Executive Summary

Legal Basis

RM-A.2.1

This Module was first issued in April 2005 by the BMA together with the rest of Volume 3 (Insurance). Any material changes that have subsequently been made to this Module are annotated with the calendar quarter date in which the change was made: UG-3 provides further details on Rulebook maintenance and version control.

RM-A.2.2

When the CBB replaced the BMA in September 2006, the provisions of this Module remained in force. Volume 3 was updated in January 2007 to reflect the switch to the CBB; however, new calendar quarter dates were only issued where the update necessitated changes to actual requirements.

RM-A.2.3

A list of recent changes made to this module is detailed in the table below:

RM-A.2.3 [Deleted]

RM-A.2.4

Guidance on the implementation and transition to Volume 3 (Insurance) is given in Module ES (Executive Summary).

RM-B.1.1

Unless otherwise stated in a Rule, or exempted in writing by the CBB, the contents of this Module apply to Bahraini insurance firms and Bahraini insurance brokers on a consolidated basis, and to overseas insurance firms and overseas insurance brokers with respect to their operations either booked in or undertaken from Bahrain.

RM-B.1.2

Because of the nature of their activities, insurance brokers are not subject to Sections RM-4.1 (Market Risk) and RM-5.1 (Insurance Technical Risk).

RM-B.1.3

The CBB will only consider granting an exemption to a Rule in this Module, where the insurance firm concerned can demonstrate that it has equivalent systems and controls applied at the group or parent entity level, that achieve the same objective as the CBB requirement concerned. The purpose of such an exemption is to allow entity-wide or group-wide systems and requirements to be applied, where these achieve the same outcome: exemptions are therefore only likely to be given with respect to overseas insurance licensees, and possibly Bahraini licensees that are part of an overseas group. Because of their general nature, exemptions will not be considered with regards to the requirements contained in Chapter RM-1 (Risk Management Systems and Controls).

RM-B.1.4

For the purposes of Paragraph RM-B.1.1, 'consolidated basis' means including the branches and subsidiaries of the Bahraini insurance firm or Bahraini insurance broker, whether these are located inside or outside the Kingdom of Bahrain.

RM-B.1.5

Unless otherwise stated in a Rule, or exempted in writing by the CBB, the contents of this Module apply to operators of insurance exchanges authorised to carry out insurance business in Bahrain.

RM-B.1.6

The contents of this Module do not apply to insurance consultants, insurance managers and to appointed representatives, because the nature of their activities only expose policyholders to limited financial risk.

RM-B.1.7

While the business of insurance managers is not subject to this Module, clients of insurance managers that are insurance firms, such as captive insurers, are subject to the requirements of this Module. The insurance manager, in fulfilling its obligations to its clients, therefore needs to manage the affairs of its clients in accordance with the requirements of the Rulebook, including this Module.

RM-B.1.8

An insurance licensee's failure to establish, in the opinion of the CBB, adequate systems and controls will result in it being in breach of Condition 6 of the Licensing Conditions of Section AU-2.6 of Module AU (Authorisation). This failure may result in the CBB withdrawing or imposing restrictions on the license, or the licensee being required to inject more capital.

RM-1.1.1

A licensee must take reasonable care to establish and maintain effective systems and controls as are appropriate to its business to manage its risks. These policies must be documented and regularly reviewed.

RM-1.1.2

The licensee's identification, assessment, management and reporting of risks must consider (but is not limited to) the management of credit, liquidity, market, technical, operational (including outsourcing) and group risks, as outlined in Chapters RM-2 to RM-8.

RM-1.1.3

As noted in Paragraph CA-A.1.2, insurance firms must regularly carry out their own assessment of their capital needs, appropriate to their risk profile, and maintain a process for monitoring and maintaining their actual capital in line with their assessment.

RM-1.1.4

For purposes of Paragraph RM-1.1.3, the CBB does not prescribe the detailed form of such assessment, in order to give insurance firms flexibility to develop their own approaches. Where a firm's assessment suggests that a level of capital that should be held is higher than the minimum required per Chapter CA-2, the CBB would expect firms to hold capital in line with their assessment.

RM-1.1.5

The licensee must determine if any additional risk categories, other than those referred to in Paragraph RM-1.1.2 and RM-1.1.3, are relevant to its business and therefore need to be addressed.

Risk Management

Risk Management Function

RM-2.1.1

Section RM-2.1 applies only to insurance firms and insurance brokers.

