BMA BERMUDA MONETARY AUTHORITY

BERMUDA MONETARY AUTHORITY

GUIDANCE NOTE

FOR RECOVERY PLANNING REQUIREMENTS

20 March 2026

TABLE OF CONTENTS

INTRODUCTION......................................................................................................................... 3

I. BACKGROUND TO RECOVERY PLANNING.............................................................. 4

II. SCOPE OF REQUIREMENTS AND PROPORTIONALITY..................................... 6

III. ENTERPRISE RISK MANAGEMENT FRAMEWORK AND RECOVERY PLANNING ................................................................................................................................. 10

IV. KEY ELEMENTS OF A RECOVERY PLAN ............................................................. 12

The Guidance Note (GN) document should be read in conjunction with the Insurance (Prudential Standards) (Recovery Plan) Rules 2024, as at the date of this document.

INTRODUCTION

1. The Bermuda Monetary Authority (Authority or BMA) continues to review Bermuda’s regulatory and supervisory regimes in an effort to ensure that the jurisdiction adheres to international standards and best practices for insurance regulation and supervision.

2. As part of these changes, the Authority introduced recovery planning rules under the Insurance (Prudential Standards) (Recovery Plan) Rules 2024 (Rules), which became operative on 1 May 2025.

3. The intention of the Rules is to:

a. Aid the insurer1 in understanding its risks from severe stress scenarios; and

b. Strengthen Bermuda’s insurance regulatory framework by helping to ensure that the insurer has a plan in place to act in an orderly and timely manner when it is under severe stress.

The introduction of a commercial insurer’s recovery planning framework is an essential pillar in strengthening the Authority’s prudential framework.

4. This recovery planning framework is informed by the relevant standards and material from the Financial Stability Board (FSB)2 , the International Association of Insurance Supervisors (IAIS)3 and other relevant international bodies. To the extent appropriate, it also draws from the experiences of other comparable jurisdictions. Additionally, to help ensure it is appropriate and applicable for Bermuda, the framework also considers the unique features of Bermuda's financial system, particularly its international insurance sector.

5. This Guidance Note (GN) aims to provide guidance on the requirements set out in the Rules, with a focus on providing an overview of the Authority's expectations in relation to both the structure and content of a Recovery Plan.

[1] For the purpose of this Guidance Note, ‘insurer’ refers to the same interpretation as detailed in the Rules.

[2] Guidance for recovery and resolution planning (fsb.org)

[3] https://www.iaisweb.org/uploads/2022/01/191125-Application-Paper-on-Recovery-Planning.pdf

I. BACKGROUND TO RECOVERY PLANNING

Rationale for Recovery Planning

6. The IAIS defines a Recovery Plan as a plan that pre-emptively identifies options to restore the financial position and viability of the insurer if it comes under severe stress4 . As such, the Authority views the Recovery Plan as a critical management and supervisory tool. Broadly, a Recovery Plan includes three key elements:

a. Credible recovery options to cope with a range of severe stress scenarios, including both idiosyncratic and market-wide stress;

b. Scenarios that are severe enough to pose a significant risk to the viability of the insurer while remaining plausible; and

c. Processes that facilitate the timely implementation of effective recovery options in a range of severe stress situations.

7. Adequate preparation in the form of recovery planning not only reduces the probability of insurers failing but also reduces the impact of potential failures by increasing preparedness within insurers. An effective recovery planning framework, therefore, contributes to achieving policyholder protection, as well as maintaining financial stability. This will help enhance the Authority's overall regulatory mandate, which is to promote the safety and soundness of the insurers it regulates and the Bermuda financial system.

8. The 2008/2009 global financial crisis highlighted that insurers are not exempt from financial vulnerabilities5 and so should be adequately prepared for any periods of stress to ensure they can recover. Following the financial crisis, the FSB brought out new recovery planning requirements for systemically important financial institutions6 . The IAIS also revised Insurance Core Principle (ICP )16.15 (and the related ComFrame element), which establishes standards for supervisory requirements in relation to recovery planning.

9. The primary objectives of the FSB Key Attributes and the IAIS ICPs (and related ComFrame elements) on recovery planning are generally aligned and involve the identification and planning for the deployment of recovery options that a (re)insurer can reliably execute when under severe stress to restore its financial strength and viability.

[4] IAIS (18 November 2019). Application Paper on Recovery Planning. https://www.iaisweb.org/uploads/2022/01/191125-Application-Paper-on-Recovery-Planning.pdf

[5] EIOPA (2018) Failures and near misses in insurance: Overview of the causes and early identification.

