Item 1. Business
Item 1. Business
Overview
Root is a technology company revolutionizing personal insurance with a pricing model based upon fairness and a modern customer experience. We operate primarily a direct-to-consumer model in which currently we acquire the majority of our customers through mobile applications.
We have built a company that recognizes each individual is unique and puts customers in control, rewarding them for their actions. For centuries, traditional insurance companies have grouped people into risk pools and long relied on the ‘law of large numbers’ to produce acceptable pricing on an aggregate basis. Fairness at the individual level has been largely ignored. Root is different—we use technology to measure risk based on individual performance, prioritizing fairness to the customer. The way we design and deliver insurance is not a simple tweak to the traditional insurance model—we are fundamentally reinventing insurance through technology, data science and a maniacal focus on the customer. While our opportunity is expansive and our ambition is global, our primary focus is on U.S. auto insurance.
We believe the $260 billion U.S. auto insurance market is ripe for disruption. Traditional methods of pooled risk assessment are not personalized and inherently less precise given individual behavioral data is underutilized or not measured as a component of the insurance risk assessment process. We believe traditional systems and processes have become outdated and are increasingly disconnected from the needs of consumers. Our initial focus on auto insurance was motivated by how well-suited we believe the product to be for fundamental improvement through technology. We believe Root is the innovator to drive this transformation.
Auto insurance is required for the vast majority of drivers in the United States and we believe it is typically the first insurance policy purchased by consumers. As a result, our auto-first strategy establishes the foundation for an expansive lifetime relationship with the opportunity to add other personal insurance lines as customer needs evolve. As part of our strategy, we have also established the technological foundation for an enterprise software offering, diversifying our revenue streams over time.
We believe the Root advantage is derived from our unique ability to efficiently and effectively bind insurance policies quickly, aided by segmenting individual risk based on complex behavioral data and proprietary telematics, a customer experience built for ease of use and a product offering made possible with our full-stack insurance structure. These are all uniquely integrated into a single cloud-based technology platform that captures the entire insurance value chain—from customer acquisition to underwriting to claims and administration to ongoing customer engagement.
As a full-stack insurance carrier, we have the infrastructure to design products and distribute, underwrite, administer and pay claims on all of our policies. Our model, supported by proprietary technology, allows us to be more adaptive across the value chain, provides complete design and feature discretion and we believe frees us to innovate and iterate more quickly than any of our major competitors. We view this flexibility as absolutely critical to introducing new capabilities, reinforcing customer centricity and driving growth. In practice this means we own and control an end-to-end insurance experience and have near complete operating autonomy, subject to regulation, to grow our business.
As with many data-enabled businesses, we benefit from a flywheel powered by data that allows us to improve our model and fuels growth. However, in contrast to many other flywheels where growth-generates-data-generates-growth, we believe our flywheel is more powerful in that increased data generates targeted growth to increase the lifetime value of our customers.
Our model naturally benefits from growing our data flywheel and our portfolio maturing. Renewal premiums, referring to premiums from a customer’s second term and beyond, have lower loss ratios as compared to new premiums in the customer’s first term. As we grow our business, we anticipate, consistent with industry norms, that our portfolio will mature and a greater proportion of our premiums will be from customer renewals. We expect this
1
growing proportion of renewal premiums will bring an increasing mix of lower loss ratio premiums and premiums without associated marketing costs .
We announced in 2021 that we continue to diversify the ways we reach our customers and our product offerings. We are leveraging our technology to develop an embedded experience at the point of car purchase with Carvana. In mid-2021, we saw an elevated consumer interest in vehicle and auto insurance purchases, resulting in a significant increase in customer acquisition and advertising campaigns in digital channels on the part of our competitors, increasing our customer acquisition costs in those channels. Not only do acquisition costs in these channels vary significantly quarter to quarter, we believe an embedded product with distribution partners offers an opportunity for greater marketing efficiency than digital marketing channels alone because they allow us to approach captive audiences in a contextually relevant, data-centric way.
The economic instability caused by the COVID-19 pandemic has led to acute inflationary pressures and supply chain disruptions, which have increased the value of used vehicles and replacement parts in 2021. These cost increases have resulted in greater claims severity while being partially offset by higher salvage and subrogation recoveries on damaged vehicles. As a result of certain factors related to the COVID-19 global pandemic, we continue to file in multiple states to establish rates that more closely follow the evolving loss cost trends. In addition, we are developing underwriting models and products that vary the level of reliance on telematics and the point at which telematics are used in underwriting.
Our Industry
Insurance is one of the oldest and largest markets in the world, touching every corner of the world and protecting many of our most important assets. Global property and casualty, or P&C, insurance premiums amount to $3 trillion annually. Our primary addressable market today is U.S. personal lines insurance. This market exceeded $375 billion in 2020 premiums and has grown at a 3% compound annual growth rate, or CAGR, since 2016.
Over the past century, there have been only a few waves of innovative disruption within insurance. Perhaps the most disruptive was the advent of the internet as a distribution channel in the late 1990s, which redefined the personal auto insurance market. We believe the rise of digital distribution is the primary driver of the $50 billion market share shift that has accrued to direct models over the last 20 years. Further, we believe the next technology-driven structural shift is underway—and this time the shift is not just distribution-related but a holistic change in the way insurance is priced and delivered.
We believe innovation has been slow within the P&C insurance industry, in part, because legacy systems are difficult to build upon and nearly impossible to replace. Also impacting the pace of innovation is institutional friction generated by the cost and perceived risk of a requisite ground-up technology rebuild, disruption of carrier-agent relationships and the business model implications of replacing broad pool-based pricing. Our proprietary technology and business model allow us to avoid these pain points and aggressively pursue the opportunity to be at the forefront of this structural shift.
Our Business Model
Behavioral Data and Proprietary Telematics
We use technology to measure risk based on transparent collection and analysis of individual driving performance, which we believe is the most powerful predictor of accidents and the leading variable in our underwriting model. By collecting and synthesizing massive amounts of rich, sensory behavioral data across thousands of driving variables, including distracted driving, we strive to price auto insurance based more on causality than correlation. This allows us to price our customers’ policies more fairly—and in turn they pay premiums commensurate with their individual risk profile. While the notion of telematics has been around for decades, only recently has mobile technology made the concept adoptable at large scale.
The pooled-risk pricing strategy employed by the majority of incumbents takes a more uniform view of risk absent the capability to segment on an individualized basis. First, incumbents generally do not have the technology and infrastructure to collect and synthesize an integrated set of proprietary telematics and claims data. Second,
2
introducing individualized telematics-based pricing across an existing portfolio constructed without telematics would have enormous profitability implications as lower-risk drivers would be re-rated to a meaningful discount, reducing profits, and high-risk drivers would be surcharged, which could result in reduced retention. As such, we believe we are the only P&C insurance carrier with a scaled proprietary telematics solution designed to price an entire book of business.
The hallmark of our data advantage is our integrated set of actual claims and associated proprietary telematics, which we believe to be one of the largest in the market. We match miles tracked, on an individual basis, with actual claims and identify a set of driving performance factors that cause, or on a relative basis are more likely to cause, accidents. We use an internally developed claims infrastructure to capture comprehensive structured data, contributing to our data advantage when combined with telematics experience and iterated over time. This integrated data set drives a usage-based insurance, or UBI, score. When UBI 3.14, a prior iteration of our current model, was reviewed it was determined to be almost ten times more predictive at estimating future losses than a leading third-party provider, according to a leading independent third-party actuarial and consulting firm. Since then, we have continued to iterate on our UBI models and have released UBI 4.0 in a majority of states, which we believe is more predictive than previous models.
Our model revolves around using integrated data and technology to create a pricing advantage through granular risk segmentation. The data we collect feeds proprietary risk scoring models which assist us in identifying what we believe to be the riskiest drivers on the road, a group we have elected not to quote, thus avoiding a risk segment that is up to two times more likely to get in an accident than our average targeted customer. By removing this high-risk segment, we can price the remaining population more fairly, resulting in a stronger conversion of customers whose behavioral data indicates lower risk than a market-standard demographic rating alone. Our segmentation often allows us to provide better pricing to lower risk customers based on their driving behavior, giving us an advantage in acquiring new customers, as compared to traditional insurance carriers, and allowing us to build a more attractive book of business that contributes even more data to our flywheel.
Customer Experience
We strive to meet customers where they are with a user-friendly interface and convenient, efficient experience. This is the mantra that drives our mobile engagement strategy and underpins both our user experience and our fundamental business model. App installation and initial engagement are designed to be intuitive so that customers can easily identify the coverage they need in everyday language, including offering bundling options which clearly lay out associated cost savings.
Our mobile engagement extends across the customer experience and value chain:
• Engagement. The vast majority of our new customers come through our digital or partnership channels, which are largely mobile. We continue to diversify the ways we reach our customers. We are developing an embedded experience that engages customers at contextually relevant times. In partnership with Carvana, we are deploying an embedded experience at the point of car purchase.
• Profile Creation. The Root app is available for both iOS and Android operating systems making it available to 99% of U.S. smartphone users. By simply scanning a driver’s license, a prospective customer can nearly complete a profile, part of an on-boarding process that is possible to complete in as little as 47 seconds and with no keyboard interaction.
• Underwriting. The test drive is a key component of the underwriting process. A two-to-four week test drive gathers and analyzes data from smartphone sensors measuring braking, consistency, turning, time of day and other performance and contextual data. We are developing underwriting models and products that vary the level of reliance on telematics and the point at which telematics are used in underwriting.
• Coverage Selection. As part of profile setup, our app pre-populates with a customer’s owned automobiles and existing or prior coverage terms, allowing easy and seamless selection of policy terms.
3
• Policy Management . Once bound, customers can perform all policy management functions seamlessly from our app, including profile or coverage adjustments, obtaining proof of insurance or chatting with a bot or human.
• Claims. We make it easy to file a claim and track processing status through to settlement via the app, allowing us to pay out claims rapidly.
Auto insurance is a product most people use every day, reinforcing the importance of our mobile-first engagement strategy for both customer experience and data collection.
Distribution
We distribute largely through the mobile channel, with the majority of our personal insurance customers acquired through either our mobile app or mobile web platform. Mobile is the fastest growing retail channel in the United States, as customers spend less time in front of computers and utilize smart phones for more convenient shopping. We therefore designed a mobile-directed customer acquisition strategy, to ultimately deliver customer acquisition costs below the average cost of doing so, through each of the embedded, direct and agent channels:
• Embedded. We build upon the superior mobile and web customer experiences of distribution partners to reach a captive customer base with an embedded solution. Through our proprietary and fully-integrated application programming interfaces, or APIs, we are able to engage prospective customers when contextually relevant in third-party applications and target high-value customer segments at a higher marketing efficiency than other channels. We expect increased penetration of this channel over time as we seek to grow embedded relationships with other tech-enabled companies like Carvana, offering access to relevant customer bases.
• Digital. Our digital channel is design ed to drive volume by efficiently capturing high-intent customers. We accomplish this by meeting our customers within platforms they use extensively such as Facebook and Google or select marketplace platforms where consumers are actively shopping for insurance. We deploy dynamic data science models to optimize targeting and bidding strategies across our digital platforms, aligning customer acquisition cost to expected lifetime value of the potential customer.
• Channel Media. We build consideration and drive intent through household-level targeted digital media channels such as YouTube and Hulu, as well as more traditional media channels such as billboards, regional TV and radio and direct mail. We utilize these media channels to drive awareness when launching new states and to actively target customers in active states.
• Referral. We encourage our existing customers to spread our value proposition. Our referral channel compensates existing customers who refer new customers who subsequently receive a quote. This channel facilitates community-based growth to those who value our fair and transparent approach to insurance. This is our lowest cost acquisition channel and an important aspect of our ongoing distribution strategy.
• Agency . We have been investing in a product to bring the speed and ease of our technology to the independent agency channel. This channel provides access to a larger demographic of customers and we believe it has staying power. We developed an efficient quote and bind process that reduces the time the agent needs to spend with the customer, allowing agencies to be an efficient acquisition channel for us.
Our customer acquisition costs can vary by channel mix, by state, due to seasonality or due to the competitive environment. We believe our main channels allow us to efficiently acquire customers by leveraging our partners’ premier user experiences to approach captive audiences in a contextually relevant, data-centric way. Furthermore, we continue to invest in the technology and data science behind our distribution with A/B tests, dynamic bidding models, and rapid updates and iterations, supporting differentiated cost of customer acquisition over the long term.
Capital Management
As a full-stack insurance company, we operate a “capital-light” business model which utilizes elevated levels of reinsurance. Our capital management strategy has three core objectives: (1) prioritize revenue and targeted customer growth while also maintaining regulatory capital requirements; (2) source efficient capital to support customer
4
acquisition costs; and (3) mitigate impact of large losses or tail events. Together these strategies serve to maximize returns on shareholder capital as we grow.
Reinsurance is a cornerstone of our capital management framework. We have multiple strategic business partnerships with leading global reinsurers who offer us reinsurance solutions on both a proportional (i.e., quota share) and non-proportional (i.e., excess of loss, or XOL, coverage) basis for multi-year periods. We also utilize a wholly-owned, Cayman Islands-based reinsurer, Root Reinsurance Company, Ltd., or Root Re.
Our Growth Strategy
We are focused on the following growth strategies to continue penetrating the $260 billion U.S. auto insurance market and ultimately the $3 trillion global P&C market. In the near term, our primary focus is to execute on the auto opportunity at hand. In the longer-term, we plan to continue to develop additional growth opportunities through the expansion of product offerings, and growing our enterprise solution and entering international markets.
