Guidelines on supervisory review process

This is only test GUIDELINES

GUIDELINES

on supervisory review process

EIOPA-BoS-25/660 Adopted on 27 January 2026

Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

GUIDELINES ON SUPERVISORY REVIEW PROCESS

INTRODUCTION

1. In accordance with Article 16 of Regulation (EU) No 1094/2010 , EIOPA issues Guidelines on supervisory review process.

2. These guidelines relate to Article 36 of Directive 2009/138/EC (Solvency II Directive) . Further relevant provisions concern in particular Articles 27, 29, 34, 71, 213(2), 248, 249, 250 and 255 of the Solvency II Directive.

3. These Guidelines aim at identifying the manner in which a risk-based, prospective and proportionate approach to supervision may be achieved within the supervisory review process.

4. The supervisory review process refers to all activities conducted by the supervisory authority in order to comply with its obligations under Article 36 of the Solvency II Directive. The supervisory review process includes the evaluation of strategies, processes and reporting procedures for insurance and reinsurance undertakings.

5. Therefore, the objective of these Guidelines is to attain consistent outcomes through the convergence of supervisory processes and practices within the supervisory review process, whilst ensuring sufficient flexibility for supervisory authorities to be able to appropriately adapt their actions on a case-by-case basis, taken into account the specificities of the insurance and reinsurance undertakings and groups involved, their own markets and other supervisory priorities.

6. These Guidelines are summarised in the diagram presented in the explanatory text of Guideline 1 and in the document “SRP Guidelines Diagram” published together with these Guidelines.

7. For the supervisory review process of insurance groups where there is a college of supervisors in place, these Guidelines have taken into consideration the Guidelines on operational functioning of colleges and the college’s specific coordination arrangements and any other processes or plans agreed by the college of supervisors.

8. These Guidelines are not intended to restrict the group supervisor and the college of supervisors from additional communications or information sharing arrangements that are consistent with the Solvency II Directive, including the proportionate and risk-based approach of the supervisory review process in line with Article 29 of the Solvency II Directive.

9. Supervisory authorities that are part of a college will have ongoing responsibilities to communicate and involve the college in the supervisory review process, particularly when taking supervisory measures, or when insurance and reinsurance undertakings or groups enter into financial difficulties. Where appropriate, examples with cross references to various requirements and Guidelines are provided in the explanatory text. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

10. These Guidelines apply to the supervisory review process performed by supervisory authorities regarding all insurance and reinsurance undertakings, both individual undertakings and insurance and reinsurance groups subject to group supervision under Article 213 of the Solvency II Directive(insurance groups). Regarding the application of the Guidelines to the supervisory review process of insurance groups the following needs to be considered: • Guidelines 10, 16, 18, 21, 35, 37 and 40 are group-specific and are only applicable to the group supervisor, with the exception of Guidelines 37 and 40 which can apply to both group supervisor and individual supervisory authority; • Guidelines 15 and 17 apply only to supervisory authorities of individual insurance and reinsurance undertakings and do not apply to supervisory authorities in their role as group supervisor. The group supervisor should comply with the relevant group-specific Guidelines 16 and 18; • Guidelines 5, 6, 7, 11, 13, 19, 21, 23, 25, 28, 29, 32, 37, 39 and 40 also include provisions that apply only if the insurance group has a college that is established under Article 248 of the Solvency II Directive. These provisions may apply to both the group supervisor and the supervisory authorities of individual insurance and reinsurance undertakings within the college, with the exception of Guideline 21, which only applies to the group supervisor.

11. Where there is group supervision established at national level pursuant to Article 216 of the Solvency II Directive, these Guidelines apply mutatis mutandis both to group supervision carried out at national level under Article 216 of the Solvency II Directive and group supervision carried out under Article 213 of the Solvency II Directive.

12. These Guidelines are addressed to the supervisory authorities under the Solvency II Directive.

13. The Guidelines apply from 30 January 2027 and repeal and replace the Guidelines on Supervisory Review Process (EIOPA-BoS-14-179).