[6] FSB (2012). Recovery and Resolution Planning: Making the Key Attributes Requirements Operational. Guidance for recovery and resolution planning.

10. In line with these objectives, the Authority recognises the increasing necessity for insurers to implement a formal and structured recovery planning framework that aligns with international standards.

Recovery Planning and Recovery Plans

11. Recovery planning represents more than the production of a Recovery Plan. Recovery planning involves the active engagement of senior management across various functions critical to implementing recovery strategies, as well as engagement from the board and relevant committees. Such engagement is needed to help ensure that the following occur:

a. A plausible range of recovery options is identified;

b. Roles and responsibilities are communicated and agreed upon;

c. Recovery options are sufficiently challenged for feasibility;

d. Impediments and implementation timeframes are identified;

e. The scenario analysis properly reflects the insurer’s strategic objectives in the scenarios; and

f. The Recovery Plan is appropriately tested.

A Recovery Plan is a key output of the recovery planning process and should reflect the lessons learned from it.

12. Insurers should not treat recovery planning as a regulatory compliance exercise. Instead, it should reflect the insurer’s actual processes and business operations.

13. The Authority would like to emphasise that the focus of the Rules is to prompt insurers to carry out an effective recovery planning exercise, rather than solely focusing on the documentation of the Recovery Plan.

14. A Recovery Plan is designed to assist the insurer in effective risk management. It should serve as a framework for the insurer to prepare for and navigate severe stress situations, although the specific actions taken and their timing will vary based on the unique circumstances they encounter. As part of its governance and oversight of the Recovery Plan, the insurer should maintain management information systems which are capable of producing information relevant to the recovery plan on a timely basis, both in advance of, and during stress events. Furthermore, in the event that the insurer experiences significant stress, the Recovery Plan can provide the supervisor with essential insights for any required supervisory actions. . The insurer should also make outputs of its management information systems regarding the recovery plan available to supervisors upon request.

II. SCOPE OF REQUIREMENTS AND PROPORTIONALITY

Scope and Proportionality of the Recovery Planning Rules

15. The Rules detail that the Authority will have regard to any or all of a number of specified matters in determining which insurers will be required to have a Recovery Plan in place under the Rules. For the purposes of recovery planning, these matters underpin the Authority’s assessment of an insurer’s nature, scale and complexity, and of whether its failure could threaten the financial stability of Bermuda.

16. With respect to the reference in the Rules to ‘enhanced supervisory monitoring’, the Authority considers an insurer to be under ‘enhanced supervisory monitoring’ if the Authority has identified any prudential and/or conduct issues from that insurer that the Authority determines could potentially put the policyholders, financial stability, or the reputation of the jurisdiction at risk. The criteria for placing insurers under enhanced supervisory monitoring take into account various prudential and or conduct issues which may include considerations, from other relevant supervisory authorities to place an insurer under enhanced supervisory monitoring, the Authority has not included a specific definition for ‘enhanced supervisory monitoring’ in the Rules as this might limit its recovery planning supervisory abilities and powers.

17. Insurers within the scope of the Rules will receive formal communication, in the form of a notice, from the Authority on the requirement to prepare a Recovery Plan. This notice will specify the deadline by which the insurer will be required to file its Recovery Plan with the Authority.

18. As noted above, the level of detail in the Recovery Plan should be proportionate to the scale and the complexity. of the insurer’s business/operations. The insurer should include information that is necessary to understand its key vulnerabilities, recovery capacity and the governance arrangements for developing and operating the Recovery Plan. The level of detail should be sufficient to enable the Recovery Plan to be understood on a standalone basis by a reasonably informed reader of the plan. Proportionality may be applied during both the development and the maintenance of the Recovery Plan.

19. In relation to the development of the plan, the Authority may apply proportionality at its discretion in the following ways:

a. Permitting the insurer to adopt a phased approach in developing a Recovery Plan, by initially submitting a high-level draft and then finalising the completed document over a period of time;

b. Permitting the insurer to align the development process with existing tools to minimise the required resources; and

c. Requiring insurers to take recovery planning measures (e.g., evaluating specific risks and options in possible recovery scenarios) as necessary without compiling a formal plan.

