Directors we advise have been proactive in considering expanding the uses for existing captives. New and existing captive directors are now carefully contemplating, and in many cases underwriting, emerging risks as part of their risk selection. For example, risks relating to cannabis (where federally legalised) and cyber-related risks. The Bermuda Monetary Authority (BMA) has generally encouraged, and in some cases required, governance oversight of captive boards to consider the operational risks of their information technology infrastructure, operations outsourcing, cybersecurity, privacy law developments, and the advancements in the use of Artificial Intelligence in a captive’s operations. The BMA’s Insurance Sector Operational Cyber Risk Management Code of Conduct (Cyber Code) was published to promote such governance requirements, which extends to the secure management of information technology system, outsourcing best practices and related disaster recovery and contingency planning.
Captive directors are also carefully monitoring legal and regulatory developments along with global trends, for example ESG-related themes in leadership and risk management. In that regard, captive directors are looking at ESG-related risks that may impact their cedant organisations, for example risks relating to global warming and de-carbonisation while also considering internal changes, for example appointments to captive boards that promote greater social equity, diversity and inclusion.
One particular field of emerging regulatory compliance that will demand director oversight relates to the collection, use and sharing of personal information. In the near future, each captive in Bermuda will be required to appoint a representative ( their “privacy officer” ) who will be responsible to ensure the captive’s compliance with the Personal Information Protection Act 2016, as amended, which will come into force on January 1st, 2025. One of the responsibilities of the privacy officer will be to conduct all communications of the captive with the Privacy Commissioner. The role of the privacy officer cannot be outsourced to an unrelated corporate services provider, although that role can be filled by a person from within the captive’s group of affiliated companies. That person does not need to be based in Bermuda but they must be “accessible” by the captive and the Privacy Commissioner.
Of course, there are many other important topics and considerations, but the above aspects of Board oversight have been coming up fairly regularly in our experience.