AUTORITÉ DES MARCHÉS FINANCIERS

GUIDELINE

SOUND RISK GOVERNANCE

LIFE INSURANCE Revoked - March 2011

TABLE OF CONTENTS

Page Purpose of this Guideline....................................................................................................... 1 Responsibilities of Directors in Ensuring Sound Business Practices..................................... 3 Applications of Principles of Sound Practices........................................................................ 8 a) Capital ............................................................................................................ 8 b) Credit ............................................................................................................ 11 c) Foreign Exchange Risk ................................................................................ 15 d) Portfolio Investments.................................................................................... 18 e) Real Estate................................................................................................... 22 f) Product Design and Pricing.......................................................................... 25 g) Underwriting and Liabilities .......................................................................... 29 h) Interest Rate Risk......................................................................................... 33 i) Liquidity ........................................................................................................ 36 j) Derivatives.................................................................................................... 41 REVISED APPENDIX Attestation of Compliance by Board of Directors

Purpose of this Guideline The mission of the Autorité des marchés financiers is to monitor and control financial institutions and intermediaries operating in Québec. In this capacity, its action concerns mainly the administration of laws and regulations governing the activities of those institutions and intermediaries, with a twofold objective of protecting the public interest and ensuring market stability. The constant changes in market and organization structures, in financial instruments and in methods of producing and distributing financial products and services are bringing about a continuous redefinition of the types and sources of risks to which institutions are exposed. These phenomena exacerbate the changes in risks, making more difficult, even obsolete, the application of traditional control and intervention procedures made available to the Autorité to carry out its mission satisfactorily. For those reasons, the Autorité intends to formalize, within its own monitoring procedures, the consideration of procedures established by directors and management teams to ensure adequate management and control of the risks to which the institution for which they are responsible is exposed. This guideline presents the principles, directions and courses of action that directors and managers should consider in order to develop, implement and monitor measures for sound and prudent management. ...its raison d’être Directors and management teams are in actual fact, outside any regulatory framework, the persons most likely to have an impact on the prudential management of financial institutions, whose strategic or everyday decisions will model the risk profile of an institution. More than any outside authority, directors and managers have ready access to financial, commercial and administrative information which is both accurate and constantly updated.

- 2 -

They therefore occupy a privileged position in defining the most suitable management and control tools to promote sound and prudent governance of the most basic aspects of their activities. In the opinion of the Autorité, parameters governing sound and prudent management must be adaptable. That is why it prefers to set forth expectations rather than rigid rules, so that efforts may be deployed efficiently and in keeping with the specific operational reality of each institution, its sectors of activity and the materiality of each ensuing risk category. These expectations are minimal; each institution may therefore adopt ones that are more restrictive. Those expectations are presented in this guideline.

- 3 -

Responsibilities of Directors in Ensuring Sound Business Practices The directors are considered to be the agents of a legal person. They must act with prudence and diligence, as well as with honesty and loyalty, in the best interests of the legal person. To these responsibilities provided for in legislation of general application, the laws governing financial institutions in Québec add the obligation to act as a reasonable person would do in similar circumstances. The duty of a prudent and reasonable manager guides all acts performed by the director in management and control. For financial institutions, that duty is obviously applied more to activities and their associated risk exposures which have a direct impact on the institution’s solvency, both immediately and in the future. Thus directors and managers must ensure the development and implementation of policies and procedures for management and control of risks to which the financial institution under their responsibility is exposed. This guideline lists and describes themes that the Autorité expects to find within the institutions under its jurisdiction. It also presents minimum considerations to be dealt with for each theme. The purpose of this guideline is not to impose a rigid, absolute set of rules dictating methods for sound risk governance. This direction is taken because of the variety of organization structures, sectors of activities and management cultures as well as the Autorité’s commitment not to add to the regulatory burden of institutions. In return for this leeway, the Autorité expects that the directors tangibly demonstrate that they have fulfilled their responsibilities in risk management and control, in particular by: • ensuring the development of policies and procedures establishing quantitative and

qualitative parameters for risk management and control; • ensuring implementation of those policies and procedures, and also ensuring that

they are applied by persons in authority who are competent and honest and who are adequately monitored;

- 4 -

• evaluating policies and procedures periodically to ensure that they are sound, appropriate and relevant and, for that purpose, to obtain the appropriate managerial reports;

• providing the Autorité with an attestation that their responsibilities in sound risk

governance have been actually fulfilled. This guideline presents a minimum list of themes to be addressed by these policies and procedures as well as additional specifications with regard to directors’ responsibilities, where applicable. The Autorité des marchés financiers is aware that several institutions, concerned about the quality of their management and risk control, have already adopted policies and procedures with goals similar to and in keeping with those set forth in this guideline. The Autorité is from the outset willing to incorporate all or part of those policies and procedures into those for which it has specified its expectations in this guideline. That is why, rather than imposing strict disclosure requirements, the Autorité will expect that institutions make their rules and procedures for sound risk management available in a form which is easy to understand. ...expectations For the Autorité des marchés financiers, the board of directors is ultimately responsible for a financial institution. The Autorité expects that the responsibility be applied, not only to the management and control of the institution in the broadest sense but also, more specifically, with regard to integrity in governing the various types of risk to which each institution is exposed. Thus, among the management and control policies that the board of directors is usually responsible for establishing and monitoring, the Autorité considers it necessary for the board of directors to ensure that a formal subcategory of rules and procedures is established for sound and prudent management of financial activities and associated risks.

- 5 -

The first subcategory of considerations for which the Autorité considers it essential that sound management policies be established concerns themes having a direct impact on the solvency of a financial institution. These themes are: • capital; • credit; • foreign exchange risk; • portfolio investments; • real estate; • product design and pricing; • underwriting and liability; • interest rate risk; • liquidity; • derivatives. The strategy for managing and controlling risks inherent to those themes, and the accompanying procedures, are presented here as minimum expectations of the Autorité. It is very likely that some of the preceding considerations, when a materiality test is administered, do not apply to a given institution. This principle nonetheless underscores the need to deal with the management and control of each of these individual risks as part of a coherent, comprehensive approach in which the interactions between these risks are considered. Moreover, an institution may be exposed to risks not provided for in this guideline and whose impact on the institution’s current and future solvency warrants the development and implementation of rules and procedures for management and control. Risks related to the behaviour of an institution and its employees and agents with customers are an example of this. Where practice warrants, the Autorité may also set forth minimum conditions for management and control of those risks.

