Section 292 of the Solvency Regulation (as of 01.01.2007)
Insurance and other risk transfer mechanisms

(1) 1Insurance and other risk transfer mechanisms may be recognised when determining the capital requirement for operational risk. 2The alleviation of the capital requirement for operational risk resulting from recognition of risk transfer mechanisms shall not exceed 20 per cent of the capital requirement before recognition of risk transfer mechanisms.

(2) 1Insurance may be recognised only if all the following requirements have been met:

1. the provider is authorised to conduct insurance or reinsurance business,

2. the provider has an appropriate credit quality,

3. the insurance policy has an initial term of at least one year,

4. where a period of notice for cancellation is stipulated in the insurance contract, this shall be at least 90 days,

5. the insurance policy has no exclusions or limitations triggered by supervisory actions,

6. the insurance policy has no exclusions or limitations that preclude recovery of damages or expenses if the institution becomes insolvent,

7. the insurance coverage is recognised in a manner that is transparent and consistent with the actual probability and severity used in the determination of the capital requirement for operational risk,

8. the insurance is provided by a company that is not included in capital consolidation, or else the insured risk was laid off to an independent third-party entity, that meets the eligibility criteria for recognition of insurance, through reinsurance or other measures, and

9. the framework for recognising insurance is well reasoned and documented.

2 Events which occur after the initiation of insolvency or liquidation proceedings are excluded from the requirement stipulated in sentence 1 number 6. 3Insurance pursuant to sentence 1 shall not include any recovery of fines or other penalties which an institution has to pay as a result of action by the supervisory authorities.

(3) When recognising insurance, appropriate haircuts shall be made for insurance policies with a period of notice or residual term of less than one year and for uncertainty of payment and for insurance coverage mismatches. If an insurance policy has a residual term of less than 90 days, it shall not be recognised for risk mitigation purposes.

(4) Other risk transfer mechanisms may be recognised if the institution can demonstrate that they achieve a noticeable and reliable mitigation of operational risk.

Explanatory comments

On subsection (1)

Risk transfer mechanisms are insurance contracts or other mechanisms which provide a supplementary coverage for an institution's operational risks or parts of those in addition to the capital backing. To recognise those mechanisms within the capital calculation, it is sufficient that a part of the covered events is borne by third parties.

Third parties shall have an adequate solvency and sufficient risk bearing capacity which is independent of the institution's capital backing. Outsourcing agreements do not count as risk transfer mechanisms. The 20% limit applies to insurance and other risk transfer mechanisms combined.

On subsection (2)

No. 1: If insurance cover is provided by a company domiciled outside the European Union, it is incumbent upon the institution to demonstrate that the insurance company is authorised to provide insurance or re insurance.

No. 2: An insurance company has an adequate solvency if it has a rating in a creditworthiness category of Step 3 or better, pursuant to the provisions of the Solvency Ordinance relating to the risk-weighting of claims of credit institutions in the Standardised Approach for credit risk, and if the rating is placed by an external credit assessment institution which BaFin recognizes. Up to date ratings based not only on publicly available data are preferred. If an insurance company has ratings that have to be placed in different categories and they do not all satisfy the criteria, the inclusion of the insurance in the AMA has to be consulted with BaFin.

No. 7: The impacts of insurance contracts on the risk situation of the institution may be recognised in different places in the risk measurement system. The assumptions underlying the recognition of insurance must be consistent with the data and assumptions used elsewhere in the model. Because of the high aggregation of data in the model, the assumptions may be based on expert estimates in conjunction with historical empirical values.

No. 8: In order for the alleviation of the capital requirement by means of an insurance contract in the AMA to be accepted, it is necessary that, under the terms of the insurance contract included, the financial impacts of one or more potential risk events be mitigated by insurance cover being provided that covers in part at least the impact of the risk event on the institution's capital adequacy or earnings situation. To that extent, for the purposes of recognising insurance provided by insurance companies that have to be included in the capital consolidation, special criteria have to be met.

Pursuant to EU Directive 2006/48/EC, insurers included in the capital consolidation comprise in particular intra-group insurers (known as "captives") and affiliated companies. These are taken into account in the determination of the capital to be set aside at the solo, group or financial conglomerate level either by capital deduction or by consolidation of risk assets (see also section 10 (6) sentence 1, no. 5 and 6, and sentence 5, sections 10a (6) and 10b of the Banking Act (KWG)), in order to avoid capital being earmarked twice for risks from the insurance industry and from the banking and investment services industries within the meaning of section 1 (19) of the Banking Act.

