Framework for the Supervision of Insurance Organizations

Page 1 of 2

BOARD OF GOVERNORS

OF THE

FEDERAL RESERVE SYSTEM

WASHINGTON, D.C. 20551

DIVISION OF SUPERVISION AND

REGULATION

SR 22-8

September 27, 2022

TO THE OFFICER IN CHARGE OF SUPERVISION AT EACH FEDERAL RESERVE

BANK AND INSTITUTIONS SUPERVISED BY THE FEDERAL RESERVE

SUBJECT: Framework for the Supervision of Insurance Organizations

Applicability: This guidance applies to all supervised insurance organizations.1

The Federal Reserve is issuing the attached Framework for the Supervision of Insurance

Organizations to describe its supervisory approach for supervised insurance organizations. The

framework is designed to reflect the differences between banking and insurance.

In summary, the guidance addresses:

•

Proportional application of supervisory guidance, resources, and activities: how

supervised insurance organizations are categorized as either complex or noncomplex

based on risk profile, how the application of supervisory guidance is risk-based, and how

supervisory resources are assigned and supervisory activities are conducted.

•

Supervised insurance organization ratings: the ratings system applied to supervised

insurance organizations, including the component ratings and rating definitions.

•

Incorporating the work of other supervisors: builds upon other guidance focused on

the Federal Reserve’s work with other banking regulators and adds transparency

describing how the work of state insurance regulators is incorporated.

Reserve Banks are asked to distribute this guidance to supervised insurance organizations

in their districts, as well as to appropriate supervisory staff

efinitions.

•

Incorporating the work of other supervisors: builds upon other guidance focused on

the Federal Reserve’s work with other banking regulators and adds transparency

describing how the work of state insurance regulators is incorporated.

Reserve Banks are asked to distribute this guidance to supervised insurance organizations

in their districts, as well as to appropriate supervisory staff. In addition, questions on the

attached guidance may be sent via the Board’s public website.2

1 In this letter, a “supervised insurance organization” is a depository institution holding company that is an

insurance underwriting company, or that has over 25 percent of its consolidated assets held by insurance

underwriting subsidiaries, or has been otherwise designated as a supervised insurance organization by Federal

Reserve staff.

2 See http://www.federalreserve.gov/apps/contactus/feedback.aspx.

On June 23, 2025, the Board announced that reputational

risk will no longer be a component of examination

programs in its supervision of banks.

Page 2 of 2

Michael S. Gibson

Director

Division of Supervision and Regulation

Partially Supersedes:

• SR letter 12-17/CA letter 12-14, “Consolidated Supervision Framework for Large

Financial Institutions”

Attachments:

• Attachment A: Framework for the Supervision of Insurance Organizations

• Attachment B: SIO Complexity Classification Work Program

Cross-References:

• SR letter 21-3/CA letter 21-1, “Supervisory Guidance on Board of Directors’

Effectiveness”

• SR letter 16-11, “Supervisory Guidance for Assessing Risk Management at Supervised

Institutions with Total Consolidated Assets Less than $100 Billion”

• SR letter 13-19/CA letter 13-21, “Guidance on Managing Outsourcing Risk”

• SR letter 13-1/CA letter 13-1, “Supplemental Policy Statement on the Internal Audit

Function and Its Outsourcing”

• SR letter 11-7, “Guidance on Model Risk Management”

• SR letter 10-6, “Interagency Policy Statement on Funding and Liquidity Risk

Management”

• SR letter

l Consolidated Assets Less than $100 Billion”

• SR letter 13-19/CA letter 13-21, “Guidance on Managing Outsourcing Risk”

• SR letter 13-1/CA letter 13-1, “Supplemental Policy Statement on the Internal Audit

Function and Its Outsourcing”

• SR letter 11-7, “Guidance on Model Risk Management”

• SR letter 10-6, “Interagency Policy Statement on Funding and Liquidity Risk

Management”

• SR letter 08-8/CA letter 08-11, “Compliance Risk Management and Oversight at Large

Banking Organizations with Complex Compliance Profiles”

• SR letter 05-23/CA letter 05-10, “Interagency Guidance on Response Programs for

Unauthorized Access to Customer Information and Customer Notice”

• SR letter 03-5, “Amended Interagency Guidance on the Internal Audit Function and its

Outsourcing”

Attachment A for SR letter 22-8

Page 1 of 19

Framework for the Supervision of Insurance Organizations

This framework describes the Federal Reserve’s approach to consolidated supervision of

supervised insurance organizations.1 The framework is designed specifically to account for the

unique risks and business profiles of these firms resulting mainly from their insurance business.

The framework consists of a risk-based approach to establishing supervisory expectations,

assigning supervisory resources, and conducting supervisory activities; a supervisory rating

system; and a description of how Federal Reserve examiners work with the state insurance

regulators to limit supervisory duplication.

A.

Proportionality – Supervisory Activities and Expectations

Consistent with the Federal Reserve’s approach to risk-based supervision, supervisory

guidance is applied, and supervisory activities are conducted, in a manner that is proportionate to

each firm’s individual risk profile

ion of how Federal Reserve examiners work with the state insurance

regulators to limit supervisory duplication.

A.

Proportionality – Supervisory Activities and Expectations

Consistent with the Federal Reserve’s approach to risk-based supervision, supervisory

guidance is applied, and supervisory activities are conducted, in a manner that is proportionate to

each firm’s individual risk profile. This begins by classifying each supervised insurance

organization either as complex or noncomplex based on its risk profile and continues with a risk-

based application of supervisory guidance and supervisory activities driven by a periodic risk

assessment. The risk assessment drives planned supervisory activities and is communicated to

the firm along with the supervisory plan for the upcoming cycle. Supervisory activities are

focused on resolving supervisory knowledge gaps, monitoring the safety and soundness of the

firm, assessing the firm’s management of risks that could potentially impact its ability to act as a

source of managerial and financial strength for its depository institution(s), and monitoring for

potential systemic risk, if relevant.

Complexity Classification and Supervised Activities

The Federal Reserve classifies each supervised insurance organization as either complex

or noncomplex based on its risk profile. The classification serves as the basis for determining

the level of supervisory resources dedicated to each firm, as well as the frequency and intensity

of supervisory activities.

Complex

Complex firms have a higher level of risk and therefore require more supervisory

attention and resources. Federal Reserve dedicated supervisory teams are assigned to execute

approved supervisory plans led by a dedicated Central Point of Contact

determining

the level of supervisory resources dedicated to each firm, as well as the frequency and intensity

of supervisory activities.

Complex

Complex firms have a higher level of risk and therefore require more supervisory

attention and resources. Federal Reserve dedicated supervisory teams are assigned to execute

approved supervisory plans led by a dedicated Central Point of Contact. The activities listed in

the supervisory plans focus on understanding any risks that could threaten the safety and

soundness of the consolidated organization or a firm’s ability to act as a source of strength for its

subsidiary depository institution(s). These activities typically include continuous monitoring,

targeted topical examinations, coordinated reviews, and an annual roll-up assessment resulting in

ratings for the three rating components. The relevance of certain supervisory guidance may vary

among complex firms based on each firm’s risk profile. Supervisory guidance targeted at

1 In this framework, a “supervised insurance organization” is a depository institution holding company that is an

insurance underwriting company, or that has over 25 percent of its consolidated assets held by insurance

underwriting subsidiaries, or has been otherwise designated as a supervised insurance organization by Federal

Reserve staff.

Attachment A for SR letter 22-8

Page 2 of 19

smaller depository institution holding companies, for example, may be more relevant for

complex supervised insurance organizations with limited inherent exposure to a certain risk.

Noncomplex

Noncomplex firms, due to their lower risk profile, require less supervisory oversight

relative to complex firms. The supervisory activities for these firms occur primarily during a

rating examination that occurs no less often than every other year and results in the three

component ratings

mplex supervised insurance organizations with limited inherent exposure to a certain risk.

Noncomplex

Noncomplex firms, due to their lower risk profile, require less supervisory oversight

relative to complex firms. The supervisory activities for these firms occur primarily during a

rating examination that occurs no less often than every other year and results in the three

component ratings. The supervision of noncomplex firms relies more heavily on the reports and

assessments of a firm’s other relevant supervisors, although these firms may also be subject to

continuous monitoring, targeted topical examinations, and coordinated reviews as appropriate.

The focus and types of supervisory activities for noncomplex firms are also set based on the risks

of each firm.

Factors considered when classifying a supervised insurance organization as either

complex or noncomplex include the absolute and relative size of its depository institution(s), its

current supervisory and regulatory oversight (ratings and opinions of its supervisors, and the

nature and extent of any unregulated and/or unsupervised activities), the breadth and nature of

product and portfolio risks, the nature of its organizational structure, its quality and level of

capital and liquidity, the materiality of any international exposure, and its interconnectedness

with the broader financial system.

For supervised insurance organizations that are commencing Federal Reserve

supervision, the classification as complex or noncomplex is done and communicated during the

application phase after initial discussions with the firm. The firm’s risk profile, including the

characteristics listed above, are evaluated by staff of the Board and relevant Reserve Bank before

the complexity classification is assigned by Board staff

rganizations that are commencing Federal Reserve

supervision, the classification as complex or noncomplex is done and communicated during the

application phase after initial discussions with the firm. The firm’s risk profile, including the

characteristics listed above, are evaluated by staff of the Board and relevant Reserve Bank before

the complexity classification is assigned by Board staff. Large, well-established, and financially

strong supervised insurance organizations with relatively small depository institutions can be

classified as noncomplex if, in the opinion of Board staff, the corresponding level of supervisory

oversight is sufficient to accomplish its objectives. Although the risk profile is the primary basis

for assigning a classification, a firm is automatically classified as complex if its depository

institution’s average assets exceed $100 billion. A firm may request that the Federal Reserve

review its complexity classification if it has experienced a significant change to its risk profile.

