Malta Regulator Calls for Stronger Risk Oversight After Insurance Sector Review

Key Takeaways

• Risk Management Weaknesses Identified: The Malta Financial Services Authority found areas requiring improvement in insurers’ risk assessment procedures, operational incident management, and business continuity planning.
• Strong Solvency II Alignment: Self-assessments indicated broad alignment with Solvency II requirements, although onsite inspections identified shortcomings in the implementation of certain risk management arrangements.
• Good Practices Recognized: Supervisors highlighted the integration of Own Risk and Solvency Assessments into strategic decisions, effective oversight of outsourced risk management functions, and the use of risk registers and key risk indicators.
• Greater Emphasis on Independent Oversight: The MFSA expects Risk Management Functions to have sufficient authority, independence, information access, and resources to challenge business decisions and escalate concerns.
• Further Supervisory Monitoring: Insurers and reinsurers are expected to review their risk management arrangements, address identified gaps, and demonstrate improvements through ongoing supervisory engagement.

Deep Dive

The Malta Financial Services Authority (MFSA) has directed insurance and reinsurance companies to review their risk management arrangements after supervisory inspections uncovered weaknesses in risk assessment procedures, operational incident management, and business continuity planning.

The findings, published on October 14, emerged from a review conducted under the regulator's 2025 supervisory priorities. The exercise examined the effectiveness of Risk Management Functions (RMFs) across the sector, including whether those functions had the independence and authority needed to challenge business decisions.

The review began with a self-assessment questionnaire that produced broadly encouraging results. Participating firms reported strong alignment with the European Union's Solvency II requirements, supported by established governance frameworks, board oversight, and documented policies and procedures.

Onsite inspections gave the regulator a closer look at how those arrangements worked in practice. Inspectors found examples of sound risk management, but also identified processes that needed further attention.

The MFSA has now asked undertakings to examine their own arrangements against the findings and supervisory expectations detailed in a letter to chief executives, identify shortcomings, and make the necessary improvements.

What Inspectors Found

Some of the strongest practices identified during the review concerned the role of risk management in business decisions. The MFSA found examples of companies incorporating their Own Risk and Solvency Assessments (ORSAs) into strategic planning rather than treating the exercise solely as a regulatory obligation. Inspectors also noted effective oversight of outsourced risk management functions, the use of risk registers and key risk indicators, and the application of risk appetite considerations to day-to-day operations.

Inspectors identified a need for greater formalization of risk identification and assessment processes, along with improvements in the management of operational risk incidents. The authority also called attention to risk management policies that needed to be better tailored to individual undertakings and weaknesses in the preparation of risk management workplans.

Business continuity and succession planning were among the other areas identified for improvement.

The findings concern several of the basic responsibilities of a risk management function. A company may have policies describing how risks should be identified and assessed, but supervisors also need to establish whether those procedures are sufficiently developed and consistently applied. The same scrutiny applies to incident management, where the effectiveness of an arrangement depends on what happens when a problem is identified.

The MFSA did not suggest that the shortcomings were universal or that the sector was broadly failing to comply with Solvency II. Its announcement acknowledged the generally strong alignment reported through the self-assessment process and the good practices observed during inspections.

The authority nevertheless found enough room for improvement to issue supervisory expectations for undertakings across the sector.

Authority and Independence Under Scrutiny

One of the clearest messages from the review concerns the standing of the Risk Management Function within an organization. The MFSA expects the function to operate as an effective second line of defence, with sufficient authority, independence, access to information, and resources to challenge business decisions and raise concerns when necessary.

Those requirements have practical consequences for how insurers organize their governance arrangements. A risk management function must be able to examine exposures arising from business activities and communicate concerns without being constrained by the operations it is responsible for overseeing.

The authority's expectations also apply to firms that outsource the function. Oversight of outsourced RMFs was among the good practices identified during the review, underscoring the continuing importance of governance arrangements when risk management responsibilities are performed externally.

Ray Schembri, the MFSA's Head of Insurance and Pensions Supervision, said the review had demonstrated both the progress made by undertakings and the need for further improvements.

“An effective Risk Management Function is fundamental to sound governance and the resilience of insurance undertakings,” Schembri said.

He added that firms should ensure their risk management functions have the authority, independence, and resources required to fulfill their responsibilities as a second line of defence.

Firms Expected to Assess Their Own Arrangements

The MFSA has instructed undertakings to review their Risk Management Systems and Risk Management Functions against the findings and expectations contained in its Dear CEO Letter. Companies are expected to identify gaps and take appropriate corrective action, with the extent of those measures determined by the nature, scale, and complexity of their operations and risk profiles.

The principle of proportionality is particularly relevant in a sector comprising undertakings with different business models, organizational structures, and exposures. The MFSA has not prescribed an identical risk management framework for every firm. It expects each undertaking to demonstrate that its arrangements are appropriate to the risks it faces.

For boards and senior management, the findings provide several areas for examination, from the adequacy of risk assessment procedures and operational incident reporting to the resources available to the Risk Management Function. The authority's emphasis on independence and the ability to challenge decisions also raises questions about how effectively risk management concerns reach those responsible for directing the business.

The MFSA said it would continue monitoring developments through its regular supervisory activities and follow-up engagements.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey