Regulatory Update: National Association of Insurance Commissioners Fall 2024 National Meeting

The revised SAT, which the NAIC adopted in February 2020, incorporates a requirement for producers to act in the “best interest” of a retail customer when making a recommendation of an annuity. To meet this standard, a producer must not place his or her own financial interest ahead of the consumer’s, and the producer must also satisfy the four key obligations of care, disclosure, conflict of interest, and documentation. Under the comparable standards safe harbor in the revised SAT, the requirements of the SAT are deemed to be satisfied if the recommendation and sale of an annuity is “made in compliance with comparable standards.” The revised SAT also imposes on insurers certain obligations related to satisfying the comparable standards safe harbor.

The guidance document addresses five elements of the safe harbor in the revised SAT, namely determining (1) whether the conditions of the safe harbor have been met; (2) whether an insurer has a reasonable basis to believe that an annuity would effectively address the consumer’s financial situation, insurance needs, and objectives; (3) the insurer’s obligation to monitor the business conduct of the financial professional or the entity supervising the financial professional; (4) the insurer’s obligation to provide information and reports to the entity supervising the financial professional; and (5) the use of third parties to perform part or all of the supervisory process for insurers.

The Annuity Suitability (A) Working Group exposed a draft of the guidance document for public comment in September 2024. Several comments were received, including a joint comment submission from various trade associations. The comment letter recommended several revisions to ensure that the guidance document conforms to the revised SAT without imposing new or different requirements on the industry. The Annuity Suitability (A) Working Group is in the process of revising the guidance document to address the public comments received, and it is expected that a revised version will be exposed in the future for further comment.

The NAIC adopted the MSA Framework in April 2022 in an effort to provide a consistent national approach for reviewing current LTCI rates that results in actuarially appropriate increases being granted by the states in a timely manner and eliminates cross-state rate subsidization. Insurers voluntarily submit filings to the multistate actuarial (MSA) team, but the decisions made by the MSA team are not binding on individual state insurance departments. 

The Minnesota method was generally supported to become the single rate review methodology in response to requests to develop a single methodology that was more explainable and understandable for commissioners, regulators, and consumers as to how the MSA team’s recommendation was determined. The proposed revisions to the cost-sharing formula (which would modify the cost sharing used in the single rate review methodology to be a 5% haircut for the first 100% of a rate increase, a 20% haircut for the portion of cumulative rate increase between 100% and 400%, and an 80% haircut for the portion of the cumulative rate increase in excess of 400%) are intended to address specific public policy challenges, particularly those related to large increases for older-age policyholders with longer durations (known as the 85/25/400 policyholder issue).

The comment period for the exposure draft ends December 13, 2024, and it is expected that the LTCI Task Force will schedule an open meeting during the week of December 16, 2024, to discuss comments on the exposure draft and consider adopting the revisions to the MSA Framework. The LTCI Task Force will be disbanded at year-end 2024, so in the event that the proposed revisions to the MSA Framework are not adopted prior to year-end, the Health Actuarial (B) Task Force will conduct further discussion and reexposure in 2025.

The conclusion that the AM produces comparable outcomes to the ICS with the goal of providing a group capital assessment that preserves the U.S. state-based system has been a priority for the NAIC for many years. In November 2019, the IAIS adopted ComFrame and the ICS, the group capital component of ComFrame, as part of a set of reforms designed to enable effective cross-border supervision of IAIGs and contribute to global financial stability. Implementation of the ICS is being undertaken in two phases, the first of which is a five-year monitoring period (which commenced in January 2020), to be followed by full implementation of the ICS as a groupwide PCR upon final adoption by the IAIS. The U.S. developed the AM as an alternative to the ICS to avoid the application of multiple capital standards to groups domiciled in the U.S. Now that the AM has been determined to provide comparable outcomes to the ICS, the AM will be used as a PCR under ComFrame for U.S.-based IAIGs.