- 6 -

Although the board of directors is ultimately responsible for tangibly demonstrating its compliance with principles of sound risk governance, notably by reviewing and approving rules, policies and procedures in the areas defined in this guideline, it should not be considered to be the sole artisan, the sole master builder in the process. The Autorité des marchés financiers considers it preferable, even essential, that development and implementation of those rules and procedures be the result of a close collaboration between the board of directors and the management team to reach a group consensus on risk management and control methods. The definition of a vision and a comprehension shared by directors and managers as objectives and means is a vital ingredient for a risk management strategy to succeed. Furthermore, the development and implementation of rules and procedures governing risk management must not be thought of as an isolated exercise, an end in itself. Such a perception could only result in a configuration of systems whose resources are inevitably prisoners of those systems, deprived of any initiative. Risk management must, both conceptually and operationally, have all the characteristics of a dynamic process. Similarly, the development of rules and procedures for sound risk practices must not be an abstract exercise. Rather, it is part of an overall approach taking into account the other operational and strategic dimensions of an institution, in particular the management culture, the business plan, the organization structure and sectors of activity. In the same perspective, the control measures of each unit must be part of a more general structure of functions and procedures to ensure achievement of the objectives set by the institution in the effectiveness and efficiency of operations, the reliability of financial reporting, and compliance with applicable laws, regulations and internal policies. Thus, the Autorité expects that the directors have ensured the implementation and are seeing to the application of a more general, adequately documented internal control process covering the key aspects underlying the business operations of every institution. For that purpose, each institution should have already adopted policies and procedures on at least:

- 7 -

• management and training of human resources; • standards of ethics governing their professional conduct; • separation of powers and delimitation of delegated powers; • implementation, maintenance and use of a management information system which is

adequate, reliable and efficient; • bookkeeping; • protection of the institution’s assets, in particular those administered for third persons,

and of the confidential information concerning them; • access to and security of information technologies; and, • compliance with legislation, regulations, rules and standards. Directors must be able to be reasonably assured that those policies and practices contribute effectively and coherently to the achievement of corporate objectives. In this perspective, the Autorité considers it appropriate that those policies and procedures be examined periodically by independent parties, whether internal or external. That examination should allow the effectiveness of those policies and procedures to be evaluated as an internal control measure. Internal and external auditors could provide periodical reports on those questions.

- 8 -

Applications of Principles of Sound Practices a) Capital Capital adequacy is a vital element in the corporate existence of a financial institution. In actual fact, capitalization is the leading indicator of an institution’s ability to face various risk exposures in the conduct of its business and, therefore, a major resource in absorbing potential losses. In this perspective, we can easily see that the quantity and quality of capital available to a financial institution is one of the first criteria considered by regulators, credit rating agencies and creditors, in assessing its soundness and stability. Considering the various forms behind the concept of capital given the many purposes, uses and calculation methods for which it can be used, the notion of capital used in this section generally refers to the stable resource necessary, in quality and in quantity, to absorb losses, sustain the existence and growth of an institution and thus offer a certain amount of security to depositors, policyholders and creditors. Because of the stringent criteria and conditions governing the eligibility of capital instruments, the definition of capital contained in most standards in force is a base measurement which is becoming increasingly recognized, having the sought-after characteristics of that resource. However, in a context of sound practices, capital management must be part of an evolutionary process that extends beyond compliance with statutory capital adequacy standards. These standards in fact set forth a series of requirements to establish, at a given time and taking into account a given financial position, the value and composition of the capital stock to be maintained. Prudential capital management is more than the application of statutory requirements; it is also the strategic planning of capital needs.

- 9 -

Thus, the Autorité expects that insurers ensure the development and implementation of policies and procedures of sound practice which at least provide for: • rigorous planning of capital needs based on an exhaustive analysis of the institution’s

growth objectives and on the risk exposure level associated with current and foreseeable activities; and

• an ongoing control of the institution’s capital needs and position, to ensure that it can

meet both short-term and long-term requirements in this area. ...relevant considerations The importance of sound management policies and procedures largely depends on, in addition to compliance with the statutory requirements in this area, the nature, complexity and risk exposure level associated with the commercial and financial activities conducted and development strategies, in the short, middle and long term. The evolutionary nature of these premises requires the implementation of a formal evaluation process, both to infer the capital position required and to anticipate future capital needs. That process, for which a minimum frequency must be set, should, in the opinion of the Autorité des marchés financiers, at least: • provide a documented estimate for a planning period, in accordance with the business

plan, of capital needs and of capital position, particularly considering the potential impact of:

- changes in the commercial, operational and financial position; - the existing and foreseeable risk exposure [level] associated with the

activities conducted, in particular in the use of derivatives; - strategic investments in technologies, fixed assets or subsidiaries;

- 10 -

- maturity structures of capital instruments and probabilities of the rights and privileges associated with them being exercised;

- foreseeable changes to statutory requirements governing the definition

and adequacy of capital. • provide a description (nature, origin, accessibility and cost) of internal and external

sources of funds which the institution will use to meet anticipated needs in capital, either overall or by specific need for financing; and

• identify measures to be put forward if an unanticipated need for capital should arise. Finally, prudential capital management requires the implementation of procedures to ensure the appropriateness and monitoring of the management procedures implemented. The content and frequency of the control instruments required for this purpose must also be established.

- 11 -

b) Credit A financial institution granting credit is exposed to the likelihood that a debtor is not able, at a given time and for various reasons, to honour all its obligations under the terms of the contract linking it with the institution. The quality of the criteria and procedures for the management and control of credit throughout its entire existence will determine the extent of that probability. In the opinion of the Autorité, sound and effective credit policies and procedures will likely reduce both the possibility of the risk occurring and the extent of that possibility and, finally, mitigate the risk exposure level related to credit operations. If credit operations must comply with principles of sound practice, it is because the risk of financial loss associated with them, through its direct impact on capital and liquidity, is by far the greatest factor in bringing about a rapid decline in solvency. For that reason, policies and procedures whose implementation is expected by the Autorité must include a definition of credit operations which is as inclusive as possible. Thus, to the classical definition of credit, that of providing a person with a sum of money to be reimbursed with interest and expenses, should be added any commitment to advance funds directly or through a substitute, with or without security, either on- or off-balance sheet. The policies and procedures which the Autorité expects insurers to develop and implement must be representative of the practices of each institution in that area. They must promote the understanding, sound management and adequate control of those practices, and not to constrain them so as to hinder the institution’s business and growth opportunities unduly. That said, those policies and procedures must provide for at least: • identification of existing and potential credit activities which is exhaustive and as

detailed as possible and a definition of the appropriate thresholds; • the application of adequate and effective methods for credit granting,

documentation and collection;

- 12 -

• the implementation of administrative procedures and information systems for adequate and effective monitoring and control of credit operations, as well as qualitative and quantitative policies and procedures implemented in accordance with this section of the guideline.

...relevant considerations The considerations which, in the opinion of the Autorité, must be taken into account in the definition of policies and procedures for sound governance of credit operations, or for adequate management and control of the ensuing risk, are presented below. Credit Activities and Thresholds The policies and procedures considered under this heading must ensure that the range of credit operations in which the institution is engaged or likely to become engaged is clearly identified. The level of risk inherent in credit activities basically depends on, in addition to the very nature of the target activities and their intrinsic risk, the composition and concentration of the portfolio. Thus, this portion of the policies and procedures should include the setting of limits, expressed for example in proportion to total assets or to capital, for each target activity, both on- and off-balance sheet and conducted individually or on a syndicated basis, with particular consideration of: • the major families of loans generally recognized in the financial sector (e.g. consumer,

housing, on policy, commercial, industrial, and the appropriate subcategories); • industry segments; • credit appropriations per region; • credits with the same type of security (including unsecured loans); • credits granted to associated borrowers whose source of repayment is common or

closely tied; • credits granted to a same natural or legal person; • credits granted to directors, managers and employees as well as to the natural or

legal persons associated with them.

