Compliance February 15, 2019

Comment Deadline Arrives for NAIC Annuity Sales Best-Interest Rule

The standard-setting and regulatory support organization governed by the chief insurance regulators of all 50 states set today as a deadline for industry comments on the latest draft of a model best-interest suitability standard applying to annuity sales.

Reported by

February 25th was the deadline set by the National Association of Insurance Commissioners (NAIC) for industry comments on its proposed revisions to the current “suitability” standard governing the sale of annuity products—revisions that NAIC officials say would effectively establish a national “best interest” suitability regime.

NAIC is the U.S. standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and five U.S. territories. Through the NAIC, state insurance regulators establish standards and best practices, conduct peer reviews, and coordinate their regulatory oversight.

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

According to attorneys with Stradley Ronon, the outcome of the NAIC’s model rulemaking process is one of the top regulatory issues for the insurance, advisory and brokerage industries in 2019. For its part, NAIC has made it a goal to finish its work on a model best-interest standard this year. On the NAIC website, it is further noted that the Annuity Suitability Working Group will also consider other ways to “promote greater uniformity across NAIC-member jurisdictions.”

In commentary shared with PLANADVISER, Stradley Ronon attorneys note that the working group tasked with revising the NAIC’s model suitability rule for the sale of annuity products was hard at work throughout 2018 and early 2019, seeking to replace its current “suitability” standard for the sale of annuity products with a rule that would apply a “best interest” standard.

“The committee faced great debate among NAIC members regarding among the future of the model rule,” the attorneys explain. “With states like New York and California leading the charge, the NAIC was pressured to adopt a rule that, like New York’s regulation, would impose a best interest standard for the sale of both annuity and life insurance products. Other states have pushed back, arguing that such an approach goes too far and would be unlikely to pass in many state legislatures. Because the NAIC is working to harmonize its advice standards with those of the Securities and Exchange Commission, it is unlikely that NAIC will have its final model rule promulgated until after the SEC finalizes its rule. The future of the NAIC’s model regulation will continue to be a hot topic of debate in 2019.”

The minutes published after the last national meeting of NAIC officials—held in November 2018—illustrate the process the regulatory organization has put in place to attempt to craft its model suitability rule in an open and transparent way. Interestingly, the meeting minutes present in significant detail the various points of debate and discussion that led to the current proposed draft, especially on the point of whether life insurance sales activity should be included. The minutes also highlight the actual language revisions made to the latest draft of the model suitability rule. As noted by the Stradley Ronon attorneys, insurance commissioners from New York and California played a leading role in crafting some of the key sections of the model suitability rule, though other states pushed back on their more progressive counterparts in some key areas. 

As of Friday, NAIC had not published a full index of the latest round of industry comment letters, but previous rounds of commentary are available on the working group’s landing page on the NAIC website, under the “related documents” tab.

Data & Research February 15, 2019

Aon Reports Growing Cyber Security Threats

The "What's Now and What's Next" report focuses on eight specific risk areas that companies may face in 2019.

Reported by

Aon plc released its 2019 Cyber Security Risk Report, which details the greatest cyber security threats and challenges organizations are currently facing.

However, the report also highlights that as companies continue to use technology to speed up the transfer of information, not only are game-changing business opportunities created, but so is increased cyber risk. 

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

The “What’s Now and What’s Next” report focuses on eight specific risk areas that companies may face in 2019. They illustrate how, thanks to rapid enhancements and constant changes in technology, the number of touch points that cyber criminals can access within a business is growing exponentially.

According to the report:

  • While technology has revolutionized the way organizations today conduct business, broader and wider-spread use of technology also brings vulnerabilities. From publishing to automotive, industries are facing new, evolving services and business models. These new opportunities however, bring with them a radically different set of risks, which organizations will need to anticipate and manage as they continue the digital transformation process.
  • Two prevailing supply chain trends will heighten cyber risks dramatically in the coming year: one is the rapid expansion of operational data exposed to cyber adversaries, from mobile and edge devices like the Internet of Things (IoT); and the other trend is companies’ growing reliance on third-party—and even fourth-party—vendors and service providers. Both trends present attackers with new openings into supply chains, and require board-level, forward-looking risk management in order to sustain reliable and viable business operations.
  • IoT devices are everywhere, and every device in a workplace now presents a potential security risk. Many companies don’t securely manage or even inventory all IoT devices that touch their business, which is already resulting in breaches. As time goes on, the number of IoT endpoints will increase dramatically, facilitated by the current worldwide rollouts of cellular IoT and the forthcoming transition to 5G. Effective organizational inventory and monitoring process implementation will be critical for companies in the coming year and beyond. 
  • Connectivity to the Internet improves operational tasks dramatically, but increased connectivity also leads to new security vulnerabilities. The attack surface expands greatly as connectivity increases, making it easier for attackers to move laterally across an entire network. Further, operational shortcuts or ineffective backup processes can make the impact of an attack on business operations even more significant. Organizations need to be better aware of, and prepared for, the cyber impact of increased connectivity.
  • Employees remain one of the most common causes of breaches. Yet employees likely do not even realize the true threat they pose to an entire organization’s cyber security. As technology continues to impact every job function, from the CEO to the entry-level intern, it is imperative for organizations to establish a comprehensive approach to mitigate insider risks, including strong data governance, communicating cyber security policies throughout the organization, and implementing effective access and data-protection controls.
  • Projections anticipate that M&A deal value will top $4 trillion in 2018, which would be the highest in four years. The conundrum this poses to companies acquiring other businesses is that while they may have a flawless approach to cyber security enterprise risk, there is no guarantee that their M&A target has the same approach in place. Dealmakers must weave specific cyber security strategies into their larger M&A plans if they want to ensure seamless transitions in the future.
  • Increased regulation, laws, rules and standards related to cyber are designed to protect and insulate businesses and their customers. The pace of cyber regulation enforcement increased in 2018, setting the stage for heightened compliance risk in 2019. Regulation and compliance, however, cannot become the sole focus. Firms must balance both new regulations and evolving cyber threats, which will require vigilance on all sides.
  • Cyber security oversight continues to be a point of emphasis for board directors and officers, but recent history has seen an expanding personal risk raising the stakes. Boards must continue to expand their focus and set a strong tone across the company, not only for actions taken after a cyber incident, but also proactive preparation and planning.

Hogg, CEO of Cyber Solutions at Aon, says, “Our 2019 report also shows that organizations must recognize the need to share threat intelligence across not only their own network but with others as well. While it may seem counterintuitive when thinking about cyber security, collaboration within and across enterprises and industries can keep private data of companies and individuals alike safer. Working together can result in improved efforts to hunt bad actors, while also raising the bar and making all parties more prepared for the inevitable day when a disruption does happen.”

Aon’s 2019 Cyber Security Risk Report may be downloaded from here.

«