Cyber Model Uncertainty and Dividend Affordability
Meridian Specialty is a Lloyd's-style insurer writing cyber, professional indemnity and specialty property. Its Solvency II own funds are £380m, SCR £300m (ratio 127%), and MCR £120m. The board wants to pay a £60m dividend before the year-end. The internal model's cyber accumulation uses a 1-in-200 scenario of £95m net, but the model has only four years of data and assumes independence between ransomware and privacy liability. The PRA has queried the cyber parameterisation, and the model validation report notes that a 20% increase in the cyber loss ratio would add £45m to the SCR. The risk margin is £80m and is sensitive to interest rates. The CFO argues that a dividend is affordable because the ratio is above 110% and the model is approved. The CRO wants to hold capital until the model change is agreed. The board asks the chief actuary for a recommendation.
1. Assess whether the £60m dividend is affordable, showing the pro forma capital position before and after the proposed model change.
Read the worked answer
The £60m dividend should not be paid on the current facts.
- Current position: own funds £380m, SCR £300m, ratio 127%. After a £60m dividend, own funds fall to £320m, ratio 107%. That is only 7 points above the SCR. It is above the MCR of £120m, but the board's own risk appetite and the PRA's supervisory expectation are likely to require a buffer above the SCR, especially for a cyber-heavy specialty insurer.
- Model change: the validation report says a 20% increase in the cyber loss ratio would add £45m to the SCR. If that adjustment is made, SCR becomes £345m. After the dividend, own funds of £320m would be below the revised SCR - a ratio of about 93%. That would be a breach of the SCR and would require regulatory notification and a remediation plan.
- Risk margin: the £80m risk margin is part of technical provisions. If interest rates fall, the risk margin can increase, reducing own funds. The dividend analysis should include a risk-margin stress, not just the SCR ratio.
- CFO's argument: 'above 110%' is not a sufficient test. A 110% ratio leaves little room for model error, cyber accumulation, or a reinsurer downgrade. The internal model is approved, but approval does not mean the parameterisation is beyond challenge; the PRA query is a live signal.
Conclusion: the dividend is not affordable on a risk-adjusted basis. At most, a much smaller dividend could be considered after the model change is agreed and the capital buffer is restored.
2. Recommend the capital actions the board should take before considering any dividend.
Read the worked answer
Recommended actions before any dividend
- Quantify the model change. Run the cyber parameterisation with the 20% loss-ratio stress and with dependence between ransomware and privacy liability. Present the board with a range of SCR outcomes, not a single approved number.
- Set a target capital ratio. A specialty insurer with cyber concentration should hold a buffer above the SCR, for example 130–140%, depending on the board's risk appetite. At £345m SCR, that implies own funds of £449–483m, which is above the current £380m. The insurer is therefore capital-short if the model change is recognised.
- Do not pay the £60m dividend. If the board wants to return capital, limit it to the surplus above the target ratio after the model change, and make it conditional on PRA agreement. On the numbers, that may be zero.
- Restore capital. Options include a capital raise, a reinsurance sidecar or quota share on cyber, reducing cyber accumulations, or slowing premium growth. A quota share may be more capital-efficient than cutting profitable business, but it cedes upside.
- Stress the risk margin. Test a 50bp fall in interest rates and a rise in the risk margin; show the board the pro forma ratio under each scenario.
Communication: the board should see a pro forma table of own funds, SCR, surplus and ratio before and after the dividend and model change. The recommendation should be documented, including the CRO's view and the PRA query.
3. Explain how model uncertainty and the risk margin should affect the board's decision, and what governance steps are needed.
Read the worked answer
Model uncertainty and the risk margin
- Cyber parameterisation: Four years of data is not enough to estimate a 1-in-200 cyber loss with confidence. The independence assumption between ransomware and privacy liability is a strong judgement; a dependent scenario (e.g. a ransomware attack that also exposes personal data) could increase the tail materially. The actuary should use expert judgement, scenario analysis and external data, and disclose the uncertainty rather than treating the model output as precise.
- Risk margin: The risk margin compensates for the cost of holding capital for non-hedgeable risks. It is sensitive to interest rates and to the SCR. If the cyber SCR increases, the risk margin may also increase, further reducing the ratio. The board should see the combined effect, not the SCR in isolation.
- Governance: The PRA query is a model risk event. The actuary should support a model change with validation, independent review and a clear audit trail. Paying a dividend while a model change is unresolved creates a governance risk: the board may be distributing capital that is needed to cover a known deficiency.
- Recommendation: treat the model change as a likely capital event, not a remote stress. Hold the dividend, agree the model adjustment with the PRA, and then reassess. If the board proceeds, the actuary should record the advice and the uncertainty in the board minutes.