The IAIS will work on developing an implementation assessment framework for the ICS, and the NAIC will now work on the implementation process for the AM through the group capital calculation as other jurisdictions will be in the process of implementing the ICS into their supervisory regimes.

The IAIS has set high-level timelines for its plans to assess the comprehensive and consistent implementation of the ICS across jurisdictions. In 2025, the IAIS will begin developing a detailed ICS assessment methodology. In 2026, the IAIS will coordinate a baseline self-assessment by IAIS members of their progress in implementing the ICS, which will serve as a baseline for future implementation progress monitoring. Then, with the aim of starting in 2027, the IAIS will initiate detailed jurisdictional assessments of ICS implementation.

a. NAIC Adopts Amendment to P&P Manual Relating to the Discretion of the NAIC Securities Valuation Office Over NAIC Designations Assigned Through the Filing Exempt Process

The NAIC Executive (EX) Committee and Plenary voted to adopt an amendment to the P&P Manual developed by the VOS Task Force that authorizes regulator discretion over NAIC Designations assigned through the FE process. The process sets forth the steps to be followed if a state insurance regulator or the NAIC Investment Analysis Office (IAO) identifies a security that has an NAIC Designation assigned from a CRP that such regulator or the IAO does not believe represents a reasonable assessment of risk for regulatory purposes.

The development of the P&P Manual amendment began at the NAIC Spring 2023 National Meeting, when the VOS Task Force initially exposed a proposed amendment to the P&P Manual that would remove a new category of investment, defined as “Structured Equity and Funds,” from the FE process, based on a review by the SVO of private letter rating rationale reports. As part of that review, the VOS Task Force noted that when the SVO finds a significant potential issue with a credit rating for an investment, the SVO should raise the issue to the VOS Task Force, along with a proposed solution (which may include a change to the resulting NAIC Designation). In response to industry comments, the VOS Task Force directed NAIC staff to draft an alternative amendment to the P&P Manual outlining this proposed process. The amendment was initially exposed in May 2023 and has since been updated to incorporate comments received from VOS Task Force members and interested parties. The P&P Manual amendment was previously adopted by the VOS Task Force and Financial Condition (E) Committee in August 2024. A summary of the process set forth in the P&P Manual amendment can be found in our prior reporting from the NAIC Summer 2024 National Meeting available here.

The effective date of the P&P Manual amendment is January 1, 2026; however, this date may be amended if additional time is needed to implement the applicable technological enhancements for the process as set forth above.

b. VOS Task Force Adopts P&P Manual Amendment to Require Annual Review of Regulatory Transactions

The VOS Task Force adopted an amendment to the P&P Manual to require an annual review of “Regulatory Transactions.” A “Regulatory Transaction” is defined in the P&P Manual as “a security or other instrument in a transaction submitted to one or more state insurance departments for review and approval under the regulatory framework of the state or states” and “engineered to address a regulatory concern one or more insurers have or may have that should be submitted to a state insurance department for approval and that has as a component a security or other instrument which on a standalone version may be an Investment Security, as defined in the P&P Manual, eligible for assignment of an NAIC Designation.” The P&P Manual offers the following examples:

• “An insurance company entered into a coinsurance reinsurance transactions [sic] that requires regulatory approval and as part of that transaction, received an IBM bond [(i.e., a bond issued by International Business Machines Corporation)]. The IBM bond, when owned by an insurance company as a stand-alone investment, would be considered eligible for Filing Exemption but the whole regulatory transaction would not be eligible for Filing Exemption. In this example, the IBM bond is assumed to be an Investment Security, as defined in [the P&P Manual].”
• “An IBM bond that was eligible for Filing Exemptions was sold/transferred from an insurance company to an affiliated insurance company that requires regulatory approval. Such an IBM bond would still be considered eligible for Filing Exemptions when owned by an insurance company as a stand-along investment [sic]. In this example, the IBM bond is assumed to be an Investment Security, as defined in [the P&P Manual]. Any other parts of the transaction requiring regulatory approvals, if any, would not be eligible for Filing Exemption.”
  