RM-2.1.2

Insurance licensees must identify and manage their credit risk across all their operations, and document their policies and procedures for achieving this in a credit risk policy. This policy must be regularly reviewed.

RM-2.1.3

Amongst other things, a licensee's credit risk policy must identify the limits it applies to both individual counterparties and categories of counterparty, how it monitors movements in counterparty risk and how it mitigates loss in the event of counterparty failure.

RM-2.1.4

Credit risk is the risk that a counterparty will not meet its obligations in accordance with agreed terms, causing a financial loss. In the case of an insurance firm, credit risk will normally occur with:

RM-2.1.5

The licensee should consider these and other credit risk factors that may affect the licensee's solvency:

RM-2.1.6

In addition to considering the failure of counterparties, the licensee should also consider scenarios such as increases in late payment and doubtful debt provisioning, and measures to mitigate credit risks, such as premium payment warranties (whereby policy coverage only becomes effective on payment of premiums).

RM-2.1.7

An insurance firm must monitor its exposure, defined as sums insured, to an individual reinsurer and provide details of its reinsurance programme to the CBB. It must notify the CBB if its total aggregate exposure, on a premium basis, to one reinsurer (or group of related reinsurers) exceeds 25% of individual or aggregate risks and why it considers that this exposure does not pose a credit risk for which a provision should be made.

RM-2.1.8

Paragraph RM-2.1.7 does not constitute a prohibition on exceeding this amount as the CBB recognises that there may be situations and types of reinsurance arrangements where reinsurance in excess of this limit might be necessary. The CBB should however be notified of these cases, and the licensee should include an explanation of the reason why it believes that the excess exposure is an acceptable credit risk.

RM-2.1.9

In addition to the requirements noted in Paragraph RM-2.1.7, insurance firms must evaluate the credit worthiness of individual reinsurers at the time of ceding business and on an on-going basis.

RM-2.1.10

The credit worthiness of reinsurers may be established by referring to ratings provided by international rating agencies, such as Standard & Poors or AM Best.

RM-2.1.11

An insurance licensee must keep its exposure to individual assets or classes of assets within prudent levels, taking into account the relationship between counterparties, geographical and sectoral concentration, duration of exposures and the exposure to single loss events (e.g. regional economic downturns). Chapter CA-4 provides additional Rules in establishing limitations in the valuation of assets.

RM-2.1.12

Specific counterparty limits are contained in Paragraph CA-4.2.33.

RM-2.1.13

An insurance licensee must take into account the risk of default in the valuation of its assets.

RM-3.1.1

Section RM-3.1 applies only to insurance firms and insurance brokers.

RM-3.1.2

Insurance licensees must identify and manage their liquidity risk across all their operations, and document their policies and procedures for achieving this in a liquidity risk policy. This policy must be regularly reviewed.

RM-3.1.3

Liquidity risk is the risk of not being able to meet liabilities when they fall due, even though a firm may still be solvent. Liquidity risk can result from claims falling due earlier than anticipated, higher than expected policy surrender or changes in mortality rates.

RM-3.1.4

Liquidity risk in insurance licensees relates to the management of their cash flow and the risk to their meeting short-term liabilities due to liquidity problems. The risks of matching of assets and liabilities, currency risk etc. are considered as part of insurance risk and are the subject of specific limits in Section CA-6.1.

RM-3.1.5

Insurance licensees must also carry out stress testing to assess the resilience of their financial resources to any identified areas of material liquidity risk. This stress testing may take into account the general characteristics, and licensee's experience, of the classes of business that it writes, any discounting of its claims provisions, and any mitigating factors that it considers relevant such as the ability to sell assets quickly and the options available to re-schedule the payments to policyholders and other counterparties.

RM-3.1.6

Where the insurance licensee considers that the nature of its assets or liabilities and the matching of its liabilities result in no significant liquidity risk exposure, it will not be expected to carry out stress testing. The CBB will expect it to document the reasons for its decision and be prepared to discuss these during an on-site visit.

RM-3.1.7

When assessing liquidity risk, the insurance licensee should consider the extent of mismatch between assets and liabilities and the amount of assets held in highly liquid, marketable forms should unexpected cash flows lead to a liquidity problem. The price concession of liquidating assets is a prime concern when assessing such liquidity risk and should be built into any assessment of capital adequacy.

RM-3.1.8

Captive insurance firms are exempted from the specific requirement to undertake stress and scenario testing aimed at testing the resilience of their financial resources to specific areas of significant risk.

RM-4.1.1

Section RM-4.1 applies only to insurance firms.

