Notes to the application form for authorisation to pursue the business of an insurer

Notes to the application form for authorisation to pursue the business of an insurer

These notes describe what DNB wants to see when considering your application for authorisation. In addition to providing you with these notes, we have listed the most relevant sections of the law for your convenience. We refer to the ‘Legislation and regulations relevant to the application for Basic authorisation’ and ‘Legislation and regulations relevant to the application for Solvency II authorisation’ (both in PDF format) on the ‘Applying for authorisation’ page on Open Book on Supervision. Please also keep these at hand when filling in the form and verify carefully whether you comply with all the requirements. By submitting a high-quality and fully completed application form, you can help us reduce our processing time. Insurers Notes to the application form for authorisation to pursue the business of an insurer

Notes to the application form for authorisation to pursue the business of an insurer 1 General information 4 2 What authorisation do I need? 5 3 Business case 6 3.1 Business plan 6 3.2 Recovery plan 9 3.3 Resolution plan 10 4 Controlled business operations 13 5 Ethical business operations 26 6 Integrity and suitability of policymakers and co-policymakers 33 7 Two day-to-day policymakers working from the Netherlands and internal supervisory body 35 8 Transparent governance structure 37 9 Minimum own funds 38 10 Solvency 40 11 Financial projections 42 12 Reinsurance policy 43 13 Financial year 44 Contents

4 1 General information Company data Please provide the requested general particulars about your company. Submit all the required annexes, including a certified copy of the notarial deed containing the company’s articles of association. Ensure that the objects clause in the articles of association reflects the actual activities to be performed by your company and does not breach the ban on secondary business activities applicable to insurers under Section 3:36 of the Financial Supervision Act (Wet op het financieel toezicht – Wft). If you do not yet have a copy of the notarial deed containing the company’s articles of association, a final draft version suffices for the purpose of our processing your application. We will not decide on your application until we have received a certified copy of your company’s articles of association. Details of the contact person for the company In addition to information about the company itself, please also include the details of the person we can contact about the application for authorisation. We will contact this person if we have any questions concerning the application. Ensure you provide us with a business email address. You must not use email addresses from Hotmail, Gmail, Yahoo, etc. We are unable to send emails to these addresses for security reasons, and we want to ensure confidential information is at all times well protected. Society at large must be able to rely on DNB handling information carefully. Consultant We recommend that you engage the services of a consultant to assist you in the application process. Practice has shown that it is more likely for an application to be complete and of a substantially higher quality if the applicant has sought advice, for example from a (legal) expert who specialises in the Wft. We can assess a complete and well-substantiated application more quickly and more thoroughly. If you decide to use the services of a consultant please also provide us with this consultant’s particulars. Proportionality When considering your application for authorisation, we take the insurance company’s nature, size, complexity and risks into account. The regulatory framework for insurers is risk-based, meaning that your company must implement all measures that the law requires. The intensity with which you do this, however, depends on the risks that your company is exposed to.

Notes to the application form for authorisation to pursue the business of an insurer Consult the flow chart below to quickly determine what authorisation you need for the 5 proposed activities. Bear in mind the following: ▪ holders of Solvency II Basic authorisation are not permitted to pursue activities abroad (no single licence); ▪ Solvency II opt-in: life insurers and non-life insurers not governed by the Solvency II Directive may apply for Solvency II authorisation on their own initiative; ▪ large prepaid funeral services insurers may opt to apply for Solvency II (life insurer) authorisation; and ▪ non-life insurers and funeral expenses and benefits in kind insurer with limited risk may be exempted from prudential supervision under certain conditions. The conditions of the Exemption Regulation are set out on our website (http://www.toezicht.dnb.nl/en/2/51- 234334.jsp). 2 What authorisation do I need? Funeral expenses and benefits in kind insurer Life insurance Non-life insurance Reinsurance Solvency II authorisation Basic authorisation 10A. Motor Vehicle Liability 10B. Road Transport Liability 11. Aircraft liability 12. Liability for ships 13. General liability 14. Credit 15. Suretyship

1. Accident
2. Health
3. Land vehicles
4. Railway rolling stock
5. Aircraft
6. Ships
7. Goods in transit
8. Fire and natural forces
9. Other damage to property
10. Various Monetary Losses
11. Legal Assistance
12. Assistance ▪ Gross premium income: < EUR 5 million a year and ▪ Company’s aggregate technical provisions: < EUR 25 million and ▪ If company is part of a group: group’s aggregate technical provisions: < EUR 25 million and ▪ Reinsurance activities, if any: < EUR 0.5 million of premium income earned or < EUR 2.5 million of technical provisions NO YES What class?

6 To properly assess the various aspects of your application for authorisation, we must have a clear and complete picture of what your company intends to do exactly. In this section we therefore ask you to submit a business plan, a recovery plan and a resolution plan. Note: for several classes a business plan does not suffice and you must furnish additional information. Below we have listed for each category/class the documents you must submit in addition to the business plan. 3.1 Business plan Your company’s business plan must include a number of specific elements: Life, non-life and prepaid funeral services insurers ▪ a schematic overview of the company’s proposed activities broken down by class, specifying the nature of the risks to be covered; ▪ a description of the reinsurance policy; ▪ the company’s strategy, including at any rate: – the targeted market share; – growth ambitions; – a SWOT analysis; – process outsourcing; – sales/distribution channels; – collaboration with intermediaries/brokers; – the targeted market segment (consumer, business, or both); – any plans to insure risks outside the Netherlands (branch office/freedom of services); ▪ based on the company’s strategy, a three-year projection of your company’s financial position and estimated results, including a full profit and loss account and a balance sheet, detailing the following points: – the company’s expected own funds; – the assumptions and calculations underlying your financial projections, such as investment costs, outsourcing costs, management costs, contributions and envisaged market share; – the company’s policy to ensure business continuity under normal, moderately adverse and highly adverse circumstances (in this context, you must include an own risk and solvency assessment (ORSA) supervisory report with elaborated scenarios and the capital policy in place; Basic insurers need not submit an ORSA supervisory report); ▪ the capital policy must at any rate include a description and substantiation of the internal capital requirement, including how additional capital is raised and risks can be mitigated; ▪ an estimate of the company’s liquidity position; 3 Business case

Notes to the application form for authorisation to pursue the business of an insurer ▪ an estimate of the company’s solvency position, including at any rate: 7 – detailed calculations of the solvency capital requirement (SCR) and the minimum capital requirement (MCR), specifying the component items and risk classification; and – a detailed itemisation of the company’s eligible own funds, including documentary evidence of their existence. Health insurers ▪ If you intend to provide or administer health insurance within the meaning of the Health Insurance Act (Zorgverzekeringswet – Zvw), your business plan must contain the elements listed above in this section. ▪ With a view to the next health insurance campaign, you must also recruit the minimum number of policyholders essential for the spreading of risks as soon as feasible. The business plan must outline how your company will recruit this minimum number of policyholders. ▪ In addition, the business plan must describe how the company intends to stand out from its competitors on the health care insurance market. Class 10A (Motor vehicle liability) (To be permitted to operate in this class, insurers must be Solvency II authorised.) If you intend to provide Class 10A (Motor vehicle liability) insurance, you must submit the following in addition to the business plan: ▪ documentary evidence that you are registered with the Dutch Motor Insurers’ Bureau (Nederlands Bureau Motorrijtuigverzekeraars – headquartered in Rijswijk); ▪ documentary evidence that you are registered with the Motor Traffic Guarantee Fund (Waarborgfonds Motorverkeer) to meet your obligations with respect to this fund under Sections 24(1) and 24a(1) of the Motor Vehicle Liability Insurance Act (Wet aansprakelijkheidsverzekering motorrijtuigen – WAM); ▪ documentary evidence that you are registered with the National Motor Vehicle and Driving Licence Registration Authority (Rijksdienst voor het wegverkeer – RDW), headquartered in Zoetermeer; and ▪ a statement of the name and contact details of the claims representatives as meant in Section 4:70(2) of the Wft. Class 17 (Legal Assistance) If you intend to exclusively provide Class 17 (Legal assistance) insurance, you must submit the following in addition to the business plan: ▪ a description of the operational management structure showing that the staff involved in legal expenses legal assistance claims representation or giving legal advice with respect to such claims do not at the same time perform these or similar activities on behalf of another

