AMERICAN INTERNATIONAL GROUP, INC. (AIG) FY 2021 MD&A

OVERVIEW

Our operations are subject to regulation by many different types of regulatory authorities, including insurance, securities, derivatives and investment advisory and thrift regulators in the United States and abroad. The insurance and financial services industries are generally subject to close regulatory scrutiny and supervision. Insurance and other regulatory authorities and law enforcement agencies, attorneys general and other governmental authorities from time to time make inquiries and conduct examinations or investigations regarding our compliance, as well as compliance by other companies in our industry, with applicable laws.

We expect that the U.S. and international regulations applicable to us and our regulated entities will continue to evolve for the foreseeable future.

Legislators, regulators and self-regulatory organizations may also consider changes to existing laws or regulations impacting our business. See Item 1A. Risk Factors – Regulation – New laws and regulations or new interpretations of current laws and regulations, both domestically and internationally, may affect our business, results of operations, financial condition and ability to compete effectively.

Additionally, while the federal government does not directly regulate the insurance business, federal legislation and administrative policies in several areas, including pension regulation, age and sex discrimination, financial services regulation, securities regulation and federal taxation, can significantly affect the insurance industry and certain of our operations. See Item 1A. Risk Factors – Regulation – Our businesses are heavily regulated and changes in laws and regulations may affect our operations, increase our insurance subsidiary capital requirements or reduce our profitability.

U.S. REGULATION

Insurance Regulation. Together, our U.S. insurance subsidiaries are licensed to transact business, and are subject to extensive regulation and supervision by insurance regulators, in all 50 states, the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands. The primary regulator of an insurance company, however, is located in its state of domicile.

We are subject to regulation under the insurance holding company laws of various jurisdictions. The insurance holding company laws and regulations vary from jurisdiction to jurisdiction, but generally require registration and periodic reporting by (re)insurance companies that are licensed in such jurisdictions and are controlled by other entities. Applicable legislation typically requires periodic disclosure concerning the entity that controls the registered insurer and the other companies in the holding company system as well as prior approval of intercompany transactions and transfers of assets, including in some instances payment of dividends by the (re)insurance subsidiary, within the holding company system. Insurance holding company laws also generally provide that no person, corporation or other entity may acquire control of an insurance company, or a controlling interest in any direct or indirect parent company of an insurance company, without the prior approval of such insurance company’s domiciliary state insurance regulator.

As a holding company with no significant business operations of our own, AIG Parent depends on dividends from our subsidiaries to meet our obligations. State insurance statutes typically place restrictions and limitations on the amount of dividends or other distributions payable by insurance company subsidiaries to their parent companies, as well as on transactions between an insurer and its affiliates. Dividends in excess of prescribed limits established by the applicable state regulations are considered to be extraordinary transactions and require prior approval or non-disapproval from the applicable insurance regulator.

Our U.S. (re)insurance subsidiaries are subject to regulation and supervision by the states and other jurisdictions in which they do business. The method of such regulation varies but generally has its source in statutes that delegate regulatory and supervisory powers to a state insurance official. The regulation and supervision relate primarily to the financial condition of the insurers and their corporate conduct and market conduct activities. This includes approval of policy forms and rates, the standards of solvency that must be met and maintained, including with respect to risk-based capital, the standards on transactions between (re)insurance company subsidiaries and their affiliates, including restrictions and limitations on the amount of dividends or other distributions payable by (re)insurance company subsidiaries to their parent companies, the licensing of insurers and their agents, deposits of securities for the benefit of policyholders, requirements for acceptability of reinsurers and the establishment of credit for reinsurance requirements, the form and content of reports of financial condition required to be filed, requirements for reserves and enterprise risk management and corporate governance requirements. Our (re)insurance subsidiaries are also subject to investments rules, which prescribe the type, quality and concentration of investments they can make, and on investment practices, such as derivatives, securities lending and repurchase transactions. In general, such regulation is for the protection of policyholders rather than the creditors or equity owners of these companies.

