1 Objective of this Circular

1 This Circular provides guidance on interpreting the requirements governing own risk assessment in accordance with section 234d of the German Insurance Supervision Act (Versicherungsaufsichtsgesetz – VAG), transposing Article 28 of the IORP II Directive¹ . It explains these provisions bindingly for the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin) and thereby guarantees their consistent application in relation to all institution for occupational retirement provision subject to BaFin’s supervision in accordance with paragraph 2 (IORPs). Section 234d of the VAG applies to Pensionsfonds on the basis of section 237 (1) sentence 1 of the VAG. The special characteristics of Pensionsfonds are addressed in each case in the text.

2 General, entry into force

2 This Circular applies to all Pensionskassen and Pensionsfonds as well as separate ring-fenced pension funds governed by public law that provide retirement benefits by way of voluntary insurance with their registered office in Germany in accordance with section 1 (1) nos. 1 and 5, section 2 (1) and section 7 no. 33 of the VAG in conjunction with sections 232 and 236 of the VAG that are subject to BaFin’s supervision.

3 This Circular is structured in the following in such a way that explanations are given in each case regarding individual sentences or paragraphs (depending on the thematic area) of section 234d of the VAG. To begin with, the relevant sentences or paragraphs are reproduced in italics, followed by the relevant explanations (not in italics).

4 “Beneficiaries” within the meaning of this Circular are all members and beneficiaries of IORPs.

5 The term “management board” refers to the boards of IORPs. To the extent that ring-fenced pension funds governed by public law or IORPs in the legal form of the European Company (SE) that fall within the scope of this Circular do not have a governing body with this title, then the corresponding executive body is to take the place of the management board. The corresponding supervisory body is to take the place of the supervisory board under the same conditions.

6 The terms “profile” and “risk profile” have the same meaning in this Circular as they do in the Minimum requirements under supervisory law on the system of governance of insurance undertakings (MaGo for IORPs)².

7 The own risk assessment must be implemented by IORPs in such a way that is appropriate to the IORP’s profile (proportionality principle). The guidance provided in MaGo for IORPs on the proportionality principle apply here, with the necessary modifications. In particular, the criteria of “size” and “internal organisation” can be included as indicators in the proportionality considerations when implementing the own risk assessment.

8 This Circular enters into force when it is published.

3 Interpretation of the individual requirements of section 234d of the VAG

Section 234d (1) of the VAG

Section 234d (1) sentence 1 of the VAG: A Pensionskasse’s risk management system includes an own risk assessment, which must be documented.

9 The objective of the own risk assessment is to help the IORP’s management board to identify its risks and to manage them appropriately.

10 The full management board determines how the own risk assessment will be implemented and scrutinises its results. To do this, it needs a general understanding of the own risk assessment, including the methodologies applied.

11 The duties assigned to the full management board in respect of the own risk assessment cannot be delegated to individual members of the management board or a committee or otherwise be delegated.

12 The guidance in paragraphs 18 to 22 of MaGo for IORPs addressing the extent to which and how their materiality plays a role in assessing risks apply, with the necessary modifications, to the own risk assessment.

13 When analysing risks and reporting, the composition of the portfolios of beneficiaries must be taken into consideration.

Role of the own risk assessment in the IORP’s risk management system

14 The own risk assessment is a component of the risk management system whose content is described in section 234d of the VAG and is also limited in time. By contrast, the full risk management system is considerably more comprehensive than the own risk assessment described openly in the VAG and contains ongoing processes that cannot be limited in time.

15 However, there are considerable content-related overlaps between the own risk assessment and the rest of the risk management system. The extent to which these overlaps can or should be leveraged in order to generate synergy effects may differ from IORP to IORP.

16 To the extent that the own risk assessment delivers insights that are not yet contained in the rest of the risk management system, this may also impact the rest of the risk management system.
Documentation requirements

17 As a minimum, the IORP must have the following documentation about the own risk assessment:

• the written internal guidelines on the own risk assessment as a component of the risk management policy within the meaning of section 23 (3) of the VAG, which can be in the form of separate or combined documentation;
• written internal documentation on each own risk assessment performed;
• a written report on the results of each own risk assessment performed (own risk assessment report).
  

18 The documents and any previous versions must be retained for six years.

Internal policies

19 The guidance in section 8.4 of MaGo for IORPs applies, with the necessary modifications, to the internal guidelines on the own risk assessment. The internal guidelines serve to determine how establish how the own risk assessment should happen.

20 The internal guidelines must in particular describe the following:

• the frequency that an IORP chooses for its regular own risk assessment (see paragraph 36), including a justification. The IORP’s profile and risk profile play a role, as does the volatility of the overall funding needs in relation to the funds available to cover them;
  
• the timing of the performance of a regular own risk assessment (see paragraph 36);
• a description of the circumstances under which a non-regular own risk assessment (see paragraph 36) would happen;
• data quality requirements. If necessary, reference can be made to data quality standards already in place in the undertaking.
  

