Guidelines for Reinsurance

---

Guidelines for Reinsurance April 2021

Contents I. Introduction.................................................................................................................................. 3 II. Reinsurance Strategy ................................................................................................... 4 Reinsurance Strategy and Risk Management Policy................................................... 7 Reinsurance Strategy and Internal Controls.................................................................. 7 Implementation and Management of the Reinsurance Strategy .......................................................... 8 III. Selection of Reinsurers...................................................................................................... 10 Authorization to Conduct Reinsurance Business........................................................... 11 Financial Strength and Stability of Reinsurers.............................................................. 12 Credit Rating............................................................................................................... 13 Retrocession..................................................................................................................... 13 Insurance Funds ...................................................................................................... 13 IV. Reinsurance Agreement ................................................................................................ 14 Role of Intermediaries in Reinsurance................................................................................. 15 V. Supervision........................................................................................................................... 16

I. Introduction The Croatian Financial Services Agency (hereinafter: HANFA), pursuant to Article 15(4) of the Act on the Croatian Financial Services Agency (Official Gazette, No. 140/05 and 12/12) and Article 204(10) of the Insurance Act (Official Gazette, No. 30/15, 112/18, 63/20 and 133/20), adopted these guidelines at its Management Board meeting held on 22 April 2021, to ensure that insurers and reinsurers are familiar with HANFA's expectations regarding their strategies, policies, and procedures applied for reinsurance risk management and the application of good practice in reinsurance. The guidelines are intended for insurers that conclude reinsurance agreements to cede excess risk above retention to a reinsurer, for more efficient risk management in this process, and with the aim of ensuring insurers' financial stability. Additionally, these guidelines appropriately apply to reinsurers that apply retrocession, i.e., transfer excess risk to another reinsurer. Reinsurance is one of the most important risk reduction techniques used by insurers to:

• reduce insurance risks and prevent financial instability;
• stabilize solvency;
• use available capital more efficiently;
• increase the number of accepted risks covered by insurance;
• disperse risk and improve exposure capacity to large risks, for example, catastrophe or cyber risks that are increasing, particularly with remote distribution; and
• increase their insurance capacity and ensure more stable operations. There is a strong economic argument in favor of insurers contracting reinsurance, which depends on the level of insurer capitalization and exposure to various risks; therefore, insurers opt for reinsurance:
• those with significant exposure to volatile business lines or significant exposure to natural catastrophe risks; and
• small insurers or specialized insurers with limited business diversification scope or lack of capital growth. In doing so, reinsurance exposes insurers to other risks such as counterparty/default risks or credit risks, assumed insurance risks, basis risks, concentration risks, liquidity risks, and operational risks. Consequently, inadequate reinsurance management can threaten the insurer's financial stability and reduce its rating. Insurers and reinsurers are obliged to carefully and responsibly select appropriate reinsurance and a reinsurer with which they will conclude a reinsurance agreement, taking into account the nature and scope of accepted insurance risks and risk exposure while considering their level of risk tolerance.

II. Reinsurance Strategy The reinsurance strategy encompasses management and appropriate monitoring and control systems for its implementation, and should be an integral part of the management system or risk management system. It must correspond to the insurer's overall risk profile, as well as its risk management strategy and financial status. For the implementation of the reinsurance strategy, the insurer is obliged to prescribe, apply, document, and regularly monitor and update an appropriate, effective, and comprehensive reinsurance policy and procedures for its implementation. The insurer's Management adopts and regularly reviews the strategic objectives of this strategy and risk management policy, while the Supervisory Board approves them to Management and monitors their implementation. The insurer's Management should review and assess the reinsurance strategy at least once a year, and modify or supplement it as necessary, for example, in the event of changed circumstances of the insurer, changes to its business strategy or reinsurer status, and adjust policies for its implementation accordingly. The reinsurance strategy implies:

• defining objectives and key factors of the reinsurance strategy;
• a procedure for identifying, monitoring, and reviewing risks arising from reinsurance, the level of risk tolerance, including key considered factors (e.g., business strategy, financial status, and cost of reinsurance);
• definition of limits for net risk that the insurer should retain and the maximum amount of protection that should be covered by reinsurance; Legal Framework When developing the reinsurance strategy and policy, the insurer acts in accordance with applicable regulations, taking into account their changes, and in line with EIOPA and HANFA guidelines. Therefore, the reinsurance strategy and policy should be in accordance with these guidelines and:

1. The Insurance Act (Official Gazette, No. 30/15, 112/18, 63/20 and 133/20)
2. Commission Delegated Regulation (EU) 2015/35 of 10 October 2014 supplementing Directive 2009/138/EU of the European Parliament and of the Council on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II), including all its amendments
3. Commission Implementing Regulation (EU) laying down technical information for the calculation of technical provisions and basic own funds for reporting purposes in accordance with Directive 2009/138/EU of the European Parliament and of the Council on the taking-up and pursuit of the business of Insurance and Reinsurance
4. HANFA Rules
5. Guidelines on the Governance System, EIOPA-BoS-14/253
6. Guidelines on Own Risk and Solvency Assessment, EIOPA-BoS-14/259 HR
7. Guidelines on the application of passive reinsurance contracts to the non-life insurance underwritten risk sub-module, EIOPA-BoS-14/173 HR

• procedure and criteria for determining the most appropriate types of reinsurance arrangements and level of retention, as well as risk retention in accepted insurance risks according to the level of risk tolerance;
• procedure for selecting a reinsurer with an acceptable credit rating that meets the criteria of an acceptable reinsurer according to insurer rules and has an acceptable credit rating assessment;
• continuous monitoring of the reinsurer, including criteria for assessing credit capacity and diversification of the reinsurer, as well as regular monitoring of rating changes;
• assessment of the need for collateral, where applicable, which includes identification and monitoring of credit risk exposure;
• determination of the role of intermediaries in reinsurance and criteria for their selection, where applicable;
• procedure and criteria for concluding an appropriate reinsurance agreement;
• defining credit risk exposure criteria and a procedure for identifying and monitoring liquidity risks, including recognizing the risk of executing claims or receiving reinsurance recoveries, to resolve any timing mismatch between insurance claim payments and reinsurance recoveries;
• procedure for identifying and monitoring aggregated risk (e.g., in a certain industry or geographic region), for relevant insurance business when dealing with exposure to a single reinsurer, especially regarding exposure to a reinsurer belonging to the same group of companies as the insurer;
• procedure for preparing and approving reinsurance programs;
• criteria, procedures, and periods for reinsurance control and updating of the strategy and policies;
• frequency of supervision and control, as well as a description of management reporting procedures for the implementation mentioned above;
• identifying employees and their roles and responsibilities in relation to the reinsurance management framework, especially key functions in procedures for developing and applying insurer strategies and policies, preparing and concluding reinsurance agreements, which at least includes monitoring and reviewing reinsurance management and managing reinsurance arrangements, as well as controlling and reporting to the insurer's Management.

When an insurer belongs to a group of companies, the reinsurance strategy should contain data on the group's reinsurance strategy. The information should identify control mechanisms and detail reporting methods for monitoring group arrangements. The strategy should also include reporting methods, monitoring of the insurer's operations by the parent company, and supervisory arrangements of the parent regulator regarding reinsurance. Any elements Role of Key Functions In the reinsurance strategy and applicable insurer policies, as well as in monitoring their effective implementation, it is necessary to establish the role of all key functions regarding their obligations and responsibilities, with the aim of ensuring compliance with regulations and risk management. In the strategy and implementation of the reinsurance strategy, a significant role is played by the key risk management function through encompassing the reinsurance strategy within the risk management policy, including the reinsurance strategy in the insurer's ORSA and other processes related to identifying and measuring the insurer's risk exposure. The key internal audit function participates in monitoring internal control systems and assessing the appropriateness and effectiveness of systems related to the reinsurance strategy. The key compliance monitoring function plays a significant role in drafting reinsurance agreements and ensuring compliance with the legal framework of the entire strategy and implementation of the reinsurance strategy. Role of Key Actuarial Function The obligation of the insurer's key actuarial function is to issue and publish at least once a year an opinion on the adequacy, appropriateness, and consistency of the reinsurance policy and strategy, as well as the reinsurance program, based on available and updated analyses appropriately discussed with relevant stakeholders. The actuarial function provides an opinion on:

1. the reinsurance policy and strategy, with emphasis on interdependence and consistency with the methodology for calculating technical provisions;
2. the structure, adequacy, and efficiency of the reinsurance program in stress scenarios;
3. the impact of reinsurance on financial stability and liquidity, as well as required solvency capital and acceptable own funds, considering the achievement of a proper balance between risk reduction and capital relief;
4. compliance of reinsurance processes with the insurer's risk appetite, particularly regarding credit and concentration risks. Mutual relationships and connections between the risk acceptance policy, reinsurance policy, and technical provisions must be considered. The holder of the actuarial function, in case of inconsistencies in approach or assumptions, must without delay alert the insurer's Management and other employees in accordance with the established policy for controlling the implementation of these policies.

of the strategy managed by the parent company or group should be identified and detailed in the reinsurance strategy. Reinsurance Strategy and Risk Management Policy Reinsurance increases the security of own capital and insurer solvency, as it enhances the insurer's ability to withstand flexibility in accepting risks, considering that reinsurance ensures a larger quantity or scope of risk without a significant increase in capital requirements for accepted insurance risks. In addition, reinsurance ensures significant liquid assets to the insurer in case of extraordinary losses. Additionally, if an insurer transfers a significant level of risk to several other reinsurers, it is expected that the insurer has considered the impact of such concentrations (especially in stress scenarios) within its risk management system and has identified credit risk, in accordance with its strategy and policy. In addition, it is important that a management reporting procedure for the above functions operates to ensure timely taking of necessary actions if significant risk increases occur. Reinsurance Strategy and Internal Controls The insurer establishes a system encompassing all processes related to the conclusion and execution of reinsurance agreements. This particularly applies to: the process of selecting reinsurance coverage and choosing a reinsurer, the process of concluding reinsurance agreements, the process of monitoring the execution of reinsurance agreements, particularly regarding timely notification of claims to the appropriate reinsurer and prompt recording of paid benefits from reinsurance. The mentioned controls include monitoring risk assessment and whether the risk is transferred as prescribed by the program and reinsurance strategy, as well as the reinsurance agreement. A prudent insurer monitors reinsurers with whom it has concluded contracts throughout the duration of the reinsurance agreement and as long as any obligations arising from the reinsurance agreement exist. The insurer should establish a system to monitor rating changes, solvency capital, assets, provisions, premium volume, ownership and management, media reports, payment timeliness of claims, and other information from various sources about its reinsurer, so that it can timely and adequately prepare and take corrective measures if unexpected financial problems with the reinsurer arise. In case of deterioration of the reinsurer's financial status during the duration of the reinsurance agreement, through the implementation of the mentioned internal controls, the insurer can timely consider contract termination and/or negotiate risk transfer to another reinsurer. Supervision over compliance with the internal control system and assessment of appropriateness and effectiveness is conducted by the insurer's internal audit, in accordance with internationally recognized standards for internal audit as well as the strategic and annual internal audit plan, taking into account the reinsurance strategy and policy. Also, other key functions, in accordance with prescribed obligations, as well as based on the insurer's internal rules and procedures, should execute their duties and assigned tasks for effective internal control of the management system. Senior management of the insurer should ensure that the existing IT/management system meets all Management's requirements regarding reporting frequency and level of detail, and internal control systems should ensure that insurance is conducted in accordance with the insurer's policy. Insurance control systems should be able to identify and report breaches of established rules in a timely manner. Security criteria are established and changed according to changes in the criteria on which they were determined. Implementation and Management of Reinsurance Strategy With regard to reinsurance and other risk reduction techniques, the insurer's risk management policy should cover at least:

1. defining the level of risk transfer corresponding to the defined risk limit and most appropriate types of reinsurance contracts, taking into account the risk profile;
2. criteria for selecting counterparties for risk reduction and procedures for assessing and monitoring their creditworthiness;
3. procedures for assessing effective risk transfer and considering basis risk;
4. liquidity management to resolve any timing mismatch between insurance claim payments and reinsurance recoveries. In cases where an insurer concludes or plans to conclude a reinsurance agreement with unaudited and/or newly established reinsurers, there is an increased need for information and analyses of the subject reinsurer due to potentially higher exposure to loss risk from uncollectible reinsurance. Therefore, in such cases, it is necessary to establish adequate levels of controls and conduct them more frequently.

