Skim time: 5 minutes · Listening time: 6.6 minutes. Prefer to listen? Flip reads this week's Brief here.

---

Ninety pages of comment letters crossed my desk this week. On a Wednesday night.

My wife asked what could possibly be in there. The price of your carrier's balance sheet.

Fitch, KBRA, and S&P Global wrote to state regulators. So did the American Council of Life Insurers, two investor and analyst associations, and one policy institute. The same complaint runs through all of them in different words. Nobody has defined what a bad rating looks like. Meanwhile California handed us a deadline. A bill that would kill one of the two theories behind thousands of website privacy suits has four days to clear both chambers.

Different rooms, same order of operations: the plumbing moves first, and your renewal moves later.

Here's what made the cut:

• Regulators want the authority to pull a rating provider out of the capital math. They have not said what earns that.
• A California vote due Monday could wipe out pending privacy claims filed as far back as 2025. It has not happened yet.
• A first-time CFO called our industry sleepy, then credited last year's turnaround to plain underwriting discipline.

Every week our team rips through 200+ insurance, legal, regulatory, and market-risk articles so you don't have to. This week: what sits under your carrier's capital, and a vote that could delete claims already open on your books.

---

Ninety pages of pushback on the plan to grade the graders

The firms in question grade the bonds a carrier holds.

They are not the agencies that rate a carrier's financial strength. The two get confused because both are called ratings. The Credit Rating Provider Working Group met August 12 in Columbus, Ohio, at the NAIC's summer national meeting.

On the table: a review process for the firms whose grades set how much capital a carrier holds against an asset.

About 90 pages of comment came back. Fitch, KBRA, and S&P Global wrote in, along with the American Council of Life Insurers, two investor and analyst associations, and the Pinpoint Policy Institute. Jake Garn, who directs financial regulation and licensing at the Utah Insurance Department, chairs the group.

The framework, he said, will not tell providers "what their methodology must be or how to do their jobs."

(source: InsuranceNewsNet)

So what?

The remedy is the part that reaches your balance sheet. The draft framework would let regulators stop recognizing a provider's grades when you calculate capital. It would also let them pull a whole asset class out of that math. Several commenters argue the NAIC does not hold that power.

The three rating agencies pressed a second point. Judging a firm by whether it agrees with the others rewards the herd over independent work. The terms that would trigger a finding still have no definitions.

Nothing moves until staff and consultant PwC turn the comments into a new draft, and projects like this have taken several meeting cycles before adoption. Our read: twelve to eighteen months, not this quarter.

Monday morning action: ask your investment team for the list of holdings where the capital charge rests on a single outside grade, and ask what a second grade would cost on the ten largest.

---

Four days that could erase two years of privacy claims

California's wiretap law dates to 1967.

The worry then was telephone taps. The worry now is website pixels. Senate Bill 690 would shut down one of the statute's two engines.

The amended bill, authored by Senator Anna Caballero, strips the private right to sue under Penal Code 638.51 for conduct on a website or app.

That is the pen register and trap-and-trace section, and it is the one plaintiffs use to reach website tracking technology. Only the Attorney General could bring those claims. It cleared Assembly Appropriations 15-0 on August 13 and sits on third reading.

Both chambers must vote by August 31.

(source: Stinson LLP; California Legislative Information)

The LION Lens

What happened — The bill moves website tracking claims under this section out of private hands and gives them to the Attorney General. It reaches back to pending claims in suits filed within two years before the start date of January 1, 2027 (source: Stinson LLP).

Why it matters — The statute allows $5,000 per violation, or three times actual damages if that is greater. No proof of harm required. Remove the count and the case reserve behind it comes back into question.

Practical implications — Two lists, not one. Every open privacy file carrying a claim under this section. And every page on your own sites running the technology that generates them.

So what?

Look at the vote history before you price the outcome. The Senate passed the original 35-0 in June 2025. The Assembly privacy committee passed the rewrite 14-0 on July 1. Appropriations passed it 15-0 on August 13. Every vote unanimous. And the bill still sat on the suspense file on August 5, where plenty of bills die. The opposition has not moved.

The relief is also narrower than it looks. The bill reaches filed suits. Demand letters sitting in your folder are a separate question, and at a community bank most of the exposure sits in that folder rather than on a docket.

Structure matters as much as the statute. Claims this size usually sit inside the retention or against a privacy sublimit. They rarely reach the tower, the excess layers stacked above your primary. What eats a sublimit is volume, not any one matter.

Plaintiffs are not going home, and the courts have not settled what 638.51 even covers. California federal judges have read the pen register definition to reach web pixels. California state judges have repeatedly read it narrowly and put tracking technology outside the statute. The Ninth Circuit's decision in Popa v. Microsoft, affirming dismissal under Pennsylvania's wiretapping statute, handed defendants a further argument: that a plaintiff must show the data collected was embarrassing, invasive, or otherwise private. Which courtroom a file lands in is doing as much work as the statute.

(source: Holland & Knight, February 2026; Hunton)

The LION POV

Here's how we're advising clients:

• Inventory the tracking technology by page and by vendor. Most of it arrived through a tag manager rather than your engineering team, which is why the count surprises people. Quote funnels, agent portals, and rate-comparison pages first.
• Take the reserve question to your actuaries, not to a headline. Ask what a signed bill would change and when they would recognize it. That timing is their judgment and your auditors' to review.
• Price for the migration. The surviving wiretapping count under Section 631 carries the same damages, so a California fix should not loosen your privacy terms elsewhere.

For a managing general agent (MGA) the exposure runs both directions. When your funnel generates the claim, your carrier's paper is in it too. Your delegated authority agreement decides who explains that to whom.

Want a read on how a retroactive privacy statute could touch your open cyber and professional liability files? Reach out for a confidential conversation.

---

The insurtech playbook turns out to be underwriting discipline

Guy Zetlser took the CFO seat at Hippo in March 2025.

First time in the job. He arrived from McKinsey, drawn to an industry he told CFO.com he found "pretty sleepy." Read what he credits for the turnaround.

None of it is new.

Raise capital when you can rather than when you need it. Grow only where you can grow profitably. Hold underwriting discipline in the good quarters too.

Roughly 540 employees turned a $40.5 million loss in 2024 into $57.7 million of net income in 2025.

(source: CFO.com)

So what?

His answer on artificial intelligence is worth stealing, and worth turning over.

He gave one auditable number instead of a story: claims adjusters are handling about 30% more files a month. A board can check that. Faster claims decisions made with a model are also the fact pattern plaintiff counsel builds bad-faith cases around. A carrier that cannot show what governed the call ends up defending the model instead of the file. Underwriters are asking the same question from their side. Expect to show model documentation, the point at which a person reviews, and how you watch the model drift. That goes for every model you lean on, not just the one in claims.

Two other signals matter at renewal. He is watching rate decisions to tune the portfolio, and he is moving the book toward casualty to cut weather risk. Casualty claims take years to develop, so a property writer adding that business changes the reserve profile behind its own program.

Monday morning action: ask for one number per workflow showing what AI changed this quarter, then ask who signs off when the model is wrong.

---

What LION is seeing in financial institution (FI) lines

Directors and officers (D&O) is mostly flat for regional and mutual carriers and MGAs, and firming for insurtechs. Errors and omissions (E&O) and insurance company professional liability (ICPL) are flat-to-firming across the board, with insurtechs seeing the sharpest increases at +4% to +9%. Cyber continues to soften for banks and investment managers but has flattened for carriers and MGAs. Fiduciary is the clearest firming signal in the stack, running +2% to +5% for regionals and MGAs and +3% to +6% for insurtechs. Crime and FI bond remain soft. Employment practices liability (EPL) is flat-to-firming regardless of sector.

---

The Bottom Line

Regulators are building a way to judge the firms that grade your carrier's assets. California has four days to vote on erasing a category of claims sitting in your reserves. The insurtech that called us sleepy credits last year's turnaround to discipline and one number it can prove. Two of those get decided by people who never sit in your renewal meeting. The third is a standard you can set yourself.

Three for your board on Monday

1. Pull the holdings where your capital charge rests on one outside grade. That list is your exposure to whatever the NAIC adopts.
2. Ask claims which open privacy files carry a pen register count. Ask your actuaries what a signed bill would change. Both questions before Monday.
3. Name one number per workflow showing what AI changed this quarter. Then name who signs off when the model is wrong.

If these questions raised others of your own, let's work through them. Reach out for a confidential conversation.

---

LION has published a structured review of the five most common D&O program gaps: the D&O Contract Vigilance Blueprint, a five-day email course available to clients and subscribers preparing for renewal.

• The policy mistakes we see most often when reviewing D&O programs
• Where your personal assets sit when the company can't indemnify you

Want it? Just reply to this email with the word "blueprint" and I'll sign you up.

Thank you for reading today's edition.

Stay Covered Everybody,

-FLIP

P.S. Want to share this edition? Copy the link below:

https://lionspecialty.kit.com/posts/90-pages-on-who-grades-your-carrier-s-bonds-4-days-to-erase-2-years-of-ca-privacy-claims-and-old-fashioned-underwriting-discipline-turns-a-loss-into-57-7m

And if this was forwarded to you, subscribe here: https://lionspecialty.kit.com/.

P.P.S. Nothing in this briefing constitutes legal advice. These are the opinions of the founder. It's market intelligence designed to help you ask better questions of your advisors and make sharper decisions at your next insurance renewal.

---

You're receiving this because you subscribed to the LION Specialty Boardroom Brief.
Unsubscribe  ·  Update your preferences