14. For the purpose of these Guidelines the following definitions apply: • When applying these Guidelines to group supervisors: o the term “supervisory authority” refers to the supervisory authority responsible for group supervision pursuant to Article 247(1) of the Solvency II Directive; • When applying these Guidelines to group supervisors, the term “insurance and reinsurance undertakings” refers to “insurance groups” (excluding guidelines 12, 19, 33, 36 and 38, which refer to both groups and the undertakings within the group); • “Group supervisor” refers to the supervisory authority that fulfils the criteria set out in Article 247(1) of the Solvency II Directive; • “College” refers to the college of supervisors as defined in Article 212(1)(e) of the Solvency II Directive; • “Members” and “participants” refer to members and participants as defined in the Guidelines on operational functioning of colleges; • “On-site inspection” refers to an organised assessment or formal evaluation exercise, performed at the location of the supervised undertaking, or the service providers to whom the supervised undertaking has outsourced functions, which leads to the issuing of a document communicated to the undertaking. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

15. If not defined in these Guidelines the terms have the meaning defined in the legal acts referred to in the introduction.

SECTION I - OVERALL SUPERVISORY REVIEW PROCESS (SRP) Guideline 1 – Conducting the supervisory review process

16. The supervisory authority should, in carrying out the supervisory review process and whilst recognising the need for flexibility and supervisory judgement, ensure it comprises three subprocesses as set out in these Guidelines: the risk assessment framework, the detailed review and the supervisory measures.

Guideline 2 – Consistency of the supervisory review process

17. The supervisory authority should ensure that the supervisory review process is applied in a consistent manner over time, across insurance and reinsurance undertakings and within the supervisory authority.

Guideline 3 – Proportionality in the supervisory review process

18. The supervisory authority should ensure that the principle of proportionality is observed throughout all the stages of the supervisory review process.

Guideline 4 – Supervisory judgement in the supervisory review process

19. The supervisory authority should ensure that supervisors use their supervisory judgement at each stage of the supervisory review process. The supervisory authority should ensure that the supervisory review process is kept flexible enough to allow appropriate supervisory judgement to be used.

Guideline 5 – On-going communication with insurance and reinsurance undertakings

20. The supervisory authority should ensure that there is an appropriate level of communication between the personnel of the supervisory authority and the insurance and reinsurance undertaking throughout the entire supervisory review process in order to facilitate effective supervision.

21. If there is a college, the communication with the supervised undertakings should be coordinated as described in Guideline 15 of the Guidelines on operational functioning of colleges.

Guideline 6 – On-going communication with and involvement of other supervisors

22. The supervisory authority should undertake an appropriate level of communication and involvement with other relevant supervisory authorities throughout the entire supervisory review process.

23. Communication with third-country supervisory authorities should be in line with any relevant memoranda of understanding in place.

24. If there is a college, communication should follow the relevant requirements and guidelines.

Guideline 7 – Inclusion of market-wide risks in the supervisory review process

25. The supervisory authority should take into account market wide analyses throughout the supervisory review process.

26. If there is a college the supervisory authority should take into account the outcome of any relevant market-wide analysis that has been shared within the college. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

Guideline 8 – Documentation

27. The supervisory authority should ensure that information supporting the conclusions from the supervisory review process is documented and easily accessible within the supervisory authority whilst also observing appropriate confidentiality standards in relation to this information.

Guideline 9 – Governance over and regular review of the supervisory review process

28. The supervisory authority should have an adequate governance mechanism in place to properly monitor the conduct of the supervisory review process.

29. The supervisory authority should regularly review their method of implementation of the supervisory review process to ensure its on-going appropriateness.

Guideline 10 – The scope and focus of the insurance group supervisory review process

30. The group supervisor should apply the supervisory review process consistently with the scope and cases of application of group supervision described in Title III, Chapter I of the Solvency II Directive, taking into account the type of the ultimate parent undertaking of the insurance group, the geographical location of its head office (EEA or a third country), the equivalence status of the third country, if any, and any financial conglomerate aspects.

31. The group supervisor should consider in the supervisory review process all relevant entities within the insurance group including regulated and non- regulated as well as EEA and non-EEA entities.

