Solvency II
The European prudential supervisory framework for insurers and reinsurers, built on a risk-based approach and structured around three pillars.
On January 1, 2016, European insurers and reinsurers stopped measuring solvency as a fixed percentage of premiums or claims, the Solvency I rule, and started measuring it on their risks. Solvency II is Directive 2009/138/EC of November 25, 2009, together with Delegated Regulation (EU) 2015/35, which carries most of the calculations. The balance sheet moves to economic value: assets at market value, technical provisions at the best estimate of cash flows plus a risk margin. Two thresholds come out of it. The SCR is the capital that absorbs a one-in-two-hundred-year loss, a 99.5 percent value at risk over one year, calculated with the standard formula or an approved internal model. The MCR is the floor, calibrated at 85 percent over one year and bounded between 25 and 45 percent of the SCR. Below the SCR, the undertaking has two months to submit a recovery plan and six to get back above it (Article 138); below the MCR, one month for a short-term finance scheme and three to recover, after which the supervisor withdraws the authorization. The rest is organized in pillars. The first is capital. The second is governance, with four key functions (risk management, compliance, internal audit, actuarial) and the ORSA of Article 45. The third is disclosure: the regular supervisory report, the annual public SFCR and the quantitative reporting templates (QRTs). The number the market reads is the solvency ratio, eligible own funds over SCR; most large groups report between 150 and 250 percent. Cyber sits awkwardly in it. The standard formula has no cyber module: the risk sits in premium and reserve risk for the liability or miscellaneous financial loss lines, and in operational risk, so an accumulation on a shared cloud provider does not show up. Hence the weight given to the ORSA and to internal models on exposed books. Directive (EU) 2025/2 of November 27, 2024 revises the regime without touching its architecture, with transposition expected in early 2027.
Textbook case: a cyber insurer on an internal model whose book is concentrated on clients of the same cloud provider will carry a markedly higher SCR than a diversified book, because its model has to reflect the correlation between claims if that shared provider fails.
Solvency II, Solvency 2, Solvency II directive, Directive 2009/138/EC, EU solvency framework
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.