Senate File 189 AN ACT RELATING TO A RISK MANAGEMENT FRAMEWORK FOR INSURERS AND INSURANCE GROUPS AND INCLUDING PENALTY AND APPLICABILITY PROVISIONS. BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA: Section 1. NEW SECTION . 522.1 Purpose and scope —— legislative intent. 1. The purpose of this chapter is to require insurers to maintain a risk management framework and complete an own risk and solvency assessment and to provide guidance and instructions for the filing of own risk and solvency assessment reports with the commissioner. 2. The general assembly finds and declares that own risk and solvency assessment summary reports will contain confidential and sensitive information related to an insurer’s or insurance group’s identification of risks material and relevant to the insurer or insurance group filing the report. This information will include proprietary and trade secret information that has the potential for harm and competitive disadvantage to the insurer or insurance group if the information is made public. It is the intent of the general assembly that own risk and solvency assessment summary reports filed with the commissioner are confidential documents, shall be shared only as provided in this chapter and to assist the commissioner in the performance of the commissioner’s duties, and shall not be subject to public disclosure. Sec. 2. NEW SECTION . 522.2 Definitions. 1. “Affiliate” , or a person affiliated with a specific person, means the same as defined in section 521A.1. 2. “Commissioner” means the Iowa commissioner of insurance.

Senate File 189, p. 2 3. “Insurance group” means the insurers and affiliates included within an insurance holding company system as defined in section 521A.1. 4. “Insurer” means the same as defined in section 521A.1. 5. “Own risk and solvency assessment” or “assessment” means a confidential internal assessment, appropriate to the nature, scale, and complexity of an insurer or insurance group, that is conducted by that insurer or insurance group, of the material and relevant risks associated with the insurer or insurance group’s current business plan, and the sufficiency of capital resources to support those risks. 6. “Own risk and solvency assessment guidance manual” or “guidance manual” means the current version of the own risk and solvency assessment guidance manual developed and adopted by the national association of insurance commissioners and amended from time to time. A change in the guidance manual is effective and applicable to this chapter on January 1 following the calendar year in which the change was adopted by the national association of insurance commissioners. 7. “Own risk and solvency assessment summary report” or “summary report” means a confidential high-level summary of the own risk and solvency assessment conducted by an insurer or insurance group. 8. “Supervisory college” means a temporary or permanent forum for communication and cooperation between regulators charged with supervision of an insurer or its affiliates. Sec. 3. NEW SECTION . 522.3 Risk management framework. An insurer shall maintain a risk management framework to assist the insurer with identifying, assessing, monitoring, managing, and reporting on the insurer’s material and relevant risks. This requirement is satisfied if the insurance group of which the insurer is a member maintains a risk management framework applicable to the operations of the insurer. Sec. 4. NEW SECTION . 522.4 Own risk and solvency assessment requirement. 1. Subject to section 522.6, an insurer, or the insurance group of which the insurer is a member, shall regularly conduct an own risk and solvency assessment consistent and comparable with the assessment process contained in the own risk and solvency assessment guidance manual. 2. An own risk and solvency assessment shall be conducted at least annually, but an assessment shall also be conducted at any time when there are significant changes to the risk profile

Senate File 189, p. 3 of an insurer or the insurance group of which the insurer is a member. Sec. 5. NEW SECTION . 522.5 Own risk and solvency assessment summary report. 1. a. Beginning in 2015, an insurer shall annually submit to the commissioner an own risk and solvency assessment summary report or any combination of reports that together contain the information described in the own risk and solvency assessment guidance manual that is applicable to the insurer or the insurance group of which the insurer is a member. b. If the insurer is a member of an insurance group, the insurer shall submit the report or reports required by this section to the state commissioner that is the lead state commissioner of the insurance group of which the insurer is a member, as determined by the procedures contained in the financial analysis handbook adopted by the national association of insurance commissioners. c. The own risk and solvency assessment summary report shall be filed after the insurer or the insurance group of which the insurer is a member conducts the insurer’s or insurance group’s strategic planning process. The insurer or insurance group shall notify the commissioner as to the date that the summary report will be filed. 2. The own risk and solvency assessment summary report shall include the signature of the insurer’s or insurance group’s chief risk officer or another executive having responsibility for the oversight of the insurer’s enterprise risk management process, attesting that to the best of that person’s belief and knowledge the insurer applies the enterprise risk management process described in the summary report and that a copy of the summary report has been provided to the insurer’s or insurance group’s board of directors or the appropriate committee of that board. 3. An insurer may comply with subsection 1 by submitting the most recent and substantially similar report provided by the insurer or another member of the insurance group of which the insurer is a member to the commissioner of insurance of another state or to a supervisor or regulator of a foreign jurisdiction, if that report provides information that is comparable to the information described in the own risk and solvency assessment guidance manual. Any such report that is submitted in a language other than English must be accompanied by a translation of that report into the English language.