The focus, frequency, and intensity of supervisory activities are based on a risk

assessment of the firm completed periodically by the supervisory team and will vary among

firms within the same complexity classification. For each risk described in the Supervisory

Expectations section below, the supervisory team assesses the firm’s inherent risks and its

residual risk after considering the effectiveness of its management of the risk. The risk

assessment and the supervisory activities that follow from it take into account the assessments

made by and work performed by the firm’s other regulators. In certain instances, Federal

Reserve examiners may be able to rely on a firm’s internal audit (if it is rated effective) or

internal control functions in developing the risk assessment

effectiveness of its management of the risk. The risk

assessment and the supervisory activities that follow from it take into account the assessments

made by and work performed by the firm’s other regulators. In certain instances, Federal

Reserve examiners may be able to rely on a firm’s internal audit (if it is rated effective) or

internal control functions in developing the risk assessment.

Supervisory Expectations

Supervised insurance organizations are required to operate in a safe and sound manner, to

comply with all applicable laws and regulations, and to possess sufficient financial and

operational strength to serve as a source of strength for their depository institution(s) through a

Attachment A for SR letter 22-8

Page 3 of 19

range of stressful yet plausible conditions. The governance and risk management practices

necessary to accomplish these objectives will vary based on a firm’s specific risk profile, size,

and complexity. Guidance describing supervisory expectations for safe and sound practices can

be found in Supervision & Regulation (SR) letters published by the Board and other supervisory

material. Supervisory guidance most relevant to a specific supervised insurance organization is

driven by the risk profile of the firm. Federal Reserve examiners periodically reassess the firm’s

risk profile and inform the firm if different supervisory guidance becomes more relevant as a

result of a material change to its risk profile.

Most supervisory guidance issued by the Board is intended specifically for institutions

that are primarily engaged in banking activities. Examples of specific practices provided in these

materials may differ from (or not be applicable to) the nonbanking operations of supervised

insurance organizations, including for insurance operations. The Board recognizes that practices

in nonbanking business lines can be different than those published in supervisory guidance

without being considered unsafe or unsound

in banking activities. Examples of specific practices provided in these

materials may differ from (or not be applicable to) the nonbanking operations of supervised

insurance organizations, including for insurance operations. The Board recognizes that practices

in nonbanking business lines can be different than those published in supervisory guidance

without being considered unsafe or unsound. When making their assessment, Federal Reserve

examiners work with supervised insurance organizations and other involved regulators, including

state insurance regulators, to appropriately assess practices that may be different than those

typically observed for banking operations.

This section describes general safety and soundness expectations and how the Board has

adapted its supervisory expectations to reflect the special characteristics of a supervised

insurance organization. The section is organized using the three rating components –

Governance and Controls, Capital Management, and Liquidity Management.

Governance and Controls

The Governance and Controls component rating is derived from an assessment of the

effectiveness of a firm’s (1) board and senior management, and (2) independent risk management

and controls. All firms are expected to align their strategic business objectives with their risk

appetite and risk management capabilities; maintain effective and independent risk management

and control functions including internal audit; promote compliance with laws and regulations;

and remain a source of financial and managerial strength for their depository institution(s).

When assessing governance and controls, Federal Reserve examiners consider a firm’s risk

management capabilities relative to its risk exposure within the following areas: internal audit,

credit risk, legal and compliance risk, market risk, model risk, and operational risk, including

cybersecurity/information technology and third-party risk

agerial strength for their depository institution(s).

When assessing governance and controls, Federal Reserve examiners consider a firm’s risk

management capabilities relative to its risk exposure within the following areas: internal audit,

credit risk, legal and compliance risk, market risk, model risk, and operational risk, including

cybersecurity/information technology and third-party risk.

Governance & Controls expectations

• Despite differences in their business models and the products offered, insurance companies

and banks are expected to have effective and sustainable systems of governance and controls

to manage their respective risks. The governance and controls framework for a supervised

insurance organization should:

o Clearly define roles and responsibilities throughout the organization;

o Include policies and procedures, limits, requirements for documenting decisions, and

decision-making and accountability chains of command; and

o Provide timely information about risk and corrective action for non-compliance or weak

oversight, controls, and management.

Attachment A for SR letter 22-8

Page 4 of 19

• The Board expects the sophistication of the governance and controls framework to be

commensurate with the size, complexity, and risk profile of the firm. As such, governance

and controls expectations for complex firms will be higher than that for noncomplex firms

but will also vary based on each firm’s risk profile.

• The Board expects supervised insurance organizations to have a risk management and control

framework that is commensurate with its structure, risk profile, complexity, activities, and

size. For any chosen structure, the firm’s board is expected to have the capacity, expertise,

and sufficient information to discharge risk oversight and governance responsibilities in a

safe and sound manner

• The Board expects supervised insurance organizations to have a risk management and control

framework that is commensurate with its structure, risk profile, complexity, activities, and

size. For any chosen structure, the firm’s board is expected to have the capacity, expertise,

and sufficient information to discharge risk oversight and governance responsibilities in a

safe and sound manner.

In assigning a rating for the Governance and Controls component, Federal Reserve

examiners evaluate:

Board and Senior Management Effectiveness

• The firm’s board is expected to exhibit certain attributes consistent with effectiveness,

including: (i) setting a clear, aligned, and consistent direction regarding the firm’s strategy

and risk appetite; (ii) directing senior management regarding board reporting; (iii) overseeing

and holding senior management accountable; (iv) supporting the independence and stature of

independent risk management and internal audit; and (v) maintaining a capable board and an

effective governance structure. As the consolidated supervisor, the Board focuses on the

board of the supervised insurance organization and its committees. Complex firms are

expected to take into consideration the Board’s guidance on board of directors’

effectiveness.2 In assessing the effectiveness of a firm’s senior management, Federal

Reserve examiners consider the extent to which senior management effectively and prudently

manages the day-to-day operations of the firm and provides for ongoing resiliency;

implements the firm’s strategy and risk appetite; identifies and manages risks; maintains an

effective risk management framework and system of internal controls; and promotes prudent

risk taking behaviors and business practices, including compliance with laws and regulations

such as those related to consumer protection and the Bank Secrecy Act/Anti-Money

Laundering and Office of Foreign Assets Control (BSA/AML and OFAC)

egy and risk appetite; identifies and manages risks; maintains an

effective risk management framework and system of internal controls; and promotes prudent

risk taking behaviors and business practices, including compliance with laws and regulations

such as those related to consumer protection and the Bank Secrecy Act/Anti-Money

Laundering and Office of Foreign Assets Control (BSA/AML and OFAC). Federal Reserve

examiners evaluate how the framework allows management to be responsible for and manage

all risk types, including emerging risks, within the business lines. Examiners rely to the

fullest extent possible on insurance and banking supervisors’ examination reports and

information concerning risk and management in specific lines of business, including relying

specifically on state insurance regulators to evaluate and assess how firms manage the

pricing, underwriting, and reserving risk of their insurance operations.

Independent Risk Management and Controls

• In assessing a firm’s independent risk management and controls, Federal Reserve examiners

consider the extent to which independent risk management effectively evaluates whether the

firm’s risk appetite framework identifies and measures all of the firm’s material risks;

establishes appropriate risk limits; and aggregates, assesses and reports on the firm’s risk

2 See SR letter 21-3, “Supervisory Guidance on Board of Directors’ Effectiveness.”

controls, Federal Reserve examiners

consider the extent to which independent risk management effectively evaluates whether the

firm’s risk appetite framework identifies and measures all of the firm’s material risks;

establishes appropriate risk limits; and aggregates, assesses and reports on the firm’s risk

2 See SR letter 21-3, “Supervisory Guidance on Board of Directors’ Effectiveness.”

Attachment A for SR letter 22-8

Page 5 of 19

profile and positions. Additionally, the firm is expected to demonstrate that its internal

controls are appropriate and tested for effectiveness and sustainability.

• Internal Audit is an integral part of a supervised insurance organization’s internal control

system and risk management structure. An effective internal audit function plays an essential

role by providing an independent risk assessment and objective evaluation of all key

governance, risk management, and internal control processes. Internal audit is expected to

effectively and independently assess the firm’s risk management framework and internal

control systems, and report findings to senior management and to the firm’s audit committee.

Despite differences in business models, the Board expects the largest, most complex

supervised insurance organizations to have internal audit practices in place that are similar to

those at banking organizations and as such, no modification to existing guidance is required

for these firms.3 At the same time, the Board recognizes that firms should have an internal

audit function that is appropriate to their size, nature, and scope of activities. Therefore, for

noncomplex firms, Federal Reserve examiners will consider the expectations in the insurance

company’s domicile state’s Annual Financial Reporting Regulation (NAIC Model Audit

Rule 205), or similar state regulation, to assess the effectiveness of a firm’s internal audit

function

have an internal

audit function that is appropriate to their size, nature, and scope of activities. Therefore, for

noncomplex firms, Federal Reserve examiners will consider the expectations in the insurance

company’s domicile state’s Annual Financial Reporting Regulation (NAIC Model Audit

Rule 205), or similar state regulation, to assess the effectiveness of a firm’s internal audit

function.

The principles of sound risk management described in the previous sections apply to the entire

spectrum of risk management activities of a supervised insurance organization, including but not

limited to:

• Credit risk arises from the possibility that a borrower or counterparty will fail to perform on

an obligation. Fixed income securities, by far the largest asset class held by many insurance

companies, is a large source of credit risk. This is unlike most banking organizations, where

loans generally make up the largest portion of balance sheet assets. Life insurer investment

portfolios in particular are generally characterized by longer duration holdings compared to

those of banking organizations. Additionally, an insurance company’s reinsurance

recoverables/receivables arising from the use of third-party reinsurance and participation in

regulatory required risk-pooling arrangements expose the firm to additional counterparty

credit risk. Federal Reserve examiners scope examination work based on a firm’s level of

inherent credit risk. The level of inherent risk is determined by analyzing the composition,

concentration, and quality of the consolidated investment portfolio; the level of a firm’s

reinsurance recoverables, the credit quality of the individual reinsurers, and the amount of

collateral held for reinsured risks; and credit exposures associated with derivatives, securities

lending, or other activities that may also have off-balance sheet counterparty credit

exposures

the composition,

concentration, and quality of the consolidated investment portfolio; the level of a firm’s

reinsurance recoverables, the credit quality of the individual reinsurers, and the amount of

collateral held for reinsured risks; and credit exposures associated with derivatives, securities

lending, or other activities that may also have off-balance sheet counterparty credit

exposures. In determining the effectiveness of a firm’s management of its credit risk, Federal

Reserve examiners rely, where possible, on the assessments made by other relevant

supervisors for the depository institution(s) and the insurance company(ies). In its own

assessment, the Federal Reserve will determine whether the board and senior management

have established an appropriate credit risk governance framework consistent with the firm’s

risk appetite; whether policies, procedures and limits are adequate and provide for ongoing

monitoring, reporting and control of credit risk; the adequacy of management information

3 Regulatory guidance provided in SR letter 03-5, “Amended Interagency Guidance on the Internal Audit Function

and its Outsourcing” and SR letter 13-1, “Supplemental Policy Statement on the Internal Audit Function and Its

Outsourcing” are applicable to complex supervised insurance organizations.

