Which insurers need an ORSA?
Every UK Solvency II firm, the Society of Lloyd’s and Lloyd’s managing agents. Rule 3.8(1) of the Conditions Governing Business Part of the PRA Rulebook says a firm “must conduct an ORSA as part of its risk-management system”, and the Part applies to all three (rule 1.1). Managing agents “must conduct an ORSA for each syndicate which they manage” (rule 12.3).
Smaller insurers can sit outside Solvency II altogether. Since 31 December 2024 a firm is excluded only if it meets every condition in Insurance General Application 2.3, including annual gross written premium of no more than £25 million and technical provisions of no more than £50 million for the firm and for its group. PS2/24 raised those thresholds from €5 million and €25 million (paragraphs 8.2 and 8.7). At implementation an existing firm dropped out only if it had stayed under the revised thresholds for three consecutive years and did not expect to exceed them in the following five (paragraph 8.10), and a firm outside Solvency II falls under the regime for non-Directive firms (paragraph 8.11).
What must an ORSA cover?
Three things at a minimum, set by rule 3.8(2): the firm’s overall solvency needs, its continuous compliance with the capital and technical provisions requirements, and how far its risk profile departs from the assumptions behind the SCR. Rule 3.8A then makes the whole assessment forward-looking.
| Element | What the rule asks | Rule |
|---|---|---|
| Overall solvency needs | The firm’s own view of its solvency needs, taking account of its specific risk profile, approved risk tolerance limits and business strategy, with proportionate processes to identify and assess risks in the short and long term | Conditions Governing Business 3.8(2)(a) and 3.8(3) |
| Continuous compliance | Compliance on a continuous basis with the SCR and MCR and with the requirements on technical provisions | 3.8(2)(b) |
| Matching adjustment and transitionals | Where the firm uses the matching adjustment, the volatility adjustment, the risk-free rate transitional or the TMTP, the compliance assessment run both with and without them | 3.8(4) |
| Deviation from SCR assumptions | The significance of the gap between the firm’s risk profile and the assumptions underlying the SCR, with the recalibration step where an internal model is used | 3.8(2)(c) and 3.8(5) |
| Forward-looking view | Risks the firm is or could be exposed to, including from changes in its strategy or in the economic and financial environment, operational risks included, and the nature and quality of the own funds to cover them, over the time periods relevant to its long-term risks | 3.8A |
The with-and-without test in rule 3.8(4) matters most to firms that rely on the long-term guarantee measures: it shows the board what its solvency looks like without a measure it depends on. The PRA also expects firms to follow EIOPA’s ORSA guidelines (SS41/15 paragraph 2.2), which ask for a quantification of capital needs, or a description of other means, for all material risks “irrespective of whether the risks are quantifiable or not” (Guideline 7).
How often is the ORSA run, and what goes to the PRA?
Regularly, and without delay after any significant change in the risk profile (rule 3.10). The EIOPA guidelines the PRA expects firms to follow add that an insurer “should perform the ORSA at least annually” (Guideline 14).
The results go to the PRA in an ORSA report (rule 3.11). Rule 2.5B(1) of the Reporting Part gives the deadline: “within 10 business days after concluding the ORSA”. The report must contain the qualitative and quantitative results and the conclusions the firm drew from them, the methods and main assumptions, a comparison of the firm’s own solvency needs with its regulatory capital requirements and own funds, and information on, and where significant deviations exist a quantification of, the quantifiable risks the SCR does not reflect (rule 3.12). The PRA “will review ORSA reports on a risk-based and proportionate basis” (SS41/15 paragraph 7.3).
Who owns the ORSA?
The board. Rule 3.9 requires the firm to “make the ORSA an integral part of its business strategy and take the ORSA into account on an ongoing basis in its strategic decisions”, and that can only be done by the people who take those decisions.
The EIOPA guidelines spell out the board’s part. It “should take an active part in the ORSA, including steering, how the assessment is to be performed and challenging the results” (Guideline 2), it approves the ORSA policy (Guideline 4), and the results go to staff once the board has approved them (Guideline 6). The firm should use the results in at least its capital management, its business planning and its product development and design (Guideline 13). The public solvency and financial condition report must also state “how often the ORSA is reviewed and approved by the firm’s governing body” (Reporting 3.3B(4)(b)).
A fair test for any board is whether it can name a decision the ORSA changed in the past year. Rule 3.9 assumes it can.
How does the ORSA link to the SCR, the capital plan and solvent exit planning?
The SCR is the regulatory yardstick the ORSA measures against, and the ORSA is where the firm says whether that yardstick fits. Rule 3.8(2)(c) asks how far the risk profile departs from the SCR’s assumptions, whether the SCR comes from the standard formula or an internal model, and rule 3.12(3) asks the report to compare the firm’s own solvency needs with its regulatory requirements and own funds.
The capital plan and the ORSA should be the same projection. Rule 3.8A asks for the risks that follow from the business strategy and for the nature and quality of the own funds that will cover them, and Guideline 13 puts the results into capital management and business planning. If the plan the board approves and the plan the ORSA stresses differ, one of them is out of date.
