Capital, governance and transparency: the three pillars of Directive 2009/138/EC turned into a system your company can run and prove. With an eye on the Solvency II review and its expected application in 2027.
Would your governance withstand a supervisory review?
Tell us the size and business of your company and we will send back a diagnosis of the three pillars: where you are in good shape and where you are not.
From paper to system: six fronts where we help insurers turn the Directive into governance that works.
Board, effective management and key function holders: we assess and document the competence and good repute that Solvency II requires, and we design a system of governance proportionate to the company’s risk profile.
The fourth key function needs independence, a risk-based plan and findings that are actually followed up. We set up or strengthen your internal audit so that Pillar 2 is not a decorative organization chart.
SCR, MCR and the quality of own funds: the legal reading of your quantitative requirements and of their governance consequences.
Outsourcing a key or critical function does not outsource the responsibility: contracts, oversight and notifications done right.
Solvency II governs the company; the IDD governs the sale. We align both frameworks so that they tell the same story.
Digital operational resilience has applied since January 2025: ICT provider register, mandatory clauses and testing.
Not just large groups: the framework reaches mutuals, mid-sized companies and new projects. Four conversations that keep coming up.
“We are a modest mutual with the same three pillars as a giant. The Solvency II review promises proportionality for small and non-complex undertakings: we want to know whether we will be able to qualify and how to prepare for it.”
“Our ORSA has become a compliance document that nobody reads. I want it to go back to being what it is: the internal assessment that connects strategy, risk and capital, and that the board really discusses.”
“The supervisor does not ask whether the board exercises oversight: it asks where that is recorded. We need minutes, key function reports and traceable decisions that show an effective system of governance.”
“We are designing a niche company. Before we talk about capital, we need to understand what governance structure, key functions and reporting we will have to sustain every year.”
Three patterns we find again and again in governance reviews: none is about actuarial calculation, all are about the system.
Key functions on paper: risk management, actuarial, compliance and internal audit exist on the organization chart but have no resources, no access to the board, or are concentrated in people with obvious conflicts. Pillar 2 collapses entirely.
An ORSA disconnected from the business: if the own risk and solvency assessment does not influence strategy or capital decisions, it is an annual ritual. The supervisor spots it in one conversation.
Outsourcing without governing: handing the actuarial function, systems or claims handling to third parties without robust contracts, without ongoing oversight and without an exit plan turns every provider into an unmanaged risk.
| Pillar | Content | Typical evidence |
|---|---|---|
| Pillar 1 — Quantitative | Capital requirements (SCR and MCR), valuation of assets and liabilities, technical provisions and quality of own funds, on a risk-sensitive basis. | Documented and governed calculations, valuation policies and regular monitoring of capital coverage. |
| Pillar 2 — Governance | Effective system of governance: board, written policies, four key functions, fit and proper assessment, controlled outsourcing and ORSA. | Board minutes, key function reports, fit and proper assessments and the ORSA report with its discussion. |
| Pillar 3 — Transparency | Public disclosure and supervisory reporting: periodic information on solvency and financial condition. | Reports published and submitted on time, with consistency between what is disclosed, what is reported and what is managed. |
We review your three pillars through a supervisor’s eyes: governance, key functions, ORSA, outsourcing and reporting. We leave you with a prioritized plan to bring you into line and, if you are a small and non-complex company, the strategy to take advantage of the proportionality in the review.
Solvency II is Directive 2009/138/EC, the European prudential framework for insurance and reinsurance undertakings. It replaced a system of rigid margins with one based on risk: the capital required depends on each company’s actual profile.
It applies, in general, to insurers and reinsurers in the EU, with exclusions and proportionality provisions for smaller companies under the applicable rules.
The classic architecture of the framework:
The three are read together: ample capital does not make up for broken governance, and vice versa.
In general terms, the SCR (Solvency Capital Requirement) is the level of capital calibrated to absorb significant losses given the company’s risk profile: it is the ordinary solvency benchmark. The MCR (Minimum Capital Requirement) is the floor below which the situation is considered unacceptable and triggers the most severe supervisory response.
