FAQs - UK regulatory approvals for insurance M&A

As the pace of M&A activity in the UK insurance and re-insurance sector increases, it is important for prospective overseas buyers to understand the process for obtaining approvals from the UK regulators; the Prudential Regulation Authority ("PRA") and the Financial Conduct Authority ("FCA"), together, the "UK Regulators".

Insurance and reinsurance companies (an "insurer") are supervised by both the PRA and the FCA. This is known as "dual regulation". The PRA, which is part of the Bank of England, is primarily responsible for the prudential supervision of insurers, ensuring financial soundness and market stability. The FCA has primary responsibility for supervision of conduct of insurers.¹ On a change of control of a UK insurer, the PRA takes the lead; but consults with the FCA.

This high-level note considers:

• frequently asked questions relating to the key legal, regulatory and strategic issues which overseas buyers need to consider as they navigate the process of obtaining approvals from the UK Regulators, and
• the change in control requirements applicable to insurers (not insurance intermediaries) and excluding any specific considerations applying to members, managing agents, brokers and coverholders of Lloyds of London.²

Which regulations govern the change in control approval process?

The change in control regime is primarily set out in Part XII of the Financial Services and Markets Act 2000 ("FSMA") (see sections 178-191). This is supplemented by the FCA Handbook (notably SUP 11 Controllers and Close Links), the PRA Rulebook, and detailed guidance such as the PRA and FCA's policy and supervisory statements "Prudential Assessment of Acquisitions and Increases in Control".

When is a change of control notification and approval triggered on a share sale?

Under the FSMA, a prospective "controller" of an insurer must notify and seek approval of the UK Regulators where it makes a decision to acquire (alone or acting in concert with others):

• 10% or more of the shares (directly or indirectly) in an insurer or its parent company;
• 10% or more of the voting power (directly or indirectly) in an insurer or its parent company; and/or
• shares and/or voting power (in any amount) in an insurer or its parent company as a result of which it will be able to exercise "significant influence" over the management of the insurer or its parent company.

Existing controllers in an insurer must also seek further approvals from the UK regulators when their threshold of shareholding and/or voting power passes 20%, 30% and 50%. 

The concept of "significant influence" is a key element of the change in control regime, capturing other arrangements where control is exercised below percentage thresholds. The UK regulators have set out a non-exhaustive list of factors that are relevant to determining whether an entity in the buyer group is able to exercise significant influence. These include: (i) the ability to appoint and remove members of the board of the insurer; (ii) the ability to direct or influence the decisions made by the board; (iii) the existence and/or control of material and regular transactions between the entity and the insurer; (iv) veto rights over material matters in relation to the operations of the insurer, such as changes to its business plan and strategy; and/or (v) additional rights exercisable against the insurer by virtue of any contract, articles of association or other shareholder arrangements.

Typically, multiple "controllers" will be identified in the buyer group using the tests under the FSMA. Pre-closing and post-closing restructurings of the insurer group will also trigger requirements for change in control approvals at each stage. As a result, sufficient time must be allocated in the transaction timetable for (a) the legal analysis on which entities will become controllers at each stage of the restructuring and (b) completion of the statutory period in which the UK regulators assess changes in control.

It is worth noting that it is the buyer's responsibility to submit the change in control forms (which are in a prescribed format) to the UK Regulators. Typically, approval by the UK regulators is a condition precedent to closing the acquisition. The change in control notification forms are delivered after signing of the relevant share purchase agreement but prior to closing/completion of the acquisition. That said, the UK regulators expect to receive a notification before a share purchase agreement is signed. An obligation to notify the FCA also applies to the target company where it becomes aware of a change in control. For the seller of an insurer, as an existing controller, where it reduces below the specified thresholds in the FSMA or ceases to hold any shares or voting power, it is required to notify (but not seek the consent of) the UK Regulators.

Is a change of control approval triggered on a sale of a book of business/policies (i.e., an asset sale)?

No. There is no change in control approval required from the UK Regulators for this type of business transfer.

The transfer of a portfolio of insurance business/policies of a UK insurer is usually undertaken under a statutory process set out in Part VII of the FSMA. This is known as a "Part VII transfer". This enables the transfer of the portfolio of insurance asset, liabilities and policies from one insurer to another, subject to approval from the court. A court approved transfer scheme is agreed, setting out the terms upon which the business will transfer. Before the court may sanction the transfer scheme, an independent expert is required to assess and report on the impact of the transfer on policyholders and other interested parties. Insurers are required to consult with policyholders, giving them the option to object. A Part VII transfer is a time-consuming and costly process, typically taking more than 12 months.

