WHITE MOUNTAINS INSURANCE GROUP LTD

United States

Insurance Regulation

Bamboo is licensed in all 50 states as an insurance producer and is registered as an MGA in California. The distribution of insurance products is a heavily regulated industry subject to regulation and supervision by state regulatory authorities. State insurance laws are often complex and generally grant broad discretion to supervisory authorities in adopting regulations and supervising regulated activities, which generally includes the licensing of insurance brokers and agents, intermediaries and third-party administrators. Our continuing ability to distribute insurance products in the states in which we currently operate is dependent upon our compliance with the rules and regulations promulgated by the regulatory authorities in each of these states.

Bamboo Captive is a protected cell captive domiciled in the state of Arizona and is subject to regulation and supervision by the Arizona Department of Insurance and Financial Institutions (“Arizona DIFI”).

White Mountains believes that Bamboo is in compliance with all applicable laws and regulations pertaining to its business that would have a material effect on its financial condition or results of operations in the event of non-compliance.

Rate Regulations

Nearly all states have insurance laws requiring personal property and casualty insurers to file rating plans, policy or coverage forms and other information with the state’s regulatory authority. In many cases, such rating plans and/or policy or coverage forms must be approved by the regulatory authority prior to use. The speed with which an insurer can change rates in response to competition or in response to increasing costs depends, in part, on whether the rating laws are (i) prior approval, (ii) file-and-use or (iii) use-and-file laws. In states with prior approval laws, the regulator must approve a rate before the insurer may use it. In states with file-and-use laws, the insurer does not have to wait for the regulator’s approval to use a rate, but the rate must be filed with the regulatory authority prior to being used. In states with use-and-file laws, the insurer must file rates within a certain period of time after the insurer begins to use them. Under all three types of rating laws, the regulator has the authority to disapprove a rate filing. While Bamboo is not an insurer, and thus not required to file its own rating plans with the state's regulatory authority, Bamboo’s commissions are derived from a percentage of the premium rates set by its fronting carrier partners in conjunction with state law, and the sustainability of Bamboo’s business is dependent on such rates. California, which is Bamboo’s primary jurisdiction at present, is a prior approval state.

Premium Accounts Held in Trust

Bamboo maintains trust accounts in order to comply with fiduciary requirements under U.S. state insurance laws and regulations relating to premium trust accounts. Under such laws, insurance agencies that do not make immediate remittances to counterparties (such as insurance companies, clients or other producers to which premium, commissions or other amounts are due from time to time) must segregate funds owed to such counterparties, and these funds must be held in trust for the insurance company, client or other relevant third-party payee. Bamboo’s use of trust accounts is routinely subject to audits by its fronting carrier partners and other external auditors.

In 2018, California enacted the California Consumer Privacy Act (the “CCPA”), which broadly regulates the sale of California residents’ personal information and grants California residents certain rights to, among other things, access and delete data about them in certain circumstances. In November 2020, California augmented the CCPA by enacting the California Privacy Rights Act (the “CPRA”). Among other things, the CPRA grants consumers the right to correct inaccurate data about them and creates a new enforcement agency. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches. Compliance with the CCPA and the CPRA, or similar laws in other jurisdictions, may increase the cost of providing services, including those provided by Bamboo.

Investment Regulation

Kudu Investment Holdings, LLC, a subsidiary of Kudu, is an investment adviser that is registered with the SEC under Section 203 of the United States Investment Advisers Act of 1940.