Attachment A for SR letter 22-8

Page 6 of 19

systems as it relates to credit risk; and the sufficiency of internal audit and independent

review coverage of credit risk exposure.

• Market risk arises from exposures to losses as a result of underlying changes in, for example,

interest rates, equity prices, foreign exchange rates, commodity prices, or real estate prices.

Federal Reserve examiners scope examination work based on a firm’s level of inherent

market risk exposure, which is normally driven by the primary business line(s) in which the

firm is engaged as well as the structure of the investment portfolio

es as a result of underlying changes in, for example,

interest rates, equity prices, foreign exchange rates, commodity prices, or real estate prices.

Federal Reserve examiners scope examination work based on a firm’s level of inherent

market risk exposure, which is normally driven by the primary business line(s) in which the

firm is engaged as well as the structure of the investment portfolio. A firm may be exposed

to inherent market risk due to its investment portfolio or as result of its product offerings,

including variable and indexed life insurance and annuity products, or asset/wealth

management business. While interest rate risk (IRR), a category of market risk, differs

between insurance companies and banking organizations, the degree of IRR also differs

based on the type of insurance products the firm offers. IRR is generally a small risk for U.S.

property/casualty (P/C) whereas it can be a significant risk factor for life insurers with certain

life and annuity products that are spread-based, longer in duration, may include embedded

product guarantees, and can pose disintermediation risk. Equity market risk can be

significant for life insurers that issue guarantees tied to equity markets, like variable annuity

living benefits, and for P/C insurers with large common equity allocations in their investment

portfolios. Generally foreign exchange and commodity risk is low for supervised insurance

organizations but could be material for some complex firms. Firms are expected to have

sound risk management infrastructure that adequately identifies, measures, monitors, and

controls any material or significant forms of market risks to which it is exposed.

• Model risk is the potential for adverse consequences from decisions based on incorrect or

misused model outputs and reports. Model risk can lead to financial loss, poor business and

strategic decision-making, or damage to a firm’s reputation

t infrastructure that adequately identifies, measures, monitors, and

controls any material or significant forms of market risks to which it is exposed.

• Model risk is the potential for adverse consequences from decisions based on incorrect or

misused model outputs and reports. Model risk can lead to financial loss, poor business and

strategic decision-making, or damage to a firm’s reputation. Supervised insurance

organizations are often heavily reliant on models for product pricing and reserving, risk and

capital management, strategic planning and other decision-making purposes. A sound model

risk management framework helps manage this risk.4 Federal Reserve examiners take into

account the firm’s size, nature, and complexity, as well as the extent of use and sophistication

of its models when assessing its model risk management program. Examiners focus on the

governance framework, policies and controls, and enterprise model risk management through

a holistic evaluation of the firm’s practices. The Federal Reserve’s review of a firm’s model

risk management program complements the work of the firm’s other relevant supervisors. A

sound model risk management framework includes three main elements: (1) an accurate

model inventory and an appropriate approach to model development, implementation, and

use; (2) effective model validation and continuous model performance monitoring; and (3) a

strong governance framework that provides explicit support and structure for model risk

management through policies defining relevant activities, procedures that implement those

policies, allocation of resources, and mechanisms for evaluating whether policies and

procedures are being carried out as specified, including internal audit review. The Federal

Reserve relies on work already conducted by other relevant supervisors and appropriately

collaborates with state insurance regulators on their findings related to insurance models

ties, procedures that implement those

policies, allocation of resources, and mechanisms for evaluating whether policies and

procedures are being carried out as specified, including internal audit review. The Federal

Reserve relies on work already conducted by other relevant supervisors and appropriately

collaborates with state insurance regulators on their findings related to insurance models.

With respect to insurance models, the Federal Reserve recognizes the important role played

4 SR letter 11-7, “Guidance on Model Risk Management” is applicable to all supervised insurance organizations.

Attachment A for SR letter 22-8

Page 7 of 19

by actuaries as described in actuarial standards of practice on model risk management. With

respect to the business of insurance, Federal Reserve examiners focus on the firm’s

adherence to its own policies and procedures and the comprehensiveness of model validation

rather than technical specifications such as the appropriateness of the model, its assumptions,

or output. Federal Reserve examiners may request that firms provide model documentation

or model validation reports for insurance and bank models when performing transaction

testing.

• Legal risk arises from the potential that unenforceable contracts, lawsuits, or adverse

judgments can disrupt or otherwise negatively affect the operations or financial condition of

a supervised insurance organization.

• Compliance risk is the risk of regulatory sanctions, fines, penalties, or losses resulting from

failure to comply with laws, rules, regulations, or other supervisory requirements applicable

to a firm. By offering multiple financial service products that may include insurance,

annuity, banking, services provided by securities broker-dealers, and asset and wealth

management products, provided through a diverse distribution network, supervised insurance

organizations are inherently exposed to a significant amount of legal and compliance risk

ther supervisory requirements applicable

to a firm. By offering multiple financial service products that may include insurance,

annuity, banking, services provided by securities broker-dealers, and asset and wealth

management products, provided through a diverse distribution network, supervised insurance

organizations are inherently exposed to a significant amount of legal and compliance risk.

As the consolidated supervisor, the Board expects firms to have an enterprise-wide legal and

compliance risk management program that covers all business lines, legal entities, and

jurisdictions of operation. Firms are expected to have compliance risk management

governance, oversight, monitoring, testing, and reporting commensurate with their size and

complexity, and to ensure compliance with all applicable laws and regulations. The

principles-based guidance in existing SR letters related to legal and compliance risk is

applicable to supervised insurance organizations.5 For both complex and noncomplex firms,

Federal Reserve examiners rely on the work of the firm’s other supervisors. As described in

section C, Incorporating the Work of Other Supervisors, the assessments, examination

results, ratings, supervisory issues, and enforcement actions from other supervisors will be

incorporated into a consolidated assessment of the enterprise-wide legal and compliance risk

management framework.

o Money laundering, terrorist financing and other illicit financial activity risk is the risk of

providing criminals access to the legitimate financial system and thereby being used to

facilitate financial crime. This financial crime includes laundering criminal proceeds,

financing terrorism, and conducting other illegal activities. Money laundering and

terrorist financing risk is associated with a financial institution’s products, services,

customers, and geographic locations. This and other illicit financial activity risks can

impact a firm across business lines, legal entities, and jurisdictions

This financial crime includes laundering criminal proceeds,

financing terrorism, and conducting other illegal activities. Money laundering and

terrorist financing risk is associated with a financial institution’s products, services,

customers, and geographic locations. This and other illicit financial activity risks can

impact a firm across business lines, legal entities, and jurisdictions. A reasonably

designed compliance program generally includes a structure and oversight that mitigates

these risks and supports regulatory compliance with both BSA/AML OFAC

requirements. Although OFAC regulations are not part of the BSA, OFAC compliance

programs are frequently assessed in conjunction with BSA/AML. Supervised insurance

5 SR letter 08-8, “Compliance Risk Management Programs and Oversight at Large Banking Organizations with

Complex Compliance Profiles” is applicable to complex supervised insurance organizations. For noncomplex firms,

the Federal Reserve will assess legal and compliance risk management based on the guidance in SR letter 16-11,

“Supervisory Guidance for Assessing Risk Management at Supervised Institutions with Total Consolidated Assets

Less than $100 Billion.”

Attachment A for SR letter 22-8

Page 8 of 19

organizations are not defined as financial institutions under the BSA and, therefore, are

not required to have an AML program, unless the firm is directly selling certain insurance

products. However, certain subsidiaries and affiliates of supervised insurance

organizations, such as insurance companies and banks, are defined as financial

institutions under 31 U.S.C. 5312(a)(2) and must develop and implement a written

BSA/AML compliance program as well as comply with other BSA regulatory

requirements

e an AML program, unless the firm is directly selling certain insurance

products. However, certain subsidiaries and affiliates of supervised insurance

organizations, such as insurance companies and banks, are defined as financial

institutions under 31 U.S.C. 5312(a)(2) and must develop and implement a written

BSA/AML compliance program as well as comply with other BSA regulatory

requirements. Unlike banks, insurance companies’ BSA/AML obligations are limited to

certain products, referred to as covered insurance products.6 The volume of covered

products, which the Financial Crimes Enforcement Network (FinCEN) has determined to

be of higher risk, is an important driver of supervisory focus. In addition, as U.S.

persons, all supervised insurance organizations (including their subsidiaries and affiliates)

are subject to OFAC regulations. Federal Reserve examiners assess all material risks that

each firm faces, extending to whether business activities across the consolidated

organization, including within its individual subsidiaries or affiliates, comply with the

legal requirements of BSA and OFAC regulations. In keeping with the principles of a

risk-based framework and proportionality, Federal Reserve supervision for BSA/AML

and OFAC primarily focuses on oversight of compliance programs at a consolidated level

and relies on work by other relevant supervisors to the fullest extent possible. In the

evaluation of a firm’s risks and BSA/AML and OFAC compliance program, however, it

may be necessary for examiners to review compliance with BSA/AML and OFAC

requirements at individual subsidiaries or affiliates in order to fully assess the material

risks of the supervised insurance organization.

• Operational risk is the risk of loss resulting from inadequate or failed internal processes,

people, and systems, or from external events. Operational resilience is the ability to maintain

operations, including critical operations and core business lines, through a disruption from

any hazard

affiliates in order to fully assess the material

risks of the supervised insurance organization.