  The P&P Manual states that Regulatory Transactions are not filing exempt; the security component of a Regulatory Transaction, however, may be eligible for designation under filing exemption or by the SVO on a stand-alone basis. In such case, the SVO or the NAIC Structured Securities Group (SSG) may conduct an analytical assessment on behalf of a state insurance department on the security component of the Regulatory Transaction, resulting in an SVO Analytical Value being produced that relates to the credit quality of the security component of the Regulatory Transaction. The insurance department may give the SVO Analytical Value to the insurer and instruct the insurer to use it to report the security component of the Regulatory Transaction.
  
  The P&P Manual did not previously require that Regulatory Transactions be periodically reviewed by the SVO. The amendment updates the instructions to require an annual review and to require the relevant insurance company notify the SVO or SSG of any material changes, consistent with all other assessments of investment risk by the SVO or SSG in the P&P Manual. Accordingly, the SVO or SSG determination of SVO Analytical Value are applicable only for the calendar year of the request and will be withdrawn without an updated assessment request. The SVO has stated that it considers the amendment to be nonsubstantive as it is consistent with the treatment for all other investment risk assessments within the P&P Manual.

c. VOS Task Force Adopts P&P Manual Amendment to Update the List of NAIC CRPs and Clarify the Use of Ratings

The VOS Task Force adopted an amendment to the P&P Manual that updates the list of NAIC CRPs and clarifies the NAIC’s use of CRP credit ratings. The P&P Manual sets forth a list of CRPs that provide credit rating services to the NAIC along with the classes of credit ratings for which they have CRP status. In addition to providing updates to this list, the amendment clarifies that only those classes of credit ratings for which the CRP is registered by the U.S. Securities and Exchange Commission (SEC) as a nationally recognized statistical ratings organization (NRSRO) are eligible to be used for NAIC CRP purposes. The amendment also clarifies that the SEC’s definition used to regulate NRSROs is distinct from the definition used for statutory accounting asset classification purposes in the Statements of Statutory Accounting Principles (SSAPs).

d. VOS Task Force Adopts P&P Manual Amendment to Update References to Investment Risk

The VOS Task Force adopted an amendment to the P&P Manual to update references to investment risk following the adoption of an amendment to the definition of “NAIC Designation” in the P&P Manual to remove outdated references to “credit risk” or “credit quality” (which narrowly relate to the ability of an insurer to make payments in accordance with contractual terms) and instead to refer more broadly to “investment risk” or other corresponding terms.

The amendment also removed the application of Subscript-S, an administrative symbol to identify other nonpayment risks. Interested parties requested that examples of other nonpayment risks also be removed from the P&P Manual.

e. SVO to Begin Deactivating Private Ratings Unsupported by Rating Rationale Reports

The SVO provided an update on private letter rating (PLR) filings, noting that in 2025, PLR securities issued after January 1, 2022, that do not have a waiver will be deactivated if required rating rationale reports are not filed.

The P&P Manual sets forth instructions for PLR securities, which are separated into three groups: (i) those issued before 2018 (when the private rating filing policy was adopted), (ii) those issued between 2018 and 2021 (after the private rating policy was adopted but before the private rating rationale report filing policy was adopted), and (iii) those issued after January 1, 2022, and subject to the private rating and rationale report filing policy set forth in the P&P Manual. 

For private ratings that require a rationale report to be filed with the SVO, if a rationale report was received, the SVO will include that security in the FE process and publish an NAIC Designation based on that PLR with the administrative symbol “PL” to denote that it is based on a PLR. However, if the security does not receive a rationale report for a PLR security that requires one, the SVO is required to treat the security as though it is not FE. This is accomplished by deactivating the unsupported private rating in NAIC systems.

