WHITE MOUNTAINS INSURANCE GROUP LTD

United States

Insurance Regulation

BAM is subject to regulation and supervision in New York and each of the states where it is licensed to conduct business. Generally, state regulatory authorities have broad supervisory and administrative powers over such matters as licenses, standards of solvency, premium rates, policy forms, investments, statutory deposits, methods of accounting, form and content of financial statements, claims reserves and LAE liabilities, reinsurance, minimum capital and surplus requirements, dividends and other distributions to shareholders, annual and other report filings and other market conduct. In general, such regulation is for the protection of policyholders rather than shareholders. White Mountains believes that BAM is in compliance with all applicable laws and regulations pertaining to its business that would have a material effect on its financial condition and results of operations in the event of non-compliance.

Bamboo is licensed in all 50 states as an insurance producer and is registered as a managing general agent in California. White Mountains believes that Bamboo is in compliance with all applicable laws and regulations pertaining to its business that would have a material effect on its financial condition or results of operations in the event of non-compliance.

State Accreditation and Monitoring

State insurance laws and regulations include numerous provisions governing marketplace activities of insurers, including provisions governing marketing and sales practices, policyholder services, claims management and complaint handling. State regulatory authorities generally test and enforce these provisions through periodic market conduct examinations. The NYDFS conducts periodic examinations of insurance companies domiciled in New York, usually at five-year intervals. In 2019, the NYDFS commenced and in early 2020 completed its examination of BAM and issued a Report on Examination of BAM for the period ending December 31, 2018. The report did not note any significant regulatory issues concerning BAM.

Risk Limits

New York Insurance Law establishes single and aggregate risk limits for financial guaranty insurers. Single risk limits for financial guaranty insurers are applicable to all obligations issued by a single entity and backed by a single revenue source. Insurance on municipal obligations is subject to a limit where the insured average annual debt service for a single risk, net of qualifying reinsurance and collateral, may not exceed 10% of policyholders' surplus and contingency reserves. In addition, the insured principal of municipal obligations attributable to any single risk, net of qualifying reinsurance and collateral, is limited to 75% of policyholders' surplus and contingency reserves.

New York Insurance Law also establishes aggregate risk limits on the basis of total outstanding principal and interest of guaranteed obligations insured net of qualifying reinsurance and collateral (the “Aggregate Net Liability”), compared to the sum of the insurer’s policyholders’ surplus and contingency reserves. Under these limits, policyholders' surplus and contingency reserves for municipal obligations must not be less than 0.33% of the Aggregate Net Liability. If a financial guaranty insurer fails to comply with single or aggregate risk limits, the NYDFS has broad discretion to order the insurer to cease new business originations. As of December 31, 2023, BAM was in compliance with the single and aggregate risk limits.

Distributions

No payment of principal or interest on the BAM Surplus Notes may be made without the approval of the NYDFS.

Contingency Reserves

New York Insurance Law and the insurance laws of other non-domiciliary states in which BAM is licensed require BAM to maintain a contingency reserve. The contingency reserve is established to protect policyholders against the effect of adverse economic developments or other unforeseen circumstances. BAM records a contingency reserve in accordance with New York Insurance Law and calculates and monitors contingency reserves required by other non-domiciliary states in which it is licensed.

The NYDFS’s cybersecurity regulation (“Part 500”) requires financial services institutions, including BAM, to establish and maintain a cybersecurity program designed to protect consumers’ private data and the confidentiality, integrity and availability of the institution’s information systems.

Investments

BAM is subject to state laws and regulations that require investment portfolio diversification and that dictate the quality, quantity and general types of investments it may hold. Non-compliance may cause non-conforming investments to be non-admitted when measuring statutory surplus and, in some instances, may require divestiture.

Holding Company Structure

Regulations under certain state insurance holding company acts contain reporting requirements relating to the capital structure, ownership, financial condition and general business operations of insurance entities. These regulations also contain special reporting and prior approval requirements with respect to certain transactions among affiliates. Although BAM has no ownership relationship with HG Re or HG Global, BAM agreed with the NYDFS to submit any agreements, or amendments thereto, among BAM and HG Re, HG Global and their affiliated entities or controlling persons to the NYDFS as if they were subject to Article 15 of the New York Insurance Law, which relates to transactions with holding companies.

Federal Regulation

Although the federal government does not directly regulate insurance businesses, federal legislation and administrative policies impact the industry. In addition, legislation has been introduced that, if enacted, could result in the federal government assuming a more direct role in the regulation of the insurance industry. Notably, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) created the Federal Insurance Office (“FIO”) within the Treasury Department, which is responsible for gathering information and monitoring the insurance industry to identify gaps in the regulation of insurers that could contribute to a systemic crisis in the insurance industry or U.S. financial system.

Investment Regulation

Kudu Investment Holdings, LLC, a subsidiary of Kudu, is an investment adviser that is registered with the SEC under Section 203 of the United States Investment Advisers Act of 1940.

Bermuda

Insurance Regulation

The Insurance Act 1978 of Bermuda and related regulations, as amended (the “Insurance Act”), regulates the insurance

business of HG Re, a special purpose insurer, GAIL, Ark’s wholly-owned Class 4 insurance and reinsurance company, Outrigger Re Ltd., a special purpose insurer, and Bamboo Captive, Bamboo’s wholly-owned Class 2 captive insurer. Outrigger Re Ltd. is also registered as a segregated accounts company under the Bermuda Segregated Accounts Companies Act 2000, as amended (the “SAC Act”). The Insurance Act provides that no person may carry on any insurance business in or from within Bermuda unless registered as an insurer under the Insurance Act by the Bermuda Monetary Authority (“BMA”). The BMA, in deciding whether to grant registration, has broad discretion to act as it thinks fit in the public interest. From time to time, HG Re, GAIL and Outrigger Re Ltd. may apply for, and be granted, certain modifications to, or exemptions from, regulatory requirements, which may otherwise apply to them.

The Insurance Act imposes solvency and liquidity standards as well as auditing and reporting requirements and confers on the BMA powers to supervise, investigate and intervene in the affairs of insurance companies. The SAC Act stipulates its own solvency test for the declaration of dividends and distributions for segregated accounts, which takes into account the solvency of each segregated account individually, rather than the solvency of the company itself.

Classification

GAIL is registered as a Class 4 insurer. Class 4 insurers carry on general insurance business including excess liability business or property catastrophe, marine & energy, casualty and specialty reinsurance business and have a total statutory capital and surplus of not less than $100 million.

As special purpose insurers, HG Re and Outrigger Re Ltd. are insurers that carry on special purpose business. Special purpose business under the Insurance Act is insurance business under which an insurer fully collateralizes its liabilities to the insured persons through (i) the proceeds of any one or more of (a) a debt issuance where the repayment rights of the providers of such debt are subordinated to the rights of the person insured, or (b) some other financing mechanism approved by the BMA; (ii) cash; and (iii) time deposits. Special purpose insurers may be registered to carry on either restricted special purpose business or unrestricted special purpose business. Restricted special purpose business is special purpose business conducted between a special purpose insurer and specific insureds approved by the BMA. Unrestricted special purpose business means special purpose business conducted by a special purpose insurer with any insured. Both HG Re and Outrigger Re Ltd. are only able to carry on restricted purpose business.

Capital and Solvency Return

As a Class 4 insurer, GAIL is required to file, on an annual basis, a capital and solvency return in respect of its general business, which currently includes, among other items, a statutory economic balance sheet, a schedule of risk management, a catastrophe risk return, a schedule of loss triangles or reconciliation of net loss reserves (where applicable), a schedule of eligible capital and the Enhanced Capital Requirement (“ECR”) as calculated by the Bermuda Solvency and Capital Requirement (“BSCR”) model (or an approved internal model). The BSCR is a mathematical model designed to give the BMA robust methods for determining an insurer’s capital adequacy. Underlying the BSCR is the belief that all insurers should operate on an ongoing basis with a view to maintaining their capital at a prudent level in excess of the minimum solvency margin otherwise prescribed under the Insurance Act. The 2023 BSCR must be filed with the BMA before April 30, 2024; at this time, we believe GAIL will exceed the minimum amount required to be maintained under Bermuda law.

