Notice 126 Enterprise Risk Management for Insurers

1 Notice No. : MAS 126 Issue Date : 2 April 2013 Last revised on 30 September 2022 ENTERPRISE RISK MANAGEMENT (“ERM”) FOR INSURERS A. Introduction

1. This Notice is issued pursuant to section 154(4) of the Insurance Act 1966 (“the Act”) and comprises both mandatory requirements and non-mandatory standards.
2. This Notice must be read in conjunction with the provisions of the Act. It is not intended to override any provision of the Act.
3. This Notice applies to any licensed insurer (except a captive insurer or a marine mutual insurer). [MAS Notice 126 (Amendment) 2013] 3A. While any deviation from the guidelines set out in this Notice does not of itself amount to an offence under the Act, the Authority may take into account such deviation as one of the factors in considering whether the insurer should be subject to additional supervisory requirements as a result of the increased risk in the operations of the insurer. [MAS Notice 126 (Amendment) 2022] Guidelines: Background A.1 MAS has issued a set of Guidelines on Risk Management Practices, with the objective of providing all financial institutions supervised by MAS with guidance on sound risk management practices. These Guidelines are organised by risk types and cover a range of risks and functions such as credit risk, market risk, internal controls, operational risks, insurance core activities such as product development, pricing and underwriting, and the role of an institution’s board of directors and senior management. A.2 The ERM requirements and guidelines in this Notice set out how insurers are to identify and manage interdependencies between key risks, and how these are translated into management actions related to strategic, capital and liquidity planning matters. [MAS Notice 126 (Amendment) 2022] A.3 ERM is the process of identifying, assessing, measuring, monitoring, controlling and mitigating risks in respect of the insurer, the group which it belongs to and, if applicable the group which it is in control of. It involves the

2 self-assessment of all reasonably foreseeable and relevant material risks that an insurer faces, and their inter-relationships, providing a link between ongoing operational management of risk and longer-term business goals and strategies. A.4 Through ERM, an insurer can form a prospective view of its risk profile and capital and liquidity needs, thus enabling its business strategy, risk management and capital allocation to be co-ordinated in order to achieve maximum financial efficiency and adequate protection of its policy owners. [MAS Notice 126 (Amendment) 2022] B. Definition 4. In this Notice- “appointed actuary” means a person appointed under section 35(1)(b) of the Act; [MAS Notice 126 (Amendment) 2013] “certifying actuary” means a person appointed under section 35(1)(c) of the Act; [MAS Notice 126 (Amendment) 2013] “continuity analysis” means an analysis of the insurer's ability to continue in business, whereby the risk management and financial resources required to do so is over a longer time horizon than typically used to determine regulatory capital and solvency requirements; “economic capital” means the capital needed by the insurer to satisfy its risk tolerance and support its business plans and which is determined from an economic assessment of the insurer’s risks, the relationship of these risks and the risk mitigation in place; “executive officer”, in relation to an insurer’s head office, means any person, by whatever name described, who – (a) is in the direct employment of, or acting for or by arrangement with, the head office; and (b) is concerned with or takes part in the management of the head office on a day￾to-day basis; [MAS Notice 126 (Amendment) 2015] “group” means the group of companies, in accordance with the accounting standards made or formulated under the Accounting Standards Act, to which the insurer belongs;

3 "MA portfolio” has the same meaning as “MA portfolio” under paragraph 1.5 of MAS Notice 133; [MAS Notice 126 (Amendment) 2022] “regulatory capital” means the level of capital required to satisfy the fund solvency and capital adequacy requirements as prescribed or specified in directions under section 17 of the Act; and “Tier 1 insurer” has the same meaning as in regulation 4 of the Insurance (Corporate Governance) Regulations 2013. 4A. Any references to a “board” or a “board of directors” in this Notice, other than in this paragraph, in the case of a licensed insurer incorporated outside of Singapore, mean: (a) the board of directors of the insurer; (b) all executive officers of the insurer’s head office with oversight responsibilities for the insurer’s Singapore operations; or (c) any committee of the insurer’s head office or regional office with oversight responsibilities for the insurer’s Singapore operations. [MAS Notice 126 (Amendment) 2015] 5. The expressions used in this Notice, except where expressly defined in this Notice or where the context otherwise requires, have the same respective meanings as in the Act. Guidelines: B.1 Diagram 1 illustrates the key features of an ERM framework and the various interactions amongst the key components.

4 Diagram 1: Key features of ERM framework C. Reliance on group’s ERM framework 6. An insurer may adopt the ERM framework of the group, as long as the ERM framework fulfils the mandatory requirements spelt out in this Notice. Guidelines: C.1 If an insurer is using the group’s ERM framework, the framework should take into account the particular circumstances and requirements of the insurer. D. Risk identification and Measurement 7. An insurer must establish an ERM framework which: (a) provides for the identification and quantification of risks using techniques appropriate to the nature, scale and complexity of the risks the insurer bears; and (b) addresses risk, solvency, capital and liquidity management. [MAS Notice 126 (Amendment) 2022]

