On 9 March, Sylvia Cronin addressed a KPMG hosted event on the themes of investment returns, Brexit and IT and Cyber Risk.
On the topic of Brexit, Ms. Cronin stated that substance is a key concern for the Central Bank when authorising insurance firms and that the Central Bank expects applicants to demonstrate that the applicant's decision-making function will be located in Ireland. The profile and levels of staff located in Ireland will also be indicative of the applicant's intention to have a substantive presence in this jurisdiction.
The Central Bank has confirmed that since November 2016, it has received 5 applications for authorisation from insurance and reinsurance entities, that a further 5 entities have indicated their intention to apply for authorisation and that approximately 20 entities have contacted the Central Bank to discuss authorisation.
In the September 2016 edition of the Arthur Cox Regulatory Update, we reported on the Central Bank's Cross Industry Guidance on IT and Cybersecurity Risks. Ms. Cronin shared some of the findings from an industry questionnaire to lower impact firms based on this Guidance, which found that:
» 87% of undertakings claim that IT risks are identified and assessed as part of a regular review process, with an IT risk register maintained.
» 50% of firms do not have standalone IT risk management frameworks in place.
» 63% of undertakings do not have a board-approved IT and cybersecurity strategy.
» 39% of firms do not regularly report IT and cyber risks to the board.
» 57% of firms do not have a boardagreed programme in place for regular cyber risk assessments and vulnerability scanning.
Ms. Cronin stated that she expects these findings to be at least partly indicative of the position across the wider insurance industry.
On the subject of investment returns, Ms. Cronin stated that the Central Bank is engaging in a stress testing exercise for the non-life market, which is separate from EIOPA's stress testing. The aim of this exercise is to test balance sheet resilience to a range of moderately severe events to assess the realism of proposed management actions in the wake of a stress event. The Central Bank has already communicated with the firms involved in this exercise. The results are expected later in 2017.
A link to Ms. Cronin's speech is here.