32. The group supervisor should focus on the group-specific issues, including: a) intra-group transactions, complexity and interconnectedness of the insurance group; b) the group risk profile including any diversification effects, risk concentrations and risk transfer across the insurance group; c) any other risks from a group-wide perspective, including those that arise at group level, such as risks from non-insurance entities; d) aspects of the group governance and group strategy including any conflict or any potential conflict of interests; e) aspects of the group-wide risk management, including any centralised risk management functions; and f) the group’s management of its group capital, including transferability and allocation within the insurance group.

SECTION II - INPUT TO THE SUPERVISORY REVIEW PROCESS Guideline 11 – Input to the supervisory review process

33. Throughout the supervisory review process the supervisory authority should, where appropriate, consider relevant information arising from different sources, including from: a) the insurance and reinsurance undertaking or the insurance group: quantitative reporting templates, regular supervisory report, solvency and financial condition report, ORSA report, other undertaking or group information or any other information requested from the insurance and reinsurance undertaking or insurance group by the supervisory authority; b) the supervisory authority or the group supervisor itself: historical information, early warning indicators, risk indicators, previous findings on insurance and reinsurance undertakings or groups, thematic reviews or stress tests results; Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence. c) the college: individual outcomes of the risk assessment framework, individual supervisory plans shared within the college, college work plan, any relevant analysis or reviews or supervisory measures shared within the college; d) other competent authorities; e) other external parties: market or sector information, information from consumer or industry bodies or associations, technical research papers or press or media information.

SECTION III - RISK ASSESSMENT FRAMEWORK Guideline 12 – Risk assessment framework structure and use

34. The supervisory authority should use a risk assessment framework to identify and assess current and future risks that insurance and reinsurance undertakings face or may face including the insurance and reinsurance undertaking’s capacity to identify, measure, monitor, manage and report on those risks.

35. The supervisory authority should use this approach for the purposes of: a) conducting the effective supervision of insurance and reinsurance undertakings; b) prioritising supervisory activities; c) setting the frequency of the regular supervisory reporting; d) determining the scope, depth and frequency of off-site analysis and on-site inspections or any other matters needed for the supervision of insurance and reinsurance undertakings.

Guideline 13 – Scope of the risk assessment framework

36. The supervisory authority should apply a risk-based and forward- looking approach to supervision that is established in the following stages: a) assessment of information; b) determination of insurance and reinsurance undertaking impact classification; c) determination of insurance and reinsurance undertaking risk classification; d) determination of outcome of risk assessment framework; e) creation of supervisory plan and determination of intensity of supervision. f) in the case of insurance groups, if there is a college established under Article 248(2) of the Solvency II Directive, the contribution of aspects of the supervisory plan to the college work plan, where appropriate.

Guideline 14 – Assessment of information

37. The supervisory authority should perform at least a high-level assessment of the information when regular reporting is received and consider the need to reappraise the components of the risk assessment framework.

Guideline 15 – Determination of undertaking impact classification

38. The supervisory authority should include in the risk assessment framework an assessment of the potential impact of all insurance and reinsurance undertakings. This assessment should reflect the potential impact that the failure of a particular undertaking would have on its policyholders and beneficiaries, on the market or the objective of the supervisory authority.

39. The supervisory authority should assign an impact classification to each undertaking and elaborate on the outcome. It should be conducted on a scale with 4 categories, from ‘Impact class 1’ the Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence. lowest impact on policyholders and beneficiaries and on the market to ‘Impact class 4’ the highest impact on policyholders and beneficiaries and on the market.

40. The impact should in principle be assessed at least on an annual basis through quantitative indicators and where applicable qualitative factors. The supervisory authority may carry out an impact classification on an ad-hoc basis in cases where an extraordinary event occurs.

Guideline 16 – Determination of impact classification for insurance groups

41. The group supervisor should include in the group risk assessment framework an impact classification for all insurance groups.

42. The impact classification at insurance group level should reflect the potential impact of the failure of the insurance group, through its entities, on the group’s policyholders and beneficiaries, on the markets where the insurance group is active or the objective of the supervisory authority.

43. The group supervisor should, when assigning an impact classification, take into account the complexity and inter-connectedness of the insurance group.

44. The group supervisor should assign an impact classification to each insurance group on a scale with 4 categories, from ‘Impact class 1’ the lowest impact of the insurance group on policyholders and beneficiaries and on the market to ‘Impact class 4’ the highest impact of the insurance group on policyholders and beneficiaries and on the market.

