one to the Department. Such an approach is consistent 

with our FSOC Report where Treasury calls for prioritizing an activities-based or industry-wide 

approach to address risks to US financial stability. 

Treasury also made recommendations on increasing the analytical rigor of the designation 

analysis process. That’s something we’ve certainly heard from a number of stakeholders through 

our engagement. Improve engagement and transparency at all stages of the designation process 

and just simplify FSOC’s processes generally. Mr. Sawyer noted the increased attention 

regarding a clear off ramp so firms that may be designated know the expectations for becoming 

de-designated. 

Mr. Sawyer then discussed the EU/US Covered Agreement and noted that Secretary Mnuchin 

charged staff with taking a very comprehensive stakeholder engagement process before he 

ultimately decided to sign the Agreement, in coordination with USTR. Treasury wanted to hear 

the concerns and the pros of the agreement from all parties: large companies, small companies, 

middle-size companies, consumer advocates, our international counterparts, but most importantly 

state insurance commissioners who would be charged with implementing the Agreement. 

As a result of that stakeholder process we also published at the time of signing a US policy 

statement which clearly outlined how the United States would view and approach 

implementation of the covered agreement. There were a number of areas that were brought to 

Treasury’s attention where the covered agreement could be clearer on issues like reinsurance 

collateral being retrospective or prospective the removal of that collateral on supervision and the 

calculation of capital, and also on the sharing of information between jurisdictions. These were 

areas that process really crystallized for Treasury to provide further clarity, and we did so with a 

very strong US policy statement. 

Mr. Sawyer then requested that Mr. Steven Seitz discuss about some of the developments on the 

international front and some of our recommendations and recent activities. 

Steven Seitz: Discussed a few of the recommendations in the Executive Order Report that relate 

to our international work and then just highlight a few of the recent developments at the IAIS, 

the FSB and in other bilateral and multilateral dialogues. 

The first theme in Treasury’s international section is the improved Team USA coordination. This 

is something FIO has taken very seriously over the last several months. As Commissioner Nickle 

noted at the last meeting, Treasury feels that it has made progress that has resulted in some of the 

recent developments we have seen at the IAIS and the FSB over the last few months.

The first issue is the Group Capital Initiative. There was a recommendation that the states, the 

NAIC and the Federal Reserve harmonize their respective group capital approaches in an effort 

to minimize duplicative and unnecessary burdens. There was an announcement last month in 

Kuala Lumpur regarding the ICS that mentioned explicitly the work that is ongoing here in the 

US with the aggregation approach and how that will be assessed by the IAIS. This is a new 

development regarding the Insurance Group Capital Standard. 
Mr. Seitz then discussed the activities and the entities-based report in international forums and 

noted the work underway internationally at the IAIS over the last year on developing this 

approach to assessing systematic risk and this is work that FIO has been involved in with the 

other US members of the IAIS. 

Mr. Seitz then noted that the FSB made a statement a few weeks ago regarding that it would not 

be publishing a 2017 G-SIB list and welcomed and encourages the work that the IAIS is doing 

on the activities-based approach, and that the IAIS will have an initial consultation paper at the 

end of 2018 with the goal of finalizing the project by the end of 2019. 

New Business and Closing Remarks 

Chairman Glaser thanked everyone. 

At 4:40pm, Chairman Glaser concluded the meeting.