Insurance (GIN) — Title 32. Risk Management and Own Risk and Solvency Assessment Act
Statutes in effect as of October 1, 2026.
Subtitle 1
Md. Code Ann., Ins. § 32-101 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–101LinkCopy Citation
(a)
In this title the following words have the meanings indicated.
(b)
“Carrier” means:
(1)
an insurer;
(2)
a nonprofit health service plan;
(3)
a health maintenance organization; or
(4)
a dental plan organization.
(c)
“Insurance group” means, for the purpose of conducting an ORSA, those carriers and affiliates that are included within an insurance holding company system as defined in § 7–101 of this article.
(d)
“NAIC” means the National Association of Insurance Commissioners.
(e)
“Own Risk and Solvency Assessment” or “ORSA” means a confidential internal assessment, appropriate to the nature, scale, and complexity of a carrier or insurance group, that the carrier or insurance group conducts, of the material and relevant risks associated with the carrier’s or insurance group’s current business plan and the sufficiency of capital resources to support those risks.
(f)
“ORSA Guidance Manual” means the current version of the Own Risk and Solvency Assessment Guidance Manual developed and adopted by the National Association of Insurance Commissioners.
(g)
“ORSA–related information” means any document, material, or other information related to an ORSA, an ORSA Summary Report, or a risk management framework of a carrier or insurance group.
(h)
“ORSA Summary Report” means a confidential high–level summary of the ORSA of a carrier or insurance group.
(i)
“Supervisory college” has the meaning stated in § 2–209.1 of this article.
Md. Code Ann., Ins. § 32-102 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–102LinkCopy Citation
(a)
The purposes of this title are to:
(1)
require a carrier or insurance group to maintain a risk management framework and complete an ORSA;
(2)
set the requirements for filing an ORSA Summary Report with the Commissioner; and
(3)
provide for the confidential treatment of the ORSA, the ORSA Summary Report, and other ORSA–related information.
(b)
This title applies to all carriers domiciled in the State that are not exempt under § 32–106 of this title.
Md. Code Ann., Ins. § 32-103 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–103LinkCopy Citation
(a)
Each carrier subject to this title shall maintain a risk management framework for identifying, assessing, monitoring, managing, and reporting its material and relevant risks.
(b)
A carrier may satisfy this requirement if the insurance group of which the carrier is a member maintains a risk management framework that applies to the operations of the carrier.
Md. Code Ann., Ins. § 32-104 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–104LinkCopy Citation
(a)
Subject to § 32–106 of this title, a carrier, or the insurance group of which the carrier is a member, shall regularly conduct an ORSA consistent with the process outlined in the ORSA Guidance Manual.
(b)
The ORSA shall be conducted:
(1)
regularly, but not less than once each year; and
(2)
at any time when there is a significant change to the risk profile of the carrier or the insurance group of which the carrier is a member.
Md. Code Ann., Ins. § 32-105 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–105LinkCopy Citation
(a)
On request of the Commissioner, but not more than once each year, a carrier shall submit to the Commissioner an ORSA Summary Report or a combination of reports that together contain the information described in the ORSA Guidance Manual, applicable to the carrier or the insurance group of which the carrier is a member.
(b)
Notwithstanding any request from the Commissioner, if the carrier is a member of an insurance group, the carrier shall submit the report required by this section if the Commissioner is the lead state commissioner of the insurance group as determined by the procedures in the Financial Analysis Handbook adopted by the NAIC.
(c)
The carrier shall:
(1)
determine the most appropriate date of the filing based on the carrier’s internal strategic planning processes; and
(2)
notify the Commissioner of the anticipated date of the filing.
(d)
The carrier’s or insurance group’s chief risk officer or other executive with responsibility for the oversight of the carrier’s enterprise risk management process shall sign the report and attest to the best of that individual’s belief and knowledge that:
(1)
the carrier applies the enterprise risk management process described in the ORSA Summary Report; and
(2)
a copy of the report has been provided to the carrier’s board of directors or the appropriate committee of the board.
(e)
A carrier may comply with subsection (a) of this section by providing the most recent and substantially similar report that the carrier or another member of an insurance group of which the carrier is a member provided to the commissioner of another state or to a supervisor or regulator of a foreign jurisdiction if that report provides information that is comparable to the information described in the ORSA Guidance Manual.
(f)
Any report that is provided under subsection (e) of this section in a language other than English must be accompanied by a translation of that report into English.
Md. Code Ann., Ins. § 32-106 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–106LinkCopy Citation
(a)
A carrier is exempt from the requirements of this title if:
(1)
the carrier has annual direct written and unaffiliated assumed premium less than $500,000,000, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program; and
(2)
the insurance group of which the carrier is a member has annual direct written and unaffiliated assumed premium less than $1,000,000,000, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program.