- 13 -

The definition of powers of the resources involved in all stages of the evaluation, authorization and monitoring process, in particular the establishment of quantitative and qualitative thresholds adapted to the complexity of target credit operations, is a component which should be codified administratively. For the Autorité des marchés financiers, the definition of approval authorities and the independence of the resources involved in each operation of solicitation, analysis, granting and collection are fundamental parameters in this codification. Documentation, Granting and Collection The quality and appropriateness of the practices underlying the granting of a loan and providing reasonable assurance that its collection complies with the original terms of the contract are fundamental components in adequate credit risk management and control. An adequately documented credit file is essential in assessing and monitoring the risk until maturity. The documentation used should at least accurately identify the borrower, purpose or type of loan, date of maturity and repayment source. Any information concerning the evaluation of credit proposals and the authorization, granting and collection of credit should also be included. Credit granting policies and procedures must ensure that, for each proposal, an appropriate evaluation is carried out of the financial condition and resources of the borrower as well as of the borrower’s past, present and future ability to honour its commitments. In the Autorité’s opinion, that analysis must take into account relevant legal documents and deeds, collateral, its status, its negotiability, its relative market value in proportion to the loan, reliability of the repayment source and the endorsers’ responsibility where applicable. Those parameters should be completed, where the risk level of the activities warrants it, by a credit rating, or they should be used together to determine such a rating.

- 14 -

Control and Monitoring Procedures Policies and procedures for collection should ensure that the terms and conditions of repayment are strictly monitored in accordance with the terms of the contract. In particular, they should include procedures allowing circumstances likely to result in a borrower’s failure to comply with the terms and conditions of the contract to be detected immediately and managed, such as a deterioration in the borrower’s financial position or a decline in the value of collateral. Those procedures should include a codification, graduated where necessary, of the appropriate measures to be implemented, as the case may be (more frequent controls, making a provision, restructuring, checklist, write-off, etc.). Finally, adequate management of credit practices requires the implementation of performance indicators and measurements as well as an accountability plan. Therefore, procedures should provide for an individual and overall evaluation of the quality and performance of the credit portfolio, as well as an evaluation of compliance with the various policies and procedures implemented under this section. The content and frequency of the controls and of the ensuing reports to be filed should also be established. The Autorité nonetheless expects that those reports set forth parameters to evaluate the quality of the portfolio, such as status of outstanding loans, value of provisions and a list of the major loans.

- 15 -

c) Foreign Exchange Risk In the normal course of its commercial and financial activities, both domestic and foreign, a financial institution may hold assets and liabilities denominated in foreign currency having a variable exchange rate with regard to Canadian currency. Financial institutions may also hold considerable stocks of foreign currency from foreign exchange trading activities, hold investments in subsidiaries abroad, or collect income or incur expenses in foreign currency. The impact of any adverse fluctuation in the currencies of those assets or liabilities, both on- and off-balance sheet, on profits results in foreign exchange risk. The Autorité expects institutions with a significant exposure to foreign exchange risk to implement a formal process enabling them to control foreign exchange positions adequately so as to modulate, within set parameters, the impact of foreign exchange fluctuations on the institution’s financial position. The procedures and practices giving a form to this process will, of course, vary according to the nature and complexity of the operations with which the foreign currencies are associated and according to the sensitivity of the assets and liabilities, both on- and off-balance sheet, to fluctuations in exchange rates. In spite of these differences, the Autorité expects insurers to ensure that the procedures provide for: • an exhaustive knowledge of the institution’s foreign exchange risk exposure; • implementation of procedures to confine foreign exchange risk within limits

considered prudent and acceptable. • the application of administrative procedures and information systems to adequately

monitor application of the policies and procedures implemented under this section.

- 16 -

...relevant considerations The considerations which, in the opinion of the Autorité, must be taken into account in defining policies and procedures for sound and prudent foreign exchange risk management are presented below. Foreign Exchange Risk Exposure The appropriateness of foreign exchange risk management and control procedures requires an exhaustive knowledge of the activities giving rise to the foreign exchange and the nature of the currencies from which it derives. In addition to identification of the currencies in which the institution authorizes transactions, the foundation of sound and prudent foreign exchange risk management is access to complete, precise information to assess accurately, on an ongoing basis, foreign exchange risk and its impact on the results, and to initiate the suitable corrective measures at the proper time. Each institution must ensure the implementation of an information system at least for measuring the net foreign exchange positions (difference between purchases and cash inflows and sales and cash outflows) on current and future rates for each currency or combination of currencies in which the institution is authorized to deal, in order to identify mismatches and to assess real and theoretical gains and losses resulting therefrom. Foreign Exchange Risk Limits Sound foreign exchange risk management requires that the level of risk exposure be confined within limits deemed acceptable considering the nature and importance of the operations involving foreign currencies and the capacity to offset mismatches. To express the risk exposure level adequately, limits must at least circumscribe, for each currency and for all currencies authorized, the total foreign exchange positions on existing or future rates. As a general rule, limits establish a parallel between those foreign exchange positions and earnings, capital or the foreign exchange volume. Limits should apply both to risks produced by the daily trading of foreign currencies and to the theoretical risk produced by the foreign exchange forward structure. Finally, because

- 17 -

foreign currency fluctuations are so unpredictable, limits set should be reviewed periodically. Prudential policies should also establish limits for settlement or exposure for each counterparty involved in foreign exchange transactions. Hedging techniques may also be used to keep foreign exchange risk exposure within set tolerance limits. Foreign currency options, foreign currency futures contracts and foreign currency swaps are examples of this. The Autorité considers it essential that these techniques be restricted beforehand to specific types of instruments, that the internal and external resources involved have a high level of expertise and that adequate monitoring and reporting systems be in place. A clear and strict definition of the powers delegated to the internal and external resources involved in foreign exchange management is a final aspect to be considered in prudent foreign exchange risk management. Monitoring and Control Finally, sound and prudent foreign exchange risk management must include control measures to ensure that the management parameters implemented under the preceding sections are adequate and effective. Control procedures should be implemented to provide directors, at a frequency and in a form to be set by them, with the assurance that: • the instruments for measuring, assessing and delimiting the foreign exchange risk

exposure are adequate, applied rigorously and periodically reviewed. In the negative, appropriate corrective measures have been set up;

• the resources appointed to apply those instruments and to monitor their application

have the necessary skills and expertise, especially with regard to use of hedging instruments.

