NAIC Credit Rating Provider (E) Working Group Moves Toward Adoption of Due Diligence Framework

The Credit Rating Provider (E) Working Group (“CRP WG”) of the US National Association of Insurance Commissioners (“NAIC”) met on August 12 and October 1, 2026, and exposed a revised draft of its proposed Credit Rating Provider (“CRP”) Due Diligence Framework (“CRP DD Framework”) for a comment period ending October 26. The CRP WG’s goal is to finalize the CRP DD Framework for adoption before the end of 2026.

Background: The NAIC Filing-Exempt System

The NAIC Valuation of Securities (E) Task Force (“VOSTF”), a subgroup of the Financial Condition (E) Committee (“E Committee”), implemented the filing-exempt (“FE”) system in 2004. The FE system is a labor-saving alternative to requiring the NAIC Securities Valuation Office (“SVO”) to perform its own investment risk assessment of every fixed-income security owned by a US insurer.

Under the FE system, if a security has a rating assigned by an NAIC-recognized CRP, then in most cases it will automatically receive the NAIC designation equivalent to that CRP rating. There are certain categories of securities that are ineligible for the FE system, notably including (i) securities that involve credit exposure to an affiliate of the insurer and (ii) securities that fail to satisfy the NAIC principles-based bond definition. When the CRP rating is a private letter (“PL”) rating, then the private rating letter rationale report generally must be submitted to the SVO in order for the PL rated security to qualify for the filing exemption.

Currently, the NAIC recognizes as CRPs all of the nationally recognized statistical rating organizations (“NRSROs”) that are registered with the US Securities and Exchange Commission (“SEC”). Each CRP rating is automatically mapped onto a corresponding NAIC designation category. In 2024, more than 152,000 securities received their NAIC designations based on their CRP ratings.

Reasons for Developing A CRP DD Framework

In recent years, SVO staff and others within the NAIC have expressed concerns that the NAIC should not “blindly rely” on CRP ratings. Those concerns were crystallized when the concept of a due diligence framework to support the NAIC’s use of CRPs was included within a larger document, Framework for Regulation of Insurer Investments—A Holistic Review. At the NAIC Summer National Meeting in August 2023, the E Committee exposed for comment an initial draft of the Holistic Review document, to which it has subsequently made revisions. In June 2025, the NAIC engaged PricewaterhouseCoopers (“PwC”) to help develop the CRP DD Framework along the lines suggested in the Holistic Review document. On January 1, 2026, when the VOSTF was reorganized into the Invested Assets (E) Task Force (“IATF”), with its three underlying working groups, the responsibility for bringing the CRP DD Framework to fruition was assigned to one of those working groups—the CRP WG.

Initial Draft of the Framework

On May 4, 2026, the CRP WG exposed for a 60-day comment period a white paper prepared by PwC, outlining a CRP DD Framework that is designed to:

• Support consistent translation of CRP ratings to NAIC investment risk designations;
• Focus due diligence activities where CRP ratings are most consequential on insurer balance sheets and where there are areas of increased risk in CRP-provided ratings; and
• Establish a structured and governed process for remediation activities, monitoring, and ongoing maintenance.

Discussion of the Initial Draft

On August 12, 2026, the CRP WG met at the NAIC Summer National Meeting to discuss comments that had been submitted on the draft white paper.

The CRP WG Chair, Jake Garn of the Utah Insurance Department, noted that some commenters had expressed concerns that the CRP DD Framework could draw the NAIC into prohibited regulation of NRSROs, a role reserved to the SEC under Section 15E of the Exchange Act and the 2006 Credit Rating Agency Reform Act (“CRARA”). Responding to those concerns, Chair Garn emphasized that (i) neither the NAIC nor the CRP DD Framework will prescribe CRP methodologies or dictate how CRPs perform their analytical work; and (ii) the CRP DD Framework is not intended to make the NAIC a regulator of NRSROs, but rather a more responsible, educated user of NRSRO ratings within its own investment risk designation framework, in alignment with the objectives of CRARA.

In advance of the August 12 meeting, NAIC staff published a document responding in detail to questions received on the first draft of the CRP DD Framework.

At the conclusion of the August 12 meeting, the CRP WG directed the SVO to work with PwC to prepare a revised draft of the CRP DD Framework, taking into account the comments received and the discussion of those comments.

Exposure of a Revised Draft of the CRP DD Framework

On October 1, 2026, the CRP WG met again and exposed for a 25-day comment period a revised draft of the white paper outlining the proposed CRP DD Framework. Comments are due on October 26, 2026. The relatively short comment period is consistent with the CRP WG’s stated objective of adopting the CRP DD Framework before the end of 2026.

Responding to a number of the comments received on the initial draft, the revised draft of the white paper includes a new paragraph acknowledging that methodological differences among CRPs exist and clarifying that the CRP DD Framework does not require CRPs to adopt a uniform methodology: “Rather, as a consumer of CRP-provided mappings, the NAIC’s due diligence procedures assess whether resulting ratings and related mappings are reasonable and fit for purpose in evaluating investment risk and assigning NAIC Designations.”

