We are pleased to launch our fourth edition of the International Newsletter for insurance and reinsurance, pulling together key current topics from across our global network. In this edition, our highly experienced international team looks at the growing market for cyber products for European insureds (including reinsurance considerations); covers recent developments in the regulatory framework for (re)insurance in Panama; concludes a series of articles on the reinsurance of Middle East risks; reviews the draft Insurance Laws Bill in South Africa; and covers recent developments in the Russian insurance sector.

UK UPDATE

By Nigel Brook and James Nicholls

The London Market is witnessing a long and rather stuttering evolution of cyber cover for European insureds.

The risks involved are very real: in 2014 an estimated 81% of large corporations and 60% of small business in the UK experienced a cyber security breach. These figures however give no indication of the types of losses involved and "cyber" is little more than a convenient blanket term; it may describe a malicious hack and subsequent theft of sensitive data such as credit card details or medical records, or an innocent omission such as an employee accidentally leaving an unencrypted laptop containing client information on a train.

Unsurprisingly, the associated insurance cover available is equally broad: an insured may obtain cover for first party losses including damage to critical infrastructure, business interruption and the significant response costs that are incurred in rectifying a security breach and notifying affected individuals. Third party risks are also commonly packaged into cyber policies under which an insurer may, for example, indemnify an insured for regulatory fines or claims brought by individuals whose data has been negligently compromised.

As a rule European companies have been reluctant to buy stand-alone cyber cover and instead appear willing to gamble on their existing programmes responding to cyber losses. In some cases, where the wording in question is sufficiently wide, this might pay off. A company's property and general liability policies, for instance, could well indemnify the first and third party losses that typically follow a cyber event. However, from a coverage perspective, the lack of established English case law means there is uncertainty regarding exactly when non-cyber cover will respond. As ever, the coverage issues faced by insurers will turn on the particular wording concerned, however the key questions have been well rehearsed by legal commentators: will damage to data constitute property damage? Are regulatory penalties insurable as a matter of law? Where is the line between the cost of responding to a cyber security breach and betterment in terms of enhancing protection?

With these uncertainties, the increasing profile and frequency of large cyber losses, and the proliferation in the use of electronic data exclusions, the days of companies favouring premium savings over cyber protection are likely numbered.

Writing cyber risks

The relative infancy of cyber products for European insureds when considered against the American experience, where the first cyber policies were written in the late 1990s, raises its own challenges in writing cyber risks for insurers and reinsurers alike. The effective assessment and rating of risks sits at the top of the list. The lack of actuarial and historical loss data means that the experience of the underwriter and a comprehensive review of the policyholder's operations are essential.

The considerations faced by Reinsurers have not been widely discussed. As a corollary to the relative youth of cyber products, the first key decision is naturally which risks to write. It is not for lawyers to stray too far into this area, however Reinsurers will be keen to satisfy themselves that the reinsured appreciates that a proposal form "tick box" exercise by an insured is not enough. The majority of cyber events stem from human error, therefore a good insured will have introduced organisation-wide training addressing the "dos and don'ts" of electronic data protection. In the UK the general awareness within companies about how to protect against cyber attacks should be encouraged by the introduction of "Cyber Essentials", a basic standard introduced by the Government in 2014.

Cyber reinsurance: considerations

The aggregation of outward reinsurance claims is an area of potential controversy in the cyber context. English law on aggregation in non-cyber cases is well-established, but is inherently fact based and close scrutiny of the aggregation wording and losses is almost always required. Without the benefit of "on point" case law it is not difficult to foresee disagreement between a reinsured and its reinsurers as to whether related losses can aggregate. For example, a reinsured may want to recover losses paid to a number of insureds as a result of a cyber extortion campaign organised by one particular association. Equally, in the third party liability context, an insured may want to aggregate all claims that result from a data breach affecting a number of systems taking place over a number of months or even years. The "hours clause" is unlikely to bring much clarity here as it is often impossible even for forensic vendors to establish exactly when a cyber breach first occurred. The task of mapping the history of a data breach is inherently more challenging than establishing the timings associated with a natural catastrophe, as the breach is typically, by its nature, latent.

Facultative reinsurers need to carefully consider their relationship with the original claims and the suitability of their claims co-operation provisions. The London Market trend for writing tall towers of cyber insurance cover means that potentially huge aggregated losses could result from a catastrophic cyber event, such as a hack of a cloud provider. With this in mind, in these early days of large cyber risks reinsurers will be unlikely to simply follow the reinsureds' settlements without any real involvement in the claim.

The future

There is no standard market cyber wording on either side of the Atlantic meaning cyber policies, as well as the underwriting assessment of cyber risks, continue to evolve. With disparate cyber forms on offer, insurers and reinsurers have the unenviable task of gauging how to limit their exposure while remaining competitive in a relatively small market. What is clear is that cyber risks, unlike the Y2K exposures at the turn of the Millennium, are a real threat to potential policyholders and logic dictates that interest in cyber products will grow. While the financial exposure to a cyber event faced by a company based in America is higher than that faced by a Europe-based counterpart (due primarily to the regulatory landscape) a Data Protection Regulation is currently working its way through the European legislature which will pave the way for vast fines for companies in violation of data protection law and should reinforce the merits of cyber cover.

The growing prominence of cyber cover represents an exciting opportunity for many insurers and reinsurers alike. There will undoubtedly be an element of trial and error for insurers and reinsurers introducing cyber offerings into London, however the Market is uniquely placed to become a leading, global centre of cyber security insurance.

LATIN AMERICA UPDATE

By Peter Hirst and Angela Carazo Gormley

Mr José Joaquín Riesen Alvarado has recently been appointed to head the Superintendence of Insurance and Reinsurance of Panama (known by its Spanish acronym "SSRP"). Following his appointment, Panama is undergoing a thorough reorganisation of the regulatory framework in reinsurance.

Panama's insurance and reinsurance market has grown rapidly in the last year. By the end of 2014 the Panamanian insurance industry was worth US$ 2 billion and the value of direct insurance premiums was US$ 1.3 billion, which represents a rise of 8.1% from a year earlier in 2013. This growth has been fuelled by the recent enactment of a new insurance law (Law 12 of 3 April 2012). It authorised new marketing channels for insurance products (apart from traditional brokers) such as insurance sales agents.

By contrast, there are currently only eight local reinsurers registered with the SSRP. In a bid to attract more reinsurers to establish themselves locally, the SSRP is proposing to also overhaul Panama's reinsurance law. The existing law dates back to 1996 and is no longer considered fit for purpose.

The main objective is to update local reinsurance regulation so as to align it more closely with other international markets. No details of the proposed amendments have yet been published although we are told a draft has been prepared. The SSRP is visiting reinsurers in the United States and Europe in order to canvass their opinions before publishing the new proposals.

Although many international reinsurers deal with the Panamanian market, the SSRP would like more reinsurers to establish themselves there and serve not only the Panamanian market but the region as a whole. Lloyd's of London is in the process of registering as a foreign reinsurer in Panama and it is hoped that the new law will encourage other international players to follow suit.

A new reinsurance law is sure to attract some attention but whether it will lead to more reinsurers establishing themselves in Panama is unclear. Many of Panama's neighbours (e.g. Colombia) have already introduced reforms and are arguably further ahead in this process. It is ambitious for Panama to believe it can overtake them in this process. In Panama's favour are its marine insurance heritage (there are many good professionals and established knowhow from its maritime past) and its reputation for stability.

A new anti-money laundering bill is also before Parliament. The draft bill's provisions strengthen the existing control and supervisory systems in the financial services market. They also introduce a risks based approach for regulated entities and regulators. The SSRP has been tasked with enforcement of the proposed law in the insurance and reinsurance sector. Dulcidio De La Guardia, Minister for Economy and Finance, said that implementing the law would pave the way for Panama's removal from the Financial Action Task Force's (FATF) "greylist" of "Improving Global AML/CFT Compliance" countries.

On 26 February 2015, the SSRP and the Financial Superintendence of Colombia signed a Memorandum of Understanding (MoU). Its main objective is to strengthen the exchange of information, mutual cooperation and cross-border supervision between both countries. The MoU was the first to be signed by the SSRP with a foreign regulatory body. The SSRP has said that more are planned with other foreign regulatory bodies.

In summary, Panamanian insurance and reinsurance legislation is set to evolve considerably during 2015. It remains to be seen whether the reinsurance market can grow in the same way as the insurance market has done in the last couple of years. At first glance this seems unlikely but until the new proposals are published it is difficult to assess what their impact will be.

MIDDLE EAST UPDATE

By Wayne Jones

Our recent 3-part series focusing on issues that arise for cedants and reinsurers involved in cross-border reinsurance arrangements reviewed two recent English judgments which highlighted the inherent risks where fronted risks are placed 'back to back', and reinsurers exercise 'claims control'. The full 3-part series can be accessed here.

In this final article we identified the following potential pitfalls and how to avoid them:

1. Fronting issues

Local cedants commonly 'front' for foreign reinsurers by substantially reinsuring the risk (sometimes up to 100%). Significant risks arise for both local cedant, who is responsible for 100% of the risk whether or not the reinsurance cover responds, and reinsurers, who are reliant on the cedant's underwriting and claims handling in the local jurisdiction.

In the Princess of the Stars, the cedant faced the invidious position of being left without any reinsurance cover for a major loss which was still to be adjudicated by the local courts. In Beazley v Al Ahleia, following market reinsurers were bound by the cedant's and lead reinsurer's actions in compromising the claim, without their knowledge or involvement, notwithstanding the reinsurance including a claims control clause.

Additional fronting risks arise for reinsurers where:

  • The cedant has a wider relationship with the underlying insured
  • Cedants are substantially owned by the underlying insured
  • The same broker is involved at underlying and reinsurance level

In order to mitigate these risks cedants and reinsurers need:

  • To recognise and identify the risks
  • Ensure the reinsurance documents deal with inherent conflicts of interest
  • Deal with brokers' inherent conflict of interest

Cedants ought to include provisions dealing with any failure of reinsurance security (eg non-vitiation provisions). Ensuring that underlying and reinsurance wordings will be interpreted identically is vital.

Reinsurers need to be aware that cedants retain negligible risk; understand underlying relationships; and ensure adequate controls in the reinsurance contract to permit control over claims settlement.

2. Different legal systems applying to the direct and reinsurance placements

Middle East risks are almost always subject to local law and jurisdiction, no matter what the policy wording might say. Policies governed by foreign law will inevitably be interpreted in accordance with local law.

Local courts may well interpret policy wordings differently to international practice. However, this should not affect 'back to back' reinsurance placements subject to English law and jurisdiction. English law has established jurisprudence to accommodate local interpretations of insurance wordings on a 'back to back' basis, so that the reinsurance wording is construed in a manner that follows the underlying interpretation.

However, the ruling in Princess of the Stars shows it is essential that the English court be supplied with sufficient evidence as to how a foreign court will interpret the underlying policy wording. The English court accepted that Philippine law and English law were likely to reach a similar conclusion in relation to the construction of a typhoon warranty, without the Philippine court having considered the issue. Countering this issue will require specific provisions to provide that the reinsurance policy will follow the interpretation of the underlying wording under local law.

In Beazley, a partial settlement by the lead reinsurer and cedant appeared to be in breach of a claims control clause. The judge appeared not to have been provided with sufficient information on Kuwaiti law that 'without prejudice' correspondence between parties is fully disclosable before the local courts, and payment of part of a claim is likely to constitute an admission of liability, and thus render the entire claim payable. Had this been appreciated it is doubtful the court would reached the decision it did.

The common factor in both cases concerns the lack of local law information put before the English court. It is imperative that parties to Middle East reinsurance disputes, whether in the local courts or London , are properly advised and appreciate the local law position.

A number of market participants contend that the answer is to have both the underlying and reinsurance wording subject to local law and jurisdiction. However, this is unlikely to provide a satisfactory solution for either party. Middle East jurisdictions lack reinsurance jurisprudence, and the local court is seldom equipped to deal with a genuine reinsurance coverage dispute. Although cedants may find the prospect of litigating on 'home turf' attractive, lack of reinsurance expertise, and issues associated with securing jurisdiction over a foreign reinsurer and procedures to enforce a local judgment, detract from the perceived advantages.

3. Conflicts of interest

Conflicts of interest can arise where:

  • Cedants have entrenched existing relationships with underlying insureds
  • The same broker handles direct and reinsurance placements
  • Cedants retain negligible risk
  • Subscribing reinsurers have competing interests

Conflicts need not be insurmountable but should be recognised and managed. In practice it appears that reinsurers, cedants and brokers, rarely take any positive steps to manage these inherent conflicts.

A number of mechanisms can be used, including:

  • Insisting independent brokers in direct and reinsurance placements
  • Requiring cedants' to warrant their 'net retention
  • Using express wordings recognising the fronting relationship
  • Reviewing subscription market procedures (eg the London market General Underwriting Agreement)

4. Market wordings

Middle East wordings tend to use international wordings which, although possibly tried and tested internationally, may be subject to different construction when translated into Arabic and considered by a local court

Wordings used for Middle East risks need to be reviewed in the context of local law and adapted accordingly. In new areas of business (e.g. Financial Lines or Cyber) a good understanding of the local law and potential exposures is required in order to customise wordings.

Reinsurers cannot rely on international interpretations of wordings. It is not sufficient for cedants to 'cut and paste' terms and wordings provided by reinsurers into a local policy.

The way forward

Middle East reinsurance is extensively cross-border and market participants need to appreciate the issues involved in order to avoid the problems identified above arising.

SOUTH AFRICA UPDATE

By Rashad Ismail

On 17 April, the National Treasury and the Financial Services Board ("FSB") published for comment the draft Insurance Laws Bill, 2015 ("the Bill"). The Bill, once enacted, will replace certain sections of the Long-term Insurance Act 52 of 1998 and the Short-term Insurance Act 53 of 1998 relating to prudential supervision, with effect from 1 January 2016. We consider briefly the effects that the Bill will have on reinsurance activities when enacted.

Following the 2008 Global Financial Crisis, South Africa recognised the need to have higher prudential and market conduct standards on banks and insurers. As in Europe, with the adoption of Solvency II, the FSB have been developing an equivalent prudential framework for insurers called the Solvency Assessment and Management Framework ("SAM"). The Bill contains the enabling legislation to allow for the implementation of the SAM regime. SAM forms part of South Africa's transition to the Twin Peaks reforms.

SAM is a risk-based supervisory framework which is aimed at contributing to financial stability by aligning an insurer's regulatory capital requirements with the underlying risks of the insurer. An insurer will be required to hold enough capital to meet the solvency capital requirement. An insurer will receive a "credit" for its reinsurance recoverable. The Bill empowers the FSB to prescribe in respect of an insurer's reinsurance arrangements, the requirements for the recognition and treatment of reinsurance and the limitations on the extent of the reinsurance business that an insurer may place with a reinsurer.

With the Bill implementing the SAM regime, many insurers will be looking to reinsurers to revise reinsurance programmes so as to maximise solvency relief within the SAM framework. We can expect to see changes in both reinsurance and retrocession arrangements of insurers and reinsurers operating in South Africa.

Coupled with the implementation of SAM, the Bill also facilitates a new reinsurance regulatory framework, as was discussed in our February 2015 International Newsletter, that will allow for a wider recognition of reinsurance, including through the use of branches of foreign reinsurers. The Bill envisages a foreign reinsurer conducting reinsurance business in South Africa. In order for a foreign reinsurer to conduct business in South Africa, the foreign insurer will have to:

  • Establish a representative office in South Africa
  • Appoint a representative and deputy representative, who must be natural persons permanently resident in South Africa
  • Establish a trust in South Africa in accordance with the provisions of the Trust Property Control Act and will have to provide security in the form of assets to such trust;
  • Be licensed as a foreign insurer in accordance with the prescribed requirements under the Bill
  • Demonstrate to the FSB that the laws of the country in which the foreign reinsurer is authorised and supervised establish a regulatory framework equivalent to that established under the Bill

It will be the responsibility of the representative to ensure that the foreign reinsurer complies with all South African legislation and to notify the FSB of any non-compliance. The FSB will be empowered to prescribe any further requirements relating to the roles and functions of the representative.

It is envisaged that a foreign reinsurer will be required to maintain its business in a financially sound condition, by providing security, in the form of assets to the trust. The FSB will be empowered to prescribe the requirements for the form of the security and the valuation of such assets.

The Bill also deals with some practical considerations regarding a foreign reinsurer. Claims against a branch of a foreign reinsurer must be recognised by a South African Court and the representative appointed may be cited as a nominal defendant. The representative may also institute any action in South Africa as a nominal plaintiff on behalf of the foreign reinsurer. The trust that will have to be established will have to meet any obligation under the reinsurance policy concerned if the foreign reinsurer fails to meet such obligation. If the FSB imposes a penalty on the foreign reinsurer for any non-compliance with local legislation, the trust will be responsible for the payment of such penalty if the foreign reinsurer fails to pay the penalty.

With the publication of the Bill, it shows that the regulators have recognised that the reinsurance market in South Africa plays a crucial role in the insurance sector. As in most other countries, reinsurance contributes to the stability of insurance markets and assists in improving the risk profile and financial soundness of insurers. We often receive questions from foreign reinsurers wishing to write business is South Africa. Unfortunately, our advice often disappoints them as the current position is restrictive and unnecessarily protective of local insurers. With the abandoning of the current position and the adoption of the SAM regime, the South African reinsurance market is "open for business".

RUSSIA UPDATE

By Maire Ni Aodha and Julia Vaynzov

Russia's insurance sector has been traditionally closed to direct involvement of foreign investors. However its accession to the WTO on 22 August 2012 has brought about substantial changes on the insurance front.

Accession to WTO

In accordance with the Protocol on the Accession of the Russian Federation to the WTO (the Protocol), Russia assumed obligations to improve access to its markets. In relation to the insurance services these obligations cover each of the following modes of supply:

  • Cross-border supply (i.e. the possibility for non-resident insurers to supply their services cross-border into the Russian territory)
  • Consumption abroad (the freedom for Russian residents to purchase insurance services in the territory of another WTO member)
  • Commercial presence (the opportunities for foreign insurers to establish, operate or expand a commercial presence in Russia, such as a branch, agency, or wholly-owned subsidiary)

Russia's specific sectoral obligations on insurance services as well as carve-outs from its obligations are detailed in Section 7(A) of the Schedule of Specific Commitments on Services annexed to the Protocol (the Schedule). Column 2 of Section 7A of the Schedule relates to Market Access Limitations and expressly lists the types of insurance services in relation to which Russia undertakes NOT to introduce market access limitations. Per the Schedule, Russia has committed to allow cross-border supply and consumption abroad in relation to:

  • International marine insurance
  • Insurance of carriage by air
  • Commercial space launching
  • Cross-border transportation of passengers and cargo including liability

In addition there is to be no limitations on foreign insurers insuring risks connected with:

  • International transportation of passengers and goods
  • International commercial air transportation and liability within the international green card system

As a next step, by August 2016, foreign insurers should have access to insuring domestic commercial air transportation (other than certain types of mandatory insurance) and maritime transportation in Russia. The list of insurance services is exhaustive. Russia has not undertaken any obligations to give foreign companies market access to any other insurance services.

In relation to all other insurance services, Russia is free to impose limitations and regulate cross-border supply of insurance services.

Russian legislation

The key legislation governing the insurance sector in Russia is the Law "On the Organisation of Insurance Business" 1992 No. 4015-1 (the Insurance Law).

The Insurance Law governs matters of licensing and regulating insurers in the Russian Federation, specifies types of insurance, parties involved in insurance and so on. It also contains rules (principally restrictions) on the commercial presence of foreign insurers in Russia and the types of activities which foreign-owned registered and licensed Russian insurers may or may not carry on in Russia. Based on the Protocol, Russia may keep these restrictions in place until 2021, at which point foreign insurance companies should be allowed to directly open branches in Russia.

Until 21 January 2014 Article 4(5) of the Insurance law included the following prohibition:

"In the Russian Federation, insurance of interests of juridical and natural persons who are resident in the Russian Federation (except for reinsurance and as otherwise provided for by federal laws) may be carried out only by insurers holding licences obtained in accordance with this Law".

In effect foreign insurers could not provide direct insurance in Russian unless they had established a presence in Russian and had a licence to do so, and even then were subject to restrictions.

However, with effect from 21 January 2014, the Insurance Law was substantially amended, and the resulting text does not include Article 4(5). The removal of the prohibition has given rise to debate. Some practitioners say the removal of Article 4(5) potentially permits non-admitted insurers to supply insurance services cross-border into Russia. The grounds for this proposition lies in the approach that so long as a matter is not prohibited it is permitted until the Court says otherwise.

Nonetheless, this approach overlooks the factit is important to bear in mind that:

  1. The definition of 'Insurer' in the Insurance Law is "insurance organisations and mutual insurance societies established in accordance with laws of the Russian Federation for the purpose of carrying on insurance, reinsurance, and mutual insurance activities and licensed to carry on the relevant type of insurance activities in accordance with the procedures set out in this Law"
  2. Article 4.1(2) of the Insurance Law provides that "insurance organisations, mutual insurance societies and insurance brokers are insurance entities. Activities of insurance entities are subject to licensing
  3. Article 938(1) of the Russian Civil Code provides that only juridical persons having a license to carry on insurance of the relevant type may enter into contracts of insurance in the capacity as insurer

However, as the Insurance Law does not include any sanctions for infringement of its provisions and it seems that the only recourse for the Russian authorities to prevent non-admitted insurance would be to initiate an investigation under the Administrative Offences Code for acting without a licence, where a licence is mandatory. There is a view that realistically Russian authorities will not be interested in pursuing non-admitted insurers where it may be difficult and costly and with limited (if any) powers to enforce.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.