- 18 -

d) Portfolio Investments For a financial institution, securities investments are a considerable source of profitability of capital not allotted to credit or for other purposes. For some financial institutions, such as property and casualty insurers, securities investments comprise a sizeable portion of their assets. Profitability is not, however, the only criterion behind the decision to invest. It must be considered in connection with the various purposes for which those investments are intended such as liquidity, matching, collateral, hedging and speculation. To each of those purposes or uses usually correspond particular types of securities meeting specific criteria of risk and return. In spite of the above principles, all classes of securities are exposed to the risk that expected returns do not materialize in accordance with the initial terms. That risk is related to the effect of price changes on the market value of the company’s securities portfolio. Therefore those activities, because of the possible losses associated with them and their effects on liquidity and capital, present a risk whose impact is similar to that of credit risk. The variety of forms and characteristics of securities, the many different uses for which they are intended, the speed, volume and complexity of transactions, the volatility of markets and the numerous resources involved in all stages of the process are as many factors underscoring the need to have policies and procedures for sound governance to reduce the risk inherent to securities. For the same reasons, in developing those policies and procedures, a definition of securities must be used which is as all-encompassing as possible. All debt and equity instruments, whether or not they are traded on an organized market, both on-and off-balance sheet or derivatives thereof, should be included in that definition and be considered in the sound governance framework (except for strategic investments or investments conferring a position of control within a corporation). In this general context, the policies and procedures which the Autorité expects insurers to develop and implement for securities investments should be in keeping with the following objectives:

- 19 -

• identification of the classes of securities for which investments are currently engaged or authorized, particularly their intended uses, the relative risk exposure level of each one and the expertise available to the institution;

• the application of appropriate measures and procedures for the assessment,

acquisition and realization of securities investments in a perspective of sound and prudent governance;

• the application of adequate administrative procedures and information and

documentation systems to control the application of the qualitative and quantitative policies and procedures implemented under this section.

...relevant considerations The analogy between credit activities and securities investments concerning the type of risk associated with them also applies to the considerations to be dealt with in developing and implementing policies and procedures for sound business practices.

Target Activities and Thresholds The first step is to identify the types of investments authorized as securities, i.e. in which the institution is engaged or likely to become engaged. That list depends mainly on the uses or purposes for which the investments are intended. It must also be drawn up in consideration of the criteria of quality and return to be established, either overall or per use category, on the basis of a reference credit rating system. Policies and procedures in the choice of target activities must be established on the basis of the often large discrepancies in risk characteristics and in the complexity of securities dictated by certain uses such as hedging operations.

As in the case of credit activities, the extent of the risk inherent to securities investments depends on, in addition to the risk and return characteristics particular to each one, the composition and concentration of the portfolio. Although the choice of target activities is usually dictated by the various uses for which they are intended or by statutory requirements, the Autorité nonetheless considers that sound practices must include the

- 20 -

establishment of limits, expressed for example in terms of assets or capital, particularly on the basis of the volume of investments: • with a same amount of liquidity and marketability; • in a specific industry segment; • whose issuers of securities are associated; • whose characteristics (return, rank in the case of a winding-up, dividend policy,

conversion privilege, etc.) are similar. Assessment, Acquisition and Realization Adequate, clearly documented policies and procedures must be in place for the sound monitoring and control of practices inherent in the assessment, approval, execution of investment decisions, trading, management and custody of securities. In the opinion of the Autorité, the policies and procedures particular to each of those themes must cover two fundamental aspects: resources and information systems. The sound management of securities operations depends largely on the integrity and competence of the internal and external resources making the investments within each of the decision and operational themes set out previously. Thus, the Autorité considers it appropriate that the policies and procedures established under this heading provide first of all for criteria governing the choice of internal and external resources to whom will be delegated powers related to the various securities operations as well as the choice of brokers to advise the institution or ultimately carry out the transactions. These criteria should particularly take into account the complexity of the types of target activities provided for and include qualitative and quantitative references governing those persons in their respective fields and levels. The independence of the resources assigned to each group of operations, including assessment, acquisition and monitoring, should be considered. Moreover, for both internal and external resources, the policies must include a precise description of the powers delegated to each one as well as a clear delimitation of responsibilities. In addition, the responsibilities delegated by contract to outside parties must be backed by clear legal texts that assure that the institution is protected adequately.

- 21 -

Secondly, the satisfactory management and control of existing and projected securities operations require that each decision and operational theme established above is supported by effective information and documentation systems adapted to the volume of activities and to the complexity of operations carried out in this area. Those systems, whether they are maintained by the institution or by a third person, must at least provide for: • identification of the description of the legal and financial characteristics of the

securities as well as their location; • a retracing of all steps of the transaction and of the resources involved in each one; • the proper classification and carrying of securities and related income, particularly on

the basis of their class (or type of target activities) or intended use; • an overall and individual assessment of returns on securities and an assessment of

the portfolio status at various stages and at maturity, on the basis of the quality and return criteria set beforehand.

Monitoring and Control Procedures Finally, monitoring policies and procedures must be in place for directors to be reasonably assured of the quality of practices for securities and their compliance with all aspects of the framework whose development and implementation are provided for in this section. The content and frequency of the controls and ensuing reports must also be established.

- 22 -

e) Real Estate The heading “Real Estate Investments” on the balance sheet of a financial institution is usually only a fraction of the institution’s real estate activities. The purchase, sale, rental or exchange of real estate, real estate investments, the financing of such operations for investment purposes or for its own use, or the use of real estate as loan security, the refinancing of such a loan and the recovery of the real estate provided as security give to this theme a certain importance which, because of its impact on the balance sheet and on the institution’s profits, must not be underestimated. The setbacks experienced by several financial institutions, for which commercial and financial activities linked to real estate have been largely responsible, show that the above statement is well founded. The quality of operations involved in real estate is an essential condition for reducing the number of losses associated with such loan and investment activities. In this context, it is easy to understand why the Autorité des marchés financiers considers it essential that directors ensure the implementation of a framework for sound governance of real estate activities, in which adequate and effective real estate policies and procedures are an important component. Thus, the policies and procedures for sound management which the Autorité expects insurers to develop and implement for real estate operations should be in keeping with the following objectives: • the identification of commercial and financial operations linked to real estate for

which an effective initial and subsequent real estate framework should systematically be applied;

• the application of appropriate measures and procedures for selecting real estate

appraisers, their compliance with recognized, modern standards and methods and the information to appear in their report, in consideration of the complexity of each type of real estate operation identified above ;

- 23 -

• the application of administrative procedures to ensure that real estate policies and procedures are adequately implemented and monitored and that they are revised periodically.

...relevant considerations The expectations of the Autorité des marchés financiers outlined in this section cannot be dissociated from real estate credit and investment activities. The policies and procedures to be codified administratively under this theme are no less essential for the sound governance of financial institutions. Scope The development of real estate policies and procedures requires first of all an exhaustive understanding and knowledge of the current and projected commercial and financial operations of each institution in this area. Thus, the Autorité considers that a list of criteria should be drawn up to determine the use of a real estate appraisal or reappraisal, either systematically or as the need arises. That list must take into account the nature of the real estate credit and investment activities conducted by the institution, their complexity, their risk exposure level and, where applicable, the relative size of the real estate, to ensure the realization of the related asset in accordance with the conditions provided for. Appraisal The policies and procedures for sound practices in real estate appraisal comprise three parts. The first consists in establishing criteria for the selection of real estate appraisers to be hired in accordance with the criteria provided for under the previous heading. In addition to basic criteria concerning skills and knowledge of a sector or of a particular type of real estate, the Autorité considers that an appraiser’s independence of the real estate being appraised and of the parties to the transaction is also fundamental. The second part of the policies and procedures for sound practices in real estate concerns appraisal methods used by real estate appraisers meeting the criteria set under the previous heading. For the Autorité, those policies and procedures must include

- 24 -

requirements to ensure that the methods used by appraisers meet or are equal to the recognized standards in the area used by recognized organizations such as the Appraisal Institute of Canada. The last part of the policies and procedures for sound management in real estate concerns the content of appraisal reports. As with appraisal methods, the Autorité des marchés financiers considers it important that the form and content of appraisal reports, particularly to ensure uniformity in the practice of hired appraisers, also be consistent with standards used by recognized professional organizations. Those policies should require that any departure from recognized appraisal standards resulting in a content not in compliance with standards in force be adequately substantiated and documented. Monitoring and Control Finally, monitoring policies and procedures must be in place for directors to ensure that the policies and procedures approved by them are implemented and followed up in accordance with all aspects of the framework whose development and implementation is provided for in this section. Those procedures may be developed and implemented in isolation or in association with procedures for real estate credit and investment activities. The content and frequency of the controls and ensuing reports must also be established.