The SVO had deferred the deactivation requirement for the past two years in order to build out functionality within the NAIC systems needed to inform insurers of the filing status. The updates are now operational, and the SVO intends to proceed with the deactivations in 2025.

According to the SVO, there are approximately 1,700 securities issued after January 1, 2022, for which rationale reports have not yet been filed. The SVO will grant a 30-day grace period for the filing of the supporting rationale report for any PLR that renewed at the end of 2024 to ensure that the company has a designation to report by year-end 2024. For any other securities, if there are any data quality issues that need to be considered, the deactivation will be deferred for three months.

f. P&P Manual Amendment Relating to CLO Modeling Project to Become Effective in 2025

The VOS Task Force heard an update on the status of the CLO modeling project. The VOS Task Force previously adopted an amendment to the P&P Manual to add reporting instructions for the financial modeling of CLOs. Specifically, the P&P Manual amendment makes CLOs ineligible to use CRP ratings to determine an NAIC Designation if the SSG can model the security. The P&P Manual amendment was introduced after the IAO identified that NAIC Designations assigned to CLOs were inconsistent when relying on CRP ratings and recommended this change to ensure reporting equivalency for NAIC regulatory purposes. The amendment is expected to become effective January 1, 2025. The ad hoc group leading this effort is seeking industry feedback on the algorithm and methodology and intends to hold monthly meetings starting in January 2025.

a. SAP Working Group Adopts Guidance on Bond Project Implementation and Single Asset, Single Borrower Transactions

The SAP Working Group adopted question-and-answer implementation guidance to address questions as to the application of the principles-based bond definition in a new Interpretation 24-01: Principles-Based Bond Definition Implementation Questions & Answers (Q&A).

One issue addressed in the Q&A that has garnered further discussion pertains to single asset, single borrower (SASB) investments. Consistent with the bond definition, asset-backed structures that are pass-throughs do not qualify as bonds, as they do not put the holder in a different economic position than holding the underlying collateral directly (i.e., they lack substantive credit enhancement). Accordingly, these structures are required to be captured as nonbond debt securities on Schedule BA within the reporting line specific for “debt securities that lack substantive credit enhancement.”

Life reporting entities can file these debt securities with the SVO to obtain an NAIC Designation that can be used for risk-based capital (RBC). To mitigate the potential adverse RBC effect from unitranche SASB commercial mortgage-backed securities transactions no longer qualifying as bonds, the SSG recommended that insurers send information regarding these unitranche SASBs to the SSG. The SSG will review the individual security, which could be modeled for an NAIC Designation by the SSG for continued appropriate RBC charges.

b. SAP Working Group Exposes Concept Agenda Item on Accounting and Reporting of Investment Subsidiaries

The SAP Working Group exposed a new concept agenda item to solicit comments on recommendations for the accounting and reporting of investment subsidiaries. The agenda item was prepared in response to questions on the classification of investments as “investment subsidiaries” in Schedule D-6-1: Valuation of Shares of Subsidiary, Controlled, or Affiliated Companies and in the life RBC formula.

The concept of an investment subsidiary was previously reflected in SSAP No. 46 — Investments in Subsidiary, Controlled, and Affiliated Entities as “investments in noninsurance subsidiary, controlled or affiliated (SCA) entities that have no significant ongoing operations other than to hold assets that are primarily for the direct or indirect benefit or use of the reporting entity or its affiliates.” For these SCAs, the guidance in SSAP No. 46 required an equity measurement method adjusted to the statutory basis of accounting. With this adjustment to the statutory basis of accounting, the measurement of the SCA under SSAP No. 46 was intended to be consistent to the accumulated measurement of the underlying assets if they had been held directly.

Subsequently, SSAP No. 46 was superseded and the concept of an “investment subsidiary” was eliminated from statutory accounting guidance.

Under current reporting and RBC provisions, reporting entities can look through investment subsidiaries to calculate RBC as if the underlying assets were held directly. However, there is no current information to verify these calculations or whether the underlying assets meet the requirements for a particular RBC factor. In addition, some companies are reclassifying Schedule BA assets (limited liability companies and joint ventures) as investment subsidiaries for look-through purposes, which the SAP Working Group noted is outside the scope of what is permitted under the existing guidance as it should include only SCAs in the scope of SSAP No. 97 — Investments in Subsidiary, Controlled, and Affiliated Entities. 

The agenda item requests feedback on the following options:

• Incorporate revisions to SSAP No. 97 to incorporate statutory accounting guidance for SCAs that hold assets on behalf of the reporting entity and affiliate (investment subsidiaries). By incorporating in SSAP No. 97, consideration can be given as to prescribing the measurement method and potential nonadmittance thresholds if the assets within the investment subsidiary would be nonadmitted if held directly.
• Sponsor a proposal to the Blanks (E) Working Group (Blanks Working Group) to capture new investment schedules, or perhaps expansions to existing investment schedules, to detail the underlying assets held within an investment subsidiary. As the RBC and asset valuation reserve (AVR) calculations require reporting entities to calculate RBC and AVR based on the underlying assets, this information should be readily available. If revisions are not incorporated into SSAP No. 97, these proposals can also clarify requirements for reporting as an investment subsidiary.
  
  
  
  

• Make a referral to the Capital Adequacy (E) Task Force and related RBC Working Groups to incorporate details that allow regulators to verify the RBC calculation for the underlying assets in investment subsidiaries. If reporting revisions are not incorporated under the Blanks Working Group proposal described above, additional schedules or reporting lines would be necessary within the RBC formula.
  
  This agenda item was exposed until January 31, 2025, and the SAP Working Group intends to discuss this item further at the NAIC Spring 2025 National Meeting.

c. SAP Working Group Reexposes Collateral Loan Reporting Revisions

The SAP Working Group reexposed revisions to Schedule BA of the annual statement blanks to provide more granular reporting lines for collateral loans for AVR and RBC purposes until January 31, 2025, in order to allow for concurrent related exposure with the Blanks Working Group. On November 6, 2024, the Blanks Working Group exposed for comment until January 31, 2025, updates to the Schedule BA reporting line categories and instructions for the expansion of collateral loans and to the AVR instructions and blank for the added collateral loan lines.

These revisions were initially exposed by the SAP Working Group at the NAIC Summer 2024 National Meeting. The proposal was drafted in response to comments that the current reporting detail on Schedule BA does not provide sufficient clarity on the type of collateral used in support of admittance of collateral loans. At its February 20, 2024, meeting, the SAP Working Group adopted revisions to SSAP No. 21R to incorporate a collateral loan disclosure for year-end 2024 to detail admitted and nonadmitted collateral loans in accordance with the underlying collateral supporting the loan. During that same meeting, the SAP Working Group exposed additional revisions to SSAP No. 21R that would expand reporting for collateral loans on Schedule BA to enable regulators to quickly identify the type of collateral in support of admittance of collateral loans in scope of SSAP No. 21R. Under the proposed revisions to Schedule BA, collateral loans will be separated by the type of collateral that secures the loan. Additionally, a new aggregated data-capture note is proposed to identify the admitted and nonadmitted collateral loans by the type of collateral that secures the loan. The exposure also included a blanks proposal to begin detailing the revisions to Schedule BA and AVR that would occur with these changes.

Relatedly, in June 2024, the NAIC Life Risk-Based Capital (E) Working Group adopted interim changes that provide for look-through treatment for collateral loans secured by mortgage loans to be treated as Schedule BA mortgages, beginning year-end 2024. The NAIC has stated that in 2025 it will continue to consider the extent to which look-through treatment should apply for RBC purposes to collateral loans secured by other types of underlying collateral.

Interested parties provided comments to the prior exposure, mostly related to the reporting and presentation in Schedule BA for AVR, which were shared with the Blanks Working Group; however, the SAP Working Group chose to reexpose the proposed changes to Schedule BA without further revisions and will consider comments concurrently once the Blanks Working Group receives comments on its related exposure.

