Learn
There is one official estimate of what Solvency II costs, and it comes from the European Commission. The impact assessment accompanying the 2021 review proposal, SWD(2021) 260 final of 22 September 2021, quotes the Commission's study on the costs of compliance for the financial sector: the average general cost of complying with Solvency II is EUR 12 million one-off and EUR 2.7 million a year ongoing, which is 3.18 percent and 0.96 percent of total operating costs respectively. The same document calls the one-off figure the highest among the financial services frameworks it compared.
Those are averages across the whole regime, all three pillars, for the undertakings in the study, and they say nothing about your undertaking on their own. What they do say is that the recurring cost is large, that it is a permanent share of operating cost rather than a project, and that the legislator considered it heavy enough to rewrite the proportionality rules. Below is what Pillar 2 contributes to that number, where the 2027 amendments cut it, and how to size your own.
| Fact | Detail |
|---|---|
| The official figures | EUR 12 million one-off, EUR 2.7 million ongoing, on average, from the study quoted in the Commission's impact assessment SWD(2021) 260. Whole-regime figures, not Pillar 2 alone. |
| What the review expects to save | Up to EUR 500 million a year by excluding up to 186 small firms from mandatory scope, and at least EUR 50 million a year from proportionality for at least 249 low-risk firms. |
| The Pillar 2 reliefs | Less frequent ORSA, less frequent policy review and combined key functions: the Commission estimated approximately up to one FTE per firm. |
| When they apply | Directive (EU) 2025/2 must be transposed by 29 January 2027 and applied from 30 January 2027 (its Article 4). |
| What Pillar 2 is | The system of governance in Articles 40 to 49 of Directive 2009/138/EC, explained in our guide to Pillar 2 requirements. Nothing in it is calculated; all of it is tested. |
What does Solvency II Pillar 2 compliance cost?
Any single figure is wrong until four things are known: whether you will be a small and non-complex undertaking from 30 January 2027, how many of the four key functions are already staffed by separate people, whether you run DORA or ISO 27001 governance you can reuse, and whether your ORSA is a process or a document. The useful move is to take the Commission's population figures, separate the governance share from the capital and reporting share, and then adjust for your own position.
The impact assessment gives you a way to do the first step. When it estimated the saving from proportionality, it made what it called the conservative assumption that the requirements which can be made proportionate represent between 5 and 10 percent of total ongoing compliance costs, and the measures it had in mind were governance and reporting ones: the frequency of the ORSA report, the frequency of the mandatory review of written policies, and the possibility of one person holding several key functions. On the EUR 2.7 million average that slice is EUR 135 000 to EUR 270 000 a year. That is the part of Pillar 2 the legislator thought it could trim, not the whole of Pillar 2, but it is the only official decomposition that exists.
The one official estimate, and how to read it
SWD(2021) 260 is the Commission staff working document behind the proposal that became Directive (EU) 2025/2. Its section on proportionality describes the problem in its own title: insufficient proportionality of the prudential rules generating unnecessary administrative and compliance costs for small and less complex insurers. It notes that the lack of any reassessment of the Article 4 thresholds "may imply high compliance costs for small companies in the scope of Solvency II, which may not compensate the benefit of being subject to Solvency II".
Three things follow, and the third is the one to take to your board.
First, these are estimates made for legislative purposes, from a study covering many undertakings much larger and much smaller than yours. They are an anchor, not a quote. Second, they are whole-regime figures. Pillar 1 model and valuation work and Pillar 3 reporting systems sit inside them, and for most undertakings those are the larger share. Third, the ongoing figure is close to a quarter of the one-off figure, every year, indefinitely. A governance programme that budgets year one as the expensive year and year two as maintenance has the shape backwards, because the Directive's own text makes most of Pillar 2 recurring.
What the other results get wrong about Solvency II cost
Two errors recur across the pages that rank for this query.
The first is treating the cost of Solvency II as the cost of the capital model. Pages written by actuarial and reporting vendors describe the SCR, the QRTs and the systems that produce them, and stop there. That is Pillars 1 and 3. Pillar 2 has no model and no filing template, which is why it is left out of the estimate and then arrives as a supervisory finding. Governance findings are slow and expensive to close because they are about behaviour, not a number you can recalculate.
The second is quoting a per-undertaking figure without saying what it covers. The Commission's EUR 12 million and EUR 2.7 million are averages across the regime. Presenting them as the cost of Pillar 2 overstates it; presenting the one FTE proportionality saving as the cost of Pillar 2 understates it by an order of magnitude. Use the figures for what they are: a population anchor and a legislator's estimate of the trimmable slice.
The seven lines every Pillar 2 budget contains
Seven lines. All of them recur, because every one of them is a requirement to keep doing something, not to build something.
1. Key function holders. Article 44(4) requires a risk management function, Article 46 a compliance function, Article 47 an internal audit function and Article 48 an actuarial function. From 30 January 2027 the new Article 41(2a) requires different persons for all four, performed independently. Small and non-complex undertakings, and undertakings with prior supervisory approval, may let the risk, actuarial and compliance holders also hold other functions or sit on the board, but never internal audit. For a small insurer this is the single largest Pillar 2 line, and the amendment decides whether it is three salaries or four.
2. Written policies. Article 41(3), as amended, requires written policies on at least risk management, internal control, internal audit, remuneration and, where relevant, outsourcing, implemented, reviewed at least annually and approved in advance by the board. Delegated Regulation (EU) 2015/35 adds a written remuneration policy in Article 258(1)(l), a business continuity policy in Article 258(3), a fit and proper policy in Article 273 and a written outsourcing policy in Article 274. Small and non-complex undertakings may review at least every five years unless the supervisor requires more. The cost is the annual review and approval cycle, not the drafting.
3. The ORSA process. Article 45(5), as amended, requires the assessment annually and without delay after any significant change in the risk profile; small and non-complex undertakings and qualifying captives may run it at least every two years. Delegated Regulation Article 312(1)(b) gives two weeks after concluding the assessment to file the supervisory report. From 2027 the assessment also has to cover macroeconomic developments under Article 45(1)(d), and Article 45a adds climate scenario analysis for undertakings with material exposure. Our guide to what to expect from an ORSA review describes the four documents a supervisor asks for.
4. Fit and proper. Article 42 requires everyone who runs the undertaking or holds a key function to be fit and proper, and the amended Article 42(2) requires notification of any change in those persons with the information needed to assess them. Article 42(4) gives supervisors the power to require removal. The recurring cost is the assessment on appointment and the notification on every change.
5. Outsourcing. Article 49 keeps the undertaking fully responsible for what it outsources and Article 49(3) requires notification to the supervisor before outsourcing critical or important functions. Where the service is ICT, DORA's register and contract requirements apply on top. One register serving both is the saving; two is the cost.
6. Internal audit and internal review. Article 47 requires an objective and independent internal audit function whose findings go to the board, and Article 41(1), as amended, requires the regular internal review of the system of governance to assess the composition, effectiveness and internal governance of the board itself, with a diversity policy including quantitative gender-balance objectives.
7. The supervisory review. Article 36 has the supervisor review the system of governance, including the ORSA, and Article 37(1)(c) lets it impose a capital add-on where governance deviates significantly from the standard. Pillar 2 has no filing deadline of its own; it is examined whenever the supervisor chooses to look, and the cost of the review is the cost of producing evidence for it. National supervisory levies are set by each supervisor and belong on this line too.
Where do the 2027 reliefs come from?
Directive (EU) 2025/2 attacks the cost at two levels, exactly as the impact assessment proposed. At the outer edge it raises the Article 4 size thresholds: an insurer is outside the Directive when its annual gross written premium does not exceed EUR 15 million, up from EUR 5 million, and its gross technical provisions do not exceed EUR 50 million, up from EUR 25 million, with the same EUR 50 million limit for the group. The impact assessment expected up to 186 firms to leave mandatory scope on that basis.
Inside the Directive it creates the small and non-complex undertaking. The new Article 29a sets the criteria, which must be met for two consecutive financial years and include, for non-life business, annual gross written premium of not more than EUR 100 million, a three-year average net combined ratio below 100 percent and cross-border premium below EUR 20 million or 10 percent of the total; for life business, gross technical provisions of not more than EUR 1 billion and an interest rate risk submodule of not more than 5 percent of technical provisions; for both, market and counterparty risk of not more than 20 percent of investments, accepted reinsurance of not more than 50 percent of premium, and compliance with the SCR. Article 29b sets the classification process, and Article 29c lets a classified undertaking use all proportionality measures unless the supervisor raises a serious concern about its risk profile. Undertakings that miss the criteria may still apply under Article 29d for prior approval to use the governance measures in Articles 35(5a), 41, 45(1b) and 45(5); the supervisor must answer within two months, or four months for requests received before 31 July 2027.
What those measures are worth is the Commission's one-FTE estimate, and it depends on your starting position. An undertaking already running the four functions with four people gains nothing from Article 41(2a). One running the ORSA annually with a two-week filing discipline gains a year off between runs but keeps every trigger for an ad hoc rerun. Our guide to what Solvency II is and how the three pillars fit together places these changes against the Pillar 1 and Pillar 3 ones arriving on the same date.
Why the recurring cost is the real number
Every one of the seven lines above is written in the present tense. Policies are reviewed at least annually. The ORSA is performed annually or every two years and after every significant change. Fit and proper is notified on every change. Internal audit reports to the board on a cycle. The supervisor reviews whenever it chooses. The Commission's own figures agree: the ongoing cost is close to a quarter of the one-off cost, every year, and the trimmable slice it identified is 5 to 10 percent of the ongoing figure, not of the one-off one.
The practical test for a Pillar 2 budget is whether year two is funded to run the system rather than to maintain documents. If the only line that recurs is a licence fee, the plan has funded the drafting and not the governance, which is the shape of programme that passes its first review and produces a finding at its third.
Size your own Pillar 2 budget
| Question | Effect on your number |
|---|---|
| Will you meet the Article 29a criteria for two consecutive years? | Decides whether the five-year policy cycle, the two-year ORSA and combined key functions are available automatically, or only with Article 29d approval |
| How many of the four key functions are held by separate people today? | Each function you have to separate by 30 January 2027 is a new recurring salary line under Article 41(2a) |
| Is the ORSA a process with a policy, a record and a filing discipline, or a document? | A document costs a rewrite each year; a process costs less each year and survives a review |
| Do you run DORA or ISO 27001 governance already? | The cybersecurity half of Article 44(2)(e), the outsourcing register and much of internal control can reuse that evidence |
| How many critical or important outsourcings do you hold? | Each needs prior notification under Article 49(3) and, for ICT, a DORA register entry; the line scales with the count |
| Have you assessed whether climate change risk is material? | If it is, Article 45a adds at least two long-term scenarios to the ORSA at intervals no longer than three years |
How to cut the number without cutting the compliance
Classify early. If you expect to meet Article 29a, the criteria are measured over the two financial years before classification, so the data you will need from 2027 is being generated now.
Build one governance control set. The written policies, the outsourcing register, the fit and proper file and the internal control framework are asked for by DORA, ISO 27001 and Solvency II in overlapping terms. Maintaining a separate programme per framework is the most expensive way to reach the same position.
Run the ORSA as a process. The two-week filing clock and the ad hoc trigger are what a supervisor tests, and a process with a record costs less to rerun than a report costs to rewrite.
Budget year two before you approve year one. If nobody can say what the four functions, the policy cycle and the ORSA cost next year, year one is not a plan.
Our Solvency II ORSA and governance checklist scores all 45 items in a spreadsheet, and the Pillar 2 software buyer's guide explains which tool category covers this work and which do not. If you want a baseline first, a free compliance check tells you which rows above you will struggle with. Our Solvency II Pillar 2 software holds the 45 governance controls with an owner, a review date and the evidence behind each, runs the ORSA as a governed process, and reuses DORA and ISO 27001 governance evidence through a crosswalk; the capital and reporting numbers stay with the actuarial and reporting tools that produce them. Pricing is published and flat, from EUR 399 per month.
Frequently asked questions
Is EUR 2.7 million a year the cost of Pillar 2?
No. It is the Commission's average ongoing cost of complying with the whole of Solvency II, from the study quoted in SWD(2021) 260. The only official decomposition is the assumption that the proportionality-eligible requirements, mainly governance and reporting, are 5 to 10 percent of that figure.
Will becoming a small and non-complex undertaking remove Pillar 2?
No. It changes frequencies and permits combined key functions. The system of governance, the ORSA, fit and proper and the outsourcing rules all still apply, and Article 29c lets the supervisor withdraw the measures where it has serious concerns about the risk profile or finds the system of governance ineffective within the meaning of Article 41.
Do the 2027 rules apply to a captive?
The definition of small and non-complex undertaking in Article 13 includes captive insurance and reinsurance undertakings, and the amended Article 45(5) lets qualifying captives run the ORSA at least every two years whether or not they are classified, provided the insured persons are group entities or eligible natural persons and there is no compulsory third-party liability business.
Can the supervisor charge me for Pillar 2 failings?
Article 37(1)(c) allows a capital add-on where the system of governance deviates significantly from the standards in Articles 41 to 49, and Article 41(5) gives the everyday power to require the system to be improved. Neither is a fine, but both cost money.
Where does the EUR 12 million figure come from?
From the study on the costs of compliance for the financial sector, as quoted in the REFIT cost-savings table of the Commission's impact assessment SWD(2021) 260 of 22 September 2021. The impact assessment presents it as the average general cost of compliance with Solvency II.
Primary sources
Cost figures are taken from the problem definition and the REFIT cost-savings table in Commission Staff Working Document SWD(2021) 260 final of 22 September 2021. Article references are taken from Articles 4, 29, 36, 37, 41, 42, 44 to 49 of Directive 2009/138/EC, the new Articles 29a to 29e and the amendments to Articles 4, 13, 35, 41, 42, 44, 45 and 45a in Directive (EU) 2025/2 including its Article 4 on transposition, and Articles 258, 273, 274 and 312 of Commission Delegated Regulation (EU) 2015/35. Supervisory levies are set nationally. Confirm the current text and your supervisor's published expectations before relying on a specific provision.
