Third-Country Reinsurance Due Diligence: Making EIOPA Assessments Repeatable

Third-country reinsurance due diligence under Solvency II is not a one-time check before treaty signing. It is a continuing obligation that requires documented, updated, and retrievable assessments for every material third-country reinsurer in the panel. Firms that treat it as a pre-renewal ad-hoc review accumulate regulatory risk that crystallizes when the supervisor asks for the file.

Why has third-country reinsurance due diligence become a repeatability problem?

Third-country reinsurance due diligence has become a repeatability problem because most cedents execute it as a manual, document-based exercise each renewal cycle. The assessment is built from scratch, stored in a slide deck, and filed where nobody can find it next year. When the supervisor asks for the complete due-diligence record, the firm cannot produce a coherent, longitudinal file.

The obligation sits at the intersection of several regulatory pressures. Solvency II requires cedents to assess the credit quality, regulatory standing, and operational capability of every material reinsurer. The third-country equivalence framework adds a layer of jurisdictional assessment. The supervisory expectation, reinforced through the 2027 review, is that due diligence is not only thorough but documented, consistent across counterparties, and updated at each renewal or material change.

Most cedents do the work. What they cannot do is demonstrate it efficiently. The assessment from last year is a PowerPoint on a shared drive. The financial data is a year out of date. The sanctions screen was done but the evidence was not saved. When the supervisor's request arrives, the compliance team reconstructs the entire file under deadline, and the reconstruction always reveals gaps that the original assessment did not.

What goes wrong when third-country due diligence relies on manual, one-off assessments?

Five failures undermine manual third-country due diligence: inconsistent assessment depth across counterparties, missing updates between renewals, undocumented sanctions and watchlist checks, inability to retrieve prior-year assessments, and ratings changes that are not reflected in the current file. Each failure weakens the firm's position with the supervisor.

The manual approach works when the panel is small and stable. It breaks when the reinsurance panel grows, counterparties change domicile or ownership, treaties extend across multiple lines, and the renewal cycle compresses the available review window. The failures below are the ones supervisors most commonly identify in thematic reviews of third-country reinsurance management.

1. Why does assessment depth vary across counterparties?

Assessment depth varies because it is driven by the analyst's knowledge, the available time, and the accessibility of the counterparty's financial data, not by a structured framework that calibrates depth to exposure. A small treaty with a complex Bermudian reinsurer may get a superficial review while a large treaty with a well-known Swiss reinsurer gets exhaustive attention.

A structured due-diligence framework solves this by defining standard data fields for every counterparty and then scaling review depth based on materiality thresholds, treaty duration, and the home jurisdiction's equivalence status. The supervisor can see that depth decisions are made systematically, not accidentally.

2. What happens when due diligence is not updated between renewals?

When due diligence is not updated between renewals, rating downgrades, regulatory actions in the home jurisdiction, ownership changes, and sanctions designations can occur without the cedent's knowledge. The treaty stays in force, the exposure continues, and the cedent's risk assessment is stale.

The gap between renewal cycles can be twelve months or more. In that time, a reinsurer can lose its rating, be acquired by an entity in a non-equivalent jurisdiction, or appear on a sanctions list. The cedent that discovers these changes at the next renewal, rather than when they occur, has a due-diligence process that the supervisor will rightly question.

3. How do undocumented checks create regulatory exposure?

Undocumented checks create regulatory exposure because the firm cannot prove it did the work. A sanctions screen was run, an ownership check was performed, a financial-strength analysis was completed, but the evidence was not preserved. When the supervisor asks, the firm's answer is a recollection, not a record.

Supervisors expect evidence of the assessment process, not just the conclusion. A file that shows the data sources consulted, the date of the consultation, the result, and the analyst's rationale for the conclusion is the standard. A file that shows only a final rating or a binary compliant/non-compliant flag does not meet it.

4. Why does retrieving prior-year assessments matter?

Retrieving prior-year assessments matters because the supervisor may ask for the complete due-diligence history of a specific reinsurer, not just the current assessment. The history shows whether the firm identified deteriorating trends, whether it acted on them, and whether its due-diligence process is genuinely continuous or a periodic checkbox exercise.

A firm that cannot produce last year's file, or produces it with a different format and different data sources than this year's file, signals that the process is not institutionalized. The supervisor's scrutiny intensifies, and the compliance burden of responding to that scrutiny compounds.

5. How do rating changes fall through the cracks?

Rating changes fall through the cracks because the cedent's due-diligence process is event-driven by renewal, not by the reinsurer's credit cycle. A downgrade that occurs three months after renewal does not trigger a review until the next renewal, by which time the treaty may have been in force for nine months with a counterparty that no longer meets the cedent's credit standards.

