Author Details

Prof. Christopher P. Buttigieg and Daphne Micallef

Abstract

In the wake of the pandemic, many financial firms rushed to change their business strategies, at times exposing deep structural weaknesses. This article examines an insurance company that attempted a change in business model and growth without the necessary governance and competence. The study details how supervisors shifted from passive monitoring to intrusive engagement, ultimately halting new business to force a rebuild of internal controls. This study bridges the gap between abstract theory of regulation and the applied day-to-day mechanics and challenges of supervising the implementation of regulation in practice to achieve the desired consumer protection and financial system integrity outcomes. It reaffirms that where critical situations arise a financial supervisor must quickly shift supervisory approach from a passive monitor to intrusive supervisory engagement.

Keywords: Governance, Intrusive Supervision, MFSA, Regulation, Solvency II, Supervision

Disclosure of Interest: The authors are officials of the Malta Financial Services Authority with respect to which the mentioned case study relates.

Use of Generative AI: The authors used Gemini 3 for language refinement and to prepare diagrams.

Information

Type	Governance, Intrusive Supervision, MFSA, Regulation, Solvency II, Supervision – the work of Christopher P Buttigieg and Daphne Micallef
Information	Journal of Financial Supervisors Academy, Volume 2, November 2026, pp. 199–210
Creative Commons	This is an open access article under the CC BY license. Journal of Financial Supervisors Academy © 2026. Licensed under CC BY 4.0.
Copyright	© The Authors, 2026. Published by Journal of Financial Supervisors Academy

Introduction

In the wake of the global pandemic, the insurance and financial services sectors faced unprecedented pressures, forcing many firms to reconsider business strategies rapidly.¹ However, such shifts at times expose underlying structural weaknesses. This article examines a specific case of an insurance undertaking (“the company” or “the firm”) that attempted a radical business plan modification without the requisite infrastructure. The subsequent intervention by the Malta Financial Services Authority (MFSA), serves as an example of how in such circumstances financial supervisors shift from a routine passive approach to intrusive and outcomes focused supervision.² The objective of this analysis is to evaluate how targeted supervisory intervention can remediate systemic governance failures. By examining the interplay between identified deficiencies, ranging from weak governance structures and lack of independent oversight to capital adequacy, and the MFSA’s escalating response, this study reaffirms that where critical situations arise a financial supervisor must quickly shift supervisory approach from a passive monitor to intrusive supervisory engagement.

This case concerns the company’s swift strategic reorientation, wherein the entity attempted to mitigate pandemic-induced losses by expanding into specialised business lines, such as the delegation of underwriting authority³, without the requisite technical competencies, operational infrastructure and robust product oversight and governance frameworks. This strategic misalignment was further exacerbated by a manifest failure in sound and prudent management and a dysfunctional risk management apparatus. Crucially, these deficiencies were anchored in a structural conflict of interest, which resulted from the concentration of power within a Chairman who simultaneously held executive powers and was also the ultimate beneficial owner (UBO). This governance arrangement effectively reduced the Board’s capacity for independent challenge, facilitating the adoption of strategic decisions that significantly amplified the firm’s risk exposure without the implementation of commensurate mitigating controls.

These deficiencies were not isolated operational gaps but were indicative of serious systemic institutional weaknesses. Indeed, the firm had a weak compliance function and other key and critical functions mandated under the Solvency II (SIID) Directive.⁴ In addition, operationally, the firm was compromised by acute ‘key person’ risk within the claims department, a consequence of high staff attrition that threatened the integrity of the firm’s institutional memory. Furthermore, the firm’s approach to capital adequacy proved fundamentally flawed, with persistent operating losses being superficially mitigated by shareholders injecting capital through opaque intercompany loan structures rather than through high-quality capital instruments. The central argument of this article is that intrusive supervision, including an MFSA’s supervisory expectation to cease new business activities pending full remediation, proved to be an effective mechanism to address the weaknesses within this firm without resorting to enforcement action.

Drawing on the authors’ forty years of collective experience in financial supervision and benefiting from direct exposure to this particular case, this article analyses the application of intrusive supervision to resolve critical situations. It first diagnoses the governance failure, where a rushed business decision exposed structural conflicts and a weak compliance culture. It then details the regulatory intervention, specifically the use of a supervisory expectation to halt new business and rebuild internal controls. Finally, the study explores the verification phase, showing how continuous oversight ensures that proposed changes are implemented in practice and result in genuine operational stability. Ultimately, this case demonstrates that financial supervision requires the capacity to identify institutional vulnerabilities and the courage to intervene decisively⁵, ensuring that proper governance and internal controls are reflected in operational reality rather than just formalistic documentation.

This article draws from a series of lectures delivered by the authors within the framework of the Postgraduate Diploma in Financial Regulation and Compliance at the University of Malta.⁶ It is designed to provide readers, specifically students, with an empirical case study that bridges the gap between theoretical frameworks and the practical execution of supervisory mandates. By analysing the complex challenges faced by the MFSA with respect to this case, this study offers a nuanced exploration into the nature and art of financial supervision. Ultimately, it underscores the necessity of proactive and decisive intervention as a fundamental safeguard to prevent institutional failure and mitigate the risks of consumer detriment and market malpractice.

The Anatomy of Governance Failure

Prior to the global pandemic, the entity was categorised as a small insurance undertaking (below ten million of annual written premiums) and classified as ‘low impact’ under the MFSA’s risk-based supervisory framework⁷. This classification resulted in a low intensity level of supervisory engagement, based on the assumption that the firm’s activities posed minimal risk to the financial system. However, the onset of Covid-19 acted as a catalyst for rapid financial deterioration, as the entity’s inability to absorb pandemic-related shocks brought about a significant decline in its solvency position and operational stability. This financial erosion necessitated an immediate upward revision of the firm’s risk rating, triggering an automatic escalation in supervisory intensity. Consequently, the MFSA was forced to step up from a routine, passive monitoring based supervisory approach to an intrusive interventionist model to address the growing threats to the firm’s viability.⁸

Upping the level of intensity of supervisory engagement on the firm exposed a ‘paper-only’ compliance culture⁹ where the company’s Board of Directors functioned as a mere formality, devoid of the substantive oversight required of regulated entities. In this regard, it became evident that Board deliberations lacked the characteristic of sound and prudent management. In fact, the board minutes revealed a persistent absence of critical inquiry, with meetings characterised by a brevity that did not include robust executive challenge. This leadership vacuum facilitated the ratification of high-risk strategic expansions without the necessary prudential safeguards, such as a comprehensive business continuity plan (BCP)¹⁰, thereby leaving the institution acutely exposed to operational weaknesses. Furthermore, the supervisory engagement unmasked a fundamental erosion of accountability, exemplified by a total absence of performance appraisals for the Board and its sub-committees¹¹, a deficiency that signalled a broader collapse in the firm’s internal governance and self-correction mechanisms.

The supervisory deep dive¹² further exposed a fractured operational core, characterised by substandard data governance and record-keeping frameworks that compromised the integrity of the firm’s reporting. This was compounded by inadequate technical provisioning, where the failure to accurately reflect a ‘best estimate’ of future liabilities left the firm’s past exposures dangerously under reserved. Central to this failure was the marginalisation of the Actuarial Function¹³, which had been systematically excluded from the calibration of case reserves and denied the opportunity to align internal methodologies with prevailing market practices.

This operational volatility was exacerbated by chronic staff attrition within the claims and risk management department and a deteriorating financial position marked by recurring, unmitigated expenses. Such personnel turnover was not a peripheral human resources issue, but a systemic threat to solvency. The absence of robust succession planning within the Claims and Risk Management functions signalled a possible breakdown in the System of Governance (SoG)¹⁴. This created an acute risk of institutional memory loss, further worsened by the omission of a business impact analysis (BIA)¹⁵. In addition, without identified recovery time objectives (RTO)¹⁶ or defined critical processes, the firm possessed no credible mechanism for operational resilience. Ultimately, the convergence of the Chairman, Executive, and UBO roles created a governance environment primed for ‘groupthink’¹⁷. This effectively neutralised independent oversight, compelling the MFSA to initiate a more granular review of Board competencies¹⁸.

The MFSA’s assessment also brought to light prudential deficiencies, specifically a failure to articulate a viable medium-term capital management strategy¹⁹ (as indicated in the introduction to the article, the firm’s approach to capital adequacy proved fundamentally flawed, with persistent operating losses being superficially mitigated by shareholders injecting capital through opaque intercompany loan structures rather than through sustainable, high-quality capital instruments) and a pervasive deficit in the Board’s collective technical suitability²⁰. When assessing the Board‘s activity in practice the MFSA noticed that this exhibited a manifest lack of the specialised expertise essential for navigating the intricacies of the regulatory landscape, ranging from ‘General Good’ provisions and compliance mandates to insurance accounting and complex actuarial oversight. This intellectual deficit fundamentally impaired the Board’s ability to provide the robust critical challenge necessary to hold executive leadership accountable.