As special purpose insurers, HG Re and Outrigger Re Ltd. are also required to file annually with the BMA a statutory return which includes, among other matters, the statutory financial statements, a statement of control and changes of control, a solvency certificate, an annual statutory declaration, an own-risk assessment, alternative capital arrangements report, cyber risk management report and compliance with sanctions report.

Financial Condition Report

As a Class 4 insurer, GAIL is required to prepare and publish a financial condition report (“FCR”), which provides, among other things, details of measures governing the business operations, corporate governance framework and solvency and financial performance of the insurer/insurance group. The FCR will be made available in accordance with the requirements of the Insurance Act.

Minimum Solvency Margin

As a general business insurer, GAIL is required to maintain statutory assets in excess of its statutory liabilities by an amount, equal to or greater than the prescribed minimum solvency margin. The minimum solvency margin that must be maintained by a Class 4 insurer is the greater of (i) $100 million, (ii) 50% of net premiums written (with a credit for reinsurance ceded not exceeding 25% of gross premiums), (iii) 15% of net aggregate loss and loss expense provisions and other insurance reserves, or (iv) 25% of the ECR, which is established by reference to the BSCR model.

As special purpose insurers, HG Re and Outrigger Re Ltd. must maintain a minimum solvency margin whereby their special purpose business assets must exceed their special purpose business liabilities by at least $1.

Enhanced Capital Requirement

As a Class 4 insurer, GAIL is required to maintain its available statutory economic capital and surplus at a level at least equal to its ECR. In either case, the ECR shall at all times equal or exceed the insurer’s minimum solvency margin and may be adjusted in circumstances where the BMA concludes that the insurer’s risk profile deviates significantly from the assumptions underlying its ECR or the insurer’s assessment of its risk management policies and practices used to calculate the ECR applicable to it. While not specifically referred to in the Insurance Act, the BMA has also established a target capital level for each Class 4 insurer equal to 120% of the respective ECR. While a Class 4 insurer is not currently required to maintain its statutory economic capital and surplus at this level, the target capital level serves as an early warning tool for the BMA and failure to maintain statutory capital at least equal to the target capital level will likely result in increased BMA regulatory oversight.

Minimum Liquidity Ratio

The Insurance Act provides a minimum liquidity ratio for general business insurers such as GAIL. An insurer engaged in general business is required to maintain the value of its relevant assets at not less than 75% of the amount of its relevant liabilities. Relevant assets include, but are not limited to, cash and time deposits, quoted investments, unquoted bonds and debentures, investment income due and accrued, accounts and premiums receivable, insurance and reinsurance balances receivable and funds held by ceding reinsurers. Relevant liabilities include, but are not limited to, general business insurance reserves and total other liabilities less deferred income tax and sundry liabilities, letters of credit and guarantees.

Eligible Capital

As a Class 4 insurer, GAIL must maintain available capital in accordance with a “three-tiered capital system” to enable the BMA to better assess the quality of an insurer’s capital resources. All capital instruments are classified as either basic or ancillary capital, which in turn are classified into one of three tiers (Tier 1, Tier 2 and Tier 3) based on their “loss absorbency” characteristics. Eligibility limits are then applied to each tier in determining the amounts eligible to cover regulatory capital requirement levels. The highest capital is classified as Tier 1 capital and lesser quality capital is classified as either Tier 2 capital or Tier 3 capital. Under this regime, not more than certain specified percentages of Tier 1, Tier 2 and Tier 3 capital may be used to satisfy the Class 4 insurers' minimum solvency margin, ECR requirements and target capital level.

Restrictions on Dividends, Distributions and Reductions of Capital

As a Class 4 insurer, GAIL is prohibited from declaring or paying any dividends if in breach of the required minimum solvency margin or minimum liquidity ratio (the “Relevant Margins”) or if the declaration or payment of such dividend would cause the insurer to fail to meet the Relevant Margins. Further, Class 4 insurers are prohibited from declaring or paying in any financial year dividends of more than 25% of its total statutory capital and surplus (as shown on its previous financial year’s statutory balance sheet) unless it files (at least seven days before payment of such dividends) with the BMA an affidavit stating that it will continue to meet its Relevant Margins. Class 4 insurers must obtain the BMA’s prior approval for a reduction by 15% or more of the total statutory capital as set forth in its previous year’s financial statements. These restrictions on declaring or paying dividends and distributions under the Insurance Act are in addition to the solvency requirements under the Companies Act 1981 of Bermuda, as amended (the “Companies Act”). See“LIQUIDITY AND CAPITAL RESOURCES — Dividend Capacity” on page 67 for further discussion.

