Own Risk and Solvency Assessment (ORSA) Guideline – August 2026 — CBTT — TT

OWN RISK AND SOLVENCY
ASSESSMENT (ORSA) GUIDELINE
AUGUST 2026

Own Risk and Solvency Assessment (ORSA) Guideline August 2026
TABLE OF CONTENTS

INTRODUCTION ...........................................................................................................................3
DEFINITIONS.................................................................................................................................5
PURPOSE, APPLICATION AND SCOPE.......................................................................................7
PRINCIPLE OF PROPORTIONALITY..........................................................................................8
ORSA PROCESS.............................................................................................................................9
GROUP ORSA ..............................................................................................................................10
KEY ELEMENTS OF A SOUND ORSA........................................................................................11
7.1 BOARD AND SENIOR MANAGEMENT OVERSIGHT...........................................................11
7.2 SOUND CAPITAL ASSESSMENT AND PLANNING..............................................................13
7.3 COMPREHENSIVE ASSESSMENT OF RISKS .......................................................................16
7.4 STRESS TESTING..................................................................................................................18
7.5 MONITORING AND REPORTING .........................................................................................21
7.6 INTERNAL CONTROLS AND OBJECTIVE REVIEW ............................................................22
7.7 INTEGRATION OF THE ORSA WITH THE ORGANISATION’S RECOVERY PLAN .............23
SETTING THE INTERNAL CAPITAL TARGETS ......................................................................24
ORSA REPORT, KEY METRICS REPORT & ASSOCIATED DOCUMENTS ............................26
SUPERVISORY REVIEW OF THE ORSA ...................................................................................29
SUPERVISORY ACTIONS ...........................................................................................................30
EFFECTIVE DATE AND TIMELINE FOR IMPLEMENTATION OF THE ORSA .....................31
APPENDIX I – RISKS TO BE CONSIDERED IN THE ORSA PROCESS............................................32
INSURANCE RISK.................................................................................................................32
CREDIT RISK ........................................................................................................................33
ASSET CONCENTRATION RISK...........................................................................................34
MARKET RISK ......................................................................................................................35
OPERATIONAL RISK............................................................................................................35
LIQUIDITY RISK...................................................................................................................36
GROUP RISK .........................................................................................................................37
MISMATCHING RISK ...........................................................................................................38
BASIS RISK ...........................................................................................................................38
REPUTATIONAL RISK..........................................................................................................39
STRATEGIC / BUSINESS RISK .............................................................................................40
PENSION RISK ......................................................................................................................40
CLIMATE RISK .....................................................................................................................40
TECHNOLOGY / CYBER RISK..............................................................................................42
OTHER RISK CONSIDERATIONS.........................................................................................43
APPENDIX II - RISK APPETITE STATEMENT (RAS).......................................................................46
APPENDIX III - ORSA REPORT FORMAT ........................................................................................48

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 3 | P a g e

INTRODUCTION
1.1. Solvency 1
is a crucial concept for an insurance organisation and reflects its financial robustness and ability to meet obligations to policyholders even in adverse situations. Solvency is fundamental for promoting trust and confidence, which are essential to an organisation’s reputation, locally and internationally. Consequently, international standards for solvency regulation emphasize the importance of a robust supervisory review process.
1.2. Maintaining solvency contributes to the overall financial stability of the insurance
industry and to the economy. As our insurance industry continues to evolve due to changing market dynamics and emerging risks, the Central Bank of Trinidad and Tobago (“Central Bank/Bank”) has a vital role to play in ensuring, stability, resilience, and long-term sustainability of the insurance industry. As such, the Central Bank must establish a solvency regime to govern the financial soundness and risk management of insurance companies. This includes setting minimum capital requirements, conducting financial risk assessments, implementing stress testing, supervising risk-based capital models, monitoring compliance with prudential standards and enforcing prompt corrective actions. Insurance organisations, therefore, should not rely solely on the regulatory capital framework.
1.3. An efficient solvency regime is important to ensure that each insurance organisation
maintainssound financial practices and risk management strategies for the specific risks they face, including any systemic risks. Therefore, as part of the solvency regime, each organisation must conduct an Own Risk and Solvency Assessment (“ORSA”) to evaluate its specific risk profile and adequacy of its risk management, solvency position and capital resources required over its planning horizon.
1.4. The ORSA is an internal forward-looking dynamic process, which should be integrated
into the insurance organisation’s decision-making framework, as well as its strategic and business planning, and is designed to ensure that organisations can comfortably meet their policyholder obligations under both normal and severe stress scenarios. The 1 See the definition of “Solvency” by the International Association of Insurance Supervisors (“IAIS”) in section 2 of this Guideline, harmonised with the provisions of the IA.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 4 | P a g e ORSA should serve as a management tool to enhance an organisation’s understanding of the interrelationships between its own risk profile and capital needs. The ORSA process should be proportional to the nature, scale, complexity, risks and business strategy of the financial organisation.
1.5. This Guideline 2
outlines the Central Bank’s expectations with respect to an insurance organisation’s ORSA process and the ORSA report.
1.6. The ORSA requirements apply to an insurance organisation on an individual basis in
the case of an individual insurer, and on a consolidated basis where an insurer or FHC is the parent company of a financial group 3 . Where applicable, groups must take into consideration the specific requirements for Group ORSAs included in this Guideline 4 .
1.7. This Guideline should be read in conjunction with the Bank’s Corporate Governance
Guideline which outlines, inter alia, the Central Bank’s expectations with respect to the risk governance framework for insurance organisations. In accordance with the Corporate Governance Guideline, organisations are required to establish a sound risk governance framework 5 , which includes an Enterprise Risk Management (ERM) framework. Insurance organisations will be required to implement the ORSA as a component of its ERM framework. The existence of a robust ERM framework and capital management process enhances the ability of organisations to effectively monitor and manage risks and capital needs on a continuous basis.
1.8. In conducting the ORSA, an insurance organisation shall determine its own capital
needs and establish Internal Capital Targets (ICTs) based on an internal assessment of all material risks. Stress and scenario testing must be an integral component used in an organisation's determination of its ICTs and operating capital level throughout the business cycle. 2 The Central Bank will review this Guideline periodically to ensure that it remains relevant and continues to reflect international best practices, legislative amendments, and significant occurrences in the domestic financial system. 3 Refer to section 3 of this Guideline – Purpose, Application and Scope. 4 Refer to section 6 of this Guideline – Group ORSA. 5 For further guidance on the risk governance framework, refer to the Central Bank’s Corporate Governance Guideline.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 5 | P a g e
2. DEFINITIONS
2.1 “capital planning” means a multidimensional internal process resulting in a plan
presenting a multi-year projection of capital demand and supply of the insurance organisation taking into account its strategy, operational plans and unexpected events.
2.2 “capital management policy” means the principles and guidelines used for capital
planning, capital issuance, usage and distributions. It is a component of capital planning, and includes internal capital goals, quantitative or qualitative guidelines for transactions impacting capital levels such as dividends and stock repurchases, strategies for addressing potential capital shortfalls and identifying sources of capital, and internal governance procedures regarding monitoring, measurement of optimal capital allocation and risk management.
2.3 “diversification benefit” means the extent to which the combined impact of risks
inherent to assets and liabilities is less than the sum of the impacts of each risk considered in isolation.
2.4 “enterprise risk management” or “ERM” means the strategies, policies and
processes of identifying, measuring, monitoring, managing and reporting risks in respect of the insurance organisation’s enterprise as a whole 6 .
2.5 “financial holding company” or “FHC” means a company required to obtain a permit
in accordance with section 51 of the Insurance Act, 2018.
2.6 “insurance organisation” or “organisation” for the purposes of this Guideline refers
to an insurer and a financial holding company.
2.7 “insurer” means a local insurer as defined in the Insurance Act, 2018.
2.8 “Internal Capital Targets” mean the target levels of capital required, based on an
insurance organisation’s own assessment of its capital needs, to cover all material risks associated with current and projected operations. These assessments should be carried 6 Refer to Appendix I – Risks and Other Considerations for a list of key risks that should be considered in the ORSA, and other risk assessment considerations.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 6 | P a g e out both on an individual risk basis as well as on an overall aggregate risk level. Insurance organisations are required to establish ICTs for both net tier 1 capital and total capital 7 .
2.9 “materiality” or “material” for the purposes of this Guideline, refers to the concept
that the information is material if omitting, misstating or obscuring it could reasonably influence decisions and affect the true and fair results of the ORSA.
2.10 “material risk” means a risk that, based on the insurance organisation’s internal
definitions, has a material impact on its overall risk profile and may affect the solvency of the organisation.
2.11 “Own Risk and Solvency Assessment” or “ORSA” is an internal assessment
conducted by an insurance organisation, appropriate to the nature, scale and complexity of the organisation, of all material risks associated with the organisation’s business plan, strategic plan and the sufficiency of capital to support those risks.
2.12 “reverse stress testing” means a stress test which starts from the identification of the
pre-defined outcome including the point of non-viability and then explores scenarios and circumstances that might cause that outcome to occur.
2.13 “risk appetite” means the level and type of risk an insurance organisation is able and
willing to assume in its exposures and business activities given its business objectives and obligations to stakeholders.
2.14 “risk appetite statement” is the written articulation of its risk appetite. It includes
quantitative measures expressed relative to earnings, capital, risk measures, liquidity and other relevant measures as appropriate. It should also include qualitative statements to address reputation and conduct risks as well as financial crime and unethical practices.
2.15 “solvency” is a fundamental financial soundness indicator of an insurance organisation,
including the ability to meet its current and other obligations to policyholders and creditors in the ordinary course of business as they generally become due and the 7 Refer to section 8 - Setting the Internal Capital Targets.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 7 | P a g e holding of sufficient assets to enable payment of all due and accruing obligations. Solvency includes capital adequacy, liquidity, technical provisions, and other components addressed in an enterprise risk management framework.
2.16 “stress testing” means a method of assessment that measures the financial impact of
stressing one or more factors which could severely affect the insurance organisation.
2.17 “technical provisions” mean assets or liabilities that represent the economic value of
the insurance organisation fulfilling its insurance obligations to policyholders. The technical provision corresponds to the current estimate and a margin over the current estimate. The current estimate reflects the present value of projected future cash flows that arise in fulfilling insurance obligations, using unbiased, current assumptions.
3. PURPOSE, APPLICATION AND SCOPE
3.1 This Guideline is made pursuant to sections 82 and 278 of the Insurance Act 2018.
3.2 The purpose of the Guideline is to:
i. provide guidance to insurance organisations on the design of their internal ORSA 8
process, and its relation to the ERM 9 framework and capital management process;
ii. provide guidance on the role of Senior Management and other participants in
performing, monitoring, reporting and reviewing the ORSA; and
iii. ensure that there is proper oversight by the Board of the conduct of the ORSA.
3.3 This Guideline is applicable to the following insurance organisations:
i. insurers on an individual basis;
ii. insurers on a consolidated basis, where the insurer is the parent company of a
financial group, and should include all the entities in the financial group; and
iii. financial holding companies on a consolidated basis, to include its subsidiaries and
companies in which the FHC is a significant shareholder.
8 Group ORSAs should take into account the requirements in section 6 of this Guideline. 9 Also refer to the ERM requirements in the Central Bank’s Corporate Governance Guideline.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 8 | P a g e
3.4 This Guideline takes into account the relevant Insurance Core Principles (ICPs)
promulgated by the International Association of Insurance Supervisors 10 (IAIS), in particular the ICPs which require each insurance organisation to establish:
i. Risk management and internal controls systems as part of its overall corporate
governance framework, including effective functions for risk management, compliance, actuarial matters and internal audit;
ii. Enterprise Risk Management framework for solvency purposes as part of its
risk management system, to identify, measure, monitor, manage, and report, the organisation’s risk exposure in an ongoing and integrated manner; and
iii. Capital adequacy framework for solvency purposes so that the insurance
organisation can absorb significant unforeseen losses and operate at a level that does not trigger supervisory intervention.
3.5 For further guidance and considerations about the identification, assessment,
management and other aspects of risk, insurance organisations must consult applicable Regulations, as well as other guidelines issued by the Central Bank, including but not limited to the following:
i. Insurance (Capital Adequacy) Regulations;
ii. Corporate Governance Guideline;
iii. Reinsurance Risk Governance Guideline for Insurers;
iv. Cybersecurity Best Practices Guideline;
v. Guideline for the Management of Outsourcing Risks;
vi. Credit Risk Management Guideline;
vii. Guideline for the Management of Market Risk; and
viii. Recovery Plan Guideline.
4. PRINCIPLE OF PROPORTIONALITY
4.1 The implementation of the ORSA process should be guided by the principle of
proportionality. This means that the ORSA should be commensurate with the nature, scope, scale and the degree of complexity in the insurance organisation’s 10 The IAIS is an international standard-setting body responsible for developing and assisting in the implementation of supervisory and supporting material for insurance supervision. The mission of the IAIS is to promote effective and globally consistent supervision of the insurance industry in order to develop and maintain fair, safe and stable insurance markets for the benefit and protection of policyholders and to contribute to global financial stability.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 9 | P a g e business activities. Consequently, simple business models should have proportionately simple ORSA processes to guide their capital management and planning.
4.2 The Central Bank expects insurance organisations to update their ORSA process as
necessary to reflect changes in business operations, strategy, and occurrence of material events. For example, increasing complexity in business activities should be accompanied by more sophisticated approaches in designing the ORSA.
4.3 The Central Bank therefore expects that there will be variations in the approaches
adopted by insurance organisations in the design of the ORSA process. Some aspects of the ORSA where differences are anticipated include the:
i. methodologies used in measuring/assessing risks and in determining the
related ICTs;
ii. type and nature of the stress tests adopted;
iii. structure of the insurance organisation’s risk control systems; and
iv. length and complexity of the ORSA Report.
5. ORSA PROCESS
5.1 The main purpose of the ORSA process is for the insurance organisation to identify,
measure, monitor, manage and report all material risks and to ensure that the organisation’s capital resources are sufficient to support those risks at all times and meet its obligations to policyholders when they fall due.
5.2 Every insurance organisation shall perform and document its ORSA 11 to assess the
adequacy of its risk management, own capital needs, as well as its current and projected future solvency and liquidity position, with a time horizon consistent with that used in its business planning (at least 3 years).
5.3 The ORSA should not be a one-time exercise but a continuously evolving process
comprising, among other things, sound and effective corporate governance and risk management frameworks and capital management processes for assessing and 11 Refer to section 9 of this Guideline – ORSA Report / Key Metrics Report / Associated Documents

