Report Contents
Introduction
There is a trend for MGAs to look at changing from an MGA model into a full insurer. Our understanding is that this will not always suit an MGA in terms of growth of profits, but for some there are very good reasons for doing so, the main one at the moment being the lack of available capacity from insurers.
This paper aims to give those considering the change some thoughts on issues which they will need to consider, highlighting some of the areas where an MGA may need to make changes to their business model, governance and functional requirements.
The article looks at this primarily from the point of view of internal governance, functions and controls most of which are driven by the additional regulatory expectations and requirements. In doing so, we do not consider the external implications of which the most obvious is the need to be able to respond to two regulators with very different approaches and outlooks.
Governance
The new business model requires a complete review of governance of the organisation.
At the top of any business is its Board. MGAs tend to operate smaller boards than insurers though that is a generalisation. The key question is not about size but whether the board as a whole has the right skills and experience to oversee the business and what is the mix of executives and non-executives. How many of the directors have experience on a board of an insurer? There are significant and important differences in the business models between an intermediary and an insurer, particularly around capital, reserving and investments and the regulators will expect to see experience of that business model.
An MGA looking to change to an insurer model will need to bring into its board directors with insurer experience and look at their iNED to executive ratio. While a majority of iNEDS may not be required depending on a number of factors, a majority is usually expected by regulators and certainly a reasonably high proportion will be required.
The board and executive committee structure will also require a review. There may be a need for several new committees. The MGA may or may not have had committee(s) covering audit, risk, compliance, operations and IT, underwriting, product governance and claims but it is unlikely to have had committees which are responsible for capital, investments and reserving. It is also likely that they will also need to have committee(s) responsible for nominations and remuneration.
Depending on the size of the business it may not be necessary to have an individual committee for each of these but there will need to be committees which are responsible for these subjects, and it is very likely they will need to be Chaired by an iNED for robust governance.
The new governance structure will therefore lead to the need for a review of all terms of references for existing committees to review responsibilities and composition.
With the likely increase in INEDS, an MGA may want to consider whether it is time to create an executive committee, if it does not already have one, and if so, who should be on that committee.
The issue of composition for board and executive committee(s) brings attention to the possible new senior roles which will be required and some additional responsibilities which may need to be allocated. As a minimum Solvency II requires four control functions for insurers: Internal Audit, Risk, Compliance and Actuarial. At least two of these, risk and compliance will exist within an MGA and the other two may exist, with Internal Audit often being outsourced and actuarial expertise sometimes utilised by MGAs for their pricing work.
However, there will need to be some upgrades in functional expertise. Risk is likely to need to move from a risk or head of risk role to a CRO role, filled by someone with experience of the development of a more robust risk management function, which will include an ORSA framework and the ability to develop the ORSA. On the topic of the ORSA the actuarial function will be required to assist with the ORSA and will need that experience to include not just capital but reserving in addition to any pricing experience they may have had. This often requires an upgrade of the actuarial function as well, coming under the guidance of a Chief Actuary.
It should be noted that some of the additional resources required can be obtained through co-sourcing arrangements but either way there is likely to be a cost.
Other roles and responsibilities which might need to be allocated would include responsibility for investment, usually a role given to the CFO, and underwriting possibly via a CUO.
Where the incumbents for these roles are remaining in position but have personal development objectives the MGA may support them by ensuring that the iNEDs they engage have these skills and are charged with mentoring the relevant individuals. Certainly, the regulators would be looking to see how the control functions are being made more robust.
As with the terms of references for the board and committees, the terms of references for the control functions will require review and upgrading. Additionally, all of the senior management role profiles and responsibilities will require a review to accommodate the additional responsibilities identified above and to ensure that all prescribed responsibilities under SM&CR have been allocated with statement of responsibilities and a new responsibilities map drafted or edited.
Key Governance Considerations:
- Does the firm have an appropriate mix of executive and independent non-executive directors?
- Does the firm have directors with the necessary skills to run an insurance company?
- Does the firm have an appropriate structure for its board and committees?
Capital
Another significant difference between an intermediary and an insurer is the approach to capital and the amount required. Insurers have to comply with the requirements of Solvency II which is a significant increase in both the administration and governance around calculation of the capital as well as the actual capital required. The latter has been the reason that some MGAs reviewing whether to transform have decided not to. The significant increase in capital against the potential profits has not made sense in terms of providing a clear business case for the investment.