This failure was not confined to the boardroom but pervaded all three lines of defence. The first-line Finance and Actuarial functions, alongside the second and third-line Risk, Compliance, and Internal Audit functions, were found to lack the operational independence required to discharge their mandates effectively.²¹ These systemic failures were further ingrained by a severe structural imbalance, a Board two-thirds comprised of executive directors who also held shareholding interests. This configuration enabled unofficial deliberations among the executive quorum, where substantive strategic decisions were formulated in private and presented to the plenary Board solely for perfunctory ratification. Such practices systematically dismantled collective accountability and transparency, reducing formal governance to a ceremonial exercise and reducing the Board’s capacity and effectiveness for independent oversight and critical intervention.

The MFSA’s review identified material systemic weaknesses within the entity’s technical provisioning architecture²², most notably regarding the initial recognition, dynamic surveillance, and iterative recalibration of claims reserves. The underlying reserving methodologies lacked the actuarial robustness essential for sound prudential reporting. Furthermore, a prevalent documentary deficit precluded forensic transparency, effectively neutralising the capacity for independent auditability or substantive critical appraisal by external reviewers. Critical inputs remained devoid of empirical justification and were not subjected to rigorous periodic revision against shifting macroeconomic indicators or emerging loss experience. In aggregate, these failures engendered the estimation of risk, fundamentally compromising the evidentiary reliability of the reserve valuations. This systemic opacity ultimately raised broader concerns regarding the integrity of the firm’s financial reporting and the veracity of its stated solvency position.

The transition from identifying these systemic vulnerabilities to actively neutralising them marks the turn from diagnostic oversight to executive action. The following section details how the MFSA deployed supervisory expectations tool (specifically to cease new business activities) to arrest the institutional direction and ensure the strengthening of governance, internal controls and prudential position.

The Strategy of Intrusive Intervention

Regulatory action operates along a sophisticated range of escalating intensity, anchored at one end by supervisory expectations. This is a soft law mechanism that functions as a form of moral suasion, exerting strategic pressure on a licensed entity to voluntarily remediate deficiencies and align with prudential standards without the immediate trigger of formal enforcement action. The opposite extremity of this scale is occupied by the revocation of authorisation, a terminal enforcement measure that effectively concludes the firm’s corporate existence. Between these poles lies a set of hard law interventions, including the imposition of administrative penalties, the suspension of licenses, the removal and replacement of directors, and, in cases of severe insolvency or governance collapse, the appointment of administrators to assume control of the firm.

Diagram – Escalation of Regulatory Intensity²³

In light of the systemic vulnerabilities identified during the intrusive engagement, the MFSA deployed a supervisory expectation to halt all new proposed business activities, including the suspension of the proposed new business model which involved delegation of underwriting authority. This compelled the firm to turn its financial and human capital away from expansion and toward the strengthening of its internal control frameworks and capital position. By applying the supervisory expectation, the MFSA ensured the firm’s risk profile remained static, providing the necessary window to reconstruct its infrastructure without further endangering policyholder interests. Crucially, while this measure relied on the firm’s cooperation, it was underpinned by the implicit threat of possible escalation. Indeed, had the entity failed to adhere to the MFSA’s expectations, the Authority would have had to transition to formal supervisory action in the form of a formal directive to the company or enforcement action such as a suspension of licence. Throughout this process, the principles of due process remained paramount, ensuring the firm’s right to be heard was respected, thereby maintaining the procedural fairness essential to the integrity of financial regulation.

The intervention followed a multistage trajectory, strategically prioritising institutional stability over immediate commercial expansion. This process was reinforced by a granular review of the Pillar I and Pillar II frameworks of SII, the dual cornerstones of prudential soundness and effective governance for insurance undertakings.²⁴ While Pillar I entailed an assessment of the entity’s quantitative requirements, including the calibration of technical provisions and the adequacy of the Solvency Capital Requirement (SCR) and Minimum Capital Requirement (MCR), Pillar II necessitated an evaluation of SoG, which included implementing adequate segregation of duties and the “4-eye principle”.

Central to this qualitative review was the Own Risk and Solvency Assessment (ORSA)²⁵ and the integrity of the firm’s IT governance. Rather than maintaining a passive reliance on the entity’s self-reported data, the MFSA adopted a cross-functional, multidisciplinary approach. By integrating the expertise of actuarial and conduct specialists, the MFSA was able to substantively challenge the firm’s reserving methodologies and the recoverability of its assets. This synthetic analysis of quantitative and qualitative streams, specifically the cross-referencing of quarterly management accounts and quantitative reporting templates against the findings of MFSA’s onsite inspections, was essential. It enabled the identification of significant valuation discrepancies, most notably regarding the treatment of intercompany loans, which had previously obscured the firm’s true financial position.

