Chubb Limited: 10-K Risk Factor Changes

Our operations rely on the secure processing, storage, and transmission of confidential and other information and assets, including in our computer systems and networks and those of third-party service providers. Our business depends on effective information security and systems and the integrity and timeliness of the data our information systems use to run our business. 28 28 28 Table of Contents Table of Contents Our ability to adequately price products and services, to establish reserves, to provide effective, efficient and secure service to our customers, to value our investments and to timely and accurately report our financial results also depends significantly on the integrity and availability of the data we maintain, including that within our information systems, as well as data in and assets held through third-party service providers and systems. Like all global companies, our systems and those of our third-party service providers, have been, and will likely continue to be, targeted by or subject to viruses, malware or other malicious codes, unauthorized access, cyber-attacks, cyber frauds, ransomware or other unauthorized occurrences, on or conducted through our information systems, which jeopardize the confidentiality, integrity or availability of our information or information systems. Cybersecurity threats are rapidly evolving and those threats and the means for obtaining access to our systems are becoming increasingly sophisticated. Cybersecurity threats can originate from a wide variety of sources including terrorists, nation states, financially motivated actors, internal actors, or third parties, such as external service providers, and the techniques used change frequently or are often not recognized until after they have been launched. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks including the deployment of artificial intelligence by bad actors intent on finding and exploiting vulnerabilities, their use of "deep fakes," and long-term persistent attacks. Although we have implemented administrative and technical controls and have taken protective actions designed to reduce the risk of cyber incidents and to protect our information technology and assets, including conducting due diligence security reviews and negotiating agreements with third-party service providers, and we additionally endeavor to modify such procedures and agreements as circumstances warrant, such measures may be insufficient to prevent unauthorized access, computer viruses, malware or other malicious code or cyber-attack, ransomware, phishing scams, or similar attempts to fraudulently induce our employees or others to take actions which compromise our information or information systems, business compromise attacks, catastrophic events, system failures and disruptions, employee errors, negligence or malfeasance, loss of assets or data and other events that could have security consequences (each, a Security Event). As the breadth and complexity of our security infrastructure continues to grow, the risk of a Security Event increases. Such an event or events may jeopardize Chubb's or its clients' or counterparties' confidential and other information processed and stored within Chubb, and transmitted through its information systems, or otherwise cause interruptions, delays, or malfunctions in Chubb's, its clients', its counterparties', or third parties' operations, or result in data loss or loss of assets which could result in significant losses, reputational damage or an adverse effect on our operations and critical business functions. Chubb may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures and to pursue recovery of lost data or assets and we may be subject to litigation costs and losses, regulatory penalties (as described above) and financial losses that are either not insured against or not fully covered by insurance maintained. In instances where we rely on third parties to perform business functions and process data on our behalf, Chubb may be exposed to additional data security risk as a result of Security Events that impact the third party or others upon whom they rely. Despite the contingency plans and facilities, we have in place and our efforts to observe the regulatory requirements surrounding information security, our ability to conduct business may be adversely affected by a disruption of the infrastructure that supports our business in the communities in which we are located, or of outsourced services or functions. This may include a disruption involving electrical, communications, transportation, or other services used by Chubb or third parties on whom we rely. If a disruption occurs in one location and Chubb employees in that location are unable to conduct business or communicate with or travel to other locations, our ability to service and interact with clients may suffer and we may not be able to successfully implement contingency plans that depend on communication or travel.