8 insurer with which they have a financial, commercial or administrative connection and that is operating in another insurance class;¹ ▪ a statement of the legally independent claims representation office to which the activities related to legal assistance claims representation have been outsourced and that is referred to in the legal assistance cover agreement; or, depending on your situation; ▪ documentary evidence that the legal assistance cover agreement includes a clause stipulating that the insured party, as soon as it is entitled to legal assistance, may engage the services of a lawyer or other expert authorised by law of its own choice to represent its interests. If you intend to provide other insurance in addition to Class 17 (Legal assistance) insurance, you must submit the following in addition to the business plan: ▪ a statement of the legally independent claims representation office to which the activities related to legal assistance claims representation have been outsourced and that is referred to in the legal assistance cover agreement;² or, depending on your situation: ▪ documentary evidence that the legal assistance cover agreement includes a clause stipulating that the insured party, as soon as it is entitled to legal assistance, may engage the services of a lawyer or other expert authorised by law of its own choice to represent its interests. Reinsurers If you apply for authorisation as a reinsurer, you must submit the following in addition to the business plan: ▪ a schematic overview of the company’s proposed activities, specifying the nature of the risks to be covered; ▪ a description of the company’s reinsurance policy, more specifically with respect to retrocession, i.e. a reinsurer transferring part of the risks it has insured to another reinsurer on payment of a premium; ▪ the company’s strategy, including at any rate: – the targeted market share; – growth ambitions; – a SWOT analysis; – process outsourcing; 1 This description may be part of the description you submit in the context of question 4 of this form. 2 You must also submit a description of the operational management structure of the claims representation office showing that the staff and members of the management body involved in legal expenses claims representation or giving legal advice with respect to such claims do not at the same time perform these or similar activities on behalf of another insurer with which the claims representation office has a financial, commercial or administrative connection.

Notes to the application form for authorisation to pursue the business of an insurer ▪ based on the company’s strategy, a three-year projection of your company’s financial 9 position and estimated results, including a full profit and loss account and a balance sheet, detailing the following points: – the company’s expected own funds; – the assumptions and calculations underlying your financial projections, such as investment costs, outsourcing costs, management costs, contributions and envisaged market share; – the company’s policy to ensure business continuity under normal, moderately adverse and highly adverse circumstances (in this context, you must include an own risk and solvency assessment (ORSA) supervisory report with elaborated scenarios and the capital policy in place; ▪ the capital policy must at any rate include a description and substantiation of the internal capital requirement, including how additional capital is raised and risks can be mitigated; ▪ an estimate of the company’s liquidity position; ▪ an estimate of the company’s solvency position, ▪ including at any rate: – detailed calculations of the solvency capital requirement (SCR) and the minimum capital requirement (MCR), specifying the component items and risk classification; and – a detailed itemisation of the company’s eligible own funds, including documentary evidence of their existence. 3.2 Recovery plan The purpose of the recovery plan is to identify solutions to potential crisis situations that your company may be faced with, including its actual or imminent non-compliance with the applicable solvency capital requirements (SCR) or minimum capital requirements (MCR). Before we can issue the requested authorisation, we must be able to assess the extent of your company’s recovery options. This is why we need you to elaborate on the financial, operational and legal feasibility of the identified solutions. Your company’s recovery plan must address the following elements: ▪ crisis scenarios; ▪ triggers for activating the recovery plan; ▪ a description of the recovery measures identified; and ▪ the usability of the measures and an indication of their respective financial and operational effects.

10 3.3 Resolution plan You must compile a resolution plan in timely preparation for the potential termination or transfer of the company’s business activities. The purpose of having such a plan in place is that if the company actually needs to be resolved, the resolution process can be executed in an orderly fashion with the fewest adverse effects possible for the policyholders and other rightful claimants. The resolution plan must encompass all the company’s business activities, products and processes. The resolution plan must have a clear responsible owner within the company, requires the prior approval of the management board and – if applicable – the supervisory board, and must be reviewed at least once a year. This must be stated in the plan. Figure 1 below shows some building blocks that you can use when compiling an adequate resolution plan. The plan is based on proportionality, and you may determine the level of detail of your resolution plan yourself. Below we will briefly discuss the separate building blocks. Figure 1 Building blocks for an adequate resolution plan Resolution plan Policy and decision-making Risk analysis Communications Governance aspects of resolution Operational aspects of resolution Legal aspects of resolution Financial aspects of resolution

Notes to the application form for authorisation to pursue the business of an insurer Policy and decision-making 11 Your resolution plan must at any rate include a description of the following four elements: ▪ the pursued objective of resolution; ▪ a description of possible resolution scenarios, e.g. merger or winding up; ▪ the bodies, functions and individuals authorised to take the decision to resolve the company, the decision-making process, and the stakeholders involved; and ▪ the manner in which decisions are recorded and documented, to enable rightful claimaints to verify afterwards whether the resolution process was executed in a sound and ethical fashion. For each scenario, please state verifiable triggers that may prompt the management board to consider resolution. The relationship between the trigger and the ultimate decision to resolve the company makes for transparent decision-making that rightful claimants can verify. Risk analysis As part of compiling a resolution plan, you must perform a risk analysis of the resolution process. The resolution plan must include a list of the main risks that may occur during the resolution process and that may jeopardise the objective of the plan (orderly resolution in the interest of the policyholders and other rightful claimants). You must translate the outcome of your risk analysis into procedures and measures to manage the identified risks. Your resolution plan must also include a procedure for monitoring the development of risks and mitigating measures, e.g. as part of the periodic review of the resolution plan. Governance The continuity of management must be guaranteed during the entire resolution process. In order to achieve this, the management board must put guarantees in place that there will be sufficient people and resources to continue services and at the same time execute the resolution process in an orderly fashion. Your resolution plan must contain the company’s governance structure during resolution, including an outline of the roles and responsibilities of the project organisation. Your resolution plan must describe the professionalism and expertise necessary for orderly resolution. Operational aspects Your resolution plan must include a realistic project plan describing the operational steps that are necessary to resolve the company promptly, properly and fully, distinguishing between: ▪ the processes and tasks that must be performed to guarantee orderly resolution, and the individuals responsible for those tasks, and ▪ (realistic) time lines, milestones and dependencies.

12 Financial aspects Your resolution plan also serves to help us gain an understanding of the financial aspects of your company’s resolution. First of all, your resolution plan must include a description of how the financial resolution of liabilities has been arranged for all rightful claimants, ensuring that all claims are transferred orderly (fully and well-balanced) and that any amounts charged are reasonable and fair. Secondly, you must provide a rough estimate of the financial resources necessary for each scenario, specifying for each scenario how these are to be financed. And thirdly, your plan must include a description of how financial risks and costs will be approached. Communications Your resolution plan must include a communication plan that has a clear overview of which stakeholders will be informed when and with what message.

