Operational Risk Capital for Health Insurers: A Primer

  • Operational risk is the concept that a bank’s or other financial company’s own actions or lack of preventive measures could lead to losses, as opposed to those from outside influences from negative economic or market forces.
  • Analysts estimate that removing backward-looking operational risk capital requirements would free up over $200 billion in capital at just the four largest U.S. banks – a number that could stretch far higher across the entire banking sector.
  • The implications for health insurers are significant. If regulators implement a 3 percent operational risk capital surcharge for health insurers, it could result in over $3.8 billion in capital forced to be set aside, with the implication of increased premiums, decreased choice, and less competition for consumers.


Operational risk is the concept that a bank’s or other financial company’s own actions or lack of preventive measures could lead to losses; in contrast to those losses from outside influences from negative economic or market forces. Most often the threat of class action or other lawsuits that would result in large settlements is given as a prime example of operational risk. And like other capital requirements, operational risk capital is the increased amount of capital that regulators require companies to hold to cover any such expected operational losses.

The notion of operational risk and capital held to protect against its losses did not exist prior to 2008. Only with the advent of poor subprime underwriting, problems with securitization, and – especially – the need to settle lawsuits and pay government penalties spawning from the financial crisis has it been implemented and taken on any importance. And, until recently, operational risk and operational risk capital were concepts that applied only in the financial services sector. Earlier this year, the National Association for Insurance Commissioners (NAIC) proposed to add an operational risk capital surcharge for health insurers, and it is meeting this week to potentially decide on what that surcharge should be. Operational risk capital makes a questionable contribution to safety and soundness in the banking and financial industry, and it’s even more questionable for health insurers when the unique attributes of their business models are taken into consideration.

Operational risk capital in the banking sector

The concept of operational risk for banks suffers two main flaws. First, it is generally calculated based on banks’ past actions, not on the future outlook. It is not filling the role or providing a cushion against the unforeseen future. Second, it feeds the regulators’ conceit that there is actually a way to identify individual types of risks and calculate the appropriate capital charge for each. And as with other capital charges, operational risk capital results in banks having less capital available to lend out, invest, or return to shareholders.

When the House Financial Services Committee passed the CHOICE Act earlier this year, it included a 93-word provision that would eliminate the concept of backward-looking operational risk entirely. Specifically, it mandates that the agencies that oversee banks “may not establish an operational risk capital requirement for banking organizations, unless such requirement is based on the risks posed by a banking organization’s current activities and businesses; is appropriately sensitive to the risks posed by such current activities and businesses; is determined under a forward-looking assessment of potential losses that may arise out of a banking organization’s current activities and businesses, which is not solely based on a banking organization’s historical losses; and permits adjustments based on qualifying operational risk mitigants.”

In sum, the CHOICE Act seeks to move from backward-looking to forward-looking assessments of risk to create a safer, sounder financial system. Getting rid of operational risk capital in the banking sector would also free up much needed capital for small business lending that continues to lag since the crisis. Some analysts estimate that removing backward-looking operational risk capital requirements would free up over $200 billion in capital at just the four largest U.S. banks – a number that could stretch far higher across the entire banking sector.

NAIC’s operational risk proposal for health insurers

Earlier this year during a conference call, NAIC’s Operational Risk Subgroup of the Capital Adequacy Task Force discussed adopting a risk factor for the basic operational risk add-on method. The read out that followed spells out NAIC’s plans to implement an additional portion of risk based capital to account for operational risk to apply to life, property and casualty, and health insurers based on their internal research and study of other countries.

Specifically, NAIC decided to implement a 3 percent add-on charge for operational risk citing, among others, the following reasons:

“There are op[erational] risk events that are not captured on other risk categories, a primary example is cyber risk. Those events which are captured through historical data used for other risks in [risk based capital] may not reflect emerging operational risks.

There are clearly similar calibration issues being confronted by other advanced insurance regulators around the globe and therefore there is heavy reliance on supervisory judgment rather than op[erational] risk data.

A review of standard methodologies used in other advanced jurisdictions indicated a target level range from approximately 3 percent (although in Bermuda it can be as low as 1 percent for some firms after qualitative considerations) to an estimated 16 percent of industry-wide capital requirements. Some target levels are pre-diversification and some post. The subgroup’s post diversification add-on is set at the low end of the spectrum for the ratio of operational risk to total capital requirement in order to recognize the lack of precision and uncertainty about the extent of embedded operational risk.”