RM-4.1.2

Insurance licensees must identify and manage their market risk across all their operations, and document their policies and procedures for achieving this in a market risk policy. This policy must be regularly reviewed.

RM-4.1.3

Market risk relates to the exposure of the insurance licensee, to fluctuations in the market value, currency or yield of an asset.

RM-4.1.4

A licensee's market risk policy must identify its appetite for market risk, systems for identifying, reporting and documenting market risk and mitigation factors in place.

RM-4.1.5

Insurance firms (other than captives) must carry out stress testing to assess the resilience of their financial resources to any identified areas of material market risk under reasonably foreseeable circumstances. This stress testing may take into account the rating and geographical spread of its assets, the duration of their maturity relative to the licensee's liabilities and the fluctuation of interest and currency rates.

RM-4.1.6

The insurance licensee should consider potential market risk events that may affect its solvency. These include the following:

RM-4.1.7

Chapter CA-4 contains Rules and Guidance relating to the valuation of assets and counterparty limits. Chapter CA-6 contains Rules and Guidance relating to currency matching and localisation.

RM-4.1.8

Where the insurance licensee considers that the nature of its assets and the matching of its liabilities result in no significant market risk exposure (e.g. its investments consist entirely of cash and bank deposits), it will not be expected to carry out stress testing. The CBB will expect it to document the reasons for its decision and be prepared to discuss these during an on-site visit.

RM-5.1.1

Section RM-5.1 applies only to insurance firms.

RM-5.1.2

An insurance firm licensee must identify and manage its insurance technical risk across all its operations, and document its underwriting and claims policies for achieving this in an underwriting policy.

RM-5.1.3

Insurance technical risk is the normal trading risk, arising out of contracts of insurance, that the insurance licensee is exposed to in its day-to-day operations, and includes the technical and actuarial bases of calculation for premiums and technical provisions in both long-term and general insurance.

RM-5.1.4

An insurance firm must document its underwriting and claims policies and review these at regular intervals.

RM-5.1.5

The underwriting policy must be at a level of detail appropriate to the nature, magnitude and source of its business and must include (but is not limited to) a description of the following elements:

RM-5.1.6

The claims policy must be at a level of detail appropriate to the nature, magnitude and source of its business and must include (but is not limited to) a description of the following elements:

RM-5.1.7

Where necessary to demonstrate the adequacy of its financial resources under reasonably foreseeable deteriorations of its underwriting and claims positions, the insurance firm must conduct stress testing under a range of foreseeable adverse scenarios.

RM-5.1.8

In assessing the outcome of adverse scenarios on the future solvency position, insurance firms must consider the impact of future further deterioration claims reserves (or, in the case of long- term business, the inadequacy of mathematical reserves) and future loss ratios being higher than past claims patterns would suggest.

RM-5.1.9

Factors that licensees may consider appropriate in assessing the levels of underwriting risk include:

RM-5.1.10

Factors that insurance licensees may consider appropriate in assessing the levels of claims risk include:

RM-5.1.11

The CBB believes that insurance firms need to consider carefully dealing with reinsurers fronting 100% of the risks that is ceded to them. The concern is that the reinsurer ceding 100% of the risk to a retrocessionaire has little incentive to adhere to proper standards of underwriting, due to it receiving a fee, based on maximizing volume of premium, at the expense of underwriting soundness. Fronting arrangements can result in abrupt cancellation by the assuming reinsurer and sometimes refusal to pay claims because of the lack of observation of the understandings with regard to business quality that were agreed upon when the arrangement was negotiated. Consequently, insurers may have to assume risks for which they believed to have covered through a proper reinsurance arrangement, should the reinsurer no longer honour the arrangement. The CBB will scrutinise carefully the management by firms of the risks associated with fronting, in the course of its supervision.

RM-5.1.12

Additional factors that general insurers may consider appropriate in assessing the levels of claims risk include:

RM-5.1.13

Additional factors that long-term insurers may consider appropriate in assessing the levels of claims risk include future variations in investment returns and in mortality and morbidity rates.

RM-6.1.1

Section RM-6.1 applies only to insurance firms and insurance brokers

RM-6.1.2

An insurance licensee must identify and manage its operational risk across all its operations, and document its policies and procedures for achieving this in an operational risk policy.

RM-6.1.3

Operational risk is the risk to the insurance licensee of loss resulting from inadequate or failed internal processes, people and systems, or from external events.