45. The impact should in principle be assessed at least on an annual basis through quantitative indicators and where applicable qualitative factors. The supervisory authority may carry out an impact classification on an ad-hoc basis in cases where an extraordinary event occurs.

Guideline 17 – Determination of undertaking risk classification

46. The supervisory authority should identify and assess the current and future risks that insurance and reinsurance undertakings face or may face, including the ability of the undertaking to manage and control those risks and to withstand possible events or future changes in economic conditions, and their potential adverse effect on the solvency and financial position, the viability of the undertaking and its ability to meet its obligations to policyholders and beneficiaries if the risks materialise.

47. The supervisory authority should carry out this risk identification and assessment for all insurance and reinsurance undertakings taking into account quantitative and qualitative criteria and measures relevant to each undertaking.

48. The supervisory authority should assign insurance and reinsurance undertakings a risk classification on a scale with 4 categories: from ‘Risk class 1’ that corresponds to being best able to withstand the risks materialising, to ‘Risk class 4’ that corresponds to being least able to withstand the risks materialising.

49. Undertakings’ risks should in principle be assessed at least on an annual basis. The supervisory authority may carry out risk classification on an ad-hoc basis in cases where and extraordinary event occurs. However, on the basis of the results of the impact assessment, the supervisory authority should be able to modulate the frequency and depth of the risk assessment for proportionality purposes. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

Guideline 18 – Determination of undertaking risk classification for insurance groups

50. The group supervisor should identify and assess the current and future group level risks that could affect the insurance group, including the ability of the insurance group to withstand possible events or future changes in economic conditions and their potential adverse effect on the solvency and financial position, the viability of the insurance group and the group’s individual insurance and reinsurance undertakings’ abilities to meet their obligations to policyholders and beneficiaries if the risks materialise.

51. The group supervisor should, when assessing the risks of the insurance group, consider the groupspecific issues outlined in Guideline 10.

52. The group supervisor should carry out this risk identification and assessment for all insurance groups taking into account quantitative and qualitative criteria and measures relevant to the insurance group.

53. The group supervisor may carry out risk classification on an ad-hoc basis in cases where an extraordinary event occurs.

54. The group supervisor should assign a risk classification to each insurance group on a scale with 4 categories: from ‘Risk class 1’ that corresponds to being best able to withstand the risks materialising, to ‘Risk class 4’ that corresponds to being least able to withstand the risks materialising.

55. Group risks should in principle be assessed at least on an annual basis. However, on the basis of the results of the impact assessment, the group supervisory authority should be able to modulate the frequency and depth of the risk assessment for proportionality purposes.

Guideline 19 – Determination of outcome of the risk assessment framework

56. The supervisory authority should ensure that the risk assessment framework outcome for all insurance and reinsurance undertakings and groups includes an impact classification and a risk classification, whether combined or not, and that they are used together with other relevant supervisory information for the purpose of setting the supervisory plan.

57. If there is a college, when exchanging the outcomes of the risk assessment framework (group and individual) the group supervisor and the other supervisory authorities should be able to explain the rationale of the outcome so to enable the college to form a shared view of the risks of the insurance group.

Guideline 20 – Business model analysis

58. As part of the supervisory review process, the supervisory authority should perform a structured business model analysis for insurance and reinsurance undertakings, in line with the nature, scale and complexity of the risks inherent in their business.

59. The business model analysis should result in a view on how the insurance and reinsurance undertaking generates value from its business. It should provide insights into the insurance and reinsurance undertaking’s strategy, its main risks as well as on the business viability, sustainability and vulnerabilities of the business model. The supervisory authority should use the outcome of the business model analysis to support the assessment of other elements of the supervisory review process. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

60. The process adopted by the supervisory authority to carry out the business model analysis can differ in terms of being an integrated or separate approach (i.e. integrated into risk assessment framework in itself) but the objectives and outcomes remain the same.

Guideline 21 – Scope of business model analysis

61. The business model analysis can be performed at the group and/or individual level depending on the supervisory authority’s expert judgement. The analysis should be forward-looking.