• Execute the Auto Opportunity
◦ Better, fairer pricing. We will never stop working to improve our ability to segment risk by increasing the influence of behavioral factors in our underwriting and pricing models. Our primary tool for improvement is to continue applying data science to our powerful flywheel, where each rotation sheds incremental light on the causes of accidents. Over time, we hope that we can replace all correlation-related inputs to our pricing model, such as credit scores, with a fully behavioral pricing model. We would view this as the ultimate achievement in customer transparency and fairness.
◦ Enhance marketing efficiency. We will continue to enhance the efficiency of our marketing spend through data science and dynamic targeting, as well as expanding our embedded experience. The embedded experience will allow us to develop integrated auto insurance solutions where we build on the premium mobile and web experiences of contextually relevant partners to access their active customer base.
◦ Grow national auto insurance presence. We will continue to focus on domestic growth by diversifying marketing channels, becoming active in more states while improving brand awareness. In November 2020, we acquired Catlin Indemnity Company, a shell insurance company subsequently renamed Root Property & Casualty Insurance Company, or Root Property & Casualty, that expands our ability to sell personal auto insurance in 48 states and the District of Columbia. In instances where a prospective customer solicits a quote in a state where we do not currently underwrite, we retain their contact information, with permission, and re-engage upon state entry.
• Insurance Product Expansion
◦ Increase value proposition and business model through cross-sell . We launched our renters product in July of 2019 and our home product partnership in May of 2020. In bundling these products with auto insurance, we unlock the 50% of the market that we believe prefers a bundled offering and was therefore not available to us before. This strategy supports our unit economics by creating additional revenue with no incremental marketing spend. We have also observed that customers with multiple policies retain better than auto-only customers.
• Insurance Product Expansion
◦ Invest in enterprise . We have developed a distinct enterprise offering leveraging our existing technology and capabilities. Over the long-term we plan to invest in and grow this product offering to create a distinct and scalable software-as-a-service recurring revenue stream absent risk retention.
◦ Pursue International . In the long-term we will look to expand into the international market, both as a consumer-facing insurer in certain markets and through enterprise software in other markets, enabling select insurance companies with mobile telematics data collection and scoring capabilities.
5
We may selectively pursue additional acquisitions and partnerships to accelerate any of our growth and profitability objectives or to improve our competitive positioning within existing and new products.
Investments
Our portfolio of investable assets is primarily held in cash, cash equivalents and available-for-sale fixed maturity securities, including U.S. Treasury securities, corporate debt securities, mortgage back securities and other debt obligations. We manage the portfolio in accordance with investment policies and guidelines approved by our board of directors. We have designed our investment policy and guidelines to provide a balance between current yield, conservation of capital, and liquidity requirements of our operations. We set guidelines that provide for a well-diversified investment portfolio that is compliant with insurance regulations applicable to the states in which we operate. For further information, see Note 3, “Investments,” in the Notes to Consolidated Financial Statements included elsewhere in this Annual Report on Form 10-K.
Competition
The insurance industry in which we operate is highly competitive. Many of our primary competitors have well-established national brands and market similar products. Our competitors include large national insurance companies such as Geico, Progressive and Allstate, as well as up-and-coming companies and new market entrants in the insurtech industry, some of which also utilize telematics and offer forms of usage-based insurance. Several of these established national insurance companies are larger than us and have significant competitive advantages over us, including increased name recognition, higher financial ratings, greater resources, additional access to capital, and more types of insurance coverage to offer, such as health and life, than we currently do. In particular, many of these competitors offer consumers the ability to purchase multiple other types of insurance coverage and “bundle” them together into one policy and, in certain circumstances, include an umbrella liability policy for additional coverage at competitive prices. Moreover, as we expand into new lines of business and offer additional products, we could face intense competition from traditional insurance companies that are already established in such markets.
Competition is based on many factors, including the reputation and experience of the insurer, coverages offered, pricing and other terms and conditions, customer service, size, and financial strength ratings, among other considerations. We believe we compete favorably across many of these factors and have developed a platform and business model based on behavioral data collection and machine learning that we believe will be difficult for incumbent insurance providers to emulate.
Intellectual Property
We believe that our intellectual property rights are valuable and important to our business. We rely on trademarks, patents, copyrights, trade secrets, license agreements, intellectual property assignment agreements, confidentiality procedures, non-disclosure agreements, and employee non-disclosure and invention assignment agreements to establish and protect our proprietary rights. Though we rely in part upon these legal and contractual protections, we believe that factors such as the skills and ingenuity of our employees and the functionality and frequent enhancements to our platform are larger contributors to our success in the marketplace.
As of December 31, 2021, we had two issued patents and two non-provisional patent applications pending examination in the United States. We continually review our development efforts to assess the existence and patentability of new intellectual property.
We have trademark rights in our name, our logo, and other brand indicia, and have trademark registrations for select markets in the United States. We also have registered domain names for websites that we use in our business.
We intend to pursue additional intellectual property protection to the extent we believe it would be beneficial and cost-effective. Despite our efforts to protect our intellectual property rights, they may not be respected in the future or may be invalidated, circumvented, or challenged. For additional information, see the sections titled “Risk Factors—Risks Related to Our Business—Our intellectual property rights are valuable, and any inability to protect them could reduce the value of our products, services and brand.”
6
People at Root
As an insurtech, we believe our differentiating factor is our talent. We believe our people, their knowledge, their skills and the ways they work will provide competitive advantages to allow us to innovate, move with speed in the market and bring subject matter expertise to bear in the market for our customers and shareholders.
Our Company is founded on a core set of values: be curious and push boundaries, be courageous and build trust and be focused and deliver impact. The specific words may change with time as we innovate and grow, but we look for employees who share the essence of these values – innovation, courage and bias for action to drive results.
These values form the basis for our People strategy, which is to give employees voice and choice, build leadership capability to ensure our leaders serve as trusted advisors and the source of truth for our employees and create a sense of belonging for all employees at all levels. These three pillars underscore each step on the employee lifecycle from attraction, to hire, to onboard, and through growth and development. We continue to engage with former employees as alumni.
Employees
As of December 31, 2021, we had 1,571 full-time employees. None of our employees are represented by a labor union or covered by collective bargaining agreements. On January 20, 2022, we instituted an organizational realignment, including an involuntary workforce reduction of approximately 330 employees, which represented approximately 20% of our workforce. The majority of the reduction was driven by optimizing certain sales and claims departments, especially claims support staff in first notice of loss. These departments saw a reduced workload that corresponded with the strategic reduction in marketing spend and lower claims volume in the second half of the year. The majority of the affected employees were notified on January 20, 2022, with most job eliminations effective January 2022. All impacted employees were supported with financial and career placement aid. We have not experienced any work stoppages.