Our operations rely on the secure processing, storage, and transmission of confidential and other information and assets, including in our computer systems and networks and those of third-party service providers. Our business depends on effective information security and systems and the integrity and timeliness of the data our information systems use to run our business. Our ability to adequately price products and services, to establish reserves, to provide effective, efficient and secure service to our customers, to value our investments and to timely and accurately report our financial results also depends significantly on the integrity and availability of the data we maintain, including that within our information systems, as well as data in and assets held through third-party service providers and systems. Like all global companies, our systems have and those of our third-party service providers, have been, and will likely continue to be, subject to threats from viruses or other malicious codes, unauthorized access, cyber-attacks, cyber frauds or other computer-related penetrations. Although we have implemented administrative and technical controls and have taken protective actions to reduce the risk of cyber incidents and to protect our information technology and assets, including conducting due diligence security reviews and negotiating agreements with third-party service providers, and we additionally endeavor to modify such procedures and agreements as circumstances warrant, such measures may be insufficient to prevent unauthorized access, computer viruses, malware or other malicious code or cyber-attack, business compromise attacks, catastrophic events, system failures and disruptions, employee errors, negligence or malfeasance, loss of assets or data and other events that could have security consequences (each, a Security Event). As the breadth and complexity of our security infrastructure continues to grow, the potential risk of a Security Event increases. Such an event or events may jeopardize Chubb's or its clients' or counterparties' confidential and other information processed and stored within Chubb, and transmitted through its computer systems and networks, or otherwise cause interruptions, delays, or malfunctions in Chubb's, its clients', its counterparties', or third parties' operations, or result in data loss or loss of assets which could result in significant losses, reputational damage or an adverse effect on our operations and critical business functions. Chubb may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures and to pursue recovery of lost data or assets and we may be subject to litigation costs and losses, regulatory penalties (as described above) and financial losses that are either not insured against or not fully covered by insurance maintained. In instances where we rely on third parties to perform business functions and process data on our behalf, Chubb may be exposed to additional data security risk. Despite the contingency plans and facilities we have in place and our efforts to observe the regulatory requirements surrounding information security, our ability to conduct business may be adversely affected by a disruption of the infrastructure that supports our business in the communities in which we are located, or of outsourced services or functions. This may include a disruption involving electrical, communications, transportation, or other services used by Chubb. If a disruption occurs in one location and Chubb employees in that location are unable to occupy our offices and conduct business or communicate with or travel to other locations, our ability to service and interact with clients may suffer and we may not be able to successfully implement contingency plans that depend on communication or travel.

We may from time-to-time face challenges resulting from changes in applicable law and regulations in particular jurisdictions, or changes in approach to oversight of our business from insurance or other regulators. Our insurance and reinsurance subsidiaries conduct business globally. Our businesses in each jurisdiction are subject to varying degrees of regulation and supervision. The laws and regulations of the jurisdictions in which our insurance and reinsurance subsidiaries are domiciled require, among other things, maintenance of minimum levels of statutory capital, surplus, and liquidity; various solvency standards; and periodic examinations of subsidiaries' financial condition. In some jurisdictions, laws and regulations also restrict payments of dividends and reductions of capital. Applicable statutes, regulations, and policies may also restrict the ability of these subsidiaries to write insurance and reinsurance policies, to make certain investments, and to distribute funds. The purpose of insurance laws and regulations generally is to protect policyholders and ceding insurance companies, not our shareholders. For example, some jurisdictions have enacted various consumer protection laws that make it more burdensome for insurance companies to sell policies and interact with customers in personal lines businesses. Failure to comply with such regulations can lead to significant penalties and reputational injury. The foreign and U.S. federal and state laws and regulations that are applicable to our operations are complex and may increase the costs of regulatory compliance or subject our business to the possibility of regulatory actions or proceedings. Laws and regulations not specifically related to the insurance industry include trade sanctions that relate to certain countries, anti-money laundering laws, and anti-corruption laws. The insurance industry is also affected by political, judicial, and legal developments that may create new and expanded regulations and theories of liability. The current economic and financial climates present additional uncertainties and risks relating to increased regulation and the potential for increased involvement of the U.S. and other governments in the financial services industry. Furthermore, governments, regulators, investors, customers, and other stakeholders have increased their focus on climate change risk reporting. A variety of governments and regulators have adopted or are in the process of adopting climate change and greenhouse gas emissions disclosure requirements for which Chubb and certain of its individual subsidiaries are or will be subject to in the future. Chubb also receives requests for information from investors, customers and other stakeholders from time to time on various aspects of its policies and strategies relating to climate change. This has resulted in expanded and increasingly complex expectations related to reporting under multiple, various, disparate and potentially inconsistent reporting requirements, increased due diligence, and potential requirements for the reporting of scope 3 emissions. Responding to such disclosure requirements and requests involves risks and uncertainties, including depending in part on estimates and third-party data that is outside our control. New reporting standards, regulations and requirements with various aims and goals could expose us to legal, regulatory, investor and other stakeholder scrutiny, and customers that disagree with our actions or reporting on climate change may determine not to do business with us, all of which may adversely affect our business, reputation and results of operations. Regulators in countries where we have operations continue to work with the International Association of Insurance Supervisors (IAIS) to consider changes to insurance company supervision, including with respect to group supervision and solvency requirements. The IAIS has developed a Common Framework for the Supervision of Internationally Active Insurance Groups (ComFrame), which is focused on the effective group-wide supervision of international active insurance groups (IAIGs), such as Chubb. As part of ComFrame, the IAIS is developing an international capital standard for such IAIGs. The details of this global capital standard and its applicability to Chubb are evolving and uncertain at this time. In addition, Chubb businesses across the European Union (EU) are subject to Solvency II, a capital and risk management regime, and our Bermuda businesses are subject to an equivalent of the EU's Solvency II regime. Also applicable to Chubb businesses are the requirements of the Swiss Financial Market Supervisory Authority (FINMA) whose regulations include Swiss Solvency Tests. There are also Risk Based 27 27 27 Table of Contents Table of Contents Capital (RBC) requirements in the U.S. which are also subject to revision in response to global developments. The impact to Chubb of these developments remains uncertain, although currently we do not expect that our capital management strategies, results of operations and financial condition will be materially affected by these regulatory changes.