Capital under Solvency II can be calculated using the standard model, which is a complex actuarial calculation to the unenlightened, or an even more complex approach using an Internal Model. Many firms who adopted internal models spent significant amounts of money in creating their internal model with the hope of finding capital efficiency through things like diversification only to find that the efficiencies did not materialise. Having spent significant time and money creating the model they now continue to spend significant sums maintaining the model. For most MGAs thinking of transforming, an internal model is unlikely to be the best option. However, even using the standard model requires considerable input from the actuarial and finance team.
Though unlikely, if the MGA is a part of a group which involves other insurers there may also be a need for assessment of the group capital position. A failure to maintain capital to the latter will result in intervention by the PRA possibly including a temporary suspension of new business being underwritten and a failure to meet the latter a more serious intervention almost always leading to closure.
Capital assessment under Solvency II will lead to two calculations, the Minimum Capital Requirement (MCR) and the Solvency Capital Requirement (SCR). A failure to maintain the latter will usually result in an intervention by the regulator, possibly involving a temporary suspension of new business underwriting and a requirement to recapitalise in short order. A failure to maintain capital to MCR will almost always lead to closure or a forced quick sale. More often than not a regulator will expect an insurer to hold capital in excess of SCR, usually at least 25% more. The insurer should have a Capital Policy setting out what it proposes to maintain.
Insurers are required to continually assess their capital. The rules on what assets qualify as capital are also quite complex leading to an increase in cost and the expertise required.
It’s easy to see why there is a need to evaluate the skills of existing board members and establish where any gaps may exist.
As mentioned above, an insurer must have a robust Own Risk and Solvency Assessment (ORSA). An ORSA must be produced annually and is reviewed and approved by the board of directors – one of the reasons a skills assessment is required on boards. In addition, what many describe as mini-ORSAs are produced quarterly.
The process for delivery of ORSAs must be documented and robust. A firm that chooses to go down the route of having an internal model will also have to have a very robust capital model approval process and validation process. These require resources including people and often expensive IT.
Key capital considerations:
- Will the firm use the standard model for capital calculations, or develop its own internal model?
- Does the firm have the necessary expertise to calculate its capital requirements, including its MCR and SCR?
- Does the firm have a documented ORSA process, and if not who has the experience to develop one?
Underwriting
The underwriting process itself varies little between whether you are an MGA or an insurer. However, there is a reasonable difference in the planning process because of a direct connection between the annual business plan and the capital which an insurer requires. It is for this reason that the dynamics are different.
An MGA needs to ensure, more often than not annually, that it has capacity from insurers. Insurers have to create an annual business plan which means selecting the business it will write and the volume, pricing and limits to ensure they are within risk appetite for each line of business, a process requiring the assistance of actuaries. The decisions about the business to be underwritten then lead to planning and design of the reinsurance program as well as the ability to work on establishing the capital required, a much more complex process for an insurer because of Solvency II.
Once the annual underwriting plan has been developed each individual underwriter’s levels of authority at the insurer must be reviewed, set and agreed.
From the setting of individual underwriting authorities there needs to be controls in place including first line PBQR (pre-bind quality controls), and peer review of risks written as well as second line oversight from the compliance function. These controls tend to be more robust for an insurer because an MGA can rely on oversight in the form of audits by its capacity providers to ensure they have written the business in accordance with their binding authority whereas the insurers have no such additional oversight so are required to ensure that their controls are robust.
Key underwriting considerations:
- Does the firm have the necessary underwriting control skills required?
- Does it have the capability to determine price and to develop an underwriting plan that can be used to calculate its capital requirements?
- Does the firm have the skills and expertise necessary to create the necessary underwriting ‘lines of defence’ controls?
Reinsurance
MGAs do not require reinsurance as they do not carry the risk. They therefore tend to have no reinsurance team and no expertise in reinsurance.
However, reinsurance is a significant risk and exposure mitigation tool for insurers. Most insurers have a reinsurance team who are responsible for creating a strategy (which will be ensconced in a Reinsurance Policy) and designing the reinsurance program to protect the insurer from both attritional and catastrophic losses. The strategy will set key criteria such as the level of reinsurance to be acquired and the minimum rating of potential reinsurers. The reinsurance team will have the support of the actuarial team and work closely with the underwriting team as well as one or more external reinsurance brokers to establish potential terms and conditions, and the likely cost of reinsurance, which will all also feed into the annual business plan and ultimately to the calculations of required capital.