Belonging at Root
We are committed to respecting, leveraging, and rewarding the unique views and contributions of all team members by increasing diversity while building and sustaining a culture of inclusivity and belonging—a Root that empowers all employees to be unapologetic about who they are while they connect, create, and innovate. Establishing and maintaining a culture of belonging requires a shift in leadership behaviors and cultural attributes. As we move to a more distributed workforce as a result of our “work where it works best approach” we plan to focus our behaviors on those that are pointed toward driving empathy and trust across our workforce to demonstrate a sense of caring for ourselves, our people and our business. Empathy and trust, along with voice and choice are the cornerstones of our culture of belonging. We are evolving in our approach to a more integrated strategy focused on attracting talent, retaining talent and serving in our communities. Our Board continues to be actively involved in this process, prioritizing representation at all levels in the company and overseeing our belonging efforts at the full board level.
We promote a culture of diversity, equity and inclusion through, for example, Employee Resource Groups, or ERGs. We currently have four ERGs – employees who regularly meet to share like experiences, serve as connectors and support each other as they move forward in their careers and lives more broadly:
• Pride 365: Celebrating everything LGBTQ+ at Root and in our communities;
• Tribe: Cultivating a professional, healthy, and supportive environment while amplifying Black voices at Root;
• Women @ Root: Creating a culture and company that empower women and allies to do their best work; and
• Root Ability and Allies: Resource-sharing, celebrating wins, and cultivating a community of support at Root for our team members with disabilities and their allies.
7
Leadership at Root
We believe we will best meet the needs of our employees by ensuring strong leadership capabilities at all levels in the organization. As our employee needs and motivations change, we are helping our leaders evolve their leadership tool kits to meet these needs and positioning our leaders to be a source of truth and trusted advisors for all of our employees. Our senior management is spending more time helping leaders focus on three aspects of leadership: care for self, care for others and care for the business. We recently launched Root’s Leadership Academy, a program that provides training, leadership toolkits, opportunities to share best practices, mentorship and support to our people managers.
Ethics and Company Values
In addition to applicable laws and regulations, our Code of Conduct, company values and policies provide the grounding for our ethical framework. Employees are encouraged to report any unusual behavior or any non-compliant activities through a variety of vehicles to include our anonymous reporting system. On an annual basis, we provide ethics training to, and require acknowledgement of our Code of Conduct by, every employee. We strive to ensure our new employees know how and what to report and are encouraged through our values to challenge us and be courageous. We have an open door policy that empowers employees to reach out to leaders, our People team, our compliance and/or internal audit teams to ensure that their concerns are heard and addressed.
Hiring and Retaining Talent
We are continually working on building a culture of attraction and retention of key talent. Our recruiting approach has moved from a Columbus-centric approach to a National landscape in order to attract the best talent to innovate and meet the needs of our customers in a multitude of ways. We are continually updating our recruiting approaches to fill candidate pipelines with diverse candidates with diverse skill sets and life experiences.
Our focus on employee engagement continues with employee surveys and feedback opportunities to create action plans to address needs. Employees provide their perspectives on everything from facilities, to communication vehicles, to development approaches, to change management strategies, and on many other subjects.
In addition, we are continually revising our performance development processes to ensure that employees receive timely and actionable feedback and can improve their performance and voice their career aspirations. We are driving to build a more inclusive learning environment where employees can participate in a variety of learning programs offered through our employee assistance program, digital learning platform and our in-person classes.
In addition, we seek to provide competitive pay and benefits through a combination of fixed and variable compensation programs. We have set salary ranges, based on our defined competitive markets, and annual short and long term incentives aligned to each of our positions as we believe are appropriate.
Our executives and senior leadership roles, along with several identified roles throughout the business participate in a long-term equity-based incentive program, which we believe strongly supports a long term view and pay for performance that is aligned with our shareholders.
Our employee benefits platform is reviewed annually to offer benefits competitive with our market and designed to meet the needs of our people and their families. We invest in the emotional and physical wellbeing of our employees and their families through our benefits programs. Our benefit offering covers medical, dental, vision, prescription drug benefits along with a robust employee assistance program, life insurance, short- and long-term disability, paid time off and paid parental leave. Our move to a “work where it works best” culture allows for tremendous employee flexibility for employees to manage their lives in the ways that they want while also meeting their performance objectives at work.
8
Meeting Our Employees Needs While Responding to COVID-19 Demands
During the past two years, we have made some fundamental changes as a result of the COVID-19 pandemic. For the health and safety of our employees, we quickly moved as many people as possible to work from home in the early stages. As the pandemic evolved and we understood more about the evolving needs of our employees, we surveyed employees and moved to an ongoing “work where it works best” working environment. In this scenario, we are allowing employees to tell us where they would like to work – in an office, or outside an office anywhere in the continental United States. This choice allows us to help employees manage their health and the health of their family members, provides them with flexibility to live where they would like, changes our geographic footprint and empowers our leaders to be creative in finding solutions that are mutually beneficial for our employees, customers and shareholders.
Insurance Regulation
We are subject to insurance regulation in the jurisdictions in which we transact insurance through our licensed insurance carriers and producer subsidiaries. Insurance regulatory authorities have broad administrative powers to regulate all aspects of an insurance carrier or producer’s business, including the powers to restrict or revoke licenses to transact business, and to levy fines and monetary penalties against insurers and insurance producers found to be in violation of applicable laws and regulations. Regulations to which our licensed insurance carriers and producer subsidiaries are subject include, but are not limited to:
• prior approval of transactions resulting in a change of “control” (as such term is defined under the Insurance Holding Company System Regulatory Act of Ohio, or the Ohio Holding Company Act, and the Delaware Insurance Holding Company System Registration Act, or the Delaware Holding Company Act, and together with the Ohio Holding Company Act, the Holding Company Acts);
• approval of policy forms and premiums;
• approval of intercompany service agreements;
• statutory and risk-based capital solvency requirements, including the minimum capital and surplus our regulated insurance subsidiaries must maintain;
• establishing minimum reserves that insurance carriers must hold to pay projected insurance claims;
• required participation by our regulated insurance subsidiaries in state guaranty funds;
• restrictions on the type and concentration of our regulated insurance subsidiaries’ investments;
• restrictions on the advertising and marketing of insurance;
• restrictions on the adjustment and settlement of insurance claims;
• restrictions on the use of rebates to induce a policyholder to purchase insurance;
• restrictions on the sale, solicitation and negotiation of insurance;
• restrictions on the sharing of insurance commissions and payment of referral fees;
• prohibitions on the underwriting of insurance on the basis of race, sex, religion and other protected classes;
• restrictions on our ability to use telematics to underwrite and price insurance policies, particularly in California;
• restrictions on the ability of our regulated insurance subsidiaries to pay dividends to us or enter into certain related party transactions without prior regulatory approval;
• rules requiring the maintenance of statutory deposits for the benefit of policyholders;
9
• privacy regulation and data security;
• regulation of corporate governance and risk management;
• periodic examinations of operations, finances, market conduct and claims practices; and
• required periodic financial reporting.
The business of insurance is almost entirely regulated at the state level, and the laws and regulations to which we are subject vary depending on the state. Unless the context otherwise requires, references herein to “state” include any of the 50 states, the District of Columbia and certain U.S. territories. These rules are subject to change as state legislatures and regulatory agencies update their laws and regulations to address real and perceived issues and concerns. These laws and regulations are also subject to interpretation by courts. The National Association of Insurance Commissioners, or NAIC, and the National Council of Insurance Legislators, or NCOIL, are the principal organizations tasked with establishing standards and best practices across the various states, the District of Columbia and five U.S. territories, and from time to time promulgate model rules and regulations that often are the basis for insurance rules and regulations adopted by such jurisdictions. We cannot predict precisely whether or when regulatory actions may be taken that could adversely affect us or the operations of our regulated insurance subsidiaries. Interpretations of regulations by regulators may change and statutes, regulations and interpretations may be applied with retroactive effect, particularly in areas such as accounting or reserve requirements.
Required Licensing
We have two wholly-owned regulated U.S. insurance subsidiaries, Root Insurance Company and Root Property & Casualty Insurance Company, or Root Property & Casualty. Root Insurance Company, an Ohio-domiciled insurer, is admitted in the state of Ohio to transact certain lines of property and casualty insurance, maintains licenses to transact insurance in Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Hawaii, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maryland, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Mexico, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, Utah, Virginia, Washington and West Virginia, and has an application pending for license to transact insurance in Massachusetts. Root Property & Casualty is domiciled in Delaware and admitted in all 50 states and the District of Columbia to transact certain lines of property and casualty insurance (including to sell personal auto insurance in 48 states and the District of Columbia). Since Root Insurance Company is our regulated insurance subsidiary with the largest premium volume, Ohio is considered our primary state insurance regulator.
We have a reinsurance captive subsidiary, Root Reinsurance Company, Ltd., or Root Re, domiciled in the Cayman Islands.
Our licensed insurance producer subsidiaries, Root Insurance Agency, LLC, Root Lone Star Insurance Agency, LLC, and Root Scout, LLC, must maintain an insurance producer license in every state in which they sell, solicit or negotiate insurance. Root Insurance Agency, LLC currently holds a resident insurance producer license in Ohio and a non-resident license in the remaining 49 states and the District of Columbia, except for California, Florida, Massachusetts and New York. Root Lone Star Insurance Agency, LLC currently holds a resident managing general agency license in Texas. Root Scout, LLC currently holds a resident insurance producer license in Ohio and a non-resident license in the remaining 49 states and the District of Columbia, except California, Florida, Massachusetts, and New York. Root Scout, LLC is seeking such license in California, Florida, Massachusetts, and New York and expects to have obtained them by the end of the second quarter of 2022.
Insurance regulators have broad authority to restrict or revoke licenses of insurance carriers and producers who are found to be in violation of any applicable laws and regulations.
10
Licensing of Our Employees
Any of our employees who sell, solicit or negotiate insurance must be licensed and appointed insurance producers and must fulfill annual continuing education requirements. In certain states in which we operate, insurance claims adjusters are also required to be licensed and fulfill annual continuing education requirements.
Insurance Holding Company Regulation
As the ultimate controlling person in the “insurance holding company system” under the Holding Company Acts, we are required to file annual enterprise risk reports, corporate governance disclosures and own risk solvency assessments with our domiciliary regulators. Moreover, in Ohio for example, any person divesting control of an insurer must provide 30 days’ notice to the regulator and the insurer.
Under the Holding Company Acts, all inter-affiliate transactions within a holding company system must meet the following conditions: (i) the terms must be fair and reasonable; (ii) charges or fees for services performed must be fair and reasonable; and (iii) expenses incurred and payments received must be allocated to the insurer in conformity with customary insurance accounting practices consistently applied. We generally must disclose any transaction between our regulated insurance subsidiaries and our other affiliates to the supervisory Department of Insurance, or DOI, and obtain prior approval from such DOI before entering into certain material inter-affiliate transactions, including, but not limited to, management agreements, tax allocation agreements, service contracts, cost-sharing arrangements, extraordinary dividends, certain reinsurance transactions and certain loan agreements.
Change of Control
Pursuant to the Holding Company Acts, a person must seek regulatory approval from the superintendent of the supervisory DOI prior to acquiring direct or indirect “control” of a domestic insurer by filing a Form A Statement Regarding the Acquisition of Control of or Merger with a Domestic Insurer. As part of this Form A application, the entity acquiring control (as well as any controlling shareholders of such entity) will need to submit, along with other documents and disclosures, its financial statements, organizational charts and biographical affidavits for any officers, directors and controlling shareholders of each applicable entity. The superintendent of the DOI will grant approval of an application to acquire control of a domestic insurer unless, after a public hearing, the superintendent finds that any of the following apply: (i) after the change of control, the domestic insurer would not be able to satisfy the requirements for the issuance of a license to write the line or lines of insurance for which it is presently licensed; (ii) the effect of the merger or other acquisition of control would be substantially to lessen competition in insurance in the applicable state or tend to create a monopoly; (iii) the financial condition of any acquiring party is such as might jeopardize the financial stability of the domestic insurer, or prejudice the interests of its policyholders; (iv) the plans or proposals that the acquiring party has to liquidate the domestic insurer, sell its assets, or consolidate or merge it with any person, or to make any other material change in its business or corporate structure or management, are unfair and unreasonable to policyholders of the domestic insurer and not in the public interest; (v) the competence, experience and integrity of the persons that would control the operation of the domestic insurer are such that it would not be in the interest of policyholders of the domestic insurer and of the public to permit the merger or other acquisition of control; or (vi) the acquisition is likely to be hazardous or prejudicial to the insurance-buying public.
The Holding Company Acts provide that control over a domestic insurer is presumed to exist if any person, directly or indirectly, owns, controls, holds with the power to vote, or holds proxies representing, ten percent or more of the voting securities of the domestic insurer. A person may rebut this statutory presumption of control by submitting a disclaimer of affiliation with the supervisory DOI, disclosing all material relationships and bases for affiliation between the person and the insurer as well as the basis for disclaiming such affiliation. The state regulators, however, may also find that “control” exists in circumstances in which a person owns or controls less than ten percent of the voting securities of the domestic insurer.
These change of control regulations may dissuade investors from acquiring a controlling stake in our company, including through transactions that some or all of our stockholders might consider to be desirable. Such regulations may also inhibit our ability to acquire an insurance company should we wish to do so in the future. See the section
11
titled “Risk Factors—Risks Related to this Offering and Ownership of Our Class A Common Stock—Applicable insurance laws may make it difficult to effect a change of control.”