There are several concerns with this reasoning. First, the fact that NAIC admits that they are relying on other countries instead of any sort of operational risk data from the United States is troublesome. This is not unlike the concerns AAF has expressed in the past with the Financial Stability Oversight Council (FSOC) simply following the lead of the international Financial Stability Board (FSB) instead of charting its own path. Certainly there is sufficient national data on operational risk and operational risk capital in other financial sectors to aid NAIC in their decision making. Second, it is clear from its last reason, above, that NAIC arbitrarily chose a 3 percent add-on as its target level based on nothing more than aiming for the low end of the spectrum because of its uncertainty about operational risk. Sure, operational risk is a difficult (if not impossible) metric to quantify (especially when attempting to use backward-looking data to formulate a forward-looking charge), but a more thorough consideration of an appropriate target level should be expected.

The temporary good news, however, is that NAIC’s Capital Adequacy Task Force met in June of this year, and, while it decided to adopt an additional charge for operational risk for all lines of insurance, it voted only to adopt a factor of zero percent for the remainder of 2017. That means that insurers will not be subject to an additional risk based capital charge to account for operational risk, but the zero percent factor is there as a placeholder until NAIC can decide exactly how much extra capital it should require beginning in 2018 or later. The bad news is that NAIC is continuing to move toward a substantial operational risk capital surcharge for all lines of insurance, including health insurers, which stands to pose significant financial threat to those companies and their consumers.

Health insurers are very different than banks

It should not need to be said, but health insurers’ business models are very different than banks’ business models. AAF has previously explained why backward-looking operational risk is a poor safety and soundness policy for banks, but the case can at least be made that banks’ interconnectedness and asset allocation necessitate some level of capital to protect against forward-looking operational risk. Health insurers on the other hand are neither interconnected nor have potentially-risky asset allocations that would subject them to the need for capital to protect against either forward- or backward-looking operational risk.

The case can also be made that at times before financial crises, the U.S. banking system was undercapitalized. That has not been the case with health insurers. And for the health insurers that recently have become insolvent, namely the Exchanged-based Co-Ops, no evidence exists that their insolvency was a result of undercapitalization due to operational risk. NAIC’s 3 percent proposal suggests that U.S. health insurers are undercapitalized by 3 percent, and that is simply not the case.

Health insurers are very different than other insurers

The health insurance business is short-tailed, meaning that the losses for its product lines are recognized and paid for shortly after the loss occurs. On the other hand, life insurance and property and casualty insurance are typically longer-tailed because there is significantly more time between loss and pay out. This distinction marks a critical difference when assessing risk and the amount of capital necessary to hold to control for it. In fact, as technology advances, the tail of the health insurance business becomes even shorter. With electronic claims submissions now making up the majority of health insurance activity, as well as prompt pay laws, an overwhelming majority of claims are received almost immediately and paid within just two to three months from the date of service. As a result, operational concerns are generally realized and handled within similar timeframes, again, more quickly than traditional lines of insurance.

U.S. Health insurers are very different than health insurers around the world

As was stated above, NAIC seems to be basing its decision to add an operational risk surcharge based almost entirely on the fact that other countries also have operational risk surcharges for their health insurers. Following along for the sake of following along is never good policy, but it is important that NAIC not lose sight of the stark differences between U.S.    health insurers and those in other jurisdictions.  Even just comparing other lines of U.S. insurance to their counterparts in countries like Australia, Bermuda, Japan, and Canada, as NAIC does in its proposal, it fails to recognize the stark differences in regulatory structure, economic climate, and business models. Even worse for the health insurance market, NAIC continues to compare these countries to the U.S. when many of them have a nationalized healthcare system that could not be more different from the health insurance market here. Using those countries as a basis for implementing similar policies in the U.S. is comparing apples to oranges.

Operational risk capital is bad policy for health insurers

Similar to the over $200 billion in operational risk capital that is currently tied up among our nation’s four largest banks, implementing an operational risk capital surcharge for health insurers would tie up billions of dollars that could otherwise be spent on research and development, returns to shareholders, or any number of consumer improvements. An AAF analysis found that a 3 percent operational risk requirement for health insurers would require at least $3.78 billion in capital to be set aside.

And, like any other new regulatory cost, this one too will be borne by the consumer in the form of higher premiums, fewer choices, and less competition. It likely will render some health insurers unsustainable and will force them to withdraw from markets completely. At a time when so many Americans are already facing reduced health insurance provider choices, further reducing those options in the name of an ill-conceived capital surcharge is a policy failure at the most basic level. Similarly, as the health insurance market faces heightened uncertainty and instability, levying additional regulatory costs on health insurers runs the risk of becoming more of a burden than they are able to bear.


NAIC’s operational risk capital surcharge for health insurers remains at zero for now, but that could soon change. NAIC is meeting this week, and it could vote to raise it to 3 percent or higher. Once it does so, there will then be a formal and complete adoption of the operational risk based capital proposal for all lines of insurance, and that could easily have damaging consequences.