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 10 | P a g e maintaining adequate and appropriate capital on a forward-looking basis. The ORSA must be implemented as an integral part of the management and decision-making culture of the insurance organisation and must not be treated as a compliance exercise.
5.4 The Central Bank expects that the ORSA would encourage insurance organisations to:
i. implement a sufficiently robust ERM framework to assess all material risks
commensurate with the organisation’s size, business model, complexity, and risk appetite;
ii. develop a Risk Appetite Statement 12;
iii. determine its own capital needs and establish ICTs 13;
iv. develop strategies for achieving those ICTs that are consistent with its business
plans, risk profile and operating environment;
v. hold adequate and appropriate capital to cover potential losses not only under
normal conditions, but also under stressed events that could severely affect the organisation;
vi. incorporate a feedback loop based on relevant information and objective
assessment, which enables the organisation to take the necessary action in a timely manner in response to changes in the risk profile; and
vii. establish a graduated series of capital triggers which serve as early warning
indicators for the Board and Senior Management to take appropriate and immediate actions to avert capital falling below the ICTs or breaching regulatory capital requirements.
6. GROUP ORSA
6.1 The ORSA for an insurance organisation that is part of a financial group should take
into account all material risks to which the organisation is exposed due to its membership in a broader group, including material risks posed by any non-insurance financial entities in the group. These risks include contagion risks, counterparty risks, reputational risks and risks related to operational dependencies such as shared functions and systems. Assessment of capital resources at a group level will need to take into account the transferability of capital between group entities under a range of market conditions. 12 Refer to Appendix II of this Guideline – Risk Appetite Statement. 13 Refer to section 8 of this Guideline – Setting The Internal Capital Targets.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 11 | P a g e
6.2 Where a Group ORSA Report is prepared at the parent level and it includes the
operations of other insurers and related entities in the group, it is expected that the components of that Group ORSA Report applicable to the insurance organisation are consistent with the requirements of this Guideline. The Group ORSA Report must adequately identify the risks, capital needs and ICTs for each insurance organisation in the group, and a Key Metrics Report must be prepared for each insurance organisation. Further, the Board of each insurance organisation in the group must ensure that the Group ORSA is appropriate and meets the required capital standards in relation to the insurance organisation.
6.3 Notwithstanding section 6.2, if an insurance organisation’s business and risk profile,
capital needs and ICTs are not adequately reflected in the Group ORSA Report, the insurance organisation will be required to prepare a separate ORSA Report that covers only the operations of the organisation, and not the operations of its parent or other related entities.
7. KEY ELEMENTS OF A SOUND ORSA
An effective ORSA should comprise, at a minimum, the following key elements:
7.1 Board and Senior Management Oversight;
7.2 Sound Capital Assessment and Planning;
7.3 Comprehensive Assessment of Risks;
7.4 Stress Testing;
7.5 Monitoring and Reporting;
7.6 Internal Control Review; and
7.7 Integration of the ORSA with the Insurance Organisation’s Recovery Plan.
7.1 BOARD AND SENIOR MANAGEMENT OVERSIGHT 14
BOARD OVERSIGHT
7.1.1 The Board has the ultimate responsibility for the sound operation and financial
condition of the insurance organisation. The Board must ensure that the organisation establishes and maintains an appropriate level and composition of capital in line with 14 This section must be read in conjunction with the Central Bank’s Corporate Governance Guideline.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 12 | P a g e regulatory requirements, the entity’s risk profile, and its capital, business and strategic plans.
7.1.2 The Board has several key responsibilities which include, but are not limited to the
following: - a. ensuring that the risk management, compliance and internal audit functions are adequately positioned, staffed and resourced to carry out their responsibilities independently, objectively, and effectively; b. establishing the insurance organisation’s risk appetite and risk limits in collaboration with senior management and the Chief Risk Officer or other Officer having responsibility for the oversight of the organisation’s ERM framework;
c. at least on an annual basis, reviewing the risk appetite and risk limits, to ensure that
the Risk Appetite Statement continues to be appropriate; d. ensuring that adequate and appropriate capital is maintained at all times, as determined by the ORSA process; e. reviewing and approving the main objectives of the ORSA and agreeing on the main assumptions of risk identification and risk measurement; f. reviewing and, where appropriate, challenging the outcomes of the risk management process and stress testing programme; g. ensuring that the risk governance framework outlines the actions to be taken when stated risk limits are breached, including disciplinary actions for excessive risktaking, escalation procedures and notification to the Board; h. consulting with and being satisfied that the decisions and actions of Senior Management and the performance of the organisation are consistent with the Boardapproved business plan, strategy and risk appetite;
i. ensuring that Senior Management is held accountable for the ongoing management
of the organisation’s risks, and that the Board is regularly and adequately informed of material matters, including:
i. proposed changes in business strategy and risk appetite;
ii. the insurance organisation’s performance and financial condition;
iii. breaches of risk limits;
iv. internal control failures; and
j. reviewing and approving the ORSA 15 at least once every twelve (12) months, and when updates are made to the ORSA Report. 15 Also refer to section 9 – ORSA Report / Key Metrics Report / Associated Documents