• Operational risk is the risk of loss resulting from inadequate or failed internal processes,

people, and systems, or from external events. Operational resilience is the ability to maintain

operations, including critical operations and core business lines, through a disruption from

any hazard. It is the outcome of effective operational risk management combined with

sufficient financial and operational resources to prepare, adapt, withstand, and recover from

disruptions. A firm that operates in a safe and sound manner is able to identify threats,

respond and adapt to incidents, and recover and learn from such threats and incidents so that

it can prioritize and maintain critical operations and core business lines, along with other

operations, services and functions identified by the firm, through a disruption.

o Cybersecurity/information technology risks are a subset of operational risk and arise

from operations of a firm requiring a strong and robust internal control system and risk

management oversight structure. Information Technology (IT) and Cybersecurity

(Cyber) functions are especially critical to a firm’s operations. Examiners of financial

institutions, including supervised insurance organizations, utilize the detailed guidance on

mitigating these risks in the Federal Financial Institutions Examination Council’s

6 “Covered products” means a permanent life insurance policy, other than a group life insurance policy; an annuity

contract, other than a group annuity contract; or any other insurance product with features of cash value or

investment. 31 CFR 1025.100(b). “Permanent life insurance policy” means an agreement that contains a cash value

or investment element and that obligates the insurer to indemnify or to confer a benefit upon the insured or

beneficiary to the agreement contingent upon the death of the insured. 31 CFR 1025.100(h)

group annuity contract; or any other insurance product with features of cash value or

investment. 31 CFR 1025.100(b). “Permanent life insurance policy” means an agreement that contains a cash value

or investment element and that obligates the insurer to indemnify or to confer a benefit upon the insured or

beneficiary to the agreement contingent upon the death of the insured. 31 CFR 1025.100(h). “Annuity contract”

means any agreement between the insurer and the contract owner whereby the insurer promises to pay out a fixed or

variable income stream for a period of time. 31 CFR 1025.100(a).

Attachment A for SR letter 22-8

Page 9 of 19

(FFIEC) IT Handbooks. In assessing IT/Cyber risks, Federal Reserve examiners assess

each firm’s:

 Board and senior management for effective oversight and support of IT management;

 Information/cyber security program for strong board and senior management support,

integration of security activities and controls through business processes, and

establishment of clear accountability for security responsibilities;

 IT operations for sufficient personnel, system capacity and availability, and storage

capacity adequacy to achieve strategic objectives and appropriate solutions;

 Development and acquisition processes’ ability to identify, acquire, develop, install, and

maintain effective IT to support business operations; and

 Appropriate business continuity management processes to effectively oversee and

implement resilience, continuity, and response capabilities to safeguard employees,

customers, assets, products, and services.

Complex and noncomplex firms are assessed in these areas. All supervised insurance

organizations are required to notify the Federal Reserve of any computer-security

notification incidents.7

o Third party risk is also a subset of operational risk and arises from a firm’s use of service

providers to perform operational or service functions

ployees,

customers, assets, products, and services.

Complex and noncomplex firms are assessed in these areas. All supervised insurance

organizations are required to notify the Federal Reserve of any computer-security

notification incidents.7

o Third party risk is also a subset of operational risk and arises from a firm’s use of service

providers to perform operational or service functions. These risks may be inherent to the

outsourced activity or be introduced with the involvement of the service provider. When

assessing effective third party risk management, Federal Reserve examiners evaluate

eight areas: 1) third party risk management governance, 2) risk assessment framework, 3)

due diligence in the selection of a service provider, 4) a review of any incentive

compensation embedded in a service provider contract, 5) management of any contract or

legal issues arising from third party agreements, 6) ongoing monitoring and reporting of

third parties, 7) business continuity and contingency of the third party for any service

disruptions, and 8) effective internal audit program to assess the risk and controls of the

firm’s third party risk management program.8

Capital Management

The Capital Management rating is derived from an assessment of a firm’s current and

stressed level of capitalization, and the quality of its capital planning and internal stress testing.

A capital management program should be commensurate with a supervised insurance

organization’s complexity and risk profile. In assigning this rating, the Federal Reserve

examiners evaluate the extent to which a firm maintains sound capital planning practices through

effective governance and oversight, effective risk management and controls, maintenance of

updated capital policies and contingency plans for addressing potential shortfalls, and

incorporation of appropriately stressful conditions into capital planning and projections of capital

positions

Reserve

examiners evaluate the extent to which a firm maintains sound capital planning practices through

effective governance and oversight, effective risk management and controls, maintenance of

updated capital policies and contingency plans for addressing potential shortfalls, and

incorporation of appropriately stressful conditions into capital planning and projections of capital

positions. The extent to which a firm’s capital is sufficient to comply with regulatory

7 SR letter 22-4, “Contact Information in Relation to Computer-Security Incident Notification Requirements”

applies to all supervised insurance organizations.

8 SR letter 13-19, “Guidance on Managing Outsourcing Risk” applies to all supervised insurance organizations.

Attachment A for SR letter 22-8

Page 10 of 19

requirements, to support the firm’s ability to meet its obligations, and to enable the firm to

remain a source of strength to its depository institution(s) in a range of stressful, but plausible,

economic and financial environments is also evaluated.

Insurance company balance sheets are typically quite different from those of most

banking organizations. For life insurance companies, investment strategies may focus on cash

flow matching to reduce interest rate risk and provide liquidity to support their liabilities, while

for traditional banks, deposits (liabilities) are attracted to support investment strategies.

Additionally, for insurers, capital provides a buffer for policyholder claims and creditor

obligations, helping the firm absorb adverse deviations in expected claims experience, and other

drivers of economic loss. The Board recognizes that the capital needs for insurance activities are

materially different from those of banking activities and can be different between life and

property and casualty insurers. Insurers may also face capital fungibility constraints not faced by

banking organizations

lping the firm absorb adverse deviations in expected claims experience, and other

drivers of economic loss. The Board recognizes that the capital needs for insurance activities are

materially different from those of banking activities and can be different between life and

property and casualty insurers. Insurers may also face capital fungibility constraints not faced by

banking organizations.

In assessing a supervised insurance organization’s capital management, the Federal

Reserve relies to the fullest extent possible on information provided by state insurance

regulators, including the firm’s own risk and solvency assessment (ORSA) and the state

insurance regulator’s written assessment of the ORSA. An ORSA is an internal process

undertaken by an insurance group to assess the adequacy of its risk management and current and

prospective capital position under normal and stress scenarios. As part of the ORSA, insurance

groups are required to analyze all reasonably foreseeable and relevant material risks that could

have an impact on their ability to meet obligations.

The Board expects supervised insurance organizations to have sound governance over

their capital planning process. A firm should establish capital goals that are approved by the

board of directors, and that reflect the potential impact of legal and/or regulatory restrictions on

the transfer of capital between legal entities. In general, senior management should establish the

capital planning process, which should be reviewed and approved periodically by the board. The

board should require senior management to provide clear, accurate, and timely information on

the firm’s material risks and exposures to inform board decisions on capital adequacy and

actions. The capital planning process should clearly reflect the difference between the risk

profiles and associated capital needs of the insurance and banking businesses

approved periodically by the board. The

board should require senior management to provide clear, accurate, and timely information on

the firm’s material risks and exposures to inform board decisions on capital adequacy and

actions. The capital planning process should clearly reflect the difference between the risk

profiles and associated capital needs of the insurance and banking businesses.

A firm should have a risk management framework that appropriately identifies, measures,

and assesses material risks and provides a strong foundation for capital planning. This

framework should be supported by comprehensive policies and procedures, clear and well-

established roles and responsibilities, strong internal controls, and effective reporting to senior

management and the board. In addition, the risk management framework should be built upon

sound management information systems.

As part of capital management, a firm should have a sound internal control framework

that helps ensure that all aspects of the capital planning process are functioning as designed and

result in an accurate assessment of the firm’s capital needs. The internal control framework

should be independently evaluated periodically by the firm’s internal audit function.

The governance and oversight framework should include an assessment of the principles

and guidelines used for capital planning, issuance, and usage, including internal post-stress

capital goals and targeted capital levels; guidelines for dividend payments and stock repurchases;

e internal control framework

should be independently evaluated periodically by the firm’s internal audit function.

The governance and oversight framework should include an assessment of the principles

and guidelines used for capital planning, issuance, and usage, including internal post-stress

capital goals and targeted capital levels; guidelines for dividend payments and stock repurchases;

Attachment A for SR letter 22-8

Page 11 of 19

strategies for addressing capital shortfalls; and internal governance responsibilities and

procedures for the capital policy. The capital policy should reflect the capital needs of the

insurance and banking businesses based on their risks, be approved by the firm’s board of

directors or a designated committee of the board, and be re-evaluated periodically and revised as

necessary.

A strong capital management program will incorporate appropriately stressful conditions

and events that could adversely affect the firm’s capital adequacy and capital planning. As part

of its capital plan, a firm should use at least one scenario that stresses the specific vulnerabilities

of the firm’s activities and associated risks, including those related to the firm’s insurance

activities and its banking activities.

Supervised insurance organizations should employ estimation approaches to project the

impact on capital positions of various types of stressful conditions and events, and that are

independently validated. A firm should estimate losses, revenues, expenses, and capital using

sound methods that incorporate macroeconomic and other risk drivers. The robustness of a firm’s

capital stress testing processes should be commensurate with its risk profile.

Liquidity Management

The Liquidity Management rating is derived from an assessment of the supervised

insurance organization’s liquidity position and the quality of its liquidity risk management

program. Each firm’s liquidity risk management program should be commensurate with its

complexity and risk profile

rm’s

capital stress testing processes should be commensurate with its risk profile.

Liquidity Management

The Liquidity Management rating is derived from an assessment of the supervised

insurance organization’s liquidity position and the quality of its liquidity risk management

program. Each firm’s liquidity risk management program should be commensurate with its

complexity and risk profile.

The Board recognizes that supervised insurance organizations are typically less exposed

to traditional liquidity risk than banking organizations. Instead of cash outflows being mainly

the result of discretionary withdrawals, cash outflows for many insurance products only result

from the occurrence of an insured event. Insurance products, like annuities, that are potentially

exposed to call risk generally have product features (i.e., surrender charges, market value

surrenders, tax treatment, etc.) that help mitigate liquidity risk.

Federal Reserve examiners tailor the application of existing supervisory guidance on

liquidity risk management to reflect the liquidity characteristics of supervised insurance

organizations. 9 For example, guidance on intra-day liquidity management would only be

applicable for supervised insurance organizations with material intra-day liquidity risks.

