GFSC Guidance Note Solvency 2 Internal Models: Approvals and Ongoing Monitoring

Version: 1 Publication Date: 3 October 2025 www.gfsc.gi GFSC Guidance Note Solvency 2 Internal Models: Approvals and Ongoing Monitoring

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 2 Ongoing Monitoring Table of Contents

1. Introduction.......................................................................................................................... 3
2. The procedure for considering Internal Model approvals ....................................................... 3 Overview.......................................................................................................................................... 3 Interaction between the GFSC and firms before an application..................................................... 3 Initial application to calculate the SCR using an Internal Model..................................................... 4 Assessment of the application ........................................................................................................ 8 Right to withdraw the application by the firm................................................................................ 9 Decision on the application............................................................................................................. 9 Transitional plan to extend the scope of the model ..................................................................... 10 Internal Model change applications.............................................................................................. 11 Applications to change the policy for changing an Internal Model .............................................. 14
3. Flexible approach to model approvals ................................................................................. 14 Residual Model Limitations........................................................................................................... 16 Safeguards to support granting or variation of model approvals................................................. 17 Model Limitation Adjustments...................................................................................................... 20 The GFSC’s powers to vary or revoke model approval.................................................................. 22
4. Significant deviations from the assumptions underlying the Standard Formula..................... 24
5. Supervisory review process: Internal Model Ongoing Review............................................... 24 Strand 1 – GFSC driven thematic schedule ................................................................................... 25 Strand 2 – AoC exercise................................................................................................................. 25 Strand 3 – Assessment of ongoing model compliance.................................................................. 25 Strand 4 – Monitoring of safeguards............................................................................................. 26

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 3 Ongoing Monitoring

1. Introduction 1.1. This Guidance Note sets out the Gibraltar Financial Services Commission’s (’GFSC’s’) approach to considering applications and granting approvals for the use of internal models (‘IMs’) for the purpose of calculating all or part of a firm’s Solvency Capital Requirement (‘SCR’), as well as variations to those approvals. It also sets out the GFSC’s supervisory approach to the ongoing review and evaluation of compliance with the requirements relating to IM approvals. For the remainder of this statement, reference to IM should be taken to mean both full and partial IMs, unless explicitly stated. 1.2. When granting these approvals, the GFSC would exercise its powers under regulation 276A(5) of the Financial Services (Insurance Companies) Regulations 20201 (the ‘Insurance Companies Regulations’) to specify provisions in the Insurance Companies Regulations which the firm in question is not required to apply, or is to apply subject to specific modifications, where the GFSC is satisfied that requiring the specified provisions to apply (either at all or without modification) is incompatible with the approval. Similarly, for the purposes of a major model change, the GFSC would exercise the same power to vary an existing approval allowing a firm to calculate its SCR using a full or partial IM. The GFSC may also, on its own initiative, (but with the consent of the firm in question), exercise the same power to vary an existing approval in order to waive or modify requirements that apply to a firm that has approval to use an IM to calculate its SCR. 1.3. This Guidance Note is relevant to all insurance undertakings and reinsurance undertakings, as defined in regulation 3 of the Insurance Companies Regulations, referred to collectively as ‘firms’. It is most relevant to firms that have approval to use an IM to calculate their SCR. It will also be of interest to firms seeking approval to use an IM and to firms that are part of groups within the European Economic Area (EEA) or non-EEA groups with a group IM.
2. The procedure for considering Internal Model approvals Overview 2.1. This chapter outlines the GFSC’s approach to considering applications and granting approval for a firm to use an IM to calculate its SCR. 2.2. It also outlines the GFSC’s approach to variations of existing IM approvals to enable firms to make major changes to their IMs and changes to their IM change policies, in accordance with regulation 103(3) to (6) of the Insurance Companies Regulations. Interaction between the GFSC and firms before an application 2.3. The GFSC expects firms to engage with it as early as possible regarding applications for initial IM approvals and for variation of existing approvals to enable firms to make major model changes to their IMs and changes to their IM change policies. This includes model changes that arise from expected future changes in firms’ risk profiles, for example, because of a potential business transaction. 1 Financial Services (Insurance Companies) Regulations 2020

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 4 Ongoing Monitoring 2.4. When considering an application for variation of an existing approval to enable a firm to make a major model change, the GFSC will seek to understand the reasons for the proposed change, the potential impact (both qualitative and quantitative) of the change, and the intended timescales for implementation of the change. 2.5. The GFSC will also seek to understand how a firm has addressed any previous GFSC feedback, data audits, and previously identified model limitations. The GFSC will also seek to understand how a firm has identified and prioritised the model change(s) included in its application, as opposed to other model improvements in its model development plan. 2.6. The GFSC may discuss with a firm whether it would be useful for the firm to enter into a pre￾application review process before submitting a formal application, and the GFSC may choose to offer such a period of pre-application engagement. The length and scope of any pre-application period will depend on the complexity and scale of a potential model (change) application, and the firm’s readiness to submit a formal application. If a firm chooses to make use of a pre￾application period, the GFSC expects to provide feedback during this process; however, this would not be a substitute for the firm's own model development, internal governance, or validation processes. In particular, the GFSC considers that a firm should have completed a full cycle of validation for its model (or major model change) before entering into a pre-application review process. Initial application to calculate the SCR using an Internal Model 2.7. A firm should submit a written application to the GFSC for approval to use an IM for the purposes of calculating its SCR. 2.8. The application should be made in the form and manner that the GFSC directs, and contain or be accompanied by any information that the GFSC may reasonably require.. 2.9. A firm making an IM application must comply with regulation 101A(1) of the Insurance Companies Regulations. In the case of regulation 101A(1)(b) applying,2 the firm or the GFSC may propose the use of one or more safeguards to mitigate any non-compliance with the internal model requirements (the requirements set out in regulations 103A and 108 to 114 of the Insurance Companies Regulations),3 and/or to ensure compliance with the calibration standards in regulation 91(3) to (5) of the Insurance Companies Regulations. Safeguards are described in more detail in Chapter 3. However, RMLs in the proposed IM should not lead, individually or overall, to significant non-compliance with the calibration standards and internal model requirements in all the circumstances in which the IM is to be used. 2.10. The documentary evidence referred to in regulation 101A(1)(a) of the Insurance Companies Regulations should include at least the following: (a) a cover letter including: 2 For example, due to the presence of some residual model limitations (‘RMLs’). RMLs are defined in regulation 3 of the Insurance Companies Regulations and described in more detail in Chapter 3. 3 Where a safeguard is needed to mitigate non-compliance with the internal model requirements, the GFSC will notify a firm of any waiver or modification of those requirements that may be necessary for the period during which the safeguard is in place, so that the firm would not be in breach of those requirements (as they appear in the Insurance Companies Regulations).