Notes to the application form for authorisation to pursue the business of an insurer To qualify for authorisation, you must set up your company’s operating procedures in such a 13 way that they guarantee controlled and ethical business operations. This means that you must analyse the operational risks your company is exposed to and take measures to mitigate these risks. As part of our assessment of controlled business operations, we look at: ▪ general principles of operational management ▪ a clear, balanced and adequate organisational structure ▪ a clear description of the duties, powers and responsibilities of all relevant functions within your company’s organisation ▪ an adequate, transparent and balanced segregation of duties ▪ an adequate system for the transfer of management information ▪ prompt and complete records and administration ▪ information systems (ICT) and security ▪ documented policy outlines ▪ measures ensuring continuity and regularity in the performance of insurance or reinsurance activities ▪ risk management ▪ internal control ▪ internal audit function ▪ actuarial function ▪ compliance function ▪ external audit ▪ outsourcing ▪ remuneration policy ▪ oath or affirmation ▪ training We expect you to include the above elements in the description of your operating procedures. We therefore address these points in the application form. Below is a more detailed explanation of these elements. General principles of operational management As a minimum, your company must base its operating procedures on the following six principles: ▪ a clear, balanced and adequate organisational structure; ▪ a clear, balanced and adequate distribution of duties, authorities and responsibilities (governance); ▪ adequate recording of rights and obligations; ▪ unambiguous reporting lines; ▪ an adequate information supply and communication system; ▪ a transparent definition of the company’s operational management, which is submitted to regular reviews. 4 Controlled business operations

14 Please provide a description of your company’s general principles and evidence that your company has organised its operational management to the effect that it guarantees sound business operations on these points. A clear, balanced and adequate organisational structure Your company must have a clear, balanced, and adequate distribution of duties and authorities in place at all levels and for all units of the company. The reporting lines must be in tune with the organisational structure. The division of tasks and the reporting lines must be documented and communicated throughout the company to ensure that all levels of the company have full knowledge of their duties, authorities and responsibilities, their role in the organisation and the control process, and how they are held accountable. If we find any shortcomings or deficiencies, you must ensure that the organisational structure and the procedures and measures are adjusted to ensure that these are remedied. More specifically, the description of your company’s clear, balanced and adequate organisational structure must at least cover the following elements: ▪ governance, including management model, decision-making processes and, if applicable, the composition of the supervisory board; ▪ the distribution of duties, responsibilities and powers of the day-to-day policymakers, the supervisory board and the co-policymakers: – a description of the organisation of key functions http://www.toezicht.dnb.nl/en/4/2/16/51-232842.jsp; – the policy with respect to second-tier management assessments http://www.toezicht.dnb.nl/en/4/2/16/51-232842.jsp; ▪ the frequency of meetings of the company’s decision-making bodies; ▪ the shareholder structure; ▪ as far as relevant, a description of the envisaged deployment of intermediaries, agents and branch offices, and procedures for outsourcing of activities, including which external parties or other parties are involved in performing these activities and services, and what their exact roles are; and ▪ the procedure for regular internal reviews of the company’s organisational structure.

Notes to the application form for authorisation to pursue the business of an insurer The description can be part of the company’s procedures manual or be included in a separate 15 document. Please state in the application form where we can find the relevant information. If your company has one or more director-major shareholders (DMSs) Please indicate in the application form whether your company has one or more director-major shareholders (DMSs), or a comparable control structure. A structure of this kind warrants special attention to balanced corporate governance. In your application, we expect you to provide insight into the division of duties, responsibilities and powers aimed at balancing the influence of those directly involved in the company and its business, particularly its managing and supervisory directors and its capital providers. We must be able to establish that the company at all times has expert and balanced operational management with adequate checks and balances and appropriate incentives. In our interpretation of a control structure involving one or more DMSs, a DMS is a natural person who is both a major shareholder (even if indirectly) and a managing director. In the absence of adequate countervailing power (checks and balances), a DMS may exercise an unduly heavy influence on the company’s day-to-day management. DMSs may find themselves in a situation where they let their own interests as a shareholder prevail over the long-term interests of the company or its stakeholders. Apart from potential conflicts of interest, there is also a risk that a DMS identifies with the company to such an extent that he or she is unable to demonstrate and safeguard the objectivity and independence required in that capacity, for example in the event that the company faces critical problems. We judge the admissibility of a control structure involving one or more DMSs on a case￾by-case basis. If your company has one or more DMSs, you must provide evidence in your application for authorisation that you have sufficiently mitigated the vulnerabilities attached to a control structure of this kind. This may include establishing a supervisory board or putting adequate arrangements in place to ensure that carefully considered decisions are taken in case of conflicting interests between the company and a DMS. An adequate, transparent and balanced segregation of duties The duties, powers and responsibilities of both individual staff and departments in your company must be distributed to contain the risk of errors and inappropriate use of assets or data. For instance, job descriptions must not include powers enabling one single person to enter into transactions or liabilities uncontrolled, to authorise, process and settle transactions, to have free access to assets, or to manipulate financial or other data. If adequate segregation of duties is difficult to achieve because you have a small number of staff, you must take alternative measures. One option is to outsource activities to third parties to compensate for the lack of internal segregation of duties. You must clearly state that this is the case, however.

16 In the case of concurrent board membership, you must pay extra attention to the independent functioning of the supervisory board or body having a comparable mandate. Conflicts of interest must be avoided, as they may prevent your company’s interests from being adequately safeguarded. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. An adequate system for the transfer of information To ensure an adequate communication system, the company must have well-operating internal communication channels, designed to ensure that all relevant information reaches the right staff members and functions at the right time. It is also important that the internal supervisory body, the management board and line management are informed promptly and receive reliable information on the company objectives and the relevant operational processes. Please indicate how this is ensured within your company. Prompt and complete records and administration You must record your company’s rights and obligations in a dedicated administrative system. Your company is responsible for ensuring that the turnover and the financial rights and obligations to be recorded in the accounts are accurate and complete. Your description must at any rate specify how your company intends to comply with the requirements in the following respects: ▪ your company must have information systems in place that provide comprehensive, reliable, clear, consistent, prompt and useful information about the company’s business activities, the obligations it has taken on and the risks it is exposed to; ▪ your company must keep adequate and well-organised records about its business and its internal organisation in terms of safeguarding the security, integrity and confidentiality of information, taking account of the nature of the information in question. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information.

Notes to the application form for authorisation to pursue the business of an insurer Information systems (ICT) and security 17 Your company must have an information system in place that enables effective management of operational processes and risks, and that meets the company’s internal and external information requirements. Please provide a description of how this is ensured. The information system must be set up to ensure that transactions and entries in data files can always be retraced to authorised source files or data processing by authorised staff. Electronic data processing must be an integrated part of the company and electronic data must be available at all times. Consequently, companies using electronic data processing must take measures and implement procedures, including back-up copies and recovery measures, and a calamity plan that must be updated at regular intervals and tested for proper functioning. Please also provide a description of this. Your company must also have procedures and measures in place that safeguard the integrity of electronic data processing. And finally, segregation of duties in electronic data processing must be aligned with the organisational structure. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Documented policy outlines Your company must have documented policy outlines with respect to risk management, internal control, internal audit, compliance, the actuarial function and, if applicable, outsourcing. These policy outlines must be reviewed at least once every year, they must be approved in advance by the management, policymaking or supervisory body, and they must be adjusted in the event of a significant change of the system or area involved. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Measures ensuring continuity and regularity in the performance of insurance or reinsurance activities Please provide a short description of the measures you have taken to ensure continuity and regularity in the performance of your activities, including the development of emergency plans. You must demonstrate the use of appropriate and proportionate systems, resources and procedures.

