Legal and regulatory updates

1. IVASS Expectations on outsourcing

On 13 November 2024, the Italian Insurance Supervisory Authority (IVASS) issued consultation paper no. 8/2024 (the Consultation Paper) on a draft letter to the market aimed at clarifying supervisory expectations on outsourcing as per Regulation no. 38/2018 in matter of corporate governance system of insurance undertakings (Regulation 38).

Regulation 38 applies only to (re)insurance undertakings with legal seat in Italy, branches of non-EU insurance undertakings and to the ultimate Italian parent undertakings. Only Parts I, III and IV of Regulation 38 apply to the ultimate Italian parent undertakings.

In the Consultation Paper, IVASS underlines that the use of outsourcing is growing in the Italian market. The Supervisory Authority is closely monitoring the activity of insurance undertakings to verify that the outsourced functions and the methods of outsourcing don't cause harm to the corporate governance system. It also wants to check that outsourcing doesn't increase the risk of insurance undertakings becoming an empty entity (so-called empty shell).

IVASS issued the Consultation Paper to indicate to insurance undertakings its expectations on how outsourcing should be exercised.

In the Consultation Paper, IVASS indicates that the draft letter to the market is also addressed, in addition to the insurance undertakings to which apply Regulation 38, to the ultimate Italian parent company of a national sub-group with the ultimate European controlling parent company when IVASS decides to exercise its supervisory activity on such sub-group.

The draft letter to the market in the Consultation Paper contains nine expectations regarding:

• governance and risk management aspects
• safeguards adopted by insurance undertakings on the outsourced functions or activities
• outsourcing of Information and Communication Technologies (ICT) services
• preventive notifications regarding the outsourcing of essential or important activities or functions, pursuant to Article 67, paragraphs 1 and 2, of Regulation 38
• communications pursuant to Article 67, paragraphs 6 and 7, of Regulation 38 (ie respectively, communication on the modification of the outsourcing of the function/activity and communication on the termination of the outsourcing agreement

Below, we look at IVASS' expectations on outsourcing.

 

Expectations on governance and risk management aspects

Expectation 1

IVASS expects insurance undertakings to:

• enhance the role of the administrative body in the decision-making process of the outsourcing of fundamental functions and of essential or important activities/functions to allow the administrative body to be fully aware of the results of the outsourcing agreements in place, the degree of dependence of the insurance undertaking on external providers and the related risks;
• consider using providers to carry out fundamental functions or essential or important activities/functions that are an integral part of the business strategies approved by the administrative body.

Expectation 2

IVASS expects insurance undertakings to:

• evaluate, in examining the adequacy of the structures and professionalism of the chosen provider, the main types of outsourcing risks and at least the following ones: operational, concentration, sub-outsourcing, legal, reputational, IT, lock-in (eg excessive dependence on one provider);
• consider the outcome of the evaluation, also in defining the measures provided for in article 65, paragraph 3, of Regulation 38, to ensure the continuity of activities outsourced in the event of interruption or serious deterioration in the quality of the provider's service, including adequate contingency plans or re-internalization of activities.

Expectation 3

IVASS expects that:

• a specific report on the results of the outsourcing agreements is presented to the administrative body during their validity period, with evidence of the critical issues.

 

Expectations on the safeguards adopted by insurance undertakings on the outsourced functions or activities

Expectation 4

IVASS expects that:

• as part of the periodic checks provided for in article 65 of Regulation 38, a risk analysis, similar to the one that is carried out when signing the outsourcing agreement, is carried out, to verify that no changes have occurred that could affect the evaluation of the outsourced activity.