As special purpose insurers, HG Re and Outrigger Re Ltd. are not required to obtain the BMA’s prior approval in connection with any reduction of total statutory capital, but are prohibited from declaring or paying a dividend if they are in breach of their minimum solvency margin or if the declaration or payment of such dividend would cause such a breach. As a segregated account, the solvency test for the declaration of dividends and distributions is evaluated based upon the solvency of WM Outrigger Re, rather than the solvency of Outrigger Re Ltd.

Insurance Code of Conduct and Insurance Sector Operational Cyber Risk Management Code of Conduct

All Bermuda insurers are required to comply with the BMA’s Insurance Code of Conduct, which establishes duties, requirements and standards to be complied with to ensure each insurer implements sound corporate governance, risk management and internal controls. Failure to comply with these requirements will be a factor taken into account by the BMA in determining whether an insurer is conducting its business in a sound and prudent manner under the Insurance Act and, in the case of GAIL, in calculating the operational risk charge applicable in accordance with the insurer's BSCR model (or an approved internal model).

All Bermuda insurers are also required to comply with the BMA’s Insurance Sector Operational Cyber Risk Management Code of Conduct, which establishes duties, requirements and standards to be complied with by each insurer in relation to operational cyber risk management.

Powers of Investigation, Intervention and Obtaining Information

The BMA has certain powers of investigation and intervention relating to insurers and their holding companies, subsidiaries and other affiliates, which it may exercise in the interest of such insurer’s policyholders or if there is any risk of insolvency or of a breach of the Insurance Act or the insurer’s license conditions. The BMA may cancel an insurer’s registration on certain grounds specified in the Insurance Act.

Notification of Cyber Reporting Events

Every insurer subject to the Insurance Act is required to notify the BMA where the insurer has reason to believe that a Cyber Reporting Event has occurred. Within 14 days of such notification, the insurer must also furnish the BMA with a written report setting out all of the particulars of the Cyber Reporting Event that are available to it. A Cyber Reporting Event includes any act that results in the unauthorized access to, disruption, or misuse of electronic systems or information stored on such systems of an insurer, including breach of security leading to the loss or unlawful destruction or unauthorized disclosure of or access to such systems or information where there is a likelihood of an adverse impact to policyholders, clients or the insurer’s insurance business, or a similar event for which notice is required to be provided to a regulatory body or government agency.

Policyholder Priority

In the event of a liquidation or winding up of an insurer, policyholders’ liabilities receive payment ahead of general unsecured creditors. Subject to the prior payment of preferential debts under the Employment Act 2000 and the Companies Act, the insurance debts of an insurer must be paid in priority to all other unsecured debts of the insurer.

Certain Other Bermuda Law Considerations

The Company is an exempted company incorporated and organized under the Companies Act. As a result, the Company is required to comply with the provisions of the Companies Act regulating the payment of dividends and making of distributions from contributed surplus. A company is prohibited from declaring or paying a dividend, or making a distribution out of contributed surplus, if there are reasonable grounds for believing that:

(1) the company is, or would after the payment be, unable to pay its liabilities as they become due; or

(2) the realizable value of the company’s assets would thereby be less than its liabilities.

In addition, the Companies Act regulates return of capital, reduction of capital and any purchase or redemption of shares by the Company.

The Economic Substance Act 2018, as amended (“ESA”) impacts every Bermuda registered entity engaged in a “relevant activity,” requiring impacted entities to maintain a substantial economic presence in Bermuda and to satisfy economic substance requirements. Under the ESA, insurance or holding entity activities (both as defined in the ESA and the Economic Substance Regulations 2018, as amended) are relevant activities. To the extent that the ESA applies to any of our Bermuda entities, we are required to demonstrate compliance with economic substance requirements by filing an annual economic substance declaration with the Bermuda Registrar of Companies. Any entity that must satisfy economic substance requirements but fails to do so could face automatic disclosure to competent authorities in the EU of the information filed by the entity with the Bermuda Registrar of Companies in connection with the economic substance requirements. Additionally, a company may also face penalties, restriction or regulation of its business activities and may be struck off as a registered entity in Bermuda for failure to satisfy economic substance requirements. The Company believes it complies with all of the applicable laws and regulations pertaining to economic substance that would have a material effect on its financial condition and results of operations in the event of non-compliance.

United Kingdom

PRA and FCA Regulation

As an insurer in the United Kingdom, Ark is dual-regulated by the Financial Conduct Authority (the “FCA”) and the Prudential Regulation Authority (the “PRA”) (collectively, the “U.K. Regulators”). The PRA currently has ultimate responsibility for the prudential supervision of financial services in the U.K. The FCA has responsibility for market conduct regulation. The U.K. Regulators regulate insurers, insurance intermediaries and Lloyd’s. Both the PRA and FCA have substantial powers of intervention in relation to regulated firms.

Lloyd’s Regulation

Lloyd’s as a whole is authorized by the PRA and regulated by both the FCA and the PRA. Lloyd’s is required to implement certain rules prescribed by the PRA and by the FCA; such rules are to be implemented by Lloyd’s pursuant to its powers under the Lloyd’s Act 1982 relating to the operation of the Lloyd’s market. Lloyd’s prescribes, in respect of its managing agents and corporate and individual members (“Members”), certain minimum standards relating to their management and control, solvency and various other requirements. If it appears to either the PRA or the FCA that either Lloyd’s is not fulfilling its delegated regulatory responsibilities or that managing agents are not complying with the applicable regulatory rules and guidance, the PRA or the FCA may intervene at their discretion.

Lloyd’s permits its Members to underwrite insurance risks through Lloyd’s syndicates. Members of Lloyd’s may participate in a syndicate for one or more underwriting year(s) by providing capital to support the syndicate’s underwriting. All syndicates are managed by Lloyd’s approved managing agents. Managing agents receive fees and profit commissions in respect of the underwriting and administrative services they provide to the syndicates. Lloyd’s prescribes, in respect of its managing agents and Members, certain minimum standards relating to their management and control, solvency and various other requirements.

General

The operations of ASML, Ark’s wholly-owned Lloyd’s managing agent, are subject to oversight by Lloyd’s, through the Lloyd’s Council. ASML’s business plan for the Syndicates, including maximum stamp capacity, requires annual approval by Lloyd’s. Stamp capacity is a measure of the amount of net premium (premiums written less acquisition costs) that a syndicate is authorized by Lloyd’s to write. Lloyd’s may require changes to any business plan presented to it or additional capital to be provided to support the underwriting plan. Lloyd’s approved stamp capacity in 2024 for Syndicate 4020 is £525 million ($667 million based upon the foreign exchange spot rate as of December 31, 2023), and for Syndicate 3902 is £250 million ($318 million based upon the foreign exchange spot rate as of December 31, 2023). Both Syndicate 4020 and 3902 are supported by capital provided through ACML, Ark’s wholly-owned Lloyd’s Corporate Member.

Ark has deposited certain assets with Lloyd’s to support ACML’s underwriting business at Lloyd’s. Dividends from a Lloyd’s managing agent or a Member of Lloyd’s can be declared and paid provided the relevant syndicate has sufficient profits available for distribution subject to Lloyd’s solvency requirements. By entering into a membership agreement with Lloyd’s, ACML has undertaken to comply with all Lloyd’s bye-laws and regulations as well as the provisions of the Lloyd’s Acts and the Financial Services and Markets Act 2000, as amended by the Financial Services Act 2012.

Capital Requirements

The underwriting capacity of a Member of Lloyd’s must be supported by a deposit in the form of cash, securities or letters of credit in an amount determined under the capital adequacy regime of the U.K.’s PRA. The amount of such deposit is calculated for each Member through the completion of an annual capital adequacy exercise. Under these requirements, Lloyd’s must demonstrate that each Member has sufficient assets to meet its underwriting liabilities plus a required solvency margin. The required amount of Funds at Lloyd’s is determined by Lloyd’s based on each syndicate’s solvency and capital requirement as calculated through its internal model.