20. In relation to the maintenance of the Recovery Plan, the Authority may apply proportionality at its discretion in the following ways, provided that the Recovery Plan remains usable and effective:

a. Adjusting the frequency of regular updates to the Recovery Plan, particularly when key relevant characteristics have not changed significantly from year to year;

b. Permitting the insurer to monitor certain triggers in the Recovery Plan less frequently, such as the status of any non-material entities within a group; and

c. Adjusting expectations regarding the insurer’s engagement with the Authority regarding the Recovery Plan

The Use of a Group Recovery Plan

21. It is the Authority’s expectation that when a Bermuda insurer is included in a Recovery Plan required by, and filed with, a group-wide supervisor (including where the group-wide supervisor is the BMA), the insurer may submit a written application to the Authority for approval to adopt that document, rather than prepare a separate plan under the Rules. The written application should be accompanied by a copy of the Recovery Plan filed with the relevant supervisory authority, and should include an assessment of the rationale for why the group plan is appropriate for the Bermuda insurer to utilise under the Rules and how it reflects the nature, scale, complexity and contribution of the Bermuda insurer to the group.

22. Where the Authority is satisfied that the Recovery Plan meets the requirements of these Rules, the Authority shall approve the application and notify the insurer of its decision in writing. In the event that the Authority requires an insurer to prepare a separate entity-level Recovery Plan, the Authority will seek to cooperate and coordinate with the group-wide supervisor (where the BMA is not the group-wide supervisor) to avoid inconsistent recovery planning and actions in times of crisis.

23. A combined Recovery Plan covering multiple entities, if appropriate, may be allowed, subject to the Authority’s approval.

Considerations Where a Recovery Plan is Requested Under the Rules in the Authority’s Role as Group Supervisor

24. The Authority expects insurers that are parent entities of an international group to show how they have incorporated the various material entities from different jurisdictions into their Group Recovery Plan. It is important that insurers recognise both the financial and non-financial interdependencies that exist among entities within the group. Insurers should be aware that recovery options available to one entity could have a significant impact on another.

25. If individual entity Recovery Plans are in place, the insurer should ensure that recovery options, indicator frameworks and governance structures align between the group and legal entity level plans while considering the interdependencies between these.

Additional Considerations When Utilising or Relying on the Group Recovery Plan

26. If any material aspects of the Recovery Plan of the individual entity (e.g., recovery triggers, recovery options, etc.) are not documented in sufficient detail but cross-reference to the Group Recovery Plan, the BMA would expect to have access to, and the right to review, the relevant sections of the Group Recovery Plan.

27. Where warranted, the BMA would notify the insurer of its request for access to the relevant parts of the group Recovery Plan and expect to receive the requested information within a reasonable period of time thereafter.

28. In case this is not practicable (e.g., there are legal impediments preventing disclosure of certain information to the BMA), the BMA will consider the issue and the options available to it, which include requiring the insurer to develop its own Recovery Plan that is both specific and adequate.

Ownership and Accountability

29. Recovery planning should be integrated into the insurer’s overall ERM framework and should be evaluated, developed, maintained and owned by the insurer. When outsourcing is used to help insurers develop their Recovery Plans, the insurer should have demonstrable oversight and clear accountability for the outsourced service as if it were performed internally, subject to the insurer’s own governance and internal control standards. Insurers should ensure their outsourcing policy is satisfied when outsourcing recovery planning activities. In practice, insurers must ensure that outsourcing does not compromise the quality and effectiveness of recovery planning.

30. In cases where the development of the Recovery Plan has been outsourced, it is essential to note that this does not absolve the insurer’s management and board of their responsibility. Accountability cannot be outsourced; an insurer’s senior management and board shall be accountable for the development, maintenance and implementation of the Recovery Plan, in line with the Authority’s expectations detailed in this Guidance Note.

III. ENTERPRISE RISK MANAGEMENT FRAMEWORK AND RECOVERY PLANNING

Integration of the Recovery Plan into the Enterprise Risk Management (ERM) Framework

31. The Recovery Plan should complement and enhance the insurer’s existing ERM framework. The insurer may use existing ERM tools as a starting point for the Recovery Plan, including risk appetites and tolerances, the capital management approach, business continuity and disaster recovery plans, contingency plans and any other preventive or corrective measures already in place.

32. The Authority expects that for an insurer to be effective in this area, recovery planning should be embedded into the overall risk management framework. Recovery planning helps insurers respond to severe stress and restore financial health, while ERM addresses broader risk identification, assessment, and mitigation.