Internal documentation

21 The IORP must document the implementation of each own risk assessment in such a way that a knowledgeable third party can understand it on the basis of this documentation and the other documents to which reference is made therein.

Own risk assessment report

22 The own risk assessment report must be submitted to the full management board of the IORP and approved by it as the final result of the own risk assessment, for example through the signatures of the members of the management board or by a corresponding resolution. The approval must be obtained swiftly. The date of the approval must be documented.

23 The supervisory board should be informed of the material results. The own risk assessment report can be submitted to it for this purpose.

24 The information provided to the full management board in the own risk assessment report must be sufficiently detailed to enable it to use it in its strategic decision-making process; see section 234d (4) of the VAG. The methodologies used in each case must be described. The results of the own risk assessment that must be reported also include the conclusions drawn.

25 The scope of the own risk assessment report depends crucially on the IORP’s risk profile and profile, and on the need to explain results and conclusions. For IORPs with a lower profile, just a few pages may be sufficient.

26 The own risk assessment report must be self-explanatory and self-contained. It may not comprise several documents. If appropriate, references in the own risk assessment report to other documents must be used in such a way that they do not contradict the purpose of the report, i.e. to summarise the most important information on an own risk assessment that has been performed.

27 If a matter is reported both in the reporting under section 26 (1) sentences 1 and 2 of the VAG that is submitted to the management board and in the own risk assessment report, any statements on this matter should not vary in substance in the two reports. If this is not the case, it should be presented and justified in the own risk assessment report.

28 Undertakings are encouraged to structure the own risk assessment report in such a way that it is clear which supervisory requirements are being addressed in which part of the report. This can be done, for example, by orienting the structure of the report, in the same way as this Circular, on the structure of section 234d (2) sentence 1 of the VAG. The information required by nos. 1 to 8 of section 234d (2) sentence 1 of the VAG must be reported separately.

29 There must be a description of the developments expected by the IORP in its environment (for example, capital markets, legal environment, economic trends, etc.) and how its own plans and projects impact the individual areas of the own risk assessment under nos. 1 to 8 of section 234d (2) sentence 1 of the VAG.

30 Problems affecting data quality must be described, including potential departures from the data quality requirements contained in the internal guidelines and their potential impact on the results of the own risk assessment.

31 In the case of section 234d (1) sentence 3 of the VAG, the own risk assessment report must describe in particular the reasons for the material change in the risk profile and the consequences this has for the IORP’s planning.

32 If potential problems are identified, the report must describe how the IORP will respond to them, in particular to avoid any non-compliance with regulatory capital requirements or the requirements governing technical provisions. The potential responses include measures already implemented at the time of the report, concrete measures that are planned or the review of potential measures. This is without prejudice to other regulatory requirements, for example under sections 134 and 135 of the VAG.

33 If the beneficiaries are exposed to risks within the meaning of section 234c (2) of the VAG, their perspective must be taken into consideration in the own risk assessment. This is the case in particular for pure defined-contribution schemes,³ unit-linked life insurance products offered by Pensionskassen and comparable products offered by Pensionsfonds.

Relationship between the own risk assessment reports and other reports

34 Under section 234c (3) sentence 2 of the VAG, the requirement to submit the report under section 26 (1) sentences 1 and 2 of the VAG to BaFin does not apply to reports that are provided to the management board in the period of six months before and after the completion of an own risk assessment for which the overall risk profile is assessed. However, this does not affect the duty to submit the reports under section 26 (1) sentences 1 and 2 of the VAG to the management board. This duty can also be satisfied by submitting the own risk assessment report to the management board if it contains all the information required for this reporting.

35 A non-regular own risk assessment (see paragraph 36) that is not performed for the overall risk profile (see paragraph 47) does not affect the duty to submit reporting under section 26 (1) sentences 1 and 2 of the VAG to BaFin.

Section 234d (1) sentences 2 and 3 of the VAG: The own risk assessment must be performed at least every three years for the overall risk profile, or more frequently if required by the supervisory authority. The Pensionskasse must perform an own risk assessment without undue delay if there has been a significant change

1. in its risk profile or
2. in the risk profile of pension schemes it operates.

36 A distinction is made between a regular own risk assessment (section 234d (1) sentence 2 1st half-sentence of the VAG) and a non-regular own risk assessment (section 234d (1) sentence 3 of the VAG).

37 The own risk assessment contains historical elements, elements relating to the reference date and forward-looking elements. The own risk assessment report must describe the periods and the reference date for which the own risk assessment was performed.

38 With regard to historical information, a regular own risk assessment performed by the IORP must cover the period between the reference date of the preceding regular own risk assessment and the reference date of the current own risk assessment, between which there must be no more than three years. In the first regular own risk assessment, as a minimum the period since 13 January 2019 must be addressed. Period overlaps are permitted but not generally necessary.