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 5 Ongoing Monitoring i. a request for approval to use a full or partial IM for the purpose of calculating the SCR, starting from a specified date, and a general explanation of the IM including a brief description of the proposed structure and scope of the IM; ii. a confirmation of the period prior to the application for which the IM has been used in the firm’s risk management system and decision-making processes in accordance with the requirements set out in regulation 108 of the Insurance Companies Regulations; iii. a confirmation that the application is complete and includes an accurate description of the IM, and that no relevant facts have been knowingly omitted; iv. a confirmation whether the firm is part of a group using an IM for the calculation of the consolidated group SCR, or whether an application to use any IM for calculating the consolidated group SCR is currently under consideration and awaiting a decision; v. the firm’s views on whether the proposed change to its approach to calculating the SCR would fall within scope of section 83A of the Financial Services Act 2019 (the ‘FSA 2019’); vi. a list of any other applications to the GFSC related to requirements under the Insurance Companies Regulations or the FSA 2019, which have been submitted by the firm or are currently anticipated within the next 6 months , together with the corresponding application dates; and vii. contact information of the relevant personnel within the firm involved in the activities related to the IM, as well as of the relevant personnel within the firm to whom the requests for supplementary information can be submitted; (b) an explanation of how the IM covers all the material quantifiable risks to which the firm, or where the firm is part of a group, the group is exposed. Where the application for the approval relates to a partial IM, the explanation should be limited to the material and quantifiable risks within the scope of the partial IM, and the firm should also provide an explanation of how the additional requirements set out in regulations 102(2), 102A and 103A of the Insurance Companies Regulations have been satisfied; (c) an explanation of the adequacy and effectiveness of the integration of the IM into the firm’s risk management system and the role it plays in the firm’s system of governance, including how the IM allows the firm to identify, measure, monitor, manage, and report risks on a continuous basis; for this purpose, the application should include the relevant extracts of the firm’s risk management policy referred to in regulation 45(4) and (8) of the Insurance Companies Regulations; (d) an assessment and a justification by the firm of the material strengths, weaknesses, and limitations of the IM, including a self-assessment of the extent to which the firm complies with the calibration standards and internal model requirements; the firm should also outline its plan for the future improvement of the IM in order to address identified weaknesses, limitations, or to develop or extend the IM; (e) where the firm is part of a group using an IM for the calculation of the consolidated SCR, or where an application to use any IM for calculating the consolidated group SCR is currently under consideration and awaiting a decision, a justification of why the group IM is not fit for

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 6 Ongoing Monitoring the risk profile of the firm, and a description of the differences between the IM to be used by the firm and the group IM; (f) the technical specifications of the IM, including a detailed description of the structure of the IM, together with a list and justification of the assumptions underlying the IM, where adjustments to those assumptions would have a material impact on the SCR; (g) an explanation of the adequacy of the resources, skills, and objectivity of the personnel responsible for the development and validation of the IM; (h) the IM change policy referred to in regulation 101A(3) of the Insurance Companies Regulations; (i) a description of the process which ensures the consistency between the methods used to calculate the probability distribution forecast with the methods used to calculate technical provisions, in accordance with regulation 109(2)(3) of the Insurance Companies Regulations; (j) a description of the independent validation process of the IM and a report of the results of the last validation in accordance with regulation 112(1) of the Insurance Companies Regulations, including what recommendations were made and how they were acted upon; (k) the inventory of the documents that form part of the documentation of the IM set out in regulation 113(1) and (2); (l) a demonstration that the use of external models or data obtained from a third party does not impair the firm’s ability to meet the calibration standards and internal model requirements, the suitability for the use of that model or data within the IM and an explanation of the preference of external models or data to internal models or data; (m) an estimation of the SCR calculated with the IM at the most granular level according to the firm’s risk categorisation, and an estimation of the SCR calculated with the Standard Formula (‘SF’) at the most granular level for the last point in time prior to the date of submission of the application where the firm calculated the SCR with the SF; (n) an identification of those parts of the business of the firm or group which have been classified as a major business unit and a justification for that classification; and (o) in the case of a partial IM, an explanation of how the proposed integration technique fulfils the requirements set out in regulation 102(2) of the Insurance Companies Regulations, and, in case of a technique different from the default one set out in regulation 103A(1) of the Insurance Companies Regulations, a justification of the integration technique proposed. 2.11. A firm should also submit evidence of the approval of the application by its governing body as set out in regulation 104(1) of the Insurance Companies Regulations. 2.12. Where a firm applies for a new model approval, the GFSC may expect it to carry out and submit the results of an analysis of change (‘AoC’) exercise, comparing its SCR as at or around the application date to its SCR one year before, with both SCRs calculated using its proposed IM. Where the GFSC notifies a firm of this expectation, it should include reasons for any changes in

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 7 Ongoing Monitoring the SCR, and documentary evidence to support those reasons, as set out in regulation 111A of the Insurance Companies Regulations.. 2.13. A firm should provide an inventory of all the documents and evidence included in the application. Where the content of a document is relevant for other documents, the firm should highlight the relevance and include cross-references. 2.14. In addition to the documents and information specified in paragraphs 2.10 to 2.13, an application to use an IM or partial IM to calculate the consolidated group SCR should include the following documents and information: (a) the proposed scope of the model: i. a list of the related undertakings that are included in the scope of the IM for the calculation of the consolidated group SCR; for each related undertaking, the list should include a reference to its supervisory authority, the lines of business written by the related undertaking, the method used for the purposes of determining the consolidated data in accordance with Article 335 of the Financial Services (Solvency 2)(Technical Standards) Regulations 20254 (the ‘Solvency 2 Technical Standards’) and the proportional share applied in accordance with regulation 200(2)(a) of the Insurance Companies Regulations; ii. the legal and organisational structure of the group, with a description of all subsidiaries, material related undertakings and significant branches, and information on relevant operations and transactions within the group, unless this information has not changed since the last group supervisory report submitted pursuant to Article 2A of the Financial Services (Insurance Supervisory Reporting)(Technical Standards) Regulations 20255 ; iii. where applicable, a list of the related undertakings excluded from the scope of a partial IM for the calculation of the consolidated group SCR, together with an explanation of the reasons for their exclusion; a description of the methods used to assess the risks in these excluded related undertakings in order to demonstrate that the exclusion does not lead to an underestimation of the overall risks to which the group is exposed; and evidence that the consolidated group SCR calculated using a combination of the partial IM and the SF will adequately reflect the overall risk profile of the group; and iv. for each related firm included in the scope of the IM for the calculation of the consolidated group SCR, where applicable, a justification of the reasons why the IM covers that related firm for the calculation of the consolidated group SCR, but it is not used to calculate the SCR of that firm; an explanation of how the full or partial IM used to calculate the consolidated group SCR differs from and interacts with the full or partial IM used for the calculation of the SCR of any of the related firms for which the GFSC has previously granted approval, and information on any future plans to extend the use of the full or partial IM to calculate the SCR of any related firm; (b) the group’s consolidated group SCR: i. an estimation of the consolidated group SCR calculated using the IM and the SF for the most recent reporting period prior to submission of the application when the consolidated group SCR was calculated using the SF; 4 Financial Services (Solvency 2) (Technical Standards) Regulations 2025 5 Financial Services (Insurance Supervisory Reporting) (Technical Standards) Regulations 2025

