NOTE: The governor signed this measure on 3/18/2016. SENATE BILL 16-029 BY SENATOR(S) Scheffel and Heath, Baumgardner, Cooke, Crowder, Grantham, Holbert, Lundberg, Martinez Humenik, Neville T., Newell, Tate, Todd, Woods; also REPRESENTATIVE(S) Duran and Lawrence, Conti, Williams. Concerning changes to Colorado insurance laws necessary to maintain accreditation with the national association of insurance commissioners (NAIC), and, in connection therewith, adopting a new own risk and solvency assessment law (ORSA) in a form substantially similar to the NAIC model and enhancing Colorado's insurance holding company system law by adding a required NAIC model provision specifying the insurance commissioner's power to issue subpoenas and examine witnesses. Be it enacted by the General Assembly of the State of Colorado: SECTION 1. In Colorado Revised Statutes, 10-3-806, add (5) as follows: 10-3-806. Examination. (5) If the insurer fails to comply with an order, the commissioner may examine the affiliates to obtain the information. The commissioner may also issue subpoenas, administer oaths, and examine under oath any person for purposes of determining compliance with this section. Upon the failure or refusal of any person to obey a subpoena, the commissioner may petition a court of competent jurisdiction, and upon proper showing, the court may enter an order compelling the witness to appear and testify or produce documentary evidence. Failure to obey the court order is punishable as contempt of court. Every person shall attend as a witness at the place specified in the subpoena, when subpoenaed, anywhere within the state. Witnesses not employed by the insurer shall be paid the same fees and mileage as are paid to witnesses in the courts of this state, which fees, mileage, and actual expenses, if any, necessarily incurred in securing the attendance of witnesses, and their testimony, must be itemized by the commissioner and charged against, and be paid by, the company being examined. SECTION 2. In Colorado Revised Statutes, add part 15 to article 3 of title 10 as follows: PART 15 OWN RISK AND SOLVENCY ASSESSMENT (ORSA) 10-3-1501. Purpose and scope - legislative declaration. (1) The purpose of this part 15 is to provide the requirements for maintaining a risk management framework and completing an own risk and solvency assessment (ORSA) and provide guidance and instructions for filing an ORSA summary report with the commissioner. (2) The requirements of this part 15 apply to all insurers domiciled in this state unless exempt pursuant to section 10-3-1506. (3) The general assembly finds and declares that the ORSA summary report will contain confidential and sensitive information related to an insurer's or insurance group's identification of risks material and relevant to the insurer or insurance group filing the report. This information will include proprietary and trade secret information that has the potential for harm and competitive disadvantage to the insurer or insurance group if the information is made public. It is the intent of the general assembly that the ORSA summary report be a confidential document filed with the commissioner, be shared only as stated in this part 15 and to assist the commissioner in the performance of his or her duties, and not be subject to public disclosure. 10-3-1502. Definitions. As used in this part 15, unless the context otherwise requires: (1) "Insurance group" means, for the purpose of conducting an ORSA, those insurers and affiliates included within an insurance holding company system as defined in section 10-3-801 (5). (2) "Insurer" has the same meaning as set forth in section 10-3-801 (6) and includes any political subdivision of the state created pursuant to article 45 of title 8, C.R.S. (3) "NAIC" or "national association of insurance commissioners" means the organization of insurance regulators from the fifty states, the District of Columbia, and the four United States territories. (4) "ORSA guidance manual" means the current version of the Own Risk and Solvency Assessment Guidance Manual developed and adopted by the NAIC and as amended from time to time. A change in the ORSA guidance manual is effective on the January 1 following the calendar year in which the change is adopted by the NAIC. (5) "ORSA summary report" means a confidential, high-level summary of an insurer's or insurance group's ORSA. (6) "Own risk and solvency assessment" or "ORSA" means a confidential internal assessment, appropriate to the nature, scale, and complexity of an insurer or insurance group, conducted by that insurer or insurance group of the material and relevant risks associated with the insurer's or insurance group's current business plan and the sufficiency of capital resources to support those risks. 10-3-1503. Risk management framework. An insurer shall maintain a risk management framework to assist the insurer with identifying, assessing, monitoring, managing, and reporting on its material and relevant risks. This requirement may be satisfied if the insurance group of which the insurer is a member maintains a risk management framework applicable to the operations of the insurer. 10-3-1504. ORSA requirement. Subject to section 10-3-1506, an insurer, or the insurance group of which the insurer is a member, shall regularly conduct an ORSA consistent with a process comparable to the ORSA guidance manual. The ORSA must be conducted no less than annually but also at any time when there are significant changes to the risk profile of the insurer or the insurance group of which the insurer is a member. 10-3-1505. ORSA summary report. (1) Upon the commissioner's request, and no more than once each year, an insurer shall submit to the commissioner an ORSA summary report or any combination of reports that together contain the information described in the ORSA guidance manual, applicable to the insurer or the insurance group of which it is a member or to both the insurer and insurance group. Notwithstanding any request from the commissioner, if the insurer is a member of an insurance group, the insurer shall submit the report required by this section if the commissioner is the lead state commissioner of the insurance group as determined by the procedures within the financial analysis handbook adopted by the NAIC. (2) The report shall include a signature of the insurer's or insurance group's chief risk officer or other executive having responsibility for the oversight of the insurer's enterprise risk management process, attesting to the best of his or her belief and knowledge that the insurer applies the enterprise risk management process described in the ORSA summary report and that a copy of the report has been provided to the insurer's board of directors or the appropriate committee of the board of directors. (3) An insurer may comply with subsection (1) of this section by providing the most recent and substantially similar report provided by the insurer or another member of an insurance group of which the insurer is a member to the commissioner of another state or to a supervisor or regulator of a foreign jurisdiction, if that report provides information that is comparable to the information described in the ORSA guidance manual. Any report in a language other than English must be accompanied by a translation of that report into the English language. 