The second-biggest US life insurance company has a risk problem. After reporting $3.8 billion of derivative hedging losses in the six months up to March 2017, MetLife surprised the market last week with a $525 million increase in reserves when it disclosed it had failed to make pension payments to 30,000 customers. That prompted the SEC to open an investigation into the insurance giant.

The news comes after MetLife claimed victory in a fiercely fought campaign to escape Federal Reserve systemic risk supervision¹⁾The biggest US insurer, Prudential Financial, retains its systemically important status. The problems highlight existing weaknesses with US statutory insurance regulation, which gives MetLife a clean bill of health.

To understand why we should worry about MetLife, compare what we get told about large banks. Basel III rules, which are enforced by national bank supervisors, stipulate that banks should disclose their detailed capital requirements at least one year.

Risky Finance compiles these disclosures and the chart below shows how they fit together in aggregate for the 11 largest banks we cover.

Credit risk forms the largest part, at 69 per cent, followed by operational risk at 24 per cent. Using the total CET1 capital of the 11 banks as numerator, we get an average CET1 ratio of 12.4 per cent. Turning the denominator into a capital requirement gives a ratio of about 150 per cent.

Now consider US insurers. At one level there is plenty of disclosure. Companies like MetLife publish annual statements for their state level supervisors that contain hundreds of pages on their asset holdings and policyholder liabilities. The disclosures are more granular than those of banks, which seldom name borrowers or counterparties. But it’s hard to make sense of the insurer reports however.

To understand what regulates the behaviour of insurers, we need to see how those myriad assets and liabilities translate into risk. The National Association of Insurance Commissioners operates a framework for state level supervisors called risk-based capital. Like Basel, RBC involves a numerator – called total available capital, and the denominator, RBC.

The NAIC specifies the components that go into RBC. For life companies that means things like the asset risk of investments (equities and bonds), interest rate risks involved in policyholder obligations such as annuity guarantees and insurance risks such as mortality.

A key difference between the Basel and NAIC approaches is the treatment of diversification. At the level of individual risks, diversification is not counted using a value-at-risk model – equities and bonds are covered by factors that just add up, although insurers can use internal models for their interest rate risk. Once calculated, the NAIC then brings in diversification at the top level using a standardised formula.

The NAIC publishes the total capital requirements for different risk categories in aggregate, and we have created the chart below to show how they fit together and the amount of top-level diversification.

What we don’t know is how these risk components fit together at the level of individual insurers. The NAIC deems this information to be confidential, and only the total capital (the numerator) and the RBC (the denominator) are disclosed by the companies.

So in the case of MetLife, we know at the end of 2016 it had about $25 billion of total capital, which was 223 per cent of the company’s total RBC across all its state-level subsidiaries. (the reported ratio was 446 per cent but this is simply the result of an NAIC rule that lets insurers divide the calculated RBC by two).

Is this enough? We don’t have enough information to tell. Was interest rate risk miscalculated before the $3.8 billion hedging loss when bond yields rose after Trump’s election victory? We can’t say, although MetLife did subsequently spin off the business unit that carried this particular risk.

Contrast this opacity with bank Basel disclosures, which for example let us see last year how Morgan Stanley upped its VaR and stress VaR versus peers, which helped boost trading profits. Absurdly, the NAIC insists that insurer RBC data must be kept secret to prevent it being compared or ranked in the same way.

As for the most recent surprise with the missing pension payments, this amounts to an operational risk, which the NAIC doesn’t incorporate in RBC at all (the NAIC is now considering including operational risk but hasn’t reached a decision). Again, the contrast with bank supervision is striking.

Since the financial crisis, operational risk losses have dominated bank annual reports, not least because of endless misconduct fines. As MetLife demonstrates, this risk can be significant for insurers, and indeed European firms have to include the risk category under Solvency II regulations.

Finally, if Basel capital ratios aren’t enough to ensure bank solvency, we also have annual stress tests. For large US banks these are effectively a binding capital requirement.

When MetLife had a bank subsidiary it briefly fell subject to Dodd-Frank stress tests, but now as a pure insurer it is exempt. The NAIC has no stress test regime in place to supplement RBC, although in typical NAIC fashion, it is talking about the idea.

It’s fine to talk when equities are at record highs, and volatility and bond yields are close to record lows. But when the next financial crisis comes, it may be that US insurance is the place where problems appear first.