Additionally, specific references to liquid assets may be more broadly interpreted to include

other asset classes such as certain investment-grade corporate bonds.

The scope of the Federal Reserve’s supervisory activities on liquidity risk is influenced

by each firm’s individual risk profile. Traditional property and casualty insurance products are

typically short duration liabilities backed by short-duration, liquid assets. Because of this, they

typically present lower liquidity risk than traditional banking activities

nvestment-grade corporate bonds.

The scope of the Federal Reserve’s supervisory activities on liquidity risk is influenced

by each firm’s individual risk profile. Traditional property and casualty insurance products are

typically short duration liabilities backed by short-duration, liquid assets. Because of this, they

typically present lower liquidity risk than traditional banking activities. However, some non-

traditional life insurance and retirement products create liquidity risk through features that allow

payments at the request of policyholders without the occurrence of an insured event. Risks of

certain other insurance products are often mitigated using derivatives. Any differences between

collateral requirements related to hedging and the related liability cash flows can also create

9 See SR letter 10-6, “Interagency Policy Statement on Funding and Liquidity Risk Management.”

Attachment A for SR letter 22-8

Page 12 of 19

liquidity risk. The Board expects firms significantly engaged in these types of insurance

activities to have correspondingly more sophisticated liquidity risk management programs.

A strong liquidity risk management program includes cash flow forecasting with

appropriate granularity. The firm’s suite of quantitative metrics should effectively inform senior

management and the board of directors of the firm’s liquidity risk profile and identify liquidity

events or stresses that could detrimentally affect the firm. The metrics used to measure a firm’s

liquidity position may vary by type of business.

Federal Reserve examiners rely to the fullest extent possible on each firm’s ORSA, which

requires all firms to include a discussion of the risk management framework and assessment of

material risks, including liquidity risk.

Supervised insurance organizations are expected to perform liquidity stress testing at

least annually and more frequently, if necessary, based on their risk profile

ss.

Federal Reserve examiners rely to the fullest extent possible on each firm’s ORSA, which

requires all firms to include a discussion of the risk management framework and assessment of

material risks, including liquidity risk.

Supervised insurance organizations are expected to perform liquidity stress testing at

least annually and more frequently, if necessary, based on their risk profile. The scenarios used

should reflect the firm’s specific risk profile and include both idiosyncratic and system-wide

stress events. Stress testing should inform the firm on the amount of liquid assets necessary to

meet net cash outflows over relevant time periods, including at least a one-year time horizon.

Firms should hold a liquidity buffer comprised of highly liquid assets to meet stressed net cash

outflows. The liquidity buffer should be measured using appropriate haircuts based on asset

quality, duration, and expected market illiquidity based on the stress scenario assumptions.

Stress testing should reflect the expected impact on collateral requirements. For material life

insurance operations, Federal Reserve examiners will rely to the greatest extent possible on

information submitted by the firm to comply with the National Association of Insurance

Commissioners’ (NAIC) liquidity stress test framework.

The fungibility of sources of liquidity is often limited between an insurance group’s legal

entities. Large insurance groups can operate with a significant number of legal entities and many

different regulatory and operational barriers to transferring funds among them. Regulations

designed to protect policyholders of insurance operating companies can limit the transferability

of funds from an insurance company to other legal entities within the group, including to other

insurance operating companies. Supervised insurance organizations should carefully consider

these limitations in their stress testing and liquidity risk management framework

unds among them. Regulations

designed to protect policyholders of insurance operating companies can limit the transferability

of funds from an insurance company to other legal entities within the group, including to other

insurance operating companies. Supervised insurance organizations should carefully consider

these limitations in their stress testing and liquidity risk management framework. Effective

liquidity stress testing should include stress testing at the legal entity level with consideration for

intercompany liquidity fungibility. Furthermore, the firm should be able to measure and provide

an assessment of liquidity at the top-tier depository institution holding company in a manner that

incorporates fungibility constraints.

The enterprise-wide governance and oversight framework should be consistent with the

firm’s liquidity risk profile and include policies and procedures on liquidity risk management.

The firm’s policies and procedures should describe its liquidity risk reporting, stress testing, and

contingency funding plan.

B.

Supervisory Ratings

Supervised insurance organizations are expected to operate in a safe and sound manner,

to comply with all applicable laws and regulations, and to possess sufficient financial and

operational strength to serve as a source of strength for their depository institution(s) through a

range of stressful yet plausible conditions. Supervisory ratings and supervisory findings are used

ervisory Ratings

Supervised insurance organizations are expected to operate in a safe and sound manner,

to comply with all applicable laws and regulations, and to possess sufficient financial and

operational strength to serve as a source of strength for their depository institution(s) through a

range of stressful yet plausible conditions. Supervisory ratings and supervisory findings are used

Attachment A for SR letter 22-8

Page 13 of 19

to communicate the assessment of a firm. Federal Reserve examiners periodically assign one of

four ratings to each of the three rating components used to assess supervised insurance

organizations. The rating components are Capital Management, Liquidity Management, and

Governance & Controls. The four potential ratings are Broadly Meets Expectations,

Conditionally Meets Expectations, Deficient-1, and Deficient-2. To be considered “well

managed,” a firm must receive a rating of Conditionally Meets Expectations or better in each of

the three rating components. Each rating is defined specifically for supervised insurance

organizations with particular emphasis on the obligation that firms serve as a source of financial

and managerial strength for their depository institution(s). High-level definitions for each rating

are below, followed by more specific rating definitions for each component.

Broadly Meets Expectations. The supervised insurance organization’s practices and capabilities

broadly meet supervisory expectations. The holding company effectively serves as a source of

managerial and financial strength for its depository institution(s) and possesses sufficient

financial and operational strength and resilience to maintain safe-and-sound operations through a

range of stressful yet plausible conditions

The supervised insurance organization’s practices and capabilities

broadly meet supervisory expectations. The holding company effectively serves as a source of

managerial and financial strength for its depository institution(s) and possesses sufficient

financial and operational strength and resilience to maintain safe-and-sound operations through a

range of stressful yet plausible conditions. The firm may have outstanding supervisory issues

requiring corrective actions, but these are unlikely to present a threat to its ability to maintain

safe-and-sound operations and unlikely to negatively impact its ability to fulfill its obligation to

serve as a source of strength for its depository institution(s). These issues are also expected to be

corrected on a timely basis during the normal course of business.

Conditionally Meets Expectations. The supervised insurance organization’s practices and

capabilities are generally considered sound. However, certain supervisory issues are sufficiently

material that if not resolved in a timely manner during the normal course of business, may put

the firm’s prospects for remaining safe and sound, and/or the holding company’s ability to serve

as a source of managerial and financial strength for its depository institution(s), at risk. A firm

with a Conditionally Meets Expectations rating has the ability, resources, and management

capacity to resolve its issues and has developed a sound plan to address the issue(s) in a timely

manner. Examiners will work with the firm to develop an appropriate timeframe during which it

will be required to resolve that supervisory issue(s) leading to this rating.

Deficient-1. Financial or operational deficiencies in a supervised insurance organization’s

practices or capabilities put its prospects for remaining safe and sound, and/or the holding

company’s ability to serve as a source of managerial and financial strength for its depository

institution(s), at significant risk

will be required to resolve that supervisory issue(s) leading to this rating.

Deficient-1. Financial or operational deficiencies in a supervised insurance organization’s

practices or capabilities put its prospects for remaining safe and sound, and/or the holding

company’s ability to serve as a source of managerial and financial strength for its depository

institution(s), at significant risk. The firm is unable to remediate these deficiencies in the normal

course of business, and remediation would typically require it to make material changes to its

business model or financial profile, or its practices or capabilities. A firm with a Deficient-1

rating is required to take timely action to correct financial or operational deficiencies and to

restore and maintain its safety and soundness and compliance with laws and regulations.

Supervisory issues that place the firm’s safety and soundness at significant risk, and where

resolution is likely to require steps that clearly go beyond the normal course of business – such

as issues requiring a material change to the firm’s business model or financial profile, or its

governance, risk management or internal control structures or practices – would generally

warrant assignment of a Deficient-1 rating. There is a strong presumption that a firm with a

Deficient-1 rating will be subject to an enforcement action.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s

practices or capabilities present a threat to its safety and soundness, have already put it in an

control structures or practices – would generally

warrant assignment of a Deficient-1 rating. There is a strong presumption that a firm with a

Deficient-1 rating will be subject to an enforcement action.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s

practices or capabilities present a threat to its safety and soundness, have already put it in an

Attachment A for SR letter 22-8

Page 14 of 19

unsafe and unsound condition, and/or make it unlikely that the holding company will be able to

serve as a source of financial and managerial strength to its depository institution(s). A firm with

a Deficient-2 rating is required to immediately implement comprehensive corrective measures

and demonstrate the sufficiency of contingency planning in the event of further deterioration.

There is a strong presumption that a firm with a Deficient-2 rating will be subject to a formal

enforcement action.

Definitions for the Governance and Controls Component Rating

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues,

the supervised insurance organization’s governance and controls broadly meet supervisory

expectations, supports maintenance of safe-and-sound operations, and supports the holding

company’s ability to serve as a source of financial and managerial strength for its depository

institutions(s). Specifically, the firm’s practices and capabilities are sufficient to align strategic

business objectives with its risk appetite and risk management capabilities; maintain effective

and independent risk management and control functions, including internal audit; promote

compliance with laws and regulations; and otherwise provide for the firm’s ongoing financial

and operational resiliency through a range of conditions. The firm’s governance and controls

clearly reflect the holding company’s obligation to act as a source of financial and managerial

strength for its depository institution(s)

sk management and control functions, including internal audit; promote

compliance with laws and regulations; and otherwise provide for the firm’s ongoing financial

and operational resiliency through a range of conditions. The firm’s governance and controls

clearly reflect the holding company’s obligation to act as a source of financial and managerial

strength for its depository institution(s).

Conditionally Meets Expectations. Certain material financial or operational weaknesses in a

supervised insurance organization’s governance and controls practices may place the firm’s

prospects for remaining safe and sound through a range of conditions at risk if not resolved in a

timely manner during the normal course of business. Specifically, if left unresolved, these

weaknesses may threaten the firm’s ability to align strategic business objectives with its risk

appetite and risk-management capabilities; maintain effective and independent risk management

and control functions, including internal audit; promote compliance with laws and regulations; or

otherwise provide for the firm’s ongoing resiliency through a range of conditions. Supervisory

issues may exist related to the firm’s internal audit function, but internal audit is still regarded as

effective.