33. Ensuring the integration of recovery planning within the wider ERM framework aligns the insurer’s response to severe stress with its overall risk management strategies. As such, the Authority expects that insurers’ current ERM tools will serve as a source of input into the recovery planning exercise. This includes, but is not limited to, the following examples:

a. Trigger framework – Recovery Plans are activated when certain metrics breach defined risk tolerance levels. The Authority expects insurers’ risk appetite limit-setting to be consistent with the Recovery Plan and serve as a starting point for defining the Recovery Plan trigger framework; and

b. Governance – Recovery Plans should specify clear governance, detailing who is responsible for maintaining the plan, activating the plan, overseeing recovery actions, and communicating with regulators and stakeholders. The Authority expects insurers to align the governance structure of the Recovery Plan with that of the ERM framework. The same reporting lines and decision-making bodies should be used to avoid silos and ensure an integrated response during times of stress.

34. An insurer should carefully consider the appropriateness of using aspects of existing ERM tools and should not simply look to replicate existing documentation. In particular, the Recovery Plan differs from the Commercial Insurer’s Solvency Self-Assessment (CISSA) in several ways. The CISSA focuses on assessing an insurer’s current and prospective solvency needs and related risk management framework to prevent the insurer from breaching prudential and regulatory requirements and facing severe stress. On the other hand, the Recovery Plan envisions the insurer being confronted with severe stress and contemplates the actions needed to mitigate that stress and restore viability.

35. While the CISSA predominantly focuses on solvency and informs the capital risk appetite by identifying the potential impact of a range of plausible but severe stresses on the level of solvency, a Recovery Plan should be a more holistic document. It should consider a wider range of severe stress scenarios, such as market-driven, liquidity and operational scenarios that might threaten the insurer’s viability. Nonetheless, details in CISSA Reports regarding the insurer’s plans to raise additional capital may form the basis for relevant considerations regarding some of the identified recovery actions in the Recovery Plan. These actions may be available to management in some of the stresses considered but should be more holistic in the Recovery Plan than in the CISSA Report. It is expected that these would be supplemented by a wider range of potential recovery actions, including for operational events.

IV. KEY ELEMENTS OF A RECOVERY PLAN

36. The Authority recognises that the Recovery Plan is a living document. It should be periodically tested for ongoing effectiveness and periodically updated, including in the event of material internal or external changes that could render it insufficiently effective. Within the Recovery Plan, areas for further improvement should be identified, along with an outline schedule to address them. This may incorporate planned activities for which outputs are expected to be reflected in the next version of the document, or longer-term multi-year initiatives relevant to the insurer which are expected to impact only subsequent versions of the Recovery Plan. Regardless of any future changes, every effort should be made to ensure that each version submitted to the BMA is both plausible and well-founded.

Minimum Contents and Structure

37. In accordance with the Rules, a Recovery Plan prepared by an insurer shall include a number of specified matters. The sub-sections below provide further detail on relevant potential considerations regarding those matters.

a) Executive Summary

38. The objective of a Recovery Plan is to allow the board and senior management to promptly understand and assess triggers, recovery options and communication strategies for effectively responding to any severe stress situations. The Executive Summary should assist in meeting this objective by facilitating navigation and understanding of the details in the Recovery Plan. Therefore, the Authority expects the executive summary of an insurer's Recovery Plan to include, at a minimum, the following topics:

a) A high-level overview of the main components of the plan;

b) The most significant triggers;

c) Key recovery options;

d) An operational plan for implementation; and

e) Any material updates/changes to the (re)insurer and its Recovery Plan.

39. It may be helpful to use tables and flow charts to summarise these details.

b) Description of the Insurer

40. The Authority expects the insurer’s Recovery Plan to include a high-level description of the insurer. This should highlight factors relevant to the viability of the insurer, which may include, but not limited to, some or all of the following factors:

a) The insurer’s business and risk strategy;

b) Organisational structure –– both operating and legal structure, including a clear mapping of the intra-group operations for each material legal entity and business line;

c) Key jurisdictions in which the insurer is active;

d) Entities covered by the Recovery Plan;

e) Key services and critical functions which are material to the insurer’s viability; and

f) Key dependencies or inter-dependencies which are material to the insurer’s viability.

Key services and critical functions

41. The insurer should identify its core business lines, key services and critical functions to be maintained during a crisis, .which if disrupted would threaten the viability of the insurer. These are the insurer’s services and internal resources that are essential for continuing its business during a severe crisis that may threaten its viability.

42. Insurers should evaluate which activities are necessary to deliver their key services. This evaluation should encompass both immediate functions, such as policy servicing, claims settlement, or investment management, as well as support services, including IT, HR, or payment and custody capabilities.