Between the two there is a ladder of intervention: breaching the SCR opens a recovery process; approaching the MCR puts the authorization itself at risk. We cover the legal reading of that ladder in regulatory capital.
Solvency II requires four functions within the system of governance: risk management, actuarial, compliance and internal audit.
Each one is expected to have operational independence, sufficient resources, direct access to the management body and holders who pass the fit and proper assessment (competence and good repute). Internal audit, in addition, must remain separate from the functions it reviews; we cover this in internal audit and in fit and proper assessment of directors.
The ORSA (Own Risk and Solvency Assessment) is the exercise in which the company itself assesses, looking forward, whether its solvency supports its strategy: which risks it takes on, how much capital it needs according to its own analysis and what would happen in adverse scenarios.
It matters because it is where Pillar 1 and Pillar 2 meet: if the ORSA does not influence the board’s decisions, the supervisor will conclude that the system of governance is formal, not real. The best ORSA is the one that makes the strategy a little uncomfortable.
Outsourcing key or critical functions is permitted under the applicable rules, but on demanding conditions: responsibility stays with the company, the contract must guarantee access, information and audit, the provider must be fit and proper, and the supervisor must be able to exercise its powers without obstacles.
For mid-sized companies it is a reasonable proportionality lever; badly executed, it is a guaranteed finding. We have a dedicated page on the outsourcing of critical functions.
The Solvency II review was published in early 2025, with application expected in 2027. Among its lines, the strengthening of proportionality stands out: more tailored treatment for what the text calls “small and non-complex undertakings”, together with adjustments in other areas of the framework.
The prudent recommendation: do not wait until 2027. Companies that aspire to the proportionate regime should assess now whether they will meet the criteria and which simplifications it would suit them to activate, because the classification will have to be applied for and sustained with data.
They are complementary layers on the same company. Solvency II governs prudential soundness and the system of governance; the IDD regulates conduct in the distribution of products; and DORA, applicable since January 2025, adds digital operational resilience: a register of information on ICT providers and mandatory contractual clauses, among other things.
The usual mistake is to manage them in silos. Product governance, technology outsourcing and capital constantly overlap; start with the full map in insurance distribution under the IDD and DORA services.
The supervisor does not assess intentions: it assesses system, people and paper. This is the sequence we use to organize the three pillars.
We test capital and provisions (in their governance dimension), the system of governance, key functions, ORSA, outsourcing and reporting against what the Directive and the supervisor expect. The gaps come out, with their priority.
Written policies someone can actually follow, key functions with a mandate, resources and a direct line to the board, up-to-date fit and proper assessments and outsourcing contracts with effective oversight.
A well-oiled annual cycle: ORSA with real discussion at the board, reporting on time, follow-up of findings and an analysis of whether the company can opt for the strengthened proportionality of the Solvency II review.
Two Pillar 2 items deserve a page of their own: fit and proper assessment of directors and outsourcing of critical functions.
Nine terms that dominate any conversation with the insurance supervisor. Understanding them well is half of Pillar 2.
The European prudential regime for insurers and reinsurers: risk-based capital, system of governance and transparency.
The level of capital calibrated to the company’s risk profile to absorb significant losses. It is the ordinary yardstick of solvency.
The absolute capital floor: below it, the supervisory response is at its maximum and the authorization is called into question.
The eligible resources to cover the SCR and MCR, classified by quality and capacity to absorb losses.
Management body, written policies, risk management, internal control and key functions, proportionate to the nature and complexity of the business.
Risk management, actuarial, compliance and internal audit: independent, resourced and with direct access to the board.
The forward-looking exercise in which the company asks itself whether its capital supports its strategy, including adverse scenarios.
Public information on solvency and financial condition plus periodic reporting to the supervisor, consistent with each other.
A principle that tailors the requirements to the company’s profile; the Solvency II review strengthens it for small and non-complex undertakings.