5 8. An insurer must ensure that its ERM framework identifies and addresses all reasonably foreseeable and relevant material risks to which the insurer is, or is likely to become, exposed. Such material risks must, at a minimum, include insurance risk, market risk, credit risk, operational risk, liquidity risk and concentration risk. Reasonably foreseeable and relevant material risks may also include, for example, legal risk and risk to the reputation of the insurer. [MAS Notice 126 (Amendment) 2022] 9. An insurer must take into account “group risk” which arises as a consequence of being a member of a group. “Group risk” includes the risk that the insurer may be adversely affected by an occurrence (financial or non-financial) in another entity of the group it belongs to. It also includes the risk that the financial stability of the group as a whole or of any of the individual insurance entities within the group, being adversely affected by an event in any one of the entities in the group, a group-wide occurrence or an event external to the group. Group risk may also arise, for example, through contagion, leveraging, double or multiple gearing, concentrations, large exposures and complexity. Participations, loans, guarantees, risk transfers, liquidity, outsourcing arrangements and off-balance sheet exposures may all give rise to group risk. In managing its risks, the insurer must consider the inter-relationships it has with other members of the group including aspects of control, influence and interdependence. 10. After identifying the risks, an insurer must highlight material risks and possible key leading indicators to its senior management regularly but no less than once every quarter. For example, if liquidity risk was identified as a material risk, the insurer may decide to use certain macro-economic indicators as leading indicators, based on the assumption that an economic downturn may increase the probability of surrenders and thus increase liquidity risk. The insurer must also update its board of directors and senior management of its risk profile regularly but no less than once a year. 11. Assumptions that are implicit in the solvency assessment of an insurer may not apply at the group level because of the legal separation of members of the group. An insurer must ensure its ERM framework takes into account the constraints in its assumptions (e.g. fungibility of capital1 ), with regard to the group.

12. An insurer must consider the causes of different risks and their impact, and assess the relationship between risk exposures. In assessing the relationship between risk exposures, the insurer must consider macroeconomic exposures and must assess external risk factors which, if they were to crystallise, could pose a significant threat to its business. The insurer must also recognise the limitations of the methods it uses to manage risks, the potential impact these limitations may have and adapt its risk management appropriately. The insurer must properly document these considerations and recognition of the limitations and their potential impact. [MAS Notice 126 (Amendment) 2022] 1 If the insurer has branches in different jurisdictions, or its parent is in a jurisdiction where restrictions on fungibility of capital apply or where there is ring-fencing of policies in participating funds, the assumption of full fungibility may not always be appropriate.

6 13. An insurer must support the measurement of its risk with documentation2 that provides detailed descriptions and explanations of the risks covered, the measurement approaches used and the key assumptions made. [MAS Notice 126 (Amendment) 2022] Guidelines: D.1 For guidelines on risk identification and measurement, refer to Appendix A. [MAS Notice 126 (Amendment) 2022] E. Risk Management Policy 14. An insurer must have a risk management policy3 which outlines how all relevant and material categories of risk are managed, both in the insurer’s business strategy and its day-to-day operations. 15. An insurer must ensure its risk management policy, at a minimum, covers the following areas: (a) the insurer’s policy for managing the risks to which it is exposed, including underwriting and investment risks; (b) the insurer's policies towards risk retention, risk management strategies including reinsurance and the use of derivatives, diversification and asset￾liability management; (c) the relationship between the insurer’s risk tolerance limits, regulatory capital requirements, economic capital and the processes and methods for monitoring risk; and (d) how the insurer’s risk management is related to its corporate objectives and strategy, taking into account its current circumstances. 16. An insurer must ensure the policies relating to insurance risks pay particular attention to risk retention and risk transfer through reinsurance and other forms of risk transfer as appropriate to the insurer’s risk profile and capital, as well as take into account the effectiveness of any risk transfer under scenarios of financial distress. 2 Such documentation should be signed or verified by senior management. [MAS Notice 126 (Amendment) 2022] 3 For avoidance of doubt, an insurer may choose to fulfil the requirements for a “risk management policy” using a collection of individual policies.

7 17. An insurer must have a risk management policy which describes the relationship between pricing, product development and investment management4 . The insurer must ensure that the risk management policy includes a category of risk comprising all of the additional group risks the insurer faces as a result of its membership in a group. [MAS Notice 126 (Amendment) 2022] 18. Where an insurer uses its group’s ERM framework, the insurer must ensure that the risk management policy covers all the risks that are relevant and material to the insurer. 19. An insurer must ensure that its risk management policy specifies a time horizon which is consistent with the nature of the insurer’s risks as well as its business planning horizon. F. Risk Tolerance Statement 20. An insurer must establish and maintain a risk tolerance statement which defines its overall quantitative and qualitative risk tolerance limits, and which takes into account all relevant and material categories of risk and their inter-relationships. 21. An insurer must incorporate its risk tolerance limits in the setting of its business strategy. 22. An insurer must set out in its written policies and procedures that are communicated to its management, its defined risk tolerance limits for its daily operations so that management understands the level of risk to which the insurer is prepared to be exposed, and the limits of risk to which they are able to expose the insurer as part of their work. G. Risk Responsiveness and Feedback Loop 23. An insurer must ensure that its ERM framework is responsive to changes in its risk profile, as a result of both internal and external events, as well as to the changing interests and reasonable expectations of policy owners and other stakeholders. An insurer must ensure that the framework includes mechanisms to incorporate new risks and new information where necessary, at least once every quarter. 24. An insurer must ensure that an effective system is in place to identify and monitor any breaches or potential breaches of the insurer’s risk tolerance limits. 25. An insurer must ensure that as part of its ERM framework, it has in place a feedback loop, which is a process to monitor and respond in a timely manner to changes in its risk profile. 4 For example, the insurer should take into account its investment strategy in the interest rate assumptions used for product pricing. [MAS Notice 126 (Amendment) 2022]

8 26. An insurer must ensure that it is able to obtain appropriate, reliable and good quality information about changes in the risk profile of the group that could materially affect the insurer. Guidelines: G.1 An insurer may include as new risks identified from its business, for example new acquisitions, new investment positions, or new business lines. An insurer may need to make changes to the ERM framework when there is new information from external sources, as a result of evolution of the environment affecting the nature and size of underlying risks, supervisory and legislative requirements, rating agency concerns (if applicable), political changes, major catastrophes or market turbulence. G.2 An insurer should ensure that the feedback loop as described in paragraph 25 is effective, such that the board of directors and senior management can make risk management decisions using information that they can rely on, and that such decisions are implemented and their effects monitored and reported to the board of directors and senior management in a timely and sufficiently frequent manner. The insurer should also ensure that the monitoring processes of its feedback loop take into account reliable information and assess the risks using objective and defined criteria. H. Own Risk and Solvency Assessment 27. An insurer must perform its own risk and solvency assessment (“ORSA”), at a minimum, annually, to assess the adequacy of its risk management, and current and projected future solvency and liquidity position with a time horizon which is consistent with that used in its business planning. When undertaking its ORSA, the insurer must document the rationale, calculations and action plans arising from this assessment. [MAS Notice 126 (Amendment) 2022] 28. An insurer must ensure that its board and senior management take responsibility for the ORSA. 29. An insurer must design its ORSA such that it will: (a) encompass all reasonably foreseeable and relevant material risks including, at a minimum, insurance risk, credit risk, market risk, operational risk, liquidity risk, concentration risk and additional risks arising due to membership of a group; [MAS Notice 126 (Amendment) 2022] (b) identify the relationship between the risks identified in sub-paragraph (a) as well as the level and quality of financial resources needed and can be made available;

9 (c) include all material risks that may have an impact on its ability to meet its obligations to policy owners, and the impact of future changes in economic conditions or other external factors; and (d) include all additional risks arising due to membership of the group, to the extent that those risks impact the insurer as appropriate to the nature, scale and complexity of those risks. Guidelines: H.1 An insurer may make reference to the sample format and suggested content for the ORSA report outlined in Appendix B when drafting its ORSA report. H.2 The ORSA undertaken by an insurer should be appropriate to the nature, scale and complexity of its risks. Where it is appropriate to the nature, scale and complexity to do so, the effectiveness of the ORSA process should be assured through internal or external independent review by a suitably experienced individual who reports directly to, or is a member of the board of directors. H.3 Regular undertaking of ORSA by an insurer should provide relevant and timely information for its management and decision making processes. The insurer should regularly reassess the causes of risk and the extent to which particular risks are material. Material changes in the risk profile of the insurer should prompt it to undertake a new ORSA. Risk assessment should be done in conjunction with consideration of the effectiveness of applicable controls to mitigate the risks. H.4 An insurer should consider scenarios in which its group splits or changes its structure in other ways. When an insurer assesses its current capital adequacy requirements, liquidity needs and continuity analysis, the insurer should also include in its ORSA relevant possible changes in the group structure and integrity in adverse circumstances and the implications this could have for group risks, the existence of the group and the support or demands from the group to or on its members. [MAS Notice 126 (Amendment) 2022] Economic and regulatory capital 30. An insurer must: (a) determine, as part of its ORSA, the overall financial resources it needs to manage its business given its own risk tolerance and business plans, and to demonstrate that regulatory requirements are met;

10 (b) base its risk management actions on consideration of its economic capital, regulatory capital requirements and financial resources, including its ORSA; and (c) assess the quality and adequacy of its capital resources to meet regulatory capital and economic capital requirements. The insurer, based on its nature, scale and complexity, may justify adopting its regulatory capital, whether in entirety as, or to form the basis of, its economic capital. 31. As part of its ORSA, an insurer must clearly distinguish between current capital needs and its projected future financial position, having regard for its longer-term business strategy and, in particular, new business plans. The insurer must also assess the appropriateness of its capital resources in supporting its business strategy and enabling it to continue its operations. Guidelines: H.5 Although the amounts of economic capital and regulatory capital requirements and the methods used to determine them may differ, an insurer should be aware of, and be able to analyse and explain, these differences. Such analysis helps to embed regulatory requirements into an insurer's ORSA and risk and capital management, so as to ensure that obligations to policy owners continue to be met as they fall due. H.6 If an insurer suffers losses that are absorbed by its available capital resources, it may need to raise new capital to meet ongoing regulatory capital requirements and to maintain its business strategies. An insurer cannot assume that capital will be readily available at the time it is needed. Therefore, an insurer should, when assessing its quality of capital, also consider the issue of re-capitalisation in its ORSA, especially the ability of capital to absorb losses on a going-concern basis and the extent to which the capital instruments or structures that the insurer uses may facilitate or hinder future re￾capitalisation. For example, if an insurer enters into a funding arrangement where future profits are cashed immediately, the reduced future earnings potential of the insurer may make it more difficult to raise capital resources in the future. H.7 An insurer may use internal models to better assess the financial resources and calculation of regulatory capital requirements due to the range of risks and their scale and complexity. H.8 For the purposes of paragraph 30, where an insurer adopts its regulatory capital, whether in entirety as, or to form the basis of, its economic capital, the insurer should clearly document the reasons for doing so in its ORSA report. [MAS Notice 126 (Amendment) 2022]

11 Liquidity Risk Management 32. An insurer must establish liquidity risk management processes as part of its ORSA which include: (a) the maintenance of a portfolio of unencumbered liquid assets under normal and stressed conditions; and (b) a contingency funding plan to meet its liquidity needs. For the purpose of sub-paragraph (a), an unencumbered liquid asset refers to an asset which an insurer is able to liquidate, free of any restrictions, and which the insurer has not pledged or collateralised for the purposes of another transaction. [MAS Notice 126 (Amendment) 2022] Guidelines: H.9 In maintaining a portfolio of unencumbered liquid assets, an insurer should ensure that every asset in this portfolio satisfies the following conditions: (a) the asset is capable of being easily converted into cash in a short period of time; (b) the insurer has assessed the asset to be of low credit risk; (c) the insurer is able to easily obtain transparent and accurate valuations of the asset; (d) the asset shows low correlation with other risky assets; (e) the asset is tradable in consistently active markets; and (f) the asset is a reliable source of liquidity during stress. Where appropriate, the insurer should assess its liquidity needs by individual currency. [MAS Notice 126 (Amendment) 2022] H.10 An insurer should establish a liquidity bucketing framework to assess its ability to meet liquidity needs under different stress horizons. An insurer may consider two classifications under this liquidity bucketing framework – the primary bucket and the secondary bucket. [MAS Notice 126 (Amendment) 2022] H.11 The primary bucket should consist of liquid assets which are of the highest credit quality and market liquidity, and can be liquidated in a short period of time even under stress. Examples of assets that may be included in the primary bucket are: (a) Cash; (b) Demand deposits; (c) Securities issued or guaranteed by:

12 • a sovereign (Credit Quality Class B or better) or a central bank (Credit Quality Class B or better); • a statutory board in Singapore; • recognised multilateral agencies; and (d) Government money market funds that: • invest a substantial amount of their total assets in liquid assets (including cash); and • whose objective is to provide liquidity on demand. [MAS Notice 126 (Amendment) 2022] H.12 The secondary bucket should consist of liquid assets which are of high credit quality, but which may take a longer period of time to liquidate, and have relatively less liquid markets as compared to the assets in the primary bucket. Examples of assets that may be included in the secondary bucket are: (a) Securities issued or guaranteed by: • a sovereign (Credit Quality Class C or Class D) or a central bank (Credit Quality Class C or Class D); • a public sector entity (other than a statutory board in Singapore) (Credit Quality Class D or better); and • a recognised multilateral development bank (Credit Quality Class D or better). (b) Covered bonds (Credit Quality Class D or better); (c) Corporate debt securities5 including commercial paper (Credit Quality Class D or better, except commercial paper which should be rated Credit Quality Class C1 or better); (d) Equities that are a constituent of a major index; and (e) Any other assets which demonstrate the characteristics of liquid assets described in Guideline H.9. An insurer should document its assessment of how these characteristics are met if such assets are included in the secondary bucket. [MAS Notice 126 (Amendment) 2022] H.13 If an insurer includes corporate debt and equity securities issued by financial institutions6 in the secondary bucket, the insurer should document its assessment of 5 Excluding complex structured products or subordinated debt securities. [MAS Notice 126 (Amendment) 2022] 6 This refers to financial institutions regulated by the Authority and financial institutions regulated in other jurisdictions. [MAS Notice 126 (Amendment) 2022]

13 how such assets are able to meet the criteria listed in Guideline H.9, taking into account that such assets have the potential for wrong-way risk7 . [MAS Notice 126 (Amendment) 2022] H.14 An insurer’s contingency funding plan should include key elements such as: (a) the governance process with clear roles and responsibilities assigned to staff involved; (b) procedures for identifying early warning indicators for potential liquidity stress events; (c) quantitative metrics used to monitor the liquidity position; (d) identification of diversified alternative sources of funding (e.g. liquidity facility) with details on when and how each source of funding can be activated; (e) description of strategies for addressing liquidity shortfalls in stressed conditions; and (f) considerations on the impact of stressed market conditions on the ability to monetise assets, including details of any operational, legal and regulatory limitations. [MAS Notice 126 (Amendment) 2022] H.15 The Credit Quality Class classification by credit rating referred to in Guidelines H.11 and H.12 is set out in Appendix 4K of MAS Notice 133. [MAS Notice 126 (Amendment) 2022] H.16 The expressions used in Guidelines H.9 to H.14, except where expressly defined in this Notice or where the context otherwise requires, have the same respective meanings as in the MAS Notice 133, as applicable. [MAS Notice 126 (Amendment) 2022] Continuity Analysis and Stress Testing 33. An insurer must undertake periodic, forward-looking continuity analysis that addresses a combination of quantitative and qualitative elements in the medium and longer-term business strategy of the insurer and includes projections of its future financial position 7 The liquidity of corporate debt and equity securities issued by financial institutions tends to be correlated with developments in the financial markets and the broader economy, and holding these instruments may cause greater stress to an insurer’s liquidity position during times of crisis. [MAS Notice 126 (Amendment) 2022]

14 and analysis of its ability to meet future regulatory capital requirements and liquidity needs. [MAS Notice 126 (Amendment) 2022] 34. An insurer must as part of its ORSA, analyse its ability to continue in business, and the risk management and financial resources required to do so, under a range of severe but plausible adverse scenarios, over a time horizon needed for effective business planning. 35. In carrying out its continuity analysis, an insurer must conduct stress testing for each relevant insurance fund maintained under section 16 of the Act by projecting the financial, economic capital and capital adequacy positions of the insurer under various scenarios, including: (a) its base scenario, based on its best estimates of risk factors; and (b) stress scenarios that: (i) take into account the most recent, relevant and material risks; (ii) assess the resilience of the insurer’s balance sheet against macroeconomic stressors; and (iii) assess the effect of stress events on material counterparty exposures. [MAS Notice 126 (Amendment) 2022] 36. An insurer must also apply reverse stress testing to identify scenarios that would be the likely cause of business failure and the actions necessary to manage this risk. Guidelines: H.17 In determining whether or not there is “business failure” for the purpose of paragraph 36, an insurer should consider its ability to meet the lower solvency intervention level8 . Where an insurer is unable to meet the lower solvency intervention level, the insurer should consider that there is a business failure. An insurer should also consider other situations where its business would be deemed unviable, such as the loss of market confidence or where the insurer is being wound up for any other reason. Where the insurer’s business would be deemed unviable, the insurer should consider that there is a business failure. [MAS Notice 126 (Amendment) 2022] 8 The lower solvency intervention level refers to the fund solvency requirement and capital adequacy requirement specified in regulation 4(2)(b) and 4(3)(b) of the Insurance (Valuation and Capital) Regulations 2004 respectively and any relevant capital add-on requirement imposed under Section 17(4) of the Act. [MAS Notice 126 (Amendment) 2022]

15 37. An insurer must, as part of its continuity analysis, include a liquidity risk management analysis to assess the overall liquidity adequacy of the insurer under both under normal and stressed conditions. [MAS Notice 126 (Amendment) 2022] Guidelines: H.18 For the purposes of paragraph 37, an insurer should include the following key elements in its liquidity risk management analysis: (a) summary of methodology to determine portfolio of unencumbered liquid assets; (b) the insurer’s liquidity risk appetite statement and liquidity risk limits; (c) an assessment of the insurer’s current liquidity position in relation to the insurer’s risk appetite and limits; (d) details of strategies, policies and processes to manage liquidity risk; (e) considerations of potential vulnerabilities and approaches to enhance liquidity positions; (f) the results of liquidity stress tests; and (g) analysis of key drivers of the change in the liquidity position compared to the prior analysis. [MAS Notice 126 (Amendment) 2022] H.19 For other guidelines on continuity analysis and stress testing, refer to Appendix C. [MAS Notice 126 (Amendment) 2022] 38. As a result of continuity analysis, an insurer must develop contingency plans and procedures. An insurer must ensure its contingency plans identify the actions that the insurer is to take immediately to restore or improve the insurer’s capital adequacy or cash flow position after some future stress scenario, and set out the criteria an insurer should apply to determine whether actions should be taken by the insurer in advance as precautionary measures. [MAS Notice 126 (Amendment) 2022] 39. An insurer must, as part of its continuity analysis, analyse the ongoing support from the group including the availability of financial support in adverse circumstances as well as the risks that may flow from the group to the insurer.

16 ORSA Reports 40. An insurer which belongs to a group may make use of its group’s ORSA report, provided the required details specific to the insurer, is clearly documented in the report. 41. A Tier 1 insurer must lodge its first ORSA report which is approved by its board of directors by 31 December of the year in which it becomes licensed under section 11 of the Act, and thereafter, a Tier 1 insurer must lodge its ORSA report annually with the Authority within 2 weeks from the date the ORSA report is approved by its board of directors. [MAS Notice 126 (Amendment) 2015] [MAS Notice 126 (Amendment) 2022] 42. An insurer which is not a Tier 1 insurer must— (a) lodge its first ORSA report within 2 weeks from the date the ORSA report is approved by its board of directors, and in any case, by no later than 31 December of the year following the year in which it becomes licensed under section 11 of the Act; and (b) thereafter, regardless of when the first ORSA report was lodged, lodge an ORSA report every third year from 2015, i.e. 2018, 2021, 2024 and so on, within 2 weeks from the date each subsequent ORSA report is approved by its board of directors. [MAS Notice 126 (Amendment) 2013] [MAS Notice 126 (Amendment) 2015] [MAS Notice 126 (Amendment) 2022] Submission of board of directors’ deliberations on ORSA reports 43. An insurer must submit to the Authority an extract of the minutes of the board of directors’ meeting detailing the deliberations made by the board of directors on the ORSA report and the board of directors’ approval of the ORSA report (the ‘Extract of the minutes’) at the time of lodgement of the ORSA report. If an insurer is unable to submit the Extract of the minutes together with the ORSA report approved by its board of directors, the insurer must undertake and confirm in writing to the Authority the date by which the Extract of minutes will be submitted to the Authority. The insurer must submit the Extract of the minutes no later than 1 month from the date of lodgement of the ORSA report with the Authority.

17 I. Effective Date 44. This Notice shall take effect on 1 January 2014. *Notes on History of Amendments

1. MAS Notice 126 (Amendment) 2013 with effect from 22 April 2013,
2. MAS Notice 126 (Amendment) 2015 with effect from 7 December 2015.
3. MAS Notice 126 (Amendment) 2020 dated 5 March 2020 with effect from 31 March 2020.
4. MAS Notice 126 (Amendment) 2022 dated 30 September 2022 with effect from 1 January

18 Appendix A GUIDELINES ON RISK IDENTIFICATION AND MEASUREMENT Risk identification

1. Concentration risks can arise from having a small number of reinsurers or material counterparties, lack of diversification of products or business lines, large exposures to specific geographical regions or industry sectors, amongst others. [MAS Notice 126 (Amendment) 2022] Causes of risk and the relationship between risks
2. In assessing the relationship between risk exposures, consideration should be given to correlations between risk events which could cause extreme losses to an insurer. Risks that show no strong dependence under normal economic conditions, such as catastrophe risks and market risks, could be more correlated in a stress scenario. For example, certain major trigger events, such as catastrophes, downgrades from rating agencies or other events that have an adverse impact on the insurer’s reputation, can result, in a high level of claims, collateral calls or policy terminations, and hence lead to serious liquidity issues. The insurer should, in its policies and procedures, outline its options for responding to such trigger events. An insurer should also assess the interdependencies between guarantees and options embedded in its products, the assets backing those products, and the current market and economic conditions it is operating in. [MAS Notice 126 (Amendment) 2022] Measuring, analysing and modelling the level of risk
3. The level of risk is a combination of the impact that the risk will have on an insurer and the probability of that risk materialising. An insurer should regularly assess the level of risk that it bears using appropriate forward-looking quantitative techniques such as risk modelling9 , stress testing, including reverse stress testing, and scenario analysis. An insurer should adopt the appropriate range of adverse circumstances and events, including those that pose a significant threat to the financial condition of the insurer, and management actions should be identified together with the appropriate timing of these actions. An insurer should use risk measurement techniques in developing long￾term business and contingency plans, where it is appropriate to the nature, scale and complexity of the insurer to do so.
4. Different approaches on assessment of the level of risk may be appropriate depending on the nature, scale and complexity of a risk and the availability of reliable data on the behaviour of that risk. For example, a low frequency but high impact risk where there is limited data, such as catastrophe risk, may require a different approach from a high 9 “Modelling” in this context does not necessarily mean complex stochastic modelling. It can also include less sophisticated methods.