10-3-1506. Exemption. (1) An insurer is exempt from the requirements of this part 15 if: (a) The insurer has annual direct written and unaffiliated assumed premium, including international direct and assumed premium, but excluding premiums reinsured with the federal crop insurance corporation and national flood insurance program, less than five hundred million dollars; and (b) The insurance group of which the insurer is a member has annual direct written and unaffiliated assumed premium, including international direct and assumed premium, but excluding premiums reinsured with the federal crop insurance corporation and national flood insurance program, less than one billion dollars. (2) If an insurer qualifies for exemption under paragraph (a) of subsection (1) of this section, but the insurance group of which the insurer is a member does not qualify for exemption under paragraph (b) of subsection (1) of this section, then the ORSA summary report required under section 10-3-1505 must include every insurer within the insurance group. This requirement may be satisfied by the submission of more than one ORSA summary report for any combination of insurers if any combination of reports includes every insurer within the insurance group. (3) If an insurer does not qualify for exemption under paragraph (a) of subsection (1) of this section, but the insurance group of which it is a member qualifies for exemption under paragraph (b) of subsection (1) of this section, then the only ORSA summary report required under section 10-3-1505 is the report applicable to that insurer. (4) An insurer that does not qualify for exemption under subsection (1) of this section may apply to the commissioner for a waiver from the requirements of this part 15 based upon unique circumstances. In deciding whether to grant the insurer's request for waiver, the commissioner may consider the type and volume of business written, ownership and organizational structure, and any other factor the commissioner considers relevant to the insurer or insurance group of which the insurer is a member. If the insurer is part of an insurance group with insurers domiciled in more than one state, the commissioner shall coordinate with the lead state commissioner and with the other domiciliary commissioners in considering whether to grant the insurer's request for a waiver. (5) Notwithstanding the exemptions provided in this section: (a) The commissioner may require that an insurer maintain a risk management framework, conduct an ORSA, and file an ORSA summary report based on unique circumstances including the type and volume of business written, ownership and organizational structure, federal agency requests, and international supervisor requests; (b) The commissioner may require that an insurer maintain a risk management framework, conduct an ORSA, and file an ORSA summary report if the insurer has risk-based capital for a company action level event as set forth in the applicable rules promulgated by the commissioner relating to insurers' risk-based capital, meets one or more of the standards of an insurer deemed to be in hazardous financial condition as defined in the applicable rules promulgated by the commissioner to define standards and the commissioner's authority for companies deemed to be in hazardous financial condition, or otherwise exhibits qualities of a troubled insurer as determined by the commissioner. (6) If an insurer that qualifies for an exemption under subsection (1) of this section subsequently no longer qualifies for that exemption due to changes in premium as reflected in the insurer's most recent annual statement or in the most recent annual statements of the insurers within the insurance group of which the insurer is a member, the insurer has one year after the year the threshold is exceeded to comply with the requirements of this part 15. 10-3-1507. Contents of ORSA summary report. (1) The ORSA summary report must be prepared to be consistent with the ORSA guidance manual, subject to the requirements of subsection (2) of this section. Documentation and supporting information must be maintained and made available upon examination or upon request of the commissioner. (2) The review of the ORSA summary report and any additional requests for information must be made using similar procedures currently used in the analysis and examination of multistate or global insurers and insurance groups. 10-3-1508. Confidentiality. (1) Documents, materials, or other information, including the ORSA summary report, in the possession or control of the division of insurance that are obtained by, created by, or disclosed to the commissioner or any other person under this part 15, are recognized by this state as being proprietary and containing trade secrets. All documents, materials, or other information, including the ORSA summary report, are confidential by law and privileged; are not subject to the "Colorado Open Records Act", part 2 of article 72 of title 24, C.R.S., or other open records, freedom of information, sunshine, or other similar law of this state; are not subject to subpoena; and are not subject to discovery or admissible in evidence in any private civil action. However, the commissioner may use the documents, materials, or other information in the furtherance of any regulatory or legal action brought as a part of the commissioner's official duties. The commissioner shall not otherwise make the documents, materials, or other information public without the prior written consent of the insurer. (2) Neither the commissioner nor any person who received documents, materials, or other ORSA-related information, through examination or otherwise, while