Once reinsurance has been arranged and losses flow through to reinsurers the reinsurance team is usually also responsible for ensuring recoveries are made efficiently. To an insurer, counter-party credit risk is a key risk which must be manged carefully and reinsurance recoveries are one of the key third party credit risks. The early availability of reinsurance recoveries is also very important element of the management of liquidity.
Key reinsurance consideration:
- Does the firm have a reinsurance plan or the ability to design an appropriate reinsurance program and the necessary expertise and resources to manage its operational reinsurance activities?
Claims
Many MGAs do not have a claims function. These MGAs operate a thin business model and, keen to avoid unnecessary costs, do not create claims functions or are not given the opportunity to handle claims by their capacity providers. An MGA converting to be an insurer will need to have a claims function which has the ability to deal with claims efficiently and effectively. The claims team will need a structured control environment with individual claim handling authorities.
However, there is more to claims than just settling them. There is a need to assess the expected losses usually with the assistance of the actuarial team so that there is a clear path and process for the calculation of reserves which are required in respect of all notified claims but also those which are incurred but not reported (IBNR). This requires good quality data based on good claims valuation assessments with the data maintained on suitable software applications.
Key claims considerations:
- Does the firm have a plan to create a claims function and the expertise to oversee this?
- Does the firm have a claims handling system that is capable of capturing the MI required by the actuarial teams to calculate overall reserves, including IBNR?
Actuarial
Solvency II requires an actuarial function which a charter, usually approved by the board of directors as a part of the solvency II governance arrangement for the control functions.
As identified above the actuarial function of an insurer has a significant role, not just in the planning process but it is required for setting benchmarking pricing and potentially pricing individual risks, calculation of capital including assistance with the ORSA process, setting reserves and work on exposure management. Most of these activities are not activities which take place at MGAs and therefore they will be required. So will the specialist IT required to support their work.
Key actuarial consideration:
- Does the firm have the necessary expertise and resources required to create an actuarial function for its business?
Risk
We identify above the likely need to an upgrade in the risk resources in terms of ability and experience which may be required. The Risk Function is a Solvency II required controls function and must have a charter or terms of reference. Many of the activities required of the risk function will not be that different between an MGA and insurer: identification, assessment and documentation of the risks faced by the business, but the risks are different, and the requirements of Solvency II add complexity.
The risks for an insurer include risks around capital, investment, reserving and liquidity and Solvency II brings the need to develop an ORSA annually as well as provide mini-ORSAs quarterly. These require experience and an understanding of an insurers business model and the implications. Because the risks are different so will be the controls required to mitigate those risks.
Solvency II also requires a more detailed level of assessment and reporting on risks with a broader range of risk policies and risk appetites for the categories of risks faced by the business. Additionally, and reporting using KRIs against the appetites and just as importantly the ability to carry out effective stress testing.
The skillsets and experience required therefore are different as is the level of resources required.
Key risk considerations:
- Does the firms existing risk resource have the necessary skills to adapt to managing the risk function for an insurance firm?
- Does the firm have senior directors (executive or non-executive) with the necessary skills to oversee the risk function?
Compliance
Compliance is another Solvency II required control function and is required to have a charter. The role of the compliance function for an MGA is not that different to that required for an insurer. However, the management of any MGA looking to transform will need to consider whether the resources available to them have the skills and bandwidth to deal with the change and the increase in responsibilities which come with an insurer because of the additional functions which may require a second line oversight and the activities within the insurer including the increased reporting requirements and increased supervision that comes with having a second regulator.
Key compliance issue:
- Does the firm have the necessary levels of skill, experience, knowledge and resource in its compliance function to be able to manage the increased workload that comes from PRA regulation?
Internal Audit
Like compliance, Internal Audit is another Solvency II required control function and must also have a charter. The role of the Internal Audit function for an MGA is also not that different to that required for an insurer ad again management will need to consider whether the resources have the experience, capabilities and bandwidth to deal with all of the very specialist areas in an insurer including the controls required for the key areas where management failures lead to a failure of the insurer: investment, pricing, reserving and exposure management and liquidity.