Bermuda

Insurance Regulation

The Insurance Act 1978 of Bermuda and related regulations, as amended (the “Insurance Act”), regulates the insurance

business of HG Re, a special purpose insurer, GAIL, Ark’s wholly-owned Class 4 insurance and reinsurance company and Outrigger Re Ltd., a special purpose insurer. Outrigger Re Ltd. is also registered as a segregated accounts company under the Bermuda Segregated Accounts Companies Act 2000, as amended (the “SAC Act”). The Insurance Act provides that no person may carry on any insurance business in or from within Bermuda unless registered as an insurer under the Insurance Act by the Bermuda Monetary Authority (“BMA”). The BMA, in deciding whether to grant registration, has broad discretion to act as it thinks fit in the public interest. From time to time, HG Re, GAIL and Outrigger Re Ltd. may apply for, and be granted, certain modifications to, or exemptions from, regulatory requirements, which may otherwise apply to them.

The Insurance Act imposes solvency and liquidity standards as well as auditing and reporting requirements and confers on the BMA powers to supervise, investigate and intervene in the affairs of insurance companies. The SAC Act stipulates its own solvency test for the declaration of dividends and distributions for segregated accounts, which takes into account the solvency of each segregated account individually, rather than the solvency of the company itself.

Classification

GAIL is registered as a Class 4 insurer. Class 4 insurers carry on general insurance business including excess liability business or property catastrophe, marine & energy, casualty and specialty reinsurance business and have a total statutory capital and surplus of not less than $100 million.

As special purpose insurers, HG Re and Outrigger Re Ltd. are insurers that carry on special purpose business. Special purpose business under the Insurance Act is insurance business under which an insurer fully collateralizes its liabilities to the insured persons through (i) the proceeds of any one or more of (a) a debt issuance where the repayment rights of the providers of such debt are subordinated to the rights of the person insured or (b) some other financing mechanism approved by the BMA; (ii) cash; and (iii) time deposits. Special purpose insurers may be registered to carry on either restricted special purpose business or unrestricted special purpose business. Restricted special purpose business is special purpose business conducted between a special purpose insurer and specific insureds approved by the BMA. Both HG Re and Outrigger Re Ltd. are only able to carry on restricted purpose business.

Capital and Solvency Return

As a Class 4 insurer, GAIL is required to file, on an annual basis, a capital and solvency return in respect of its general business, which currently includes, among other items, a statutory economic balance sheet, a schedule of risk management, a catastrophe risk return, a schedule of loss triangles or reconciliation of net loss reserves (where applicable), a schedule of eligible capital and the Enhanced Capital Requirement (“ECR”) as calculated by the Bermuda Solvency and Capital Requirement (“BSCR”) model (or an approved internal model). The BSCR is a mathematical model designed to give the BMA robust methods for determining an insurer’s capital adequacy. Underlying the BSCR is the belief that all insurers should operate on an ongoing basis with a view to maintaining their capital at a prudent level in excess of the minimum solvency margin otherwise prescribed under the Insurance Act. The 2024 BSCR must be filed with the BMA before April 30, 2025; at this time, we believe GAIL will exceed the minimum amount required to be maintained under Bermuda law.

As special purpose insurers, HG Re and Outrigger Re Ltd. are also required to file annually with the BMA a statutory return which includes, among other matters, the statutory financial statements, a statement of control and changes of control, a solvency certificate, an annual statutory declaration, an own-risk assessment, alternative capital arrangements report, cyber risk management report and compliance with sanctions report.

Financial Condition Report

As a Class 4 insurer, GAIL is required to prepare and publish a financial condition report (“FCR”), which provides, among other things, details of measures governing the business operations, corporate governance framework and solvency and financial performance of the insurer/insurance group. The FCR will be made available in accordance with the requirements of the Insurance Act.

Minimum Solvency Margin

As a general business insurer, GAIL is required to maintain statutory assets in excess of its statutory liabilities by an amount, equal to or greater than the prescribed minimum solvency margin. The minimum solvency margin that must be maintained by a Class 4 insurer is the greater of (i) $100 million, (ii) 50% of net premiums written (with a credit for reinsurance ceded not exceeding 25% of gross premiums), (iii) 15% of net aggregate loss and loss expense provisions and other insurance reserves or (iv) 25% of the ECR, which is established by reference to the BSCR model.

As special purpose insurers, HG Re and Outrigger Re Ltd. must maintain a minimum solvency margin whereby their special purpose business assets must exceed their special purpose business liabilities by at least $1.

Enhanced Capital Requirement

As a Class 4 insurer, GAIL is required to maintain its available statutory economic capital and surplus at a level at least equal to its ECR. In either case, the ECR shall at all times equal or exceed the insurer’s minimum solvency margin and may be adjusted in circumstances where the BMA concludes that the insurer’s risk profile deviates significantly from the assumptions underlying its ECR or the insurer’s assessment of its risk management policies and practices used to calculate the ECR applicable to it. While not specifically referred to in the Insurance Act, the BMA has also established a target capital level for each Class 4 insurer equal to 120% of the respective ECR. While a Class 4 insurer is not currently required to maintain its statutory economic capital and surplus at this level, the target capital level serves as an early warning tool for the BMA and failure to maintain statutory capital at least equal to the target capital level will likely result in increased BMA regulatory oversight.

Minimum Liquidity Ratio

The Insurance Act provides a minimum liquidity ratio for general business insurers such as GAIL. An insurer engaged in general business is required to maintain the value of its relevant assets at not less than 75% of the amount of its relevant liabilities. Relevant assets include, but are not limited to, cash and time deposits, quoted investments, unquoted bonds and debentures, investment income due and accrued, accounts and premiums receivable, insurance and reinsurance balances receivable and funds held by ceding reinsurers. Relevant liabilities include, but are not limited to, general business insurance reserves and total other liabilities less deferred income tax and sundry liabilities, letters of credit and guarantees.

Eligible Capital

As a Class 4 insurer, GAIL must maintain available capital in accordance with a “three-tiered capital system” to enable the BMA to better assess the quality of an insurer’s capital resources. All capital instruments are classified as either basic or ancillary capital, which in turn are classified into one of three tiers (Tier 1, Tier 2 and Tier 3) based on their “loss absorbency” characteristics. Eligibility limits are then applied to each tier in determining the amounts eligible to cover regulatory capital requirement levels. Under this regime, not more than certain specified percentages of Tier 1, Tier 2 and Tier 3 capital may be used to satisfy the Class 4 insurers' minimum solvency margin, ECR requirements and target capital level.

Restrictions on Dividends, Distributions and Reductions of Capital

As a Class 4 insurer, GAIL is prohibited from declaring or paying any dividends if in breach of the required minimum solvency margin or minimum liquidity ratio (the “Relevant Margins”) or if the declaration or payment of such dividend would cause the insurer to fail to meet the Relevant Margins. Further, Class 4 insurers are prohibited from declaring or paying in any financial year dividends of more than 25% of its total statutory capital and surplus (as shown on its previous financial year’s statutory balance sheet) unless it files (at least seven days before payment of such dividends) with the BMA an affidavit stating that it will continue to meet its Relevant Margins. Class 4 insurers must obtain the BMA’s prior approval for a reduction by 15% or more of the total statutory capital as set forth in its previous year’s financial statements. These restrictions on declaring or paying dividends and distributions under the Insurance Act are in addition to the solvency requirements under the Companies Act 1981 of Bermuda, as amended (the “Companies Act”). See“LIQUIDITY AND CAPITAL RESOURCES — Dividend Capacity” on page 75 for further discussion.

As special purpose insurers, HG Re and Outrigger Re Ltd. are not required to obtain the BMA’s prior approval in connection with any reduction of total statutory capital, but are prohibited from declaring or paying a dividend if they are in breach of their minimum solvency margin or if the declaration or payment of such dividend would cause such a breach. As a segregated account, the solvency test for the declaration of dividends and distributions is evaluated based upon the solvency of WM Outrigger Re, rather than the solvency of Outrigger Re Ltd. as a whole.