We may from time to time face challenges resulting from changes in applicable law and regulations in particular jurisdictions, or changes in approach to oversight of our business from insurance or other regulators. Our insurance and reinsurance subsidiaries conduct business globally. Our businesses in each jurisdiction are subject to varying degrees of regulation and supervision. The laws and regulations of the jurisdictions in which our insurance and reinsurance subsidiaries are domiciled require, among other things, maintenance of minimum levels of statutory capital, surplus, and liquidity; various solvency standards; and periodic examinations of subsidiaries' financial condition. In some jurisdictions, laws and regulations also restrict payments of dividends and reductions of capital. Applicable statutes, regulations, and policies may also restrict the ability of these subsidiaries to write insurance and reinsurance policies, to make certain investments, and to distribute funds. The purpose of insurance laws and regulations generally is to protect policyholders and ceding insurance companies, not our shareholders. For example, some jurisdictions have enacted various consumer protection laws that make it more burdensome for insurance companies to sell policies and interact with customers in personal lines businesses. Failure to comply with such regulations can lead to significant penalties and reputational injury. The foreign and U.S. federal and state laws and regulations that are applicable to our operations are complex and may increase the costs of regulatory compliance or subject our business to the possibility of regulatory actions or proceedings. Laws and regulations not specifically related to the insurance industry include trade sanctions that relate to certain countries, anti-money 26 26 26 Table of Contents Table of Contents laundering laws, and anti-corruption laws. The insurance industry is also affected by political, judicial, and legal developments that may create new and expanded regulations and theories of liability. The current economic and financial climates present additional uncertainties and risks relating to increased regulation and the potential for increased involvement of the U.S. and other governments in the financial services industry. Regulators in countries where we have operations continue to work with the International Association of Insurance Supervisors (IAIS) to consider changes to insurance company supervision, including with respect to group supervision and solvency requirements. The IAIS has developed a Common Framework for the Supervision of Internationally Active Insurance Groups (ComFrame), which is focused on the effective group-wide supervision of international active insurance groups (IAIGs), such as Chubb. As part of ComFrame, the IAIS is developing an international capital standard for such IAIGs. The details of this global capital standard and its applicability to Chubb are evolving and uncertain at this time. In addition, Chubb businesses across the European Union (EU) are subject to Solvency II, a capital and risk management regime, and our Bermuda businesses are subject to an equivalent of the EU's Solvency II regime. Also applicable to Chubb businesses are the requirements of the Swiss Financial Market Supervisory Authority (FINMA) whose regulations include Swiss Solvency Tests. There are also Risk Based Capital (RBC) requirements in the U.S. which are also subject to revision in response to global developments. The impact to Chubb of these developments remains uncertain, although currently we do not expect that our capital management strategies, results of operations and financial condition will be materially affected by these regulatory changes.

Our pricing, establishment of liabilities for life insurance and annuity products, including reinsurance programs, are based upon various assumptions, including but not limited to equity market changes, interest rates, mortality rates, morbidity rates, and policyholder behavior. With the adoption of long-duration targeted improvements (LDTI), the accounting for our FPB reserves is also sensitive to changing interest rate conditions. We are required to update for changes in discount rates quarterly and review assumptions at least annually, which could cause volatility in our net income and shareholders' equity. Guaranteed minimum death benefits (GMDB) and guaranteed living benefits (GLB), principally guaranteed minimum income benefits (GMIB), associated with variable annuity contracts, are collectively referred to as market risk benefits (MRB). The process of establishing MRB liabilities relies on our ability to accurately estimate insured events that have not yet occurred but that are expected to occur in future periods. Significant deviations in actual experience from assumptions used for pricing and for MRB liabilities could have an adverse effect on the profitability of our products and our business. Under reinsurance programs covering variable annuity guarantees, we assumed the risk of GMDB and GMIB associated with variable annuity contracts. We ceased writing this business in 2007. Our net income is directly impacted by the changes in the MRB liability reflecting market conditions, policyholder behavior, and other changes in assumptions. We view our variable annuity reinsurance business as having a similar risk profile to that of catastrophe reinsurance, with the probability of long-term economic loss relatively small at the time of pricing. Adverse changes in market factors and policyholder behavior will have an impact on consolidated net income.