Expectation 5

IVASS, to have knowledge of the activity carried out by the provider and to promptly inform the administrative body of any critical issues, expects insurance undertaking to:

• include “Service Levels” (SLAs) in contracts that define an adequate quality standard to which the provider must comply, the measurement of these standards through the identification of specific indicators (key performance indicators, KPIs), and any penalties applicable to the provider if they fail to fulfil the agreed service levels;
• adopt processes that allow them to evaluate:
• compliance with SLAs
• the regular performance of the KPIs
• the causes of any failure to comply with the KPIs and service levels provided to clients
• the measures undertaken by the provider and the timing of their implementation to overcome any critical issue
• the possible application of the penalties provided for in the contract
• adjustments, modifications and additions to the contract, taking into account the evolution of services

• not result in complex chains of sub-providers that could affect the ability of the transferring company to verify the adequate performance of the outsourced activity or function.

 

Expectations on outsourcing of ICT

Expectation 6

IVASS expects insurance undertakings:

• to proactively align their management and control models with the DORA Regulation, with particular regard to adopting a strategy dedicated to informatic risk, based on the constant examination of all dependencies on third parties in the ICT sector and including a policy for using ICT services to support critical or important functions provided by third-party providers.

 

Expectations on preventive notifications regarding the outsourcing of essential or important activities or functions, pursuant to article 67, paragraphs 1 and 2, of Regulation 38

Expectation 7

As part of the process of identifying essential or important activities or functions, IVASS expects that the activities or functions are presumed as such, and therefore subject to the obligation of the preventive communication to IVASS. Those activities or functions include:

• designing insurance products with the related definition of tariffs
• investment management
• managing and settling claims (including the use of call centres)
• complaint management
• regular and constant provision of accounting support
• providing ICT services
• the ORSA process

 

Expectations on the communications pursuant to Article 67, paragraphs 6 and 7, of Regulation 38

Expectation 8

IVASS expects that:

• it receives in advance a communication on the appointment from the assigning company to a new provider;
• the sub-outsourcing of the outsourcing contract is not communicated in advance, since it's expected that the provider can carry out the outsourced activity, rather than directly, through sub-outsourcing, within the terms and conditions set in the outsourcing contract;
• from the point of view of the contractual content, it receives communication on the inclusion in the outsourcing agreement of a further service, in addition to the one initially agreed, which modifies the activity being provided. For example, in the case of outsourcing management phases concerning an insurance class different from the one to which it refers the original outsourcing (eg the outsourcing of the management of general third party liability claims in addition to that of MTPL claims already outsourced).

Expectation 9

IVASS expects that:

• outsourcing an essential or important function or activity to a new provider following the natural expiry of the previous outsourcing contract, constituting a new outsourcing, must be notified in advance, within the time limits laid down in Article 67(1) and (2) of the Regulation.

The Consultation Paper is available, in Italian, here.

All comments and proposals should be sent to IVASS, by December 14, 2024, using the table attached to the Consultation Paper to this email address: letteraalmercatoesternalizzazione@ivass.it

 

2. RIGA procedure: “Shareholders” and “holdings” forms updated

On November 7, 2024, as part of the process of evolutionary maintenance of IT applications, IVASS released an update of the RIGA procedure for “Shareholders and Shareholders' Agreements” and “Qualifying Holdings in Undertakings” forms.

The changes introduce new automatic checks aimed at ensuring higher quality and accuracy of the data transmitted.

The modifications don't change the structure of the reports, since the content of the information remains the same.

In particular, the following automatic checks on the sent information have been designed:

• checking the size of shareholders' holdings;
• validating tax codes and VAT numbers with the Bank of Italy's Register of Subjects;
• consistency checks on validity dates related to shareholders, funds, agreements and holdings.

Any inconsistencies with the data in the historical archive will be communicated via Infostat message. For technical assistance and clarifications, companies should use the email address provided in the operational guide. A new updated version of the operational guide is available in the “Data Collection” section of the IVASS website.

 

3. EIOPA releases opinion on the scope of DORA in light of the review of the Solvency II framework

On November 15, 2024, the European Insurance and Occupational Pensions Authority (EIOPA) published its opinion on the impact of the increased size thresholds regarding exclusion from scope of Solvency II as part of the Solvency II Review on insurance undertakings in the scope of the Digital Operational Resilience Act (DORA).