ORSA
Pursuant to the Own Risk and Solvency Assessment, or ORSA, an insurance company with gross written and unaffiliated assumed premium of more than $500 million or that is part of an insurance group with gross written and unaffiliated assumed premium of more than $1 billion must maintain a risk management framework to assist the insurer with identifying, assessing, monitoring, managing, and reporting on its material and relevant risks. In addition, the insurer must regularly conduct an own risk and solvency assessment in accordance with NAIC’s ORSA Guidance Manual. Upon the request of the superintendent of the Ohio DOI, and not more than once a year, an insurer must submit an ORSA summary report, or any combination of reports that together contain the information described in the ORSA Guidance Manual, with respect to the insurer and the insurance group of which it is a member. Root Insurance Company became subject to ORSA in 2020 since it had gross written and unaffiliated assumed premium in excess of $500 million for that year and its first assessment was due prior to the end of fiscal year 2021. Root, Inc. filed its first ORSA summary report with the Ohio DOI on December 30, 2021.
Restrictions on Paying Dividends
We are a holding company that transacts a majority of its business through operating subsidiaries. Consequently, our ability to pay dividends to stockholders and meet our debt payment obligations depends on the results of operations of our operating subsidiaries and on the ability of such subsidiaries to provide us with cash, whether in the form of dividends, distributions, loans or otherwise. The payment of any extraordinary dividend by one of our regulated insurance subsidiaries requires the prior approval of the superintendent of the supervisory DOI. “Extraordinary dividend” is defined under the Code as: (i) any dividend or distribution of cash or other property whose fair market value, together with that of other dividends or distributions made within the preceding twelve months, exceeds the greater of (a) ten percent of an insurer’s policyholder surplus as of December 31 of the preceding year, or (b) an insurer’s net income for the twelve-month period ending December 31 of the preceding year or (ii) any dividend or distribution paid by an insurer from a source other than earned surplus. As of December 31, 2021, neither Root Insurance Company nor Root Property & Casualty were permitted to pay any dividends to us without approval of the superintendent of the supervisory DOI. See the section titled “Risk Factors—Risks Related to Our Business— Failure to maintain our risk-based capital at the required levels could adversely affect our ability to maintain regulatory authority to conduct our business.”
In addition, insurance regulators have broad powers to prevent a reduction of statutory surplus to inadequate levels, and there is no assurance that dividends of the maximum amount calculated under any applicable formula would be permitted. The Ohio DOI and the Delaware DOI may in the future adopt statutory provisions more restrictive than those currently in effect.
Reserves
Our domestic insurance subsidiaries are required to hold admitted assets as reserves to cover projected losses under its policies, in accordance with actuarial principles. In accordance with NAIC’s property and casualty statement instructions, they must submit an annual Statement of Actuarial Opinion from a qualified actuary appointed by the company, certifying that its reserves are reasonable.
Risk-Based Capital
Our domestic insurance subsidiaries are required to maintain minimum levels of risk-based capital to support their overall business operations and minimize the risk of insolvency. State insurance regulators use risk-based capital to set capital requirements, based on the size and degree of risk taken by the insurer, taking into account various risk factors including asset risk, credit risk, underwriting risk, and interest rate risk. As the ratio of an insurer’s total adjusted capital and surplus decreases relative to its risk-based capital, the risk-based capital laws provide for increasing levels of regulatory scrutiny and intervention.
12
Both Ohio and Delaware have adopted the model legislation promulgated by the NAIC pertaining to risk-based capital and require annual reporting by insurers domiciled within such states to confirm that the insurer is meeting its risk-based capital requirements. Insurers falling below a risk-based capital threshold may be subject to varying degrees of regulatory action. An insurance company with total adjusted capital that is less than 200% of its authorized control level risk-based capital is at a company action level, which would require the insurance company to file a risk-based capital plan that, among other things, contains proposals of corrective actions the company intends to take that are reasonably expected to result in the elimination of the company action level event. Additional action level events occur when the insurer’s total adjusted capital falls below 150%, 100% and 70% of its authorized control level risk-based capital. When total adjusted capital falls below 70%, a mandatory control event is triggered which results in the supervisory DOI placing the insurance company in receivership and assuming control of the operations of the insurer. Root, Inc. entered into an agreement with the Superintendent of Insurance, State of Ohio, or the Superintendent, guaranteeing that Root Insurance Company will maintain certain capital and surplus requirements or risk-based capital levels, whichever is greater, and such additional surplus as the Superintendent requires. The guarantee remains in effect until such time as the Superintendent may release Root, Inc. in writing. As of December 31, 2021, both Root Insurance Company and Root Property & Casualty’s risk-based capital levels are above any of these regulatory action level thresholds and our guaranteed threshold.
Hazardous Financial Conditions
Our insurance regulatory authorities have the authority to deem our domestic insurance subsidiaries to be in a hazardous financial condition such that the insurer’s continued operation may be hazardous to its policyholders, creditors, or the general public. A finding of a hazardous condition can be based upon a number of factors, including, but not limited to: (i) adverse findings in a financial, market conduct or other examination; (ii) failure to maintain adequate reserves in accordance with presently accepted actuarial standards of practice; (iii) net loss or negative net income in the last twelve month period or any shorter period of time; (iv) failure to meet financial and holding company filing requirements; (v) insolvencies with a company’s reinsurer(s) or within the insurer’s insurance holding company system; (vi) a finding of incompetent or unfit management of the insurer; (vii) a failure to furnish requested information or provide accurate information in relation to a response to an inquiry or filing of a financial statement; and (viii) any other finding determined by the commissioner to be hazardous to the insurer’s policyholders, creditors or general public.
If an insurance regulatory authority finds one of our domestic insurance subsidiaries to be in hazardous condition it has the authority, in lieu of placing the insurer into supervision, rehabilitation or liquidation, to enter into a memorandum of understanding with the insurer or issue an order to require the insurer to remedy the hazard. This would include, but is not limited to, ordering the insurer to: (i) increase its capital and surplus, (ii) suspend payments of dividends, (iii) limit or withdraw from certain investments, (iv) correct corporate governance deficiencies and (v) take any other action necessary to cure the hazardous condition.
Periodic Examinations
Our insurance subsidiaries are subject to on-site visits and financial and/or market conduct examinations by state insurance regulatory authorities. We are subject to financial condition examinations in any state in which one of our insurance company subsidiaries is domiciled. For example, Root Insurance Company is Ohio-domiciled and subject to a financial condition examination by the Ohio DOI at least every five years, during which the Ohio DOI reviews the company’s financials, governance, and operations, including its relationships and transactions with affiliates. Root Insurance Company’s first financial condition examination by the Ohio DOI covered the period of January 1, 2015 through December 31, 2019 and was completed on July 8, 2021. Root Property & Casualty, a Delaware-domiciled insurer, was subject to a similar financial condition examination by the Delaware DOI, which covered the period of January 1, 2016 through December 31, 2020 and was completed on February 2, 2022. The Ohio DOI and Delaware DOI examination reports are available to the public and contained no formal findings. Additionally, no financial statement adjustments were required as a result of the Ohio DOI and the Delaware DOI examinations.