Deficient-1. Deficiencies in a supervised insurance organization’s governance and controls put

its prospects for remaining safe and sound through a range of conditions at significant risk. The

firm is unable to remediate these deficiencies in the normal course of business, and remediation

would typically require a material change to the firm’s business model or financial profile, or its

governance, risk management or internal control structures or practices

governance and controls put

its prospects for remaining safe and sound through a range of conditions at significant risk. The

firm is unable to remediate these deficiencies in the normal course of business, and remediation

would typically require a material change to the firm’s business model or financial profile, or its

governance, risk management or internal control structures or practices.

Examples of issues that may result in a Deficient-1 rating include, but are not limited to:

• The firm may be currently subject to, or expected to be subject to, informal or formal

enforcement action(s) by the Federal Reserve or another regulator tied to violations of laws

and regulations that indicate severe deficiencies in the firm’s governance and controls.

• Significant legal issues may have or be expected to impede the holding company’s ability to

act as a source of financial strength for its depository institution(s).

• The firm may have engaged in intentional misconduct.

Attachment A for SR letter 22-8

Page 15 of 19

• Deficiencies within the firm’s governance and controls may limit the credibility of the firm’s

financial results, limit the board or senior management’s ability to make sound decisions, or

materially increase the firm’s risk of litigation.

• The firm’s internal audit function may be considered ineffective.

• Deficiencies in the firm’s governance and controls may have limited the holding company’s

ability to act as a source of financial and/or managerial strength for its depository

institution(s).

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s

governance and controls present a threat to its safety and soundness, a threat to the holding

company’s ability to serve as a source of financial strength for its depository institution(s), or

have already put the firm in an unsafe and unsound condition

rial strength for its depository

institution(s).

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s

governance and controls present a threat to its safety and soundness, a threat to the holding

company’s ability to serve as a source of financial strength for its depository institution(s), or

have already put the firm in an unsafe and unsound condition.

Examples of issues that may result in a Deficient-2 rating include, but are not limited to:

• The firm is currently subject to, or expected to be subject to, formal enforcement action(s) by

the Federal Reserve or another regulator tied to violations of laws and regulations that

indicate severe deficiencies in the firm’s governance and controls.

• Significant legal issues may be impeding the holding company’s ability to act as a source of

financial strength for its depository institution(s).

• The firm may have engaged in intentional misconduct.

• The holding company may have failed to act as a source of financial and/or managerial

strength for its depository institution(s) when needed.

• The firm’s internal audit function is regarded as ineffective.

Definitions for the Capital Management Component Rating:

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues,

the supervised insurance organization’s capital management broadly meets supervisory

expectations, supports maintenance of safe-and-sound operations, and supports the holding

company’s ability to serve as a source of financial strength for its depository institution(s)

l Management Component Rating:

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues,

the supervised insurance organization’s capital management broadly meets supervisory

expectations, supports maintenance of safe-and-sound operations, and supports the holding

company’s ability to serve as a source of financial strength for its depository institution(s).

Specifically:

• The firm’s current and projected capital positions on a consolidated basis and within each of

its material business lines/legal entities comply with regulatory requirements and support its

ability to absorb potential losses, meet obligations, and continue to serve as a source of

financial strength for its depository institution(s);

• Capital management processes are sufficient to give credibility to stress testing results and

the firm is capable of producing sound assessments of capital adequacy through a range of

stressful yet plausible conditions; and

• Potential capital fungibility issues are effectively mitigated, and capital contingency plans

allow the holding company to continue to act as a source of financial strength for its

depository institution(s) through a range of stressful yet plausible conditions.

Attachment A for SR letter 22-8

Page 16 of 19

Conditionally Meets Expectations. Capital adequacy meets regulatory minimums, both currently

and on a prospective basis. Supervisory issues exist but these do not threaten the holding

company’s ability to act as a source of financial strength for its depository institution(s) through

a range of stressful yet plausible conditions

conditions.

Attachment A for SR letter 22-8

Page 16 of 19

Conditionally Meets Expectations. Capital adequacy meets regulatory minimums, both currently

and on a prospective basis. Supervisory issues exist but these do not threaten the holding

company’s ability to act as a source of financial strength for its depository institution(s) through

a range of stressful yet plausible conditions. Specifically, if left unresolved, these issues:

• May threaten the firm’s ability to produce sound assessments of capital adequacy through a

range of stressful yet plausible conditions; and/or

• May result in the firm’s projected capital positions being insufficient to absorb potential

losses, comply with regulatory requirements, and support the holding company’s ability to

meet current and prospective obligations and continue to serve as a source of financial

strength to its depository institution(s).

Deficient-1. Financial or operational deficiencies in a supervised insurance organization’s

capital management put its prospects for remaining safe and sound through a range of plausible

conditions at significant risk. The firm is unable to remediate these deficiencies in the normal

course of business, and remediation would typically require a material change to the firm’s

business model or financial profile, or its capital management processes.

Examples of issues that may result in a Deficient-1 rating include, but are not limited to:

• Capital adequacy currently meets regulatory minimums although there may be uncertainty

regarding the firm’s ability to continue meeting regulatory minimums.

• Fungibility concerns may exist that could challenge the firm’s ability to contribute capital to

its depository institutions under certain stressful yet plausible scenarios.

• Supervisory issues may exist that undermine the credibility of the firm’s current capital

adequacy and/or its stress testing results.

Deficient-2

regarding the firm’s ability to continue meeting regulatory minimums.

• Fungibility concerns may exist that could challenge the firm’s ability to contribute capital to

its depository institutions under certain stressful yet plausible scenarios.

• Supervisory issues may exist that undermine the credibility of the firm’s current capital

adequacy and/or its stress testing results.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s

capital management present a threat to the firm’s safety and soundness, a threat to the holding

company’s ability to serve a source of financial strength for its depository institution(s), or have

already put the firm in an unsafe and unsound condition.

Examples of issues that may result in a Deficient-2 rating include, but are not limited to:

• Capital adequacy may currently fail to meet regulatory minimums or there is significant

concern that the firm will not meet capital adequacy minimums prospectively.

• Supervisory issues may exist that significantly undermine the firm’s capital adequacy metrics

either currently or prospectively.

• Significant fungibility constraints may exist that would prevent the holding company from

contributing capital to its depository institution(s) and fulfilling its obligation to serve as a

source of financial strength.

• The holding company may have failed to act as source of financial strength for its depository

institution when needed.

Definitions for the Liquidity Management Component Rating:

cant fungibility constraints may exist that would prevent the holding company from

contributing capital to its depository institution(s) and fulfilling its obligation to serve as a

source of financial strength.

• The holding company may have failed to act as source of financial strength for its depository

institution when needed.

Definitions for the Liquidity Management Component Rating:

Attachment A for SR letter 22-8

Page 17 of 19

Broadly Meets Expectations. Despite the potential existence of outstanding supervisory issues,

the supervised insurance organization’s liquidity management broadly meets supervisory

expectations, supports maintenance of safe-and-sound operations, and supports the holding

company’s ability to serve as a source of financial strength for its depository institutions(s). The

firm generates sufficient liquidity to meet its short-term and long-term obligations currently and

under a range of stressful yet plausible conditions. The firm’s liquidity management processes,

including its liquidity contingency planning, support its obligation to act as a source of financial

strength for its depository institution(s). Specifically:

• The firm is capable of producing sound assessments of liquidity adequacy through a range of

stressful yet plausible conditions; and

• The firm’s current and projected liquidity positions on a consolidated basis and within each

of its material business lines/legal entities comply with regulatory requirements and support

the holding company’s ability to meet obligations and to continue to serve as a source of

financial strength for its depository institution(s).

Conditionally Meets Expectations. Certain material financial or operational weaknesses in a

supervised insurance organization’s liquidity management place its prospects for remaining safe

and sound through a range of stressful yet plausible conditions at risk if not resolved in a timely

manner during the normal course of business

ource of

financial strength for its depository institution(s).

Conditionally Meets Expectations. Certain material financial or operational weaknesses in a

supervised insurance organization’s liquidity management place its prospects for remaining safe

and sound through a range of stressful yet plausible conditions at risk if not resolved in a timely

manner during the normal course of business.

Specifically, if left unresolved, these weaknesses:

• May threaten the firm’s ability to produce sound assessments of liquidity adequacy through a

range of conditions; and/or

• May result in the firm’s projected liquidity positions being insufficient to comply with

regulatory requirements and support the firm’s ability to meet current and prospective

obligations and to continue to serve as a source of financial strength to its depository

institution(s).

Deficient-1. Financial or operational deficiencies in a supervised insurance organization’s

liquidity management put the firm’s prospects for remaining safe and sound through a range of

stressful yet plausible conditions at significant risk. The firm is unable to remediate these

deficiencies in the normal course of business, and remediation would typically require a material

change to the firm’s business model or financial profile, or its liquidity management processes.

Examples of issues that may result in a Deficient-1 rating include, but are not limited to:

• The firm is currently able to meet its obligations but there may be uncertainty regarding the

firm’s ability to do so prospectively.

• The holding company’s liquidity contingency plan may be insufficient to support its

obligation to act as a source of financial strength for its depository institution(s).

• Supervisory issues may exist that undermine the credibility of the firm’s liquidity metrics and

stress testing results.

Deficient-2

ions but there may be uncertainty regarding the

firm’s ability to do so prospectively.

• The holding company’s liquidity contingency plan may be insufficient to support its

obligation to act as a source of financial strength for its depository institution(s).

• Supervisory issues may exist that undermine the credibility of the firm’s liquidity metrics and

stress testing results.

Deficient-2. Financial or operational deficiencies in a supervised insurance organization’s

liquidity management present a threat to its safety and soundness, a threat to the holding

Attachment A for SR letter 22-8

Page 18 of 19

company’s ability to serve as a source of financial strength for its depository institution(s), or

have already put the firm in an unsafe and unsound condition.

Examples of issues that may result in a Deficient-2 rating include, but are not limited to:

• Liquidity shortfalls may exist within the firm that have prevented the firm, or are expected to

prevent the firm, from fulfilling its obligations, including the holding company’s obligation

to act as a source of financial strength for its depository institution(s).

• Liquidity adequacy may currently fail to meet regulatory minimums or there is significant

concern that the firm will not meet liquidity adequacy minimums prospectively for at least

one of its regulated subsidiaries.

• Supervisory issues may exist that significantly undermine the firm’s liquidity metrics either

currently or prospectively.

• Significant fungibility constraints may exist that would prevent the holding company from

supporting its depository institution(s) and fulfilling its obligation to serve as a source of

financial strength.

• The holding company may have failed to act as source of financial strength for its depository

institution when needed.

C

e firm’s liquidity metrics either

currently or prospectively.

• Significant fungibility constraints may exist that would prevent the holding company from

supporting its depository institution(s) and fulfilling its obligation to serve as a source of

financial strength.

• The holding company may have failed to act as source of financial strength for its depository

institution when needed.

C.

Incorporating the Work of Other Supervisors

Similar to the approach taken by the Federal Reserve in its consolidated supervision of

other firms, the oversight of supervised insurance organizations relies to the fullest extent

possible, on work performed by other relevant supervisors. Federal Reserve supervisory

activities are not intended to duplicate or replace supervision by the firm’s other regulators and

Federal Reserve examiners typically do not specifically assess firms’ compliance with laws

outside of its jurisdiction, including state insurance laws. The Federal Reserve collaboratively

coordinates with, communicates with, and leverages the work of the Office of the Comptroller of

the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), Securities and Exchange

Commission (SEC), Financial Crimes Enforcement Network (FinCEN), Internal Revenue

Service (IRS), applicable state insurance regulators, and other relevant supervisors to achieve its

supervisory objectives and eliminate unnecessary burden.

Existing statutes specifically require the Board to coordinate with, and to rely to the

fullest extent possible on work performed by the state insurance regulators. The Board and all

state insurance regulators have entered into Memorandums of Understanding (MOU) allowing

supervisors to freely exchange information relevant for the effective supervision of supervised

insurance organizations

Existing statutes specifically require the Board to coordinate with, and to rely to the

fullest extent possible on work performed by the state insurance regulators. The Board and all

state insurance regulators have entered into Memorandums of Understanding (MOU) allowing

supervisors to freely exchange information relevant for the effective supervision of supervised

insurance organizations. Federal Reserve examiners take the actions below with respect to state

insurance regulators to support accomplishing the objective of minimizing supervisory

duplication and burden, without sacrificing effective oversight:

• Routine discussions (at least annually) with state insurance regulatory staff with greater

frequency during times of stress;

• Discussions around the annual supervisory plan, including how best to leverage work

performed by the state and potential participation by state insurance regulatory staff on

relevant supervisory activities;

Attachment A for SR letter 22-8

Page 19 of 19

• Consideration of the opinions and work done by the state when scoping relevant examination

activities;

• Documenting any input received from the state and considering the assessments of and work

performed by the state for relevant supervisory activities;

• Sharing and discussing with the state the annual ratings and relevant conclusion documents

from supervisory activities;

• Collaboratively working with the states and the NAIC on the development of policies that

affect insurance depository institution holding companies; and

• Participating in supervisory colleges.

The Federal Reserve relies on the state insurance regulators to participate in the activities

above and to share proactively their supervisory opinions and relevant documents

m supervisory activities;

• Collaboratively working with the states and the NAIC on the development of policies that

affect insurance depository institution holding companies; and

• Participating in supervisory colleges.

The Federal Reserve relies on the state insurance regulators to participate in the activities

above and to share proactively their supervisory opinions and relevant documents. These

documents include the annual ORSA,10 the state insurance regulator’s written assessment of the

ORSA, results from its examination activities, the Corporate Governance Annual Disclosure,

financial analysis memos, risk assessments, material risk determinations, material transaction

filings (Form D), the insurance holding company system annual registration statement (Form B),

submissions for the NAIC liquidity stress test framework, and other state supervisory material.

If the Federal Reserve determines that it is necessary to perform supervisory activities related to

aspects of the supervised insurance organization that also fall under the jurisdiction of the state

insurance regulator, it will communicate the rationale and result of these activities to the state

insurance regulator.

10 See NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual (December 2017) at

https://content.naic.org/sites/default/files/publication-orsa-guidance-manual.pdf.

Attachment B for SR letter 22-8

1

SIO Complexity Classification Work Program

Overview

Consistent with the Federal Reserve’s approach to risk-based supervision, supervisory resources are assigned, and

supervisory activities are conducted, in a manner that is proportionate to each organization’s risk profile. For

supervised insurance organizations (SIOs), this begins by classifying each organization as either complex or

noncomplex

mplexity Classification Work Program

Overview

Consistent with the Federal Reserve’s approach to risk-based supervision, supervisory resources are assigned, and

supervisory activities are conducted, in a manner that is proportionate to each organization’s risk profile. For

supervised insurance organizations (SIOs), this begins by classifying each organization as either complex or

noncomplex. The complexity classification serves as the basis for determining the level of supervisory resources

needed to supervise each SIO effectively, as well as the frequency and scope of supervisory activities.

The purpose of this work program is to support the vetting of an SIO’s risk profile and the assignment of a complex

or noncomplex classification. At a high level, the work program assists the relevant Federal Reserve Bank in

deciding whether to recommend to the Board that a dedicated supervisory team would be necessary to achieve the

Federal Reserve’s supervisory objectives – to ensure that supervised organizations comply with rules and

regulations, and that they operate in a safe and sound manner. The supervisory framework for SIOs described in

SR letter 22-8, “Framework for the Supervision of Insurance Organizations” recognizes that large, well-established,

and financially strong SIOs with relatively small depository institutions can be classified as noncomplex if the

Board considers the corresponding level of supervisory oversight sufficient to accomplish these objectives.

Complex SIOs: Complex organizations have a higher level of risk and therefore require more supervisory

attention and resources. Federal Reserve Bank dedicated supervisory teams are assigned to execute approved

supervisory plans led by a dedicated Central Point of Contact

plex if the

Board considers the corresponding level of supervisory oversight sufficient to accomplish these objectives.

Complex SIOs: Complex organizations have a higher level of risk and therefore require more supervisory

attention and resources. Federal Reserve Bank dedicated supervisory teams are assigned to execute approved

supervisory plans led by a dedicated Central Point of Contact. The activities listed in the supervisory plans focus

on understanding any of the organization’s risks that could threaten the safety and soundness of the consolidated

organization or an organization’s ability to act as a source of strength for its depository institution(s). These

activities typically include continuous monitoring, targeted topical examinations, coordinated reviews, and an

annual roll-up assessment resulting in ratings for the three rating components. The focus, frequency, and

intensity of supervisory activities are based on the organization’s unique risk profile and, therefore, can vary

among complex SIOs. The relevance of certain supervisory guidance also may vary among complex SIOs based

on each organization’s unique risk profile. Supervisory guidance targeted at smaller depository institution

holding companies, for example, may be more relevant for complex SIOs with limited inherent exposure to a

certain risk.

For those organizations classified as complex, this work program also supports decisions related to the composition

of the dedicated supervisory team, including the number and expertise of the examiners.

Noncomplex SIOs: Noncomplex organizations, due to their lower risk profile, require less supervisory oversight

relative to complex firms. The supervisory activities for these firms occur primarily during a rating examination

that occurs no less than every other year and results in the assignment of the three component ratings

visory team, including the number and expertise of the examiners.

Noncomplex SIOs: Noncomplex organizations, due to their lower risk profile, require less supervisory oversight

relative to complex firms. The supervisory activities for these firms occur primarily during a rating examination

that occurs no less than every other year and results in the assignment of the three component ratings. Although

these organizations are subject to topical target examinations, continuous monitoring, and coordinated reviews as

appropriate, the supervision of noncomplex firms relies more heavily on the reports and assessments of the

organization’s other relevant supervisors. The focus and types of supervisory activities for noncomplex firms are

also set based on its unique risks.

Size of Depository Institution

The total assets of the SIO’s depository institution(s), both in absolute terms and relative to the organization’s total

assets, can materially influence the ability of the SIO to act as a source of financial strength during times of stress.

The larger the depository institution, on both an absolute and relative basis, the more likely an SIO will be

classified as complex.

Attachment B for SR letter 22-8

2

Consistent with the approach taken for other supervised portfolios, the Federal Reserve will automatically classify

as complex any SIO with banking assets in excess of $100 billion. For SIOs with less than $100 billion in banking

assets, size is considered along with other factors to arrive at a holistic view of the organization’s risk profile.

1. Please complete the table below using GAAP values, if available. Use statutory values for the insurance

operations and to estimate total consolidated assets if GAAP values and not available

assets in excess of $100 billion. For SIOs with less than $100 billion in banking

assets, size is considered along with other factors to arrive at a holistic view of the organization’s risk profile.

1. Please complete the table below using GAAP values, if available. Use statutory values for the insurance

operations and to estimate total consolidated assets if GAAP values and not available.

Business

Assets

Accounting Basis

Banking

Life insurance (general account)

P&C insurance

Insurance separate account

Other insurance

[Other business 1]

[Other business 2]

Total Consolidated Assets

3rd party assets under management

Assets under administration

2. Describe the historical and planned growth trend for the consolidated organization and for each business line

listed above.

3. Describe how the information above influences the resources needed to effectively supervise the SIO.

Regulatory Oversight

The Federal Reserve relies to the greatest extent possible on the work of the SIO’s other supervisors. While it is

important for Federal Reserve supervisory staff to understand the risks emanating from the insurance and banking

activities of an SIO and how these risks impact the consolidated organization, the assessment of these businesses is

typically left primarily to the state insurance regulator(s) and functional banking regulator (usually the OCC)

respectively. By statutory mandate, the Federal Reserve is required to rely to the fullest extent possible on the

work performed by the state insurance regulators. Particularly for SIOs with subsidiary depository institutions less

than $100 billion in total assets, examiners rely heavily on the work of the OCC to assess the organization’s

banking operations. Therefore, the nature and materiality of the organization’s non-insurance and non-banking

activities heavily influences the need for Federal Reserve supervisory resources

e state insurance regulators. Particularly for SIOs with subsidiary depository institutions less

than $100 billion in total assets, examiners rely heavily on the work of the OCC to assess the organization’s

banking operations. Therefore, the nature and materiality of the organization’s non-insurance and non-banking

activities heavily influences the need for Federal Reserve supervisory resources. SIOs with non-insurance and

non-banking activities that have a low probability of negatively influencing the organization’s ability to act as a

source of strength for its depository institution(s) typically require fewer resources to effectively supervise and so

are more likely to be considered non-complex.