39 The question of when an own risk assessment must be performed within a financial year is not specified. However, an IORP must be in the position to demonstrate that the own risk assessment is rationally integrated into the business planning processes.

40 The own risk assessment constitutes an analysis at a certain point in time that does not have to be identical to the balance sheet date. Based on a selected time for the analysis, a reference period must be defined for certain areas of the own risk assessment, for example with regard to assessing the effectiveness of the risk management system.

41 The own risk assessment must be performed promptly after the selected reference date, i.e. on the basis of the latest data. If, for example, an own risk assessment in 2021 is based on data as at 31 December 2020, there may not have been any material changes to the data in the meantime. At the latest, an own risk assessment must be completed nine months after the underlying reference date. In the case of a non-regular own risk assessment, as a rule a shorter period is likely to be appropriate.

Non-regular own risk assessment

42 The risk profile of the IORP or of a pension scheme that it operates has undergone significant change in particular if its size, nature, scale, complexity or the evaluation of the relevant risks has changed materially. In particular, this can be assumed if the evaluation of the overall funding needs of the IORP or of a pension scheme that it operates is significantly affected as a result of the change.

43 An IORP must take precautions that enable it to identify a significant change in its risk profile or, if it operates several pension schemes within the meaning of this provision, of the risk profile of a pension scheme that it operates. Therefore, if an IORP operates several pension schemes, analysing them separately is a mandatory requirement. This is without prejudice to other regulatory requirements, for example under section 132 of the VAG.

44 The IORP must use in particular results of stress tests or scenario analyses as well as qualitative considerations in order to establish whether changes in external factors could cause significant changes to its risk profile.

45 The IORP must itself assess whether a change to its risk profile that it has established is significant. Such an assessment must be documented with the reasons for it, irrespective of its outcome.

46 Changes to the risk profile may be a consequence of internal decisions and external factors. Examples include: move into new business areas, significant changes in approved risk tolerance limits or reinsurance agreements, portfolio transfers, significant changes in capital market conditions or the composition of assets.

47 It appears reasonable to limit a non-regular own risk assessment to those risks and areas that are impacted particularly by the significant change to the risk profile that triggers the non-regular own risk assessment.

48 If an IORP only operates one pension scheme, there is normally also likely to be a significant change to the IORP’s risk profile if there is a significant change to the risk profile of the pension scheme. There could be exceptions, for example, if recourse to the IORP’s equity by the pension scheme is very unlikely, for instance in the case of a Pensionsfonds that only offers a product in accordance with section 236 (2) of the VAG, or an IORP that solely offers pure defined-contribution schemes.

49 An IORP operates more than one pension scheme within the meaning of this provision if several sub-portfolios are managed entirely or largely separately from each other. This is the case, for example, if several guarantee asset accounts (Pensionskassen) or several guarantee assets (Sicherungsvermögen) (Pensionsfonds) are present, or because of the contractually required separation of investments. This is the case for a pure defined-contribution scheme, and frequently also for non-insurance based pension schemes in accordance with section 236 (2) of the VAG.

50 In the case of portfolios of unit-linked life insurance and the corresponding investment holdings, the Pensionskasse must assess how allocation to one or more pension schemes should be made. This applies, with the necessary modifications, to Pensionsfonds that have portfolios comparable to unit-linked life insurance.

51 A tariff is not a pension scheme within the meaning of this provision if it is not managed separately. For this reason, a change in the assessment of collateral in the biometric actuarial assumptions for only a single tariff, for example, will only result in the need to perform a non-regular own risk assessment if this has to be classified overall as a significant change to the IORP’s risk profile.

Section 234d (1) sentence 4 of the VAG: If only a single pension scheme is involved in the case of sentence 3 number 2, the own risk assessment can be limited to that pension scheme.

52 If an IORP is required to perform a non-regular own risk assessment because of the requirements of section 234d (1) sentence 3 no. 2 of the VAG, the pension scheme in question is termed a “triggering pension scheme” in the following.

53 If there are several pension schemes without there being any requirement to perform an own risk assessment for the IORP’s overall risk profile, they must be analysed separately in the own risk assessment as a matter of principle. This applies, with the necessary modifications, if an own risk assessment is performed for the IORP’s overall risk profile and a separate analysis is necessary in order to obtain meaningful results. For simplification purposes, reference is made in the following to the “triggering pension scheme” in the singular.

54 The scope of this provision is limited to cases in which the probability of recourse to the IORP’s equity by the triggering pension scheme or other impact on the overall funding needs of the IORP is very low, as a rule therefore to non-insurance based commitments by Pensionsfonds and pure defined-contribution schemes.

55 Supplementing paragraph 47, the following applies when performing a non-regular own risk assessment for a triggering pension scheme:

56 The documentation requirements, reporting obligations and submission deadlines for the own risk assessment apply here in the same way. Equally, the requirements of section 234d (3) and (4) of the VAG also apply here.