We are also subject to market conduct examinations in any state in which one of our insurance subsidiaries issues policies. Market conduct examinations examine an insurer’s conduct toward policyholders, including
13
complaint handling, marketing, claims, policyholder notice, rate and form filing, and customer service. These examinations can result in fines and other monetary penalties, as well as other regulatory orders requiring remedial, injunctive, or other corrective action. Root Insurance Company is currently undergoing market conduct examinations conducted by the Virginia Bureau of Insurance and the Texas Department of Insurance. The Texas examination is expected to conclude near the end of the first quarter of 2022 and the Virginia examination is expected to conclude near the end of the second quarter of 2022. In addition, Root Re, our Cayman Islands subsidiary, is subject to inspections by the Cayman Islands Monetary Authority, or CIMA, on an ad-hoc basis and likely within a five-year period. To date no inspection has occurred.
Statutory Accounting Principles
A licensed insurance carrier’s financial statements must be completed in accordance with statutory accounting principles, or SAP. SAP was developed by U.S. insurance regulators as a method of accounting used to monitor and regulate the solvency of insurance companies. In developing SAP, insurance regulators were primarily concerned with evaluating an insurer’s ability to pay all its current and future obligations to customers. As a result, statutory accounting focuses on conservatively valuing the assets and liabilities of insurers, generally in accordance with standards specified by the insurer’s domiciliary jurisdiction.
Uniform statutory accounting practices are established by the NAIC and generally adopted by regulators in the various U.S. jurisdictions. These accounting principles and related regulations differ somewhat from generally accepted accounting principles in the United States, or GAAP, which are designed to measure a business on a going-concern basis. GAAP gives consideration to matching of revenue and expenses and, as a result, certain expenses are capitalized when incurred and then amortized over the life of the associated policies. Other assets such as goodwill are accounted for under GAAP financial statements but not SAP. As a result, the values for assets, liabilities, and equity reflected in financial statements prepared in accordance with GAAP may be different from those reflected in financial statements prepared under SAP.
Credit for Reinsurance
Root Insurance Company is currently party to a number of reinsurance agreements under which it has ceded a portion of the risk it is insuring to various reinsurers. State insurance laws permit U.S. insurance companies, as ceding insurers, to take financial statement credit for reinsurance that is ceded, so long as the assuming reinsurer satisfies the state’s credit for reinsurance laws. Once an insurance carrier has received credit for reinsurance it does not need to hold separate admitted assets as reserves to cover claims on the risks that it has ceded to the reinsurer. There are several different ways in which the credit for reinsurance laws may be satisfied by an assuming reinsurer, including being licensed in the state, being accredited in the state, or maintaining certain types of qualifying collateral. We ensure that all of Root Insurance Company’s reinsurers qualify for credit for reinsurance so that Root Insurance Company is able to take full financial statement credit for its reinsurance.
Rate Regulation
Most states require personal property and casualty insurers to file rating plans, policy or coverage forms, and other information with the state’s regulatory authority. In certain cases, such rating plans, policy forms, or both must be approved prior to use.
We currently have products on file and approved in the following states: Alabama, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Georgia, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maryland, Mississippi, Missouri, Montana, Nebraska, Nevada, New Mexico, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, Utah, Virginia, West Virginia, and Wisconsin.
The speed with which an insurer can change rates in response to competition or increasing costs depends, in part, on whether the rating laws are (i) prior approval, (ii) file-and-use or (iii) use-and-file laws. In states having prior approval laws, the regulator must approve a rate before the insurer may use it. In states having file-and-use laws, the insurer does not have to wait for the regulator’s approval to use a rate, but the rate must be filed with the regulatory authority prior to being used. A use-and-file law requires an insurer to file rates within a certain period of
14
time after the insurer begins using them. Under all three types of rating laws, the regulator has the authority to disapprove a rate filing.
An insurer’s ability to adjust its rates in response to competition or to changing costs depends on an insurer’s ability to demonstrate to the regulator that its rates or proposed rating plan meet the requirements of the rating laws. In those states that significantly restrict an insurer’s discretion in selecting the business that it wants to underwrite, an insurer can manage its risk of loss by charging a rate that reflects the cost and expense of providing the insurance. In those states that significantly restrict an insurer’s ability to charge a rate that reflects the cost and expense of providing the insurance, the insurer can manage its risk of loss by being more selective in the type of business it underwrites. When a state significantly restricts both underwriting and pricing, it becomes more difficult for an insurer to maintain its profitability.
From time to time, the personal lines insurance industry comes under pressure from state regulators, legislators, and special-interest groups to reduce, freeze, or set rates at levels that do not correspond with our analysis of underlying costs and expenses. In particular, auto insurers have come under increasing pressure and in some states have been required to refund a portion of their premium to their policyholders due to decreasing auto claims arising from the COVID-19 pandemic. Whether this pressure continues to exist depends on the persistence of COVID-19 generally. State regulators may interpret existing law or rely on future legislation or regulations to impose new restrictions that adversely affect profitability or growth. We cannot predict with precision the impact on our business of possible future legislative and regulatory measures regarding insurance rates.
In addition, insurers are restricted in their ability to use telematics-based data to set premium rates in California. Proposition 103, which was passed by referendum in 1988, limits the factors that insurers can use to set auto insurance rates to, in decreasing order of importance: (i) the insured’s driving safety record; (ii) the number of miles he or she drives annually; (iii) the number of years of driving experience the insured has had; and (iv) those other factors that the Commissioner of the California Department of Insurance, or CA DOI, may adopt by regulation and that have a substantial relationship to the risk of loss. Under current California regulation, the use of telematics-based data beyond miles driven, including when, where or how the car is driven, is prohibited. We are currently in discussions with the CA DOI to revise its regulations to allow us to use telematics to a greater extent to underwrite and price insurance policies, although we cannot predict the outcome of these discussions, and there can be no assurance that the CA DOI will revise its regulations accordingly, if at all.
Insolvency Funds and Associations, Guarantee Funds, Assigned Risk Plans, Mandatory Pools, and Insurance Facilities
Most states require admitted property and casualty insurance companies to become members of insolvency funds or associations, which they fund through an annual assessment. In addition, certain states have enacted laws that require an insurer conducting business in that state to participate in assigned risk plans, reinsurance facilities and joint underwriting associations. These funds cover payments of claims of state policyholders whose admitted insurance carriers have become insolvent. The annual assessments required in any one year will vary from state to state and are subject to various maximum assessments per line of insurance.