62. The business model analysis should be performed at least every three years and after major changes in the business or risk profile of the insurance and reinsurance undertaking and group e.g. large mergers and acquisitions to adequately reflect relevant emerging trends.

63. The level of detail of the analysis should be commensurate with the nature, scale and complexity of the risks the insurance and reinsurance undertaking and group faces or could face assessed in combination with the impact it could have on policyholders.

Guideline 22 – Structured approach

64. When performing a business model analysis following an integrated or separate approach, the supervisory authority should make use of a structured approach. The aim of the structured approach is to minimize the risk of overlooking important information and excluding this from the business model analysis, and to optimize consistency which in turn enables the comparison over time and between peers.

65. This structured approach should at least comprise: a) a structured identification of risks; b) an analysis of the business environment; c) a qualitative and quantitative analysis of the current business model; d) an analysis of the business plans and; e) an analysis of the business viability, sustainability and vulnerability.

Guideline 23 – Creation of supervisory plan and determination of intensity of supervision

66. The supervisory authority should define minimum engagement levels and conduct at least every three years the supervisory review process for all insurance and reinsurance undertakings under its scope of supervision, having regard to their size, complexity, and intrinsic riskiness.

67. The supervisory authority should utilise the outcome of the risk assessment framework together with the details of the risks identified, the various priorities and constraints of the supervisory authority and other relevant supervisory information to develop the supervisory plan.

68. The supervisory plan should set out the frequency and intensity of supervisory activities for each insurance and reinsurance undertaking. The supervisory plan should be commensurate to the nature, scale and complexity of the insurance and reinsurance undertaking.

Guideline 24 – Interaction between the group supervisory plan and the college work plan

69. If there is a college, the group supervisor should include the relevant aspects of the group supervisory plan in the college work plan (as set out in Guideline 12 of the Guidelines on operational functioning of colleges) for discussion and action within the college.

70. Relating to the group supervisory review process, the college work plan should include: a) a description of the main risks being focused on as a result of the outcome of the group risk assessment framework; Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence. b) descriptions and rationale of the activities to be carried out within the college on the basis of the group supervisory plan; c) the identification of the relevant entities within the insurance group and their supervisory authorities that the group supervisor is likely to seek input from.

Guideline 25 – Governance of the supervisory plan

71. The supervisory authority should ensure that the appropriateness of the supervisory plan is subject to suitable oversight and internal governance within the supervisory authority.

Guideline 26 – Notification of the frequency of regular supervisory report

72. The supervisory authority should notify insurance and reinsurance undertakings of the frequency of the regular supervisory report required, be it annually, every two or three years as well as any subsequent change to that, as soon as possible and no later than three months in advance of the insurance and reinsurance undertakings’ financial year end.

73. The decision on frequency should, at least, take the outcome of the risk assessment framework, other supervisory information and the exercise of supervisory judgement into consideration.

74. If there is a college, the supervisory authorities should communicate changes to the regular supervisory report frequency to the group supervisor before notifying the insurance and reinsurance undertakings if appropriate.

Guideline 27 – Update of the risk assessment framework

75. The supervisory authority should, throughout the supervisory review process, consider if it is necessary to update the outcome of the risk assessment framework.

SECTION IV - DETAILED REVIEW Guideline 28 – Detailed review activities

76. The supervisory authority should carry out detailed review activities, whether off-site analysis or on-site inspections, based on the supervisory plan, taking into account all relevant information and focusing on the areas of risk as identified in the risk assessment framework.

77. If there is a college the supervisory authorities should also refer to the college work plan when carrying out the detailed review activities with regard to any participation of other supervisory authorities in line with the Guidelines on operational functioning of colleges.

Guideline 29 – Request for additional information during the detailed review

78. The supervisory authority should, where appropriate, evaluate the need for additional information from the insurance and reinsurance undertaking, including various types of data, analyses or tasks to be performed by the insurance and reinsurance undertaking. The timeframe allowed by the supervisory authority for the provision of additional information should be appropriate in order for the insurance and reinsurance undertaking to be able to answer the request.