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 13 | P a g e SENIOR MANAGEMENT RESPONSIBILITIES
7.1.3 Senior Management is responsible for:
a. implementing a well-defined risk management framework and ORSA process. b. determining the capital needs and establishing ICTs 16. Stress and scenario testing must be an integral component used in an insurance organisation's determination of its ICTs and operating capital level throughout the business cycle.
c. establishing an adequate system for monitoring and reporting risk exposures 17, and
for assessing how changes to their risk profile affects the organisation’s capital needs. The review should take into account, inter alia, scenarios used in the capital assessment process, integration with the recovery planning process and the validity of the estimated future capital requirements. d. reviewing the ORSA process periodically to ensure that it remains appropriate relative to the risk profile of the insurance organisation, and in line with material changes to the organisation’s size, complexity, business strategy, markets and regulatory requirements. e. reviewing and updating the ORSA 18 at least once every twelve (12) months and upon the occurrence of material changes or specific trigger events. The review should take into account, inter alia, whether the processes relating to the ORSA successfully achieved the objectives, the continuing relevance of any key components, the reasonableness and validity of any assumptions and scenarios used in the capital assessment process and the validity of the estimated future capital requirements.
7.2 SOUND CAPITAL ASSESSMENT AND PLANNING
7.2.1 Insurance organisations must have a system in place for effective capital assessment
that is sufficiently comprehensive, appropriately forward-looking and adequately formalized.
7.2.2 The insurance organisation’s capital assessment and planning process should enable the
Board and Senior Management to make informed decisions on the appropriate amount, 16 When establishing the ICTs, insurers should have regard to the guidance in section 8 - Setting the Internal Capital Targets. 17 For further guidance, refer to section 7.5 – Monitoring and Reporting 18 Also refer to section 9 – ORSA Report / Key Metrics Report / Associated Documents

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 14 | P a g e type and composition of capital needed to support the organisation’s business strategies across a range of potential scenarios and outcomes.
7.2.3 As part of the capital planning process, the insurance organisation should, inter alia,
take into account the:
a. capital adequacy relative to risks; b. desirable capital level;
c. capital needs for multiple time horizons, which may vary over time with economic,
financial or credit cycles; d. anticipated capital expenditures; e. anticipated balance sheet growth; f. approved dividend policy; g. prospective mergers, acquisitions and/or restructuring; h. potential impact on earnings and capital in the event of an economic downturn and, in particular, the effects of a sudden, sustained downturn; and
i. external capital sources and the potential difficulties of raising additional capital
during downturns or times of stress.
7.2.4 The fundamentals of a sound capital assessment should include:
a. a clear and documented process for evaluating risks and determining whether or not a risk should result in an explicit amount of capital being held; b. policies and procedures designed to ensure that the insurance organisation identifies, measures and reports all material risks;
c. a process for determining the amount and composition of capital required for
current and anticipated future levels of risk, in accordance with the organisation’s risk appetite, strategic focus and business plan; and d. a process of internal controls, reviews and audits to ensure the integrity of the overall risk management process.
7.2.5 Internal capital assessments may be designed in different ways depending on the size,
nature and complexity of operations and level of sophistication of risk management practices. The choice of the methodology should ensure the insurance organisation’s ability to collect the necessary information and calculate the inputs in a reliable manner. The actual calculation and allocation of internal capital should be supplemented by

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 15 | P a g e robust qualitative procedures to identify, measure, monitor and manage all material risks.
7.2.6 There are four fundamental components of a sound capital planning process that should
be considered:
7.2.6.1 Internal Controls and Governance
a. There should be a formalized capital planning process administered through an effective governance structure. Capital plans should be approved by the Board at least annually, and the underlying processes and models should be subject to regular independent validation. b. It is expected that the capital planning process will:
i. produce an internally consistent and coherent view of current and future capital
needs;
ii. reflect the input of different experts from across the insurance organisation;
iii. demonstrate a strong link between the capital planning, budgeting and strategic
planning processes; and
iv. include a formal process for identifying situations where competing
assumptions are made, and differences in strategic planning and capital allocation should be escalated for discussion and approval by Senior Management and, where appropriate, by the Board.
7.2.6.2 Capital Management Policy and Risk Capture
a. There should be a written, Board approved, capital management policy which specifies the principles that management will follow in making decisions on deploying capital. b. The capital management policy should:
i. include a suite of capital and performance-related metrics against which
management monitors the organisation;
ii. identify triggers and limits for every metric specified in the capital
management policy;
iii. incorporate minimum thresholds that are monitored by managers to ensure that
the organisation remains strong;
iv. include an expression of the risk appetite that should be approved and renewed
annually by the Board; and

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 16 | P a g e
v. be supported by a monitoring framework which is complemented by a formal
escalation protocol, that is sufficiently clear and transparent for situations when a trigger or limit is approached and/or breached, and timely decisions need to be taken.
7.2.6.3 Forward-looking View
a. Forward-looking stress testing and scenario analyses should be an integral component of the capital planning process. These techniques provide a forward view on the sufficiency of the capital base and how it could be jeopardized if there were a dramatic institution-specific or economic change; and b. The insurance organisation should conduct forward-looking stress testing on a consistent basis and in ad hoc scenarios outside the normal stress testing procedures 19 .
7.2.6.4 Management Framework for Preserving Capital
a. It is important that actions to maintain capital are clearly defined in advance and that the management process allows for plans to be updated swiftly to allow for better decision-making in changing circumstances; b. The capital planning process should provide information to the Board and Senior Management on the degree to which an insurance organisation’s business strategy and capital position may be vulnerable to unexpected changes in conditions. They are responsible for prioritizing and quantifying the capital actions available to cushion against such changes (for example reduction or cessation of common stock dividends, equity raises and/or balance sheet reductions); and
c. The Board and Senior Management should ensure that the capital management
policy and associated monitoring and escalation protocols remain relevant alongside an appropriate risk reporting and stress testing framework.
7.3 COMPREHENSIVE ASSESSMENT OF RISKS
7.3.1 The ORSA should address all material risks, whether these are explicitly captured in
the regulatory capital framework or not, as well as risks that are not easily quantifiable. 19 Refer to section 7.4 - Stress Testing for further considerations.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 17 | P a g e Such material risks must, at a minimum, include insurance risk, market risk, credit risk, operational risk, liquidity risk, concentration risk, and if applicable, group risk. The ORSA should also give proper consideration to low and immaterial risks that, when combined with other risks, become material. Adequate explanations to justify the conclusions reached on the materiality of risks should be provided, including explanations for risks identified as low or immaterial. External risks such as those arising from business cycle effects and the macroeconomic environment, should also be considered.
7.3.2 The insurance organisation must ensure that its ERM framework identifies and
addresses all reasonably foreseeable, emerging, and other relevant risks that may have an impact on an organisation’s ability to continue operations, in both normal and stressed conditions. The ERM framework must set basic goals, benchmarks and limits with respect to the organisation’s risk appetite.
7.3.3 Insurance organisations must demonstrate how they combine their risk measurement
approaches to arrive at the overall internal capital for the respective risks. The ORSA document must contain the underlying assumptions, processes and key considerations regarding the drivers, assessment, measurement and mitigants in place for each risk. The ORSA should also include any additional capital required for the risks identified having regard to the organisation’s risk management and mitigation strategies.
7.3.4 Appendix I – Risks & Other Considerations - provides guidance on the key risks that
should be considered in the ORSA, and other considerations which may be relevant when assessing risks. It is not intended to be an exhaustive list, and insurance organisations are required to include in their capital assessment, any other material risks to which they are exposed. Organisations should also be mindful of the capital adequacy effects of concentrations, which may arise within each risk type.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 18 | P a g e
7.4 STRESS TESTING
7.4.1 Stress testing is an important tool that should be used by insurance organisations as part
of their enterprise risk management and is a key component in the ORSA process. In particular, stress testing:
a. alerts the management of an organisation to adverse unexpected outcomes related to a broad variety of risks; and b. is used to assess the resilience of an organisation’s financial condition against adverse unexpected outcomes.
7.4.2 Stress testing also supplements other risk management approaches and measures by
playing an important role in:
a. providing forward looking assessments of risk; b. overcoming limitations of models and historical data;
c. supporting internal and external communication;
d. feeding into capital and liquidity planning procedures; e. informing the setting of an organisation’s risk tolerance; f. addressing existing or potential, enterprise-wide risk concentrations; and g. facilitating the development of risk mitigation or contingency plans to lessen the impact of the adverse scenarios.
7.4.3 Stress testing should take account of views from across the company, applied across
business and product lines, and should cover a range of perspectives and techniques, including both quantitative and qualitative analyses.
7.4.4 Each insurance organisation is expected to collaborate with relevant personnel and
subject matter experts such as its actuary, risk officers and business managers to design a stress testing framework appropriate to its own circumstances. The framework must be appropriately documented, including the reasoning and judgements underlying the scenarios chosen and the results of the assessments.
7.4.5 The stress testing required pursuant to the Insurance (Financial Condition Report)
Regulations (FCR Regulations) is used for risk identification and control and assesses threats to an insurance organisation’s financial condition. The ORSA further enhances

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 19 | P a g e an organisation’s understanding of the interrelationships between its risk profile and capital needs - for example, setting ICTs.
7.4.6 Both the financial condition testing in accordance with the FCR Regulations and ORSA
relate risk to capital and are complementary in nature. Therefore, some level of consistency between the processes for the financial condition testing and ORSA is expected. Results of the stress testing pursuant to the FCR Regulations can be incorporated, referenced and/or used in the ORSA.
7.4.7 At a minimum, stress testing for ORSA must be consistent with the relevant
requirements in the Act, regulations and guidelines, and must contain an assessment of capital adequacy and liquidity under adverse scenarios against a variety of capital ratios, including regulatory capital ratios, as well as ratios based on ICTs.
7.4.8 The stress testing process should examine the impact of shocks to different risk
categories within the book of business of an insurance organisation. These shocks must consist of sufficiently stressed adverse scenarios that could severely affect the organisation, such as those scenarios that could generate the worst damage in terms of losses and impact on reputation. The process should include analyses of single-risk adverse scenarios, integrated scenarios, and reverse stress testing 20 .
7.4.9 Insurance organisations should also perform reverse stress testing, which is a risk
management tool used to increase an organisation’s awareness of its business model vulnerabilities. Reverse stress testing should be appropriate to the nature, size and complexity of the organisation’s business plans and of the risks it bears.
7.4.10 Where reverse stress testing reveals that an insurance organisation’s risk of business
failure is unacceptably high, the organisation should devise realistic measures to prevent or mitigate the risk of business failure, taking into account the time that it would have to react to these events and implement those measures.
7.4.11 In carrying out its reverse stress testing, an insurance organisation should consider
scenarios in which the failure of one or more of its major counterparties or a significant 20 Refer to section 7.3 - Comprehensive Assessment of Risks and Appendix I for examples of risks to be considered.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 20 | P a g e market disruption arising from the failure of a major market participant, whether or not combined, would cause the organisation to fail.
7.4.12 To enable the users of the ORSA report to clearly understand the stress tests, how the
outputs were derived, and to challenge the findings, the following details need to be described:
a. a complete explanation of assumptions (including their quantification) behind each stress test, and assumed management actions within the explanation of each stress test; b. the impact of each stress test on the Internal and Regulatory Capital Ratios before and after management actions; and
c. the return periods of each stress test, given that stress tests might be considered at
different return periods (e.g. 1-in-10 or 1-in-200 year event).
7.4.13 The stress-testing programme should be proportionate to the nature, size, complexity
and risk profile of the insurance organisation’s activities. When implementing the organisation’s stress testing programme – a. The Board must:
i. ensure that stress testing is an integral part of the risk management
framework;
ii. approve the stress testing programme, as well as any subsequent changes;
iii. be informed, regularly and in writing, of the main findings of the stress tests
and the implications on the organisation’s business continuity, capital needs and solvency, considering the organisation’s risk appetite and overall strategy; and
iv. consider the possible risk mitigation strategies.
b. Senior Management and/or person in charge of stress testing must:
i. document the stress testing programme, and ensure that the programme is
approved by the Board;
ii. review the appropriateness of the methodologies, and the accuracy and
completeness of the financial and quantitative data inputs;
iii. assess the reasonableness and validity of the ORSA results, including the
embedded assumptions and inputs from stress tests, scenarios, models and other methodologies and tools used in the assessment process;

