Supervisory Review Process

Art. 36, para. 1, subpara. 1 of the Solvency II Directive provides that the supervisory authorities shall review insurance undertakings’ compliance with legal and administrative provisions adopted on the basis of the Directive. The immediately following subpara. 2 along with paras. 2 through 4 supply detail concerning the areas to be examined. Paragraph 2 recites a non-exhaustive list, including system of governance, technical provisions, own capital requirements, investment rules, quality and quantity of own funds, and where applicable the correctness of an internal model. Paragraph 3 imposes upon the Member States a duty to deploy tools adapted to continuous supervision in order to identify “deteriorating financial conditions” and to monitor the remedy of that deterioration.

Paragraph 1, subpara. 2 goes on to specify that the Supervisory Review Process shall comprise the assessment of the system of governance and of the risks that insurance undertakings are or could be exposed to. In art. 36, para. 6, subpara. 2, the Solvency II Directive instructs the supervisory authorities to determine, based on the principles of proportionality, how often they will subject an insurance undertaking to the periodic supervisory processes of review, evaluation, and assessment. The supervisory authority may thus also determine the appropriate subject-matter scope of the supervisory process, based on the risk profile of the insurance undertaking. Article 36, para. 5, of the Solvency II Directive prescribes that the Member States shall provide their insurance supervisory authorities with such intervention powers as will enable these authorities to demand that insurance undertakings remedy weaknesses or deficiencies discerned by the authorities.

In art. 36, para. 1, subpara. 2, the Solvency II Directive provides for assessment of risks that an insurance undertaking faces or may face. This assessment is the conceptual counterpart to the own-risk and solvency assessment (ORSA). Article 36, para. 4 of the Solvency II Directive requires supervisory authorities to assess the adequacy of the “methods and practices” of insurance undertakings designed to identify and withstand future or possible risks arising from economic conditions of the insurance undertakings.

Article 36 of the Solvency II Directive contains some overlapping provisions. For example, para. 2 (a) and para. 1, subpara. 2 both identify the system of governance as a matter for review. Since an insurance undertaking must incorporate risks attending economic conditions into its risk management system¹⁸ and—pursuant to paragraph 1, subpara. 2—the SRP includes risk assessment, paragraph 4 is in part superfluous. Furthermore, the non-exhaustive nature of art. 36, para. 1 of the Solvency II Directive is important with regard to the application of the law. This nature leads to art. 36, para. 4 of the Solvency II Directive, also not exhaustive,¹⁹ which sets forth further matters for review.²⁰

Article 36, para. 3 of the Solvency II Directive prescribes that the supervisory authorities shall have in place appropriate monitoring tools to enable them to identify deteriorating financial conditions in insurance undertakings and to monitor the pertinent remedies. This prescription comports with Recital 17 of the Solvency II Directive in imposing on the Member States the regulatory task of sufficiently equipping and establishing the administrative processes of their authorities. This provision is irrelevant in relation to the supervised undertakings because in other places the Solvency II Directive establishes intervention powers for the purpose of monitoring financial condition. Monitoring tools are procedures to collect information pertaining to insurance undertakings. Information comes to the supervisory authorities on the one hand in the Report to Supervisors (RTS),²¹ in the Solvency and Financial Condition Report (SFCR),²² and by virtue of the insurance undertakings’ ad hoc reporting duty. In addition, however, information is gained from on-site investigations authorized under art. 34, para. 5. And further yet, in some instances the Solvency II Directive imposes an information and reporting duty on third parties.²³ Still further, the supervisory authorities have access to generally available sources and they observe the insurance markets. These activities enable them to form conclusions pertaining to individual insurance undertakings.²⁴ This information-gathering is aimed at identifying risks to insureds and beneficiaries, among such risks being deterioration of financial conditions.²⁵

The implementation of art. 36 of the Solvency II Directive in German law on the one hand is complete with the RegE [Government’s Draft] but from another view exceeds its mandate and thus misses the mark. The Supervisory Review Process is defined in sec. 289, para. 3, sent. 2 of the VAG RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act]. Pursuant to this definition, the process consists in assessing the “strategies, processes, and reporting procedures established by insurance undertakings to comply with the legal and administrative provisions adopted by Directive 2009/138/EC”. It is inapposite to incorporate this definition into the paragraph on “financial supervision”, which is distinguished from “legal supervision” also in the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act]. Financial supervision is a part of legal supervision. This is so because the Supervisory Review Process, for example as regards the system of governance and the ORSA expressly noted in art. 36, para. 2 (a) of the Solvency II Directive, includes “legal supervision” under sec. 289, para. 2 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] along with “business activities” in the same manner as “financial supervision” along with “business organization” captured in the following paragraph. In view of the exclusive supervision under the laws of the country of origin only in the area of financial supervision under art. 30, para. 1 of the Solvency II Directive, the assignment of the Supervisory Review Process to the financial supervision area entails significant legal consequences. In addition, art. 30, para. 2, subpara. 1 of the Solvency II Directive defines the factual scope of financial supervision without including the requirements as to the business organization. A further inconsistency is seen in the separation of the legal definition from the description of the object of the Supervisory Review Process, a description appearing in paragraph 4.