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 8 Ongoing Monitoring ii. for each related undertaking, the SCR calculated using the SF for the most recent reporting period prior to submission of the application; iii. where applicable, the regulatory capital requirement for related undertakings that are also regulated entities other than Solvency II undertakings and third country insurance and reinsurance undertakings, included in the scope of the IM, for the most recent reporting period prior to submission of the application when the consolidated group SCR was calculated with the SF; and iv. an explanation of the difference between the sum of the SCR of all the related insurance and reinsurance undertakings of the group and the consolidated group SCR calculated with the IM. 2.15. An application to use a group IM should also include the following documents and information, in addition to those referred to in paragraph 2.14, where applicable: (a) in relation to paragraph 2.14(a)(i), a list of all the firms applying to use the group IM to calculate their SCRs; and (b) the documents referred to in paragraph 2.10(o) in relation to the use of a partial IM for the calculation of the SCR of each firm in the group applying for the use of the group IM to calculate its SCR. For this purpose, the firm may restrict these documents to those with content that is not already covered in the documents submitted in accordance with point (a). Assessment of the application 2.16. The GFSC will confirm receipt of the firm’s application. 2.17. An application for approval to use an IM to calculate the SCR is expected to be considered complete if it includes all documentary evidence set out in paragraphs 2.10 and 2.11, and in the case of any non-compliance with the calibration standards and internal model requirements, regulation 101A(1)(b) of the Insurance Companies Regulations. An application for approval to use a group internal model to calculate the consolidated group SCR will be considered complete if it includes all of the documentary evidence set out in paragraphs 2.10 to 2.11 and 2.14 to 2.15, and in the case of any non-compliance with the calibration standards and internal model requirements, regulation 101A(1)(b) of the Insurance Companies Regulations. 2.18. The GFSC will inform the firm of the status of the application as either complete or incomplete. In the latter case, the GFSC will specify the reasons why the application is incomplete and may decide to carry on considering the application only once it considers it to be complete. 2.19. Where the GFSC has considered an application to be complete, the GFSC may still request additional information necessary for carrying out its assessment. Any such request will specify the additional information required and will include the reasons for the request. This may delay the decision on the application beyond the indicative timeframe in paragraph 2.23. 2.20. A firm should ensure that all documentation referred to in regulation 113 of the Insurance Companies Regulations is made available to the GFSC throughout the assessment of the application.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 9 Ongoing Monitoring 2.21. The assessment of the application will involve ongoing communication with the firm and may include discussions regarding adjustments to the IM and, in the case of a partial IM, a request for a transitional plan to extend the scope of the model, as set out in regulation 102A of the Insurance Companies Regulations. If the GFSC is not satisfied by the firm’s transitional plan to extend the scope of its partial IM, this may result in the GFSC rejecting the firm’s IM application. 2.22. If the GFSC considers that it is unlikely to grant an IM approval, based on the application as submitted, it may notify the firm that: (a) adjustments would need to be made to the IM to ensure compliance with calibration standards and internal model requirements; this may include Model Limitation Adjustments (‘MLAs’), to ensure compliance with the calibration standards, as described in paragraphs 3.24 to 3.33; and/or (b) safeguards would need to be set by the GFSC to ensure compliance with the calibration standards and/or mitigate non-compliance with the internal model requirements and, where a safeguard is imposed in the latter case, of any waiver or modification of the underlying internal model requirements for the period during which the safeguard is in place (which would be specified in a written notice to the firm), so that it would not be in breach of those requirements. 2.23. The GFSC intends to determine the outcome of a complete application within 6 months from the date of receipt of the application and to provide the firm with a written notice of that determination, and will make reasonable efforts to do so. 2.24. Where related undertakings are excluded from the IM used for the calculation of the consolidated group SCR, the GFSC will assess whether the explanation provided under paragraph 2.14(a)(iii) adequately demonstrates that the overall risks to which the group is exposed are not underestimated by use of a partial IM. 2.25. Where the IM used for the calculation of the consolidated group SCR covers a firm but is not used to calculate that firm’s SCR, the GFSC will assess whether the justification provided in paragraph 2.14 is sufficient. Right to withdraw the application by the firm 2.26. A firm which has applied for approval to use a full or partial IM to calculate its SCR or for a variation of an existing IM approval may withdraw that application by notifying the GFSC in writing at any time before the GFSC reaches a decision on the application. Decision on the application 2.27. The GFSC’s approach to granting approvals for the use of an IM to calculate the SCR is set out in Chapter 3. The GFSC expects to grant such an approval in the following circumstances:

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 10 Ongoing Monitoring (a) the firm demonstrates to the GFSC’s satisfaction that it satisfies the calibration standards and internal model requirements, or where safeguards are intended to mitigate non￾compliance with the internal model requirements and/or ensure compliance with the calibration standards, as described in paragraph 3.4; (b) the firm’s systems for identifying, measuring, monitoring, managing, and reporting risk are adequate; and (c) if it is satisfied that the firm’s policy for changing the IM fulfils the requirements set out in regulation 103 of the Insurance Companies Regulations. 2.28. When the GFSC has reached a decision on an application, it will notify the firm in writing with its decision. The GFSC will specify the following: (a) where the GFSC grants the approval, the starting date from which the model can be used to calculate the SCR; (b) where the GFSC grants the approval, any waivers or modifications of internal model requirements, any safeguards (RML capital add-ons (‘CAOs’) and/or other requirement safeguards) set by the GFSC relating to the approval, together with the reasons for those safeguards, the GFSC’s expectations as regards a firm’s remediation of the RMLs underlying those safeguards, and, where relevant, an expected timeframe for remediation (as described in paragraphs 3.11 to 3.12); where the GFSC has requested a transitional plan in accordance with regulation 102A of the Insurance Companies Regulations, it will include within the written notice a decision on the transitional plan submitted by the firm; and (c) where the GFSC does not grant the approval, the reasons on which the decision is based. 2.29. In the case of an application for approval to calculate a consolidated group SCR using a full or partial IM, the GFSC will provide its decision to the firm and, where relevant, to each related firm applying for the use of the group IM to calculate its solo SCR. Transitional plan to extend the scope of the model 2.30. In the case referred to in regulation 102A of the Insurance Companies Regulations and when it is applicable to groups under regulation 209(4) of the Insurance Companies Regulations, the GFSC will explain the reasons for requiring a transitional plan and set the minimum scope which the IM must cover after the implementation of the transitional plan. 2.31. The transitional plan should be approved by the firm’s governing body and should clearly identify the period for implementing the plan, the extension of the scope and the measures and resources necessary to extend the scope of the IM. The GFSC will evaluate the plan presented by the firm. The GFSC may, where necessary, require the firm to submit an amended transitional plan. 2.32. If a firm fails to implement the transitional plan to extend the scope of its IM, the measures that the GFSC may consider taking include:

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 11 Ongoing Monitoring (a) extend the time period to implement the plan, potentially subject to amendments to the plan; (b) require the firm to calculate its SCR according to the SF set out in regulations 93 to 100 of the Insurance Companies Regulations and Chapter 5 of the Solvency 2 Technical Standards; or (c) vary the firm’s IM approval to allow the use of a partial IM with a more limited scope than the minimum scope referred to in paragraph 2.30. Internal Model change applications 2.33. As required by regulation 101A(1) and 103(5) of the Insurance Companies Regulations, in an application for the variation of an existing approval to calculate the SCR using a full or partial IM, a firm should either: (a) confirm to the GFSC in writing and submit documentary evidence to demonstrate that the calibration standards and internal model requirements (as waived or modified in accordance with regulation 276A(5) of the Insurance Companies Regulations), would be complied with after applying the major change; or (b) where some of the calibration standards and internal model requirements would not be complied with after applying the major change, identify those requirements, and explain to the GFSC in writing why and in what way they are not satisfied, and submit documentary evidence demonstrating that all other requirements (in the calibration standards and internal model requirements) are satisfied. Where this is the case, the firm or the GFSC may propose the use of one or more safeguards in order to mitigate any non-compliance with the internal model requirements and/or to ensure compliance with the calibration standards. 2.34. In addition to the requirements described in 2.33, where a firm applying to the GFSC has been granted a waiver or modification of any of the internal model requirements by the GFSC, the firm must also either confirm as described in 2.33(a) or explain as described in 2.33(b) (and in both cases submit documentary evidence) by reference to the unmodified internal model requirements (as required by regulation 103(6) of the Insurance Companies Regulations). 2.35. Additionally, in the case of a partial IM, a firm should submit documentary evidence setting out how it would fulfil regulations 102(2) and 102A after applying the major change. 2.36. The GFSC intends to consider no more than one model change application per firm per year. A firm may include several individual model changes within a single application (along with any extension of the scope of its IM), which the GFSC will review together under the same supervisory approval process. This will help to ensure that firms are able to apply robust governance to model changes and that the GFSC is able to commit appropriate resources to review applications. However, the GFSC understands that business or market conditions may, in some circumstances, lead to a firm submitting more than one model change application in a year. 2.37. A planned transaction (for example an acquisition or investment in a new asset class) or other event, may lead to a change in a firm's risk profile that would result in the IM no longer