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 21 | P a g e
iv. ensure that stress testing is sufficiently severe to gauge the insurance
organisation’s preparation for the scenarios chosen, and incorporate stress test results into the Risk Appetite Statement, assessment of long-term strategies, and determination of internal capital needs;
v. update the Board on the stress testing findings and emerging issues;
vi. assist in the development of risk mitigation strategies;
vii. identify inconsistencies, contradictions, and possible gaps in stress tests
with a view to making improvements to the stress testing programme; and
viii. revise stress-testing techniques to reflect emerging risks that the
organisation may face.
7.5 MONITORING AND REPORTING
7.5.1 Insurance organisations should establish an adequate system for monitoring and
reporting risk exposures and for assessing how changes to their risk profile affects the organisations’ capital needs.
7.5.2 Insurance organisations should have management information systems that are
commensurate with their size, complexity and risk. These systems should facilitate the timely, adequate and accurate identification, measurement and monitoring of risks by Senior Management, have the capacity to detect limit breaches, and supported by procedures to report and rectify such breaches.
7.5.3 Insurance organisations should consistently monitor their internal and external
environment and consider current and forecasted business operations to determine issues that may impact their ORSA and associated ICTs.
7.5.4 The ORSA should allow Senior Management to:
a. evaluate the level and trend of all material risks and their impact on capital levels; b. evaluate the sensitivity and reasonableness of the assumptions used in the capital assessment measurement system;
c. determine whether the organisation is holding sufficient capital for its various risks
and is compliant with established capital adequacy goals; d. assess the future capital requirements based on the organisation’s reported risk profile and make necessary adjustments to the organisation’s strategic plan;

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 22 | P a g e e. evaluate the adequacy of capital using stresses and scenarios; f. put suitable monitoring procedures in place to be able to proactively manage risks; and g. determine whether the company’s risk register should be updated with the new risk(s) identified in the ORSA report.
7.5.5 Senior Management should, at least once a year, ensure that the ORSA related processes
successfully achieve their objectives, and that appropriate changes are made to ensure that the underlying objectives are achieved, if needed.
7.5.6 The Board should receive from Senior Management information on all potential
material risks facing the insurance organisation, including those relevant to the entity’s risk profile, capital and liquidity needs. Information should be comprehensive, accurate, complete and timely.
7.5.7 The Board should, at least once a year, assess and document whether the processes
relating to the ORSA implemented by the insurance organisation successfully achieve the objectives that it envisaged.
7.6 INTERNAL CONTROLS AND OBJECTIVE REVIEW
7.6.1 The internal control structure of an insurance organisation is essential to the quality of
its ORSA. Appropriate systems should be implemented to continuously assess the organisation’s risks and capital level, and monitor compliance with internal policies. Internal control systems should be adequate to ensure well-ordered and prudent conduct of the business.
7.6.2 The ORSA process, including the ORSA report, should be subject to periodic objective
reviews by an internal/external auditor or by a skilled and experienced internal/external resource or individual, who reports directly to the Board, to verify its integrity, accuracy, and reasonableness, at least every three (3) years or upon the occurrence of specific trigger events or material changes.
7.6.3 An objective reviewer should not be responsible for, nor have been actively involved
in the part of the ORSA that it reviews. For example, where the internal auditor is not

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 23 | P a g e otherwise involved in the process, the ORSA may be included in the internal audit plan so that it is covered within the audit cycle.
7.6.4 Areas that should be considered in the objective review include:
a. the comprehensiveness and appropriateness of the insurance organisation’s assessment process given the nature, scale and complexity of its activities, the soundness of the controls underpinning it and the regulator’s expectations with respect to the ORSA process; b. the governance mechanisms related to the assessment and review by the insurance organisation of group processes used in its operations, where the organisation uses a Group ORSA;
c. identification of large exposures, risk concentrations, dependencies and
interactions; d. appropriateness of the methodologies, distributions and measures, and accuracy and completeness of data inputs into the organisation’s assessment process; e. reasonableness and validity of the ORSA results, including the embedded assumptions and inputs from stress tests, scenarios, models and other methodologies and tools used in the assessment process; f. reasonableness of the individual risk and other components and overall ORSA results; g. consistency of the ORSA with an insurance organisation’s risk limits and appetite; h. appropriateness of the documentation that supports the ORSA and the contents of the ORSA report;
i. effectiveness of information systems that support the ORSA; and
j. consistency and linkages of the ORSA process and results with the risk management, strategic, business and capital planning processes.
7.7 INTEGRATION OF THE ORSA WITH THE ORGANISATION’S RECOVERY PLAN
7.7.1 The insurance organisation shall ensure that its ORSA is fully aligned with, and directly
informs, the Recovery Plan (RP). Both documents must reflect a coherent view of the organisation’s risk profile, capital needs, including alignment of assumptions, stress scenarios, capital triggers, governance, and feedback mechanisms.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 24 | P a g e
7.7.2 Assumptions used in the ORSA must be consistent with those used in the RP. This
includes macroeconomic conditions, market movements, claims trends, lapse behaviour, and management actions.
7.7.3 Stress tests and scenarios used in the ORSA must be aligned with or mapped to those
in the RP. The insurance organisation shall document how ORSA stresses link to RP triggers and recovery options.
7.7.4 The insurance organisation is required to ensure that capital-based triggers and early
warning indicators in the RP are calibrated using ORSA metrics and must link RP triggers to ORSA solvency measures, including risk appetite thresholds, capital targets, and forward-looking solvency projections.
7.7.5 Governance structures for the ORSA and RP must be coordinated and consistent
including board oversight, escalation procedure and decision-making authorities.
7.7.6 A formal feedback loop between ORSA and RP must be implemented. Where RP
testing reveals unrealistic assumptions, weak recovery options, or insufficient capital buffers, the insurance organisation must revise ORSA capital targets, strengthen the risk appetite, or adjust stress scenarios. Similarly, ORSA findings must inform updates to the RP.
7.7.7 The insurance organisation shall maintain documentation demonstrating ORSA–RP
alignment, including:
a. A mapping document linking ORSA components to RP components; b. Evidence of Board review and challenge; and
c. Summary of changes made to either document as a result of alignment assessments.
8. SETTING THE INTERNAL CAPITAL TARGETS
8.1 As a key part of the ORSA, insurance organisations are required to set ICTs that are
above the minimum regulatory capital ratios. These targets should be expressed as a percentage of the capital requirements, and insurance organisations should ensure that it maintains capital levels that are at least at the level of the ICT to ensure sufficient capital to support their risk profile as determined through the ORSA process.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 25 | P a g e
8.2 ICTs capture a broader range of risks commensurate with the organisation’s risk profile
and should take into account all material risks, as well as unforeseen events. ICTs represent the amount of capital required, based on an insurance organisation’s own assessment of its capital needs, to cover all material risks associated with its current and projected operations.
8.3 In setting ICTs, an insurance organisation should assess the adequacy of its capital
resources for supporting its current risk profile and enabling it to continue its operations in the normal course, under varying degrees of stress and under a wind-up scenario. Insurance organisations should also consider its target capital composition/mix and its assessment of the characteristics and quality of capital resources when setting its ICTs. Organisations can refer to the qualifying criteria in the Insurance (Capital Adequacy) Regulations.
8.4 An insurance organisation should consider both bottom-up (for example, by summing
capital amounts for individual risks) and top-down (for example, via stress testing of the overall capital position) perspectives on the adequacy and composition of its capital.
8.5 Insurance organisations are required to establish ICTs for net tier 1 capital, and for the
total capital. Net tier 1 capital should serve to reduce the likelihood of insolvency, both in normal times and during periods when the insurer is under stress. The ICT ratios should be set above the minimum regulatory capital ratios specified in the Insurance (Capital Adequacy) Regulations or by the Inspector of Financial Institutions as follows:
a. The ICT ratio for net tier 1 capital must be more than the minimum regulatory net tier 1 ratio; and b. The ICT ratio for total capital must be more than the minimum regulatory capital ratio.
8.6 The Board should satisfy itself that the capital targets are in line with the insurance
organisation’s risk appetite. The following are examples of what should be considered in setting ICTs:
a. regulatory capital requirements; b. internal assessments of capital needs, including those arising from the organisation’s business plans and strategy, and stress testing results;
c. the likely volatility of profit and the capital surplus;