57 The requirement of section 234d (2) sentence 1 no. 1 of the VAG also applies in this case.

58 The effectiveness of the risk management system (section 234d (2) sentence 1 no. 2 of the VAG) must only be assessed in relation to the triggering pension scheme.

59 The way the IORP handles conflicts of interest with the sponsoring undertaking (section 234d (2) sentence 1 no. 3 of the VAG) is often likely to be independent of the triggering pension scheme’s risk profile. If this is the case, a corresponding note and a reference to the most recent own risk assessment performed for the IORP’s overall risk profile will be sufficient to satisfy the requirement of section 234d (2) sentence 1 no. 3 of the VAG. In other cases, the relevant requirements that would also apply to an own risk assessment of the IORP’s overall risk profile apply in this case.

60 In the case described here, the assessment of overall funding needs and the description of the measures to cover them (section 234d (2) sentence 1 no. 4 of the VAG) can be limited to the triggering pension scheme.

61 With regard to the requirements of section 234d (2) sentence 1 no. 5 of the VAG, the same requirements apply, with the necessary modifications, as for an own risk assessment of the IORP’s overall risk profile. This applies, with the necessary modifications, to the requirements of section 234d (2) sentence 1 nos. 7 and 8 of the VAG, to the extent that the risks affect the triggering pension scheme.

62 With regard to the requirements of section 234d (2) sentence 1 no. 6 of the VAG, the change to the risk profile of the triggering pension scheme will often not tend to lead to a change in the qualitative assessment specified there. In this case, a corresponding note and a reference to the most recent own risk assessment performed for the IORP’s overall risk profile will be sufficient. In other cases, the qualitative assessment must be performed with regard to the triggering pension scheme.
Section 234d (1) sentence 5 of the VAG: Pensionskassen must inform the supervisory authority of the findings of each own risk assessment performed within 14 days of its completion.

63 The IORP informs BaFin by transmitting its own risk assessment report. The own risk assessment is completed when the own risk assessment report is approved by the management board and the period for submitting the own risk assessment report to BaFin begins.

64 The question of when an IORP has to perform a regular own risk assessment for the first time depends on its membership of one of the two groups described in the following:

• Group 1 includes all IORPs with total assets of more than EUR 1 billion as at 31 December 2019 as well as Pensionskassen that are required to comply with additional reporting obligations on how they manage the low interest rate environment/are subject to intensified supervision;
• Group 2 includes all IORPs that do not belong in Group 1.

65 BaFin expects Group 1 IORPs to perform their first regular own risk assessment at the latest as at the 31 December 2020 reference date, that they complete it at the latest as at 30 September 2021, and that they submit the corresponding own risk assessment report to BaFin at the latest as at 14 October 2021. In the case of Group 2 IORPs, the dates shown above are deferred in each case by one year.

66 The following applies to IORPs whose financial year differs from the calendar year: if these IORPs wish to perform their first regular own risk assessment as at a balance sheet date, they can use the balance sheet date falling in calendar year 2021 as the reference date of this own risk assessment, regardless of their membership of one of the groups described in paragraph 64. The deadlines set out in paragraph 41 or section 234d (1) sentence 5 of the VAG apply, with the necessary modifications, to the submission of the first regular own risk assessment report to BaFin.

Section 234d (2) of the VAG

Section 234d (2) sentence 1 no. 1 of the VAG: As part of the own risk assessment, the Pensionskasse must

1. describe how the own risk assessment is integrated into the management and decision-making processes of the Pensionskasse;

67 The description of how the own risk assessment is integrated into the management and decision-making processes must address the requirements of section 234d (2) sentence 1 nos. 2 to 8 of the VAG. In addition to processes at management board level, other management and decision-making processes must be taken into account if they are or were affected by the own risk assessment.

68 The general principles governing how integration occurs must be described and concrete decisions that are based on the own risk assessment or are or were affected by it must be mentioned. In particular, there could be a discussion of material decisions or measures that have resulted from an earlier own risk assessment if they have not been reported yet or have not been conclusively reported yet.

Section 234d (2) sentence 1 no. 2 of the VAG: 2. assess the effectiveness of the risk management system;

69 This comprises a description of the extent to which the objectives of the risk management system defined in the risk strategy have been achieved (target-actual analysis). It also includes a review of whether these objectives are still appropriate.

70 If the assessment of the effectiveness of the risk management system reveals a need for improvements or changes, this must be addressed in the own risk assessment report.

Section 234d (2) sentence 1 no. 3 of the VAG: 3. describe how it prevents or manages conflicts of interest with the sponsoring undertaking, if the person responsible for a key function also performs a similar function in the sponsoring undertaking;

71 These disclosures in the own risk assessment report supplement the opinions of the IORP in accordance with section 234b (3) sentence 2 of the VAG that the IORP sends BaFin on an event-driven basis (if the person responsible for a key function performs or is scheduled to perform a similar function in the sponsoring undertaking), and are therefore only necessary if the person responsible for the key function actually performs a similar function in the sponsoring undertaking.