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 12 Ongoing Monitoring being compliant with the calibration standards and/or internal model requirements, thereby prompting a model change application outside of the firm’s scheduled model development plan. In such situations, the firm should consider whether the GFSC could realistically consider and reach a decision on the model change application ahead of the completion of the transaction or the expected occurrence of the event. If a firm or the GFSC expects that it is unrealistic for the GFSC to consider and reach a decision on a model change application in the required timeframe, the firm should discuss with the GFSC how it will calculate its SCR so that it remains compliant with the relevant requirements and remains adequately capitalised immediately after the transaction or event takes place. 2.38. Where an event occurs that causes a firm to consider whether changes might be required to its IM, the GFSC recognises that it might take some time for the firm to determine what changes are required and to implement those changes within its model in a way that meets the calibration standards and internal model requirements. In such circumstances, firms should discuss with the GFSC what other steps might be taken in the interim until the firm can submit a model change application for consideration by the GFSC. 2.39. A firm should include in its application the documents set out above in paragraphs 2.10 to 2.11 and 2.14 to 2.15, where their content would be affected by the major change to the full or partial IM. The firm should also include a detailed description of the qualitative and quantitative impacts of the major change compared with its existing model approval. To ease the administrative and operational burden on both firms and the GFSC, the GFSC expects a firm to update the application documents that the firm provided to support its most recent approval or variation of approval application, for each subsequent application for a variation of that approval. Applications for a variation of approval should therefore cover a short description of the proposed changes together with an updated suite of documentary evidence, where the changes to this evidence from that submitted to the GFSC to support the existing approval are clearly signposted, for example using ‘tracked changes’. The firm should also provide a ‘clean’ version of the full application. 2.40. The GFSC expects to be able to assess the following from a firm’s documentation: (a) justification for the model change(s); (b) a description of the changes that are proposed to be made to the version of the IM for which approval has been granted by the GFSC; (c) the historical changes and any additional, future planned changes to the IM; (d) evidence that the model change application has been approved by the firm’s governing body; (e) evidence that the model change(s) have been independently validated; and (f) evidence in the form that the GFSC directs, indicating which items have been altered since the version of the IM for which approval has been granted by the GFSC. 2.41. The GFSC expects firms' model change applications to be of a high quality. If the GFSC considers that a firm's model change application is incomplete, or that it does not otherwise

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 13 Ongoing Monitoring appear to be a viable application, it will discuss with the firm an alternative timescale for submitting a revised application. In particular, RMLs that would be present in the IM after implementing the changes, if approved by the GFSC, should not, overall, lead to significant non￾compliance with the calibration standards and internal model requirements. 2.42. Following the submission of a model change application, a firm should continue to use the version of the IM for which approval has been granted by the GFSC when calculating its SCR. The firm should continue to use that version of the IM for regulatory purposes until the GFSC reaches a decision on the model change application. For the avoidance of doubt, the firm can continue to make minor changes to its IM in accordance with its IM change policy while the GFSC is considering a model change application. 2.43. Firms should have regard to the possibility that a variation of an existing approval is not granted, and the possibility of the GFSC either modifying any existing safeguards, or imposing new safeguards, to address new or emerging RMLs. As such, firms should have contingency plans addressing possible outcomes of its model change application, where appropriate, and share these with the GFSC. 2.44. The GFSC will follow the same approach as set out in sections ‘Assessment of the application’ and ‘Decision on the application’ for assessment of and decisions on an application for variation of an existing approval, to enable a firm to make a major model change or a change to its IM change policy (other than a change in accordance with regulation 103(4) of the Insurance Companies Regulations). 2.45. While minor changes to a firm’s IM made in accordance with its model change policy do not require the firm’s IM approval to be varied, the GFSC will regularly review firms’ reporting of minor model changes, as set out in Chapter 5, and may challenge any that it considers should be classified as a major model change. In addition, minor changes may be subject to review by the GFSC at any time as part of the GFSC’s ongoing supervisory review process. If a minor change causes a firm’s IM to no longer meet the calibration standards and/or internal model requirements, firms must address this issue. Minor change accumulations will be reset at the end of an annual cycle (that firms may specify), or at the point of the GFSC receiving a major change application (contingent upon approval for the application being granted), unless otherwise agreed with the GFSC. 2.46. Changes to the model change policy in accordance with regulation 103(4) of the Insurance Companies Regulations are not required to be reported to the GFSC – see further details in the next section. 2.47. Firms are encouraged to discuss accumulated minor changes (and their collective impact) with the GFSC prior to resetting the accumulation counter to zero, to ensure a common understanding of the interaction between the various minor changes and the overall IM. 2.48. Firms must remain adequately capitalised at all times,6 including during the period when a model change application is being reviewed by the GFSC. The GFSC may consider use of 6 Regulation 90(1) of the Insurance Companies Regulations, Core Principle 10 in the Financial Services (Core Principles and Consumer Duty) Regulations 2024 and the Appropriate Resources Threshold Condition in Schedule 12 of the Financial Services Act 2019.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 14 Ongoing Monitoring supervisory tools such as a CAO or other requirement safeguard (as described in Chapter 3) to ensure that any material risks to its objectives are adequately mitigated.7

2.49. Firms that apply MLAs must document governance procedures for doing so in their IM change policies and must consider whether and explain why their use of MLAs constitutes minor or major model changes as required by regulation 103(2) of the Insurance Companies Regulations. These governance procedures should include the procedures for applying, reviewing, and removing MLAs. Applications to change the policy for changing an Internal Model 2.50. The GFSC expects a firm to discuss with its normal supervisory contact a proposal to alter its IM change policy in accordance with regulation 103(3) of the Insurance Companies Regulations other than in the circumstances set out in 2.51 below. A firm can apply for any such change separately or as part of an application for other major changes to an existing model approval. 2.51. Regulation 103(4) of the Insurance Companies Regulations allows a firm to make administrative changes to its internal model change policy (that do not affect the overall substance, scope, processes and outcomes of the policy) without applying for a variation of the firm’s existing approval. Examples of such administrative changes include: changes to the name of the company or logo; updating titles, role descriptions or names of staff responsible for the IM; or corrections to the drafting of the text and updating numbered references. 2.52. A firm should include in its application for the variation of an existing approval for changes to its IM change policy the reason for the proposed change and evidence that, after applying the changes, the calibration standards and internal model requirements would be complied with (see regulation 103 of the Insurance Companies Regulations). Additionally, in the case of a partial IM, a firm should submit documentary evidence setting out how it would fulfil regulations 102(2) and 102A after changing its IM change policy. 2.53. The GFSC expects to grant a variation of an existing approval for changes to a firm’s IM change policy only if it is satisfied that the scope of the policy is comprehensive, and that the procedures described in the policy for changing the IM ensure that the IM and, if the context requires, the firm meets on a continuous basis the calibration standards and internal model requirements (as waived or modified in accordance with regulation 276A(5) of the Insurance Companies Regulations). 2.54. Firms’ applications should be in the form and manner that the GFSC directs, and contain or be accompanied by any information that the GFSC reasonably requires. 3. Flexible approach to model approvals 3.1. The GFSC’s approach to granting and varying IM approvals applies in a way that is proportionate without compromising on modelling standards. In particular, the GFSC will consider allowing firms to remedy RMLs in their IMs after the approval (or variation) has been granted. The GFSC considers that the degree to which any limitation can be considered residual will depend on the 7 See the GFSC’s Guidance Note on Solvency 2: Capital Add-Ons