RM-6.1.4

Insurance licensees must consider the impact of operational risks on their financial resources and solvency. In so doing, insurance licensees must consider the factors listed under Paragraph RM-6.1.5, and any other factors relevant to their business.

RM-6.1.5

In assessing potential operational risk, events that may affect the licensee's solvency include the following:

RM-6.1.6

Human failure may arise either from the loss of one or more key individuals, lack of competence or failure of an individual to follow procedures or observe authority levels.

RM-6.1.7

The insurance licensee must identify those processes, systems and premises that are critical to its survival and continuing operations and must develop contingency plans ('business continuity planning') covering these areas. These plans must be regularly updated and tested.

RM-6.1.8

An insurance licensee should have the means to ensure that its statutory and regulatory responsibilities are effectively carried out, especially where the group is subject to matrix management. More specifically, clear reporting lines and responsibilities need to be defined to minimize the risk that statutory and regulatory responsibilities are overlooked.

RM-6.1.9

Insurance licensees must ensure that there is adequate succession planning and that the risks arising from the loss of key individuals are thereby contained.

RM-6.1.10

The licensee's Board is responsible for ensuring the suitability and competence of employees for the assigned tasks, and for the adequacy of staffing levels. Depending on their size and scale of their activities, insurance licensees should consider having in place a formal appraisal process and a training plan for professional members of staff. For employees that are members of professional bodies it may also be appropriate for this to be integrated with requirements of those bodies for Continuing Professional Education (CPE).

RM-6.1.11

Insurance licensees must identify, manage and control the risks that arise from human failure, including employees and agents. These include inappropriate remuneration policies, health and safety and employment policies.

RM-6.1.12

The licensee's business continuity planning, risk identification and reporting must cover reasonably foreseeable external events and their likely impact on the firm and its business portfolio.

Physical Security Measures

Third Party Insurance

RM-7.1.1

This Chapter sets out the CBB’s approach to outsourcing by licensees. It also sets out various requirements that licensees must address when considering outsourcing an activity or function.

RM-7.1.2

In the context of this Chapter, ‘outsourcing’ means an arrangement whereby a third party performs on behalf of a licensee an activity which commonly would have been performed internally by the licensee. Examples of services that are typically outsourced include data processing, cloud services, customer call centres and back-office related activities.

RM-7.1.3

In the case of branches of foreign entities, the CBB may consider a third-party outsourcing arrangement entered into by the licensee’s head office/regional office or other offices of the foreign entity as an intragroup outsourcing, provided that the head office/regional office submits to the CBB a letter of comfort which includes, but is not limited to, the following conditions:

RM-7.1.4

The licensee must not outsource the following functions:

RM-7.1.5

For the purposes of Paragraph RM-7.1.4, certain support activities, processes and systems under these functions may be outsourced (e.g. call centres, data processing, credit recoveries, cyber security, e-KYC solutions) subject to compliance with Paragraph RM-7.1.7. However, strategic decision-making and managing and bearing the principal risks related to these functions must remain with the licensee.

RM-7.1.6

Branches of foreign entities may be allowed to outsource to their head office, the risk management function stipulated in Subparagraph RM-7.1.4 (iv), subject to CBB’s prior approval.

RM-7.1.7

Licensees must comply with the following requirements:

RM-7.1.8

For the purpose of Subparagraph RM-7.1.7 (iv), licensees as part of their assessments may use the following:

When conducting on-site examinations, licensees should ensure that the data of the outsourcing service provider’s other clients is not negatively impacted, including impact on service levels, availability of data and confidentiality.

RM-7.1.9

For the purpose of Subparagraph RM-7.1.7 (i), the CBB will provide a definitive response to any prior approval request for outsourcing within 10 working days of receiving the request complete with all the required information and documents.

RM-8.1.1

Section RM-8.1 applies only to Bahraini insurance firms and Bahraini insurance brokers.

RM-8.1.2

An insurance licensee must identify, manage and control risks to its activities arising from the activities and financial position of other members of its group.

RM-8.1.3

The CBB may impose additional restrictions on the insurance licensee should it have reason to believe that other members of the group pose undue risk to the insurance licensee. These restrictions, for instance, may try to limit the risk of financial contagion, by restricting financial transactions between the licensee and group members.

RM-8.1.4

For purposes of Section RM-8.1, the term group refers to a person or firm who is:

RM-8.1.5

The Board is expected to request sufficient information of its group members to allow it to address group risks.