Our pricing, establishment of liabilities for life insurance and annuity products, including reinsurance programs, are based upon various assumptions, including but not limited to equity market changes, interest rates, mortality rates, morbidity rates, and policyholder behavior. Effective January 1, 2023, we adopted new U.S. GAAP accounting guidance for long-duration contracts (LDTI) that affects the accounting for guaranteed minimum death benefits (GMDB) and guaranteed living benefits (GLB), principally guaranteed minimum income benefits (GMIB), associated with variable annuity contracts, collectively referred to as market risk benefits (MRB). The process of establishing MRB liabilities relies on our ability to accurately estimate insured events that have not yet occurred but that are expected to occur in future periods. Significant deviations in actual experience from assumptions used for pricing and for MRB liabilities could have an adverse effect on the profitability of our products and our business. Under reinsurance programs covering variable annuity guarantees, we assumed the risk of GMDB and GMIB, associated with variable annuity contracts. We ceased writing this business in 2007. Our net income is directly impacted by the change in the fair value of the MRB liability. We view our variable annuity reinsurance business as having a similar risk profile to that of catastrophe reinsurance, with the probability of long-term economic loss relatively small at the time of pricing. Adverse changes in market factors and policyholder behavior will have an impact on consolidated net income. With the adoption of LDTI, effective January 1, 2023, the accounting for our FPB reserves will also be sensitive to changing interest rate conditions. The LDTI guidance requires that we update FPB reserves for changes in discount rates quarterly which could cause volatility in our shareholders' equity.

Chubb Limited and our non-U.S. subsidiaries operate in a manner so that none of these companies should be subject to U.S. tax (other than U.S. excise tax on insurance and reinsurance premium income attributable to insuring or reinsuring U.S. risks and U.S. withholding tax on some types of U.S. source investment income), because none of these companies should be treated as engaged in a trade or business within the U.S. However, because there is considerable uncertainty as to the activities that constitute being engaged in a trade or business within the U.S., we cannot be certain that the Internal Revenue Service (IRS) will not contend successfully that Chubb Limited or its non-U.S. subsidiaries are engaged in a trade or business in the U.S. If Chubb Limited or any of its non-U.S. subsidiaries were considered to be engaged in a trade or business in the U.S., such entity could be subject to U.S. corporate income and branch profits taxes on the portion of its earnings effectively connected to such U.S. business, in which case our results of operations and our shareholders' investments could be adversely affected. Historically, our Bermuda operations have not been subject to Bermuda income tax. However, on December 27, 2023, the Government of Bermuda enacted a 15 percent income tax effective January 1, 2025. We currently anticipate that the new Bermuda income tax would be a covered tax under the OECD’s global minimum tax regime discussed in our Risk Factor below titled “The Organization for Economic Cooperation and Development (OECD), European Union (EU), Swiss Federal Council, and other jurisdictions are considering, have considered, or have passed measures that might change long standing tax principles that could increase our taxes.” Therefore, we would expect any implementation of the OECD global minimum tax regime to count any enacted Bermuda income tax toward such OECD minimum tax. The imposition of the Bermuda corporate income tax could have an adverse effect on our results of operations beginning in 2025.

Chubb Limited and our non-U.S. subsidiaries operate in a manner so that none of these companies should be subject to U.S. tax (other than U.S. excise tax on insurance and reinsurance premium income attributable to insuring or reinsuring U.S. risks and U.S. withholding tax on some types of U.S. source investment income), because none of these companies should be treated as engaged in a trade or business within the U.S. However, because there is considerable uncertainty as to the activities that constitute being engaged in a trade or business within the U.S., we cannot be certain that the Internal Revenue Service (IRS) will not contend successfully that Chubb Limited or its non-U.S. subsidiaries are engaged in a trade or business in the U.S. If Chubb Limited or any of its non-U.S. subsidiaries were considered to be engaged in a trade or business in the U.S., such entity could be subject to U.S. corporate income and branch profits taxes on the portion of its earnings effectively connected to such U.S. business, in which case our results of operations and our shareholders' investments could be adversely affected. The Bermuda Minister of Finance, under the Exempted Undertakings Tax Protection Act 1966 of Bermuda, as amended, has given Chubb Limited and its Bermuda insurance subsidiaries a written assurance that if any legislation is enacted in Bermuda that would impose tax computed on profits or income, or computed on any capital asset, gain, or appreciation, then the imposition of any such tax would not be applicable to those companies or any of their respective operations, shares, debentures, or other obligations until March 31, 2035, except insofar as such tax would apply to persons ordinarily resident in Bermuda or is payable by us in respect of real property owned or leased by us in Bermuda. We cannot be certain that we will not be subject to any Bermuda tax after March 31, 2035.