Operational risk (Solvency II)

A non-life insurer that collects one billion euros of premiums carries, for operational risk, 3% of that amount, or 30 million, whatever the quality of its controls. Article 204 of Delegated Regulation (EU) 2015/35 sets the formula. The operational charge is the higher of two amounts, one drawn from earned premiums, the other from technical provisions. For premiums, 4% of life premiums excluding unit-linked and 3% of non-life premiums; for provisions, 0.45% of life provisions excluding unit-linked and 3% of non-life provisions. Growth terms are added if premiums rise by more than 20% in a year. The result is capped at 30% of the basic SCR. For unit-linked contracts the charge is 25% of annual expenses, because the policyholder carries the risk. The regulator defends this simplicity, wanting it simple, and it is criticized by those who, like cyber insurers or asset managers, think it ignores the role of internal control quality. Only an internal model can model operational risk for real. Within groups, cyber, internal fraud and the failure of a critical provider therefore go through a percentage.