- 25 -

f) Product Design and Pricing Product design and pricing are fundamental components in the management of life insurers. An insurance product should be priced at least to cover expenses and liabilities associated with the risks underwritten. Financial losses which could result from underpricing thus give rise to product design and pricing risk. The products offered by life insurers, in the form of insurance or annuity contracts, individual or group insurance, products underwritten by those insurers or accepted as reinsurance, are exposed to design and pricing risk. However, it is accepted that the estimated duration of the period separating the time when the product is underwritten and the occurrence of the risk covered or the period over which the liabilities are spread are elements determining the extent of the risk. Thus, some life and health insurance products with liabilities covering or occurring over long periods comprise a relatively large design and pricing risk component. The impact of inappropriate pricing is no less tangible and potentially material in short-term products; the leeway necessary to curb the ensuing losses or to revise the pricing could in this case be somewhat limited. Although the relative significance of the design and pricing risk component is dependent on those considerations as well as on the nature and complexity of operations, on the expected return and on the capacity to absorb potential losses, the Autorité des marchés financiers is of the opinion that the prudent management and control of that risk require the same amount of rigor regardless of the products offered. Moreover, because the efficiency of management and control procedures implemented can be assessed only when the projected liabilities materialize, the design and validation of policies and procedures to be established under this heading must be closely associated on an ongoing basis with underwriting and liability management. In this context, the policies and procedures of which the Autorité expects insurers to ensure the development and implementation should be in keeping with the following objectives: • identification of existing product lines and of insurance product families likely to be

marketed by the insurer as a principal insurer or as a reinsurer;

- 26 -

• the application of methods and the implementation of adequate documentation systems to monitor product design and pricing;

• the application of procedures to ensure adequate monitoring and control of the

framework implemented under this heading. ...relevant considerations The considerations which, in the opinion of the Autorité des marchés financiers, must be taken into account in assessing, monitoring and controlling design and pricing risk are presented below. Insurance Activities and Thresholds The choice of existing or projected products or product families is a main component in the operating strategies and business plan of each insurer. That choice will also be dictated by the amount of financial resources allotted to product development. When those choices are made, however, an exhaustive knowledge of intrinsic product components is an essential prerequisite in pricing. The line of products offered also determines the level of expertise required in the underwriting and processing of claims. Thus, each insurer should draw up an inventory of products or homogeneous product families in which the distinctive characteristics of each one are specified, including: • nature of the risk assumed; • options, riders, rights and privileges associated with the product; • target markets ; • compliance of the product with the strategy for diversifying insurance activities; • terms and conditions for offering and distributing the product including costs, and the

expertise required in the underwriting and processing of claims. In addition to the very nature of the products and their specific risk exposure level, the overall level of risk to which insurance activities are exposed depends largely on the composition and concentration of the product portfolio. Thus, the policies and procedures established under this heading should set limits for each product or family of products,

- 27 -

particularly considering the amount of insurance written per individual contract and per group of contracts or of insured having the same risk features (e.g. geographic region, industry segment or risk profile). Monitoring of Product Design and Pricing The accuracy of pricing goes hand in hand with a knowledge of the factors, phenomena and events affecting the occurrence and materiality of the risk assumed. Recognized and currently used actuarial methods and principles provide the necessary framework for these considerations when a new product is priced, when existing prices are changed or when changes to an existing product are introduced. Prudent policies and practices require the consideration of the widest possible range of pricing parameters, some of them falling outside applicable standards. Moreover, the variability inherent to most parameters used requires that they be reviewed periodically and supported by the appropriate documentation. Thus, parameters to be considered and periodically revised should include, where applicable: • mortality and/or morbidity rates; • lapse rates and surrender values; • interest rates; • inflation; • anti-selection factors; • the exercise of options by the policyholder; • expenses for acquiring products and settling claims; • concentration (catastrophic loss potential); • factors related to the market or to marketing (competitive positioning, demand,

volume of contracts, costs for distribution system); • asset risks, including asset yield deficiency risk; • unexpected occurrences, e.g. future costs related to insurers’ insolvencies

(stabilization fund risk), technology and regulatory amendments. Some measures are available to insurers for reducing the impact of those factors or the variation of those factors on pricing. Implementation of a formal and periodic process for price revision on the basis of experience is one of those measures which also include:

- 28 -

• extra premiums, policy restrictions, or particular financial arrangements; • specific requirements and/or limits applicable per contract or per homogeneous group

of contracts; • retrospective rating or limitations on experience rating refunds; and • reinsurance or other measures likely to reduce existing or potential liabilities such as

the use of derivatives or of financing operations on the capital market. The application of any of the above measures should be supported by adequate documentation showing the financial impact, especially through the use of simulation models. In spite of an exhaustive analysis of risk factors and the use of measures to hedge the risk exposure, an insurer’s market strategy may lead it to underprice certain products voluntarily. Insurers using this practice should ensure beforehand that they have a product line which is sufficiently diversified and have rigorously measured its impact on their results and on their capital. Monitoring and Control Finally, monitoring and control procedures must be in place for directors to ensure the quality of practices for design and pricing risk management and control, their compliance with all aspects of the framework whose development and implementation are provided for in this section and their dissemination to the resources concerned. Those measures must in particular assess the appropriateness of the components of that framework through the implementation of a periodic revision and appraisal process which first and foremost takes liabilities into account. Those policies must also include a description and a clear delimitation of levels of approval authorities, in particular concerning the appointed actuary, and a description of the powers delegated. The content and frequency of controls and ensuing reports must also be established. Periodic or special internal reports, in particular that of the appointed actuary on the insurer’s financial position, should be considered an integral part of the control measures to be implemented.

- 29 -

g) Underwriting and Liabilities Through design and pricing, the product line each insurer intends to offer as well as applicable rates have been determined. Within these broad parameters, however, the risks inherent to each type of product present a new level of disparity because of the many different kinds of individual insurance proposals and the processing of each claim. In other words, the risk to be insured is appraised more accurately when the risks are approved and claims and benefits are processed. It is thus important to properly understand and measure the nature, importance and variability of the factors likely to have an impact on the level of those risks in order to develop effective monitoring and control procedures to confine the risk to levels in keeping with the insurer’s profitability objectives and its capacity to absorb losses. The selection and approval of risks, the exercise and management of options resulting in liabilities and the adjudication of claims are the chief factors determining the risk exposure of underwriting and claims and benefit processing practices. Inadequate or insufficient policies and procedures expose insurers to potential financial losses resulting in underwriting and liability risk. This section of the guideline sets forth the principal components of a prudential framework which, in the opinion of the Autorité des marchés financiers, should govern the approval of insurance proposals and the processing of claims, either for products written directly by the insurer or for products accepted as reinsurance. The existing and potential underwriting and liability risk may vary according to the nature and complexity of the products, their intrinsic risk level and the options they include. Thus, that risk cannot be considered separately from the parameters for monitoring product design and pricing risk set forth in the preceding section; rather, it must constitute a primary basis in assessing the efficiency and accuracy of those parameters.