Guideline 30 – Detailed review conclusions

79. The supervisory authority should ensure that the main findings and conclusions of the detailed review are recorded and internally accessible for supervisory purposes. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

Guideline 31 – Detailed off-site analyses

80. The supervisory authority should, as defined in the supervisory plan and taking into account the college work plan, if there is a college, use off-site analyses to carry out further activities beyond the high level assessment of information performed in the risk assessment framework, focusing on the specified risk areas.

Guideline 32 – On-site inspections

81. The supervisory authority should carry out regular on-site inspections if defined in the supervisory plan and take into account the college work plan, if there is a college, or other ad-hoc on-site inspections as appropriate.

Guideline 33 – Governance of on-site inspections

82. The supervisory authority should have adequate governance mechanisms in place which allow them to properly monitor the on-site inspections.

Guideline 34 – Process to follow for on-site inspections

83. The supervisory authority should consider, for the on-site inspections, the following phases: preparation, field work and written conclusions.

Guideline 35 – Written conclusions of on-site inspections

84. The supervisory authority should communicate the conclusions of the on-site inspections in writing to the insurance and reinsurance undertaking and should allow the insurance and reinsurance undertaking to respond to the conclusions within a reasonable timeframe as set by the supervisory authority. The supervisory authority should communicate these conclusions to those persons who effectively run the insurance and reinsurance undertaking and are considered appropriate in that context.

85. If there are other supervisory authorities involved in the on-site inspections, the supervisors should discuss the conclusions that will be communicated to the relevant insurance and reinsurance undertakings that are part of the insurance group before communicating them.

Guideline 36 – Joint on-site inspections

86. Joint on-site inspections are inspections carried out by a joint on-site inspections team composed by two or more supervisory authorities and EIOPA, where relevant, in the context of supervision of cross-border activities and group supervision.

87. Joint on-site inspections may be initiated based on the request of the supervisory authority of the home or the host Member State, or EIOPA. In case of supervision of cross-border activities, the joint on-site inspections can be initiated upon decision of the supervisory authority of the home Member State, or of the host Member State, where applicable. In case of group supervision, the joint on-site inspections can be initiated upon decision of the group supervisor. The request to or the decision not to initiate a joint on-site inspection need to be duly justified.

88. Guidelines 29, 30, 31 and 32 apply to joint on-site inspections.

89. Guidelines 32a, 32b and 32c apply mutatis mutandis to joint on-site inspections in the context of group supervision.

Guideline 37 – Principles governing joint on-site inspections

90. The joint on-site inspections team should be able to: Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence. a) access the premises of the supervised insurance and reinsurance undertakings, and/or the premises of any service providers to whom the supervised entity has outsourced functions, covered by the scope of the inspection, b) conduct all necessary investigations by accessing to the relevant information, documents and data (including those stored in the IT systems), c) obtain oral or written explanations from the supervised entity.

91. The joint on-site inspections team is subject to the requirements of professional secrecy pursuant to all relevant provisions in Union legislation with regard to the facts, actions and non-public information that they become aware of during the inspection. These requirements apply even after their duties have ceased.

92. The joint on-site inspections team should act with independence and objectivity. The joint on-site inspections team should observe and comply with the relevant laws and regulations.

Guideline 38 – Procedural aspects for joint on-site inspections

93. The supervisory authorities concerned should reach joint conclusions in writing. The joint conclusions may include findings, as well as the most appropriate supervisory actions recommended by the supervisory authorities concerned.

94. The supervisory authority of the home Member State should draft a report taking into account those joint conclusions and adopt the appropriate supervisory measures. In case the supervisory authority of the home Member State does not take into account all or part of the joint conclusions, it should inform all other participating members of the joint on-site inspections team and state the reasons.

95. The supervisory authority of the home Member State should inform the other participating supervisory authorities and EIOPA, about the outcome of the consultation with the supervised entity in relation to the report (right-to-be-heard) and about any additional collected evidence, if any.

96. The joint conclusions by the supervisory authorities concerned may be used by the other participating supervisory authorities to take supervisory measures within their mandate.

97. In case the joint conclusions are relevant to multiple jurisdictions, the supervisory measures should be taken in a coordinated manner if feasible.

SECTION V - SUPERVISORY MEASURES Guideline 39 – Identification of matters leading to the supervisory measures

98. The supervisory authority should, based on the conclusions of the detailed review, identify any weaknesses and actual or potential deficiencies or non-compliances with requirements that could lead them to imposing supervisory measures.

