Continuity policy, contingency plans and recovery plans
- Solvency II Law: Articles 204 to 211 (recovery plans)
- Delegated Regulation 2015/35: Article 258, § 3 (continuity policy)
- Underlying thematic NBB Circular: Circular PPB/D.256 of 10 March 2005 on business continuity (remains applicable)
- EIOPA Guidelines: Guideline 8 (contingency plans)
Insurance companies must have a continuity policy for their business and they are expected to draw up contingency plans for areas in which they consider themselves vulnerable. The Bank may also ask companies to draw up an ex-ante recovery plan if it deems this justified.
11.1. Continuity policy
Delegated Regulation 2015/35 sets out that insurance companies must develop a business continuity policy to ensure that in case of an interruption of their systems and procedures, critical data and business functions are protected and their insurance activities can be pursued or, if this isn’t possible, that these data and business functions are recovered as quickly as possible and their insurance activities are resumed as soon as possible. This is not a new requirement given that Circular PPB/D.256 already recommended that insurance companies have a business continuity policy and ensure that their organisation is designed in such a way as to be able to maintain or as quickly as possible recover their critical or important functions, activities or tasks in the case of serious and unplanned interruption to the business, although the scope is broader (IT and other issues).
11.2. Contingency plans
In addition to the aforementioned continuity policy, insurance companies are expected to identify material risks and draw up contingency plans for areas in which they consider themselves vulnerable and to regularly evaluate, update and test these contingency plans. These contingency plans can cover a wide range of vulnerabilities and are not limited to IT. This should allow the Bank to have a constructive and structured dialogue about the company’s vulnerabilities.
11.3. Recovery plans
The Solvency II Law (Article 204 et seq.) stipulates that the Bank may ask a company to draw up a recovery plan if it deems this justified in light of the potential risks of considerable deterioration of the company’s financial situation.