- 30 -

Notwithstanding these potential risk variations, the policies and procedures to be codified, implemented and monitored should be in keeping with at least the following objectives: • the application of adequate references and methods governing the selection and

approval of risks and the definition of the appropriate reference points; • the application of procedures for managing the processing of benefits and options and

the adjudication of claims; • the use of adequate administrative procedures and documentation systems for

prudent management and control of the framework implemented under this section. ...relevant considerations The components of a prudential framework in the management and control of underwriting and liabilities is presented below. Risk Selection and Approval and Limits Applicable The cornerstone of prudential governance of underwriting and liabilities is disclosure of the underwriting risks the insurer agrees to evaluate and accept as well as the applicable references as the case may be. The criteria for an adequate assessment and control of risks inherent to the underwriting thus authorized by the insurer, as principal insurer or as reinsurer, should at least specify: • the nature of the risk insured, the corresponding product and the options associated

with it as well as the applicable premium scale; • the distinguishing characteristics of the insured, e.g. occupation, industry segment,

health or any other distinctive assurability profile; • the territory within which the proposals may be received, defined geographically or by

jurisdiction.

- 31 -

Prudent underwriting and liability risk management also requires the definition of limits or quotas set for the different types of underwriting risks authorized on the basis of the above criteria or any other criteria the insurer wishes to use to set prudential limits. Those limits may be expressed in a measurement unit representing the risk resulting from insurance or annuity contracts and can include as many subdivisions or groups of measurement units as each insurer deems appropriate according to the nature and complexity of its activities. Limits expressed as more segmented geographic references or industry subcategories are examples of this. Those limits can be absolute thresholds or, depending on what each insurer considers appropriate, thresholds on the basis of which a more rigorous selection or control of risks becomes necessary. Policies and procedures must also specify the nature of the documents and proof required in support of insurance proposals. In addition to the above measures, reinsurance is a means available to insurers of reducing the risk exposure associated with underwriting and liabilities. Prudent policies in this area must provide for rules generally governing reinsurance management and procedures of risk cession, including the establishment of limits beyond which reinsurance seems appropriate and the management of movements of cash flows related to reinsurance. These frameworks should also include a list of insurers with which reinsurance treaties will be authorized (in particular with insurers not holding a license issued by a Canadian jurisdiction), provide financial soundness criteria to be met by each insurer and specify the terms and conditions each insurer considers prudent to include in the treaties. Limits should also be set for ceded liabilities per type of product, for a same reinsurer and for all reinsurers. Processing of Claims The codification of policies and procedures in claims processing (including management of options giving rise to financial obligations) is the second part of the framework for sound underwriting and liability risk management. That codification first of all specifies the elements to be considered or compiled in the processing of claims, in particular: • the nature of the risk assured, the product concerned and the options it includes; • the documentation and proof required;

- 32 -

• the appropriateness of the documentation and proof provided with the terms, conditions and options or other criteria provided for in the contract;

• the legal jurisdiction of the claim. Policies and procedures should include quantitative or qualitative criteria on the basis of which settlement applications must be submitted for approval or for closer investigation. Claims settlement procedures and the corresponding controls should also be provided, either for products underwritten by the insurer or for products ceded in reinsurance. Monitoring and Control Procedures Finally, monitoring policies and procedures must be in place for directors to ensure the quality of practices for underwriting and liabilities management and control, their compliance with all aspects of the framework whose development and implementation are provided for in this section and their dissemination to the resources concerned. Those measures must in particular assess the appropriateness of the components of that framework through periodic revision and evaluation. The results and findings ensuing therefrom should also be seen in association with product design and pricing management parameters for approval purposes. Those policies should also include a description and a clear delimitation of levels of approval authorities, in particular concerning the appointed actuary, and a description of the powers delegated. The content and frequency of controls and ensuing reports must also be established. Periodic or special internal reports, in particular that of the appointed actuary on the insurer’s financial position, should be considered an integral part of the control measures to be implemented.

- 33 -

h) Interest Rate Risk Interest rates influence profits and the net asset value of a financial institution in two ways: first, because they are a determining factor in the pricing of assets and liabilities, both on- and off-balance sheet; and second, because of the cash flows they generate. The impact of interest rate changes on the financial results of an institution gives rise to interest rate risk. This risk, whose extent is determined by the sensitivity of interest-producing and interest-bearing assets and liabilities to rate changes, becomes apparent when there is a mismatch in the movements of the respective rates of assets and liabilities, both on- and off-balance sheet, or a mismatch in the times when those assets and liabilities are reassessed. The impact of the interest rate risk requires that directors provide themselves with the necessary tools to evaluate, manage and control the repercussions of interest rate changes on the institution’s operations. These tools take the form of policies and procedures whose characteristics may vary from one institution to another because of the maturity structure of assets and liabilities and their intrinsic sensitivity to interest rate changes. The Autorité des marchés financiers is aware of the limits imposed on these tools by the uncontrollable nature of several exterior factors contributing to interest rate changes and, therefore, to an appropriate adjustment of interest rate risk. In spite of these differences and reserves, the components which the Autorité expects insurers to consider as priorities in the development and implementation of policies and procedures for sound management of interest rate risk must at least include: • application of the recognized and appropriate measurement instruments to assess the

impact of potential changes in interest rates on financial results; • the establishment of limits to restrict interest rate risk to levels considered acceptable

and prudent by directors; • the application of administrative procedures and documentation systems to monitor

adequately the application of policies and procedures set up under this section.

- 34 -

...relevant considerations The considerations which, in the opinion of the Autorité des marchés financiers , must be taken into account in defining policies and procedures for the sound and prudent management of interest rate risk are presented below. Measurement Instruments Sound interest rate risk governance requires that the resources assigned to the task have a precise knowledge of the profile and extent of the risk to which the institution is exposed, by considering first of all the possible impact of rate changes. For that purpose, each institution must have relevant data to ensure that the risk exposure level (impact of rate changes) is confined within set limits, and to implement the suitable corrective measures at the appropriate time. Interest rate risk assessment techniques may be used to achieve this twofold objective. Each institution is responsible for determining the most appropriate technique given its needs, in consideration of the elements having a major impact on the degree of sensitivity of assets and liabilities to rate changes. Gap analysis, duration analysis and simulation models meet those criteria. Interest Rate Risk Limits The prudential management of interest rate risk requires, in addition to the application of techniques to measure it, that it remains within limits determining the level of risk exposure and therefore acting as reference parameters when the chosen technique or techniques are applied. For the Autorité, it is important, in determining these risk limits, to consider in particular the capacity of each institution to offset mismatch positions and, ultimately, its capacity to absorb the ensuing losses. The values used in expressing mismatch positions related to specific maturity dates should thus be representative of the impact in this twofold perspective. The expression of limits on the basis of earnings, regulatory capital or income-producing assets allow such an impact to be inferred. Because the accuracy of