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 15 Ongoing Monitoring particular circumstances. In any event, it must not result in significant non-compliance with the relevant requirements. The GFSC will require a safeguard as an interim means of addressing the risks arising from such a limitation. The fact that the limitation is temporary and capable of remediation (and that a safeguard may be designed to mitigate the non-compliance in the interim) is likely to be key in the GFSC’s assessment that the way in which the firm is unable to demonstrate compliance is not significant at the point of assessment. The GFSC expects firms to make all reasonable efforts to remedy such limitations. The timeframe within which remediation is expected will depend on the nature of the limitation, as some, by their nature, may persist for longer than others. 3.2. The GFSC will not necessarily reject an IM application if it identifies RMLs which prevent a firm from demonstrating compliance with all the relevant requirements. The GFSC will consider granting (or varying) a model approval with appropriate safeguards, where safeguards achieve the following: (a) they mitigate residual non-compliance with the internal model requirements, and/or (b) they ensure compliance with the calibration standards in regulation 91(3) to (5) of the Insurance Companies Regulations. 3.3. The GFSC’s use of safeguards will be subject to supervisory judgement and will depend on case￾specific circumstances, noting the importance of consistent treatment of firms. The appropriateness (e.g. in terms of magnitude and features) of safeguards that the GFSC would consider setting in order to support granting of a model approval (or variation of an existing approval) are described in paragraphs 3.13 to 3.21. 3.4. Further to paragraph 2.27(a), where the GFSC identifies RMLs in a proposed IM that individually, and when considered overall, do not lead to significant non-compliance with the calibration standards and internal model requirements, the factors the GFSC will consider when deciding whether to grant a model approval, or vary a model approval for a major model change, include the following: (a) whether, in the GFSC’s judgement, the model + safeguards achieve compliance with the calibration standards; (b) where there is some residual non-compliance with the internal model requirements and that needs to be remedied, the GFSC will consider whether one or more safeguards could mitigate that residual non-compliance in the interim; (c) the appropriateness of a firm’s (or group’s) IM change policy, which may present particular challenges in light of any identified limitations; and (d) whether granting an approval with safeguards, considering the factors described in paragraphs 3.15 to 3.16, would provide a better outcome for advancing the GFSC’s statutory objectives than the alternative of rejection and use of the SF by a firm (or group) to calculate some or all of its SCR. 3.5. Pursuant to paragraph 3.4, additional factors the GFSC will consider when deciding to grant approval (or vary an existing approval in the case of a major model change) for a group IM include:

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 16 Ongoing Monitoring (a) whether the consolidated group SCR calculated using the IM will adequately reflect the overall risk profile of the group; (b) the impact of diversification of risks within the group on the group’s risk profile; (c) the impact of intragroup transactions on the group’s risk profile, and whether the model makes appropriate allowance for interactions within the group; (d) the availability of eligible own funds of related undertakings to absorb losses at the level of the group; (e) the fungibility of capital and any restrictions on movement of capital within the group; (f) the method of group consolidation; and (g) risks specific to entities that are outside of Gibraltar. 3.6. Where the GFSC grants an approval or approves the variation of an existing approval; it will specify in a written notice issued to the firm: (a) any requirement safeguards set by the GFSC to support the model approval; and (b) where a safeguard is imposed that is intended to mitigate non-compliance with any internal model requirement, a waiver or modification of that requirement for the period during which the safeguard is in place, so that the firm would not be in breach of the requirement. 3.7. A firm with an IM approval must ensure ongoing compliance with the internal model requirements, as waived or modified by the written notice issued to it by the GFSC, along with any additional requirements imposed by the GFSC and documented in the written notice. Where a firm detects any non-compliance with the requirements set out in the written notice, regulation 106(1) of the Insurance Companies Regulations will apply. Residual Model Limitations 3.8. The GFSC recognises that models with some residual deficiencies or limitations can be of value for regulatory purposes. 3.9. An RML, as defined in regulation 3 of the Insurance Companies Regulations, is an aspect of a model that prevents the firm from complying with the relevant rules in all the circumstances in which the model is to be used. Any such limitation should not lead to significant non-compliance with the requirements in the Insurance Companies Regulations. The GFSC distinguishes between its approach to an RML, depending on: (a) the extent to which it relates to the calibration standards; and/or (b) the extent to which it relates to an internal model requirement. 3.10. RMLs could arise in a number of circumstances, for example:

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 17 Ongoing Monitoring (a) Incomplete data for modelling a risk (where the data is unavailable) could mean a firm cannot demonstrate it meets statistical quality standards as they apply to data (e.g. regulation 109(3) to (4) of the Insurance Companies Regulations). This could also result in the firm struggling to demonstrate that the model meets the calibration standards. (b) A simplified modelling approach for a given risk exposure, which the GFSC considers to be appropriate and compliant with the relevant requirements only if the firm’s risk exposure remains below a defined limit. Above that limit, the GFSC considers that the model in its current form is not appropriate to calculate an SCR that meets the calibration standards and internal model requirements. 3.11. In determining whether model limitations represent significant model deficiencies, the GFSC will assess those limitations individually and overall. Safeguards to support granting or variation of model approvals 3.12. The GFSC expects to use safeguards at the point of granting an IM approval and varying an IM approval for either a major model change, or where it detects new RMLs (or changes to existing RMLs) during model reviews within the internal model ongoing review (‘IMOR’) framework (as described in Chapter 5). 3.13. There are two types of safeguards that the GFSC could set to achieve the outcomes described in paragraph 3.2: (a) requirement safeguards, which would apply to a firm’s business practices or model use, to ensure the model does not develop any significant risk profile deviations. These safeguards can be used to mitigate non-compliance with the internal model requirements; and (b) RML CAOs, which are intended to address an internal model residual deviation as regards the SCR (as defined in regulation 3 of the Insurance Companies Regulations), in order to ensure compliance with regulation 91(3) to (5) of the Insurance Companies Regulations. 8 These safeguards could also mitigate non-compliance with the internal model requirements, in particular, where that non-compliance results in a risk profile deviation as regards the SCR. Table 1: Summary of model approval safeguards and their effect 8 Additional detail on RML CAOs is provided in the GFSC’s Guidance Note on Solvency 2: Capital Add Ons.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 18 Ongoing Monitoring Safeguard RML CAO Requirement safeguard Calibration standards Ensures compliance with regulation 91(3) to (5) of the Insurance Companies Regulations Internal model requirements Mitigates non-compliance (and the GFSC may need to waive or modify a provision within the Insurance Companies Regulations, in accordance with regulation 276A(5) of those Regulations). Mitigates non-compliance (and the GFSC may need to waive or modify a provision within the Insurance Companies Regulations, in accordance with regulation 276A(5) of those Regulations). 3.14. Safeguards are exogenous to an IM and will be documented by the GFSC in the written notice of its decision. Where the GFSC considers that one or more safeguards may be needed to support granting of an IM approval (or variation of an existing approval) to achieve the outcomes described in paragraph 3.2, the GFSC expects to discuss those safeguards and underlying RMLs with a firm during the application period, in advance of taking a decision. 3.15. The GFSC expects to only grant (or vary) a model approval with one or more RML CAO(s) where it determines that deviation in the firm’s risk profile from the assumptions underlying the SCR, when assessed individually and overall, does not constitute an internal model significant risk profile deviation, but rather an internal model residual deviation. Additional information on internal model significant risk profile deviations and internal model residual deviations is set out in the GFSC’s Guidance Note on Solvency 2: Capital Add-Ons. The GFSC expects to set RML CAOs using its powers in section 70/71 of the Financial Services Act 2019 (and in the case of undertakings within groups that are subject to group supervision by the GFSC, using its powers under regulation 33 of the Insurance Companies Regulations, by virtue of regulation 192 of those Regulations), which is the same approach used for all other types of CAOs. 3.16. Where the GFSC considers it possible to set requirement safeguards to support the granting of an IM approval to mitigate residual non-compliance with the internal model requirements, the GFSC will consider the appropriateness of those safeguards in the context of, among other things, the firm’s (or group’s) business mix, risk profile, business strategy, and plans for future growth. 3.17. If, after granting a model approval (or variation of an existing approval, to enable a firm to make a major model change), the GFSC determines that a risk profile deviation as regards the SCR becomes significant, the GFSC would consider (among other possible supervisory measures) setting a CAO for internal model significant risk profile deviation.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 19 Ongoing Monitoring 3.18. Where a group applies for or has approval to use an IM to calculate its consolidated group SCR, and the GFSC determines that a safeguard is appropriate to support granting or varying a model approval at the (solo) level for a firm within the group, it will take into account the factors listed in paragraph 3.5 when considering whether a corresponding safeguard should also be set at the level of the group. 3.19. Firms are required to make all reasonable efforts to remedy the deficiency that led to the imposition of a safeguard (as required by regulation 102C of the Insurance Companies Regulations and which applies to groups through regulation 209(4) and 211(3) of the Insurance Companies Regulations). What constitutes ‘reasonable efforts’ will depend on the underlying model deficiency. The GFSC will specify any requirement safeguards needed to mitigate non￾compliance with the internal model requirements within a written notice issued to the firm. The GFSC will also explain in writing its expectations of what the firm needs to do in order to remediate the RML so that a safeguard can be removed. 3.20. The GFSC expects safeguards to be temporary: as a firm develops its IM and remediates underlying RMLs to the GFSC’s satisfaction, the GFSC expects to remove safeguards. The type of RML will influence the expected duration of a safeguard. The GFSC recognises that there are some situations where safeguards may need to remain in place longer-term, for example: (a) where safeguards relate to model weaknesses that can only be remediated through accumulation of data or further model development; (b) where further model development would represent spurious accuracy and overreliance on modelled outputs. 3.21. In these situations, the use of safeguards to support granting of an IM approval (or variation of an existing approval, for a major model change) could help to facilitate model development at an appropriate pace and enable the embedding of the IM within a firm’s risk management system, while mitigating risks to the GFSC’s objectives. Safeguard duration will depend on a firm’s case-specific circumstances, and the GFSC will regularly review the appropriateness of safeguards using the IMOR framework (as described in Chapter 5). If a firm’s IM development does not keep pace with changes to its risk exposure, the GFSC would take appropriate action. 3.22. Where a firm ceases to comply with a safeguard set by the GFSC, the GFSC will take appropriate action. In the case of an RML CAO, the firm’s SCR will include any RML CAO set by the GFSC. Non-compliance with an RML CAO would therefore constitute non-compliance with the firm’s SCR, and so regulation 122 of the Insurance Companies Regulations would apply. For all safeguards, the GFSC’s approach to non-compliance with a safeguard will depend on the case-specific circumstances, and could include: (a) specifying a deadline for the firm to re-establish compliance or develop a more appropriate modelling approach that remediates the underlying RML. If the firm fails to restore compliance or address the underlying RML within the required timescales, this could lead to more severe supervisory action, such as stronger safeguards or ultimately variation or revocation of the firm’s model approval (described in more detail in paragraphs 3.35 to 3.39);

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 20 Ongoing Monitoring (b) setting a new safeguard or modifying the existing safeguard; and (c) consideration of using the GFSC’s enforcement tools. 3.23. The GFSC will remove a safeguard and vary the firm’s approval, if applicable, where the firm demonstrates to the GFSC’s satisfaction that it has addressed the RML that led to the imposition of the safeguard. The mechanism by which the GFSC removes a safeguard and any waiver or modification of the internal model requirements will depend on its type and materiality, and could include a written request by a firm (along with supporting information) or an application for a major model change. Model Limitation Adjustments 3.24. In some circumstances, firms may mitigate RMLs or uncertainty by incorporating MLAs into their models. An MLA is a capital adjustment which contributes to the calculation of a firm’s SCR (or a group’s group SCR) that is intended to ensure that it complies with the calibration standards. The GFSC recognises that MLAs can be an important (model) risk management tool for firms, enabling them to address RMLs and modelling uncertainty in a pragmatic way, and can help firms keep their models up to date and compliant with the relevant calibration requirements. An MLA could be applied as: (a) an adjustment to a firm’s or (or group’s) SCR; (b) an adjustment to an intermediate component of a firm’s (or group’s) SCR, e.g. for a risk module or sub-module, prior to aggregation; or (c) an adjustment to a parameter or assumption within a firm’s (or group’s) model, which has the effect of increasing the firm’s (or group’s) SCR compared to the SCR that would be calculated by the model without the adjustment. 3.25. The GFSC generally expects that each MLA will be (or result in) a positive increase to the SCR and that any negative MLAs are only applied after discussion with supervisors. This is because negative MLAs (which reduce the SCR) could lead to a reduction in overall modelling standards, since it would allow a firm to benefit from a lower SCR due to a model limitation. 3.26. The GFSC considers that MLAs form part of a firm’s IM, and as such are not safeguards as described in the paragraphs above. Furthermore, the GFSC considers that MLAs are not expert judgements, since expert judgements are covered separately by firms’ expert judgement policies. The GFSC will document the use of relevant MLAs within a firm’s IM approval when granting an initial approval or varying an existing approval for the purposes of a major model change. 3.27. Further to paragraph 2.48, a firm with an IM approval is required to include within its IM change policy its approach to using MLAs, including where they are specified as minor or major model changes.9 This should include an explanation of governance arrangements relating to their use, and an explanation of where they are specified as minor and major changes and the reason they are specified as such. A firm should also include within its IM change policy a 9 As required by regulation 103(2) of the Insurance Companies Regulations