(b)
(1)
If a carrier qualifies for exemption under subsection (a)(1) of this section, but the insurance group of which the carrier is a member does not qualify for exemption under subsection (a)(2) of this section, then the ORSA Summary Report that is required under § 32–105 of this title shall include every carrier within the insurance group.
(2)
The ORSA Summary Report requirement under paragraph (1) of this subsection may be satisfied by submitting more than one ORSA Summary Report for any combination of carriers if the combination of reports includes every carrier within the insurance group.
(c)
If a carrier does not qualify for exemption under subsection (a)(1) of this section, but the insurance group of which it is a member qualifies for exemption under subsection (a)(2) of this section, then the only ORSA Summary Report required under § 32–105 of this title is the report that applies to that carrier.
(d)
(1)
A carrier that does not qualify for exemption under subsection (a) of this section may apply to the Commissioner for a waiver from the requirements of this title based on unique circumstances.
(2)
If the carrier applying for a waiver is part of an insurance group with carriers domiciled in more than one state, the Commissioner shall contact the lead state commissioner and other domiciliary commissioners in considering whether to grant the carrier’s request for a waiver.
(3)
In deciding whether to grant the carrier’s request for a waiver, the Commissioner may consider:
(i)
the type and volume of business written;
(ii)
ownership and organizational structure; and
(iii)
any other factor the Commissioner considers relevant to the carrier or insurance group of which the carrier is a member.
(e)
Notwithstanding the exemptions provided for in this section, the Commissioner may require that a carrier:
(1)
maintain a risk management framework, conduct an ORSA, and file an ORSA Summary Report based on unique circumstances, including the type and volume of business written, ownership and organizational structure, federal agency requests, and international supervisor requests; or
(2)
maintain a risk management framework, conduct an ORSA, and file an ORSA Summary Report if the carrier:
(i)
has risk–based capital at a company action level event as set forth in § 4–305 of this article;
(ii)
meets one or more of the standards of a carrier deemed to be in financially hazardous condition as described in § 9–102 of this article; or
(iii)
otherwise exhibits qualities of a troubled carrier as determined by the Commissioner.
(f)
If a carrier that qualifies for an exemption under subsection (a) of this section subsequently no longer qualifies for that exemption due to changes in premium as reflected in the carrier’s most recent annual statement or in the most recent annual statements of the carriers within the insurance group of which the carrier is a member, the carrier shall have 1 year following the year the threshold is exceeded to comply with this title.
Md. Code Ann., Ins. § 32-107 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–107LinkCopy Citation
(a)
The ORSA Summary Report shall be prepared consistent with the ORSA Guidance Manual.
(b)
Documentation and supporting information for the ORSA Summary Report shall be maintained and made available on examination or request of the Commissioner.
(c)
(1)
The Commissioner shall review the ORSA Summary Report.
(2)
The Commissioner shall make any requests for additional information using procedures similar to those currently used in the analysis and examination of multi–state or global carriers and insurance groups.
(d)
The ORSA Summary Report shall include a short summary of material changes and updates to the ORSA Summary Report since the prior year.
(e)
The Commissioner may retain, at the carrier’s expense, third–party consultants, including attorneys, actuaries, accountants, and other experts not otherwise a part of the Administration’s staff as may be reasonably necessary to assist the Administration in reviewing the carrier’s risk management framework, ORSA, ORSA Summary Report, or compliance with this title.
Md. Code Ann., Ins. § 32-108 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–108LinkCopy Citation
(a)
(1)
ORSA–related information, including the ORSA Summary Report, in the possession or control of the Commissioner that is obtained by, created by, or disclosed to the Commissioner or any other person under this title:
(i)
is confidential and privileged;
(ii)
is not subject to Title 4 of the General Provisions Article;
(iii)
is not subject to subpoena; and
(iv)
is not subject to discovery or admissible as evidence in any civil action.
(2)
Except as provided in subsections (b) and (d) of this section, the Commissioner may not otherwise make ORSA–related information public without prior written consent of the carrier to which it pertains.
(b)
The Commissioner may use ORSA–related information in the furtherance of any regulatory or legal action brought as part of the duties of the Commissioner.
(c)
The Commissioner, and any person who receives ORSA–related information, through examination or otherwise, while acting under the authority of the Commissioner or with whom ORSA–related information is shared under this title, may not be allowed or required to testify in any private civil action concerning any ORSA–related information that is subject to subsection (a) of this section.