Attachment B for SR letter 22-8

3

Less-than-satisfactory ratings, significant supervisory issues, or outstanding enforcement actions from any of the

SIO’s supervisors is a sign of elevated risk and potential challenges to it serving as a source of managerial and/or

financial strength for its depository institution(s). Even after the classification determination is made, supervisory

ratings and opinions will continue to influence the focus, frequency, and intensity of supervisory activities.

Activities that exist outside of legal entities with regulatory oversight can often increase the risks of the

consolidated organization.

1. Describe the organization’s activities currently subject to no or limited regulatory oversight, including the

materiality of the risks associated with these activities (examples include financial advisory services,

distribution, investment origination/structuring, and some captive reinsurance arrangements).

2. If currently supervised by the Federal Reserve, describe the organization’s current ratings and any outstanding

or recently closed supervisory issues (enforcement actions, matters requiring attention (MRAs), and matters

requiring immediate attention (MRIAs)).

3

sory services,

distribution, investment origination/structuring, and some captive reinsurance arrangements).

2. If currently supervised by the Federal Reserve, describe the organization’s current ratings and any outstanding

or recently closed supervisory issues (enforcement actions, matters requiring attention (MRAs), and matters

requiring immediate attention (MRIAs)).

3. Describe, if applicable, the current ratings and supervisory opinions of the organization’s other regulators

(state insurance regulators, OCC, FDIC, state banking regulators, SEC, international regulators, etc.).

Describe any outstanding supervisory issues.

4. Describe any recent changes in the supervisory ratings assigned to the organization by its regulators.

5. Describe how the information above influences the resources needed to effectively supervise the SIO.

Product and Portfolio Risks

Attachment B for SR letter 22-8

4

The composition of an SIO’s assets and liabilities, including off-balance sheet exposures, is a major driver of

supervisory focus. Traditional insurance liabilities that are supported with high-quality assets require less

regulatory oversight, which is typically provided primarily by state insurance regulators. Liabilities tied to

sophisticated hedging programs or that are otherwise complex and assets that are of low quality, illiquid, or overly

concentrated, increase an SIO’s risks. The quality of an SIO’s asset-liability management program is also

considered when evaluating this factor.

1. Describe the insurance products currently sold by the organization and provide product liability balances as of

the most recent year-end. Describe the key risks associated with the organization’s insurance business and the

organization’s use of reinsurance.

2. Describe the banking products sold by the organization and provide product balances as of the most recent

year-end

or.

1. Describe the insurance products currently sold by the organization and provide product liability balances as of

the most recent year-end. Describe the key risks associated with the organization’s insurance business and the

organization’s use of reinsurance.

2. Describe the banking products sold by the organization and provide product balances as of the most recent

year-end. Describe the key risks associated with the organization’s banking business.

3. Describe the non-insurance/non-banking products sold by the organization and provide product balances as of

the most recent year-end. Describe the key risks associated with these products.

4. Describe the organization’s sources of market risk, including its use of derivatives (for hedging and other

purposes).

5. Describe the organization’s investment guidelines and risk appetite statement for credit risk. Provide a

breakout of the organization’s investment portfolio as of the most recent year-end, including by asset type and

rating. Describe any recent changes to the organization’s investment mix.

6. Describe the organization’s off-balance sheet exposure and the risks associated with this exposure.

Attachment B for SR letter 22-8

5

7. Describe the organization’s use of third parties for operational purposes and for risk management.

8. Describe the organization’s IT infrastructure and its exposure to IT and Cyber risks.

9. Describe how the information above influences the resources needed to effectively supervise the SIO.

Organizational Structure

As a consolidated supervisor, the Federal Reserve must understand and be able to assess risks throughout the

organization. An intricate organizational structure can increase and/or mask certain risks

e and its exposure to IT and Cyber risks.

9. Describe how the information above influences the resources needed to effectively supervise the SIO.

Organizational Structure

As a consolidated supervisor, the Federal Reserve must understand and be able to assess risks throughout the

organization. An intricate organizational structure can increase and/or mask certain risks. The intricacy of an

SIO’s organizational structure is determined by considering the number, type, and location of its legal entities;

guarantees and other arrangements, including reinsurance, between legal entities; and the purpose for the SIO’s

legal entity structure.

1. Describe the structure of the organization, including the legal entity structure, the board committee structure,

senior management committee structure, and where in the organization risks are managed.

2. Describe any potential challenges (reporting, regulatory, etc.) related to the organization’s ownership

structure.

3. Describe any statutory limitations on the organization’s investments in noninsurance subsidiaries.

4. Describe the organization’s use of internal (captive) reinsurance, internal financing, and affiliate guarantees.

Attachment B for SR letter 22-8

6

5. Describe the organization’s internal shared services arrangements and other intra-group activities between

among the organization’s subsidiaries.

6. Describe the organization’s ability to identify, aggregate, and report risk exposures and risk concentrations

across business lines and legal entities.

7. Describe how the information above influences the resources needed to effectively supervise the SIO.

Quality and Level of Capital

A key expectation is that the SIO act as a source of financial strength for its depository institution(s). Sufficient

capital available to be deployed, if necessary, is essential in fulfilling this role

usiness lines and legal entities.

7. Describe how the information above influences the resources needed to effectively supervise the SIO.

Quality and Level of Capital

A key expectation is that the SIO act as a source of financial strength for its depository institution(s). Sufficient

capital available to be deployed, if necessary, is essential in fulfilling this role. The Federal Reserve will consider

the SIO’s capital level, any limits to deploying capital to support its depository institution(s), and its prior support

of its subsidiaries during periods of financial stress.

1. Provide a five-year history of the regulatory capital metric applicable for each of the organization’s significant

legal entities subject to a regulatory capital regime. Describe any cases of unusual over or under

capitalization.

2. Describe the organization’s use of leverage (financial and operational), including where the leverage is issued

and any concerns regarding the organization’s ability to service its debt.

3. Describe the organization’s capital planning process, including the involvement by its board.

Attachment B for SR letter 22-8

7

4. Describe the organization’s capital stress testing framework, including its capital contingency plans if

available.

5. Describe the organization’s capital resources and capital targets.

6. Describe the organization’s access to capital markets.

7. Describe any legal contingencies tied to capital within the organization, including any restrictions related to

capital fungibility between legal entities, particularly as they relate to the depository institution.

8. Describe how the information above influences the resources needed to effectively supervise the SIO.

Quality and Level of Liquidity

A key requirement is that the SIO can act as a source of financial strength for their depository institution(s)

y restrictions related to

capital fungibility between legal entities, particularly as they relate to the depository institution.

8. Describe how the information above influences the resources needed to effectively supervise the SIO.

Quality and Level of Liquidity

A key requirement is that the SIO can act as a source of financial strength for their depository institution(s).

Sufficient liquidity available to be deployed, if necessary, is essential in fulfilling this role. The Federal Reserve

will consider the SIO’s liquidity level, any limits to deploying liquidity to support its depository institution(s), and

its prior support of its subsidiaries during periods of financial stress.

1. Describe the organization’s liquidity position using relevant regulatory metrics, metrics used by the

organization to manage its liquidity, and/or any industry-standard liquidity metrics relevant for the

organization’s business lines.

2. Describe the sufficiency of the organization’s level of liquidity given its risk profile.

Attachment B for SR letter 22-8

8

3. Describe the organization’s liquidity planning and contingency funding plan, if available.

4. Describe any instances of the organizations’ prior support of its subsidiaries during periods of stress.

5. Describe the organization’s framework for liquidity risk management, including liquidity stress testing, risk

tolerance, and reporting to senior management and the board.

6. Describe the organization’s funding structure, including its reliance on short-term funding, and its access to

and use of secondary market funding sources.

7. Describe any restrictions related to liquidity fungibility between legal entities, particularly as they relate to the

depository institution.

8. Describe how the information above influences the resources needed to effectively supervise the SIO

’s funding structure, including its reliance on short-term funding, and its access to

and use of secondary market funding sources.

7. Describe any restrictions related to liquidity fungibility between legal entities, particularly as they relate to the

depository institution.

8. Describe how the information above influences the resources needed to effectively supervise the SIO.

International Exposure

While geographic diversification can be a benefit, international operations present unique challenges. These

include challenges that arise from differences in accounting standards, regulatory frameworks, and legal

requirements. An SIO with international operations that materially contribute to its risk profile is more likely to be

considered complex.

Attachment B for SR letter 22-8

9

1. Has the organization been designated as an internationally active insurance group (IAIG) by its group-wide

insurance supervisor?

2. Describe the organization’s international business activities, including the countries and products in which it is

active.

3. Describe the risks associated with the organization’s international operations and the materiality of these risks

relative to the broader organization.

4. Describe how the information above influences the resources needed to effectively supervise the SIO.

Interconnectedness

The Federal Reserve also monitors supervised institutions for potential systemic risk, or interconnectedness with

the broader financial system. An SIO whose failure could contribute to increased instability in the overall

financial system of the United States will more likely be considered complex.

1. Describe any potential concerns related to the organization’s systemic interconnectedness with the broader

financial system.

2. Describe how the information above influences the resources needed to effectively supervise the SIO.

lure could contribute to increased instability in the overall

financial system of the United States will more likely be considered complex.

1. Describe any potential concerns related to the organization’s systemic interconnectedness with the broader

financial system.

2. Describe how the information above influences the resources needed to effectively supervise the SIO.

Attachment B for SR letter 22-8

10

Other Factors for Consideration

Describe any risk factors not identified above that have contributed to the Reserve Bank’s complexity

classification proposal. Include in the description how these additional factors influence the resources needed to

effectively supervise the SIO.

Conclusion

Describe the Reserve Bank’s proposed complexity classification. The proposal should be supported by the

information above and should be focused on the resources needed to effectively supervise the organization given

its risk profile.