Notwithstanding that there is no regulatory change in control approval required, there may be other approvals necessary under the PRA Rulebook and FCA Handbook connected with the acquisition which are applicable to both share sales and business acquisitions. These include UK Regulatory approvals relating to:

• changes in senior management/certain board members of the insurer requiring approval under the UK Regulators' senior manager regime as set out in the PRA Rulebook and FCA Handbook;
• compliance with and restrictions on remuneration of senior managers and certain board members as required under Solvency UK (in particular, variable remuneration); and
• approval of any applicable internal models and valuation methods for calculation of solvency capital requirements for UK insurers under Solvency II (where relevant).

What assessment criteria do the UK regulators use to consider prospective controllers?

The assessment criteria under the FSMA are:

• the reputation of the prospective controller;
• the reputation and experience of any person who will direct the business of the UK insurer as a result of the proposed acquisition;
• the financial soundness of the prospective controller, in particular in relation to the type of business that the UK insurer undertakes (including, without limitation, its ability to comply with regulatory capital and liquidity requirements); and
• if the UK insurer is to become part of a group as a result of the acquisition, whether that group has a structure which makes it possible to (i) exercise effective supervision (ii) exchange information among regulators; and (iii) determine the allocation of responsibility among regulators.

The UK Regulators may impose conditions to its approval of a change in control (e.g., additional capital requirements or divestment of certain non-regulated businesses, etc.).

What documentation needs to be submitted for the change in control approval process?

The process for collation of all necessary documentation is time-consuming and labour intensive and typically needs to begin before execution of the share purchase agreement. The change in control application forms are in a prescribed format and are typically completed with the assistance of legal counsel. Information will need to be provided on, amongst other things, the following:

• audited financial statements of the prospective controller for the last three financial years, including balance sheet, profit and loss accounts, annual reports and financial annexes;
• information relating to business of the prospective controller, including applicable business segments and financial and non-financial relationships with any current shareholders, board members and/or senior management of the UK insurer being acquired;
• information on directors of (and senior management who run the business of) each prospective controller, including CVs;
• information on parent companies which control the prospective controller (controllers of the controller);
• information on any existing or historic civil or criminal proceedings, business and employment issues and regulatory sanctions impacting the controllers, its directors and senior management;
• pre/post-acquisition structure charts showing all entities in the UK insurer group and prospective controller group meeting requisite shareholding and voting power thresholds;
• information relating to the transactions, including terms of the share purchase agreement, any applicable acquisition financing, any share capital restructuring or other group reorganisation; and
• a regulatory business and strategic development plan setting out short-, medium- and long-term goals including a capital adequacy forecast, acquisition due diligence report highlights, three-year financial forecast for the insurer, changes in governance arrangements and outsourcing/systems/compliance frameworks and plans for ongoing compliance/remediation with FCA consumer duty for insurers active in retail markets.

Ensuring the accuracy and completeness of information submitted is critical. It is a criminal offence under the FSMA to knowingly or recklessly give the UK Regulations information that is false, misleading or deceptive.

Further considerations for PE and hedge fund investors

Under the UK Regulators' policy and supervisory statements "Prudential Assessment of Acquisitions and Increases in Control", specific information requirements may apply to buyers who are private equity funds or hedge funds acquiring 20% or more of a UK insurer. These additional requirements include:

• detailed description of previous acquisitions of regulated and unregulated financial institutions;
• information on investment policy, monitoring and exit strategies; and
• decision making and governance frameworks, including key personnel with overall responsibility for fund investment.

What change of control approvals apply where the insurer is incorporated outside the UK but has a UK branch supervised and licenced by the UK Regulators?

Third-country branches (i.e., UK branches of foreign (re)insurance companies) do not need UK Regulators' approval for changes in control. The appropriate procedure for change in control will occur in the jurisdiction where the insurer is incorporated (i.e., by its home state regulator). Typically, the UK branch will notify the UK Regulators that a change of control is taking place and advise when the foreign regulatory approvals will be obtained. 

What is the approach to group supervision and individual/group capital requirements when acquiring a UK insurer?

Individual/Solo capital requirements: In the PRA Rulebook, the Solvency UK set out the rules on capital requirements at the insurer entity level and the group level and group supervision requirements.