18 Your company must formulate, implement and enforce a business continuity policy to ensure that, in the event that its systems and procedures are interrupted, critical data and business functions are protected and the insurance or reinsurance activities are continued, or – if this is impossible – that the affected data and business functions are promptly recovered and the insurance or reinsurance activities are resumed as soon as feasible. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Risk management Your company must describe its risk management and risk control, taking account of credit risk, market risk, interest rate risk, concentration risk, liquidity risk, operational risk, insurance risk, and the risks associated with the macroeconomic environment in which the company operates and with the phase of the economic cycle. In addition, you must have a clear perspective of the risks that your company is exposed to. The policy principles following from your risk perception must state how your company intends to manage its risk exposure. Your risk management policy must be recorded in the form of procedures and measures, which must be tuned to the nature, size, risk profile, and the complexity of the company’s activities, and include ▪ authorisation procedures ▪ limit allocation ▪ limit monitoring ▪ emergency procedures and measures The liquidity risk management procedures and measures must focus on management of the company’s current and future net financial position and requirements. They must be clearly defined and recorded, e.g. in a policy plan, and must be consistently communicated, preferably in writing, to all business units of the insurance company exposed to these risks. Your company must have an independent risk management function in place that ensures systematic, independent risk management, focussing on identifying, measuring and evaluating risks that the company is or may be exposed to. Risk management covers the company’s operations as a whole as well as those of its individual business units. The risk management function must be given the required authority and access to all information necessary for the performance of its tasks.

Notes to the application form for authorisation to pursue the business of an insurer The risk management function’s duties, responsibilities and powers must be laid down in a 19 charter. Please submit a copy of this charter with your application. The description of your company’s first-line and second-line risk management and of the risk management key function must demonstrate that the company has organised its operational management to the effect that it guarantees sound business operations on this point and that, if applicable, it meets the Solvency II requirements in respect of its risk management function set-up. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Climate change risks Insurers may be vulnerable to the physical consequences of climate change (physical risks) as well as the transition to a climate-neutral economy (transition risks). Given the potential impact of climate-related risks on the balance sheet of insurers, DNB expects insurers to incorporate climate-related risks into their risk management, a.o. by mapping the influence of these risks on their risk profile. In the Good Practice ‘Integrating climate-related risks in the ORSA’ DNB explains how substance can be given to the integration of climate-related risks in the governance, the risk management and disclosure of insurers. In the context of a controlled and ethical business operation DNB expects insurers to consider and address climate-related risks already in the first stage of a license application. Internal control The effectiveness of the organisational structure and the procedures and measures in place must be tested independently in-house (at least once a year). By “independent” we mean independent of the line management and independent of the control measures integrated in the different operational processes. Independent internal control is an ongoing process that includes changing internal and external circumstances, new products and services, and support processes. Any shortcomings found must be adequately addressed. More specifically, in this section of the application form you must describe your company’s internal control framework, providing details of guidance, procedures and governance relating to operational management. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information.

20 Internal audit function Your company must have an effective internal audit function. This function assesses whether the internal control system and other components of the organisation’s governance system are adequate and effective. The internal audit function is objective and operates independently from other operational units of the organisation. Its duties, responsibilities and powers must be laid down in a charter. The description must demonstrate that your company has adequately set up the third line in the ‘three lines of defence’ model. If your company outsources the internal audit function’s activities, it must have a dedicated policy in place (listing, for example, the criteria that the relevant audit firm must meet). The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Actuarial function Note: this function must be put in place by all life insurers and by non-life insurers providing non-life insurance products with a term of more than four years. Your company must have an organisational unit that performs an independent and effective actuarial function. The organisational unit is responsible for coordinating and auditing the calculation of the technical provisions,and for informing the insurer’s day-to-day policymakers about the adequacy and reliability of this calculation. The actuarial function’s duties, responsibilities and powers must be laid down in a charter. If your company outsources the actuarial function’s activities, it must have a dedicated policy in place. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Compliance function Your company must have an organisational unit that performs an independent and effective compliance function. It is important to have an independent compliance function in place in order to supervise compliance with legislation and regulations and internal rules, requirements and procedures. Supervision of compliance with rules, requirements and procedures for instance includes assessing new legislation and verifying whether new products and procedures comply with rules and regulations. The actual shape of the compliance function depends on the nature and size of the insurance company. ‘Independent’ at least means that the compliance function is not influenced by commercial or other interests.

Notes to the application form for authorisation to pursue the business of an insurer Compliance duties must be recorded in a compliance charter, and the necessary activities must 21 be further detailed in an annual compliance plan. The compliance charter must at any rate include the following elements: ▪ definition and scope ▪ compliance mission ▪ the compliance officers’ job profile, including key tasks, powers and responsibilities ▪ the compliance function’s special status in your company ▪ safeguards for segregation of duties ▪ the names of the internal and/or external compliance officer(s)/staff member(s) ▪ annual compliance plan (whether or not in draft form) ▪ (in the case of outsourcing) outsourcing policy The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. External audit Insurers must commission a qualified auditor to audit their financial statements and the supervisory reports for submission to DNB. The obligation to commission an auditor qualified to perform audits at public interest entities does not apply to insurers with limited risk (i.e. insurers holding Solvency II Basic authorisation). The instruction to the external auditor auditing the company’s financial statements must include a review and at least a general assessment of the adequacy of the organisational structure and risk control. The external audit must also focus on the management of risks that may be of material influence on the company’s financial performance, position and ability to continue as a going concern, including IT risks. The external audit must be integrated in the year-end audit of the financial statements as much as possible. The auditor’s report must include an opinion of the company’s operational management. Outsourcing As we are responsible for the prudential supervision of all activities and business processes of your company (also if these have been outsourced), it is important that you provide us with all information based on which we can assess whether all activities (also those outsourced) are performed in conformity with Part 3 of the Wft on the prudential supervision of financial enterprises. Please provide us with an overview of the activities to be outsourced.

22 The description of the underlying policy, measures and procedures can be part of your company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Your company is permitted to outsource activities unless doing so hampers adequate compliance with the rules and regulations to which it is bound. This limitation applies only to outsourcing of important activities, i.e. activities that may seriously harm the company’s compliance with the requirements of its authorisation, its financial results, or the solidity or continuity of its services and activities if they are performed incompletely or inadequately. There are also activities that you are not permitted to outsource, i.e. the duties and activities of staff members determining the day-to-day policy, including policy adoption and accountability for the policies pursued. In our assessment, we are extra critical of the outsourcing of some specific activities. The internal control function must have professional expertise, detailed knowledge of the structure of the organisation and must be available at all times. Outsourcing this function to a company that has no formal or actual control structure relationship with your company will consequently harm embedding of the quality of internal control. In some cases it may also be difficult to outsource the internal audit function. If the internal audit function is outsourced, the audit must be performed by that third party under your company’s management and supervision. Your company must at all times be able to render account of the structure and effectiveness of its operational management. It is essential to explicitly consider the risk of conflicts of interest when selecting the third party to perform the audit and the staff member within your company who will be responsible for managing and supervising the audit. Your company must pursue an adequate policy and have procedures and measures in place for the processes it outsources on a permanent basis, and it must have adequate procedures and measures and sufficient expertise and information available to be able to assess the performance of outsourced activities. Your company must always enter into written agreements with the third parties to which it outsources activities on a permanent basis. An adequate outsourcing policy requires your company to take into consideration the impact of outsourcing on the soundness of its business operations. This may include implementing procedures to be followed and measures to be taken to remedy deficient services by the third party, and to avert calamities. Insurance companies that outsource activities on a permanent basis must analyse the risks associated with outsourcing. Risk analysis is an essential element for assessing whether or not activities are suitable for outsourcing.

Notes to the application form for authorisation to pursue the business of an insurer To assess outsourced activities adequately, your company must have sufficient information at 23 its disposal about the company to which it outsources these activities. Your company must also have sufficient in-house expertise to properly assess this information. Please enclose copies of the outsourcing agreements with third parties your company has entered into. The outsourcing agreement must at the very minimum provide for the following: ▪ the exchange of information between the company and the third party about unlocking information required by the supervisory authorities as part of the performance of their statutory tasks; ▪ the option for your company to make changes at any time to how the third party performs the outsourced activities; ▪ the obligation incumbent on the third party to enable your company to continuously meet the requirements ensuing from primary and secondary legislation; ▪ the possibility for supervisory authorities to perform or have performed on-site inspections at the third party; ▪ the manner in which the agreement is terminated and how after termination it is ensured that your company can again perform the activities concerned itself, or have such activities performed by another third party. To conclude, when outsourcing activities your company must prevent the outsourcing from compromising the company’s obligations to its customers and their statutory rights. Controlled remuneration policy As part of its controlled operational management, your company must pursue a controlled remuneration policy that must be recorded in writing. In short, the policy must include the requirement that remuneration does not contain incentives to take more risks than acceptable in view of the company’s solidity. The remuneration policy must in a structured and logical way describe potentially negative incentives as part of risk management, and describe how your company prevents and mitigates these incentives. Obviously, developing a sound remuneration policy requires in-depth analysis of possibly inappropriate incentives contained in remuneration structures and components. This analysis should pay explicit attention to the incentives that may arise as a result of variable remuneration components. It could also cover positive incentives arising from clawback provisions.

24 The description of your company’s remuneration policy must answer the following four questions: ▪ Is the fixed-to-variable remuneration ratio applied appropriate to your company? This includes the generally important aspects to remuneration policies, e.g. the nature of the company’s activities, the size of the company and the consequences for customer treatment. When formulating the appropriate ratio, the company must remain within the boundaries set by the bonus cap. ▪ What is the ratio between awarded remuneration and distributed variable remuneration? ▪ What is the composition of variable remuneration? ▪ What are the criteria and performance on which variable remuneration are based? You should describe not only the performance and results of the individual staff members receiving the variable remuneration, but also the performance of their business unit and that of the company as a whole. Performance assessments of individual staff members must also include non-financial criteria, e.g. to what extent objectives such as the following have been achieved: strategic goals, customer satisfaction, compliance with risk management policies, compliance with internal and external rules, leadership, management skills, cooperation with other staff and business units, creativity, motivation, sustainability, and corporate social responsibility. Negative performance on non-financial criteria, especially in case of unethical or non-compliant behaviour, must cancel out positive results on financial criteria. In such cases, variable remuneration should be reduced to zero. At least 50% of variable remuneration must be based on non-financial criteria. Moreover, variable remuneration must be capped. For more information on this point, we refer you to Sections 1:121 and following of the Wft. Please enclose your company’s remuneration policy with the application form. We also ask you to briefly state in your own words how your company’s remuneration policy does not encourage staff to take more risks than acceptable in view of the company’s solidity. Oath and affirmation Under the 2015 Regulation on the Financial Sector Oath or Affirmation (Regeling eed of belofte financiële sector 2015), your company must have rules on the oath or affirmation in place. These rules can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Training Please enclose your company’s training programme with the application form. We also ask you to describe how your company has organised its training programme to the effect that it guarantees sound business operations.

Notes to the application form for authorisation to pursue the business of an insurer Adequate implementation of processes and procedures largely depends on the level of 25 knowledge and experience of staff. This is why knowledge of and experience with risk management (including money laundering and terrorist financing) are important preconditions for developing an adequate control framework. Staff training courses are important instruments to communicate and embed knowledge of legislation including the Anti￾Money Laundering and Anti-Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme – Wwft) and the Sanctions Act 1977 (Sanctiewet 1977 – Sw), and of integrity policy principles and procedures. Your company must provide training courses to familiarise staff members with the provisions of the Wwft and the Sw, and to enable them to perform customer due diligence fully and correctly and recognise unusual transactions. These training courses must cover money laundering and terrorist financing techniques, methods and trends, the international environment and standards, and new developments in this area. To enable staff to keep abreast of new developments and to improve awareness in the long term, rather than as one-off sessions training courses must preferably be provided at regular intervals and at different levels. The compliance function is also advised to attend additional training courses to keep up to date on new developments in national and international legislation and regulations, and money laundering and terrorist financing risks. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information.

26 The integrity of your company is one of the pillars of trust and, hence, a precondition for its proper functioning. It is essential that you prevent your company from getting involved in unlawful or socially unacceptable acts. Your company must pursue an adequate policy to ensure ethical operational management. The integrity policy must be detailed and implemented in clear and readily accessible procedures and measures, contained in a procedures manual. This procedures manual must also include (a reference to) the procedures required pursuant to the Decree on Prudential Rules for Financial Undertakings (Besluit prudentiële regels – Bpr). The regulatory framework for adequate integrity policies is risk-based, meaning that your company must implement all measures that the law requires. The intensity with which you do this, however, depends on the risks that your company is exposed to. These risks may for instance be related to the nature and background of customers, the type of product or service provided, the combination of customer and product, and how customer contact takes place (delivery channels). You must assess the risks that your company is exposed to and formulate sufficient mitigating measures. The frameworks of the Wft (ethical operational management) and the Wwft assume that a company allocates its customers to risk categories, based on the nature and size of the risk exposure. The risk categories vary between high and low and allocation must be based on objective and recognisable indicators. The higher the risks, the more effort the company must make to mitigate them. Obviously, you must also define which risks are unacceptable. Your company’s integrity policy must at any rate address the following points: ▪ systematic integrity risk analysis ▪ preventing conflicts of interest ▪ dealing with and reporting of incidents ▪ reliability of staff in integrity-sensitive positions ▪ customer due diligence (applicable only to life insurers) ▪ Sw Sanctiewet (SW is Sanctions Act) ▪ transaction monitoring and reporting of unusual transactions (applicable only to life insurers) These points are discussed in detail below. 5 Ethical business operations

Notes to the application form for authorisation to pursue the business of an insurer Systematic integrity risk analysis (SIRA) 27 Your company’s integrity policy and its implementation starts with identifying your integrity risk exposure. Such a systematic integrity risk analysis (SIRA) is a precondition for ensuring ethical operational management. Please enclose the SIRA with the application form. As risks are always in a state of flux, the SIRA is bound to a sell-by date, i.e. a date by which the analysis must be updated. The SIRA to be considered together with the authorisation application must at any rate be up to date. It must include instructions stating in which situations business units must be reviewed, when an additional review is required, or when a review must be brought forward. The analysis must be verifiable, i.e. recorded in a separate document, and the integrity policy must be based on the outcome of the SIRA, and you must use a comprehensible quantification method. The SIRA is based on gross (inherent) and net (residual) risks and analyses the likelihood and impact of these risks. The size of net risks must be clear and the measures and procedures must have a plausible effect. The SIRA must at any rate include an analysis of the following risks: conflicts of interest, money laundering, terrorist financing, breach of sanctions legislation, and internet fraud and scams. Your company’s SIRA must also include an analysis of risks associated with your customers’ products and services and you must include this in the customer profiles that you intend to use. In this context, you must pay extra attention to online customer acceptance (applicable only to life insurers). You must show that this always carries high risk and your analysis must show how your company intends to offset this elevated risk. Your procedures and measures must be verifiably connected with the specific risks identified in the SIRA. The control measures set out in the SIRA must be in line with the nature, size, complexity and risk profile of your company’s operations. Please provide a description of your procedures and measures. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the  relevant information. You will find more information on the SIRA in our user manual for producing an adequate SIRA: ‘Integrity risk analysis: more where necessary, less where possible’: http://www.toezicht.dnb.nl/en/binaries/51-234068.pdf Preventing conflicts of business and private interests Conflicts of interest or the semblance thereof may negatively affect your company as well as its customers. Your company must therefore have procedures and measures in place to prevent conflicts between its own business interests and the private interests of

28 ▪ policymakers ▪ group directors ▪ supervisory directors ▪ other staff members or individuals who permanently work for the company Please provide us with your company’s policy on this point, which should make clear how you approach ▪ personal, professional, and financial interests in relation to contacts with customers and other stakeholders ▪ confidential and non-confidential information ▪ customer relationship management ▪ private financial transactions ▪ secondary activities Incidents An incident is defined as behaviour or an event that poses a serious threat to ethical pursuit of business operations. This includes both showing and refraining from specific behaviour. Because of the repercussions that incidents can have on the company, it is important that you organise your operational management so as to ensure that the risk of incidents occurring is limited to the best possible extent. The company must be prevented from being implicated in criminal offences, or committing acts that conflict with commonly accepted practices. It makes no difference who commits these acts: staff members, managing directors, members of the supervisory body, or natural persons or legal entities working for your company. This is why your company must have procedures and measures in place to deal with incidents. The incident policy must at any rate include the following elements: ▪ recording of incidents ▪ procedures for handling incidents ▪ notifying the supervisory authority of incidents and their handling The description of the incident policy can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Your incident records enable us to assess whether your company handles incidents appropriately. From your records, we should be able to distil the characteristics of the incident, the perpetrator(s) causing the incident or aggravating the situation, and the measures taken. You must notify us promptly of any incidents.

Notes to the application form for authorisation to pursue the business of an insurer Reliability of staff in integrity-sensitive positions 29 In addition to the positions of managing director or member of the supervisory body, there are other positions that may influence ethical business operations. These are known as integrity￾sensitive positions. Integrity-sensitive positions include: ▪ management directly below policymakers and co-policymakers ▪ positions with powers that pose real risks to ethical business operations You must determine which positions in your company qualify as integrity-sensitive, and thoroughly assess the staff members holding these positions. This also applies to temporary staff. Please submit a description of your company’s policy regarding integrity￾sensitive positions. The description can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. Customer due diligence This section applies exclusively to life insurers not operating as funeral expenses and benefits in kind insurer (Section 1(a)(5) of the Wwft) Wwft is Wet ter voorkoming van witwassen en terrorismefinanciering (Anti-Money Laundering and Anti-Terorist Financing Act). You are not permitted to start providing services to customers before you have identified and verified the customer and the ultimate beneficial owner (UBO), i.e. customer due diligence. Your procedures manual should explain the procedures and measures contained in the customer due diligence exercise. These procedures and measures for customer acceptance must be in line with your company’s integrity policy, the risk analysis performed, and the applicable statutory requirements, including the Wwft and the Sw. Your company’s customer due diligence policy must address the following points: ▪ The company must verify the identity of each customer based on independent and reliable documents. ▪ The company must have sufficient insight into the customer’s or legal entity’s ownership and control structure. ▪ The company must be aware of, and must adequately document, why and with what intention the customer wants to use the company’s services, and must incorporate this into the customer’s risk profile. ▪ The company must keep all such information in readily accessible form for at least five years after it has ceased providing services to or terminated its business relationship with the customer in question. ▪ All data on customers and UBOs must be kept in a central place accessible to compliance and other need-to-know staff.

30 Procedures and measures must document how and by whom customer due diligence is to be performed. The relevant staff must be made aware of the internal and statutory requirements imposed on customer due diligence. Customer acceptance must be approved by authorised staff or management based on the four-eyes principle. Business relationships with high-risk customers require the explicit approval of senior management. Your company must also record when enhanced customer due diligence is required and which measures it intends to take in such cases, and document whether customers, prospective customers or UBOs are politically exposed persons (PEPs). You must divide customers into risk categories, stating your reasons for allocating customers, products or services to specific risk categories. This classification must be adequate and in line with the SIRA mentioned above. Acceptance is subject to screening against sanctions lists, PEP lists and any other relevant lists. You must record positive matches in the relevant customer file and take action where needed. You must also document these matches in the customer’s risk profile and report them to us. And finally, an exit policy must be put in place for customers who cannot or do not want to be identified, or whose identity cannot be verified in the prescribed manner. When such cases occur, they must be verifiably followed up. The description of the customer due diligence policy can be part of the company’s procedures manual or be included in a separate document. Please state in the application form where we can find the relevant information. See our Guidance on the Wwft and the Sw for more information on this topic. Sanctions Act Your procedures manual must include your policy and procedures on sanctions legislation. These procedures must guarantee the existence of a comprehensive and up-to-date inventory of services offered, broken down by countries, natural persons, legal entities and groups governed by sanctions legislation. You must also have a separate procedure in place for the receipt and internal distribution of sanctions lists (at any rate with respect to the Dutch sanctions lists and the EU regulations). These procedures and measures must ensure that you regularly check your customer base for matches with the entities targeted by sanctions legislation. The procedures must provide for risk-based monitoring of domestic and international services. Your procedures and measures must take account of the standards and objectives of the different sanctions regulations (sanctions measures against persons or entities and against countries).

Notes to the application form for authorisation to pursue the business of an insurer The procedures and measures must be structured so as to enable your company, if a match is 31 detected, to freeze financial assets or prevent financial resources or services from being made available to sanctioned persons or entities. The company must have adequate measures in place to guarantee that potential matches are promptly reported to the responsible central person or department and that confirmed matches are reported to DNB. Note: your Sw procedures must also include relationships with other customers, e.g. sublicence holders, authorised representatives, and payments to affiliated companies. See our Guidance on the Wwft and the Sw for more information on this topic. http://www.toezicht.dnb.nl/en/binaries/51-212353.pdf. Transaction monitoring and reporting of unusual transactions This section applies exclusively to life insurers not operating as funeral expenses and benefits in kind insurer (Section 1(a)(5) of the Wwft). Your company must have procedures and processes in place to monitor customers’ accounts, activities and/or transactions so as to gain and retain insight into the nature and background of customers and their financial behaviour, and to detect non-standard transaction patterns, including unusual transactions and transactions that by their nature entail increased risk of money laundering or terrorist financing. You must have procedures and processes in place stipulating how transactions are monitored and how to act if transactions are made that may qualify as unusual, and you must make motivated and logical choices between electronic monitoring and manual monitoring. If you have large numbers of transactions, electronic monitoring will be the obvious choice, but this stops at detecting possible unusual transactions. Suspected unusual transactions are not performed before they have been manually verified and, where necessary, you have contacted the party involved. Your procedural descriptions must state which members of staff are authorised to perform manual checks, and which cases require the involvement of the compliance officer. You must have policies and procedures in place to report detected unusual transactions to FIU-Netherlands without delay. And your company must notify all relevant business units of the policies, procedures and measures relating to the subjects mentioned above. Your company is also responsible for

32 ▪ implementing the policies, the procedures and the measures ensuing from them ▪ systematically assessing the policies, procedures and measures ▪ independently monitoring the implementation of the policies, procedures and measures relating to ethical business operations And finally, your company must have ▪ procedures in place to ensure that detected deficiencies or shortcomings are reported to the officers entrusted with that duty (independent compliance function) ▪ procedures in place to ensure that the detected deficiencies or shortcomings relating to ethical business operations are appropriately remedied under the supervision of an independent compliance function See our Guidance on the Wwft and the Sw for more information on this topic. http://www.toezicht.dnb.nl/en/4/6/51-204770.jsp

Notes to the application form for authorisation to pursue the business of an insurer Suitable policymakers 33 The policymakers³ in your company must be suitable to occupy this position. You must therefore take care to nominate individuals whom you expect to pass DNB’s suitability screening. When assessing suitability, we determine whether a nominee displays relevant and appropriate knowledge, skills and professional behaviour to perform the job, and establishes this based on their education, work experience and competences. A suitability screening is linked to position, we take account of ▪ the nominee’s intended job ▪ the nature, scope, complexity and risk profile of the company, and ▪ the composition and performance of the management board as a whole DNB uses the Policy Rule on Suitability 2012, which can be consulted on www.overheid.nl (in Dutch only). For more information on the assessment process, please refer to the relevant Open Book on Supervision pages, http://www.toezicht.dnb.nl/en/4/2/16/51-229353.jsp To notify us of a nominee, you can use the Prospective Appointment Notification Form (M2015/1EN) on our Open Book on Supervision pages. We frequently see that notification forms are not filled in completely, which causes unnecessary delays. Our website provides information to help you prepare for the assessment procedure. http://www.toezicht.dnb.nl/en/4/2/16/50-229355.jsp Please note: pursuant to the Management and Supervision Act (Wet bestuur en toezicht), public and private limited companies and foundations⁴ meeting specific size criteria are subject to a maximum number of supervisory positions. The following restrictions apply: ▪ No director of a large legal entity may hold more than two supervisory board memberships or non-executive directorships or a combination of these at other large legal entities. ▪ No director may chair the supervisory board or be a member of another corporate supervisory body of another large legal entity. ▪ No supervisory director, non-executive director or member of a corporate supervisory body may hold more than five comparable supervisory positions at large legal entities. Appointments that do not comply with these restrictions are void. 6 Integrity and suitability of policymakers and co-policymakers 3 Owners of a qualifying holding are not subject to our fitness assessment, unless they co-determine the company’s day-to-day policy. The section “Propriety of policymakers and co-policymakers” below sets out which staff members are classified as co-policymakers. 4 The legal form of insurance companies must be public limited company, mutual insurance association or European company (http://www.toezicht.dnb.nl/en/4/2/16/51-229355.jsp).

34 Integrity of policymakers and co-policymakers The integrity of the policymakers and co-policymakers in your company (managing directors and supervisory directors or, where applicable, members of the supervisory body) must be beyond any doubt. This requirement also applies to the individuals that have a say in your company policies. Individuals holding direct or indirect qualifying shareholdings in the company are classified as co-policymakers. Owners of a qualifying holding are natural persons or legal entities that have a direct or indirect shareholding interest or control in the company of 10% or more. Persons who are able to exercise actual influence on the company’s day-to-day management are also designated as co-policymakers. DNB verifies whether the propriety of the nominee is beyond doubt. Nominees’ intentions, actions and antecedents must not stand in the way of performing their jobs. In particular, we review criminal, financial, supervisory, tax and administrative law antecedents and other relevant information. In principle, integrity screening is a one-time procedure. Nominees who have passed the screening assessment will not require rescreening. Our decision will stand unless a change in the relevant facts or circumstances provides reasonable grounds for reconsidering a previous integrity screening. Integrity screening only includes the integrity of the relevant person. This means that – unlike in initial suitability screenings – our decision does not depend on circumstances such as the composition of the management board, the type of company that the proposed appointment pertains to or the specific position the nominee will hold. We perform integrity assessments based on information provided by the company and the results of our own screening. For more information see our Open Book on Supervision pages on initial propriety assessments: http://www.toezicht.dnb.nl/en/4/2/16/51-229355.jsp

Notes to the application form for authorisation to pursue the business of an insurer 35 7 Two day-to-day policymakers working from the Netherlands and internal supervisory body Two day-to-day policymakers working from the Netherlands The day-to-day management of your company must be in the hands of at least two natural persons. These persons must perform all activities relating to determining the day-to-day policy from the Netherlands, at any rate for part of the time. The purpose of this requirement is to safeguard the continuity and quality of the company’s business operations and services. The continuity of the day-to-day decision-making at the highest level of an insurance company is safeguarded by having a day-to-day management consisting of at least two natural persons. This reduces the risk of the company being temporarily or permanently out of control. The day￾to-day decision-making is not jeopardised in the event of the temporary absence of one of the day-to-day policymakers. It is assumed here that the members of the day-to-day management have sufficient basic expertise to take over the day-to-day decision-making from each other. From the date the authorisation is issued, the company must meet the two-headed day-to￾day management requirement on an ongoing basis, which means that if one or more day-to￾day policymakers are absent or unable to act, it must promptly arrange for such replacement to ensure that at least two are available. Moreover, the day-to-day policymakers must be able to assess each other’s decisions and adjust these where necessary. Internal control requires a minimum of two individuals to provide adequate checks and balances. The managing directors of the insurance company are usually classified as day-to-day policymakers, as they are responsible for the policies and decisions underlying the company’s day-to-day operational management. However, the concept of ‘policymaker’ also covers individuals who are not managing directors but whose influence extends to the company’s day-to-day management. The law prescribes two-headed day-to-day management as a minimum in order to safeguard the attainment of several statutory objectives. When assessing your application, we check whether your company meets these objectives. To pre-empt corporate tunnel vision and unbalanced policy, it is important to have at least two day-to-day policymakers who are able to prepare decisions from diverse relevant angles and who can check and balance each other where necessary. To safeguard an adequate governance structure, the responsibilities at the highest level (and of the appointed management board if applicable) and the manner in which good governance is set up must be clear and unambiguous. It is important to lay down in writing the names and details of the designated day-to-day policymakers. This makes it clear to everyone who are responsible for the policies and decisions underlying the insurance company’s day-to-day operational management.

36 Internal supervisory body Insurance companies must have an internal supervisory body that functions independently. The body functions independently as a whole and its individual members function independently from each other and from other parties including the management board, the shareholder, the works council and the employees. Its duty is to carefully represent the eligible interests of any particular category of stakeholders in the interest of the insurance company. Insurers whose legal form is public limited company or European company must have a supervisory board or body with a comparable remit. Insurers whose legal form is mutual insurance association must also adequately provide for an internal supervisory function. All insurers applying for authorisation must demonstrate to us that they have set up an independent internal supervisory body and describe how its independent functioning is ensured. The internal supervisory body of a public limited company or European company must consist of at least three natural persons. Consult our Open Book on Supervision pages for more information about the independent functioning of the supervisory board or comparable body. http://www.toezicht.dnb.nl/en/3/51-226002.jsp

Notes to the application form for authorisation to pursue the business of an insurer 37 8 Transparent governance structure Your company must have a transparent and balanced governance structure. In short, this means that your company’s formal governance structure must be the same as its actual governance structure. The governance structure in place must not constitute an impediment to adequate supervision of the company. This occurs if, as a result of the governance structure, the company is affiliated with individuals who are subject to the laws of non-EU states. The aim of this statutory provision is to prevent the organisational structure within which the activities of the governance structure are performed from deviating sharply from the legal structure in which the activities are embedded. An organisational structure of this kind makes it impossible for us to adequately supervise your company. This includes identifying your company’s risk exposure, or assessing whether its operational management is sound and prudent. We must be able to infer from your application and the enclosed annexes that your company meets this requirement.

38 Your company must have own funds for covering the minimum capital requirement. The respective absolute minimum amounts of own funds are listed below: ▪ Solvency II life insurer: EUR 3,700,000 ▪ Life insurer with limited risk: EUR 250,000 ▪ Solvency II non-life insurer in liability, credit and suretyship insurance: EUR 3,700,000 ▪ Solvency II non-life insurer, other: EUR 2,500,000 ▪ Non-life insurer with limited risk: EUR 200,000 ▪ Reinsurer: EUR 3,600,000 ▪ Funeral expenses and benefits in kind insurer: EUR 250,000 Requirements for a Solvency II authorisation Your company must submit information demonstrating that it meets the minimum capital requirement, including a detailed quantitative calculation. The relevant templates S28.01 and S28.02, which are also included in Commission Implementing Regulation (EU) 2015/2452, can be found on the EIOPA website using the following link: http://www.toezicht.dnb.nl/ en/2/51-224687.jsp. This minimum capital requirement must be at least equal to the absolute minimum amount of own funds specified above. You must also submit a calculation of the company’s eligible own funds for covering the minimum capital requirement, providing documentary evidence for their existence. The relevant template S23.01 Own funds can be found on the EIOPA website using the link provided above. In the annexes you submit to us, you must demonstrate that your company meets the minimum capital requirement. In support of the specification of your company’s eligible own  funds, you may submit the following documents: ▪ certified financial statements ▪ memorandum of incorporation ▪ bank statement evidencing the contribution of a specific amount in capital ▪ other documents Requirements for a Solvency II Basic authorisation (applicable to insurers with limited risk) Your company must submit information demonstrating that it meets the minimum capital requirement, including a detailed quantitative calculation. The relevant templates can be found on our website using the following link: http://www.toezicht.dnb.nl/2/50-235104.jsp 9 Minimum own funds

Notes to the application form for authorisation to pursue the business of an insurer You must also submit a calculation of your company’s eligible own funds for covering 39 the minimum capital requirement, providing documentary evidence for their existence. The relevant template Own funds can be found on our website using the following link: http://www.toezicht.dnb.nl/2/50-235104.jsp You must demonstrate to us that your company meets the minimum own funds requirement. In support of the specification of your company’s own funds, you may submit the following documents: ▪ certified financial statements ▪ memorandum of incorporation ▪ bank statement evidencing the contribution of a specific amount in capital ▪ other documents Note: the minimum capital requirement is part of the required solvency as calculated in accordance with the section below.

40 10 Solvency Solvency requirements for a Solvency II authorisation The minimum required solvency is expressed in the solvency capital requirement (SCR). The method to be used for calculating the SCR is determined based on the sectors in which your company is active and the risks it is exposed to. The minimum amount of SCR is calculated using template S25.01, which is also included in Commission Implementing Regulation (EU) 2015/2452, and further detailed in templates S26.01 and S27.01, which can be found on the EIOPA website using the following link: http://www.toezicht.dnb.nl/en/2/51-224687.jsp Please complete the Solvency II templates for calculating the SCR and eligible own funds (S23.01) for covering the SCR. You must also provide documentary evidence for the existence of these items. Note: a number of items are not included, or not included in full, in the calculation of eligible own funds for covering the SCR. We would ask you to pay close attention to this, as we find these items are often overlooked. Intangible assets for instance. These assets are regarded as “soft” assets that offer hardly any buffer against losses in times of stress. Other examples of items not included in the calculation of eligible own funds include deferred tax assets based on future profitability projections. You must obtain our prior permission to use ancillary own funds in determining the actual own funds. Visit http://obtinternlive.dnb.nl/en/2/51-224687.jsp for more information on this point. Solvency requirements for a Solvency II Basic authorisation (applicable to insurers with limited risk) The required solvency is expressed in the solvency capital requirement (SCR). The method to be used for calculating the SCR is determined based on the sectors in which your company is active and the risks it is exposed to. The minimum amount of SCR is calculated using the SCR templates that can be found on our website using the following link: http://www.toezicht.dnb.nl/2/50-235104.jsp Information for health insurers is available http://www.toezicht.dnb.nl/en/3/51-233291.jsp Please complete the Solvency II Basic templates for calculating the SCR and eligible own funds to cover the SCR. You must also provide documentary evidence for the existence of these items.

Notes to the application form for authorisation to pursue the business of an insurer Note: a number of items are not included, or not included in full, in the calculation of eligible 41 own funds for covering the SCR. We would ask you to pay close attention to this, as we find these items are often overlooked. Intangible assets for instance. These assets are regarded as “soft” assets that offer hardly any buffer against losses in times of stress. Other examples of items not included in the calculation of eligible own funds include deferred tax assets based on future profitability projections. You must obtain our prior permission to use ancillary own funds in determining the actual own funds. Visit http://obtinternlive.dnb.nl/en/2/51-224687.jsp for more information on this point. Note: The calculation of the SCR may yield an outcome below the minimum capital requirement or the absolute minimum own funds. In that case, the highest of these three amounts constitutes the applicable solvency requirement.

42 Based on your company’s strategy, please provide a three-year projection of your company’s financial position and estimated results, including a full profit and loss account and a balance sheet. You must detail at least the following four points: ▪ the company’s expected own funds; ▪ the assumptions and data underlying your financial projections, such as investment costs, outsourcing costs, management costs, fees and envisaged market share; ▪ the company’s policy to ensure business continuity under normal, moderately adverse and highly adverse circumstances (in this context, you must include an own risk and solvency assessment (ORSA) supervisory report with elaborated scenarios and the capital policy in place; for insurers with limited risk, the capital policy suffices); ▪ an estimate of the company’s liquidity position. The projections must include at least the following five estimates: ▪ an estimate of the costs involved in setting up the administrative organisation and the production network, showing that the company has the required financial means to cover these costs, and, in the event that one of the risks to be covered comes under the Assistance class, a statement of the means available to the company to provide the agreed assistance; ▪ an estimate for the first three financial years of the administration costs other than those listed, in particular overhead and commissions; ▪ an estimate for the first three financial years of the premiums and claims; ▪ an estimate for the first three financial years of the liquidity position; and ▪ an estimate for the first three financial years of the financial means to cover the liabilities and the SCR as meant in Section 3:57(3) of the Wft. 11 Financial projections

Notes to the application form for authorisation to pursue the business of an insurer Your company must describe its proposed reinsurance policy, addressing at any rate the 43 following two elements: Life, non-life and funeral expenses and benefits in kind insurer We expect you to describe the nature of the reinsurance agreements and specify the reinsurers with which these agreements are to be concluded. Also indicate the risks the company is still exposed to, the amounts involved, as well as the maximum amounts against which insurance policies can be taken out under the reinsurance agreement. Reinsurers Please provide an explanation of your reinsurance policy, more specifically with respect to retrocession, i.e. a reinsurer transferring part of the risks it has insured to another reinsurer on payment of a premium. 12 Reinsurance policy

44 The insurance company’s financial year must coincide with the calendar year. If your company provides evidence that it cannot reasonably be expected to meet this requirement, DNB may, at its request, grant dispensation for a fixed term or ongoing. In that case, you must demonstrate that your company will use alternative means to attain the objectives that this requirement seeks to protect. 13 Financial year

De Nederlandsche Bank N.V. PO Box 98, 1000 AB Amsterdam, the Netherlands +31 (0)20 524 91 11 dnb.nl