43. Insurers should evaluate key services from the viewpoints of existing policyholders and claimants as well as the broader economic context. For current policyholders and claimants, the primary concern is the continuity or substitutability of their coverage and the assurance of claim settlements. Regarding the wider economy, significant factors include the market share of insurance segments that are necessary to facilitate economic activity, the availability of insurance cover and the potential for current or prospective policyholders to switch to another provider.

c) Trigger Framework

44. The trigger framework should include a range of criteria, each with established limits and thresholds, that will prompt certain responses from the insurer, such as enhanced monitoring or implementation of the Recovery Plan.

45. The Authority expects that the recovery triggers will include solvency and liquidity triggers at a minimum, as these will serve as the primary metrics for determining the activation of the Recovery Plan.

46. The trigger framework should include quantitative criteria, such as capital, liquidity, profitability, interest rate movements and fluctuations in business volumes, and qualitative criteria, including asset quality, macro-economic conditions and operational events (e.g., cyber-attacks). The criteria could encompass company-specific metrics as well as economic metrics. Examples of criteria include Enhanced Capital Requirement ratios (ECR), rating downgrade, fall in share price, widening of Credit Default Swap (CDS) spreads, negative press coverage, a counterparty requesting additional capital and income dropping below a limit identified in the Recovery Plan.

47. The triggers should typically be set above the level at which supervisory intervention would occur for the relevant metric.

48. The framework should operate in a tiered manner to reflect that varying degrees of response will be required, depending on the circumstances and severity of the stress event. For instance, an insurer may choose to use certain criteria as Early Warning Indicators (EWI) to alert it to emerging risks and determine that these criteria require heightened monitoring. When EWIs are breached, they should serve as a signal for the insurer to evaluate the circumstances and determine whether any measures are needed. This may include the convening of a senior decision-making committee. Other criteria may be used as 'trigger points' for enacting more intensified responses, such as starting escalation procedures or activating the Recovery Plan.

49. The insurer should implement reliable management information systems that allow it to monitor various indicators relevant to potential recovery actions in a timely manner. Additionally, these systems should clearly identify specific thresholds or criteria that trigger or activate the Recovery Plan.

50. The Authority expects the trigger framework to be integrated into the insurer’s day-to-day governance and risk management practices. The triggers should align with the key risk indicators that support the risk appetite statement, as well as metrics in the CISSA and capital and liquidity policies. However, it is important to recognise that while key risk indicators associated with the risk appetite statement aim to ensure adherence to the desired risk profile, triggers for recovery are anticipated to detect emerging stresses.

51. The triggers should reflect the company’s specific circumstances and vulnerabilities and should be calibrated to be sufficiently sensitive to notify the insurer of stress. They should also be sufficiently forward-looking to provide ample time for recovery actions to be taken.

52. The number of triggers developed and employed by an insurer should be appropriate for the insurer’s business and risk profile and sufficient to ensure that the insurer is alerted to deteriorating conditions in various areas without becoming impractical.

53. Stress testing and scenario analysis can serve as a valuable feedback mechanism for assessing the calibration of the trigger framework, as they demonstrate that the trigger points would be activated, allowing for the selection and timely implementation of effective recovery options.

54. Insurers should periodically review the recovery triggers and their associated thresholds as part of the Recovery Plan review process and recalibrate them as necessary.

55. Recovery triggers should be monitored frequently to help ensure that the insurer can respond appropriately and in a timely manner to restore its financial position following a decline in financial health.

d) Governance

56. In this section, the insurer should define the organisation's current governance structure, including the specific actions related to crisis management. The plan should describe the processes for monitoring, escalating and activating the Recovery Plan, as well as the key roles and responsibilities of the relevant stakeholders in each area of the governance process. It is best practice to have a committee responsible for activating and leading the implementation of the Recovery Plan that is assessed and approved by the board. Additionally, the insurer should officially designate a key member of its senior management, such as one from the risk or finance functions, with the responsibility for delivering an effective Recovery Plan. This individual should also serve as a key point of contact with the BMA.

57. The Authority expects the board of directors to be responsible for the final approval of the Recovery Plan.

Governance in relation to development, approval, reviewing & testing of the Recovery Plan

58. The Recovery Plan should outline the processes for continuously developing the initial plan and updating it where necessary.