Guideline 40 – Early intervention measures in case of a risk of non-compliance with the Solvency Capital Requirement

99. The supervisory authority should assess whether a situation of a risk of non-compliance (so called ”near non-compliance” or ”near-breach”) with the Solvency Capital Requirement (SCR) occurs and, as a consequence, assess the need for early intervention measures aiming at avoiding the breach from occurring. In certain circumstances it might be necessary for the supervisory Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence. authority to extend the scope of early intervention measures to consider also the Minimum Capital Requirement (MCR) or specific key supervisory indicators, like local GAAP equity.

100. The supervisory authority should apply early intervention measures at an initial stage in order to avoid the deterioration of the financial position of the insurance and reinsurance undertakings or groups.

101. The supervisory authority should assess, identify and apply early intervention measures based on a combination of qualitative and quantitative key risk indicators.

102. Early intervention measures applied by the supervisory authority should be proportionate to the nature of the issues identified and be based on a forward-looking and risk-based approach.

Guideline 41 – Assessment of the significance of weaknesses, deficiencies or noncompliances

103. The supervisory authority should, in order to decide upon measures, assess the significance of the weaknesses and the actual or potential deficiencies or non-compliances identified in the detailed review.

Guideline 42 – Identification and assessment of the significance of weaknesses, deficiencies or non-compliances at group level

104. The group supervisor identifies and assesses any weaknesses and actual or potential deficiencies or non-compliance from a group-wide perspective, taking into account the specificities of the insurance group structure and business and the interconnectedness of the insurance and reinsurance group.

105. The group supervisor should consider whether the findings on weaknesses and actual or potential deficiencies or non-compliance from a group-wide perspective relate to the insurance group as a whole or to some specific insurance and reinsurance undertakings.

Guideline 43 – Different measures for varying situations

106. The supervisory authority should take measures appropriate to the level of significance of the weaknesses and the actual or potential deficiencies or non-compliances, faced by the insurance and reinsurance undertakings.

Guideline 44 – Ladder of intervention

107. The notion of proportionality and appropriateness of the supervisory measures provided in the Solvency II Directive should be implemented through a gradual supervisory response. In that frame, such measures should be applied according to an appropriate ladder or escalation of interventions (ladder of intervention).

Guideline 45 – Decision upon measures at group or individual level

108. The supervisory authorities responsible for the supervision of the relevant insurance and reinsurance undertakings or the group supervisor, in case of measures related to the insurance group as a whole, should take the necessary measures against the relevant insurance and reinsurance undertaking based on their analysis of the findings on the weaknesses, deficiencies or non-compliances. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

109. Where measures are taken both at group and individual levels, the group supervisor and the supervisory authorities should coordinate measures, where appropriate, to enhance their effectiveness.

Guideline 46 – Governance over exercise of measures

110. The supervisory authority should have a suitable governance process on the exercise of supervisory measures to ensure that they are used in a consistent, proportionate and objective manner and that they are properly documented.

Guideline 47 – Notification of measures

111. The supervisory authority should notify the undertaking in writing and on a timely manner about the specific measures that the insurance and reinsurance undertaking should implement. This notification should, where appropriate, include a specification of the appropriate timeframe in which the insurance and reinsurance undertaking is to implement the actions necessary to comply with the measures.

112. If there is a college and where more than one supervisory authority takes measures, the supervisory authorities should consider coordinating their communication strategy.

Guideline 48 – Communication in the college

113. If there is a college, the supervisory authority should, where appropriate, communicate to the group supervisor the supervisory measures taken.

Guideline 49 – Monitoring implementation by insurance and reinsurance undertakings

114. The supervisory authority should monitor whether the measures are properly implemented by the insurance and reinsurance undertakings.

Guideline 50 – Review of supervisory measures

115. The supervisory authority should review the measures and update the supervisory plan in response to the degree of effectiveness of the supervisory measures as implemented by the insurance and reinsurance undertaking.