IT
The change in business model brings a need to look at the IT requirements for the MGA. It can be assumed that the underwriting platform should be suitable provided that it has the ability to be re-engineered to add the ability to capture exposure data which can then be extracted and used for capital calculations, reinsurance purchasing and exposure management. However, most MGAs will not have the specialist IT applications which will be required for:
- Capital calculations;
- Exposure management;
- Liquidity monitoring;
- Reserving and reserve modelling; and
- Reinsurance administration and performance monitoring.
In some cases, the MGA may also not have a robust claims system which will also provide the data required for accurate reserving.
Key IT consideration:
- Does the firm have the necessary IT platform(s) to manage all of the additional data capture and processing requirements that come from being an insurer?
Corporate
Depending on the level of sophistication of the MGA corporate structure, a new parent company may be required to accommodate any new capital inflow. A service company may also be required to house all of the employees and other inter-group service arrangements which may need to be developed and if it is, a review of intra-group VAT would be recommended.
The following may require review:
- any articles and memoranda of association; and
- the share capital structure and membership.
Additional Changes
The following are additional but potentially less significant changes which the management of an MGA may need to consider.
Outsourcing
Many of the changes above which would result in the increasing of the size of the firm and its resources may be augmented by the use of outsourcing. Thus, a firm may decide that rather than building a significant infrastructure it is going to maintain a lean business model by outsourcing many of the new requirements. So, for example, it may decide to outsource in whole or in part as a co-sourcing model, one of more of Internal Audit, Claims, aspects of the actuarial requirements and even underwriting through the use of delegated underwriting arrangements with other MGAs’.
To the extent that a firm does so, however, it will need to have the skillsets and experience in-house, to oversee and manage the outsourced services. So, a firm outsourcing its claims function will still require someone responsible for claims and arrangements for the oversight, which can also be outsourced in part to a third-party audit firm, though they too will then need to have oversight.
While the FCA has provisions within the SYSC rules on outsourcing the PRA has recently had a greater focus on outsourcing arrangements which are encapsulated in Supervisory Statement 2/21. These requirements will need to be met by any firm which transforms itself into an insurer.
Operational Resilience
Many MGAs are not large enough to be categorised as an Enhanced Firm and consequently they will not be subject to the new requirements for Operational resilience. However, all dual regulated firms, that is all insurers (which are regulated by both the PRA and the FCA) are subject to these requirements. This leads to the need to the need to have in place an Operational Resilience Framework supporting the approach to ensuring that the firm is operationally resilient.
Licensing
A review of licensing will be required as the application of the PRA and FCA rules for insurers and intermediaries including FCA are slightly different.
Probably more significantly, the rules governing what risks an insurer can and cannot underwrite from third countries such as the United States are very different to the rules regarding what an intermediary in the UK may do in relation to the same business and while we use the US as an example, the difference is true for most countries in the world.
Products and Distribution
The new business model may drive a need to review all of the distribution agreements which the MGA has in place such as their Terms of Business Agreements.
Many, but not all, MGAs are co-manufacturers of the insurance products they underwrite and are caught by the FCA PROD rules. Often their responsibilities are limited by their agreements with their capacity providers with whom they share manufacturer responsibilities under the rules. However, once they become an insurer, there is less opportunity for limiting responsibility. It is still possible to share the burden with coverholders appointed under a binding authority but most MGAs looking to change to being an insurer are not looking to then delegate their underwriting to third parties and are therefore more likely to be responsible for complying with FCA requirements.
Summary
There are many interconnected issues for the management of an MGA to consider when looking at whether to change business model and become an insurer rather than an intermediary. Almost without fail they increase ongoing cost and add complexity. Whether these issues are outweighed by the benefits of becoming an insurer is the question to be answered.
If you are considering this step, ICSR has the depth of knowledge and experience to be able to assist you with both the strategy and implementation, including any more detailed assessment of the regulatory implications of the transition to your business.
InsTech in London: From MGA to Full Stack Insurer – Everything You Need to Know
Kenneth Underhill will be appearing as a panellist at this event being hosted by InsTech London. Please contact us if you would like to attend as a guest of ICSR and join Kenneth on 29th March in London.