acting under the authority of the commissioner or with whom such documents, materials, or other information are shared pursuant to this part 15 is permitted or required to testify in any private civil action concerning any confidential documents, materials, or information subject to subsection (1) of this section. (3) In order to assist in the performance of the commissioner's regulatory duties, the commissioner: (a) May, upon request, share documents, materials, or other ORSA-related information, including the confidential and privileged documents, materials, or information subject to subsection (1) of this section, including proprietary and trade-secret documents and materials, with other state, federal, and international financial regulatory agencies, including members of any supervisory college as defined in section 10-3-807, with the NAIC and with any third-party consultants designated by the commissioner, if the recipient agrees in writing to maintain the confidentiality and privileged status of the ORSA-related documents, materials, or other information and has verified in writing the legal authority to maintain confidentiality; and (b) May receive documents, materials, or other ORSA-related information, including otherwise confidential and privileged documents, materials, or information, including proprietary and trade-secret information or documents, from regulatory officials of other foreign or domestic jurisdictions, including members of any supervisory college as defined in section 10-3-807, and from the NAIC, and shall maintain as confidential or privileged any documents, materials, or information received with notice or the understanding that it is confidential or privileged under the laws of the jurisdiction that is the source of the document, material, or information; (c) Shall enter into a written agreement with the NAIC or a third-party consultant governing sharing and use of information provided pursuant to this part 15, consistent with this subsection (3), which agreement must: (I) Specify procedures and protocols regarding the confidentiality and security of information shared with the NAIC or a third-party consultant pursuant to this part 15, including procedures and protocols for sharing by the NAIC with other state regulators from states in which the insurance group has domiciled insurers. The agreement must provide that the recipient agrees in writing to maintain the confidentiality and privileged status of the ORSA-related documents, materials, or other information and has verified in writing the legal authority to maintain confidentiality. (II) Specify that ownership of information shared with the NAIC or a third-party consultant pursuant to this part 15 remains with the commissioner and that the NAIC's or third-party consultant's use of the information is subject to the direction of the commissioner; (III) Prohibit the NAIC or third-party consultant from storing the information shared pursuant to this part 15 in a permanent database after the underlying analysis is completed; (IV) Require prompt notice be given to an insurer whose confidential information in the possession of the NAIC or a third-party consultant pursuant to this part 15 is subject to a request or subpoena to the NAIC or third-party consultant for disclosure or production; (V) Require the NAIC or a third-party consultant to consent to intervention by an insurer in any judicial or administrative action in which the NAIC or third-party consultant may be required to disclose confidential information about the insurer shared with the NAIC or third-party consultant pursuant to this part 15; and (VI) In the case of an agreement involving a third-party consultant, provide for the insurer's written consent. (4) The sharing of information and documents by the commissioner under this part 15 does not constitute a delegation of regulatory authority or rule-making, and the commissioner is solely responsible for the administration, execution, and enforcement of this part 15. (5) No waiver of any applicable privilege or claim of confidentiality in the documents, proprietary and trade-secret materials, or other ORSA-related information may occur as a result of disclosure of such ORSA-related information or documents to the commissioner under this section or as a result of sharing as authorized in this part 15. (6) Documents, materials, or other information in the possession or control of the NAIC or a third-party consultant under this part 15 is confidential by law and privileged; is not subject to the "Colorado Open Records Act", part 2 of article 72 of title 24, C.R.S., or other open records, freedom of information, sunshine, or other similar law of this state; is not subject to subpoena; and is not subject to discovery or admissible in evidence in any private civil action. 10-3-1509. Sanctions. Any insurer failing, without just cause, to timely file the ORSA summary report as required in this part 15 shall, after notice and hearing, pay a penalty of two hundred dollars for each day's delay. The maximum penalty under this section is twenty-five thousand dollars. The commissioner may reduce the penalty if the insurer demonstrates to the commissioner that the imposition of the penalty would constitute a financial hardship to the insurer. 10-3-1510. Rules. The commissioner may, upon notice and opportunity for all interested persons to be heard, issue rules and orders as are necessary to carry out this part 15. 10-3-1511. Effective date. The requirements of this part 15 are effective beginning with calendar year 2017. The first required filing of the ORSA summary report is in 2017 as specified in section 10-3-1505. An insurer that has maintained a risk management framework consistent with the requirements of this part 15 in calendar year 2016 may, but is not required to, file its ORSA summary report in 2016, and such report will be confidential as specified in section 10-3-1508. SECTION 3. Safety clause. The general assembly hereby finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, and safety. ____________________________ ____________________________ Bill L. Cadman Dickey Lee Hullinghorst PRESIDENT OF SPEAKER OF THE HOUSE THE SENATE OF REPRESENTATIVES ____________________________ ____________________________ Effie Ameen Marilyn Eddins SECRETARY OF CHIEF CLERK OF THE HOUSE THE SENATE OF REPRESENTATIVES APPROVED________________________________________ _________________________________________ John W. Hickenlooper GOVERNOR OF THE STATE OF COLORADO