Continuous monitoring, with alerts on rating changes, regulatory actions, and ownership events, is what converts due diligence from a point-in-time check to an ongoing control. The supervisor is increasingly asking not only "what was the rating at renewal?" but "when did you know it changed, and what did you do?" The continuous controls approach is becoming the expected standard.

Build a repeatable third-country due diligence process with Insurnest's compliance technology

Talk to Our Specialists

Visit Insurnest to learn how we help cedents and brokers build structured, documented, and supervisor-ready due diligence on every third-country reinsurer.

What do actuarial reporting managers actually expect from a third-country due diligence process?

Actuarial reporting managers expect a structured assessment framework that defines standard data fields for every counterparty, continuous monitoring of rating and regulatory changes between renewals, documented and retrievable evidence for every assessment, materiality-driven depth scaling, and a panel-wide view that shows the aggregate third-country exposure and its credit-quality distribution.

Elena is the actuarial reporting manager at a European multiline insurer that cedes significant premium to reinsurers in Bermuda, Singapore, and Dubai. She is responsible for the reinsurance recoverable balances, the credit-risk module of the solvency calculation, and the annual ORSA report that must address third-country counterparty risk. Her name is on the filing, and when the supervisor asks about third-country due diligence, the question lands on her desk.

Her current process is a pre-renewal scramble. For each material third-country reinsurer, she assembles the latest rating report, checks the EIOPA equivalence register, runs a sanctions screen, and writes a brief assessment. The files are saved in a folder named by the renewal year. When the supervisor asked for the due-diligence file on her largest Bermuda-domiciled reinsurer, covering the last three years, it took her team four days to assemble it, and the 2023 assessment was missing entirely because the analyst who wrote it had left the firm.

Elena wants a process where the assessment is built once, updated at renewal and on material events, stored in a structured format, and retrievable by counterparty and year with a single query. She wants her team to spend its time reviewing risks, not reconstructing files. Below are the specifics she will insist upon.

• A standard assessment template with mandatory data fields. "Every third-country reinsurer must be assessed on the same dimensions: financial strength, regulatory status, ownership, sanctions, treaty exposure, and contract enforceability. The template drives consistency." She will not accept free-text assessments that vary by analyst.
• Jurisdictional equivalence assessment as a distinct, referenced layer. "The EIOPA equivalence finding for the counterparty's home country must be documented, dated, and linked to the individual reinsurer's file. When equivalence changes, the change must propagate." Jurisdiction and entity are separate but linked assessments.
• Continuous monitoring of rating and regulatory changes between renewals. "If a Bermuda reinsurer is downgraded in June, I need to know in June, not in November when the renewal begins. The process must include automated alerts on material events." Point-in-time assessment is not enough.
• Sanctions and watchlist screening with preserved evidence. "Every screen must produce a dated result that is saved to the assessment file. I need to show the supervisor that the screen was run, on what date, against which lists, and with what result." Undocumented screening is the most common finding in supervisory reviews.
• Materiality-driven depth scaling with documented rationale. "The top five third-country reinsurers by exposure get deep-dive assessments. The next tier gets standard assessments. The tiering logic must be documented and approved, not left to analyst discretion." Proportional depth directs effort where it matters.
• Treaty-level exposure linkage within the assessment. "The assessment must show not only who the reinsurer is but what treaties it supports, what lines, what limits, and what duration. The supervisor wants to see that due-diligence depth correlates with exposure." Exposure drives the case for depth.
• Assessment version history with date and analyst identity. "Every update must create a new version with a timestamp and the analyst's name. The supervisor must be able to see who assessed what and when." Version control is the foundation of the audit trail.
• Panel-wide aggregation of third-country exposure by jurisdiction and rating. "I need to see the whole third-country panel in one view: total recoverable by jurisdiction, by rating band, and by equivalence status. That view goes into the ORSA and the board pack." Aggregate visibility supports risk-appetite decisions.
• Contract enforceability opinion for non-equivalent jurisdictions. "If a jurisdiction does not have full equivalence, I need a legal opinion on whether the reinsurance contract would be enforceable in that jurisdiction's courts. The opinion must be in the file." Legal risk is part of credit risk.
• Retrievability by counterparty and by renewal year. "When the supervisor asks for the due-diligence file on a specific reinsurer covering the last three years, the system must produce it in minutes, not days." Retrievability is the test of whether the process is institutionalized.

Elena's core argument is that repeatability is itself a regulatory expectation. A firm that can produce a structured, consistent, and longitudinal due-diligence file earns supervisory confidence. A firm that reconstructs its file under deadline earns supervisory skepticism.

How can cedents build a repeatable third-country reinsurance due diligence process?