Insurance undertakings have to comply with DORA from January 17, 2025. But at the date the reviewed Solvency II framework applies, they might be exempted from DORA.

In its opinion, EIOPA is calling on the European Commission to take the necessary actions so small insurance undertakings don't make disproportionate compliance efforts in the transition period before the application of the revised Solvency II Directive.

Read EIOPA's opinion here.

 

4. ESAs publish 2024 joint report on principal adverse impacts disclosures under the Sustainable Finance Disclosure Regulation

On October 30, 2024, the European Supervisory Authorities (ie EBA, EIOPA and ESMA – (ESAs)) published a 2024 joint report on principal adverse impacts disclosures under the Sustainable Finance Disclosure Regulation.

The joint report assesses both entity and product-level Principal Adverse Impact (PAI) disclosures under the SFDR. It aims to show the negative impact of financial institutions’ investments on the environment and people and the actions taken by asset managers, insurers, investment firms, banks and pension funds to mitigate them.

The joint report shows that financial institutions have improved the accessibility of their PAI disclosure and the quality of the PAI statement. And there's been some slight improvement in the compliance with the SFDR disclosures in some European markets.

The joint report includes ESAs' recommendations to National Competent Authorities to ensure convergent supervision of financial market participants’ practices, and to the European Commission for their comprehensive assessment on the SFDR.

Read the joint report here.

 

5. EIOPA sets methodology for calculating value for money

On October 7, 2024, EIOPA published news on its website concerning EIOPA's methodology on setting value-for-money benchmarks for unit-linked and hybrid insurance products. The aim is to tackle several issues identified by the European national authorities related to the mismatch between consumers' expected returns and the actual benefits received, or to unjustified costs, fees and penalties in the unit-linked and hybrid market (the Benchmark Methodology).

Since value-for-money is proved to have a significant impact on consumers' trust, it became a key priority for EIOPA to promote a consistent and convergent approach across all member states.

Following the publication of EIOPA's Supervisory Statement on value-for-money in 2021, some jurisdictions laid down expectations on value-for-money assessments and developed work on benchmarks (like Italy with its Letter to the Market of March 27, 2024). So EIOPA also started working on developing value-for-money benchmarks (VfM benchmarks) with the objectives of helping:

• National Competent Authorities (NCAs) in identifying products with higher value for money risks and promoting a more efficient and risk-based approach to conduct supervision; and,
• insurance product manufacturers in identifying comparable offers to determine if their products offer value, including the assessment of costs for consumers to ensure they're due and proportional to the expenses borne by the provider and the benefits offered to policyholder.

As a result of this work, EIOPA launched a public consultation in December 2023 on its proposed methodology for setting VfM benchmarks for unit-linked and hybrid insurance products. The Benchmarks Methodology published results from stakeholders’ feedback received during the public consultation and the execution of a data pilot in several member states.

The reference benchmarks

According to EIOPA, manufacturers of insurance products shouldn't consider benchmarks as a “safe harbour” since they should continue to ensure that all costs are identified, quantified, due and consistent with the target market's needs.

Moreover, benchmarks shouldn't be seen and used as price regulation. In fact, EIOPA is aware that the benchmarks cannot capture all products’ specificities and consumers’ needs as they're varied in nature and shouldn't be used as a consumer disclosure tool. The nature of the indicators and the product clustering process require in-depth technical knowledge of the Benchmark Methodology, which might not be easy for most consumers to understand.

Nonetheless, benchmarks are the reference points which, as anticipated:

• support NCAs in their supervisory activities, allowing them to identify unit-linked and hybrid products that pose higher value-for-money risks; and
• when discussed with national supervisors and eventually shared with insurance product manufacturers, enable them to identify the costs and benefits of comparable offers in the market and facilitate their product testing and pricing process, including assessing that all costs are proportionate and due.

In the Benchmark Methodology, benchmarks are carried out at the level of the combination of wrapper plus specific option (for instance, if one product offers ten investment options, there will be ten possible combinations of wrapper plus specific investment option).