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 26 | P a g e d. the dividend policy; e. where relevant, ratings agency assessments; and f. access to additional capital.
8.7 At the Central Bank’s request, an insurance organisation will be required to justify their
ICT ratios and document their explanations with appropriate data and methodologies. An organisation may be required to reassess its ICT ratios if the justifications do not demonstrate to the Central Bank’s satisfaction that the ICT ratios submitted are relevant and sufficient.
8.8 The Central Bank must be notified in writing within five (5) business days of approved
changes to an organisation’s ICT Ratios.
8.9 Insurance organisations are expected to operate at capital levels above the ICTs and
maintain sufficient capital to support their risk profile as determined through the ORSA process.
8.10 The Central Bank understands that an insurance organisation's capital resources may
fall below its ICTs. If this happens or is anticipated to happen within two (2) years based on financial forecasts or other reports (e.g. projections of very likely scenarios), then the organisation should inform the Central Bank promptly and provide plans on how it expects to manage the risks and/or restore its capital resources to its ICTs within a reasonable period of time.
9. ORSA REPORT, KEY METRICS REPORT & ASSOCIATED DOCUMENTS
9.1 The main purpose of the ORSA Report is to apprise the Board of the insurance
organisation on the full spectrum of its material risks, how the organisation intends to mitigate those risks and how much current and future capital should be maintained, given its risk profile and strategic/business plans with a time horizon consistent with that used in its business planning (at least 3 years).
9.2 The Central Bank expects insurance organisations to demonstrate via the ORSA Report,
the insurance organisation’s ORSA process, approach to capital management, and how the output of the ORSA supports strategic decisions.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 27 | P a g e
9.3 The ORSA Report must be formally documented and include sufficient information
about the process, underlying principles, methodologies, and key assumptions used to assess and quantify the risk exposures, as well as the overall results relative to the insurance organisation’s risk appetite, strategic and operational plans, and capital management framework 21 .
9.4 A Key Metrics Report (KMR) must also be prepared, which provides a summary of the
results of the ORSA, as well as a comparison with regulatory capital 22 . SUBMISSIONS TO THE BOARD OF DIRECTORS
9.5 The ORSA Report and KMR must be updated at least once every twelve (12)
months by Senior Management and submitted to the Board for its review and approval within six (6) months after the financial year end 23. It is also expected that the ORSA Report and KMR will be updated by Senior Management and approved by the Board upon the occurrence of specific trigger events or material changes, taking into account, inter alia:
a. changes in the business, strategy, nature, scale or complexity of activities, or operational environment; b. whether the processes relating to the ORSA successfully achieved the objectives;
c. the continuing relevance of key components;
d. the reasonableness and validity of assumptions and scenarios used in the capital assessment process; and e. the validity of the estimated future capital requirements. SUBMISSIONS TO THE CENTRAL BANK
9.6 The first Board-approved ORSA Report (using audited data for the 2025 financial
year end or more recent audited data where applicable) must be submitted to the Central Bank within 14 months from the date of issuance of this Guideline 24 , together with all associated documents listed in 9.7 below. 21 Refer to Appendix III – ORSA Report Format. 22 Refer to the Key Metrics Report (KMR) template on the Central Bank’s Website. 23 Except for the first submission, which is addressed in 9.6 below. 24 Refer to the implementation timelines in section 12.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 28 | P a g e
9.7 At a minimum, the following associated documents as are relevant must be submitted
with the ORSA Report (unless already submitted separately):
a. Key Metrics Report (KMR); b. Extract of the minutes of the Board meeting(s) certified by the Corporate Secretary, that details the Board’s deliberations and approval of the ORSA Report and KMR;
c. capital plan;
d. business model; e. business and strategic plans; f. risk governance and risk management frameworks; g. risk appetite statement 25; h. stress-testing programme;
i. risk data, including key risk indicators;
j. any aggregation methodologies; k. details of the management information systems; and
l. objective reviewer report covering the ORSA 26
.
9.8 After the first ORSA submission, insurance organisations will be required to
submit:
a. Annually and within six (6) months after the financial year end:
i. A copy of the KMR; and
ii. An extract of the minutes of the Board meeting(s) certified by the Corporate
Secretary, that details the Board’s deliberations and approval of the ORSA Report and KMR. b. According to the stipulated timelines that will be specified by the Central Bank:
i. A copy of the Board-approved ORSA Report; and
ii. All associated documents.
c. Upon request, which may be outside of the stipulated timelines specified in this
Guideline or otherwise, an updated Board-approved ORSA Report and associated documents, should there be any major change to its business model, operations, markets, the economy, or any other aspect that may significantly impact the risk profile as determined by the Central Bank. 25 Refer to Appendix II – Risk Appetite Statement. 26 Refer to section 7.6 – Internal Controls and Objective Review. The Objective Reviewer Report is required at least every three (3) years or upon the occurrence of specific trigger events or material changes.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 29 | P a g e
10. SUPERVISORY REVIEW OF THE ORSA
10.1 As part of the Central Bank’srisk-based supervisory framework, the Bank may consider
the company’s ORSA and associated documents in its assessment of inherent risks and risk management practices, to ensure that insurance organisations have implemented an appropriate ERM framework to identify, measure, monitor, manage and report their risks, and are maintaining adequate and appropriate forms of capital to support all material risks. An organisation’s ORSA is not required to be approved by the Central Bank.
10.2 The supervisory evaluation is intended to generate an active dialogue between
insurance organisations and the Central Bank, and when excessive risks, insufficient capital or deficiencies are identified; prompt and decisive action must be taken to reduce risk, address deficiencies or restore capital.
10.3 The Board and Senior Management must be able to justify why their ORSA is
considered appropriate for the organisation (e.g. methodology used, effectiveness of the capital model applied, key assumptions, results of the assessment, sources of data, etc.) and demonstrate that they have:
a. implemented a well-designed enterprise risk management framework; b. appropriately considered and accounted for all material risks that should be reasonably known, as well as the potential impact of unforeseen events such as economic downturns; and
c. evaluated their capital adequacy relative to the risks identified.
10.4 The Central Bank may request and review the ORSA report and associated documents,
in its assessment of the risk profile of an insurance organisation.
10.5 In conducting the ORSA reviews, the Central Bank will have regard to, inter alia, the:
a. soundness of the overall ORSA given the nature and scale of business activities; b. degree of management involvement in the process e.g. whether target and actual capital levels are monitored and reviewed by the Board;
c. extent to which the internal capital assessment is used routinely within an insurance
organisation for decision-making purposes;

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 30 | P a g e d. results of sensitivity analyses and stress tests conducted and how these results relate to capital plans and internal targets; e. degree to which internal targets and risk assessments incorporate the full range of material risks faced; f. manner in which business risks and activities are aggregated; g. quality of an insurance organisation’s management information systems; and h. relevance and appropriateness of the amount and composition of capital determined by the ORSA process.
10.6 The Central Bank may, where necessary, request further information, and meet with the
Board and Senior Management of insurance organisations in order to evaluate fully the comprehensiveness of the ORSA and the adequacy of the governance framework.
11. SUPERVISORY ACTIONS
11.1 Insurance organisations are expected to have sufficient capital above their own ICTs,
to support their risk profile as determined through the ORSA process. Organisations must also have robust capital recovery plans in place in the event that capital has or is expected to fall below their own ICTs. If the Central Bank identifies any areas of concern, the Bank will engage in dialogue with the insurance organisation regarding the ORSA results and take appropriate action if the concerns are not satisfactorily addressed in a timely manner.
11.2 The Central Bank will use the combination of options best suited to the circumstances
of the insurance organisation and its operating environment, keeping in mind its mandates to ensure financial stability, the safe and sound operations of the insurer organisation and to protect the interest of policyholders. The Central Bank will consider a range of other options/actions as outlined in the Central Bank’s Supervisory Ladder of Intervention Policy, including but not limited to:
a. intensified monitoring and reporting; b. restriction or prohibition of certain activities;
c. restriction or prohibition of the payment of dividends; and
d. requiring the preparation and implementation of a satisfactory capital restoration plan.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 31 | P a g e
11.3 The insurance organisation should not regard capital as a substitute for addressing
fundamentally inadequate controls or risk management processes. The Central Bank may require that organisations implement risk mitigating measures including strengthening risk management, applying internal limits, holding additional financial resources, and improving internal controls etc. that are commensurate with their risk exposures, size and complexity.
12. EFFECTIVE DATE AND TIMELINE FOR IMPLEMENTATION OF THE ORSA
12.1 This Guideline comes into effect on the date of its issuance. This section establishes
the timeline for the implementation of the ORSA process, adoption of relevant policies, and submission of the first ORSA Report and associated documents. Also refer to
section 9 for further details pertaining to the ORSA Report, Key Metrics Report and
associated documents.
12.2 Within 6 months from the date of issuance, insurance organisations are required to
submit a Board-approved Action Plan, which includes a comprehensive timeline for implementation and conduct of the ORSA.
12.3 Within 9 months from the date of issuance 27
, insurance organisations are required to submit Board-approved:
a. ERM Policy; b. Capital Management Policy;
c. Asset Liability Management Policy; and
d. Dividend Policy.
12.4 Within 14 months from the date of issuance, insurance organisations will be required
to submit:
a. The first Board-approved ORSA Report (using data for the 2025 financial year end or more recent audited data where applicable); and b. All associated documents as per section 9.7. 27 Subsequent submissions will be required when there are amendments/updates made in normal course of business.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 32 | P a g e
APPENDIX I – RISKS TO BE CONSIDERED IN THE ORSA PROCESS
The risk considerations contained within this Appendix are intended to provide broad guidance to insurance organisations for the purposes of the ORSA. It is not an exhaustive list of risk exposures.