19 frequency, low impact risk for which there is substantial amounts of data available. For example, stochastic risk modelling may be appropriate to measure some non-life catastrophe risks, whereas relative simple calculations may be appropriate in other circumstances. 5. An insurer should base the measurement of its risks on a consistent economic assessment of the total balance sheet as appropriate to ensure that appropriate risk management actions are taken. 6. Where a risk is not readily quantifiable, an insurer should make a qualitative assessment that is appropriate to that risk and sufficiently detailed to be useful for risk management. The insurer should analyse the controls needed to manage such risks to ensure that its risk assessments are reliable and consider events that may result in high operational costs or operational failure. Such analysis is expected to inform the insurer’s judgments in assessing the size of the risks and enhancing overall risk management. 7. An insurer should ensure that when carrying out its continuity analysis, it assesses its risk on a consistent basis, so that any variations in results can be readily explained. The insurer should use such analysis to prioritise its risk management. 8. Where models are used, an insurer should be mindful that, regardless of how sophisticated the models are, they cannot exactly replicate the real world. The use of models itself generates risk (modelling and parameter risks) which, if not explicitly quantified, should at least be acknowledged and understood by the insurer, including the board of directors and senior management. 9. An insurer may use stress testing and scenario analysis to complement the use of models for risks that are difficult to model, or where the use of a model may not be appropriate from a cost-benefit perspective. 10. An insurer may use scenario analysis to facilitate communication on risk matters at various levels of the organisation. Such communication would enable the ERM framework to be better appreciated within the organisation and better integrate the framework with its business operations and culture. Updates to the board of directors and senior management 11. When necessary, such as during financial distress, an insurer should update its board and senior management of its risk profile on a more frequent basis.

20 Appendix B ILLUSTRATIVE ORSA REPORT TEMPLATE FOR AN INSURER Section Summary Description A Executive Summary • Purpose of the report • Planning horizon captured in the report • Summary of the results of ORSA • Includes the key risks that threaten the financial strength of the insurer and the key mitigating actions identified B ORSA Process • Summary of the ORSA process • Includes summary of the key risk management policies and comments on the effectiveness of these policies in managing its risk profile • Includes summary of key changes to its ORSA process and underlying assumptions • Includes details of principal assumptions and interdependencies between the various key assumptions C Strategy and Risk tolerance • Summary of current business strategy and risk tolerance • Impact of the business strategy on the risk profile • Demonstrates link between strategy, risk and capital D Risk Exposures • Risk tolerance statements and assessment of the current risk profile against defined tolerance • Assessment of risks which may not be quantified within the economic capital and regulatory capital review such as group, reputational and emerging risks • Assessment of the effectiveness of controls in place to mitigate against key risks • Summary of breaches on defined risk tolerance since last reporting and any impact to risk strategy and capital E Business Projection and Stress Testing • Brief description of stress scenario • Includes the rationale for the choice and construction of the scenarios and the description of the assumptions • Potential risk, capital and solvency profile under various stressed conditions • Qualifications of results (if any) F Capital Requirement • Summary of methodology to determine required capital (regulatory and economic) • Assessment of regulatory and economic capital needs based on the actual and potential risks faced • Analysis of key drivers of the change in the financial, economic and capital adequacy positions G Solvency Assessment • Assessment of available funds to meet capital requirements, both now and based on future projections • Summary of capital management plans • Assessment of capital planning and adequacy

21 Section Summary Description • Includes the capital contingency plans where future funds may be insufficient to meet capital needs, and the timeframe for implementing these measures • Include assessment of contingent capital or access to additional funds (e.g. from parent company or Head office) post-event • Assessment of the effectiveness of capitals which are fungible or likely to be fungible H Liquidity Risk Management Analysis • Summary of methodology to determine portfolio of unencumbered liquid assets • Liquidity risk appetite statement and liquidity risk limits • Assessment of current liquidity position in relation to risk appetite and limits • Details of strategies, policies and processes to manage liquidity risk • Considerations of potential vulnerabilities and approaches to enhance liquidity positions • Results of liquidity stress tests • Analysis of key drivers of the change in the liquidity position compared to the prior analysis [MAS Notice 126 (Amendment) 2022] I Assurances • Comparison of actual experience (including the Capital Adequacy Requirement) vis-à-vis projection from the prior year • Comment on the suitability of current projection assumptions in light of past actual experience • Comment on the management actions taken in the previous period in response to the recommendations stated in the previous ORSA Report • Summary outcome of independent review of ORSA (if any) • Limitations and reliance J Appendices and References • Includes detailed projection of the stress testing