Guiding Principles of the CRP DD Framework

The revised draft of the white paper sets out three guiding principles for the CRP DD Framework:

1. Pragmatic approach: Focusing on areas where the CRP ratings have the greatest potential impact on the insurance industry or an insurance company’s solvency. There is a statement that risk assessment and detailed testing procedures are aligned to industry exposure, data history and observed rating variability, ensuring that diligence activities are both effective and efficient.
2. Scalable: Designed to scale with the continued growth and changing composition of insurer balance sheets, accommodating the evolution of new asset classes, emerging risk types and changes in CRP methodologies, ensuring adaptability to shifting industry dynamics and regulatory priorities over time. There is a newly added statement that the NAIC expects the CRP DD Framework to evolve over time (i) with changing investment and market landscapes, (ii) as data availability, volume, and quality improve, and (iii) as the NAIC gains further implementation experience under the CRP DD Framework.
3. Transparency: All components of the CRP DD Framework—from data collection through scoping, risk assessment, testing, remediation, and governance—are to be documented and transparent. This ensures that key design components, diligence activities, quantitative and qualitative results, and remediation actions are communicated clearly, in order to reinforce confidence in both the process and its outcomes. There is a newly added statement that the NAIC believes that a prudent approach is to be transparent about the type of analysis that will be performed under the CRP DD Framework, the purpose of such analysis, and the basis for conclusions, without committing to publication of all underlying formulas and parameters.

Overview of the CRP DD Framework

Given the objective of corroborating the appropriateness of CRP‑provided mappings used in the NAIC translation matrix for FE/PL securities, the CRP DD Framework has the following four components (see the revised draft of the white paper for the details of each):

• Scoping assessment
  • Preliminary screening
  • Quantitative assessment
  • Qualitative assessment
• Risk assessment
  • Historical data analysis
• Detailed testing procedures
  • Methodology walkthrough and discussion with the CRP
  • Security specific rating review
  • Security specific rating methodology review
• Governance procedures
  • Annual report summarizing CRP due diligence findings
  • Review and approval of remediation actions
  • Updates and enhancements to CRP DD Framework

Provisional Acceptance of Current CRPs

Historically accepted CRPs will be provisionally accepted under the CRP DD Framework for a 36-month period following implementation (which may be extended by the CRP WG), provided that all three of the following conditions are satisfied:

1. The CRP continues to meet the acceptance criteria established in the Purposes & Procedures Manual;
2. No materially adverse findings related to a specific CRP are identified in the most recently available SEC (or other applicable jurisdictional) examination reports as of the implementation date; and
3. The CRP agrees to meet NAIC data call requirements to support the NAIC in the implementation and ongoing maintenance of the framework.

Potential Remediation Actions Under the CRP DD Framework

Remediation actions are divided into “Tier 1” and “Tier 2” remediation actions.

“Tier 1” remediation actions include the following:

• Watchlist/enhanced monitoring—applied in cases for minor deviations or data limitations where further observation is warranted before taking further remediation actions.
• Additional detailed testing scope—additional testing assigned to specific CRPs or asset classes where data is limited or preliminary findings indicate emerging risk or inconsistency or lack of comparability.

“Tier 2” remediation actions include the following:

• Requiring more than one CRP rating—in the event rating inconsistencies are identified and persist, the NAIC may require additional ratings to support FE or PL submissions.
• Translation matrix adjustment—implemented when systemic rating inconsistencies are observed for a given CRP or asset class, indicating misalignment between CRP ratings and NAIC designations.
• Removal of filing-exempt status for an asset class—triggered by repeated inconsistencies in CRP ratings for a given asset class.
• CRP de-admittance—considered in cases of persistent inconsistencies with rating methodology or outcomes.

In the case of CRP, WG remediation action determinations that are materially adverse to a CRP, a confidential and detailed explanation of the decision will be provided to the affected CRP, prior to any adverse decision being made public. The CRP will be able to present its opposition to the CRP WG in a regulator-only session, including explanatory context and any new materials. Any “Tier 2” remediation actions recommended by the CRP WG will be subject to approval “up the chain” by the IATF, the E Committee, and the NAIC Plenary.

Once a remediation action is finalized, a defined notice period of 120 days, consistent with existing filing requirements outlined in the NAIC Purposes & Procedures Manual, will be provided prior to implementation to mitigate significant market impact. All remediation actions will apply on a prospective basis only. CRPs subject to de-admittance may be permitted to reapply for CRP status at a later date.

Separate Process for Discretionary Challenges of the Use of CRP Ratings on Individual FE And PL Securities

Also bear in mind that the separate process whereby the SVO has the discretion to challenge the use of a CRP rating to determine the NAIC designation category for a specific FE or PL security is now fully operational. There is a summary of that process in our previous Legal Update, US NAIC Summer 2024 National Meeting Highlights: Investment-Related Initiatives.