The Benchmark Methodology

The Benchmark Methodology outlines a three-step approach to create reference benchmarks:

1. Features for product clusters: due to the existence of insurance wrappers offering the possibility to invest in a multitude of underlying investment options, EIOPA decided that “product clustering” will be useful for the consumer. Investment options are divided into two categories:

• Individual investment option: meaning an external or internal fund, a profit participation component or direct lines like stocks or shares.
• Combined investment option: the combination of multiple external or internal funds according to a pre-determined investment allocation/strategy, either fixed or dynamic, which is predefined by the insurance undertaking.

But, since the policyholder's perspective might differ from the manufacturer's, the following principles contained in Annex I of the Benchmark Methodology apply:

• Data collection and benchmarks’ calibration will be carried out at the level of the combination of wrapper plus specific option, and they should be inclusive of all costs.
• Manufacturers will have to report a set of values to calculate value-for-money indicators for each combination of wrapper plus specific investment options.
• Manufacturer’s reporting of data concerning the wrapper plus specific option should be sufficiently varied to populate the highest number of clusters and allow the calculation of the respective benchmarks.
• In case of Multi-Option Products (MOPs), the data will be collected at the level of the most sold, the most expensive and the cheapest combination of wrapper plus specific investment option. In case of hybrid products with pre-determined strategy, the reporting can be reduced given the more limited number of options available.
• The selection of the most expensive and the cheapest combination is based on reduction in yield at recommended holding period (RIY at RHP), whereas the most sold refers the gross written premium (GWP).

To avoid confusion about whether one product falls within more than one cluster, different versions of the same wrapper will be considered as different products and fall within their respective clusters.

To ensure an adequate number of clusters with homogeneous products, the Benchmark Methodology contains minimum clusters that can be further developed depending on data availability and the initial setting of benchmarks.

The minimum clusters are based on six clustering features resulting in a maximum of 204 product clusters (for all product categories), and one extra feature for the profit participation component resulting in 12 additional product clusters. This doesn't mean that all clusters will be populated in the first exercise given that all possible combinations of clustering features might not be available or be representative of the market. Annex II includes the representation of the minimum clusters resulting from the combination of the following features:

• Product category: distinguishes between pure unit-linked and hybrid products in which the unit-linked part is combined (or can be combined) with profit-sharing features. Due to the heterogeneity of fund allocation approaches between unit-linked and profit-sharing, it is necessary to create subcategories of hybrids.
• Premium frequency: refers to the different needs of consumers in terms of premium payments. Two main categories are included:
• single
• regular

• Recommended holding period (RHP): three categories are considered:
• short: ie insurance wrapper with less than 10 years RHP
• medium: ie insurance wrapper between 10 and 20 years RHP
• long: ie insurance wrapper with more than 20 years RHP

• Level of biometric coverage: differentiates products that offer a significant level of coverage for consumers from the premium paid to RHP. Two categories are considered:
• significant
• If short RHP: insured event scenario at RHP covering 150% or more of the premium paid at that time.
• If medium or long RHP: insured event scenario at half RHP covering 120% or more of the premium paid at that time.
• other: all other cases.
• Underlying asset classes: considers the most relevant asset classes and applies to pure and hybrid unit-linked products. Where there's more than one asset class supporting the product, the predominant asset class at the start of the contract will be considered. Three categories are developed for this grouping feature:
• equity
• asset allocation funds
• rest
• Summary risk indicator (SRI): will allow to differentiate between risk of the investments and foster comparison between similar products. SRIs are grouped in two or three categories according to the underlying asset class.

Even though these criteria are listed in the document, EIOPA states that final clusters and benchmarks will be fully determined once a full dataset is available.