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 21 Ongoing Monitoring description of its procedures for applying, reviewing, and removing such MLAs. A firm with an IM approval should also include in its submission of quarterly model change (‘QMC’) information to the GFSC its use of any MLAs that it classifies in its IM change policy as minor or major model changes.10 A firm must also report to the GFSC the impact of MLAs on changes to its SCR as identified in its annual AoC exercise (as described in Chapter 5), along with supporting narrative information to explain those impacts. 3.28. The GFSC expects to review a firm’s use (or proposed use) of MLAs in the following circumstances: (a) during the normal process of granting an IM approval, or variation of an existing approval for the purposes of a major model change, in advance of making its decision on an IM approval (or variation) application; (b) when reviewing proposed changes to a firm’s IM change policy, where the changes relate to the firm’s use of MLAs or the governance arrangements for their use; (c) as part of its ongoing review of firms’ models via the IMOR framework (as described in Chapter 5), in particular when reviewing a firm’s AoC submission (as required by regulation 111A of the Insurance Companies Regulations); and (d) during the GFSC’s review of model changes included in a firm’s QMC submission. 3.29. The GFSC recognises that a firm’s use of MLAs will fluctuate over time, as the firm develops its IM in response to changes in the economic environment, and to reflect changes in the firm’s business mix and risk profile. The GFSC generally expects that an individual MLA should only be used by a firm on a temporary basis, and that the firm should make all reasonable efforts to remediate the RML or address the uncertainty which led to the use of the MLA over time. The GFSC’s expectations in this regard will depend on the case-specific circumstances, including the size and nature of the underlying model deficiency or uncertainty. The GFSC will monitor a firm’s remediation of RMLs underlying MLAs over time as part of the IMOR framework. 3.30. In some cases, the GFSC may consider an MLA to be an appropriate alternative to an RML CAO, to address an RML that leads to an internal model residual deviation,11 to ensure compliance with calibration standards. Whether an RML CAO or MLA is appropriate for that purpose will be subject to supervisory judgement and will depend on the case-specific circumstances. Some of the factors the GFSC will consider when making such a judgement include: the size and nature of the RML underlying the internal model residual deviation, the firm’s plans to remediate the RML that led to the internal model residual deviation, and whether there is additional non-compliance with internal model requirements. 10 A firm with an IM approval should submit this information using the QMC.01 reporting template in the Financial Services (Insurance Supervisory Reporting)(Technical Standards) Regulations 2025 and provide supporting narrative information. 11 For example, where the GFSC considers an RML as evidence that a model is under-calibrated, or there is uncertainty as to whether the model’s calibration meets the 1:200 standard required by regulation 91(3) to (5) of the Insurance Companies Regulations. The GFSC will not grant a model approval (or vary an existing permission in the case of a major model change) where the firm’s risk profile deviates significantly from the assumptions underlying the SCR.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 22 Ongoing Monitoring 3.31. Where a firm uses an MLA to address an internal model residual deviation,12 and the underlying deviation grows and becomes more material over time, the GFSC would consider setting an RML CAO to replace the MLA. This would ensure that the firm’s SCR continues to comply with the calibration standards – provided that the risk profile deviation as regards the SCR is not significant. If the risk profile deviation as regards the SCR meets the relevant conditions to be classified as a significant risk profile deviation, then the GFSC would consider (among other supervisory measures) setting a CAO for internal model significant risk profile deviation. 3.32. Where firms within a group make use of MLAs to calculate their solo SCRs, they should document their approach in their IM change policies, as described in paragraph 3.27. Those relevant firms should also consider whether an MLA applied at the solo level should also be applied at the level of the group, when calculating the group SCR. In making such a determination, firms should consider the factors set out in paragraph 3.5. 3.33. Where a group uses MLAs in the calculation of its consolidated group SCR, it should document its approach in its IM change policy, as described in paragraph 3.27. The GFSC’s powers to vary or revoke model approval 3.34. The GFSC’s power to grant model approvals under regulation 276A of the Insurance Companies Regulations also permits the GFSC to vary or revoke an approval. The GFSC expects to use its power to vary a firm’s model approval to enable a firm to make a major change to its model, as well as changes to its IM change policy, and to modify existing safeguards, set new safeguards, and remove safeguards, as appropriate.13 The GFSC may also exercise its power to vary a firm’s model permission in order to waive or modify internal model requirements that apply to the firm. 3.35. The GFSC’s power to vary a firm’s IM approval could also be exercised to unilaterally reduce the scope of a firm’s IM. The GFSC does not expect to make use of its power in this manner routinely. It may be considered appropriate where the GFSC has concerns that the IM is no longer compliant with the internal model requirements, and that part or all of the firm’s IM is inadequate or no longer appropriately reflects the firm’s (or group’s) risk profile and, for example, where the firm has failed to remedy this situation itself. The GFSC is only likely to consider this option having first explored other, more targeted supervisory actions. 3.36. Furthermore, the GFSC would exercise this power in a proportionate manner, for example by only removing from the model approval the deficient parts of the IM (risk sub￾modules, business units with respect to a specific risk module, or major business units, depending on the structure of the model) where the GFSC considers that they no longer appropriately reflect the risk profile of the firm (or group). The following scenarios could lead the GFSC to consider exercising its variation power as described: 12 Either when applying for an initial IM approval, variation of an existing approval in order to make a major model change, or as a minor model change after approval is granted. 13 And, where necessary, waive or modify any underlying internal model requirement for the period during which a safeguard is in place, so that the firm would not be in breach of those requirements, in accordance with regulation 276A(5) of the Insurance Companies Regulations.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 23 Ongoing Monitoring (a) if a firm does not make all reasonable efforts to remedy the RML that led to the setting of an IM safeguard where required by the GFSC, and those limitations become significant deficiencies such that the GFSC considers it is inappropriate to address them with more severe safeguards or other supervisory measures (e.g. CAO for internal model significant risk profile deviation); (b) where, over time, significant model deficiencies arise (e.g. due to underdevelopment), in particular relating to the appropriateness of the design and operation of a firm’s IM, and the GFSC has concerns that part or all of the firm’s IM is inadequate or the SCR that the IM generates no longer appropriately reflects the firm’s risk profile better than if the SF were used, and the GFSC considers that those deficiencies cannot be adequately addressed via other supervisory measures; (c) if a firm does not make every effort to remedy the deficiencies that led to the setting of a CAO arising as a result of an internal model significant risk profile deviation or significant system of governance deviation, and the GFSC considers that those deficiencies cannot be adequately addressed via other supervisory measures; (d) if a firm does not comply with safeguards set by the GFSC to support the IM approval, and does not take action to remediate the non-compliance as required by the GFSC; and (e) where a firm ceases to comply with the internal model requirements and fails to comply with regulation 106(1) of the Insurance Companies Regulations, or to implement the plan to restore compliance with the internal model requirements (required by regulation 106(1) of the Insurance Companies Regulations) in a timely and cooperative manner, and the GFSC considers that those deficiencies cannot be adequately addressed via other supervisory measures. 3.37. Where the GFSC considers that exercise of its power to vary a firm’s or group’s model approval as described in paragraph 3.35 is potentially likely, then it will engage with the firm as early as possible to manage the firm’s reversion to calculating some of its SCR using the SF. The GFSC may request that the firm submits a realistic transitional plan to reduce the scope of its model, as required by regulation 102B of the Insurance Companies Regulations. Where such a plan is requested, the GFSC will explain the reasons for requiring a transitional plan and set the maximum scope which the IM can cover after the implementation of the transitional plan, by specifying which deficient risk sub-modules, business units with respect to a specific risk module, or major business units (depending on the structure of the model) should be removed from the model. Prior to submission to the GFSC, the transitional plan should be approved by the firm’s governing body. For a transitional plan to be considered realistic, it should clearly identify the following: (a) the expected period for implementing the plan to reduce the scope of the IM; (b) the measures and resources necessary to reduce the scope of the IM; (c) how the firm will integrate the capital requirement generated by the reduced scope partial IM with the SF SCR. This would be particularly relevant for a firm that has approval to calculate all of its SCR using a full IM, as the firm would need to select and justify an appropriate integration technique for that purpose. A firm with approval to use a partial IM