INSURANCE RISK
a. Insurance risk is the risk that unexpected changes in assumptions of underwriting, product design, pricing and claims settlement may adversely impact on an insurance organisation’s capital resources, and expose the entity to financial loss and consequent inability to meet its liabilities. b. The ORSA should address insurance risk since it is inherent in the business of insurance, given the potential for claims or payouts to be made to policyholders or beneficiaries.
c. The occurrence of adverse events under specified perils and conditions covered by the
terms of an insurance policy result in the organisation’s exposure to insurance risk. When assessing insurance risk, insurance organisations should take into consideration the following uncertainties:
i. the ultimate amount of net cash flows from premiums, commissions, claims,
payouts, and related settlement expenses,
ii. the timing of the receipt and payment of these cash flows, and
iii. policyholder behaviour.
d. Note that while such insurance business can contribute to an insurance organisation’s investment portfolio, investment returns are not elements of insurance risk. e. Insurance organisations should also consider insurance concentration risk since the entity may be exposed to the possibility of significant losses across its portfolio as a result of natural and non-natural perils and/or other accumulations of losses arising from a common dependent source. In assessing insurance concentration risk, the following information should be considered:
i. geographical concentration of insurance risk;

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 33 | P a g e
ii. economic sector concentration of insurance risk;
iii. extent to which the risk is reduced by reinsurance transfer; and
iv. risk concentration inherent in reinsurance cover.
f. Note that the geographical concentration of premiums may be based on where the insured risk is located rather than where the business is written. Where material, the organisation should disclose its highest premium concentration ratios in respect of reinsurers which the entity engages.
2. CREDIT RISK
a. Credit risk is the risk that a counterparty will fail to meet its obligations in accordance with agreed terms. It entails the risk of adverse changes in the value of the insurance organisation’s capital resources, resulting from a counterparty’s inability or unwillingness to meet its contractual obligations. b. The ORSA should consider the credit risk to counterparties such as reinsurers, issuers of securities, agents, brokers, policyholders, debtors, and guarantors. Insurance organisations should consider credit risk mitigation techniques such as limiting or diversifying its exposure, or holding additional capital.
c. Reinsurance credit risk is an important consideration for insurance organisations. It is
the risk that ceded reinsurance balances will not be collected. Reinsurers may face solvency issues leading to delayed payment or default, and this can have significant consequences for the solvency and liquidity of the ceding insurer. Therefore, ceding insurers must ensure that the credit risk posed by reinsurers is aligned with the entity’s risk appetite, and reflected in its capital adequacy assessment, as well as its ORSA. d. Credit concentration risk calculations should be performed at the counterparty level (i.e. large exposures), at the portfolio level (i.e. sectoral and geographical concentrations) and at the asset class level. e. An insurance organisation’s credit risk assessment should consider:
i. risk rating systems;
ii. portfolio analysis/aggregation;

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 34 | P a g e
iii. large exposures and risk concentrations; and
iv. securitization and complex structured instruments.
f. The sophistication of the methodologies used to quantify credit risk should be appropriate to the scope and complexity of the insurance organisation’s activities, and at minimum, take into consideration:
i. historical loss experience;
ii. forecast and past economic conditions; and
iii. attributes specific to a defined group of borrowers.
3. ASSET CONCENTRATION RISK
a. Concentration risk means the risk that any single exposure or group of exposures with the potential to produce losses large enough relative to an insurance organisation’s capital, total assets, or overall risk level may threaten an organisation’s health or ability to maintain its core operations. Asset concentration risk is brought about by a deficiency in the diversification of the insurance organisation’s portfolio of assets. It is noted that asset concentration risk arising from the limited availability of suitable domestic investment vehicles in the jurisdiction may be an issue. b. When assessing asset concentration risk for the ORSA, the following should be considered:
i. investment products/type of asset;
ii. credit rating;
iii. issuer/counterparty or related entities of an issuer/counterparty;
iv. financial market;
v. sector;
vi. geographical area;
vii. aggregate exposure to related entities; and
viii. different types of exposures to the same entity or group.
c. An insurance organisation may also incur a concentration to a particular asset type
indirectly through investments backed by such assets (e.g. collateralized debt obligations).

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 35 | P a g e
4. MARKET RISK
a. Market risk is the risk of loss or adverse change in the value of capital resources arising from the volatility of market prices of assets or changes in the valuation of liabilities. Insurance organisations should have methodologies to assess and actively manage all material market risks and should be able to identify risks resulting from movements in market prices (equity prices, interest rates and exchange rates). For general insurers, market risk relates to the portfolios of marketable assets held, but may also be related to assumptions used for claims inflation. Similarly, for long-term insurers, the market risk in the asset portfolios is linked to the various economic assumptions used to value the liabilities, in particular the rate at which those liabilities are discounted. b. An insurance organisation should also use stress testing to determine the potential effects of market events, economic shifts, and changes in interest rates, foreign exchange and liquidity conditions. The market shocks applied in stress tests must reflect the nature of portfolios and the time it could take to manage risks under severe market conditions.
5. OPERATIONAL RISK
a. Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events and includes legal risk 28, but excludes strategic and reputational risk. b. An insurance organisation’s exposure to operational risk arises from its daily operations in which there can be deficiencies or breakdowns in transaction processing, fraud, physical security, AML/CFT, data/information security, information technology systems, modelling and outsourcing. It can also include a specific, unanticipated event such as court interpretations of a contract liability, loss of key personnel, natural disasters 29 , and cyber-attacks 30 .
c. As part of the ORSA process, the ERM framework must incorporate a robust process
for assessing and managing operational risk, and evaluating capital required. Failure 28 Legal risk is the risk that an insurer may be adversely affected due to legal uncertainty that can arise from unenforceable contracts, change in laws or regulations, or failure to properly comply with legislation. 29 Also refer to the section on Climate Risk below. 30 Also refer to the section on Cybersecurity Risk below.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 36 | P a g e to properly manage operational risk may expose the organisation to significant losses and may allow other types of risk, such as market or credit risk to be excessive. d. When assessing operational risk, the insurance organisation must:
i. have policies outlining the organisation’s approach to identifying, assessing,
monitoring and controlling/mitigating operational risk;
ii. consider the organisation’s appetite and tolerance for operational risk, and the
extent and manner in which operational risk is transferred outside the entity;
iii. analyse the effects of extreme events and shocks relating to operational risk, for
example a sudden increase in failed processes across business units or a significant incidence of failed internal controls.
6. LIQUIDITY RISK
a. Liquidity risk refers to the risk that an insurance organisation is unable to realize its investments and other assets in a timely manner in order to meet its financial obligations, including collateral needs, when they become due, without disrupting its operations and without incurring substantial losses. b. Each insurance organisation must have adequate systems in place for measuring, monitoring, and controlling liquidity risk. Insurance organisations should evaluate the adequacy of capital given their own liquidity profile and the liquidity of the markets in which they operate.
c. The ORSA must include the relationship between liquidity and capital. Liquidity is
critical to the ongoing viability of an insurance organisation, and the organisation’s capital positions can also affect the ability to obtain liquidity, especially in a crisis. d. Insurance organisations should consider both funding liquidity risk and market liquidity risk. Funding liquidity risk is the risk that an organisation will not be able to meet adequately both expected and unexpected current and future cash flow and collateral needs without affecting either daily operations or financial condition. Market liquidity risk is the risk that an organisation cannot easily offset or eliminate a position at the market price because of inadequate market depth or market disruption.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 37 | P a g e e. Insurers must also assess the impact of reinsurance programmes on their liquidity. Reinsurance does not remove the ceding insurer’s underlying legal liability to its policyholders. The ceding insurer remains liable to fund all valid claims under contracts of insurance it has written, regardless of whether they are reinsured or not. For this reason, a large claim or series of claims could give rise to cash flow challenges, if there are delays in collecting from reinsurers or in the ceding insurer providing proof of loss to reinsurers. Therefore, ceding insurers are required to take appropriate measures to manage their liquidity risk, including funding requirements in adverse circumstances.
7. GROUP RISK
a. Group risk refers to the risk that the financial condition of a group or legal entity within the group may be adversely affected by a group-wide event, an event within a legal entity, or an event external to the group, and may be financial or non-financial in nature. b. Group risk can arise through contagion, leveraging, double or multiple gearing, concentrations, large exposures, complexity, participations, loans, guarantees, risk transfers, liquidity, outsourcing arrangements and off-balance sheet exposures.
c. The inter-relationships among legal entities within a group can influence the impact of
the risks on the legal entity. Therefore, such inter-relationships should be taken into account in managing the risks of an insurance organisation within the group and in managing the risks of that group. d. The insurance organisation’s ERM framework is expected to address direct and indirect inter-relationships between legal entities within the group, if applicable. These interrelationships should be clearly defined and understood to enable them to be more accurately integrated in the group-wide solvency assessment. e. Risks from all parts of a group, including non-insurance legal entities (regulated or unregulated) and partly-owned entities should be taken into account when managing group risk. It should also be noted that assumptions implicit in the solvency assessment of an insurance organisation may not apply at a group level as a result of separation of legal entities within the group.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 38 | P a g e f. It is expected that a Group ORSA should:
i. include all reasonably foreseeable and relevant material risks arising from every
legal entity within the group, and from the widest group to the extent that they impact the insurance organisation;
ii. take into account the fungibility of capital and the transferability of assets within
the group, and ensure capital is not double counted;
iii. account for diversification in the group, and be able to demonstrate how the
diversification benefit would be impacted and/or maintained in a stress situation; and
iv. consider potential changes in group structure.
8. MISMATCHING RISK
a. Mismatching risk refers to the risk that the future cash flows which are generated by insurance organisation’s assets do not suitably match the timing or magnitude of cash flow demands of corresponding liabilities. b. When conducting the ORSA, the ERM framework should have an explicit Asset Liability Management (ALM) Policy and the ALM disclosures should include information on:
i. the ALM methodology and key assumptions employed in measuring assets for
ALM purposes; and
ii. sensitivity of regulatory capital resources and provisions held as a consequence
of a mismatch between assets and liabilities.
9. BASIS RISK
a. Basis risk refers to the risk that returns on instruments of varying types, credit quality, marketability, liquidity and/or maturity do not move together. Therefore, insurance organisations may be exposed to market value variation of assets and/or hedges that can be independent of liability values. b. For example, when insurers utilize reinsurance to transfer insurance risk to a reinsurer, it creates other risks such as credit, operational and basis risk. For ceding insurers, basis risk refers to the risk that the actual loss experience is different from the compensation