Senate File 189, p. 4 Sec. 6. NEW SECTION . 522.6 Exemption. 1. An insurer is exempt from the requirements of this chapter if both of the following apply: a. The insurer has annual direct written and unaffiliated assumed premium, including international direct and assumed premium, but excluding premiums reinsured with the federal crop insurance corporation and the federal flood program, of less than five hundred million dollars. b. The insurance group of which the insurer is a member has annual direct written and unaffiliated assumed premium, including international direct and assumed premium, but excluding premiums reinsured with the federal crop insurance corporation and the federal flood program, of less than one billion dollars. 2. If an insurer qualifies for exemption from the requirements of this chapter pursuant to paragraph “a” of subsection 1, but the insurance group of which the insurer is a member does not qualify for exemption pursuant to paragraph “b” of subsection 1, then the own risk and solvency assessment summary report that is required pursuant to section 521H.5 shall include information concerning every insurer in the insurance group. This requirement may be satisfied by the submission of more than one summary report for any combination of insurers in the insurance group provided that the combination of reports submitted includes every insurer in the insurance group. 3. If an insurer does not qualify for exemption pursuant to paragraph “a” of subsection 1, but the insurance group of which the insurer is a member qualifies for exemption pursuant to paragraph “b” of subsection 1, then the only own risk and solvency assessment summary report that is required pursuant to section 522.5 is the report applicable to that insurer. 4. An insurer that does not qualify for exemption pursuant to subsection 1 may apply to the commissioner for a waiver from the requirements of this chapter based upon unique circumstances. In deciding whether to grant the insurer’s request for a waiver, the commissioner may consider the type and volume of business written, ownership and organizational structure, and any other factors the commissioner considers relevant to the insurer or the insurance group of which the insurer is a member. If the insurer is part of an insurance group with insurers domiciled in more than one state, the commissioner shall coordinate with the state commissioner

Senate File 189, p. 5 that is the lead state commissioner of the insurance group, as determined pursuant to section 522.5, and with the other domiciliary commissioners in considering whether to grant the insurer’s request for a waiver. 5. Notwithstanding the exemptions provided in this section, the commissioner may do the following: a. Require that an insurer maintain a risk management framework, conduct an own risk and solvency assessment, and file an own risk and solvency assessment summary report based on unique circumstances including but not limited to the type and volume of business written, ownership and organizational structure, federal agency requests, and international supervisor requests. b. Require that an insurer maintain a risk management framework, conduct an own risk and solvency assessment, and file an own risk and solvency assessment summary report if the insurer has a risk-based capital level that is a company-action-level event as set forth in section 521E.3 for insurers and section 521F.4 for health organizations or that would cause the insurer to be in hazardous financial condition as set forth in 191 IAC 110, or if the insurer otherwise exhibits qualities of a troubled insurer as determined by the commissioner. 6. If an insurer that qualifies for an exemption pursuant to subsection 1 subsequently no longer qualifies for that exemption due to changes in premium as reflected in the insurer’s most recent annual statement or in the most recent annual statements of the other insurers in the insurance group of which the insurer is a member, the insurer shall have one year following the year the threshold is exceeded to comply with the requirements of this chapter. Sec. 7. NEW SECTION . 522.7 Contents of own risk and solvency assessment summary report. 1. The own risk and solvency assessment summary report shall be prepared consistent with the own risk and solvency assessment guidance manual, subject to the requirements of subsection 2. Documentation and supporting information shall be maintained and made available upon examination of an insurer or upon request of the commissioner. 2. The review of an own risk and solvency assessment summary report, and any additional requests for information, shall be made using procedures similar to the procedures currently used in the analysis and examination of multistate or global

Senate File 189, p. 6 insurers and insurance groups. Sec. 8. NEW SECTION . 522.8 Confidentiality. 1. Documents, materials, or other information, including an own risk and solvency assessment summary report, in the possession or control of the insurance division of the department of commerce, that are obtained by, created by, or disclosed to the commissioner or to any other person pursuant to this chapter, are recognized in this state as being proprietary and containing trade secrets. All such documents, materials, or other information, including the summary report, shall be confidential and privileged, shall not be subject to chapter 22, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. However, the commissioner is authorized to use such documents, materials, or other information, including the summary report, in the furtherance of any regulatory or legal action brought as a part of the commissioner’s official duties. The commissioner shall not otherwise make the documents, materials, or other information, including the summary report, public without the prior written consent of the insurer that provided the documents, materials, or other information, including the summary report. 2. The commissioner or any person who received documents, materials, or other information related to own risk and solvency assessments, through examination or otherwise, while acting under the authority of the commissioner or with whom such documents, materials, or other information are shared pursuant to this chapter, shall not be permitted or required to testify in any private civil action concerning any confidential documents, materials, or information, including summary reports, subject to subsection 1. 3. In order to assist in the performance of the commissioner’s regulatory duties, the commissioner may do any of the following: a. Upon request, share documents, materials, or other own risk and solvency assessment-related information, including the confidential and privileged documents, materials, or information subject to subsection 1, and including proprietary and trade secret documents, materials, or information, with other state, federal, or international financial regulatory agencies, including members of any supervisory college, with the national association of insurance commissioners, and with any third-party consultants designated by the commissioner,

Senate File 189, p. 7 provided that the recipient agrees in writing to maintain the confidentiality and privileged status of the documents, materials, or other assessment-related information and verifies in writing the legal authority to maintain such confidentiality and privilege. b. Receive documents, materials, or other own risk and solvency assessment-related information, including otherwise confidential and privileged documents, materials, or information, and proprietary and trade secret documents, materials, and information, from regulatory officials of other foreign or domestic jurisdictions, including members of any supervisory college, and from the national association of insurance commissioners, and shall maintain as confidential or privileged any documents, materials, or information received with notice or the understanding that the documents, materials, or other information received are confidential and privileged under the laws of the jurisdiction that is the source of the documents, materials, or information. 4. In order to assist in the performance of the commissioner’s regulatory duties, the commissioner shall enter into a written agreement with the national association of insurance commissioners or with a third-party consultant that is consistent with subsection 3, governing the sharing and use of information provided pursuant to this chapter, and that does all of the following: a. Specifies procedures and protocols regarding the confidentiality and security of information shared with the national association of insurance commissioners or with a third-party consultant pursuant to this chapter, including procedures and protocols of the national association of insurance commissioners for sharing information with other state regulators from states in which an insurance group has domiciled insurers. The agreement shall require that the recipient of such information must agree in writing to maintain the confidentiality and privileged status of the own risk and solvency assessment-related documents, materials, or other information and verify in writing the legal authority to maintain confidentiality and privilege. b. Specifies that ownership of information shared with the national association of insurance commissioners or with a third-party consultant pursuant to this chapter remains with the commissioner and that use of the information by the national association of insurance commissioners or by a

Senate File 189, p. 8 third-party consultant is subject to the direction of the commissioner. c. Prohibits the national association of insurance commissioners or a third-party consultant from storing the information shared pursuant to this chapter in a permanent database after the underlying analysis is completed. d. Requires that prompt notice be given to an insurer whose confidential information is in the possession of the national association of insurance commissioners or a third-party consultant pursuant to this chapter, that the information is subject to a request or subpoena to the national association of insurance commissioners or the third-party consultant for disclosure or production. e. Requires the national association of insurance commissioners or a third-party consultant to consent to intervention by an insurer in any judicial or administrative action in which the national association of insurance commissioners or the third-party consultant may be required to disclose confidential information about the insurer that was shared with the association or consultant pursuant to this chapter. f. In the case of an agreement involving a third-party consultant, provides for the insurer’s written consent to the agreement. 5. The sharing of documents, materials, or information by the commissioner pursuant to this chapter shall not constitute a delegation of regulatory authority or rulemaking, and the commissioner is solely responsible for the administration, execution, and enforcement of the provisions of this chapter. 6. No waiver of any applicable privilege or claim of confidentiality in the documents, proprietary and trade secret materials, or other own risk and solvency assessment-related information shall occur as a result of the disclosure of such documents, materials, or information to the commissioner under this section or as a result of the sharing of those documents, materials, or information as authorized in this chapter. 7. Documents, materials, or other information in the possession or control of the national association of insurance commissioners or a third-party consultant pursuant to this chapter shall be confidential and privileged, shall not be subject to chapter 22, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action.

Senate File 189, p. 9 Sec. 9. NEW SECTION . 522.9 Penalties. 1. If an insurer fails, without just cause, to file an own risk and solvency assessment summary report by the filing date stipulated to the commissioner pursuant to section 522.5, subsection 1, the commissioner shall, after notice and hearing, impose a penalty of five hundred dollars for each day after the stipulated date that the summary report is not filed. The penalties shall be collected by the commissioner and deposited in the general fund of the state. The maximum penalty which may be imposed under this section is fifty thousand dollars. 2. The commissioner may reduce the penalty to be imposed if the insurer demonstrates to the commissioner that imposition of the penalty would constitute a financial hardship to the insurer. Sec. 10. NEW SECTION . 522.10 Severability. If any provision of this chapter, or the application of this chapter to any person or circumstance, is held invalid, such holding shall not affect the provisions or applications of this chapter which can be given effect without the invalid provision or application, and to that end the provisions of this chapter are severable. Sec. 11. APPLICABILITY DATE. The provisions of this Act are applicable beginning on January 1, 2015. ______________________________ PAM JOCHUM President of the Senate ______________________________ KRAIG PAULSEN Speaker of the House I hereby certify that this bill originated in the Senate and is known as Senate File 189, Eighty-fifth General Assembly. ______________________________ MICHAEL E. MARSHALL Secretary of the Senate Approved _______________, 2013 ______________________________ TERRY E. BRANSTAD Governor