59. The Authority expects insurers to cover the following areas:

a. Details of the membership of the board of directors, senior management and other relevant key persons in control functions with significant roles in the development, approval, reviewing and updating of the Recovery Plan, including a description of their roles and responsibilities;

b. Details of the process for the development and approval of the Recovery Plan that ensures appropriate segregation of duties and controls between those tasked with creating the plan, and those who review and approve the plan;

c. Description of the policies for the continuous development and review of recovery plans, including the frequency of the review. The Recovery Plan should be reviewed and updated at least once every three years or when there is a material change in the financial position, strategy, business or risk profile of the business. The Authority may require more frequent updates, which insurers will be informed of in writing; and

d. Details of the regular operational testing of the Recovery Plan to ensure its prompt activation and execution and to verify the effectiveness of the operational procedures and governance involved in implementing the plan. Insights gained from these evaluations should be integrated as the plan is updated.

Governance in relation to escalation and activation of Recovery Plan processes

60. Insurers should also document the process for escalating breaches of recovery triggers and for activating the Recovery Plan. This process should include an outline of the decision-making process following a trigger breach to ascertain the appropriate response, as well as an identification of the individuals accountable for these decisions and the timing of when they will be made. This should align with the procedure outlined in any crisis management documents. For example, the crisis management committee may be the same as the one specified in the business continuity plan.

e) Recovery Options

61. Recovery options are a range of potential actions that insurers can take to restore the operational viability and financial position of the entity. In the event that trigger points are breached, recovery option(s) may be implemented. It is important to consider recovery options in detail in advance of a stress event, so that appropriate action can be taken to recover in a timely manner.

62. Recovery options would typically include, but are not limited to, the following actions:

• Raising capital or other funding

• Increasing liquidity

• Implementing business continuity or Disaster Recovery Plans

• Enhancing risk mitigation (e.g., expanding the use of reinsurance)

• Reducing costs

• Selling or disposing of part (e.g., business units or subsidiaries) or all of an insurer’s business and assets

• Restricting dividends

• Restricting new business activities

• Going into run-off

The Recovery Plan should include a detailed description of each recovery option. The following details may be considered for inclusion:

• A summary analysis that includes the essential elements of the option

• A description of the option

• An overview of the key assumptions underlying the option and the basis for any expert judgement

• An assessment of the strategic implications of executing the option

• An assessment of the financial impact on normal and stressed market conditions. It may be appropriate to consider a range of pricing and asset valuation outcomes

• Potential adverse consequences of executing the option

• Speed and timing for effective execution, with justification of the timelines

• Any dependency on external counterparties for effective execution

• Operational aspects underlying effective execution, highlighting delegated authorities and approval requirements

• An assessment of potential impediments and constraints to effective execution, both internal and external

• A brief description of any previous experience with applying a certain option, including lessons learned from that experience

  63. Each recovery option should be accompanied by the necessary information to evaluate and execute it, including relevant strategic, financial, and operational analyses. It is important that any recovery option should be underpinned by assumptions that are realistic in stressed conditions, particularly in relation to pricing and valuation. Insurers should document and explain the assumptions used.

  64. The quantitative analysis should demonstrate that insurers have taken into account and identified the expected impact of each option on the insurer’s capital, liquidity and profitability, as well as operations. This can allow the insurer’s board and senior management to promptly understand and assess recovery options for use in effectively responding to any severe stress situations, in line with the intended purpose of a Recovery Plan. When analysing the capital impact of each option, it will be easier to assess the effectiveness of the options where the impact has been expressed in percentages or basis points rather than absolute values.

  65. The decision-making mechanism for determining the appropriate course of action should be clearly and comprehensively documented in the plan, including the identity of the individuals who will be involved in the process, the level of authority for deciding upon and initiating recovery actions, and any guiding principles or strategies for driving decision-making in a crisis.

  66. The selected options should be suitable for the insurer’s business model and sufficiently diverse to address a full range of potential crisis situations.

  67. Insurers should select options that can be effectively implemented during periods of severe stress and that will restore the capital and/or liquidity positions. However, insurers should also consider options which are less easy to implement, as these may be considered in extreme stress situations. Such options might include structural changes, for example.

  68. Insurers should consider providing details of any recovery options that were considered but were subsequently excluded, including the reasons for dismissing them.

  69. The recovery options proposed should be credible and feasible. Options are credible and feasible if they are reasonably likely to be implemented within the required timeframes and effectively in situations of stress, taking into account the preparatory measures that the insurer has taken or has planned to take. The key factors that may influence an Option’s credibility and feasibility are:

e. Past experience in implementing similar measures. Experience and expertise in activating proposed Options may serve as a useful indicator for the insurer of the credibility and viability of those Options during future stress events. Insurers should consider any relevant ‘lessons learned’ that have resulted from implementing recovery options in the past to improve the credibility of their options;

f. Estimated timeframes for executing recovery options; and

g. Potential risks and impediments to timely and effective implementation of recovery measures, as well as possible mitigating actions and concrete preparatory measures that can be undertaken to eliminate identified risks and impediments.