In this context affiliated companies are affiliated undertakings as defined by section 271 (2) of the Commercial Code (HGB):

“Affiliated companies within the meaning of this book are defined as companies that are required to be included as parents or subsidiaries (section 290 HGB), in accordance with the provisions governing full consolidation, in the consolidated financial statements of a parent that is the ultimate parent required to prepare the most comprehensive consolidated financial statements in compliance with subpart two, even if such financial statements are not actually prepared, or that prepares or could prepare exempting consolidated financial statements in accordance with section 291 HGB or under a regulation issued by virtue of section 292 HGB; subsidiaries that are not consolidated under section 296 HGB are also affiliated companies.”

In order for the risk-mitigating effect to be accepted, the risks borne by any such provider must be laid off to reinsurers outside the consolidation definition, or other appropriate steps must be taken to ensure that the insurance undertaking has sufficient external supplementary cover assets to cover a potential loss event.

If the risks are partially laid off and the conditions, which otherwise remain the same, are met, the risk-mitigating effect will be recognised to the corresponding extent.

The creation of adequate technical provisions at the insurance undertaking that is having to be consolidated may be tantamount to the transferring of risks to third parties if the risks are adequately diversified and a market premium is payable for the insurance. In order to assess whether diversification is adequate, the proportion of intra-group shares in total premiums and for the highest individual risk per class of insurance or, following the introduction of Solvency II, the probable maximum loss should be used. In assessing whether diversification is adequate, the proportion of reinsurance to portfolios of insurance contracts may also be taken into account. If the risks are laid off to reinsurance undertakings that also have to be consolidated, the foregoing also applies to the reinsurance undertaking. These rules apply mutatis mutandis to financial conglomerates.

The institution filing the application must demonstrate that the aforementioned conditions are met. If the banking part of a group is unable to provide figures relating to the insurance part, permission may be granted for the intra-group insurance company, at the bank's instigation, to disclose the relevant figures on existing reinsurance or diversification of risks directly to BaFin or to send a letter of confirmation to BaFin. For risk-modelling purposes, the banking part must, however, be aware of the proportion of insurance contracts that are eligible for recognition.

Re no. 9: The actual risk mitigation achieved through insurance contracts and their proper recognition in the model must be demonstrated. Careful consideration should also given under this heading to how the institution monitors whether there is any material change in the insurance cover.

On subsection (3)

Appropriate haircuts are necessary to allow for payment uncertainties and mismatches in coverage when recognising insurance. These may arise from, for example, breaches of obligation, disagreement over the risks insured against or contract terms and conditions or shortages of cover in the sum assured.

These uncertainties about the insurance cover may, depending on the model used, be recognised in the data, scenarios or modelling at e.g. the level of individual risk events. The basis may be expert estimates, which should take into account historical cover exclusions and loss data and their actual coverage by insurance contracts.

There is no need to increase the haircuts for insurance contracts with a residual term of less than one year if the institution can demonstrate that a reduction in the cover effect over time does not occur. Any existing limits in insurance contracts should be monitored by the institution. There is no need for a haircut for insurance contracts with a residual term of less than 90 days in respect of the residual term if, for example:

1. the insurance contract is expected to be renewed automatically and no notice of termination has been given; or

2. insurance cover follows on immediately, e. g. as a result of a new insurance contract that has already been concluded. This also applies if the insurance cover from the latter does not come into effect until some time in the future provided it is no later than the end of the preceding contract. If there is any material difference in the terms of the follow-on insurance, in the last 3 months of the residual maturity of the preceding insurance the lower insurance cover of this and the follow-on insurance should be taken as the basis.

The capital requirement for operational risk after allowing for current insurance contracts will need to be re calculated whenever changes occur which have a material effect on the capital requirement for operational risk.

On subsection (4)

The development of further risk transfer mechanisms is still at an early stage. If an institution would like to recognise such a mechanism as having a risk-mitigating effect in its measurement system, it must demonstrate that it achieves a noticeable and reliable mitigation of operational risk. For this purpose, it must take into account, as a minimum, the credit quality of the entity bearing the risk, the maturity of the mechanism and how it operates with regard to the operational risk at the institution.