Competent authorities shall assess an institution's compliance with the requirements relating to the impact of insurance and ORTM within an AMA, as referred to in the last sentence of point (e) of Article 322(2) and in Article 323 of Regulation (EU) No 575/2013, by confirming at least the following:

1. (a)

   that the insurance provider meets the authorisation requirements referred to in Article 323(2) of Regulation (EU) No 575/2013, in accordance with Article 37;

2. (b)

   that the insurance is provided via a third party, as referred to in point (e) of Article 323(3) of Regulation (EU) No 575/2013, in accordance with Article 38;

3. (c)

   that the institution avoids the multiple counting of risk mitigation techniques, as referred to in point (e) of Article 322(2) of Regulation (EU) No 575/2013, in accordance with Article 39;

4. (d)

   that the risk mitigation calculation appropriately reflects the insurance coverage, as referred to in point (d) of Article 323(3) of Regulation (EU) No 575/2013, and that the framework for recognising insurance is well reasoned and documented, as referred to in point (f) of Article 323(3) of that Regulation, including the following:

   1. (i)

      the insurance coverage relates to the institution's operational risk profile, in accordance with Article 40;

   2. (ii)

      the institution uses a sophisticated risk mitigation calculation, in accordance with Article 41;

   3. (iii)

      the risk mitigation calculation is aligned to the institution's operational risk profile in a timely fashion, in accordance with Article 42.

5. (e)

   that the institution's methodology for recognising insurance captures all the relevant elements through discounts or haircuts in the amount of insurance recognition, as referred to in points (a) and (b) of Article 323(3) and in Article 323(4) of Regulation (EU) No 575/2013, in accordance with Article 43;

6. (f)

   that the institution demonstrates that a noticeable risk mitigating effect is achieved with the introduction of the ORTM, as referred to in the second sentence of Article 323(1) of Regulation (EU) No 575/2013, in accordance with Article 44.

For the purposes of assessing the authorisation requirements of the insurance provider as referred to in Article 36(a), competent authorities shall consider that an undertaking authorised in a third country fulfils the requirements of authorisation, where that undertaking satisfies prudential requirements that are equivalent to those applied in the Union, including the requirements referred to in Article 323 of Regulation (EU) No 575/2013.

1. (1)

   For the purposes of assessing that the insurance coverage for the purposes of AMA own funds requirements is provided by a third-party entity, as referred to in Article 36(b), competent authorities shall confirm, on the basis of the comprehensive view of an institution's consolidated situation as referred to in Article 4(1), point (47) of Regulation (EU) No 575/2013, that neither the institution nor any other of the entities included in the scope of consolidation has a participation or a qualifying holding, as referred to in Article 4(1), points (35) and (36) respectively, of Regulation (EU) No 575/2013, in the party providing the insurance.

2. (2)

   Where the requirements of paragraph 1 are partially met, only that portion of the insurance provided where ultimate liability rests with an eligible third-party entity by virtue of the fact that the risk is effectively transferred outside of the consolidated entities shall be considered as insurance provided via a third party.

For the purposes of assessing that the insurance coverage for the purposes of AMA own funds requirements avoids the multiple counting of risk mitigation techniques, as referred to in Article 36(c), competent authorities shall confirm that an institution has taken reasonable steps to ensure that neither the institution nor any of the entities included in the scope of the consolidation is knowingly re-insuring contracts that cover operational risk events forming the object of the initial insurance arrangement entered into by the institution.

1. (1)

   For the purposes of assessing that the insurance coverage relates to an institution's risk profile, as referred to in point (i) of Article 36(d), competent authorities shall confirm that an institution has carried out a well-documented and well-reasoned insurance risk mapping process whereby the institution develops an insurance coverage consistent with the likelihood and impact of all operational risk losses that it may potentially face.

2. (2)

   For the purposes of paragraph 1, competent authorities shall confirm that the institution complies with at least the following:

   1. (a)

      estimates the probability of insurance recovery and the possible timeframe for the receipt of payments by insurers, including the likelihood of a claim being litigated, the length of that process and current settlement rates and terms, based on the experience of its insurance risk management team, supported where necessary by appropriate external expertise including claims counsel, brokers and carriers;

   2. (b)

      uses the estimates resulting from point (a) to assess the performance of insurance in the event of an operational risk loss and designs this process with the view to assessing the insurance response for all relevant loss and scenario data being entered into the operational risk measurement system;

   3. (c)

      maps the insurance policies based on their assessment resulting from point (b) to the institution's own operational risks at the maximum level of detail, using all the information sources available, including internal data, external data and scenario estimates;

   4. (d)

      employs the appropriate expertise and conducts this mapping with transparency and consistency;

   5. (e)

      assigns the appropriate weight to the past and expected performance of insurance through an assessment of the components of the insurance policy;

   6. (f)

      obtains formal approval from the appropriate risk body or committee;

   7. (g)

      periodically re-examines the insurance mapping process.

For the purposes of assessing that an institution uses a sophisticated risk mitigation calculation, as referred to in point (ii) of Article 36(d), competent authorities shall confirm that the modelling approach for incorporating the insurance coverage within the AMA meets at least the following:

1. (a)

   it is consistent with the operational risk measurement system adopted to quantify the gross-of-insurance losses;

2. (b)

   it is transparent in its relationship with the actual likelihood and impact of losses used in the institution's overall determination of its AMA own funds requirements, and is also consistent with that relationship.

