Clifford Chance

The PRA has recently published its 2024/25 Business Plan, which continues to be structured around the PRA's four strategic priorities.

The PRA's strategic priorities for 2024/25 remain consistent with those outlined in its 2023/24 Business Plan. This reflects the comprehensive update undertaken last year to take account of the PRA's expanded rulemaking powers, new secondary objective, and strengthened accountability requirements to Parliament under the Financial Services and Markets Act (FSMA 2023). This will be the PRA's first full year of operating under FSMA 2023, which is expected to be another active year for the PRA and, therefore, regulated businesses.

There are a number of continuing priorities across the insurance sector, including Solvency II reforms, cyber and facilitating international competitiveness, but the key theme that stands out across the Business Plan is resilience.

This article does not summarise all the priorities in the 2024/25 Business Plan, but the noteworthy priorities include the following:

Resilience

• Operational Resilience
  • FSMA 2023 empowers HM Treasury, in consultation with the UK regulators, to designate certain third-party services providers as "critical" if they provide services to the financial sector, which, if those services fail or are disrupted, could pose a risk to the stability of, or confidence in, the UK financial system. Following the end of the consultation period of CP26/23 – "Operational Resilience: Critical third parties to the UK financial sector" last month, the PRA is actively working with other authorities this year to develop the final policy and oversight approach to critical third-party service providers, who may include IT providers and cloud services. The designation process, and the finalised policy, could therefore impact UK insurers who rely on such third parties. Insurers will need to carefully consider the potential impact of any designations and how disruptions to critical services from these providers could affect their operations. Insurers will therefore need to factor the above issues into their operational resilience plans, as explained below.
  • The PRA, FCA and Bank of England operational resilience policies will each come into force in March 2025. As firms have now identified their most important business services, set impact tolerances and commenced a programme of scenario testing, the PRA will work closely with the FCA to assess firms' progress, focusing on the ability of firms to deliver important business services within defined impact tolerances.
• Cyber Resilience
  • The PRA considers adequate standards of cyber resilience as a major priority for this year. The PRA will continue to monitor and assess firms' ability to manage cyber threats through the ongoing use of threat-led penetration testing and will continue ongoing sector engagement through the Cross-Market Operation Resilience Group (CMORG), which serves as the central forum for industry-wide discussions on operational resilience.
  • If the proposals are finalised, the Critical Third Party rules and requirements will include specific measures on technology and cyber resilience.
  • The PRA and FCA will also conduct the third edition of the joint survey on machine learning in UK financial services in Q2 2024 to further explore how best to address issues and risks posed by artificial intelligence and machine learning.
• Financial Resilience
  • Following the recent increased demand for longevity risk transfer and appetite for "jumbo" reinsurance deals, funded reinsurance continues to be a focus for the PRA in the UK life insurance market. Subject to responses to CP 24/23 "Funded Reinsurance", the PRA will finalise and implement its policy expectations on how it expects firms to address the risk of an erosion in standards for assets used as collateral in funded reinsurance transactions, at both an individual transaction level and at aggregate level. This will include the expectation that firms place limits on their activities to ensure sound risk management.
  • This year, the PRA will also prepare to examine exposures to the recapture of funded reinsurance in the 2025 life insurance stress test.
  • As the scope of technology continues to expand, monitoring and assessing cyber underwriting risk will also be at the core of the PRA's supervisory focus, particularly for firms with material exposures. The PRA has also recently undertaken a thematic project focused on cyber underwriting risk and is expected to publish its aggregate findings soon.
  • The PRA has highlighted that global geopolitical risks have intensified over the past year and noted that their 2023 model drift analysis revealed that firms using internal models within the non-life sector have generally made limited allowance for economic and geopolitical uncertainties. Additionally, the analysis identified potential optimism in expected underwriting profits and the costs and benefit of reinsurance. In response, the PRA will continue its scrutiny of internal models and will address perceived systemic trends that may weaken the robustness of models used across the market as a whole, as well as specific model drift within individual firms.
  • The reforms to Solvency II will also offer life insurers opportunities to expand the range of credit risk assets that are used to back their annuity liabilities and are also intended to enable them to meet their commitments to invest in assets that contribute to the transition to net zero. Insurers' capabilities in these opportunities will remain a key focus for the PRA as increased activity in the bulk purchase annuity market is, in the PRA's view, expected to lead to exposure to credit risk and potentially concentrations in exposure to internally valued and rated assets.
• Solvency II Reforms
  • It is expected that the PRA will publish a number of its final policies in respect to the implementation of Solvency II, including on the matching adjustment (MA) reforms and a final taxonomy package on regulatory reporting and disclosure reports in Q2 2024.
  • Earlier this month, the PRA issued a statement on its website to clarify points on the MA reforms set out in CP19/23 – "Review of Solvency II: Reform of the Matching Adjustment", and it is expected that the PRA will publish its final policy in June 2024. The majority of these reforms will be implemented through legislation which will take effect from the end of June to allow PRA-authorised firms to take immediate advantage of new investment opportunities. The remaining Solvency II reforms consulted upon in CP12/23 – "Review of Solvency II: Adapting to the UK insurance market" will take effect on 31 December 2024
  • To facilitate the implementation of these reforms, the PRA intends to streamline the application process for new internal model permissions and variations of existing permissions and will publish templates to assist with the preparation of high-quality and complete applications by firms.
• International competitiveness
  • At the end of 2022, the PRA introduced changes to the regulation of Insurance Special Purpose Vehicles (ISPVs) to make the UK more competitive as an international Insurance Linked Securities (ILS) destination. However, the PRA acknowledges the changes did not result in as much activity as originally envisaged and expects to consult on a package of reforms to the regime. The potential reforms are intended to allow for a wider range of transaction structures in the UK regime and to further improve the speed of the application process, and thereby also reduce costs for applicants.
  • The PRA will also introduce a new "mobilisation" regime to facilitate entry and expansion for new insurers from 31 December 2024. The Business Plan suggests that newly authorised insurers in mobilisation could be offered the option of using a set period of time to build up systems and resources while operating with business restrictions, proportionate regulatory requirements and lower capital requirements. This new regime could be helpful for insurtech startups to enter the UK market.

There is a significant amount of regulatory engagement in the pipeline this year, with a broad section of reviews and proposals expected over the next 12 months. We would recommend that firms routinely monitor announcements from the PRA, FCA and HM Treasury as well as the various consultation papers and policy statements referenced in the PRA's 2024/25 Business Plan. Whilst the new PRA Rulebook has been launched, Solvency II reforms have not yet been incorporated. This means firms should stay informed about upcoming updates to ensure their continued compliance. Several changes relevant to operational resilience will take effect within the next year. Firms should prioritise ensuring their operational resilience frameworks are fully implemented and functional by March 2025.