To be clear, the Senior Insurance Managers Regime should not be operated in such a way so as to put good people off. The desired outcome is that of effective governance, not enforcement. Insurance innovation and regulation Preparedness for what tomorrow’s world may bring will likely involve a degree of change – greater risk-awareness, ensuring good governance, collaboration with the regulator – but is the insurance industry capable of that change? The insurance industry has been founded upon taking the long term view. This is a concept that perhaps evokes a perception of consistency rather than innovation. However, the UK industry has traditionally not shied away from changing with the times, with the London market being a particular example. Already, in response to changes on the horizon, we are seeing shifts in business models. Insurers are refreshing their product offerings, altering operational structures and enhancing distribution channels. The PRA has an important role to play in this so let me return to the subject of regulation. To be clear, regulators have no intrinsic reason to stifle innovation. Far better to supervise a successful, profitable, innovating enterprise than a declining out-dated one. Underpinning that view, I would say that there should not be a prohibitive trade-off between insurers’ ability to innovate versus their ability to manage risks. Instead, the PRA will need to work with its regulated entities closely and early in the process of innovation.
Technological enhancements bring new opportunities to businesses but the pace of innovation must be met by the pace of corresponding safeguards to deal with the risks. In particular, the risk of cyberattack is a great concern. The pace here is really changing very rapidly. As with the other risks, insurers are affected for both good and ill: with ever more frequent and increasingly sophisticated cyber-attacks on businesses and individuals, insurers are being relied upon more and more for protection. A new business opportunity for sure. But, unlike most other insured risks, insurance firms could themselves be significant victims. It is difficult to predict how cyber-crime – or even cyber accidents – will evolve, and it is very challenging to obtain data for losses that arise out of cyber-events. This makes it all the more difficult to quantify reserves, models and prices as well as develop operational safeguards internally. An Insurer wishing to expand into any new business area needs to demonstrate to the PRA that new risk exposures are well understood and that the required capital for an altered risk profile has been fully considered. As stated previously, business model analysis forms an important part of the PRA’s supervisory approach and a focus for its supervisory activity. Insurers will need to deal with the PRA in an open, co-operative and constructive manner to allow us to understand whether the business model is sustainable and to identify key vulnerabilities. This will ensure a more informed, focussed and proportionate supervisory approach.