70. Insurers should include information on the operational impact of recovery options. For example, insurers should consider whether implementing selected options could negatively impact the company’s normal functioning, particularly with regard to the continuity of its operations, including IT systems and services. Each option in the Recovery Plan should include an assessment of how it would help ensure continuity of operations when implementing that option.

71. Insurers should develop a plan that considers any implementation constraints associated with each option and how to address them. For example, it is possible to distinguish between the time needed to execute an option and the time needed to realise its benefits (if there is a difference). Other impediments may include those related to the following:

• Legal proceedings

• Operations

• Finance

• Reputation

  72. It is important for insurers to take specific actions in a business-as-usual environment to remove any impediments to the effective implementation of recovery options when they are required.

  73. Where an insurer is part of a wider group and the recovery option relies on financial assistance from the parent company, the insurer should also contemplate alternative measures that could be applied should the anticipated support not materialise. Similarly, the plausibility of recovery options should be assessed, taking into account the coordination of recovery options within the group.

  74. The selection of the most appropriate option will vary depending on the type and severity of the stress being experienced. Nonetheless, consideration should also be given to the compatibility of the options by taking a holistic view of all the recovery options available, including which options will be prioritised for each scenario, the order in which the recovery actions will be taken, which options can be combined, and the potential impact on other options once implemented. Recovery Plans should take into account the potential conflicts that may arise when they are implemented simultaneously.

  75. The Recovery Options should be developed independently of any particular stress scenario. Scenario analysis should then be employed to help assess whether the Recovery Options provide sufficient capacity for recovery across a range of potential stresses and whether they can be implemented in a timely manner.

f) Scenario Analysis and Testing

76. Scenario analysis involves applying the Recovery Plan to severe but plausible scenarios that would cause the insurer to invoke the plan in order to demonstrate its credibility and effectiveness, including the trigger framework and the recovery options. It also gives insurers insights into major risk factors and potential impediments to recovery, given that the primary purpose of the scenario analysis is to validate the viability of, and test the impact of recovery options available to the insurer under severe stress.

77. As a Recovery Plan considers scenarios which are threats to the insurer’s viability, analysis should consider potential stress events beyond those considered in most existing parts of the Enterprise Risk Management (ERM) framework (except for reverse stress testing). Scenarios considered are therefore likely to have both a higher impact and a lower probability than scenarios which are already considered. This includes scenarios captured by regulatory capital requirements, and stress testing undertaken for the purposes of the CISSA process, as detailed within CISSA Reports. The analysis undertaken within scenario analysis in the Recovery Plan also differs from that in other areas of the ERM framework, given that the intention is to validate the viability and test the impact of the recovery options available to an insurer.

78. The scenarios should encompass events that are most relevant to the insurer, considering the insurer’s risk profile, business model, group structure (if appropriate), and other relevant risk factors while also reflecting the unique characteristics of the Bermuda insurance market. Insurers should demonstrate in their Recovery Plans that they have considered a range of severe but plausible scenarios and carried out an initial assessment of which scenarios could trigger the Recovery Plan. Such scenarios should then be assessed in more detail. The range of scenarios to consider would include, but not be limited to:

• Idiosyncratic and systemic – scenarios that are specific to the insurer and those that affect the wider industry or economy. Insurers should consider whether the combination of a market-wide and an idiosyncratic stress event could trigger recovery • Fast and slow – scenarios that evolve quickly (e.g., a sudden reduction in the market value of investments) and those that evolve over a longer period of time (e.g., ongoing trading losses), as each of these is likely to require a different recovery response

  79. The insurer should consider both financial and operational scenarios (e.g., scenarios that impact capital, liquidity, profitability, risk profile and operations).

  80. It is expected that, as part of preparatory engagement regarding the creation of a Recovery Plans, boards and management teams explicitly consider whether there are any operational scenarios which would threaten the viability of the insurer, in order to identify appropriate scenarios tailored to the insurer for consideration in the Recovery Plan. These scenarios could arise, for example, from issues such as fraud, significant regulatory fines, major operational incidents, simultaneous absence of multiple key employees, the failure of material counterparties, or severe cyberattacks.