• Excluding any additional capital add-ons which the PRA has powers to impose in certain circumstances, under Solvency UK an insurer is subject to detailed requirements relating to (i) a minimum capital requirement and a solvency capital requirement (known as "SCR") which represents the amount of capital an insurer requires to operate as a going concern on a value at risk measure over a period of one year and (ii) a reserve requirement of certain assets to meet its estimate future liabilities under its insurance policies. Assets held by the insurer over and above these amounts may be available for distribution as a dividend to shareholders. As such, due diligence on ongoing and future compliance capital requirements is a significant area of focus for prospective buyers.
• Some UK insurers will calculate their SCR based on a standard formula set out under the regulations. Others, with PRA approval, will be permitted to use their own internal models which are calibrated and tailored to the individual risk and business profile of the relevant insurer. Where the buyer is part of an insurance group, the integration of internal models for group risk and capital planning and management post-acquisition, will be a key area of consideration by the PRA.

Group capital requirements: The group SCR under Solvency II is an aggregate capital requirement calculated at the level of the ultimate parent undertaking which is the top holding company within the group which has its head office in the UK or Gibraltar. This is often, but not always the "insurance holding company" which is defined under Solvency II as a parent undertaking whose business is to acquire and hold participations in insurance companies. Where the buyer is not an insurance group, then the ultimate parent undertaking may be a "mixed activity insurance holding company;" this is an entity which is a parent undertaking of an insurer but is not an insurance holding company. An entity only qualifies as a "parent undertaking" where it has, amongst other things, a majority of the voting rights or the capacity to exercise dominant influence, e.g., power to appoint/remove the majority of the board. The group, for the purposes of the SCR, will include the ultimate parent undertaking, the insurer, and the insurer's direct and indirect parent and subsidiary undertakings. Where the relevant insurance holding company is placed in the group is often driven by a combination of group capital, group supervision and tax considerations.

Group supervision requirements: The PRA exercises direct and indirect supervision over insurance holding companies (as well as the insurer) as part of its group supervision mandate. Where a group, for which the PRA is the group supervisor, wishes to exclude entities from the scope of group supervision, it must apply to the PRA for approval. The PRA may require a group to establish an intermediate holding company in the UK for group supervision purposes. For groups with cross-border activities, the PRA coordinates with other national and international regulators to ensure effective group-wide supervision. There is scope under Solvency II for the PRA to waiver group supervision requirements. For cross border group predominantly weighted in the European Union, the PRA has agreed that the relevant EU national supervisor(s) may exercise group supervision. Equally, under regulatory equivalence arrangements under Solvency II and/or where the PRA has co-operation agreements with certain other regulators (e.g., in the United States, Switzerland and Bermuda) under which a UK insurer may apply under the PRA Rulebook for group supervision to be waived in favour of an offshore regulator (e.g., the Bermuda Monetary Authority).

Which assets must be carved out of any security package where the acquisition is financed by third-party debt?

In the regulatory business and development plan submitted to the PRA as part of the change in control approval, the buyer will need to provide information relating to any acquisition financing, including any security granted.

Any share security over the equity in the UK insurer or insurance holding company may only be enforced by third-party lenders where UK Regulators' approvals have been granted.

The security package will need to exclude, amongst other things: (i) amounts constituting SCR, other regulatory capital and the reserve requirements under Solvency II; (ii) assets and monies expressly held to and for the benefit of (or on trust for) policyholders; (iii) custody and segregated accounts (client money and assets); (iv) reinsurance receivables which are subject to restrictions on assignments; and (v) ring-fenced assets held as part of its long-term insurance business under section 37 of the FSMA.³

There may also be restrictions on entities within the UK regulated insurance group from granting guarantees to any third-party lender or financier as this may have an impact on regulatory capital calculations.

How long do the UK Regulators have to approve/reject a change in control application?

Under section 178 of the FSMA, the UK Regulators have up to 60 business days to assess a change in control application; this is known as the assessment period. The assessment period does not commence until the UK Regulators have confirmed to the buyer that they have received all information required in connection with the application. The assessment period can be interrupted for up to a further 20 working days (or 30 working days for an overseas buyer) if the relevant UK Regulator requests further information. Typically, delays are associated with the application being "incomplete" because the UK Regulators require clarification or further information when the change in control application form and supporting documents are initially submitted.

It is standard market practice for these documents to start to be prepared in the final stages of preparing the share purchase agreement to give sufficient time for collation of information and also for all structural issues associated with the transaction to be finalised.