While the supervisory strategy of intrusive intervention served to prevent further risk accumulation and neutralise immediate threats to solvency, its ultimate purpose was that of transitioning into a secondary phase of MFSA’s oversight of remediation. This transition ensured that the “supervisory shock” resulting from the supervisory expectation to cease all new business activities, was converted into the appropriate governance culture and compliance with prudential requirements. As a result, setting the stage for the eventual verification by the MFSA of the firm’s remediation and implementation of the Authority’s expectations.

Verification of Remediation

The success of this supervisory engagement in achieving remediation was based on its focus on the firm’s strengthening of the overall governance and prudential situation. Two years following the initial supervisory engagement, the MFSA conducted a secondary, on-site inspection to verify practical implementation of the firm’s remediation plan. This follow-up engagement moved beyond mere policy review to evaluate the Board’s capacity to manage the institution in a sound and prudent manner. The scope was purposefully broad, encompassing the operational efficacy of the Compliance and Risk Management functions and the robustness of the internal control environment.

Furthermore, the MFSA conducted a prudential review of technical reserves. This was complemented by an evaluation of the Investment Management function under the prudent person principle, ensuring that asset allocation remained consistent with the firm’s risk appetite. This approach reinforces the supervisory philosophy that accountability is achieved not through passive rule-monitoring, but through an intrusive evaluation of a firm’s actual governance substance and long-term resilience.²⁶

Diagram – Escalation of Regulatory Intensity²⁷

Through the issuance of post-inspection findings and ORSA feedback letters, combined with constant engagement, including exit interviews with key functionaries, and tripartite dialogues with external auditors and the Insurance Manager, the Authority fostered a continuous remedial dialogue. This oversight model ensured that all stakeholders were aligned with the MFSA’s prudential objectives. Ultimately, the supervisory mandate was only fulfilled when supervisory expectations were evidenced in the firm’s day-to-day decision-making, financial resilience, and cultural transformation, eventually allowing the MFSA to lift the said expectations as the firm returned to a state of compliance.

Conclusion

This case study confirms that the efficacy of supervision is predicated upon timely escalation and the strategic deployment of corrective levers. In this instance, the transitioning of the supervisory approach from passive engagement to intrusive supervision and the imposition of a supervisory expectation to halt new business served as the critical point. This acted as a catalyst for reform, effectively decoupling the firm’s expansionary ambitions from its suboptimal operational base. Forcing the firm to prioritise the strengthening of its governance framework and prudential stability over business considerations. Ultimately, this study bridges the gap between abstract theory of regulation and the applied day-to-day mechanics and challenges of supervising the implementation of regulation in practice to achieve the desired consumer protection and financial system integrity outcomes. It reaffirms that where critical situations arise that threaten consumer protection and the integrity of the financial system, a supervisor must quickly shift supervisory approach from a passive monitor to intrusive supervisory engagement, thereby driving the necessary changes.

Footnotes

¹ Buttigieg, C. P., Sapiano, G., Consiglio, J., & Brunelli Zimmermann, B. (2024). COVID-19 Pandemic: lessons from the European system of financial supervision. European Law Review, 49, 338-356.

² Buttigieg, Christopher P., Effectiveness of Financial Supervision (May 05, 2024). Times of Malta, 26 May 2024, Available at SSRN: https://ssrn.com/abstract=4850678 or http://dx.doi.org/10.2139/ssrn.4850678 accessed 24.12.2025.

³ Delegation of underwriting (often called Delegated Authority or “giving the pen”) is an arrangement where an insurance company (the carrier) provides, a third party who is a specialised type of insurance intermediary, with underwriting authority and the authority to manage claims. The principal and the insurance intermediary enter into an agreement referred to as the binder agreement which defines the authority limits delegated to the insurance intermediary. The said intermediary can accept/refuse a risk on behalf of the insurer, issue policy documents, collect premiums and handle claims. They can also be co-manufacturers of insurance products.

⁴ Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast) (Text with EEA relevance).

⁵ Buttigieg, Christopher P., The Nature and Art of Financial Supervision: Reflections on a 25-Year Journey (July 29, 2025). Available at SSRN: https://ssrn.com/abstract=5585470 or http://dx.doi.org/10.2139/ssrn.5585470 accessed 24.12.2025.

^{6/ Postgraduate Diploma in Financial Regulation and Compliance – L-Università ta’ Malta}

⁷ Malta Financial Services Authority, Risk Based Supervision – Strengthening Our Supervisory Approach (2020) https://www.mfsa.mt/wp-content/uploads/2020/06/Risk-Based-Supervision-Stengthening-Our-Supervisory-Approach.pdf, accessed 23 December 2025.

⁸ Since the firm’s licensing preceded the pandemic by over a decade, this case study suggests that there may have been opportunities to further strengthen supervisory engagement. Certain governance weaknesses had been evolving over time. A more proactive escalation of supervisory measures might have mitigated these issues before they were compounded by the challenges of COVID-19. Nonetheless, the firm was categorised as low impact, with an equivalent level of supervisory engagement in line with the MFSA’s risk-based approach to supervision.

⁹ In the financial sectors, a “paper-only” compliance culture (also known as a “tick box” or “check box” culture) describes an organisation that prioritises the appearance of following rules over the actual intent of those rules. In such a culture, compliance is treated as a bureaucratic obstacle to be cleared rather than a set of ethical principles that guide business decisions.

¹⁰ Delegated Regulation (EU) 2015/35, article 258 inter alia requires “an insurance undertaking to implement and maintain a business continuity policy aimed at ensuring, in the case of an interruption to their systems and procedures, the preservation of essential data and functions and the maintenance of insurance and reinsurance activities, or, where that is not possible, the timely recovery of such data and functions and the timely resumption of their insurance or reinsurance activities..” A BCP is a proactive strategy designed to ensure that a firm can continue to operate—even at a reduced capacity—during and immediately after a disruption.

¹¹ Directive 2009/138/EC (Solvency II Directive), article 41 inter alia requires: … “all insurance and reinsurance undertakings to have in place an effective system of governance which provides for sound and prudent management of the business. … The system of governance shall be subject to regular internal review.”

¹² A supervisory deep dive is an intensive, targeted review into a particular area of a firm’s governance or operations. It goes beyond the review of high-level policies, and scrutinises the raw data, individual files, and the actual behaviour of a firm’s staff.

¹³ The Actuarial Function is a critical governance pillar required by regulators (like SII in Europe) to ensure an insurance undertaking remains financially stable.

While “actuarial science” is the field of study, the “Actuarial Function” is the official department or role responsible for the company’s long-term survival. See Article 48 of Directive 2009/138/EC.

¹⁴ Delegated Regulation (EU) 2015/35, Chapter IX, Section 1, Elements of the system of governance.

¹⁵ BIA is a core part of business continuity management, a systematic process to determine what happens to the company if a disaster strikes (e.g., a flood at HQ, or a massive server failure).

¹⁶ RTO is the maximum amount of time a business process or IT system can be “down” before the consequences become unacceptable to the company.

¹⁷ Groupthink is a psychological phenomenon where a group’s desire for harmony and “fitting in” becomes so strong that it overrides critical thinking. Instead of evaluating all options, the group rushes to a consensus to avoid conflict. The dangers of groupthink are significant because they can lead to failures in business and government, these may include: [a] suppression of dissent; [b] the illusion of invulnerability; and [c] moral and ethical blindness. Delegated Regulation (EU) 2015/35, article 268 inter alia requires functions of an insurance undertaking to act in an objective, fair and independent manner.

¹⁸ The assessment of competence in line with the MFSA’s fit and proper test is an ongoing test. GUIDANCE ON THE FITNESS AND PROPERNESS ASSESSMENT APPLIED BY THE AUTHORITY

¹⁹ Delegated Regulation (EU) 2015/35, article 297.

²⁰ Directive 2009/138/EC (Solvency II Directive), article 42, requires insurance undertakings “ensure that all persons who effectively run the undertaking or have other key functions at all times fulfil the following requirements: [a] their professional qualifications, knowledge and experience are adequate to enable sound and prudent management (fit); and [b] they are of good repute and integrity (proper).

²¹ Delegated Regulation (EU) 2015/35, article 268.

²² Directive 2009/138/EC (Solvency II Directive), Chapter VI, Section 2, Rules relating to technical provisions.

²³ This diagram was generated using an AI language model (Gemini 3) based exclusively on the conceptual framework provided by one of the authors.

²⁴ Directive 2009/138/EC (Solvency II Directive).

²⁵ Directive 2009/138/EC (Solvency II Directive), article 45.

²⁶ Buttigieg, Christopher P., The Nature and Art of Financial Supervision: Reflections on a 25-Year Journey (July 29, 2025). Forthcoming in the Journal of Financial Compliance,  Available at SSRN: https://ssrn.com/abstract=5585470 or http://dx.doi.org/10.2139/ssrn.5585470 accessed on the 24.12.2025.

²⁷ This diagram was generated using an AI language model (Gemini 3) based exclusively on the conceptual framework provided by one of the authors.