  81. It is useful to include a timeline of how a scenario evolves. The timeline should provide information on the occurrence of the stress event, from the breach of specific recovery trigger(s) and up to the point where the insurer recovers, with the deployment of a relevant recovery measure or combination of measures. Inclusion of a timeline of this nature helps stakeholders understand how different frameworks interact, and where responsibilities shift during stress events – for example, when some contingency plans may become impractical as the situation escalates in severity.

  82. The analysis of each scenario should set out which recovery indicators would be triggered and at what point. Insurers should also establish which recovery options will be implemented in each scenario, as well as the expected impact, feasibility and timeframe for implementation. This is important since the same recovery options can have different impacts, both financial and operational, depending on the recovery scenario in which they are deployed.

  83. An appropriate assessment of the recovery options in different recovery scenarios can also provide a practical measure of the insurer's recovery strategies' efficiency and effectiveness. It is also recommended to assess the cross-effects of executing different options in the same stress scenario, as this will help to understand the real effectiveness of a given set of options. Insurers should evaluate the impact of each scenario, among other things, on liquidity, capital, profitability, risk profile and operations while considering the impact of recovery options activated in response.

  84. In cases where a group Recovery Plan is relied upon, if the group recovery stress scenarios are not appropriate for the individual entity or are not sufficiently severe to support effective recovery planning, additional stress scenarios that address individual entity specificities must be developed and tested for recovery planning at the individual entity level.

  85. Scenario analysis should be supplemented by operational testing or simulation exercises, which serve as ‘dry runs’ for the Recovery Plan. These exercises are essential for assessing the practical effectiveness of the plan and providing assurance that it can function as intended during any future potential management crisis or stress scenario. Plans of this nature and their scheduled timing should be detailed in the Recovery Plan.

  86. The operational testing of the Recovery Plan process is important to build confidence that the governance and escalation procedures in the plan are well understood, including by the board and senior management. This provides assurance that the Recovery Plan can be implemented in a timely manner during a crisis. Therefore, insurers should consider conducting regular simulations/dry runs focusing on the internal escalation processes, the formation and functioning of crisis management teams and the determination of their communication strategies. Proactively testing the recovery options and assumptions detailed in the plan helps to ensure management that the plan can be effectively executed in a crisis.

  87. The Authority notes that the nature and outcomes of operational testing undertaken can be summarised within the Recovery Plan. Insurers may also refer to and signpost relevant sections of other supporting documents within the Recovery Plan (having regard to paragraph 18 above), for example, by explaining how testing exercises documented elsewhere are relevant to the Recovery Plan. This approach can assist the board and senior management in promptly understanding and assessing triggers, recovery options and communications strategies to respond to severe stress scenarios.

g) Communication Plan

88. The insurer should have in place a communication strategy that will enable the insurer to communicate with all relevant stakeholders before, during and after the implementation of the Recovery Plan. This involves anticipating potential communication needs during a crisis and developing a plan to address these. This should be based on the communication plan in any existing contingency planning framework.

89. The Recovery Plan may contain customised communication plans that recognise the varying communication requirements based on the specific stress scenario and the recovery measures being implemented. The depth of such considerations within a Recovery Plan should reflect an insurer’s nature, scale and complexity, but an effective communication plan will consider:

• The timing of the communications;

• The roles and responsibilities of individuals involved in communications;

• Details of the communications; and

  90. The communication channels insurers should consider both internal and external communications, including:

• The BMA

• Other regulators of relevance to the insurer

• Management

• Staff

• Key counterparties

• Policyholders

• Investors

• Analysts

• Rating agencies

• Media

  91. The Communications Plan should explicitly indicate when the Authority will be notified about the activation of the Recovery Plan. It is expected that insurers will inform the Authority under the following instances:

a. In anticipation of a likely breach of a trigger point, describing the situations that could lead to the activation of the Recovery Plan;

b. Immediately in the event of a breach of one or more recovery trigger points, including a description of the causes and consequences of such breach;

c. When the Recovery Plan is activated;

d. Periodically following the activation of the Recovery Plan, detailing the progress and implementation status of the chosen recovery options and their impact on the cause(s) of the stress scenario, such as the insurer’s solvency and liquidity positions; and

e. Upon successful recovery and exiting the recovery zone, the insurer should promptly notify the relevant supervisors.

Conclusion

92. Adequate preparation, in the form of recovery planning, not only reduces the probability of insurers failing but also mitigates the impact of potential failures by increasing preparedness within insurers. An effective recovery planning framework contributes to achieving policyholder protection while maintaining financial stability.

93. If you have any questions or require further clarification, please do not hesitate to contact your supervisory team. The Authority would like to thank its stakeholders for their continued engagement in relation to recovery planning.