10 AIG | 2021 Form 10-K

TABLE OF CONTENTS

ITEM 1 | Business

Further, as part of their regulatory oversight process, state insurance departments conduct periodic examinations, generally once every three to five years, of the books, records, accounts and business practices of insurers domiciled in their states. Examinations are generally carried out in cooperation with the insurance regulators of other states where the insurer is licensed under guidelines promulgated by the National Association of Insurance Commissioners (NAIC). State and federal insurance and securities regulators and other state law enforcement agencies and attorneys general also, from time to time, make inquiries and conduct examinations or investigations regarding our compliance, as well as other companies in our industry, with, among other things, insurance laws and securities laws.

In recent years, insurance regulators have emphasized the investigation of alleged improper insurance pricing and sales practices by insurers, including, for example, race-based underwriting or sales practices, misleading sales presentations by insurance agents, targeting of the elderly or other vulnerable adults and the suitability of products for potential customers. Insurance regulators have also shown interest in the use of external data, algorithms and artificial intelligence in insurance practices, including underwriting, marketing, and claims practices.

Insurance regulators have also expressed concern around climate change risk and disclosure. Towards the end of 2021 the NAIC Climate and Resiliency Task Force Solvency Workstream issued an informal questionnaire to stakeholders on potential enhancements to existing regulatory tools relative to the solvency effects of climate change. The chief insurance regulators of a number of states, including New York, require insurance companies to respond to a survey on how they manage risks related to climate change. The NAIC also released a significantly expanded climate risk disclosure survey for consultation. While the NAIC is aiming to finalize the new survey format in 2022, the precise timing in terms of when insurance companies would be required to respond to the new survey and how it will interact with AIG’s other climate-related disclosures is not yet clear. The New York State Department of Financial Services (NYDFS) published final guidance on managing financial risks from climate change in November 2021, according to which New York-domiciled insurers are expected to integrate financial risks from climate change into their governance frameworks, risk management processes and business and investment strategies.

There can be no assurance that any noncompliance with such applicable laws, regulations or guidance would not have a material adverse effect on our business or results of operations.

NAIC Activities and Model Laws

In the United States, the NAIC is a standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and five U.S. territories. The NAIC is not a regulator, but, with assistance from the NAIC, state insurance regulators establish standards and best practices, conduct peer reviews and coordinate regulatory oversight. The NAIC’s mandate is to benefit state insurance regulatory authorities and consumers by promulgating model insurance laws and regulations for adoption by the states. The NAIC also provides standardized insurance industry accounting and reporting guidance through the NAIC Accounting Manual. However, model insurance laws and regulations are only effective when adopted by the states, and NAIC statutory accounting and reporting principles may be modified by each state. Every state has adopted, in substantial part, the Risk-Based Capital (RBC) Model Law promulgated by the NAIC or a substantially similar law, which allows states to act upon the results of RBC calculations, and provides four incremental levels of regulatory action regarding insurers whose RBC calculations fall below specific thresholds. Those levels of action range from the requirement to submit a plan describing how an insurer would regain a specified RBC ratio to a mandatory regulatory takeover of the company. The RBC formula is designed to measure the adequacy of an insurer’s statutory surplus in relation to the risks inherent in its business. The RBC formula computes a risk-adjusted surplus level by applying discrete factors to various asset, premium, reserve and other financial statement items, or in the case of interest rate and equity return (C-3) market risk, applying stochastic scenario analyses. These factors are developed to be risk-sensitive so that higher RBC requirements are applied to items exposed to greater risk. In June 2021, the NAIC adopted changes to the RBC factors for bonds and real estate, which became effective on December 31, 2021. The modified bond and real estate factors are not expected to have a material impact on our RBC calculations. The statutory surplus of each of our U.S. domiciled (re)insurance companies exceeded RBC minimum required levels as of December 31, 2021. Statutory accounting principles promulgated by the NAIC, including for our insurance company subsidiaries, have been, or may be, modified by individual state laws, regulations and permitted practices granted by our domiciliary insurance regulators. Changes to the NAIC Accounting Manual or modifications by the various state insurance departments may impact the investment portfolios and the statutory capital and surplus of our U.S. insurance companies. If any of our (re)insurance entities fell below prescribed levels of statutory surplus, it would be our intention to provide appropriate capital or other types of support to that entity. For additional information, see Part II, Item 7. MD&A – Liquidity and Capital Resources – Liquidity and Capital Resources of AIG Parent and Subsidiaries – Insurance Companies.