(d)
In order to assist in the performance of the Commissioner’s regulatory duties, the Commissioner:
(1)
may, on request, share ORSA–related information, including confidential and privileged ORSA–related information that is subject to subsection (a) of this section, with:
(i)
other state, federal, and international financial regulatory agencies, including members of any supervisory college;
(ii)
the NAIC; and
(iii)
any third–party consultants the Commissioner designates.
(2)
The Commissioner may share ORSA–related information under paragraph (1) of this subsection if the recipient:
(i)
agrees in writing to maintain the confidentiality and privileged status of the ORSA–related information; and
(ii)
verifies in writing that it has the legal authority to maintain the confidentiality of the ORSA–related information.
(e)
(1)
The Commissioner may receive ORSA–related information from:
(i)
other state, federal, and international financial regulatory agencies, including members of any supervisory college; and
(ii)
the NAIC.
(2)
The Commissioner shall maintain as confidential and privileged any ORSA–related information received under paragraph (1) of this subsection that the Commissioner receives with notice or the understanding that it is confidential or privileged under the laws of the jurisdiction that is the source of the ORSA–related information.
(f)
(1)
The Commissioner shall enter into a written agreement with the NAIC or a third–party consultant governing the sharing and use of information provided under this title, consistent with this section.
(2)
The agreement required under paragraph (1) of this subsection shall:
(i)
specify procedures and protocols regarding the confidentiality and security of ORSA–related information shared with the NAIC or a third–party consultant under this title, including procedures and protocols for sharing by the NAIC with other state regulators from states in which the insurance group has domiciled carriers;
(ii)
specify that the recipient agrees in writing to maintain the confidentiality and privileged status of the ORSA–related information and has verified in writing the legal authority to maintain the confidentiality;
(iii)
specify that ownership of the ORSA–related information shared under this title remains with the Commissioner and that the use of the ORSA–related information by the NAIC or a third–party consultant is subject to the direction of the Commissioner;
(iv)
prohibit the NAIC or a third–party consultant from storing the ORSA–related information shared under this title in a permanent database after the underlying analysis is completed;
(v)
require prompt notice to be given to a carrier whose confidential ORSA–related information in the possession of the NAIC or a third–party consultant under this title is subject to a request or subpoena for disclosure or production;
(vi)
require the NAIC or a third–party consultant to consent to intervention by a carrier in any judicial or administrative action in which the NAIC or a third–party consultant may be required to disclose confidential ORSA–related information about the carrier shared with the NAIC or a third–party consultant under this title; and
(vii)
in the case of an agreement involving a third–party consultant, provide:
(1)
that the third–party consultant shall be under the direction and control of the Commissioner and act in a purely advisory capacity;
(2)
that the third–party consultant is subject to the same confidentiality standards and requirements as the Commissioner;
(3)
that the third–party consultant shall verify to the Commissioner, with notice to the carrier, that the third–party consultant:
(A)
is free of any conflict of interest;
(B)
has internal procedures in place to ensure that it remains free of any conflict of interest; and
(C)
will comply with the confidentiality standards and requirements of this article;
(4)
that, before using a carrier’s ORSA–related information in a manner inconsistent with the agreement with the Commissioner or sharing the carrier’s ORSA–related information with a person other than the Commissioner, the third–party consultant shall obtain written consent of the carrier; and
(5)
for written notification to the carrier.
(g)
(1)
The sharing of ORSA–related information and documents by the Commissioner under this title may not constitute a delegation of regulatory authority or rulemaking.
(2)
The Commissioner is solely responsible for the administration, execution, and enforcement of this title.
(h)
A waiver of any applicable privilege or claim of confidentiality in ORSA–related information may not occur as a result of disclosure of the ORSA–related information to the Commissioner under this section or as a result of sharing the ORSA–related information as authorized under this title.
(i)
ORSA–related information in the possession or control of the NAIC or a third–party consultant under this title:
(1)
is confidential and privileged;
(2)
is not subject to Title 4 of the General Provisions Article;
(3)
is not subject to subpoena; and
(4)
is not subject to discovery or admissible in evidence in any civil action.
Md. Code Ann., Ins. § 32-109 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–109LinkCopy Citation
(a)
Subject to § 2–210 of this article, a carrier that, without just cause, fails to timely file an ORSA Summary Report as required by this title is subject to a penalty of $200 for each day the violation continues, up to a maximum of $25,000.
(b)
The Commissioner may reduce the penalty under subsection (a) of this section if the carrier demonstrates to the Commissioner that the imposition of the penalty would constitute a financial hardship to the carrier.
(c)
This section does not limit the authority of the Commissioner to take any other action authorized by this article.
Md. Code Ann., Ins. § 32-110 (2026)
Title 32. Risk Management and Own Risk and Solvency Assessment Act
Subtitle 1
§ 32–110LinkCopy Citation
The Commissioner may adopt regulations consistent with this title.