Before the impact of Coronavirus/COVID-19 materialized and lead to a shut down of much of the public life in Germany, on 6 March 2020, the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) published its Circular 01/2020 (VA) on Minimum Requirements under Supervisory Law on the System of Governance of small Insurance Undertakings (Circular). In the Circular, BaFin sets out how it intends to interpret and apply the governance requirements under the German Insurance Supervision Act (Versicherungsaufsichtsgesetz) in the case of small insurance companies. Small insurance companies are those that do not exceed the thresholds or conduct the business that leads to an application of the Solvency II regime on German insurers (Art. 4 EU Solvency II Directive 2009/138/EC). The scope of application of the Circular may be extended following the current review of the Solvency II Directive. In its respective Consultation Paper EIOPA is currently suggesting to raise the relevant thresholds.

Because the implementation of the Solvency II regime in Germany in 2016 did not directly affect small insurers, they are still generally subject to the same rules that were applicable to all German insurers under Solvency I. However, some aspects introduced under Solvency II also became part of the regulatory framework for small insurers. This applies in particular to the governance requirements which to some extent apply to all insurers. However, certain elements such as the rules relating to the key functions including the requirement of a compliance function, the own risk and solvency assessment as well as the requirement to determine outsourcing managers responsible for the monitoring of outsourced key functions do not apply.

The proportionality principle has particular relevance when determining the appropriate set-up of small insurers. It is also part of the Solvency II regime and as such currently subject to review on the European level. BaFin is considering how its application can be improved in order to avoid inappropriate costs and efforts on the part of small insurers with a low risk profile. The main step taken in this regard by BaFin in the Circular is the introduction of a legal assumption that smaller insurers comply with the principle of separation of functions unless they do not effectively manage conflicts of interest or tasks are not performed in an independent and unbiased way. BaFin expresses the expectation that appropriate solutions can be found on an individual basis through a dialogue between BaFin and the insurer concerned.

In addition, the description of BaFin’s expectations on the risk management policies of the insurers is much less descriptive than the corresponding part of the circular relevant for Solvency II insurers. This is apparently a measure meant to reduce the regulatory burden for small insurers. This may or may not be used as a model for Solvency II insurers when BaFin will review the respective circular following the current Solvency II review.

The Circular introduces two new paragraphs that are not contained in the respective circular for Solvency II insurers: One paragraph deals with the risk culture that should be established in the insurer’s organization as a basis of an appropriate and effective risk management system. BaFin expects that a risk culture is defined and communicated by the management of the insurer that is supposed to foster it, live up to it and make sure that it is implemented throughout the organization (tone at the top). This should apply similarly to Solvency II insurers.

Another paragraph deals with automated business processes. It refers to the requirements on the IT set out in another circular (Circular 10/2018 (VA)) issued by BaFin and applicable to all insurers and pension funds in Germany. In the current Circular BaFin stresses that any risks related to automated business processes need to be identified, assessed and managed and that the entire management needs to be aware of the main features of implementation, design and functionality of the automated business processes.

Another new element is the requirement on small insurers to not only make sure that the law is complied with but also that external standards which may be of technical nature are met. Following comments in the consultation proceeding, BaFin clarified that it is still in the insurers’ discretion to decide with which external standards they comply as well as the scope of their controlling measures. However, such decision should be made comprehensible to third parties including the supervisory authority.

Small insurers will need to consider their compliance with the Circular immediately as it will come into force on 1 April 2020. In its accompanying letter to the Circular, BaFin states that general grace periods for the application of the principles set out therein would not be appropriate, given that the underlying provisions of law are in force since 2016. However, the addressees may have individual discussions with BaFin on how to implement additional adaptations to the principles and at which pace. This may even more apply under the current circumstances where the operations of the companies are aggravated by the restrictions imposed to combat the Corona crisis.