In this paragraph 4, along with paragraph 3, the RegE [Government’s Draft] integrates the terms of art. 36, paras. 1 and 6 of the Solvency II Directive. But without explanation, RegE [Government’s Draft] fails to include the list of examples in art. 36, para. 2 of the Solvency II Directive. This feature needlessly hampers application of the law but does not create an incomplete implementation that is contrary to law. The draft act also declines to grant special powers for the remedy of weaknesses or deficiencies established in the supervisory process.²⁶ Consequently, the statement of grounds for RegE [Government’s Draft] envisions no such requirement. Under this statement of grounds, a weakness or deficiency satisfies the conditions of sec. 289, para. 1 of the VAG RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] and constitutes abusiveness within the meaning of sec. 292 para. 1, sent. 3 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act].²⁷ In opposition to this stance, however, is the general view that supervision according to the principles of abusiveness is not consistent with the Solvency II Directive, which contemplates only legal supervision.²⁸ Finally, sec. 289, paras. 2–4 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] does not mention the monitoring tools for determining deterioration of the financial foundations of an insurance undertaking (art. 36, para. 3 of the Solvency II Directive).²⁹

Further, a certain easing of BaFin [Federal Financial Supervisory Authority] supervision in the government’s draft of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] is not congruent with the Solvency II requirements. On this point, sec. 45, para. 2 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] provides for auditors’ review of the solvency statement under sec. 69 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act],³⁰ resulting in a separate report on the result. The same applies to the insurance undertakings’ obligation under sec. 47, para. 2 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] in each case “to submit promptly” to the supervisory authority “the reviewed solvency statement and the review report on the solvency statement”. No legal basis for this scheme appears in the Solvency II Directive. In its response on this point, the Bundesrat [German Federal Council] thus explained³¹: “The solvency statement is a key element of the new Solvency II rules. Its review cannot be assigned to an external auditor. This is to be accomplished as a core task of insurance supervision, not least because responsibility for this area rests with insurance supervisory authorities”. In its response, the German federal government noted³² “providing for audit of the solvency statement will make reviewing the content substantially easier for the supervisory authority”. This approach, however, contradicts core requirements of the Solvency II Directive. Namely, art. 27 of the Directive requires “that the supervisory authorities are provided with the necessary means and have the relevant experience [and] capacity… ”. Similarly, under art. 36, para. 3, “[t]he supervisory authorities shall have in place appropriate monitoring tools… ”. And in reference to auditors, art. 35, para. 2 (c) and art. 72, para. 1 of the Solvency II Directive provide only for a right of information regarding the findings from the statutory audit, and do not anticipate use of these findings for further purposes such as a relaxation of supervision for the insurance supervisory authorities.

The starting point for the Supervisory Review Process is art. 36, para. 1, subpara. 1 of the Solvency II Directive and, in like manner, sec. 289, para. 3, sent. 2 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act]. Under these provisions, the Supervisory Review Process shall review and evaluate the “strategies, processes, and reporting procedures” established by insurance undertakings to comply with the provisions of the insurance supervisory regime. The new supervisory regime endeavors to identify processes. The deficiencies of these processes may be manifested in the form of inadequate provision of capital, which in itself is also an indicium of weaknesses and deficiencies in insurance undertakings. In other words, the new orientation of the supervisory regime is not merely on the results of business, but also on the modalities and procedures employed therein.⁴⁰

The term “process” appears to have been adopted from the field of business management. Thus, the science of business management can provide insight into the legal term “process”, as it appears in art. 36, para. 1, subpara. 1 of the Solvency II Directive. A process is the convergence of material and human resources to accomplish an objective.⁴¹ The express listing of the reporting procedure as a matter for review highlights the importance of a functioning communications structure and culture. This emphasis, however, is superfluous in view of the broad scope of the term “process”, as presented here. The identification of strategy as a matter for review ultimately does not raise concerns here under art. 16 of the Charter of Fundamental Rights of the European Union (CFREU) or under art. 12 of the GG [German Basic Law]⁴² because it is compliance strategy alone and not business strategy that is subject to supervisory evaluation.

In contrast, under art. 36, para. 2 of the Solvency II Directive, “compliance” with subsequently named requirements is subject to the Supervisory Review Process. In contradistinction to art. 36, para. 1, subpara. 1 of the Solvency II Directive, art. 36, para. 2 is not restricted by its terms to “strategies, processes, and reporting procedures”. Whether an insurance undertaking satisfies the regulatory capital requirements is of course indirectly an issue relating to investment strategies and other processes. But separate from procedural approaches, the issue is one directly related to purely result-oriented matter. With reference to the scheme set forth in art. 36 of the Solvency II Directive, one might assume that art. 36, para. 2 of the Solvency II Directive is restricted at the outset to review of compliance with requirements that address “strategies, processes, and reporting procedures”. This is so because art. 36, para. 2 clearly refers to art. 36, para. 1 of the Directive. The language of art. 36, para. 2 of the Solvency II Directive by its own terms clearly contradicts this interpretation. This passage addresses “compliance” with requirements and is not restricted to the “strategies, processes, and reporting procedures” as noted in art. 36, para. 1, subpara. 1 of the Solvency II Directive. Moreover, the scheme of art. 36, para. 2 of the Solvency II Directive bears on art. 36, para. 1, subpara. 2 of the Solvency II Directive. This latter provision in turn provides for the “assessment of the qualitative requirements relating to the system of governance” and for its part is not restricted to strategies, processes, and reporting requirements.

The review criteria to be applied by the supervisory authorities arise from art. 36 of the Solvency II Directive and from sec. 289, para. 3, sent. 2 and para. 4, sent. 1 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act]. The “review”, “evaluation”, and “assessment” provided for here relate to whether the insurance undertakings have in place strategies, processes, and reporting procedures to ensure that they comply with the “laws, regulations, and administrative provisions adopted pursuant to this Directive”. In contrast, art. 34, para. 1 of the Solvency II Directive provides further that supervisory authorities shall have the power “to ensure that insurance and reinsurance undertakings comply with the laws, regulations and administrative provisions with which they have to comply in each Member State”. Against this background, the Supervisory Review Process accords with art. 34, para. 1 of the Solvency II Directive as a procedure to establish infringements.⁴³ In a departure from the suggestion in the title to the rule, this provision contains an assignment not only of task but also of power.⁴⁴ And in accord, for example, with art. 40, art. 71, para. 2, and art 72, para. 1, subpara. 1 (a) of the Solvency II Directive, art. 36, para. 1, subpara. 1 of the Solvency II Directive relates exclusively to compliance with “the laws, regulations and administrative provisions adopted pursuant to this Directive”. These are the respective national implementation rules based on the Solvency II Directive, i.e., in Germany the rules of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] and the rules of the implementing regulation. The corresponding EIOPA Guidelines are not part of this scheme because they are not legally binding and, because of the comply or explain approach, have only a de facto binding effect. Nevertheless, the supervisory authorities resort to the Guidelines to construe the rules they elucidate. Thus, review, evaluation, and assessment as to insurance undertakings can lead to no more than the conclusion that an infringement of the identified rules exists or not. A more extensive supervision of insurance undertakings is not possible on this basis.⁴⁵

The undefined legal terms “review and evaluation” must be given definite content, also in the context of the principle of proportionality.⁴⁶ The Solvency II Directive is largely silent as to this definite content. Article 31, para. 2, subpara. 1 (b) of the Directive, implemented in sec. 312, para. 2, no. 2 VAG-RegE, provides that the Member States shall disclose “the general criteria and methods…used in the Supervisory Review Process as set out Article 36”. Upon this basis, the BaFin [Federal Financial Supervisory Authority] could publish further explanatory notices, circulars, and the like. With such disclosure, however, the supervisory authorities restrict their discretionary power under the general principle that administrative authorities are bound by the very rules they lay down. It remains a mystery how these “criteria and methods” are to be developed and applied throughout Europe, in view of the objective of full harmonization, which according to Recital 40 of the Solvency II Directive includes “supervisory convergence…also in respect of supervisory practices”.⁴⁷ As a result, only the EIOPA by use of appropriate guidelines can forestall the obvious danger of supervisory divergence and thus also regulatory arbitrage.⁴⁸

“Evaluation” within the Supervisory Review Process allows the supervisory authority to assess the insurance undertaking internally with respect to its development and the risk that it might not be able to comply with the requirements of the law in the future. Evaluation does not depend solely on whether infringements by the insurance undertaking have occurred, but also on the prospect of infringements. In this process, all foreseeable circumstances should enter into the evaluation. Evaluation, then, is the result of the review process.