Policies and procedures for implementing the reinsurance strategy include:

• setting guidelines for accepting insurance into coverage, by risk type, insurance terms, and total exposure by risk type, with the need to align exclusions, limits, and deductibles with the reinsurance contract, otherwise the insurer's net exposure will increase;
• maximum retention levels, taking into account not only individual risks but also unexpected risks caused by specific events (pandemics, floods, earthquakes, etc., large risks), and recognizing possible deficiencies in the reinsurance program that may cause inappropriate exposure or establishing limits of amount and type of risk to be automatically covered by reinsurance;
• defining criteria and procedures for acquiring facultative reinsurance1 coverage that should be secured before the insurer accepts a risk exceeding its capacity and/or risk appetite;
• anticipated coverage terms compatible with insurance terms, limits based on portfolio structure and reinsurance costs assessment, and adequate capital to support retained risk, all with the aim of avoiding uncovered risks;
• the insurer's reporting system and its IT system should ensure timely and effective receipt and processing of information indicating deviations from the reinsurance management strategy;
• procedures and responsible employees for operational implementation of the reinsurance strategy;
• fraud prevention and protection measures; and
• description of the functioning of the internal control system. The insurer's Management is responsible for fulfilling all prescribed and supervisory requirements that the insurer must meet; therefore, it is also responsible for adopting the reinsurance strategy and establishing an appropriate system for its implementation and internal control to ensure its execution. Internal control systems should be subject to regular review and assessment, at least once a year. The insurer's Management should receive regular and comprehensive reports on the implementation of the strategy or policies for its execution, execution of reinsurance agreements, particularly regarding data on premiums, commissions, claims, and technical provisions, as well as information on reviews of reinsurance coverage overall and regarding facultative reinsurance coverage. The reinsurance strategy should regularly undergo assessment to ensure the fulfillment of planned reinsurance coverage and the insurer's strategic objectives. Any deviations from the strategy are approved by the insurer's Management.

1 Facultative reinsurance is mainly used by insurers as a supplement to obligatory reinsurance, thereby covering additional risks above and outside what is covered by obligatory reinsurance contracts. Also, facultative reinsurance is most often used for individual reinsurance when a more detailed contract and individual solution are needed. Otherwise, if an insurer wants to insure all its insurance contracts within a certain risk category, it will conclude obligatory reinsurance.

Based on the adopted reinsurance strategy, the insurer's Management adopts policies for implementing the reinsurance strategy, in which it prescribes in detail the obligations and responsibilities of key function holders and other employees or organizational units responsible for acting according to the mentioned strategy, then control and supervision over the execution of their duties, as well as reporting to the insurer's Management and its authorities in relation to the above. The established supervision and internal control system should ensure timely identification of breached limits and prevent the acceptance of risks exceeding the insurer's and its reinsurance capacity.

III. Selection of Reinsurers For the financial stability of insurers, the quality of the selected reinsurer is particularly important, because insurance purchased at the best terms and lowest price is inadequate if the reinsurer is unable to fulfill its contractual obligations when the payment obligation matures. The insurer should have control over the selection of the reinsurer, in order to minimize the risk of inadequate reinsurer selection and have set prudent limits regarding its maximum total exposure to any reinsurer or group of reinsurers, considering the nature, size, and security of that reinsurer. The insurer should maintain an up-to-date list of acceptable reinsurers and record for each reinsurer the appropriate level of exposure, including to group companies and affiliated persons, where applicable. In addition to the mentioned data, each reinsurer should be recorded with data on: credit rating, type of reinsurance coverage, risk type, insurance premium, commission, and paid benefits by periods and by contract years and/or year of occurrence, as well as other technical details that enable full understanding