It is still expected that the revisions will have an effective date of January 1, 2026; however, revisions will need to be adopted by August 2025 to allow the revisions to take effect for the 2026 statutory filing year.

d. SAP Working Group Reconsiders Proposal to Bifurcate Debt Securities With Derivative Wrappers

In a change of course, the SAP Working Group directed NAIC staff not to continue with a proposal that would have required bifurcation of debt securities with derivative wrappers or components if the item does not reflect a structured note and detailed the accounting and reporting guidance for the bifurcated debt and derivative components. The proposal was previously exposed at the NAIC Summer 2024 National Meeting until September 27, 2024, and comments received from interested parties did not support the change. Interested parties argued that insurers who own these types of instruments should evaluate the debt investment in its entirety to determine if the principles-based bond definition has been met.

After considering the comments from interested parties, the SAP Working Group agreed that these debt securities should be subject to the bond definition without derivative bifurcation (such that, if they do not qualify as bonds, they will be reported as nonbond debt securities). As a result, NAIC staff will modify this proposal and subsequently reexpose during the SAP Working Group’s December 17, 2024, public interim meeting to clarify disposal and reacquisition reporting requirements on the investment acquisition and disposal schedules when a debt security is sold and then reacquired from a special purpose vehicle with those added derivative components.

e. SAP Working Group Considers Updates Regarding Combination Reinsurance Contracts

The SAP Working Group received updates on previously exposed revisions to SSAP No. 61R — Life, Deposit-Type, and Accident and Health Reinsurance to incorporate guidance noting that interdependent contract features such as a shared experience refund must be analyzed in the aggregate when determining risk transfer.

The American Council of Life Insurers (ACLI) provided short oral comments on the revisions, stating its concern that the revisions lack specifics and may lead to a “diversity of practice” in their application. As a result, according to the ACLI, additional guidance is necessary for regulators and industry participants to understand how the risk transfer analysis will apply in order to ensure more consistency across state regulators. At the request of the ACLI, the SAP Working Group had extended the deadline for public comment to December 9, 2024, to provide sufficient time for specific language suggestions to be provided.

The revisions were initially exposed at the NAIC Spring 2024 National Meeting in response to a referral from the Valuation Analysis (E) Working Group (VAWG) and were reexposed at the NAIC Summer 2024 National Meeting to allow for further discussion. VAWG had identified that issues were arising when evaluating reinsurance for risk transfer in accordance with SSAP No. 61R when treaties involve more than one type of reinsurance and where there is interdependence of the types of reinsurance, including a refund based on aggregate experience. VAWG regulators observed that some insurers are reporting an overstated reserve credit due to a bifurcated risk transfer analysis where the insurers reported a proportional reserve credit for a coinsurance component, despite in aggregate the reinsurer being exposed to loss only in tail scenarios. Thus, the ceding company would take a proportional reserve credit that reflects the transfer of all actuarial risks when not all actuarial risks were transferred. To address these concerns, VAWG made a recommendation to the SAP Working Group to consider clarifications to risk transfer requirements.

The proposed revisions to SSAP No. 61R clarify that for purposes of evaluating whether a contract with a reinsurer transfers risk, what constitutes a contract is essentially a question of substance. For instance, the profit-sharing provisions of one contract may refer to experience on other contracts and therefore raise the question of whether, in substance, one contract rather than several contracts exists. Therefore, if agreements with a reinsurer do not, in the aggregate, transfer risk, the individual component contracts that make up those agreements also would not be considered to transfer risk, regardless of how they are structured.

Discussion on this topic is expected to resume at a public interim meeting of the SAP Working Group on December 17, 2024.

f. SAP Working Group Considers Updates Regarding Funds Withheld and ModCo Insurance Asset Reporting

The SAP Working Group received updates on previously exposed draft reporting schedules to add a new part to the reinsurance schedules (Schedule S of the Life/Fraternal and Health annual statement blanks and Schedule F of the Property/Casualty and Title annual statement blanks) to add reporting on FWH and ModCo assets.