72 There must be a description of which conflicts of interest there are or were or references to potential conflicts of interest. If no new insights are available in this respect, reference can be made to the statements of the IORP in accordance with section 234b (3) sentence 2 of the VAG. There must be a description whether the measures that are aimed at preventing conflicts of interest were or are effective, and whether additional or modified measures are necessary in future.

Section 234d (2) sentence 1 no. 4 of the VAG: 4. assess the overall funding needs and describe any measures to cover the funding needs, where applicable;

Assessment of overall funding needs

73 As part of the assessment of overall funding needs (assessment), it should be estimated whether the existing supervisory requirements for covering technical insurance or Pensionsfonds liabilities (technical liabilities), capital resources and risk-bearing capacity⁴ will continue to be satisfied in the future, including in light of risks. The IORP’s liquidity must also be analysed. This requires quantitative information in each case.

74 An IORP can identify other areas of its overall funding needs in the own risk assessment.

75 Appropriate valuation methods must be used for the individual areas that match the IORP’s profile and risk profile. The valuation methods required in each case by commercial and supervisory law must be used. Additionally, other methods selected by the IORP at its own discretion can be used, including, for example, the common framework for risk assessment and transparency of IORPs⁵ published by EIOPA or asset-liability management (ALM) methods.

76 Existing supervisory or undertaking-specific methods, procedures or reports (such as stress tests, forecast calculations, risk-bearing capacity concepts, reports of the responsible actuary, the actuarial function or the independent risk control function, or actuarial opinions) can form the basis for the assessment. If the periods or risk analyses necessary for the own risk assessment are not considered (see paragraph 82 et seq.), they must be supplemented accordingly in the own risk assessment.

77 Long-term projects of business activity can be used for the assessment. This includes projected balance sheets and income statements as well as of the regulatory capital requirements. These projections should enable the IORP to perform the assessment from a forward-looking perspective.

78 It is particularly important that the actuarial assumptions used to calculate the technical liabilities are sufficiently sound, including in light of potential risks. This must be addressed in the own risk assessment. Reference can be made to existing examinations, for example by the responsible actuary and the actuarial function.

79 As a minimum, the following must be included in the assessment of capital resources:

• potential future changes to the IORP’s risk profile, to the extent that they might affect the assessment;
  
• the nature and scale of own funds items and how these might change as a result of redemption, repayment and maturity dates;
• whether the IORP currently has adequate own funds and realistic plans for how it can obtain additional own funds if this should be necessary, for example because of the business strategy or business plans. When assessing whether its own funds are adequate, the IORP must take account of the quality and volatility of its own funds and in particular their loss-absorbing capacity in various scenarios. In particular, the loss-absorbing capacity of existing subordinated loans must be described.

80 In respect of risk-bearing capacity, it should be analysed whether the risk coverage potential⁶ will continue to be adequate in future, including in light of risks, to enable all material risks to be covered.

81 Pure defined-contribution schemes or commitments by Pensionsfonds under section 236 (2) and (3) of the VAG will not normally trigger any material “funding need” at the IORP in the sense that the IORP must itself make available additional own funds in order to satisfy its obligations under these commitments.

Risks

82 The assessment shall include the following in particular:

• a forward-looking determination and assessment of the risks to which the IORP is exposed and could be exposed in the future, taking into account potential future changes to its risk profile that are attributable in particular to the IORP’s business strategy or the economic and financial environment, including operational, environmental, social and governance risks. The IORP does not have to discuss risks that cannot be quantified. The risks included in the assessment must be presented in the own risk assessment report;
• the nature and scale of the funds necessary or available for the area in question, taking into account the risks identified in the forward-looking determination and assessment.

83 The following in particular must be taken into account in the forward-looking determination and assessment of the risks:

• as a general principle, risks may arise from all assets and obligations;
  
• the periods that are relevant in each case with regard to the consideration of the risks existing for the IORP;
• the IORP’s internal control and risk-management systems and the defined risk tolerance limits;
• risk mitigation techniques – this must be taken into account if there is no effective risk transfer;
• the quality of processes and input data, in particular the appropriateness of the IORP’s business organisation, taking into account the risks that could arise from a lack of appropriateness or defects;
• the IORP’s business planning, taking into account provisions relating to section 234d (4) of the VAG (paragraph 125 et seq.).
• potential external stress situations or other negative scenarios.

84 The IORP must identify and consider external factors that could have material adverse effects on its overall funding needs or the funds available to cover them. Such external factors could be changes to the economic conditions, the legal framework, the tax environment, the market in which the IORP operates, and technical developments.

Reference period

85 The reference period for the assessment must cover at least the five years following the reference date of the own risk assessment. If the business plans cover a longer period, this period should also be included in this assessment.

86 A shorter period will normally be appropriate for analysing the IORP’s liquidity. For example, a period of one year may be appropriate if, according to current knowledge, the investments still available after a year can be liquidated at any time to an extent that exceeds the probable payments in a sufficiently long subsequent period (for example, five years), or if the payments received are expected to clearly exceed the payments made in a sufficiently long subsequent period (for example, five years). This must be explained if necessary. As a minimum, the own risk assessment report must contain the liquidity planning for the following year.

87 For the period analysed in accordance with paragraph 85, the assessment must be made in each case for the expected future development and in the event that negative developments occur. In each case, the negative developments that form the basis of the analysis must be explained. In addition to deterministic analyses, stochastic studies and, if applicable, other suitable analysis methods are possible.

Measures to cover the overall funding needs

88 If the overall funding needs determined by the IORP, if appropriate related to one area only, cannot be covered at present or are not expected to be covered in the future, the IORP must describe measures in the own risk assessment report with which the overall funding needs could be covered. The IORP must promptly initiate the measures that are necessary to improve its (future) situation to the extent necessary. These obligations apply irrespective of and in addition to other regulatory requirements, for example sections 132 et seq. of the VAG.

89 The measures described must be realistic and practicable.

90 The description of the measures must cover both the expected development and also the case that the analysed risks materialise.

91 Potential measures can include decisions by the IORP whether to retain, reduce or transfer risks, and which tariffs and actuarial assumptions it uses.

92 In the assessment, the IORP must also take into consideration the measures that would be adopted by the management board under unfavourable circumstances. In doing so, it assesses the impact of these measures, including the financial consequences, and also takes account of circumstances and facts that could influence the effectiveness of the risk mitigation measures.

93 The concrete reaction of the IORP to the results of the assessment also depends on how likely the IORP considers these risks will occur.

Section 234d (2) sentence 1 no. 5 of the VAG: 5. assess the risks to members and beneficiaries relating to the paying out of their retirement benefits and the effectiveness of any remedial action taking into account, where applicable, any

a) indexation mechanisms,

b) mechanisms for reducing pension rights and pension benefits, including the conditions under which and the extent to which pension rights and pension benefits can be reduced, and by whom;

94 The risks relating to all forms of the benefits provided or to be provided by the IORP must be analysed, meaning in particular benefits linked to invalidity or death as well as benefits linked to age.

95 The assessment in accordance with section 234d (2) sentence 1 no. 5 of the VAG must be made separately from the assessment of the overall funding needs in accordance with section 234d (2) sentence 1 no. 4 of the VAG. However, it appears obvious to take account of the existing correlations.

96 Risks for the members and beneficiaries exist both in respect of the benefits guaranteed by the IORP and in respect of benefits that the IORP does not guarantee but promises, for example in the case of a pure defined-contribution scheme.

97 Risks may also exist in respect of benefits that members and beneficiaries expect, for example benefits from profit participation due to non-binding model calculations or non-binding promises of regular increases in benefits in the case of a pure defined-contribution scheme. The IORP must also address such benefits here.

98 The focus of the IORP’s risk-management is usually on its ability to pay the guaranteed benefits. With regard to pure defined-contribution schemes, the Regulation on the Supervision of Pensionsfonds (Pensionsfonds-Aufsichtsverordnung) contains special risk management requirements that must be complied with.

99 “Indexation mechanisms” within the meaning of section 234d (2) sentence 1 no. 5a) of the VAG are arrangements that result in the member or beneficiary assuming or being able to assume that their benefits will be increased in future depending on certain factors. Indexation mechanisms within the meaning of this provision do not include future guaranteed benefit increases. These must be treated as other guaranteed benefits.

100 The mechanisms within the meaning of section 234d (2) sentence 1 no. 5b) of the VAG include in particular:

• provisions in the articles of association of Pensionskassen with the legal form of a mutual insurance association (Versicherungsverein auf Gegenseitigkeit – VVaG) that set out that pension claims can be reduced;
• other adjustment or amendment clauses under contractual arrangements or the articles of association, in particular in the case of Pensionskassen with the legal form of a VVaG, for example that enable the annuitisation factors to be reduced for tariffs with continuous single premiums;
• the possibility to modify benefits in the case of pure defined-contribution schemes;
• the possibility to modify benefits in the case of commitments in accordance with section 236 (2) and (3) of the VAG.

101 There must be a discussion of whether the payment of part of the (unreduced) pension benefits will be assumed by third parties (for example sponsoring undertakings of the IORP) if pension rights and pension benefits are reduced. Risks to members and beneficiaries that apply in the case of these third parties relating to the paying out of their retirement benefits do not need to be analysed here.

102 “Remedial action” means all measures and mechanisms that mitigate risks that exist for members and beneficiaries in relation to the paying out of their retirement benefits. Examples of remedial action are changes to the risk profile of the investments by the IORP or obtaining additional capital, including in the form of premium increases if necessary. The impact of potential and planned remedial action must be discussed. As part of a pure defined-contribution scheme, the use of collective security buffers can also be considered as remedial action.