For the purposes of assessing that the risk mitigation calculation is aligned with an institution's operational risk profile in a timely fashion, as referred to in point (iii) of Article 36(d), competent authorities shall confirm at least the following:

1. (a)

   that the institution has reviewed the use of insurance and has recalculated the AMA own funds requirements, as appropriate, where the nature of the insurance has changed significantly or where there is a major change in the institution's operational risk profile;

2. (b)

   where material losses are incurred, affecting the insurance coverage, that the institution recalculates the AMA own funds requirements with an additional margin of conservatism;

3. (c)

   where there is an unexpected termination or reduction of the insurance coverage, that the institution is prepared to immediately replace the insurance policy on equivalent or improved terms, conditions and coverage, or to increase its AMA own funds requirements to a gross-of-insurance level;

4. (d)

   that the institution calculates capital gross- and net-of-insurance, at a level of granularity such that any erosion in the amount of insurance available, including by payment of a material loss, or a change in insurance coverage, can be immediately recognised for its effect on the AMA own funds requirements.

1. (1)

   For the purposes of assessing that an institution's methodology for recognising insurance captures all the relevant elements through discounts or haircuts in the amount of insurance recognition, as referred to in Article 36(e), competent authorities shall confirm at least the following:

   1. (a)

      that the institution investigates the various factors that create the risk that the insurance provider will not make the payments as expected and decrease the effectiveness of the risk transfer, including the ability of the insurer to pay in a timely manner and the ability of the institution to identify, analyse and report the claim in a timely manner;

   2. (b)

      that the institution investigates how the various factors referred to in point (a) have affected the mitigating impact of insurance on the operational risk profile in the past and how they may affect it in the future;

   3. (c)

      that the institution reflects the uncertainties referred to in point (a) in its AMA own funds requirements, through appropriately conservative haircuts;

   4. (d)

      that the institution carefully takes into account the characteristics of the insurance policies, including whether those policies cover only losses that are claimed or notified to the insurer during the policy term, therefore any loss that is discovered after the policy expires is not covered, or whether they cover losses that are incurred during the policy term, even where they are not discovered and the claim is not lodged until after the expiration of the policy, or whether the losses are first-party direct losses or third-party liability losses;

   5. (e)

      that the institution considers and fully documents data on insurance pay-outs by loss type in its loss databases and sets haircuts accordingly;

   6. (f)

      that the institution has in place procedures for loss identification, analysis and claims processing, with the view to verifying the actual coverage protection provided by the insurer or the ability to receive the claim payment funds within a reasonable timeframe;

   7. (g)

      that the institution explicitly quantifies and models separately the haircuts in relation to each of the identified relevant uncertainties instead of applying one single haircut into the calculation covering all uncertainties or an ex post calculation haircut;

   8. (h)

      that the institution takes into account the recognition of the insurer's claims-paying ability risk to the maximum extent, by applying appropriate haircuts in the insurance modelling methodology;

   9. (i)

      that the institution ensures that the claims-paying ability risk for counterparty default is assessed on the basis of the credit quality of the insurance company responsible under the given insurance contract, irrespective of whether the insurance company's parent institution has a better rating or whether the risk is transferred to a third party;

   10. (j)

       that the institution makes conservative assumptions relating to the renewal of insurance policies on the basis of equivalent terms, conditions, and coverage as the original or existing contracts;

   11. (k)

       that the institution has processes in place to ensure that the potential exhaustion of insurance policy limits and the price and availability of reinstatements of cover as well as the cases where the coverage of the insurance contract does not match the operational risk profile of the institution are appropriately reflected in its AMA insurance methodology.

2. (2)

   For the purposes of paragraph 1, competent authorities may consider that the requirement for the institution to apply haircuts for the time remaining until the expiry of the insurance contract or for the cancellation term is not necessary where the cover will be renewed and continuous and where at least one of the following conditions is met:

   1. (a)

      where the institution can demonstrate the existence of continuous cover on equivalent or improved terms, conditions and coverage for at least 365 days;

   2. (b)

      where the institution has in place a policy that cannot be cancelled by the insurer, other than for non-payment of premium, or which has a cancellation period of more than one year.

For the purposes of assessing that an institution has demonstrated that a noticeable risk mitigating effect is achieved with the introduction of ORTM, as referred to in Article 36(f), competent authorities shall apply at least the following:

1. (a)

   confirm that the institution has experience in using ORTM instruments and their characteristics, including probability of coverage and timeliness of payment, before these instruments can be recognized in the institution's operational risk measurement system;

2. (b)

   refuse ORTM as eligible risk mitigation instruments of the AMA own funds requirements where the ORTM are held or used for trading purposes rather than for risk management purposes;

3. (c)

   verify the eligibility of the protection seller including whether it is a regulated or unregulated entity, and the nature and characteristics of the protection provided, whether it is funded protection, securitization, guarantee mechanism or derivatives;

4. (d)

   confirm that outsourced activities are not considered part of ORTM;

5. (e)

   confirm that the institution calculates the AMA own funds requirements gross- and net-of-ORTM for each capital calculation, at a level of granularity such that any erosion in the amount of protection available, can be immediately recognised for its effect on capital requirements;

6. (f)

   confirm that where material losses are incurred, affecting the coverage provided by the ORTM or where changes in the ORTM contracts create major uncertainty as to their coverage, the institution recalculates its AMA own funds requirements with an additional margin of conservatism.