Insurance Code of Conduct and Insurance Sector Operational Cyber Risk Management Code of Conduct

All Bermuda insurers are required to comply with the BMA’s Insurance Code of Conduct, which establishes duties, requirements and standards to be complied with to ensure each insurer implements sound corporate governance, risk management and internal controls. Failure to comply with these requirements will be a factor taken into account by the BMA in determining whether an insurer is conducting its business in a sound and prudent manner under the Insurance Act and, in the case of GAIL, in calculating the operational risk charge applicable in accordance with the insurer's BSCR model (or an approved internal model).

All Bermuda insurers are also required to comply with the BMA’s Insurance Sector Operational Cyber Risk Management Code of Conduct, which establishes duties, requirements and standards to be complied with by each insurer in relation to operational cyber risk management.

Powers of Investigation, Intervention and Obtaining Information

The BMA has certain powers of investigation and intervention relating to insurers and their holding companies, subsidiaries and other affiliates, which it may exercise in the interest of such insurer’s policyholders or if there is any risk of insolvency or of a breach of the Insurance Act or the insurer’s license conditions. The BMA may cancel an insurer’s registration on certain grounds specified in the Insurance Act.

Notification of Cyber Reporting Events

Every insurer subject to the Insurance Act is required to notify the BMA where the insurer has reason to believe that a Cyber Reporting Event has occurred. Within 14 days of such notification, the insurer must also furnish the BMA with a written report setting out all of the particulars of the Cyber Reporting Event that are available to it. A Cyber Reporting Event includes any act that results in the unauthorized access to, disruption or misuse of electronic systems or information stored on such systems of an insurer, including breach of security leading to the loss or unlawful destruction or unauthorized disclosure of or access to such systems or information where there is a likelihood of an adverse impact to policyholders, clients or the insurer’s insurance business, or a similar event for which notice is required to be provided to a regulatory body or government agency.

Policyholder Priority

In the event of a liquidation or winding up of an insurer, policyholders’ liabilities receive payment ahead of general unsecured creditors. Subject to the prior payment of preferential debts under the Employment Act 2000 and the Companies Act, the insurance debts of an insurer must be paid in priority to all other unsecured debts of the insurer.

Certain Other Bermuda Law Considerations

The Company is an exempted company registered under the Companies Act. As a result, the Company is required to comply with the provisions of the Companies Act regulating the payment of dividends and making of distributions from contributed surplus. A company is prohibited from declaring or paying a dividend, or making a distribution out of contributed surplus, if there are reasonable grounds for believing that:

(1) the company is, or would after the payment be, unable to pay its liabilities as they become due; or

(2) the realizable value of the company’s assets would thereby be less than its liabilities.

In addition, the Companies Act regulates return of capital, reduction of capital and any purchase or redemption of shares by the Company.

The Economic Substance Act 2018, as amended (“ESA”) impacts every Bermuda registered entity engaged in a “relevant activity,” requiring impacted entities to maintain a substantial economic presence in Bermuda and to satisfy economic substance requirements. Under the ESA, insurance or holding entity activities (both as defined in the ESA and the Economic Substance Regulations 2018, as amended) are relevant activities. To the extent that the ESA applies to any of our Bermuda entities, we are required to demonstrate compliance with economic substance requirements by filing an annual economic substance declaration with the Bermuda Registrar of Companies. Any entity that must satisfy economic substance requirements but fails to do so could face automatic disclosure to competent authorities in the EU of the information filed by the entity with the Bermuda Registrar of Companies in connection with the economic substance requirements. Additionally, a company may also face penalties, restriction or regulation of its business activities and may be struck off as a registered entity in Bermuda for failure to satisfy economic substance requirements. The Company believes it complies with all of the applicable laws and regulations pertaining to economic substance that would have a material effect on its financial condition and results of operations in the event of non-compliance.

United Kingdom

PRA and FCA Regulation

As an insurer in the United Kingdom, Ark is dual-regulated by the Financial Conduct Authority (the “FCA”) and the Prudential Regulation Authority (the “PRA”) (collectively, the “U.K. Regulators”). The PRA currently has ultimate responsibility for the prudential supervision of financial services in the U.K. The FCA has responsibility for market conduct regulation. The U.K. Regulators regulate insurers, insurance intermediaries and Lloyd’s. Both the PRA and FCA have substantial powers of intervention in relation to regulated firms.

Lloyd’s Regulation

Lloyd’s as a whole is authorized by the PRA and regulated by both the FCA and the PRA. Lloyd’s is required to implement certain rules prescribed by the PRA and by the FCA; such rules are to be implemented by Lloyd’s pursuant to its powers under the Lloyd’s Act 1982 relating to the operation of the Lloyd’s market. Lloyd’s prescribes, in respect of its managing agents and corporate and individual members (“Members”), certain minimum standards relating to their management and control, solvency and various other requirements. If it appears to either the PRA or the FCA that either Lloyd’s is not fulfilling its delegated regulatory responsibilities or that managing agents are not complying with the applicable regulatory rules and guidance, the PRA or the FCA may intervene at their discretion.

Lloyd’s permits its Members to underwrite insurance risks through Lloyd’s syndicates. Members of Lloyd’s may participate in a syndicate for one or more underwriting year(s) by providing capital to support the syndicate’s underwriting. All syndicates are managed by Lloyd’s approved managing agents. Managing agents receive fees and profit commissions in respect of the underwriting and administrative services they provide to the syndicates.

General

The operations of ASML, Ark’s wholly-owned Lloyd’s managing agent, are subject to oversight by Lloyd’s, through the Lloyd’s Council. ASML’s business plan for the Syndicates, including maximum stamp capacity, requires annual approval by Lloyd’s. Stamp capacity is a measure of the amount of net premium (premiums written less acquisition costs) that a syndicate is authorized by Lloyd’s to write. Lloyd’s may require changes to any business plan presented to it or additional capital to be provided to support the underwriting plan. Lloyd’s approved stamp capacity in 2025 for Syndicate 4020, including ACSN 3832, is £750 million ($938 million based upon the foreign exchange spot rate as of December 31, 2024) and for Syndicate 3902 is £250 million ($313 million based upon the foreign exchange spot rate as of December 31, 2024). The Syndicates are supported by capital provided through ACML, Ark’s wholly-owned Lloyd’s Corporate Member.

Ark has deposited certain assets with Lloyd’s to support ACML’s underwriting business at Lloyd’s. Dividends from a Lloyd’s managing agent or a Member of Lloyd’s can be declared and paid provided the relevant syndicate has sufficient profits available for distribution subject to Lloyd’s solvency requirements. By entering into a membership agreement with Lloyd’s, ACML has undertaken to comply with all Lloyd’s bye-laws and regulations as well as the provisions of the Lloyd’s Acts and the Financial Services and Markets Act 2000, as amended by the Financial Services Act 2012.

Capital Requirements

The underwriting capacity of a Member of Lloyd’s must be supported by a deposit in the form of cash, securities or letters of credit in an amount determined under the capital adequacy regime of the U.K.’s PRA. The amount of such deposit is calculated for each Member through the completion of an annual capital adequacy exercise. Under these requirements, Lloyd’s must demonstrate that each Member has sufficient assets to meet its underwriting liabilities plus a required solvency margin. The required amount of Funds at Lloyd’s is determined by Lloyd’s based on each syndicate’s solvency and capital requirement as calculated through its internal model.

Intervention Powers

The Lloyd’s Council has wide discretionary powers to regulate Members’ underwriting at Lloyd’s. It may, for instance, withdraw a Member’s permission to underwrite business or to underwrite a particular class of business. The Lloyd’s Council may change the basis on which syndicate expenses are allocated or vary the Funds at Lloyd’s requirements or the investment criteria applicable to the provision of Funds at Lloyd’s. Exercising any of these powers might affect the return on the Member’s participation in a given underwriting year. If a Member of Lloyd’s is unable to pay its debts to policyholders, the Member may obtain financial assistance from the Lloyd’s Central Fund, which in many respects acts as an equivalent to a state guaranty fund in the U.S. If Lloyd’s determines that the Central Fund needs to be increased, it has the power to assess premium levies on current Members of Lloyd’s. The Lloyd’s Council has discretion to call or assess up to 3% of a Member’s underwriting capacity in any one year as a Central Fund contribution.

While not currently material to our operations, Syndicates 4020 and 3902 also access insurance business from the European Economic Area though the London Branch of Lloyd’s Insurance Company. Lloyd’s Insurance Company is authorized and regulated by the National Bank of Belgium and regulated by the Financial Services and Markets Authority.

Solvency II and the U.K.’s Domestic Prudential Regime

The European Parliament’s Solvency II regulation represents a risk-based approach to insurance regulation and capital adequacy. Its principal goals are to improve the correlation between capital and risk, effect group supervision of insurance and reinsurance affiliates, implement a uniform capital adequacy structure for insurers and reinsurers across the EU Member States, establish consistent corporate governance standards for insurance and reinsurance companies, and establish transparency through standard reporting of insurance operations. Under Solvency II, an insurer’s or reinsurer’s capital adequacy in relation to various insurance and business risks may be measured with an internal model developed by the insurer or reinsurer and approved for use by the Member State’s regulator or pursuant to a standard formula developed by the European Commission. Following the U.K.'s exit from the EU, and the expiry of the transition period on December 31, 2020, U.K. authorized insurers are subject to the U.K.'s separate domestic prudential regime. This regime was identical to the Solvency II regime from January 1, 2021, although the two regimes have begun to diverge.

Each year, the PRA requires Lloyd’s to satisfy an annual solvency test which measures whether Lloyd’s has sufficient assets in the aggregate to meet all outstanding liabilities of its Members, both current and runoff. If Lloyd’s fails this test, the PRA may require the entire Lloyd’s market to cease underwriting or individual Lloyd’s Members may be required to cease or reduce their underwriting.

The EU General Data Privacy Regulation (the “GDPR”) requires companies to satisfy requirements regarding the notification of data breaches and the handling of personal and sensitive data, including its use, protection and the ability of persons whose data is stored to correct or delete such data about themselves. The GDPR permits regulators to impose fines of up to €20 million or 4% of global annual revenue, whichever is higher, and establishes a private right of action.

The GDPR was transposed into U.K. domestic law in January 2021 following the U.K.'s exit from the EU (“U.K. GDPR”) and supplements the United Kingdom's Data Protection Act of 2018. The U.K. GDPR generally tracks the compliance requirements and fine structure of the GDPR.

Climate Change

In response to PRA climate change risk management guidelines, Ark has established a climate change working group and has undertaken a climate change risk assessment. The risk assessment highlighted regulatory, claims, underwriting and investment risks associated with climate change. Ark regularly analyzes climate change risk as part of its risk management framework. Ark also engages with industry peers through the Lloyd’s Climate Change market group. Ark has assigned its Chief Risk Officer responsibility under the PRA Senior Insurance Managers Regime for climate change risk. The Chief Risk Officer reports to the Ark Board on climate change matters.

General

We are subject to various state, federal and international laws and regulations that address the collection, storing, use, disclosure, security, privacy, transfer and other processing of personal information and other data, including SEC rules, GDPR, the California Consumer Privacy Act and the California Privacy Rights Act, among others.

Change of Control

The jurisdictions where we operate have laws and regulations that require regulatory approval of a change of control. Where such laws apply to us, there can be no effective change in our control (or in the control of some or our subsidiaries) unless the person seeking to acquire control has filed a statement with the regulators and obtained prior approval for the proposed change.