Cedents build a repeatable process by establishing a structured assessment framework with standard data fields, implementing continuous monitoring of counterparty risk events, capturing and storing assessment evidence systematically, linking assessments to treaty-level exposures, building panel-wide aggregation views, and maintaining version-controlled retrieval by counterparty and renewal year.

The process converts an ad-hoc research exercise into a governed, auditable workflow. Each capability below addresses a specific failure mode and produces evidence that satisfies the supervisor.

1. How does a structured assessment framework standardize across the panel?

A structured assessment framework standardizes by defining mandatory data fields, scoring criteria, and review-depth rules that apply uniformly to every third-country reinsurer. Each assessment covers financial strength, regulatory status, ownership, sanctions, contract enforceability, and treaty exposure, using the same data sources and the same scoring methodology.

The framework eliminates the variability that makes two analysts' assessments of the same reinsurer look different. It also makes the process explainable to the supervisor: "every third-country reinsurer is assessed on these six dimensions using these three data sources, and the review depth scales with exposure according to this materiality matrix." The standardization is itself a governance control.

2. Why does continuous monitoring matter more than point-in-time assessment?

Continuous monitoring matters more because the interval between renewals is when ratings change, regulatory actions occur, ownership shifts, and sanctions are imposed. A process that only checks the counterparty at renewal is blind for up to twelve months, and the supervisor increasingly expects firms to know about material changes when they happen.

Automated monitoring pulls rating data from agency feeds, regulatory-status data from supervisory registers, ownership data from corporate registries, and sanctions data from official lists. An alert on a material change triggers a reassessment, not a note to review at renewal. The firm's due-diligence record now shows continuous vigilance rather than periodic checks.

3. How does evidence capture convert a research exercise into an audit file?

Evidence capture converts a research exercise into an audit file by saving, at the moment of assessment, the source document, the date of access, the data points extracted, and the analyst's conclusion. Each data-point in the assessment references its source, and the source is attached to the file.

When the supervisor asks "on what basis did you conclude this reinsurer's governance is adequate?", the answer is a reference to the specific pages of the specific regulatory filing that the analyst reviewed, saved with the assessment. The evidence trail converts the assessment from an opinion into a documented conclusion, which is what the supervisor requires.

4. What does linking assessments to treaty-level exposures deliver?

Linking assessments to treaty-level exposures delivers the ability to show the supervisor that due-diligence depth is proportional to risk. The assessment file lists every treaty supported by the reinsurer, with line of business, limit, attachment point, and duration. The supervisor can see that the largest exposures received the deepest review.

This linkage also supports the ORSA narrative. When the firm describes its third-country counterparty risk, it can reference specific treaties, specific exposures, and the specific due-diligence conclusions that support its risk-appetite statement. The exposure tracking aggregates naturally from the assessment data.

5. How does panel-wide aggregation support risk-appetite management?

Panel-wide aggregation produces a consolidated view of all third-country reinsurance exposure by jurisdiction, by rating band, by equivalence status, and by line of business. The view shows the total recoverable at risk in non-equivalent jurisdictions, the credit-quality distribution, and the concentration to any single reinsurer or jurisdiction.

This is the management-reporting output of the due-diligence process. It goes to the risk committee, the board, and the ORSA report. It answers the question "how much third-country exposure do we have, and how well is it covered by our due-diligence process?" The aggregation view is what turns individual assessments into portfolio-level governance.

6. What does version-controlled retrieval deliver during supervisory review?

Version-controlled retrieval delivers the ability to produce, on demand, the complete due-diligence file for any third-country reinsurer covering any date range. The system stores every assessment version with date, analyst, and content, and retrieves the requested versions in a single package.

This is the capability that directly answers the supervisor's request. Instead of a four-day file reconstruction, Elena's team runs a query and produces the complete due-diligence history for the requested reinsurer across the requested years, consistent in format, complete in evidence, and ready for supervisory review. The speed and completeness of the response are themselves evidence of a well-controlled process.

Deliver supervisor-ready third-country due diligence with Insurnest's compliance platform

Talk to Our Specialists

Visit Insurnest to see how we help cedents, brokers, and reinsurers build structured, monitored, and retrievable due-diligence workflows on every third-country reinsurer.

What does an ideal third-country reinsurance due diligence process look like?

An ideal third-country reinsurance due diligence process is built on a structured assessment framework covering every material counterparty, continuously monitored for rating and regulatory changes, fully evidenced with source documents, linked to treaty-level exposures at renewal, aggregated for panel-wide risk-appetite visibility, and stored with version-controlled retrieval by counterparty and year.

In Elena's ideal process, the due-diligence workflow begins at treaty placement. When a new third-country reinsurer is proposed, the system creates an assessment record pre-populated with the counterparty's rating, regulatory status, and ownership data from automated feeds. The analyst reviews the data, adds treaty-level exposure context, assesses contract enforceability, and documents the conclusion. The assessment is saved in the standard format, versioned, and linked to the treaties it supports.

At each renewal, the assessment is retrieved, pre-populated with updated feeds, and reviewed. The analyst confirms that the earlier conclusions still hold, updates the financial data, and re-runs the sanctions screen. The new version is saved, and the prior version forms part of the longitudinal record. When a mid-cycle rating downgrade occurs, the monitoring engine alerts the analyst, who updates the assessment and, if the downgrade breaches a materiality threshold, escalates to the risk committee.

When the supervisor arrives for the periodic review and asks for the due-diligence record on the top five third-country reinsurers, Elena's team produces five complete, consistent, multi-year files in under an hour. The supervisor sees a process that is standardized, evidenced, and continuous. The review moves on to other topics, and Elena's due-diligence process earns the credibility that protects the firm from deeper scrutiny.

Turn third-country due diligence into a regulatory strength with Insurnest's technology

Talk to Our Specialists

Visit Insurnest to learn how we help reinsurance buyers, cedents, and groups build structured, supervised-ready due-diligence workflows.

Conclusion

For European cedents with material third-country reinsurance panels, the regulatory expectation has moved decisively beyond point-in-time assessment. Structured, documented, continuously updated, and retrievable due diligence is now the baseline, and firms that cannot meet it will face supervisory findings that compound the cost of every subsequent review.

The technology to standardize assessments, monitor counterparty events, capture evidence, and retrieve files on demand is available. The investment is modest relative to the cost of a supervisory finding on third-country risk management, and it pays for itself in reduced compliance-team effort at every renewal cycle.

For actuarial reporting managers, chief risk officers, and compliance leads, the practical path is clear. Define the standard assessment framework. Link it to treaty exposures. Automate the monitoring. Capture the evidence. Build the retrieval. The supervisor will ask. The firm's answer should be a file, not a project.

Frequently asked questions

What is third-country reinsurance due diligence under Solvency II?

It is the obligation to assess whether a reinsurer domiciled outside the European Economic Area meets equivalent regulatory, financial, and governance standards. The assessment must be documented, updated, and available to the supervisor on request.

How does EIOPA determine equivalence for third-country reinsurance jurisdictions?

EIOPA assesses the third country's solvency regime, supervisory powers, professional secrecy, and policyholder protection. A positive equivalence finding simplifies due diligence but does not remove it for individual reinsurers.

What makes third-country due diligence difficult to repeat across renewal cycles?

Assessments are often built as one-off exercises stored in slide decks and spreadsheets. When the same reinsurer comes up for review at the next renewal, the prior assessment cannot be efficiently reconstructed or updated.

Which data points must a third-country due diligence file contain?

Financial strength, regulatory status in the home jurisdiction, ownership structure, sanctions screening, treaty-level exposure, claims-payment history, and an assessment of the legal enforceability of the reinsurance contract in the counterparty's domicile.

How do treaty-level exposures affect the intensity of third-country due diligence?

Larger exposures or those covering long-tail lines require deeper diligence because the financial consequences of a counterparty failure compound over time. Materiality thresholds should drive the depth, not the existence, of the assessment.

What happens when a third-country reinsurer's equivalence status changes?

The cedent must reassess the reinsurer's standing against the revised supervisory framework, determine whether existing treaties remain compliant, and document the conclusion. Failure to reassess can expose the cedent to regulatory capital charges.

Can third-country due diligence be standardized across a reinsurance panel?

Yes. A structured assessment framework with standard data fields, scoring criteria, and documentation templates makes due diligence repeatable across counterparties and renewal cycles while allowing depth to scale with exposure.

How should third-country due diligence be evidenced to a supervisor?

Each assessment should produce a dated, signed file containing the data sources reviewed, conclusions reached, and the rationale for those conclusions. The evidence must be retrievable by counterparty and renewal year on regulatory request.

About the author

Hitul Mistry is the Founder of Insurnest, an InsurTech company that engineers end-to-end technology exclusively for the insurance industry serving carriers, TPAs, MGAs, brokers, and reinsurers across India, the UAE, and the US. With more than a decade of insurance domain experience, he has built systems spanning underwriting automation, AI-powered underwriting intelligence, claims management, rating and quoting, broking and agency platforms, and reinsurance automation across Health/GMC, Group Life, Motor, P&C, and Reinsurance. Insurnest doesn't adapt generic software to insurance; it builds from the workflow up.

Connect with Hitul on LinkedIn.