- 35 -

the limits established is largely dependent on the changeable, unpredictable nature of interest rates, these rates should be reviewed at appropriate intervals. Hedging techniques may be used by financial institutions to confine interest rate risk within set limits. Options and interest rate futures contracts and interest rate swaps are examples of this. These instruments can be used for various purposes. However, the Autorité des marchés financiers considers it appropriate to restrict their use to hedging, using them as basic prudential measures. Specific procedures should establish in particular the types of instruments chosen, and the skills, experience and delegated powers of the resources entrusted with using those instruments. Those procedures should comprise monitoring and reporting systems. Monitoring and Control Finally, sound and prudent interest rate risk management must include control measures to ensure a rigorous application and periodical revision of the management parameters implemented under the previous sections. Control procedures should therefore at least provide directors, at a frequency to be set by them, with the assurance that: • the instruments for measuring, assessing and delimiting interest rate risk are adequate

and applied rigorously; • the resources appointed to apply those instruments and to monitor their application

have the necessary skills and expertise, especially with regard to the use of hedging instruments;

• periodic examinations are carried out to evaluate the accuracy of risk assessment

techniques used and to evaluate risk limits, particularly in consideration of the highly volatile nature of interest rates, and to initiate the appropriate corrective measures, if necessary.

- 36 -

i) Liquidity In the normal course of its operations, a financial institution must be able to meet its financial obligations, whether or not these obligations are forecasted. The requirements in certain laws and regulations governing financial institutions for the maintenance of a minimum amount of assets with a high amount of liquidity or readily convertible to cash are part of this perspective. In addition to this static concept, the changing, progressive and, to a certain extent, unpredictable nature of cash outflows must be taken into account. Thus, liquidity is to be considered as part of an ongoing process. In this perspective, liquidity management refers to a formal process through which a financial institution allocates and structures its assets and liabilities to provide the necessary liquidity to honour its anticipated or unanticipated cash outflow commitments, while minimizing the use of costly loan sources or asset discounting. The Autorité des marchés financiers considers that sound liquidity governance, or adequate management and control of liquidity risk, substantially increases an institution’s ability to contain a situation rapidly which could otherwise degenerate into an irreversible crisis, thus making the institution more stable. In this context, the Autorité expects that insurers ensure the development and implementation of policies and procedures for sound liquidity practices which at least provide for: • an assessment of the amount of liquidity required to allow the institution to

honour on an ongoing basis its cash outflows which have fallen due or are about to fall due, both off-and on-balance sheet or derivatives thereof;

• the application of processes and measures to prevent or remedy any potential

incapacity of regular cash inflows to match cash outflows, including contingency measures;

• the application of administrative procedures and information systems to measure

and control on an ongoing basis the liquidity required and available and to monitor

- 37 -

adequately the application of qualitative policies and procedures implemented under this section.

...relevant considerations The ability of a financial institution to meet its forecasted and unforecasted cash outflow commitments is, without considering the structure and composition of its assets and liabilities, largely dependent on the quality of the policies and procedures developed and implemented in the assessment of liquidity requirements and in the management of regular and exceptional sources of funds. Assessment of Liquidity Requirements The assessment of liquidity requirements is generally associated with the application of asset/liability management techniques to infer the amount of liquidity required by managing cash inflows and cash outflows. Furthermore, those techniques allow that liquidity requirement to be influenced by a change in the characteristics of the assets and liabilities and a measurement of their impact. The nature and complexity of assets/liabilities management techniques obviously varies according to the nature and structure of the assets and liabilities, both on- and off-balance sheet. However, the Autorité considers it essential that the technique chosen by a financial institution for assessing its liquidity requirements on an ongoing basis should at least provide for the following: • the structure and matching of cash flow maturities expected to be provided by the

assets and liabilities, both on- and off-balance sheet, whose analysis allows the liquidity surpluses or deficiencies to be assessed in the short and middle term;

• identification of self-generated or external sources of liquidity (operating liquidity

surpluses) to offset liquidity deficiencies.

- 38 -

Management and Control of Liquidity Deficiencies In principle, rigorous policies and procedures for assessing liquidity requirements based on adequate and efficient asset/liability management techniques should ensure that the sources of funds cover cash outflows for each period. It is nevertheless possible that cash flow assumptions and projections do not materialize as expected, requiring alternative measures and procedures to be developed and implemented in order to prevent such a situation from occurring and, where applicable, to manage and control that situation adequately. For that purpose, specific measures must be included in the policies and procedures for, in particular, implementation of: • rules for adequate diversification of sources of funds so that the institution does not

unduly depend on one type or a limited number of types of elements generating cash inflows;

• specific criteria governing the choice and characteristics of liquidity instruments to be

maintained, considering in particular that they must have a minimum credit risk exposure level, be readily convertible to cash or be traded on an organized market;

• rules defining the nature and sources of external financing to be used, where

necessary, to offset a liquidity deficiency; and • measures and procedures to be implemented in case of the inability of an institution to

generate enough sources of funds to meet its commitments when they fall due or when the institution finds it difficult to have access to external sources of funds to allow it to remedy that inability.

- 39 -

Monitoring and Control Procedures Finally, the sound governance of liquidity practices requires the implementation of procedures and measures to ensure monitoring of the policies and procedures established as well as their constant appropriateness for the institution’s needs and activities. The content and frequency of the controls and reports which directors may use to ensure the monitoring and appropriateness of the framework must also be established.

- 41 -

j) Derivatives Derivatives are contracts whose value depends on that of an underlying primary asset, rate or index. Financial institutions using that type of instrument are faced with the same types of risk as those using traditional securities only. Credit risk, liquidity risk and market risk (interest rate risk, currency risk, equity price risk and commodity price risk) are the main sources of risk. Derivatives may be used for three purposes: hedging, arbitrage and speculation. Given the extent of the leverage that some of those categories may cause through the potential range of gains and losses, the Autorité des marchés financiers considers that the implementation of policies, management structures and control procedures must always prevail, considering the insurer’s level of activity in that area, except if that activity is expressly excluded of the investment policy. The level of detail of policies and procedures could vary depending on the level of use and of complexity of derivatives but they must include at least the objectives pursued, procedures for approval of use of new derivatives, procedures for approval of counterparties and brokers, limits for use, levels of authorization, accountability to the board of directors and, finally, efficient procedures for monitoring the activity. The Autorité however feels that derivatives used for speculation require higher levels of expertise and control in order to exercise rigorous management in keeping with the degree of risk exposure. In that context, the Autorité expects each insurer using derivatives to develop, implement and review at least once a year policies and procedures enabling the following objectives to be met: • identification of derivatives which managers are authorized to transact and the related

limits; • application of appropriate processes and measurements to calculate the insurer’s

exposure to various financial risks; • monitoring and control of hedging positions including a measure to assess their

efficiency;

- 42 -

• application of administrative procedures and use of adequate information and documentation systems to monitor the application of qualitative and quantitative policies and procedures implemented under this section.