Solvent exit planning is the newest link. Since 30 June 2026 the Preparations for Solvent Exit Part has required UK Solvency II firms, non-Directive insurers and the Society of Lloyd’s, other than firms in passive run-off, to produce a solvent exit analysis and update it after any material change and at least every three years (rules 1.1, 1.2 and 2.1). SS11/24 lets a firm include the analysis “as a discrete section in its ORSA” and lets it draw on and adapt the scenarios developed in the ORSA’s stress and scenario testing (paragraphs 2.3 and 2.4). Our wind-down and solvent exit page covers the analysis in detail.
What did Solvency UK change for the ORSA?
Less than the name suggests. In PS15/24, published on 15 November 2024, the PRA restated the Solvency II law it inherited into its own Rulebook, with effect from 31 December 2024, aiming to do so “without material changes to the policy substance unless explicitly mentioned” (paragraphs 1.21 and 1.48). That is why the ORSA’s forward-looking requirement is now rule 3.8A of the Conditions Governing Business Part.
The PRA has said the regime “will eventually be known as ‘Solvency UK'” (PS2/24 paragraph 1.9). It expects firms to keep considering EIOPA guidelines where relevant (PS15/24 paragraph 1.27), and SS41/15 still asks firms to comply with the ORSA guidelines. Two changes around the ORSA matter more in practice: the higher Solvency II thresholds that took some small insurers out of the regime, and the solvent exit analysis that every insurer in scope has had to hold since 30 June 2026. Dated changes for insurers and banks are in our regulatory tracker.
Where do ORSAs usually go wrong?
Usually where the rule asks for the firm’s own judgement and the document supplies a restatement of the regulatory numbers.
- The SCR presented as the firm’s own solvency need, with no view of where the standard formula fits the business badly (rule 3.8(2)(a) and (c)).
- A point-in-time ratio, with no projection of the capital position through the plan and under stress (rules 3.8(2)(b) and 3.8A).
- A paragraph asserting that the SCR assumptions are appropriate, with no analysis behind it, when rule 3.12(4) asks for a quantification where the deviations are significant.
- The matching adjustment or the TMTP left in every scenario, so the board never sees the with-and-without view rule 3.8(4) requires.
- Results without methods, so the reader cannot tell what would change them (rule 3.12(2)).
- An annual document produced for the supervisor and not opened again until the next one, which meets the reporting rule and misses rule 3.9.
Our ORSA service writes, reviews or rebuilds the ORSA, including the forward-looking solvency projection in open Excel, and directors who want to prepare for the ORSA session can take board risk training. For how the ORSA compares with the bank and investment firm assessments, see which prudential assessment your firm needs.
Questions readers ask
How quickly must the ORSA report reach the PRA?
Within 10 business days after the firm concludes the ORSA (Reporting Part rule 2.5B(1)).
Does the ORSA have to use the standard formula?
No. The ORSA assesses the firm’s own solvency needs. Rule 3.8(2)(c) asks how far the risk profile deviates from the assumptions underlying the SCR, whether the SCR is calculated on the standard formula or an internal model.
Is the ORSA published?
The ORSA report goes to the PRA, not the public. The public solvency and financial condition report describes the ORSA process, how it fits into decision-making and how often the governing body reviews and approves it (Reporting 3.3B(4)).
Does a small insurer outside Solvency II need an ORSA?
The ORSA rules in the Conditions Governing Business Part apply to UK Solvency II firms (rule 1.1), so a firm excluded under Insurance General Application 2.3 is not caught by them. If it is not a friendly society, it must still carry out a capital assessment, identifying the risks to meeting its liabilities and quantifying the financial resources it needs to cover them, under the PRA’s overall resources rules for non-Directive insurance companies (SS43/15 paragraph 2.4). It does still need a solvent exit analysis, because the Preparations for Solvent Exit Part also applies to non-Directive insurers (rule 1.1).
Sources: PRA Rulebook, Conditions Governing Business Part, rules 1.1, 3.8 to 3.12 and 12.3; PRA Rulebook, Reporting Part, rules 2.5A, 2.5B and 3.3B; PRA Rulebook, Insurance General Application Part, rule 2.3; PRA Rulebook, Preparations for Solvent Exit Part, rules 1.1, 1.2 and 2.1; PRA SS41/15 (November 2024 version), paragraphs 2.2 and 7.3; EIOPA Guidelines on own risk and solvency assessment (EIOPA-BoS-14/259, as published by the Bank of England), Guidelines 2, 4, 6, 7, 13 and 14; PRA SS11/24 Solvent exit planning for insurers (December 2024), paragraphs 2.3 and 2.4; PRA SS43/15 Non-Solvency II insurance companies: capital assessments (November 2015), paragraph 2.4; PRA PS15/24 (15 November 2024), paragraphs 1.21, 1.27 and 1.48; PRA PS2/24 (28 February 2024), paragraphs 1.9, 8.2, 8.7, 8.10 and 8.11. Accessed 10 October 2026.
How we research and check our articles: our editorial policy.