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 39 | P a g e received from the reinsurer. Ceding insurers should consider the degree of basis risk that is assumed, and what implications this could have for the entity’s financial position in cases of losses. A ceding insurer’s risk and capital management strategies should clearly articulate the part played by reinsurance, in particular the risk concentration levels and ceding limits as defined by the ceding insurer’s risk appetite; and the mechanisms to manage and control relevant risks. Basis risk is also common in other insurance products, such as parametric and indemnity insurance.
10. REPUTATIONAL RISK
a. Reputational risk refers to the risk arising from negative perception on the part of policyholders, counterparties, shareholders, investors, regulators or other relevant parties that can adversely affect an insurance organisation’s ability to maintain existing or establish new business relationships, and continued access to sources of funding. b. Reputational risk often arises because of inadequate management of other risks including insurance, market, credit, and operational risks, whether they are associated with direct or indirect involvement in the sale or origination of complex financial transactions or relatively routine operational activities.
c. Reputational risk can lead to the provision of implicit support, which may give rise to
credit, liquidity, market and legal risk; all of which can have a negative impact on an insurance organisation’s earnings, liquidity and capital position. d. An insurance organisation should identify potential sources of reputational risk to which it is exposed. This includes the organisation’s business lines, liabilities, affiliated operations, off-balance sheet activities and markets in which it operates. The risks that arise should be incorporated into the insurance organisation’s risk management process and appropriately addressed in its ORSA and liquidity contingency plans. e. Insurance organisations should have in place appropriate policies to identify sources of reputational risk when entering new markets, products or lines of activities. In addition, an organisation’s stress testing procedures should take account of reputational risk, so management has a firm understanding of the consequences and second round effects of reputational risk.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 40 | P a g e
11. STRATEGIC / BUSINESS RISK
a. Strategic or business risk refers to the current or prospective risk to earnings and capital arising from imperfections in business strategy formulation, inefficiencies in implementing business strategy, non-adaptability or less adaptability with the changes in the business environment and adverse business decisions. b. Strategic/business risks may impact on the capital of an insurance organisation as a result of adverse business decisions, improper implementation of those decisions, or a lack of responsiveness to political, fiscal, regulatory, economic, cultural, market or industry changes.
c. Insurance organisations should constantly review and assess the compatibility of their
strategic goals with the prevailing environment in which they have material operations. There will be both quantitative and qualitative dimensions to the resources needed to carry out business strategies. These include effective communication channels, efficient operating systems, reliable delivery networks, and good quality management and staff.
12. PENSION RISK
a. Pension risk is the risk of a change (up or down) in the plan’s funding deficit or surplus and the resulting change in the plan’s funding ratio for any occupational pension arrangements for which the insurer is financially responsible.
13. CLIMATE RISK
a. Climate risk refers to the risk emanating from the effects of climate events such as extreme weather, temperature increases, epidemics and changes in the earth’s ecosystems. b. The linkages between climate change and financial system risk are becoming increasingly evident. For example, climate change may exacerbate insurance, credit, market, operational and reputational risk. The risks to insurance organisations have uncertain and extended time horizons and have the potential to significantly impact

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 41 | P a g e business operations. Insurers should adopt a strategic, holistic and long-term approach, considering how climate-related risks might impact all aspects of their risk profile.
c. “Physical risks” refer to the financial risks from the increasing severity and frequency
of climate-related extremes and events (i.e. acute physical risks); longer-term gradual shifts of the climate (i.e. chronic physical risks); and indirect effects of climate change such as public health implications (e.g. morbidity and mortality impacts). d. “Transition risks” refer to the financial risks related to the process of adjustment towards a low-greenhouse gas (GHG) economy. These risks can emerge from current or future government policies, legislation, and regulations to limit GHG emissions, as well as technological advancements, and changes in market and customer sentiment towards a low-GHG economy. e. Physical and transition risks can also lead to liability risks, such as the risk of climaterelated claims under liability policies, as well as litigation and direct actions against entities for failing to manage their climate-related risks. f. Climate risk should be embedded in the overall risk management framework. Insurer’s policies, systems, management information and risk reports to the Board should reflect climate risk considerations. The risk management framework should include robust structures to identify, measure, monitor, manage and report on exposure to climate risk. g. The ORSA should incorporate a climate risk assessment. At a minimum, the insurer should evaluate its portfolios and determine the materiality of the risks which may emanate from a climate event. The assessment should also consider the likely impact of climate events on all aspects of the operations of the insurer. The likelihood of such climate risk events should also be ascertained. A contingency plan should also be developed to formalize the course of action that would be taken in the event of a climate event. h. Insurers should utilize scenario analysis to enable testing of their resilience to climate change events. In particular, climate risk related scenarios, using appropriate assumptions, should be incorporated into the stress testing framework. This should enable the insurer to ascertain the potential loss and overall impact of possible climate

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 42 | P a g e events. This information along with the general assessment of the impact of climate change should inform decision making by the Board and Senior Management.
14. TECHNOLOGY / CYBER RISK
a. Technology risk, which includes cyber risk, refers to the risk arising from the inadequacy, disruption, destruction, failure, or damage from unauthorized access, modifications, or malicious use of information technology (IT) assets, people or processes, resulting in financial loss and/or reputational damage. b. The frequency and severity of cyber threats, data breaches, and ransomware attacks are on the rise, and it is critical that insurance organisations integrate technology and cyber risk management as part of its enterprise risk management framework and ORSA.
c. The risk management framework should identify potential cybersecurity threats and
vulnerabilities applicable to the IT environment, including internal and external networks, hardware, software applications, systems interfaces, and data; and assess the probable impact on the insurance organisation’s business operations, reputation or profitability. d. Policies and procedures for information security must be implemented and regularly reviewed and updated. The insurance organisation should also ensure that adequate attention is placed on outsourcing risks, particularly risks related to third party providers of IT and cloud services. e. The insurance organisation must conduct regular vulnerability assessments of its IT assets, including IT systems, network devices and applications, to identify security vulnerabilities and ensure risks arising from these gaps are addressed. f. Refer to the Central Bank’s Cyber Security Best Practices Guideline for guiding principles that are consistent with international best practices, for establishing an adequate cybersecurity framework proportional to the company’s business model, complexity of operations and risks.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 43 | P a g e
15. OTHER RISK CONSIDERATIONS
The following risk considerations may also be relevant when assessing risks for the ORSA.
15.1 EMERGING/EVOLVING RISKS
a. Potential new developments or emerging trends in an insurance organisation’s internal or external environment may prompt the identification of certain risks. Some of these risks may have been considered and determined to be low risk or immaterial, and others may not have yet been defined or evaluated. For example, environmental, social and governance (ESG) risks have the potential to be material and cause financial or reputational damage, however reliable ESG data is lacking and the regulatory landscape is still evolving. b. It is important to note that risks that were once considered immaterial may become material as the environment of the insurance organisation changes, and could have the potential to evolve into a systemic risk. The ORSA process should therefore consider how risks may evolve and what measurement and management techniques are necessary for monitoring these risks.
15.2 CROSS BORDER ACTIVITIES
a. The ORSA should consider operations in multiple jurisdictions and engagement in cross-border investments where applicable to the insurance organisation. It is important for insurance organisations to consider such cross-border activities in their ORSA process, since transactions with foreign counterparties can expose the organisation to increased risks such as country risk, concentration risk, foreign currency risk, as well as regulatory, legal, compliance and operational risks. It may also be difficult to enforce their rights to the asset or collateral in the event of a default, given legislative and regulatory actions in the foreign jurisdictions. b. The ORSA should also assess the controls, capital or assets needed in light of the risks associated with concentrations in cross border activities. The following should be clearly identified and taken into consideration when assessing group-wide capital needs, as well as ICTs for individual insurers:

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 44 | P a g e
i. operations in foreign jurisdictions where restrictions on fungibility or access to
capital apply or could apply;
ii. potential ring-fencing of funds; and
iii. where minimum/target regulatory capital requirements in other jurisdictions exceed
levels in Trinidad and Tobago.
15.3 RISK TRANSFER/MITIGATION
a. Insurance organisations that use risk transfer or risk mitigation techniques to manage their risk (e.g. reinsurance, hedging, or securitization) must consider possible new or additional risks that might arise, such as credit, concentration and operational risks. b. Insurance organisations should also be aware that risk mitigation techniques could potentially give rise to residual risks that may render overall risk reduction less effective. Residual risk means the amount of risk remaining after inherent risks have been reduced by risk controls. Examples of these risks include legal risk and documentation risk. In assessing its risk mitigation strategies, insurance organisations should ensure that these residual risks are also measured, monitored and reported.
15.4 RISK AGGREGATION AND DIVERSIFICATION BENEFITS
a. Risk aggregation is the approach used to calculate the total of each and all risk elements. A diversification benefit results when the aggregation of risks produces results that are less than the total of the individual risk elements. b. Where risk aggregation/diversification adjustment benefits are applied in an insurance organisation’s ORSA, they should be validated and calibrated by the organisation on a regular basis. Insurance organisations should be prudent in their assessment of aggregation/diversification benefits and should consider whether such benefits exist in periods of stress. When giving consideration to the benefits of diversification, consideration should also be given to the potential concentrations, dependencies and interactions of risks that may cause the total impact to be greater than the sum of the impact of the risks considered individually.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 45 | P a g e
c. Insurance organisations should:
i. have systems capable of aggregating risks, and understand the volatility of
correlations over time and under stressed market conditions; and
ii. ensure that any potential concentrations are addressed when aggregating risks, since
losses could arise from several simultaneous risk exposures stemming from the same event. For example, a localized natural disaster could generate losses from insurance, credit, market, and operational risks at the same time.
15.5 VALUATION OF ASSETS AND LIABILITIES FOR SOLVENCY PURPOSES
a. Insurance organisations are expected to have appropriate methodologies for the valuation of assets and liabilities for risk management and solvency purposes. Policies and procedures should set out the valuation methodologies for the initial pricing, valuation adjustments and periodic independent revaluation. b. The overall financial position of an insurance organisation should be based on the consistent measurement of assets and liabilities, the explicit identification and consistent measurement of risks and their potential impact on all components of the balance sheet. The balance sheet, when taken together with capital requirements, should result in an appropriate recognition of risks.
c. The values placed on the assets and liabilities of an insurance organisation for solvency
purposes should be a reliable measure of their value at the date of solvency assessment. Objectivity is an important aspect of valuing assets and liabilities in a reliable manner, so that a valuation is not influenced inappropriately by an organisation’s management. This may be achieved by using information available from effective internal control processes, market valuations and other relevant current or factual information, by applying professional standards and subjecting valuations to independent review.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 46 | P a g e
APPENDIX II - RISK APPETITE STATEMENT (RAS)