Insurers using external resources in risk management and/or derivatives trading must ensure that the policies and procedures adopted under this chapter apply mutatis mutandis. ...Relevant considerations The considerations which, in the Autorité’s opinion, must be taken into account in the definition of policies and procedures, supervision, monitoring and control of the risks inherent to derivatives are presented below. Target Activities and Thresholds An insurer must invest its funds as a prudent and reasonable person would do in similar circumstances. This principle which must govern all activities in loans and investments is all the more important in conducting derivatives activities. Inappropriate use of these instruments could result in excessive risk taking whereas the effect sought is rather more efficient management of financial risks. There are many derivatives on the market, each one having its particular features. Managers must have extensive knowledge of the derivatives they will use in hedging strategies. The choice of derivatives whose use will be authorized must above all be determined by knowledge and mastery of those instruments. That choice should also be based on the following criteria: • whether the risk can be assessed (measured); • liquidity of the market; • availability of an independent audit of the price of the derivative; • solvency of the counterparty; • adequacy of the insurer’s capital.

- 43 -

The Autorité des marchés financiers believes that the establishment of clear, precise limits expressed on the basis of a significant measurement unit is fundamental from a sound governance point of view. Those limits should be defined according to the type of risk exposure as described in one of the following headings. Market Risk (Currency Risk, Interest Rate Risk, Equity Price Risk) The criteria set forth in the preceding sections of this guideline concerning the management of those risks also applies to derivatives. The analysis and assessment of the various market risk components must precede the establishment of hedging strategies because these strategies basically aim to contain them. However, derivatives are themselves subject to market risk. Therefore, the Autorité considers that the risk management process cannot be effective without an overall assessment of the risk. Derivatives must therefore be considered in the context of an integrated assets/liability management strategy. The Autorité does not intend to require a precise method for assessing the risk. The technique and indicators chosen must, however, be based on the following criteria: • risk measurements represent the possible impact of adverse changes in market

conditions on the financial earnings of the institution and on the value of the business; • the technique allows the risk to be assessed on a timely basis depending on the

volatility of the markets on which the institution has positioned itself. In addition, risk assessment should include use of stress scenarios. Liquidity Risk Liquidity risk is present when the terms of contracts make it difficult to unwind a position on the market through a reverse transaction or otherwise. These conditions are present especially on the over-the-counter market where the terms of each contract are customized. The institution must define a measure of the risk and exposure limits.

- 44 -

Credit Risk One of the important risk components associated with use of derivatives is the counterparty default risk. That risk may be slight when derivatives are traded on an organized market because clearing houses act as a counterparty. However, on the over-the-counter market, each party is exposed to the risk of the other defaulting. Credit limits must therefore be established in accordance with the principles set forth in section b) of this guideline (section on credit). Moreover, the institution must ensure that its staff responsible for credit analysis has minimum qualifications for analyzing credit risk in derivatives. Credit limits per counterparty (maximum exposure and eligible counterparties) and for all counterparties must be incorporated into the overall credit risk limit of the institution. Use of bilateral and multilateral netting agreements with counterparties could be an efficient way to reduce credit risk. Before calculating the credit risk on a net basis, the institution must ensure that the netting agreements are enforceable under the laws of the relevant jurisdictions. Systems Risk Systems risk is mainly the possibility that traders and managers use unreliable financial data. Access to reliable, independent data should be ensured on an ongoing basis. In addition, a failure of information and documentation systems could have dire consequences on the risk level. Mechanisms must be put in place to ensure that in case of failure, market positions will not remain open involontarily. Legal Risk Before trading on the derivatives market, the institution must ensure that the counterparties are legally empowered to carry out that type of transaction. Similarly, special attention must be given to the terms of over-the-counter contracts and to netting contracts.

- 45 -

Monitoring and Control Procedures Given the magnitude of the risks with which institutions using derivatives could be faced, the Autorité des marchés financiers is of the opinion that an independent risk management and monitoring function must be set up, especially when justified by the volume of the activities and their purposes. The sound governance of derivatives practices requires implementation of procedures and measures to ensure compliance with policies and their constant appropriateness with regards to the institution’s needs and activities. The risk management function should have the following responsibilities and features: • be, when the volume and the purposes justify so, independent from the front office and

from the back office; • set detailed limits for each type of risk; • set limits on transactions to be applied to each trader in absolute amounts; • note and report each time the limits referred to above have been exceeded; • define risk measures and design stress tests; • ensure an independent evaluation of the positions and of the market value of the

financial instruments used; • evaluate gains and losses with a given frequency ; • evaluate the efficiency of hedging positions taken on the market; • define the responsibilities of all the staff and services involved, in particular the front

office and the back office, in the use of derivatives, considering an adequate segregation of functions. This definition should include authorized operations, applicable limits and the resources responsible for accountability;

• ensure that the staff involved has adequate training; • ensure compliance with all policies and procedures involving derivatives; • regularly report to management and to the board of directors on the activity as a

whole; • send to managers the results of their controls (feedback). In some situations, only the initial reason for a transaction allows a hedging strategy to be differentiated from a speculative strategy. The risk management division must therefore ensure that the purpose is clearly defined and that each strategy involving the use of derivatives products is well documented.

- 46 -

Only a clear, comprehensive process in risk monitoring and in accountability will allow management and the board of directors to be sufficiently informed of the risk exposure. The information addressed periodically to the board of directors should be easy to understand and in an accessible form.

REVISED APPENDIX

Attestation of Compliance by Board of Directors Each institution must ensure implementation of the Guideline of the Autorité des marchés financiers regarding Sound Risk Governance for Life Insurers (“Guideline”). From the 2000 fiscal year onwards, each institution must complete the form below attesting that it complies with the expectations specified therein or that it undertakes to do so. Parts I and II of the form and, where applicable, Part III, must be sent to the Autorité des marchés financiers with the annual return.

Autorité des marchés financiers

COMPLIANCE ATTESTATION FORM

PART I Corporate Name of Insurer Fiscal Year I, the undersigned, confirm that the members of the board of directors have adopted a resolution dated YY/MM/DD stating that: I. they are aware of the expectations presented in the Guideline of the Autorité des marchés

financiers for sound risk governance; II. they have the assurance, as indicated in Part II of this form, that the policies and procedures

provided for in the Guideline have been developed and implemented and are adequately monitored;

and, where the members of the board of directors indicate in Part II of this form that the insurer does not comply with one of the themes provided for in the Guideline, the resolution must also include the following paragraph in consideration of Part III of this form:

III. in areas where this assurance has not been obtained, the directors specify the action plan envisaged to remedy the situation and the period allotted for that purpose.

Signature of Secretary Date For further information, the Autorité may contact:

Tel.:

PART II Corporate Name of Insurer Fiscal Year The insurer must use the table below, checking one of the four items for each theme.

Theme Theme does not apply

Theme is not important

The insurer complies

with Theme

The insurer does not

comply with Theme

Internal Control Risk Governance: • Capital • Credit • Foreign Exchange Risk • Portfolio Investments • Real Estate • Product Design and Pricing • Underwriting and Liability • Interest Rate Risk • Liquidity • Derivatives Explanations: The board of directors must provide explanations where it indicates that the insurer does not

comply with a theme or where it indicates that a theme does not apply or is not important.

PART III

Corporate Name of Insurer Fiscal Year For each theme with which the insurer does not comply, the insurer must attach an action plan describing the measures envisaged to remedy the situation and specifying the period allotted for that purpose.