22 Appendix C GUIDELINES ON CONTINUITY ANALYSIS AND STRESS TESTING General guidance

1. When conducting the continuity analysis, an insurer should take into consideration new business plans and product design and pricing, including embedded guarantees and options, and the assumptions appropriate given the way in which products are sold. The insurer’s current premium levels and strategy for future premium levels are a key element in its continuity analysis. In order for continuity analysis to remain meaningful, an insurer should also consider changes in external factors such as possible future events including changes in the political or economic situation.
2. In performing its stress testing, an insurer should construct the base scenario in a manner that is consistent with the insurer’s business plan. The base scenario should take into account the insurer’s management and business philosophy and strategies such as marketing plans, sales objectives, investment policies, pricing philosophy, underwriting philosophy, reinsurance practices and its policy on allocation to participating policy owners and shareholders.
3. The following guidelines should be observed for the construction of projections under an insurer’s continuity analysis and stress test scenarios: (a) The projections should be comprehensive in scope and cover all key products and lines of business and all assets of the insurer that are material to the solvency of the insurer; (b) Separate projections should be made for each insurance fund established and maintained by the insurer under the Act; and (c) Where the assets or liabilities of an insurance fund that are material to the solvency of the insurance fund have different inherent characteristics, the appointed actuary or certifying actuary, as the case may be, should make separate projections by major product lines, MA portfolios, and asset classes within the insurance fund. [MAS Notice 126 (Amendment) 2022]
4. Adequate checks should also be conducted on the appropriateness of any data or projections that form the bases for the ORSA report. If an insurer relies on any other person for any aspect of the data or projections, the insurer should be satisfied that the person relied on is qualified for such purposes. The nature and extent of the reliance on such person and his particulars should be disclosed in the ORSA report.
5. As part of its continuity analysis, an insurer should analyse its ability to withstand continuous adverse developments over the period of projection. Such adverse developments should include persistent inflation, recession, falling stock markets and

23 claims experience. In deriving the assumptions relating to the scenarios, the insurer should consider the differing nature of various assumptions as compared to others: (a) Some assumptions, such as mortality or renewal expenses in real terms, may reasonably be relied on as fairly stable or having a stable trend. However, attention should be paid to both the risk of sudden change (e.g. a new infectious disease) and the possibility of a change in the trend.

(b) Other assumptions, for example policy persistency, may need to be considered in the context of both historical experience and changes anticipated in the light of different operating methods now used by the insurer. (c) Yet other assumptions may be highly uncertain and totally outside the control of the insurer. This is particularly true of investment conditions, the volatility of which may have significant implications for the financial condition of the insurer. 6. During the analysis and construction of each scenario, an insurer should take into account links between the various key assumptions made. An insurer should ensure that the stress scenarios and model parameterisations are not limited to historical events, distributions and correlations, but incorporate forward-looking perspectives. [MAS Notice 126 (Amendment) 2022] 7. An insurer should show in its ORSA report the impact on the insurer’s financial condition and liquidity position if no management action is taken. In the ORSA report, the insurer should also demonstrate how, with appropriate and timely management action, it can maintain or regain a satisfactory financial condition and liquidity position under each scenario on a going concern basis. The target financial, liquidity and capital adequacy positions should be consistent with its risk tolerance limits. [MAS Notice 126 (Amendment) 2022] 8. An insurer may propose in the ORSA several alternative courses of management action it could take to mitigate its financial loss or liquidity concern in any given scenario. Rationale for each course of action, and the potential implications should be clearly described in the ORSA report. The ORSA report should illustrate the financial and liquidity impact of each management action taken. [MAS Notice 126 (Amendment) 2022] 9. An insurer should ensure that the capital and cash flow projections (before and after stress scenarios) and the management actions included in their forecasts, are approved by senior management. 10. An insurer should also identify the key areas of concern noted from the stress test results and recommend risk management measures and the timeframe for implementing these measures. An assessment should be done on the adequacy of the mitigating measures, and where applicable, conduct further analysis to quantify the likely impact of such measures and set out the results of the analysis in the ORSA report.

24 11. These measures may include, but are not limited to, changing the asset mix, hedging investment risks wherever appropriate, changing the mix of new business, increasing the use of MA (as described in paragraph 3.4 of MAS Notice 133), withdrawing from certain lines of business or revising reinsurance arrangements. [MAS Notice 126 (Amendment) 2022] Design of Stress Scenarios 12. An insurer should specify the reasons for the choice and construction of the scenarios presented in the ORSA report. The insurer, as the case may be, should also include a brief description of the scenario in the ORSA report, for example, “financial crisis with adverse claims experience” and “decrease in new business and large terminations due to drop in confidence in the insurer”. 13. In constructing the stress test scenarios, an insurer should analyse its key risk exposure in the face of catastrophic events such as natural calamities, a severe economic recession or a major crash in the equity, property or bond market. The insurer should also take into consideration the prevailing environment, including the economic, medical, demographic, social and political situation at the relevant time. 14. An insurer should construct stress scenarios which clearly illustrate the extent to which one, or several, of its relevant and material risks, if realised, can affect its financial, capital and liquidity position. [MAS Notice 126 (Amendment) 2022] Macroeconomic stress test 15. In designing the macroeconomic stress test, an insurer should: (a) determine its key risk drivers by reviewing its risk profile, for instance, the type of assets that it has significant holdings in, the nature of products that it underwrites and the type of insurance risks that it is more susceptible to; (b) define a projection horizon that is commensurate with the severity of the scenario so that the full impact, or at least the majority of the impact of the stressors on its financial position could be captured in the projection horizon; and (c) consider whether and when it is appropriate to apply the investment and non￾investment stress parameters, depending on the construct of a relevant scenario. [MAS Notice 126 (Amendment) 2022] 16. An insurer should identify a range of plausible events or changes in market conditions that could affect the insurer’s financial position, by taking into account the insurer’s vulnerabilities. An insurer should consider relevant stress factors such as:

25 (a) investment shocks such as large movements in credit spreads, decline in equity and property prices, changes in sovereign yield curves by major currencies; and (b) non-investment shocks such as a drop in new business premiums, an increase in termination rates and the mass lapse of policies. [MAS Notice 126 (Amendment) 2022] 17. In the construction of the stress scenario, an insurer should consider contagion effects on the assumptions made. Contagion effects refer to the consequential effects on other assumptions relating to the scenario as a result of the interdependence of the assumptions used to construct the scenario. [MAS Notice 126 (Amendment) 2022] Material counterparty stress test 18. In designing the material counterparty stress scenario, an insurer should pay attention to financial sector counterparties, as these may be more likely to contribute to the build￾up of systemic risk. An insurer should consider relevant stress factors such as: (a) which of its material counterparties are more likely to default or experience a deterioration in their credit-worthiness, taking into account the economic conditions at the time of construction of the stress scenario, the industry sector they belong to and the geographic areas they are located in. For example, insurers may assume the default of its largest reinsurer (or retrocessionaire for reinsurers), or a fall in the total reinsurance recoverable on paid and unpaid claims relating to its main reinsurance counterparties; and (b) default by material counterparties in its investment portfolio. For example, insurers may assume the default by issuers of bonds held by the insurer. In considering which material counterparties in its investment portfolio may default, the insurer should also consider the industry sector they belong to and the geographical areas they are located in. [MAS Notice 126 (Amendment) 2022] Liquidity stress test 19. In designing the liquidity stress test, an insurer should consider: (a) a variety of short-term and protracted, market-wide and insurer-specific, liquidity stress scenarios; (b) several time horizons (such as 7 days, 30 days, 90 days or one year) that are relevant to the insurer’s business model, liquidity risk appetite and liquidity risk profile; and

26 (c) any restrictions on selling of assets to generate liquidity such as assets pledged as collaterals or assets in MA portfolios which should not be used to meet the liquidity needs of non-MA portfolios. [MAS Notice 126 (Amendment) 2022] 20. An insurer should identify a range of severe but plausible scenarios that could adversely affect the insurer’s cash in-flows, cash out-flows and overall liquidity position, including by taking into account the insurer’s vulnerabilities. If an insurer assesses that a liquidity stress test based on the immediate horizon (e.g. 7 days or less) is not relevant, the insurer should document its assessment accordingly and may choose to adopt longer term horizons for its liquidity stress testing. The insurer should ensure that the chosen stressors help the management to identify material liquidity risks to the insurer. [MAS Notice 126 (Amendment) 2022] 21. An insurer should assess whether sufficient appropriate liquid assets are available to meet cashflow obligations over the various time horizons used. For example: (a) An insurer should assess whether sufficient assets in the primary bucket are available to meet cashflow obligations within the immediate horizon (i.e. 7 days or less). (b) An insurer should assess whether there are sufficient assets in the primary bucket and assets in the secondary bucket to meet cashflow obligations within short term horizons (i.e. between 7 days and 90 days). In addition to the use of assets in the primary bucket and assets in the secondary bucket, an insurer may consider including a broader spectrum of appropriate assets to assess whether sufficient assets are available to meet cashflow obligations within longer term horizons (i.e. more than 90 days and up to a year). Where such assets are used, an insurer should document its rationale for the use of these assets to meet its cashflow obligations within longer term horizons. [MAS Notice 126 (Amendment) 2022] 22. When analysing its liquidity position, an insurer should include projections which adequately reflect the insurer’s stressed cash flow position and overall liquidity position, taking into account both investment related shocks and non-investment related shock events. Examples of events related to investment related shocks may include a reduction or cessation of dividends and rental incomes, and an increase in collateral requirements arising from margin calls to mark-to-market the collaterals. Examples of non-investment shocks may include a decrease in reinsurance recoveries or a mass lapse of policies with surrender values, and a short-term liquidity crunch due to large claims arising from severe natural catastrophe losses. [MAS Notice 126 (Amendment) 2022] 23. An insurer should account for the possibility of lower realisable values of the liquid assets in the event of stress when determining the liquidity position. An insurer should

27 ensure that these haircuts include the potential costs and financial losses arising from their sale under the various stressed conditions, noting that these may be exacerbated when the insurer is a forced seller (i.e. such assets should be subject to higher haircuts). [MAS Notice 126 (Amendment) 2022] 24. The insurer should ensure that the amount of haircuts applied on the liquid assets reflects the credit quality of the asset, the severity of the stress scenario and the timing of the liquidation. For example, assets in the secondary bucket are expected to incur higher haircuts compared to assets in the primary bucket for the same stress event, and the amount of haircut applied to an asset should increase in proportion to the severity of the stress scenario. Due to the potential for wrong-way risk10, higher haircuts should also be applied to corporate debt and equity securities issued by financial institutions11 compared to such instruments issued by non-financial institutions of similar credit and market risks. The insurer should also document the rationale and amount of haircut applicable to each asset type. [MAS Notice 126 (Amendment) 2022] 25. When deciding on appropriate management actions to be taken in response to the results of liquidity stress testing, an insurer may consider additional management actions such as the activation or establishment of credit facilities, deferment or reduction of dividend payments, and capital injections from its shareholders or head office (in addition to those listed in paragraph 11 of Appendix C). [MAS Notice 126 (Amendment) 2022] 10 The liquidity of corporate debt and equity securities issued by financial institutions tends to be correlated with developments in the financial markets and the broader economy, and holding these instruments may cause greater stress to an insurer’s liquidity position during times of crisis. [MAS Notice 126 (Amendment) 2022] 11 This refers to financial institutions regulated by the Authority and financial institutions regulated in other jurisdictions. [MAS Notice 126 (Amendment) 2022]

28 Reverse stress test 26. In conducting reverse stress testing, an insurer should determine the combination of risk factors that would most likely lead to business failure. 27. An insurer may use reverse stress testing, which identifies scenarios that are most likely to cause the insurer to fail, to enhance risk management. While some risk of failure is always present, such an approach may help to ensure adequate focus on the management actions that are appropriate to avoid undue risk of business failure. The focus of such reverse stress testing is on appropriate risk management actions rather than the assessment of financial adequacy and so may be largely qualitative in nature, although broad assessment of any financial impacts arising from the risk of business failure may help in deciding the appropriate action to take.