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 24 Ongoing Monitoring would have to consider if its existing integration technique would continue to be appropriate for use with a partial IM of reduced scope; (d) how the resulting reduced scope partial IM would comply with the calibration standards, including potentially through the use of MLAs. If those requirements would not be complied with, the firm should explain to the GFSC in writing why and in what way they would not be satisfied, so that the GFSC may consider whether an RML CAO safeguard is appropriate to ensure compliance with those rules; and (e) how the reduced scope partial IM would comply with the internal model requirements. If some of those requirements would not be complied with, the firm should identify those requirements, explain to the GFSC in writing why and in what way they would not be satisfied, and submit documentary evidence demonstrating that all other internal model requirements would be satisfied. The GFSC may consider whether one or more safeguards would be appropriate to mitigate any non-compliance with the internal model requirements. 3.38. The GFSC will evaluate the transitional plan submitted by the firm. Where necessary, the GFSC may require the firm to submit an amended transitional plan. When the GFSC is satisfied with the plan, it will inform the firm in writing, setting out its expectations as regards timelines and engagement for implementing the required model developments. Once those developments are completed to the GFSC’s satisfaction, the GFSC would vary the firm’s model approval as required. 3.39. The GFSC generally only expects to use its power to revoke a firm’s IM approval in exceptional circumstances, having first explored all other, more targeted supervisory actions. 4. Significant deviations from the assumptions underlying the Standard Formula 4.1. Where it is inappropriate for a firm to calculate its SCR in accordance with the SF, because its risk profile deviates significantly from the assumptions underlying the SF calculation, then the GFSC may require the firm to do one of the following: (a) replace a subset of the parameters used in the SF by undertaking specific parameters when calculating the life, non-life, and/or health underwriting risk modules; or (b) develop an IM to calculate its SCR, or a partial IM to calculate some risk modules of its SCR. 4.2. In the circumstances described in paragraph 4.1, the action taken by the GFSC will be proportionate, and will depend on the case-specific circumstances. 5. Supervisory review process: Internal Model Ongoing Review 5.1. The IMOR framework is the GFSC’s approach for continuous review and evaluation of firms’ IMs. This framework incorporates an annual AoC exercise, assessment of ongoing model compliance, and monitoring of safeguards, and may also incorporate thematic reviews.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 25 Ongoing Monitoring Strand 1 – GFSC driven thematic schedule 5.2. The GFSC has a schedule of thematic exercises it uses to engage with firms on key risk areas to which they are exposed. The GFSC will use the information collated from these exercises to highlight emerging risks across the industry and identify areas of future regulatory focus. 5.3. All firms with an IM may be expected to engage with this schedule of exercises, which can include, but is not limited to, analysis of market risk sensitivities (‘MRS’) and internal model output (‘IMO’) reviews. The GFSC will communicate with the industry on the schedule of thematic reviews to ensure firms have adequate notice of upcoming exercises. It may be appropriate in certain cases for some firms to not participate, but this is subject to supervisory discretion and firms should discuss this possibility in advance with their normal supervisory contacts. Strand 2 – AoC exercise 5.4. The GFSC will review a firm’s submission in respect of its annual AoC exercise comparing the change in its SCR as at the firm’s most recent financial year end and its SCR as at the firm’s previous financial year end. Firms are required to complete and submit the AoC.01 reporting template to explain all material causes of changes in their SCRs over the year. This should include changes in a firm’s risk profile, changes to its IM (including any changes to individual MLAs used within its IM), changes in the amount of any CAOs set by the GFSC, changes in risk exposures, economic conditions, etc. 5.5. Firms should use the output of their AoC exercises to identify causes of movements in their SCRs and assess the possibility and sources of model drift. In addition, firms are required to provide reasons, and documentary evidence to support those reasons, explaining any change in SCR identified in AoC.01. The GFSC expects this documentation to also include other details relevant to the AoC exercise, as set out in regulation 111A of the Insurance Companies Regulations. 5.6. As described in paragraph 2.12, the GFSC may expect firms to carry out and submit to the GFSC the results of an AoC exercise when applying for a new model approval. The GFSC may also expect this of firms when applying for variation of an existing approval in relation to a major model change. It will notify firms where it expects them to do so.14

5.7. The GFSC will engage with firms on their AoC submissions if further information is required. Strand 3 – Assessment of ongoing model compliance 5.8. The GFSC expects to engage with firms on a case-by-case basis relating to any concerns regarding their compliance with the calibration standards and internal model requirements. 5.9. The GFSC will take into account as part of its own review a firm’s annual attestation regarding the ongoing compliance of its IM and, where the context requires, the firm itself, with the internal model requirements. This will include a review of a firm’s plans to address any problems identified by the model validation process. 14 For example, where the impact on a firm’s SCR in the event of the GFSC granting (or varying) the approval would be significant, or where a firm proposes complex changes to its IM.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 26 Ongoing Monitoring 5.10. The GFSC will also consider whether the emergence of RMLs or significant deficiencies over time may require an adjustment to the firm’s model or SCR to ensure that the firm complies with the calibration standards.15 Where this is the case, a firm should explain its proposed model development (in line with its IM change policy), including any relevant judgements, to the GFSC. 5.11. Following the granting of an IM approval, where a firm fails to make all reasonable efforts to remedy the RML that led to the setting of a safeguard, or where failures to follow internal model requirements (e.g. use test requirements in regulation 108 of the Insurance Companies Regulations) point to possible issues relating to the governance of a firm, the GFSC will consider imposing a governance CAO (‘GCAO’). An example of a governance issue that could result in a GCAO is the failure by a firm to follow the arrangements set out in its IM change policy. Strand 4 – Monitoring of safeguards 5.12. The GFSC will monitor any safeguards it imposes at the time of granting or varying a firm’s IM approval, or as part of the ongoing assessment of the IM and the SCR. Where appropriate, this could result in any of the following: (a) request by the GFSC for submission of a progress report setting out the measures taken, and progress made on remedying the RML that led to the imposition of an IM safeguard.16 The GFSC will discuss the timing and frequency of such progress reports with a firm. The GFSC will evaluate a progress report submitted by a firm and provide feedback where relevant. Where necessary, the GFSC may request a firm to submit additional information or an amended progress report; (b) re-calibration of the safeguard(s), if the existing calibration is no longer considered appropriate for the model’s circumstances, (e.g. if the firm’s risk profile has changed or for other reasons); (c) removal of the safeguard(s), as described in paragraphs 3.20 to 3.23, if the GFSC considers the underlying RML has been fully addressed; (d) setting of new safeguard(s) to mitigate new or emerging non-compliance with the internal model requirements, or to ensure compliance with the calibration standards;17 (e) the GFSC taking appropriate action in response to a firm ceasing to comply with a safeguard set by the GFSC as described in paragraph 3.22; (f) revoking or varying the IM approval to reduce the scope of the IM, as described in paragraphs 3.36 to 3.40. 15 For example, where an RML gives rise to an internal model residual deviation or where significant deficiencies lead to a significant deviation in the firm’s risk profile from the assumptions underlying the SCR. 16 As required by regulation 102C of the Insurance Companies Regulations. 17 And, where necessary, waive or modify any underlying internal model requirements for the period during which a safeguard is in place, so that the firm would not be in breach of those requirements.

Gibraltar Financial Services Commission Guidance Note on Solvency 2 Internal Models: Approvals and 27 Ongoing Monitoring

Published by: Gibraltar Financial Services Commission PO Box 940 Suite 3, Ground Floor Atlantic Suites Europort Avenue Gibraltar www.gfsc.gi © 2025 Gibraltar Financial Services Commission