1. VfM indicators around which benchmarks will be calculated: benchmarks will be calculated for each cluster based on a list of indicators covering costs and returns. The indicators cover very important metrics for assessing value-for-money considering the costs and benefits of the products. All indicators will also be assessed during the first calibration exercise and revised if the analysis of the collected data shows a low level of statistical significance. Here are the indicators reported in the Benchmark Methodology:

1. Entry costs: the costs paid at policy subscription.
2. Total costs indicator: the assessment of all costs borne by the policyholders.
3. Reduction in yield (RIY): its calculated according to the PRIIPs KID methodology with both wrapper and investment costs.
4. Surrender: according to EIOPA, comparing the surrender value with the premium paid will provide valuable information to the value-for-money assessment.
5. Internal rate of return (IRR): its calculated according to PRIIPs KID methodology with the RHP of the underlying investment.
6. Insurance benefit: the premium which is given back to consumers if the insured event occurs.
7. Break-even return: this metric will enable to understand the minimum performance of the underlying investment which is required to break even.

According to EIOPA, these indicators should be evaluated jointly to assess them in a comprehensive manner.

Finally, EIOPA will evaluate the composition of the clusters and, if necessary, implement further adjustments to benchmarks applicable and/or adapt clustering criteria.

1. Data collection and calibration of the benchmarks: following the collection of data from undertakings and the calculation of the indicators, benchmarks will be established for each cluster based on the quartiles of the distribution of the indicators. Benchmarks will be set at the third quartile (Q3), except for the surrender, IRR and insurance benefit indicators for which benchmarks will set at the first quartile (Q1). Because, as opposed to the other indicators, lower values represent higher value for money risk. Considering that the indicators and benchmarks require testing and possible adjustments, the methodology refers to the initial benchmark calculations, but, to limit the burden on the market, EIOPA will rely on the data collection process attached to the annual Cost and Past Performance (CPP) report and readjust the questionnaire and scope to ensure the collection of suitable data for both CPP report and benchmarks.

Finally, the Benchmark Methodology has a section called “non-clustering features and other considerations” in which EIOPA states that all the abovementioned steps of the methodology don't consider other qualitative benefits that unit-linked and hybrid products can offer to consumers. Therefore, EIOPA will also collect data and inform NCAs about the following important features:

• Guarantees: both 80% or more premium guaranteed at RHP and the effective date of the guarantee could be a reason for higher costs.
• Digitalization: EIOPA will identify and share with NCAs the value of adding digital features to insurance products.
• Risk mitigation techniques: the existence of dynamic allocation between a minimum number of assets during product lifecycle and/or between a significant number of countries/currencies/other characteristic (with the purpose of mitigating financial risks) could be considered a reason for higher costs.
• High number of early surrenders and high exit costs/penalties: useful to determine if surrender metrics require investigation.
• Claims rejected for the biometric coverage: to determine, for instance, if value-for-money issues exceeds the analysis of insurance benefit indicator and demands NCAs further analyse riders, claims management and exclusions.
• Results from previous years' exercises.
• Materiality of the product: in view of the risk based of the Benchmark Methodology, NCAs can decide, for example, to entail higher costs/lower benefits because of the specific market targeted.

It's important to highlight that EIOPA plans to conduct a regular review of the Benchmark Methodology to ensure adjustment and improvement over time. Specifically, the Benchmark Methodology will be reviewed on a two-year basis until a certain stability is reached. Moreover, EIOPA doesn't plan to share benchmarks with insurance product manufacturers and/or publish them before dialogue with NCAs and only when the methodology is sufficiently tested and stable. Instead, EIOPA will circulate the benchmarks to NCAs for supervisory purposes (such as, as mentioned above, identifying products with higher value-for-money risks).

Finally, even though EIOPA considers them two separate areas, the developments in the area of value-for-money within the Retail Investment Strategy (RIS) may inform future reviews of the Benchmark Methodology. Indeed, the Insurance Distribution Directive (IDD) don't explicitly refer to value-for-money benchmarks. Nevertheless, Article 25 of the IDD requires insurance product manufacturers to have product oversight governance arrangements and a product approval process.

Read EIOPA's Supervisory 2021 Statement (in English).

Read EIOPA's public consultation of December 2023 (in English).

Read the Benchmark Methodology (in English).