Investment Regulation
Root Insurance Company is subject to Ohio’s rules and regulations governing the investment of its assets. Similarly, Root Property & Casualty is subject to Delaware’s rules and regulations governing invested assets. These laws generally require that an insurance company invest in a diverse portfolio and limit their investments in certain asset categories. Failure to comply with these laws and regulations would cause non-conforming investments to be treated as non-admitted assets for purposes of measuring statutory surplus and, in certain circumstances, we would be required to dispose of those investments.
Trade Practices
Insurance producers are subject to regulation on how they may sell, solicit or negotiate insurance and conduct their business, with state laws prohibiting certain unfair trade practices. Such practices include, but are not limited to, false advertising, making false statements to regulators, unfair discrimination and rebating premium to
15
policyholders above certain de minimis amounts. We set business conduct policies and provide training to make our employee-agents and other customer service personnel aware of these prohibitions and require them to conduct their activities in compliance with these statutes.
Unfair Claims Practices
Insurance companies, third-party administrators and individual claims adjusters are generally prohibited by state statutes from engaging in unfair claims practices. Unfair claims practices include, but are not limited to, misrepresenting pertinent facts or insurance policy provisions, failing to acknowledge and act reasonably promptly upon communications with respect to claims arising under insurance policies, failing to adopt reasonable standards for the investigation and settlement of a claim and attempting to settle a claim for less than the amount to which a reasonable person would have believed such person was entitled. We set business conduct policies to make claims adjusters aware of these prohibitions and to require them to conduct their activities in compliance with these statutes.
Commission Sharing
Insurance producers cannot share insurance commissions with any person for selling, soliciting or negotiating insurance unless such person holds an insurance producer license in the lines of insurance that are being transacted. Under the insurance laws of most states, there is a limited exception to this prohibition on commission sharing for the payment of referral fees to unlicensed persons, provided that the fee is a flat fee that is not contingent on the purchase of insurance and the referral does not involve the discussion of the terms or conditions of the policy.
Data Privacy
The use of non-public personal information in the insurance industry is subject to regulation under the privacy provisions of the Gramm-Leach Bliley Act and the NAIC Insurance Information and Privacy Act, as adopted and implemented by the various state legislatures and insurance regulators, including through the California Financial Information Privacy Act. Pursuant to these laws and regulations, among other things, an insurance carrier or producer must disclose its privacy policies to all of its applicants and policyholders and must also provide either an opt-in or opt-out, depending on the state, to the sharing of non-public personal information with unaffiliated third parties. Under these rules and regulations, insurance companies and producers must also establish a program of administrative, technical, and physical safeguards designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of customer information, and protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to the customers.
We are also subject to the California Consumer Privacy Act, or CCPA, which took effect on January 1, 2020, and the California Privacy Rights Act, or CPRA, which will become effective January 1, 2023. The CCPA and CPRA give California residents the right to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed disclosures about how their personal information is used and shared. The CCPA and CPRA exempt certain information that is collected, processed, sold or disclosed pursuant to the California Financial Information Privacy Act, the Gramm-Leach-Bliley Act or the federal Driver’s Privacy Protection Act, which also apply to us. However, the definition of “personal information” in the CCPA is broad and encompasses other information that we process beyond the scope of this exemption.
16
Cybersecurity
Additionally, in response to the growing threat of cyber-attacks in the insurance industry, certain jurisdictions have begun to consider and adopt new cybersecurity regulations. On October 24, 2017, the NAIC adopted the Insurance Data Security Model Law, intended to serve as model legislation for states to enact in order to govern cybersecurity and data protection practices of insurers, insurance agents, and other licensed entities registered under state insurance laws. A number of states have adopted versions of the Insurance Data Security Model Law, each with a different effective date. Root takes steps to comply with financial industry cybersecurity regulations and believes it complies in all material respects with their requirements but the patchwork nature of the laws in this area currently can make it more costly and difficult to ensure compliance. Our board of directors oversees cybersecurity risk management and delegates oversight of our information security program to our executive officers and chief information security officer, who is responsible for the day-to-day management of our information security program and provides updates to the audit committee of our board of directors at each of its meetings. Our incident response team, headed by our general counsel, reports material information security incidents to our executive officers, who in turn report them to our board of directors.
Federal Regulation
The regulation of insurance companies is principally a matter of state law, and the federal government does not directly regulate the transaction of insurance. However, federal regulation and initiatives do have an impact on the insurance industry. In particular, the Federal Insurance Office, or FIO, was established within the U.S. Department of the Treasury by the Dodd-Frank Act in July 2010 to monitor and coordinate the regulation of the insurance industry across the United States.
Although the FIO has limited direct regulatory authority over insurance companies or other insurance industry participants, it does represent the United States on prudential aspects of international insurance matters, including at the International Association of Insurance Supervisors, or IAIS. In addition, the FIO serves as an advisory member of the Financial Stability Oversight Council, or FSOC, assists the Secretary of the U.S. Department of the Treasury with administration of the Terrorism Risk Insurance Program, monitors trends in the insurance industry and advises the secretary of the U.S. Department of the Treasury on important national and international insurance matters. The FIO has the ability to make a recommendation to the FSOC to designate an insurer as “systemically significant,” subjecting the insurer to regulation by the Federal Reserve as a bank holding company, which could lead to higher capital requirements.
In addition, a number of federal laws affect and apply to the insurance industry, including various privacy laws, false advertising laws, anti-money laundering laws, the Fair Credit Reporting Act, or FCRA, and the economic and trade sanctions implemented by the Office of Foreign Assets Control, or OFAC. OFAC has imposed civil penalties on persons, including insurance and reinsurance companies, arising from violations of its economic sanctions program.
Available Information
General information about Root, Inc., including our Corporate Governance Guidelines and our Code of Business and Ethics, can be found at ir.joinroot.com under the “Governance” tab by selecting “Documents & Charters.” We will post on our website any amendments to, or waivers from, our Code of Business and Ethics requiring disclosure under applicable rules within four business days of the amendment or waiver. Charters for the Audit, Risk and Finance Committee, Compensation Committee, and Nominating and Governance Committee are also available at this location. Root, Inc. uses its website, ir.joinroot.com, as a channel for routine distribution of important information, including news releases and other investor communications. Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, as well as any amendments and exhibits to those reports, are available free of charge through our website as soon as reasonably practicable after the reports are filed with or furnished to the SEC. These documents are also available in hard copy, free of charge, by contacting our Investor Relations office. Additionally, the SEC maintains a website (www.sec.gov) that contains the reports, proxy statements and information statements, and other information regarding issuers that file or furnish electronically with the SEC. In addition, our website allows investors and other interested persons to sign up to
17
automatically receive email alerts when we post news releases and financial information on our website. Information contained on our website is not incorporated into this Annual Report on Form 10-K or other securities filings.
18