Houston, we have a problem: a detailed account
The DORA Regulation will become applicable to all (re)insurance undertakings subject to the Solvency II directive (SII) on 17 January 2025 according to its Article 2(3)(b)). Very small insurers, exempted from SII according to Article 4 SII, are also exempted from the obligations under the DORA regulation. But the application dates of these two European legislative instruments don’t fit together which is especially a problem for a new group of exempted very small insurers.
The Article 4 SII exemption of insurance undertakings is based on three categories of criteria: quantitative thresholds for size, reinsurance for nature and business lines for complexity, although the title of the article only refers to size. In 2019, of the 3016 (re)insurers undertakings, around 14% were exempted. It should be noted that 13 EEA countries do not exclude any undertaking from SII. The countries that exclude undertakings apply SII with exemptions, or Solvency I, or a sui generis regime. The recent agreed amendments to SII changed the size thresholds from their last updated October 2021 version: the annual GPW income went up from 5,4 to 15 million euro, and the gross technical provisions increased from 26,6 to 50 million euro, both for solo undertakings and for groups. However, as these new thresholds will only become applicable on 29 January 2027 (24 months after the entry into force, 20 days after publication in the OJ of the amended SII directive), there is a new category of very small insurers that risks to have to apply DORA during approximately 2 years. That new category of very small undertakings concerns those undertakings today still in scope of the SII directive but which will join the exempted category in 2027. According to our calculations based on Insurance Risk Data, this will concern about 110-120 insurance undertakings in 18 EEA countries, mainly, but not exclusively mutual insurers or subsidiaries of large groups.
EIOPA pinpointed this incoherence between DORA and SII in terms of scope and has, based on Article 9a(4) of the EIOPA Regulation (and not Article 9a(1), why?), sent a detailed account in writing to the competent authorities and the Commission, dated 14 November 2024. The ‘detailed account’ of the unintended impact of the size thresholds, which EIOPA provided the Commission with, explains the legal basis and the issue. It also contains an annex: ‘EIOPA Opinion on the impact of increased size thresholds as part of the Solvency II review on insurance undertakings in scope of DORA’. In that Annex, EIOPA opines that including these exempted undertakings in the scope of the DORA regulation ‘would not significantly contribute to the regulation’s primary objective of enhancing digital operational resilience in the European financial sector. This excessive compliance burden, without a proportionate benefit in terms of improved resilience, places an unnecessary strain on these companies’, thus EIOPA. EIOPA suggests two actions: it considers first that the Commission should initiate an amendment of Union law to address this issue (as neither EIOPA, they explain, nor the competent authorities possess any power to waive the application of Union law), and second, that the competent authorities should implement a risk-based prioritization of supervisory actions and consider a proportionate approach concerning DORA compliance, “expecting competent authorities not to prioritize supervisory actions based on the relevant requirements in the DORA regulation in relation to these small insurance undertakings”. Obviously, EIOPA’s initiative would not have been necessary if the co-legislators – which for sure must have been aware of the possible incoherence of the deadlines between DORA and SII – would have included a clause to amend the DORA deadline in the SII amendment exercise for these Article 4 SII ‘non-directive or exempted’ insurers, quod non. A pity. Industry voiced its concern already months ago, but no “quick fix” was proposed by the Commission, while this would have been, I believe, a low-hanging-fruit quick win in the Commission’s widely communicated burden-reducing-effort. What EIOPA is trying to do is laudable but raises the question whether an opinion expecting non-prioritization is a solution for a legislative conundrum.
My wish for 2025: coherent and thorough lawmaking.