SECTION VI – RECOVERY AND RESOLUTION Guideline 51 – Pre-emptive recovery planning

116. In the supervisory review process, the supervisory authority should use the information contained in pre-emptive recovery plans prepared pursuant to Directive (EU) 2025/1.

117. In addition, the supervisory authority should assess the consistency of pre-emptive recovery plans with the insurance and reinsurance undertaking or group’s system of governance, including decision-making process and the risk management process.

SECTION VII – CONDUCT OF BUSINESS Guideline 52 – Supervision of conduct of business

118. The supervisory authority should take into consideration how conduct risks are managed within insurance and reinsurance undertakings or groups regardless of its consumer protection mandate, without prejudice to the application of the proportionality principle. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

119. In case the supervisory authority does not have a consumer protection mandate, it should cooperate with the supervisory authority in this matter in order to achieve the goal of consumer protection.

SECTION VIII – EMERGING RISKS Guideline 53 – Governance in addressing emerging risks in the supervisory review process

120. The supervisory authority should have a regular process in place, where at least once a year major legal and regulatory developments, as well as changes to the risk landscape are analysed and assessed for their impact on the implemented supervisory review process. In addition to the regular process, the supervisory authority may also establish an ad hoc process to respond to specific developments or changes to the regulatory landscape as they occur.

121. The results of such a process should be translated into necessary adjustments to the established supervisory review process.

122. Such changes should be implemented as quickly as possible. If an immediate implementation is not possible, an adjustment plan should be drawn up to ensure proper compliance.

Guideline 54 – Supervision of ICT risks

123. The supervisory authority should integrate the assessment of ICT-related risks (as part of the overall operational risk of the insurance and reinsurance undertaking) within its supervisory review processes. The assessment should be in line with the requirements stemming from the Digital Operational Resilience Act.

124. The assessment of these operational risks (e.g. business interruption) should involve verifying whether the insurance and reinsurance undertakings are integrating such risks in their system of governance, in particular risk management.

125. The assessment should be risk-based and proportionate to the nature, scale and complexity of the insurance and reinsurance undertaking.

Guideline 55 – Climate change and other sustainability risks

126. The supervisory authority should integrate the assessment of climate change risks, including the climate change scenario analysis’ in accordance with Article 45a of the Solvency II Directive, and other sustainability risks within their supervisory review processes.

127. That should involve an assessment of an actual and potential impact of sustainability risks and verifying whether and how insurance and reinsurance undertakings are integrating such risks within their business models and strategies, and the system of governance, particularly focusing on risk management and actuarial functions, the assessment of the overall solvency needs within the ORSA, the remuneration policies, and the investment strategies, also in their implementation of the prudent person principle.

128. In case of climate change risks, supervisory authorities should assess both the potential impact of the physical risks and transition risks. With respect to risk management, the supervisory authority should also verify whether insurance and reinsurance undertakings make reasonable efforts to assess their sustainability risks over different time horizons, i.e. whether the insurance and reinsurance undertaking is able to forecast its climate and sustainability risks over the short, medium and long-term. Please note that the authoritative source of information is the English version. If there is any conflict between the translated versions and the English version, the latter takes precedence.

Guideline 56 – Use of supervisory technology in the supervisory review process

129. The supervisory authority should establish an ongoing quality control process regarding the supervisory review process implemented, and consider where technological developments could promote data-driven supervisory processes. The supervisory authority should implement, where possible and considered necessary, experimental technological approaches, testing those emerging technologies that could improve the efficiency and responsiveness of the supervisory review processes.

COMPLIANCE AND REPORTING RULES

130. This document contains Guidelines issued under Article 16 of the Regulation (EU) No 1094/2010. In accordance with Article 16(3) of that Regulation, competent authorities and financial institutions are required to make every effort to comply with guidelines and recommendations.

131. Competent authorities that comply or intend to comply with these Guidelines should incorporate them into their regulatory or supervisory framework in an appropriate manner.

132. Competent authorities are to confirm to EIOPA whether they comply or intend to comply with these Guidelines, with reasons for non-compliance, within two months after the issuance of the translated versions.

133. In the absence of a response by this deadline, competent authorities will be considered as noncompliant to the reporting and reported as such.

FINAL PROVISION ON REVIEWS

134. These Guidelines will be subject to a review by EIOPA.