RM-8.1.6

Where the licensee's group or parent reports its own solvency position to its regulatory authority (on a group or 'solo' basis), a copy of this calculation must be provided to the CBB within 30 calendar days from the due date to the other regulatory authority, in accordance with Paragraph CA-7.1.8.

RM-8.1.7

Where a licensee is part of a larger financial services group, it may rely on the systems and controls that the group (or its parent company) has put in place. The Board in these circumstances should establish what systems and controls are in place and should ensure that it is provided with sufficient and timely information on the solvency position of the group. This should be evidenced in the prudential records retained in Bahrain.

RM-8.1.8

In assessing group systems and controls, an insurance licensee must give consideration to:

RM-8.1.9

An insurance licensee should not be subject to material influence by other entities of the group through informal or undocumented channels. The overall governance, high-level controls and reporting lines with the group should be clearly documented.

Role of the Board and Senior Management

Cyber Security Strategy

Cyber Security Policy

Approach, Tools and Methodology

Prevention Controls

Cyber Risk Identification and Assessments

Cyber Incident Detection and Management

Recovery

Cyber Security Insurance

Training and Awareness

Reporting to CBB

Appendix A – Cyber Security Control Guidelines

The Control Guidelines consists of five Core tasks which are defined below. These Functions are not intended to form a serial path or lead to a static desired end state. Rather, the Functions should be performed concurrently and continuously to form an operational culture that addresses the dynamic cyber security risk.

Identify – Develop an organisation-wide understanding to manage cyber security risk to systems, people, assets, data, and capabilities. The activities in the Identify Function are foundational for effective use of the Cyber Security Risk Management Framework. Understanding the business context, the resources that support critical functions, and the related cyber security risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs.

Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. The Protect Function supports the ability to limit or contain the impact of a potential cyber security incident.

Detect – Develop and implement appropriate activities to identify the occurrence of a cyber security incident. The Detect Function enables timely discovery of cyber security events.

Respond – Develop and implement appropriate activities to take action regarding a detected cyber security incident. The Respond Function supports the ability to contain the impact of a potential cyber security incident.

Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cyber security incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cyber security incident.

Below is a listing of the specific cyber security activities that are common across all critical infrastructure sectors:

IDENTIFY

Asset Management: The data, personnel, devices, systems, and facilities that enable the licensee to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the licensee’s risk strategy.

Business Environment: The licensee’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cyber security roles, responsibilities, and risk management decisions.

Governance: The policies, procedures, and processes to manage and monitor the licensee’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cyber security risk.

Risk Assessment: The licensee understands the cyber security risk to licensee’s operations (including mission, functions, image, or reputation), licensee’s assets, and individuals.

Risk Management Strategy: The licensee’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.

Third Party Risk Management: The licensee’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing third party risk. The licensee has established and implemented the processes to identify, assess and manage supply chain risks.

PROTECT

Identity Management, Authentication and Access Control: Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.

Awareness and Training: The licensee’s personnel and partners are provided cyber security awareness education and are trained to perform their cyber security-related duties and responsibilities consistent with related policies, procedures, and agreements.

Data Security: Information and records (data) are managed consistent with the licensee’s risk strategy to protect the confidentiality, integrity, and availability of information.

Information Protection Processes and Procedures: Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational units), processes, and procedures are maintained and used to manage protection of information systems and assets.

Maintenance: Maintenance and repairs of information system components are performed consistent with policies and procedures.

Protective Technology: Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.

DETECT

Anomalies and Events: Anomalous activity is detected and the potential impact of events is understood.

Security Continuous Monitoring: The information system and assets are monitored to identify cyber security events and verify the effectiveness of protective measures.

Detection Processes: Detection processes and procedures are maintained and tested to ensure awareness of anomalous events.

RESPOND

Response Planning: Response processes and procedures are executed and maintained, to ensure response to detected cyber security incidents. Response plan is executed during or after an incident.

Communications: Response activities are coordinated with internal and external stakeholders.

Analysis: Analysis is conducted to ensure effective response and support recovery activities.

Mitigation: Activities are performed to prevent expansion of an event, mitigate its effects, and resolve the incident.

Improvements: The response activities are improved by incorporating lessons learned from current and previous detection/response activities.

RECOVER

Recovery Planning: Recovery processes and procedures are executed and maintained to ensure restoration of systems or assets affected by cyber security incidents. Recovery plan is executed during or after a cyber security incident.

Improvements: Recovery planning and processes are improved by incorporating lessons learned into future activities.

Communications: Restoration activities are coordinated with internal and external parties (e.g. coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors).