What Is Solvency II? The Three Pillars Explained

Solvency II is the prudential regime for insurance and reinsurance undertakings in the European Union. It is set out in Directive 2009/138/EC of 25 November 2009, applied from 1 January 2016, and it requires every insurer and reinsurer in scope to hold capital calibrated to the risks it runs, to operate a system of governance including an own risk and solvency assessment, and to report to its supervisor and to the public. The detail sits in Commission Delegated Regulation (EU) 2015/35 and in EIOPA's guidelines, and the whole regime is being amended by Directive (EU) 2025/2, which applies from 30 January 2027.

The Directive never uses the word "pillar". The three pillar structure is the conventional way of reading it, borrowed from banking supervision, and it is useful because each pillar is a different kind of obligation, tested in a different way, and usually handled by a different team and a different tool.

Who does Solvency II apply to?

Article 2(1) applies the Directive to direct life and non-life insurance undertakings established in a Member State, or wishing to become established there, and to reinsurance undertakings that conduct only reinsurance. Article 4 then carves out the smallest insurers. Today an undertaking is outside the Directive if, among other conditions, its annual gross written premium income does not exceed EUR 5 million and its gross technical provisions do not exceed EUR 25 million. From 30 January 2027 Directive (EU) 2025/2 raises those thresholds to EUR 15 million and EUR 50 million. Article 4(2) adds the ratchet: if any threshold is exceeded for three consecutive years, the Directive applies from the fourth year.

Because it is a directive rather than a regulation, the text you are actually held to is the national transposition, and the authority that supervises you is your national supervisor, not EIOPA. EIOPA issues guidelines and technical standards that supervisors apply, which is why the same article can be read slightly differently across borders.

Pillar 1: what are the quantitative requirements?

Pillar 1 is the balance sheet and the capital that has to sit behind it. Article 76 requires technical provisions for all insurance and reinsurance obligations, valued at the current amount the undertaking would have to pay to transfer them immediately to another undertaking, consistently with financial market information. Article 77 splits that value into a best estimate, the probability-weighted average of future cash flows discounted at the risk-free rate, and a risk margin. Own funds, under Article 87, are the sum of basic own funds and ancillary own funds.

Article 100 requires eligible own funds covering the Solvency Capital Requirement, calculated either with the standard formula or with an approved internal model. Article 101(3) fixes the calibration: the SCR corresponds to the Value-at-Risk of basic own funds at a 99.5 percent confidence level over one year, and Article 101(4) requires it to cover at least non-life, life and health underwriting risk, market risk, credit risk and operational risk. Beneath it sits the Minimum Capital Requirement in Articles 128 and 129, calculated as a linear function of technical provisions, premiums, capital at risk, deferred tax and expenses, calibrated to an 85 percent one-year Value-at-Risk, held between 25 and 45 percent of the SCR, subject to an absolute floor in euros that Article 300 indexes to inflation every five years, and recalculated at least quarterly.

All of this is actuarial work performed in capital models and reporting engines. Venvera does not perform it, and this page is not a guide to it.

Pillar 2: what is the system of governance?

Pillar 2 is how the undertaking is run and how the supervisor checks it. Article 40 places ultimate responsibility for compliance on the administrative, management or supervisory body. Article 41 requires an effective system of governance, proportionate to the nature, scale and complexity of the business, with written policies on at least risk management, internal control, internal audit and, where relevant, outsourcing, reviewed at least annually and approved in advance by the board. Article 42 requires the people who run the undertaking or hold key functions to be fit and proper. Article 44 requires a risk management system covering at least six named areas. Article 45 requires the own risk and solvency assessment. Articles 46 to 48 establish the compliance, internal audit and actuarial functions, and Article 49 keeps the undertaking fully responsible for what it outsources.

The supervisor's side of Pillar 2 is the supervisory review process in Article 36, whose first named item is the system of governance including the ORSA, and the capital add-on in Article 37, which a supervisor may impose where the system of governance deviates significantly from the standards and other measures are unlikely to fix it in time. Nothing in Pillar 2 is filed by a date. It is examined whenever the supervisor chooses to look. Our guides to Solvency II Pillar 2 requirements and to what to expect from an ORSA review go through the articles one by one.

Pillar 3: what has to be reported and disclosed?

Pillar 3 has two audiences. The public one is served by the Solvency and Financial Condition Report under Article 51, disclosed annually and covering the business and performance, the system of governance, the risk profile, the valuation bases and capital management, including the amounts of the SCR and MCR. The supervisory one is served by Article 35, which requires undertakings to submit the information necessary for supervision, and by Delegated Regulation Article 304, which lists what that comprises: the SFCR, a regular supervisory report submitted at least every three years, the ORSA supervisory report whenever an assessment is performed, and annual and quarterly quantitative templates.

The clocks are in the Delegated Regulation. Article 300 gives 14 weeks after the financial year end for the SFCR and Article 312 gives 14 weeks for the annual templates and the regular supervisory report, five weeks after each quarter end for the quarterly templates, and two weeks after concluding the assessment for the ORSA supervisory report. From 30 January 2027 the amended Directive changes the annual ones: Article 35b gives 16 weeks for annual supervisory information, five weeks for quarterly information and 18 weeks for the regular supervisory report, and Article 51(7) gives 18 weeks for the SFCR, which is also split into a part for policyholders and a part for market professionals.

What does Directive (EU) 2025/2 change?

Directive (EU) 2025/2 was published in the Official Journal on 8 January 2025. Member States must adopt transposing measures by 29 January 2027 and apply them from 30 January 2027. Across the three pillars the changes that matter most are these. The size exclusion in Article 4 rises to EUR 15 million of premium and EUR 50 million of technical provisions. A new Article 29a defines small and non-complex undertakings, classified through the notification process in Article 29b, and a set of proportionality measures attaches to that status, including a less frequent review of written policies and an ORSA at least every two years.

In Pillar 2, Article 41(2a) requires different persons to hold the risk management, actuarial, compliance and internal audit functions, Article 44(2)(e) names cybersecurity inside operational risk, Article 45(1) gains macroeconomic, macroprudential and liquidity elements, and a new Article 45a requires a climate change materiality assessment and, where exposure is material, at least two long-term climate scenarios analysed at intervals no longer than three years. In Pillar 3, the SFCR becomes a two part report under the rewritten Article 51, and Article 51a subjects the Solvency II balance sheet in the SFCR to audit for undertakings other than small and non-complex undertakings and captives. Pillar 1 changes, including a Cost-of-Capital rate of 4.75 percent for the risk margin from 30 January 2027 under the amended Article 77(6), sit outside the scope of this guide.

What the other results get wrong

The first error is the date. Solvency II did not arrive in 2016. Directive 2009/138/EC was adopted on 25 November 2009 with application originally set for 2012, then postponed, and Directive 2013/58/EU fixed the application date at 1 January 2016. Pages that describe it as a 2016 law tend also to miss that the text has been amended repeatedly since, most recently by Directive (EU) 2025/2.

The second is presenting Solvency II as a capital rule with some paperwork attached. Pillar 1 produces the number, but the supervisory review process in Article 36 evaluates the system of governance first, and the capital add-on in Article 37(1)(c) exists specifically for governance failures. An insurer with a comfortable solvency ratio and a weak system of governance is not in a comfortable position.

The third is treating "Solvency II software" as one category. The capital engine that calculates the SCR, the reporting tool that produces the templates, and the governance platform that runs Pillar 2 are three different products, and a buyer who expects one tool to do all three is set up to be disappointed. Our Solvency II software buyer's guide separates the three.

Where do you stand?

One question per pillar, plus the one that decides whether the others apply. Fill it in from your own records.

Venvera covers Pillar 2 only. Our Solvency II Pillar 2 software holds the system of governance, the ORSA as a governed process, the four key functions, fit and proper and outsourcing across 45 controls, and reuses governance evidence you already keep for DORA and ISO 27001. It does not calculate the SCR or MCR and it does not produce the quantitative templates. If Pillar 2 is where your gaps are, a free compliance check gives you a baseline.

Frequently asked questions

Is Solvency II a regulation or a directive?

A directive. Directive 2009/138/EC is transposed into national law by each Member State, so the binding text is national. The detailed rules in Commission Delegated Regulation (EU) 2015/35 are a regulation and apply directly.

When did Solvency II start to apply?

1 January 2016, the application date fixed by Directive 2013/58/EU. The Directive itself was adopted on 25 November 2009.

Is the ORSA Pillar 1 or Pillar 2?

Pillar 2. Article 45 places the own risk and solvency assessment inside the risk management system, and Article 45(7) says it shall not serve to calculate a capital requirement. It uses Pillar 1 numbers, but it is a governance process tested through the supervisory review in Article 36.

What is the difference between the SCR and the MCR?

The SCR is the capital an undertaking needs to absorb a one-in-200-year loss over one year, calibrated to a 99.5 percent Value-at-Risk under Article 101(3). The MCR is the lower floor below which policyholders are exposed to an unacceptable level of risk, calibrated to 85 percent and held between 25 and 45 percent of the SCR under Article 129.

When do the Directive (EU) 2025/2 changes apply?

Member States must adopt and publish transposing measures by 29 January 2027 and apply them from 30 January 2027.

Primary sources

Article references above are taken from Articles 2, 4, 35, 36, 37, 40 to 49, 51, 76, 77, 87, 100, 101, 128, 129 and 300 of Directive 2009/138/EC, the application date in Directive 2013/58/EU, the amendments in Directive (EU) 2025/2 including its Article 4 on transposition, and Articles 300, 304 and 312 of Commission Delegated Regulation (EU) 2015/35. National transposition may add detail. Confirm the current text before relying on a specific provision.