103 If remedial action is already assessed elsewhere in the own risk assessment report, reference can be made to this assessment.

104 Benefit reductions due to an indexation mechanism or the use of mechanisms in accordance with section 234d (2) sentence 1 no. 5b) of the VAG are usually not remedial action, but a consequence or expression of the materialisation of risks that exist from the perspective of the beneficiaries.

105 In particular the existence of provisions in the articles of association of Pensionskassen with the legal form of a VVaG that set out that insurance benefits may be reduced and allow the annuitisation factors to be reduced in the case of tariffs with continuous single premiums, are not mechanisms that increase the risk-bearing capacity from the perspective of members and beneficiaries, with the result that their existence does not justify any increase in the risk exposure.

106 Irrespective of the above, there must be a discussion of the extent to which indexation mechanisms may be exposed if risks materialise or mechanisms within the meaning of section 234d (2) sentence 1 no. 5b) of the VAG can be used.

107 The risks that exist for members and beneficiaries relating to the paying out of their retirement benefits are frequently closely linked to the risks that exist for an IORP. For this reason, the methods already used in the IORP’s other risk management system may also be relevant here.

Section 234d (2) sentence 1 no. 6 of the VAG: 6. carry out a qualitative assessment of the mechanisms protecting pension rights and pension benefits including, as applicable, any of the following in favour of the Pensionskasse or the members and beneficiaries:

a) guarantees, covenants or any other type of financial support by the sponsoring undertaking,

b) insurance or reinsurance by an undertaking covered by Directive 2009/138/EC, or

c) coverage by a pension protection scheme;

108 The mechanisms analysed here include all obligations or (potential) commitments by third parties to provide funds to the IORP or directly to the beneficiaries to pay the guaranteed benefits if the IORP cannot (any longer) pay these benefits itself, in particular:

• the subsidiary liability of the employer within the meaning of section 1 (1) sentence 3 of the BetrAVG;
• protection by the Pensions Insurance Association (PSV), sections 7 et seq. of the BetrAVG;
• protection by a guarantee scheme under sections 221 et seq. of the VAG;
• the obligation or willingness of shareholders, sponsoring undertakings of the IORP or other third parties to make additional funds available to the IORP.

109 Other “mechanisms” to protect pension rights and benefits (for instance prudent accounting and calculations, establishing guarantee assets (Sicherungsvermögen), investment rules, risk management, internal control system, internal audit, own funds requirements, …) are not required to be analysed here (under no. 6).

110 The qualitative assessment must include the following in particular:

• a list of all existing mechanisms in the sense described above;
• a description of the way these mechanisms function, including their interaction and the sequence in which they are used, although in the cases of subsidiary liability, protection by the PSV and protection by the guarantee scheme within the meaning of sections 221 et seq. of the VAG, there is no need to reproduce the statutory requirements;
• a description of their legal basis or where they are to be found (for example the articles of association, the VAG, technical business plan, (letter of) commitment, contract) as well as an estimate of the legal enforceability of claims under the mechanisms in question, although it is not necessary to estimate the legal enforceability in the case of subsidiary liability, protection by the PSV and protection by a guarantee scheme within the meaning of sections 221 et seq. of the VAG;
• information about the groups of beneficiaries, the number of beneficiaries, the share of the premium reserve which are protected by the relevant mechanism, the form this takes, the limit that applies, and if applicable an explanation why certain groups are not protected.

111 The possibility of support being provided to the IORP by sponsoring undertakings, shareholders or other third parties must also be assessed if there is no binding obligation on them to provide such support, but it can be assumed that such support would be necessary so that the IORP can pay out its benefits, or if in the past such support was already provided on a voluntary basis.

112 When assessing subsidiary liability and the obligation or willingness of sponsoring undertakings, shareholders or other third parties to make additional funds available to the IORP, the following questions must be addressed:

• whether the IORP can obtain reliable information from publicly available sources with reasonable effort about the economic or financial position of (if applicable, of a small number of large) sponsoring undertakings, shareholders or the other third parties: does this information give rise to evident doubts about their ability to meet their obligations or commitments to provide support?
• does the IORP have reliable information (about legal, economic or other circumstances) that allow a statement whether the sponsoring undertakings, shareholders or other third parties are or might not be able to meet their obligations or commitments in certain adverse situations? Could such information be obtained with reasonable effort?
  IORPs that operate industry-wide, in particular on the basis of extensive collective agreements, can also make these analyses on the basis of statistic indicators for the industry in question.

113 When assessing the obligation or willingness of sponsoring undertakings to make additional funds available to the IORP, the following additional questions in particular must be addressed:

• how many sponsoring undertakings are there? Are the majority of the IORP’s obligations or of the beneficiaries attributable to a single or a handful of large sponsoring undertakings?
• do the sponsoring undertakings belong to a single or a handful of groups of companies?
• are there (legal or actual) structures that result in the sponsoring undertakings being responsible for each other’s obligations?
• are there other special characteristics that may have an impact on the sponsoring undertakings’ ability or willingness to meet their obligations to provide support to the IORP?
• do the sponsoring undertakings belong to a single or a handful of industries, with the result that there are “concentration risks” when it comes to (possible) support by the sponsoring undertakings?

If a specific case involves obligations or the willingness of shareholders or other third parties to make additional funds available to the IORP, the questions listed above must be addressed correspondingly.

114 The duties of the PSV as the organisation responsible for insolvency insurance are governed by the BetrAVG. The nature and scope of the protection it provides is therefore determined by the lawmakers. A more extensive assessment by the IORP therefore appears to be unnecessary. This applies, with the necessary modifications, to a guarantee scheme within the meaning of sections 221 et seq. of the VAG.

115 There must be a discussion of the protection provided by reinsurance contracts or, in particular with Pensionsfonds and pure defined-contribution schemes, by investments in life insurance contracts.

116 In particular subsidiary liability, protection by the PSV and protection by a guarantee scheme within the meaning of sections 221 et seq. of the VAG may not be taken by the IORP as a reason to enter into greater risks than it would enter into without these mechanisms.

117 By contrast, the IORP may take mechanisms within the meaning of section 234d (2) sentence 1 no. 6 of the VAG as a reason for entering into greater risks if these mechanisms result in the IORP receiving additional funds if the risks materialise, and if those parties that are required to make available the funds in this case agreed that the IORP can use these mechanisms as a reason for entering into greater risks. The IORP must be able to demonstrate this.

Section 234d (2) sentence 1 no. 7 of the VAG: 7. undertake a qualitative assessment of the operational risks;

118 It is sufficient if operational risks are reported in the own risk assessment report in the same way as in the reporting by the IORP under section 26 (1) sentences 1 and 2 VAG to the management board. The guidance provided in MaGo for IORPs on operational risks apply, with the necessary modifications.

Section 234d (2) sentence 1 no. 8 and sentence 2 of the VAG: 8. assess new and probable emerging risks because the Pensionskasse considers environmental, social and governance factors in its investment decisions. The assessment under sentence 1 number 8 must include, among other things, risks related to climate change, use of resources and the environment, social risks and risks related to the depreciation of assets due to regulatory change.

119 Please refer to the BaFin Guidance Notice on Dealing with Sustainability Risks: https://www.bafin.de/dok/13412782.

Section 234d (3) of the VAG

Section 234d (3) sentence 1 of the VAG: For the performance of the risk assessment under subsection (2), the Pensionskasse must have in place methods to identify and assess risks that

1. it could be exposed to in the short or long term and
2. that may have an impact on the Pensionskasse’s ability to meet its obligations.

120 Please refer to the guidance above on section 234d (2) of the VAG.

121 Material changes to methods and procedures for which there is no objective reason must be avoided so that the results are comparable over time to the greatest extent possible. The impact of material changes to methods and procedures should be presented in the own risk assessment report.

Section 234d (3) sentences 2 and 3 of the VAG: The methods must be proportionate to the size, nature, scale and complexity of the Pensionskasse’s activities and must also cover the risks referred to in subsection (2) sentence 2. They must be described in the own risk assessment.

122 The proportionality principle must be considered in particular for the methods referred to in section 234d (3) sentence 1 of the VAG.

123 Application of the proportionality principle may not lead to simplifications with regard to the multi-year perspective to be adopted for assessing the overall funding needs or the scale of the necessary quantification of the overall funding needs.

124 With regard to the requirement that the methods must also cover the risks referred to in section 234d (2) sentence 2 of the VAG, please refer to the BaFin Guidance Notice on Dealing with Sustainability risks referred to in paragraph 119.

Section 234d (4) of the VAG: The own risk assessment must be taken into account in the Pensionskasse’s strategic decisions.

125 The IORP must take into account the results of the own risk assessment and the insights gained during the performance of the own risk assessment at least in the following areas:

• in its business plans, including in plans relating to the overall funding needs;
• when developing and designing new products;
• in decisions on business strategy and the risk strategy.

126 When performing the own risk assessment, the IORP considers its business strategy as well as strategic and financial decisions that affect the risk situation and the overall funding needs, including the regulatory capital requirements.

127 The full management board must be aware of the impact that strategic and material decisions have on the IORP’s risk profile and overall funding requirements, including the regulatory capital requirements, and consider whether this impact is desirable, tolerable and feasible in light of the quantity and quality of its own funds.

128 If the impact of strategic or material decisions is to be “tested” in advance in an own risk assessment, this does not necessarily imply that a full-scale own risk assessment must be performed before each such decision. For example, it may be sufficient to examine how the result of the assessment of the IORP’s overall funding needs, including the regulatory capital requirements, performed in the preceding own risk assessment would change if certain decisions were to be taken.