A board that understands the business and its risks, approves the policies and effectively oversees the system of governance.
Minutes showing real deliberation, a calendar of mandatory items and documented director training.
Risk management, actuarial, compliance and internal audit that are operational, independent and listened to.
Approved mandates, periodic reports to the board and a documented response to its recommendations.
Own forward-looking assessment, with adverse scenarios, connected to strategy and capital.
ORSA report, minutes of its discussion at the board and traceable decisions arising from the exercise.
Critical functions outsourced only with robust contracts, ongoing oversight and retained responsibility.
Inventory of arrangements, access and audit clauses, provider monitoring reports.
Timely, high-quality information to the supervisor and the market, consistent with internal management.
Reports submitted on time, data quality controls and reconciliation with management information.
Five symptoms that anticipate findings. If you tick two or more, a governance review is advisable this year.
Solvency II is the prudential chassis, but the company also answers for its conduct in distribution, its technological resilience and the quality of its corporate governance. These pages complete the overall view that a board should have in front of it.
Distributor types, training, IPID and product governance: the sales framework that sits alongside your prudential soundness.
If you manufacture insurance with an investment component, the strengthened distribution regime is as much yours as the channel’s.
The common logic of capital in financial institutions: requirements, quality of resources and intervention ladders.
Digital operational resilience since January 2025: ICT providers, mandatory clauses and incident management.
Within Pillar 2, go deeper into fit and proper assessment of directors, internal audit, the three lines of defense and the outsourcing of critical functions.
Tell us what kind of insurer you are (lines of business, size, group) and what worries you: capital, key functions, ORSA or the 2027 review.
Directive 2009/138/EC (Solvency II) is the prudential framework for European insurance and reinsurance undertakings. Its central idea: solvency is not measured with fixed rules but according to the risk that each company takes on, and it does not rest on capital alone but on a tripod (quantitative requirements, system of governance and transparency) that the supervisor assesses as a whole. For an insurer’s board, Solvency II is not an actuarial matter that can be delegated: it is the legal description of how the company must be governed and of what it must be able to demonstrate at any time.
The quantitative pillar governs the valuation of assets and liabilities, technical provisions and two capital benchmarks. In general terms, the SCR is the capital calibrated to absorb significant losses given the risk profile, and the MCR is the minimum below which the supervisory response is at its maximum. Between the two runs a ladder of escalating intervention: the capital position is not just a number, it is a legal regime of consequences. The quality of own funds (not every resource covers equally) completes the picture. We cover the governance dimension of these requirements in regulatory capital.
The supervisable heart of the framework. The company must demonstrate an effective system of governance: a competent management body, written policies that are applied, ongoing assessment of the fit and proper status of directors and four operational key functions (risk management, actuarial, compliance and internal audit) with independence, resources and direct access to the board. The integrating piece is the ORSA: the internal, forward-looking assessment of risks and solvency that must feed real strategy and capital decisions. Outsourcing of critical functions is possible, but with retained responsibility and demonstrable oversight.
The third leg requires the company to tell the outside world what it manages inside: public disclosure on solvency and financial condition and periodic reporting to the supervisor, with enforceable deadlines and data quality. The practical standard is consistency: what is disclosed, what is reported and what the board and the key functions work with must tell the same story. Discrepancies among those three are the most frequent finding and the most avoidable, because they are fixed with process: owners, a calendar and quality controls before each submission.
The Solvency II review was published in early 2025 with application expected in 2027. Among its axes, it strengthens proportionality for small and non-complex undertakings, which will be able to access treatment better suited to their profile on the terms set by the revised framework. The operational reading, prudently: candidate companies should get ahead of the analysis of the criteria and prepare the evidence, and all should review what changes in their governance and reporting before the date. An insurer is best placed arriving in 2027 with Pillar 2 well run in and with its conduct framework (distribution under the IDD) aligned with the prudential one.
Key legislation, linked to the official text:
Legislation and links reviewed in .