The Malta Financial Services Authority (the “MFSA” or the “Authority”) has issued a Dear CEO Letter outlining its findings from a thematic supervisory review concerning the implementation and effectiveness of the Risk Management Function (“RMF”) within insurance and reinsurance undertakings (“Undertakings”).
The review, conducted during 2025, comprised onsite supervisory inspections and a self-assessment questionnaire distributed to selected Undertakings. It focused on corporate governance, Board oversight, risk management policies, operational effectiveness and the integration of risk management into decision-making processes.
Whilst the self-assessment results generally indicated strong alignment with the applicable regulatory framework, the onsite inspections revealed good practices as well as areas requiring improvement, particularly in relation to risk identification and assessment, operational risk incident management, risk management policies, workplans and business continuity and succession arrangements.
Under Article 44 of Directive 2009/138/EC (“Solvency II”), Undertakings are required to maintain an effective Risk Management System (“RMS”) which is integrated into their organisational structures and decision-making processes. The MFSA emphasised that the RMF should operate as a second line of defence, with sufficient independence, authority and access to information to effectively challenge business decisions and escalate material risks.
The self-assessment also identified one Undertaking that had not designated a Board member to oversee the RMS, as required by Chapter 1 of the Insurance Rules.
The Authority identified good practices involving active Board participation throughout the Own Risk and Solvency Assessment (“ORSA”) process, including reviewing assumptions, challenging stress-testing results and considering their implications for business strategy, capital management and risk appetite. Other good practices included early ORSA planning, alignment with strategic planning and budgeting, and documented Board challenge.
Where the RMF is outsourced, Undertakings remain responsible for its effective oversight. The MFSA expects sufficient internal expertise to assess and challenge outsourced activities, supported by regular engagement with service providers, appropriate reporting arrangements and clearly allocated responsibilities. Boards and those overseeing the outsourced function remain fully accountable. The letter also calls for prompt remediation of weaknesses through action plans with clear ownership and timelines, together with appropriate continuity arrangements and credible exit strategies.
The MFSA identified weaknesses in the formalisation and documentation of risk identification and assessment processes. In certain Undertakings, risk identification relied predominantly on informal discussions or desk-based assessments, whilst others lacked clearly documented methodologies for assessing inherent and residual risks. The Authority expects Undertakings to establish structured procedures for identifying, assessing, challenging and escalating risks, supported by consistent assessment criteria, a clear link between inherent and residual risk assessments, and appropriate documentation.
Attention should be given to the allocation of risk and control ownership, with clearly designated individuals responsible for managing and monitoring identified risks rather than responsibilities being assigned collectively to departments or multiple individuals. Such individual accountability should be documented.
The MFSA also highlighted the importance of maintaining regularly updated Risk Registers, incorporating risk categorisation, comprehensive descriptions, inherent and residual risk assessments, mitigating controls, consistent likelihood and impact ratings, and clearly allocated responsibilities. Such registers should be used as active management tools to support ongoing risk monitoring and informed decision-making.
The review also identified good practices in the use of Key Risk Indicators (“KRIs”), including alignment with risk appetite and strategic objectives, meaningful thresholds, clear ownership and escalation procedures, and regular review. The MFSA expects Undertakings to continue refining their use of KRIs.
Good practices in embedding risk appetite into daily operations included measurable limits and tolerances tailored to the Undertaking’s risk profile, reporting of breaches, near-breaches and deteriorating trends, and clear links to underwriting, investment, reinsurance and product approval decisions. The RMF independently monitored adherence to limits and challenged decisions where exposures approached or exceeded them.
The supervisory inspections identified shortcomings in the recording, investigation and escalation of operational risk incidents, including near misses. The MFSA observed that certain Undertakings did not systematically capture incidents, whilst others applied inconsistent reporting thresholds, used unclear definitions of incidents and losses, or relied excessively on management judgement when determining whether incidents should be recorded.
The Authority expects Undertakings to maintain clearly defined incident management procedures, ensuring that incidents and near misses are appropriately recorded, assessed and escalated. Such procedures should incorporate consistent reporting criteria, root cause analyses, clearly allocated responsibilities and effective monitoring of remedial actions.
Information gathered from operational incidents and near misses should also inform broader risk assessments, scenario analyses and ORSA processes, allowing Undertakings to identify emerging risks and address underlying control weaknesses before they result in further losses or operational disruption.
Although the Undertakings inspected maintained Board-approved Risk Management Policies, the MFSA observed that several policies remained overly generic and insufficiently tailored to the respective business models and risk profiles. Deficiencies included the absence of sufficiently detailed methodologies for managing relevant risk categories and their aggregation, limited explanations of the relationship between risk management arrangements and solvency requirements, and inadequate provisions concerning the frequency, scope and triggers of stress-testing exercises.
The Authority expects Undertakings to maintain comprehensive Risk Management Policies aligned with the applicable Insurance Rules, supported by additional Board-approved sub-policies and documented procedures where necessary. Periodic policy reviews should also reflect substantive changes in the Undertaking's activities, risk exposures and operating environment rather than mere cosmetic updates.
Furthermore, the MFSA identified shortcomings in Risk Management Workplans, particularly where planned activities, deadlines and responsibilities were not sufficiently documented.
The MFSA identified deficiencies in business continuity and succession planning arrangements, notwithstanding that the Undertakings inspected maintained documented Business Continuity Plans (“BCPs”). In particular, the Authority observed that the RMF was not always adequately involved in the development, maintenance and testing of BCPs. Certain Undertakings had not conducted formal Business Impact Analyses, whilst others lacked regular testing arrangements to demonstrate the effectiveness of their continuity procedures.
The MFSA emphasised that business continuity planning should address a range of potential disruptions, including system outages, cyber incidents and operational interruptions, rather than focusing exclusively on remote working arrangements.
Shortcomings were also identified in succession planning, including the absence of documented plans identifying key positions, potential successors and interim arrangements. Plans were not always regularly reviewed or subject to Board oversight, and RMF involvement was often limited or absent. The MFSA expects comprehensive, documented continuity and succession arrangements that are regularly reviewed and tested, with active RMF involvement and oversight.
The MFSA expects all Undertakings to review and assess their RMS and risk management framework. This includes reviewing their risk identification procedures, Risk Registers, KRIs and risk appetite arrangements, operational incident reporting arrangements, Risk Management Policies, workplans and business continuity and succession procedures. Undertakings should identify gaps and take the necessary action to align their arrangements with the applicable regulatory framework and the Authority’s expectations, applying proportionality according to the nature, scale and complexity of their operations and risk profile. Proportionality must not result in ineffective governance or insufficient RMF oversight.
Particular attention should also be given to ensuring that the RMF is adequately resourced, maintains sufficient independence and authority, and is effectively integrated into governance and decision-making processes. Where the function is outsourced, Undertakings should ensure that appropriate oversight and accountability arrangements remain in place.
Should you require further information on the MFSA's findings or assistance in reviewing your organisation's risk management framework, internal policies and regulatory compliance arrangements, please contact us at info@gtg.com.mt
Author: Dr Kimberley Blundell