The ACLI provided short verbal comments on the reporting schedules, stating their concerns regarding maintaining the confidentiality of treaty-level information regarding assets and pricing as well as regarding the resource strain that insurers may experience by seeking to comply with requirements under the recently completed bond project. At the request of the ACLI, the SAP Working Group had extended the deadline for public comment to December 16, 2024, to provide sufficient time for additional comments to be provided.

The reporting schedules were initially exposed at the NAIC Summer 2024 National Meeting in response to a referral from the IMR Ad Hoc Group, which was formed to develop a long-term solution for the treatment of negative interest maintenance reserve for statutory accounting. During the IMR Ad Hoc Group’s discussions, it was noted that there were issues in identifying assets subject to FWH and ModCo arrangements within the financial statements and reporting schedules. The initial recommendation was to add a new part to the reinsurance schedules to include all assets held under a FWH arrangement and include a separate signifier for ModCo assets.

Discussion on this topic is expected to resume at a public interim meeting of the SAP Working Group on December 17, 2024.

a. NAIC Establishes Data Call Study Group

The Innovation, Cybersecurity, and Technology (H) Committee announced the formation of a Data Call Study Group that is intended to enhance regulator access to high-quality and timely data allowing for evidence-informed decisions, enhanced supervisory capabilities, and improved efficiency.

The study group is intended to work toward reducing the significant costs borne by insurers in responding to data calls run by different states by ensuring that regulators establish and use consistent data definitions, establish standardized filing deadlines for ongoing market intelligence data filings, and minimize the need for ad hoc data calls by coordinating across states as needed.

Regulators and NAIC staff participating in the study group intend to begin their work by creating an inventory of data definitions and data collected and stored by the NAIC. Representatives from trade associations and insurers are also expected to be invited to assist the study group in its work.

b. NAIC Considers Amendments to Privacy Protections Regulatory Framework

The Privacy Protections (H) Working Group discussed next steps for drafting amendments to the Privacy of Consumer Financial and Health Information Regulation (#672) (Privacy Model Regulation). Earlier this fall, a drafting group consisting of state insurance regulators, industry representatives, consumer representatives, and state legislators began holding a series of open meetings to consider the “chair draft” of the proposed amendments, which had been exposed for public comment on August 20, 2024. As of November 4, 2024, the drafting group had completed its review of Article II of the Privacy Model Regulation, as amended (regarding third-party contractual obligations). In December, the drafting group will begin considering Article III of the Privacy Model Regulation (regarding consumer requests). Once the entire Privacy Model Regulation has been reviewed and revised by the drafting group, it will be reexposed for public comment before the working group considers it for adoption.

The Innovation, Cybersecurity, and Technology (H) Committee also approved the request of the working group to extend the deadline for the completion of its work until December 31, 2025.

c. NAIC Considers Development of Cybersecurity Event Repository and Portal

The Cybersecurity (H) Working Group directed NAIC staff to continue developing a confidential cybersecurity event repository and portal at the NAIC. This initiative, which was discussed at an interim meeting of the working group on October 30, 2024, is aimed at enhancing the cybersecurity event notification process within the U.S. insurance sector.

The regulators intend for the portal to

• initially focus on facilitating the transmission of event notices pursuant to the Insurance Data Security Model Law (#668)

   

• focus on the Model #668 reporting requirements, narrowing the information provided by the companies reporting to the regulators via the portal

   

• include functionality allowing for the submission of updates to the initial notice to the department of insurance

Although industry representatives generally supported the idea of a uniform notification method for state regulators, they raised concerns regarding portal security and data confidentiality.

Once the NAIC staff’s work testing the portal’s security and confidentiality is complete, the working group will consider the results of such testing prior to approving the portal’s use by regulators and industry.