A well-defined risk appetite articulated through a Risk Appetite Statement (RAS) is an
important component of an effective risk governance framework 31. Developing and conveying the insurance organisation’s RAS is essential to reinforcing a strong risk culture.
An effective risk appetite statement should:
a. include key background information and assumptions that informed the insurance organisation’s strategic and business plans at the time they were approved; b. be linked to the insurance organisation’s short- and long-term strategic, capital and financial plans, as well as compensation programmes;
c. establish the amount of risk the insurance organisation is prepared to accept in pursuit
of its strategic objectives and business plan, taking into account the interests of its customers and the fiduciary duty to shareholders, as well as capital and other regulatory requirements; d. determine for each material risk and overall, the maximum level of risk that the insurance organisation is willing to operate within, based on its overall risk appetite, risk capacity, and risk profile; e. include quantitative measures that can be translated into risk limits applicable to business lines and legal entities as relevant, and at the group level, which in turn can be aggregated and disaggregated to enable measurement of the risk profile against risk appetite and risk capacity; f. include qualitative statements that articulate clearly the motivations for taking on or avoiding certain types of risk, and establish some form of boundaries or indicators (e.g. non-quantitative measures) to enable monitoring of these risks; g. ensure that the strategy and risk limits of each business line and legal entity, as relevant, align with the entity-wide risk appetite statement as appropriate; and 31 For further guidance on the risk governance framework, refer to the Central Bank’s Corporate Governance Guideline.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 47 | P a g e h. be forward looking and, where applicable, subject to scenario and stress testing to ensure that the insurance organisation understands what events might push the entity outside its risk appetite and/or risk capacity.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 48 | P a g e
APPENDIX III - ORSA REPORT FORMAT 32
The Central Bank expects that the level of detail provided in the ORSA Report will vary given the differences in the nature, scope and complexity of operations. However, the fundamental framework including comprehensive assessment of risk, risk management and internal controls, setting of ICTs, and involvement of Board and Senior Management should be reflected in the ORSA of all insurance organisations. While the Central Bank provides guidance on the format of the ORSA Report, insurance organisations may make amendments to the format, where appropriate. In addition, insurance organisations must append all documents deemed necessary to support the details presented in the ORSA Report. The ORSA Report must be updated at least once every twelve (12) months and upon the occurrence of specific trigger events or material changes, must include the signature of the insurer’s Chief Risk Officer or other Officer having responsibility for the oversight of the insurer’s ERM framework and ORSA process, and must be approved by the Board.

EXECUTIVE SUMMARY
The executive summary should present an overview of the ORSA process, methodology and results:
a. purpose of the document; b. planning horizon considered in the report;
c. main findings of the ORSA, material risks identified and mitigating actions put in place;
d. required capital based on actual and potential risks (amount and composition), compared with the regulatory capital requirements (details/calculations should be provided); e. plans to manage the risks and/or restore capital resources within a reasonable period, if the required capital is deficient; f. adequacy and effectiveness of the insurance organisation’s risk management processes; g. key changes to the ORSA process and underlying assumptions; h. summary of the financial position, business strategy and risk appetite; 32 Also refer to section 9 – ORSA Report / Key Metrics Report / Associated Documents.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 49 | P a g e
i. brief description of the capital management policy and dividend plan, and how the
insurance organisation intends to manage capital to meet requirements now and based on future projections; j. capital contingency plan where future funds may be insufficient to meet capital needs; k. major issues where further analysis is required; and
l. persons who have carried out the assessment, how it has been challenged, who has approved
it and when.
2. BACKGROUND
This section should include relevant organisational and historical financial data on the insurance organisation. This may include details of the group structure, profitability, dividends, capital resources, insurance policy liabilities and any conclusions that can be drawn from trends in the data that may have implications for the future. It should also give a brief description of the organisation’s current business profile and expected changes to the business profile.
3. CURRENT AND PROJECTED FINANCIAL AND CAPITAL POSITIONS
This section should explain the present financial position of the insurance organisation, projected business volumes, projected financial position and future sources of capital.
4. ASSESSMENT OF RISK EXPOSURES AND CAPITAL ADEQUACY
This section should include the following details of the risk assessment and capital adequacy review:
Timing a. The effective date of the ORSA, with details of any events that have happened since that may materially change the assessment and calculations. The impact of such events should be included. Risk Assessment a. Articulation of the insurance organisation’s risk appetite 33; 33 Refer to Appendix II - Risk Appetite Statement.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 50 | P a g e b. Details of all risks considered, including at a minimum insurance, credit, market, operational, liquidity and concentration risk;
c. Identification of the material risks, why the level of risk is considered to be acceptable/not
acceptable, and what mitigating actions were implemented/will implemented; d. Identification of any risks deemed low risk or immaterial and the justification for that determination; e. The interdependency between various risks and key assumptions; f. Assessment of the effectiveness of controls in place to mitigate against key risks:
g. Demonstration of the link between the business strategy, risk and capital; h. Summary of breaches on defined risk tolerance since last reporting and any impact to business strategy and capital.
i. Details of any restrictions on the ability to transfer capital into or out of the entity;
j. Conclusions arising out of the risk assessment including an analysis of significant movements in capital required and available since the last ORSA, and a comparison of regulatory capital with the overall capital requirement identified by the ORSA. k. The organisation’s plans to manage the risks and/or restore capital resources within a reasonable period, if the required capital is deficient. Methodology and Assumptions a. A description of how the risk assessment has been carried out and what assumptions have been made; b. An explanation of how the risk assessment relates to the ICTs set by the insurance organisation;
c. Details on how capital is allocated for all risks identified and stress testing/scenario
analysis; d. Where internal models are used to quantify risks, the following information should be provided:
i. key assumptions and parameters within the capital modelling work and background
information on the derivation of key assumptions;
ii. how parameters have been chosen, including the historical period used and the
calibration process;
iii. limitations of the model;
iv. the sensitivity of the model to changes in the key assumptions or parameters chosen;
v. validation work undertaken to ensure the continuing adequacy of the model(s); and

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 51 | P a g e e. Detail the reliance placed on Group ORSAs and the rationale or inputs obtained from an objective reviewer or internal audit. Relevant copies of such external or internal reports should be attached. Sensitivity Analysis This section should detail the sensitivity tests undertaken to key assumptions and factors that have a significant impact on the broader financial condition of the insurance organisation e.g. changes in interest rates. Material changes in the financial risks to which the business is exposed should be explored and quantified as far as possible. Stress Testing / Reverse Stress Testing At a minimum, this section should entail a description of the insurance organisation’s stress testing framework specific to its ORSA 34, including the base scenario, adverse scenarios, rationale for selections, models and techniques used, projections, reverse stress testing carried out and specific disclosures. Some examples of matters to discuss include:
a. a description of the main assumptions and methods used to project and stress the base scenario; b. key assumptions of the risks being tested and justification of how the risk is significant to the insurance organisation;
c. a description of the criteria used in the assessment of capital adequacy;
d. the results of the financial projections including the balance sheet, income statement, ICT ratio for net tier 1 capital, and ICT ratio for total capital, for each year of the projection period; e. results of the stress tests using the assessment criteria; and f. an assessment of the impact of the adverse scenarios on the capital of the insurance organisation, including a discussion on any management actions needed to manage or mitigate the impact of these scenarios. Group ORSA / Stress Tests Where the insurer has recourse to the parent’s ORSA and/or stress testing, this should be stated together with an explanation as to how this has been used in the insurer’s ORSA. 34 Refer to section 7.4 – Stress Testing.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 52 | P a g e
5. RISK AGGREGATION AND DIVERSIFICATION
This section should describe how the results of separate risk assessments have been combined to obtain an overall view of capital adequacy. This requires some sort of methodology to be used to quantify the amount of capital required to support individual risks so that they can be aggregated into a total figure. Any adjustments made for diversification or risk correlations must be explained.
6. CAPITAL MANAGEMENT POLICY
The insurance organisation’s capital management policy should:
a. describe how the organisation manages, monitors and makes decisions regarding capital planning; b. include internal post-stress capital goals 35 and real-time targeted capital levels; guidelines for dividends and stock repurchases; and strategies for addressing potential capital shortfalls;
c. describe the manner in which consolidated estimates of capital positions are presented to
Senior Management and the Board; d. require staff with responsibility for developing capital estimates to clearly identify and communicate to Senior Management and the Board, the key assumptions affecting various components that feed into the aggregate estimate of capital positions and ratios; and e. require the aggregated results to be directly compared against the insurance organisation’s stated post stress capital goals and those comparisons should be included in the standard reporting to Senior Management and the Board.
7. CAPITAL PLAN
This section should outline the key aspects of the insurance organisation’s capital needs to support its operations in the medium term (at least 3 years), to support its strategic plan (forecasted/long-term) and to support unforeseen and unexpected events as set out in 35 Post-stress capital goals should provide specific minimum thresholds for the level and composition of capital that the insurer intends to maintain during a stress period. The insurer must be able to demonstrate through its own internal analysis, independently of any regulatory capital requirements, that remaining at or above its internal post-stress capital goals will allow the insurer to continue to operate.

Own Risk and Solvency Assessment (ORSA) Guideline August 2026 53 | P a g e contingency plans. The detailed capital plan, if a separate document, should be submitted as an appendix to the ORSA.
8. FUTURE ACTION PLAN
This section should include:
a. a summary of significant deficiencies, weaknesses, and challenges identified by the insurance organisation, and action plans, including timeframes to address them including:
i. changes in risk profile;
ii. improvements in governance, systems and processes; and
iii. changes to the composition of capital and ICTs.
b. planned changes in risk management and internal controls including:
i. improvements in risk policy; and
ii. improvements in risk management tools.
9. USE OF ORSA WITHIN THE INSURANCE ORGANISATION
This section should:
a. state the extent to which the ORSA is embedded in the operations of the insurance organisation and is used for decision-making and capital planning, including the extent and use of capital modelling or scenario analysis and stress testing; b. Comment on the suitability of current projection assumptions in light of actual past experience;
c. Provide details on the management actions taken in the previous period in response to
the recommendations stated in the previous ORSA Report. d. Include a summary of the independent review of the ORSA.
10. REFERENCES AND APPENDICES
Include all relevant references and attach the Key Metrics Report 36 and associated documents 37 . 36 Insurers will be required to use the Key Metrics Report (KMR) template on the Central Bank’s Website. 37 For the list of associated documents, refer to section 9 – ORSA Report, Key Metrics Report & Associated Documents.

Own Risk and Solvency Assessment (ORSA) Guideline – August 2026

Lineage: In force