Intervention Powers

The Lloyd’s Council has wide discretionary powers to regulate Members’ underwriting at Lloyd’s. It may, for instance, withdraw a Member’s permission to underwrite business or to underwrite a particular class of business. The Lloyd’s Council may change the basis on which syndicate expenses are allocated or vary the Funds at Lloyd’s requirements or the investment criteria applicable to the provision of Funds at Lloyd’s. Exercising any of these powers might affect the return on the Member’s participation in a given underwriting year. If a Member of Lloyd’s is unable to pay its debts to policyholders, the Member may obtain financial assistance from the Lloyd’s Central Fund, which in many respects acts as an equivalent to a state guaranty fund in the U.S. If Lloyd’s determines that the Central Fund needs to be increased, it has the power to assess premium levies on current Members of Lloyd’s. The Lloyd’s Council has discretion to call or assess up to 3% of a Member’s underwriting capacity in any one year as a Central Fund contribution.

While not currently material to our operations, Syndicates 4020 and 3902 also access insurance business from the European Economic Area though the London Branch of Lloyd’s Insurance Company. Lloyd’s Insurance Company is authorized and regulated by the National Bank of Belgium and regulated by the Financial Services and Markets Authority.

Solvency II and the U.K.’s Domestic Prudential Regime

The European Parliament’s Solvency II regulation represents a risk-based approach to insurance regulation and capital adequacy. Its principal goals are to improve the correlation between capital and risk, effect group supervision of insurance and reinsurance affiliates, implement a uniform capital adequacy structure for (re)insurers across the EU Member States, establish consistent corporate governance standards for insurance and reinsurance companies, and establish transparency through standard reporting of insurance operations. Under Solvency II, an insurer’s or reinsurer’s capital adequacy in relation to various insurance and business risks may be measured with an internal model developed by the insurer or reinsurer and approved for use by the Member State’s regulator or pursuant to a standard formula developed by the European Commission. Following the U.K.'s exit from the EU, and the expiry of the transition period on December 31, 2020, U.K. authorized insurers are subject to the U.K.'s separate domestic prudential regime. This regime was identical to the Solvency II regime from January 1, 2021, although the PRA has made proposals that may cause the two regimes to diverge.

Each year, the PRA requires Lloyd’s to satisfy an annual solvency test which measures whether Lloyd’s has sufficient assets in the aggregate to meet all outstanding liabilities of its Members, both current and runoff. If Lloyd’s fails this test, the PRA may require the entire Lloyd’s market to cease underwriting or individual Lloyd’s Members may be required to cease or reduce their underwriting.

The EU General Data Privacy Regulation (the “GDPR”) requires companies to satisfy requirements regarding the notification of data breaches and the handling of personal and sensitive data, including its use, protection and the ability of persons whose data is stored to correct or delete such data about themselves. The GDPR permits regulators to impose fines of up to €20 million or 4% of global annual revenue, whichever is higher, and establishes a private right of action.

The GDPR was transposed into U.K. domestic law in January 2021 following the U.K.'s exit from the EU (“U.K. GDPR”) and supplements the United Kingdom's Data Protection Act of 2018. The U.K. GDPR generally tracks the compliance requirements and fine structure of the GDPR.

Climate Change

In response to PRA climate change risk management guidelines, Ark has established a climate change working group and has undertaken a climate change risk assessment. The risk assessment highlighted regulatory, claims, underwriting and investment risks associated with climate change. Ark regularly analyzes climate change risk as part of its risk management framework. Ark also engages with industry peers through the Lloyd’s Climate Change market group. Ark has assigned its Chief Risk Officer responsibility under the PRA Senior Insurance Managers Regime for climate change risk. The Chief Risk Officer reports to the Ark Board on climate change matters on a quarterly basis.

General

We are subject to various state, federal and international laws and regulations that address the collection, storing, use, disclosure, security, privacy, transfer and other processing of personal information and other data, including SEC rules, Part 500, GDPR, the California Consumer Privacy Act, and the California Privacy Rights Act, among others.

Change of Control

The jurisdictions where we operate have laws and regulations that require regulatory approval of a change of control. Where such laws apply to us, there can be no effective change in our control (or in the control of some or our subsidiaries) unless the person seeking to acquire control has filed a statement with the regulators and obtained prior approval for the proposed change.