Article 36, para. 1, subpara. 2 of the Solvency II Directive establishes the supervisory evaluation of risks, of qualitative requirements relating the system of governance and of the ability of insurance undertakings to assess those risks. Article 36, para. 4 of the Solvency II Directive expands the scope for assessment to the adequacy of the methods and practices of the insurance undertakings designed to identify and withstand future unfavorable changes. The English-language version of the Solvency II Directive uses the term “assessment” in this context. “Assessment” can be translated as “Einschätzung”. Following the natural literal interpretation, “Bewertung” [assessment] might be distinguished from “Beurteilung” [evaluation] on the criterion of intensity of appraisal. An “Einschätzung” or “Bewertung” according to its ordinary unforced meaning has a stronger appraisal imprint than “Beurteilung”. Despite this (minimal) difference in the appraisal-based character, the difference between “Beurteilung” [evaluation] and “Bewertung” [assessment] is of purely academic interest. From the legal point of view, this situation presents a pleonasm as often occurs in European law because of the compromise nature of many European legal acts. The same situation often arises both within⁴⁹ and outside insurance law⁵⁰ and is of no significance in the application of the law.

If the authority discerns an infringement by an insurance undertaking, the undertaking—in Germany—will be subject to an administrative measure requiring remedy of the infringement. If the evaluation determines that the insurance undertaking is in compliance with the supervisory requirements, the supervisory authority likewise must disclose this result to the insurance undertaking subject to the procedure. Initial support for communicating the results of the Supervisory Review Process is found in that such information serves to prevent infringements by confirmation of conduct that previously was unobjectionable.⁵¹ In addition, in no. 3.70 CEIOPS’ Advice for Level 2-Implementing Measures on Solvency II: Supervisory Reporting and Public Disclosure,⁵² CEIOPS took it as given that the insurance undertakings would be aware of their evaluation by the supervisory authority. Otherwise, CEIOPS would not emphasize that the result of the Supervisory Review Process should not be the subject of public reports by insurance undertakings. In addition, the concept of notice of results of the Supervisory Review Process to the affected insurance undertaking is a basis for Issues Paper, no. 4.43, where it is stated that in certain cases discussions between the supervisory authority and the insurance undertaking should be held. Ultimately, however, this result is attributable above all to the principle of transparency of the supervisory process, as set forth in art. 31, para. 1 of the Solvency II Directive.

Thus, the supervisory authority can confirm the compliance of an insurance undertaking with the legal provisions to be met by means of determinative administrative measure. This is so because this determination would be sought by the affected insurance undertaking such that adoption of an administrative measure would be possible in this instance.⁵³ In the absence of a legal basis for a claim, insurance undertakings have no claim to a notice in the form of an administrative measure. In particular, such a measure is not inferable from the construction of sec. 289, paras. 3 and 4 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act]. In principle, a private individual has no claim to a determinative administrative measure in the absence of a corresponding provision of law.⁵⁴ Therefore, the form of the report of results in an instance of full compliance, which as such is mandatory, is consigned to the decision of the supervisory authority.

The evaluation whether governance requirements⁵⁵ have been met is a core area of the Supervisory Review Process. Articles 41 ff. of the Solvency II Directive and secs. 24 ff. of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] contain the governance requirements. Based on the general principles for corporate governance found in art. 41, para. 1 of the Solvency II Directive and in sec. 24 of the VAG-RegE, arts. 42 ff. of the Solvency II Directive and secs. 25 ff. of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] contain specific details with respect to the requirements for personnel with key functions, for the risk management system, for internal monitoring (including the compliance function), for the internal review function, for the actuarial function and for outsourcing. The implementing regulation⁵⁶ at Level 2 of the delegated legislative process supplies detail to the basic legal requirements. The Guidelines⁵⁷ at Level 3, by contrast, are not legally binding.⁵⁸

Article 41, para. 1 of the Solvency II Directive and sec. 24 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] require insurance undertakings to have an “effective system of governance” in place as well as, respectively, an effective and proper “business organization”, adequate to their individual circumstances. Under the risk-based approach of Solvency II, the aim is a system of governance that for its part entails the fewest risks possible and at the same time identifies and adequately deals with the risks arising from business activities and in the organizational area. Governance is effective when it examines its own nature as a source of risk and handles risks without endangering the objectives of supervision. In this manner it will be assured that insurance undertakings meet the primary objective⁵⁹ of insurance supervision.

Four supervisory criteria arise from arts. 41 ff. of the Solvency II Directive and secs. 24 ff. of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act]. One of these criteria is that an effective communications system must exist,⁶⁰ which above all shall be directed toward exchange of information about risks. Another criterion is sufficient internal review within the insurance undertaking, a review that takes into account the nature of the system of governance as a source of risk. Also essential is the transparency directive, which for example requires clear lines of responsibility and the issuance of guidelines in the areas of the business organization. Finally, Solvency II is concerned with an appropriate allocation of competencies. Thus, art. 42 of the Solvency II Directive, implemented in sec. 25 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act], sets forth “fit” and “proper” requirements for personnel having key functions.⁶¹ And a component of competence allocation is that, under art. 48, para. 1 (i) and sec. 31 para. 2, sent. 2 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act], the actuarial function is to be incorporated into the risk management system. Most of the deeply ramified requirements for the components of the governance system can be comprehended within one of these criteria.

Especially in the area of governance supervision, it is as difficult as it is sensitive to draw a hard and fast line between the supervision of legality set down under art. 34, para. 1 of the Solvency II Directive and an ill-defined, “back door” supervision according to the principles of abusiveness⁶² not provided for in the new Solvency II system. But even if, contrary to European law, supervision according to the principles of abusiveness is retained, as is the case under the current VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act], still its predictability should be ensured so far as possible. To this extent, then, a dilemma arises, for example, that the assessment of whether an insurance undertaking has in place an “effective risk-management system” (art. 36, para. 2 (a) and art. 44, para. 1, subpara. 1 of the Solvency II Directive and sec. 27, para. 1, sent. 1 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act]) presupposes an assessment of a chiefly economic nature on the part of the insurance supervisory authorities: The evaluation of what is “effective” proceeds de facto under commercial and thus theoretical concepts. This leads to a not inconsiderable scope for unpredictable assessment by supervisory authorities and thus also to the problem of uncertainty in the law.⁶³

This is so because even a literal interpretation of the legal requirements at issue becomes difficult due to their abstract nature. They require judgmental detail.

Nevertheless, despite these difficulties one may ascertain the natural sense of such complex concepts as “risk-management system” and “internal control”. In this, one finds assistance in business concepts and findings which are widely accepted by scholars.⁶⁴ It is especially noteworthy here that the Solvency II legal requirements prescribe merely a minimum level of precautions for an operating business organization. This condition gives rise at the same time to a prohibition on optimization for supervisory authorities with respect to the supervised insurance undertakings.⁶⁵ By contrast, economic principles generally align with the business organization best suited to maximize profit. For a business policy autonomously oriented thereon, this would signify a de facto order on optimization. Further, the law does not aim for the highest level of individual complexity; rather it seeks an application that is both abstract and of lesser complexity. In distinction to the economic sciences, the law is based upon general values and weighing of interests.⁶⁶ This should be taken into account when applying art. 36 of the Solvency II Directive. Further, the teleological interpretation of the Solvency II provisions and their concretion have a key role to play, a role that must take account of the principle of proportionality. The risk-based approach of Solvency II requires that the supervised undertakings shall have a risk status that is always within their power to control.

Early on, CEIOPS announced several pertinent criteria in order to provide insurance undertakings and supervisory authorities with non-binding guidelines. Much in this material is to be affirmed.⁶⁷ CEIOPS, however, proposed among other things handling the problem by creating groups of comparable undertakings in order to identify where each undertaking stands in this group.⁶⁸ Such a comparison cannot, for example, disclose whether a risk-management system is effective because a determination of effectiveness requires absolute, not relative, criteria. This is particularly so, because arts. 41 ff. of the Solvency II Directive and secs. 24 ff. of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] prescribe a supervisory minimum standard as to governance which, as a practical matter, insurance undertakings will mostly exceed, in view of the economic advantages of a good business organization. Indeed, a further difficulty is presented by the depth of detail in the proposals, which do not strike a proper balance between certainty in the law and principles-based supervision.

Under art. 75, para. 1 of the Solvency II Directive and sec. 69 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act], liabilities and assets are to be valued at market value. This valuation is to be based on the amount for which they could be exchanged between “knowledgeable willing parties in an arm’s length transaction”. Title 1, Chapter II of the draft of the proposed implementing regulation is addressed to concretizing these requirements. Both insurance undertakings and supervisory authorities must make use of complex models in order to correctly set market value. The requirements of art. 75 of the Solvency II Directive and sec. 69 of the VAG-RegE [Government’s Draft of a Tenth Act Amending the German Insurance Supervision Act] lead to difficult assessments based on the assumption of a hypothetical contractual party.⁶⁹