AIG | 2021 Form 10-K 11

TABLE OF CONTENTS

ITEM 1 | Business

The NAIC’s Model Regulation “Valuation of Life Insurance Policies” (Regulation XXX) requires insurers to establish additional statutory reserves for term life insurance policies with long-term premium guarantees and universal life policies with secondary guarantees (ULSGs). NAIC Actuarial Guideline 38 (Guideline AXXX) clarifies the application of Regulation XXX as to these guarantees, including certain ULSGs. In December 2012, the NAIC approved a new Valuation Manual containing a principle-based approach to life insurance company reserves. Principle-based reserving (PBR) is designed to tailor the reserving process to more closely reflect the risks of specific products, rather than the factor-based approach employed historically. The Valuation Manual became effective on January 1, 2017, after revisions to the NAIC’s model Standard Valuation Law were enacted by the requisite number of states, representing the required premium volume. Subsection 20 of the Valuation Manual (VM-20) applies to individual life insurance reserves, most notably term insurance and ULSGs. VM-20 is also referred to as “Life PBR”, and replaces Regulation XXX and Guideline AXXX for new life insurance business issued after January 1, 2017. As permitted by applicable regulations, we deferred implementation of Life PBR until January 1, 2020, and have implemented it as of such date with respect to relevant policies issued on or after January 1, 2020. Variable Annuity (VA) reserving requirements, found in subsection 21 of the Valuation Manual (VM-21), replaced the previous Actuarial Guideline XLIII requirements. Substantial revisions to VM-21 became effective January 1, 2020, with options for early adoption or phased-in adoption. We applied VM-21 in full, effective January 1, 2020, to both new and existing VA business. VM-21 is also referred to as “VA PBR.” See Item 1A. Risk Factors – Reserves and Exposures – Reinsurance may be unavailable or too expensive relative to its benefit, and may not be adequate to protect us against losses and Note 18 to the Consolidated Financial Statements for risk and additional information related to these statutory reserving requirements.

The NAIC’s Insurance Holding Company System Regulatory Act (the Model Holding Company Act) and the Insurance Holding Company System Model Regulation include (i) provisions authorizing insurance commissioners to act as global group-wide supervisors for internationally active insurance groups and participate in international supervisory colleges, and (ii) the requirement that the ultimate controlling person of a U.S. insurer file an annual enterprise risk report with its lead state regulator identifying risks likely to have a material adverse effect upon the financial condition or liquidity of its licensed insurers or the insurance holding company system as a whole. All of the states where AIG has domestic insurers have enacted a version of the revised Model Holding Company Act, including the enterprise risk reporting requirement.

The NAIC’s Risk Management and Own Risk and Solvency Assessment Model Act (ORSA) requires that insurers maintain a risk management framework and conduct an internal own risk and solvency assessment of the insurer’s material risks in normal and stressed environments. All of the states where AIG has domestic insurers have enacted a version of ORSA. The NAIC has also adopted a Corporate Governance Annual Disclosure Model Act (CGAD) that requires insurers to submit an annual filing regarding their corporate governance structure, policies and practices. All of the states where AIG has domestic insurers have enacted a version of the CGAD.

The NAIC developed its Group Capital Calculation (GCC) for the supervision of insurance groups in the United States, which it adopted in December 2020. In May 2021, the NAIC determined that provisions of the December 2020 amendments to the Model Holding Company Act that authorize the GCC and liquidity stress testing (LST) will become accreditation standards, and thus states must adopt significant elements of the model to remain accredited. The LST applies to large life insurers based on a set of scope criteria. The purpose of LST is to support macroprudential surveillance, including to assess the potential impact on broader financial markets of aggregate asset sales within a liquidity stress scenario. The proposed effective date of the accreditation standard is January 1, 2026, though the NAIC plans to encourage states to implement the GCC provisions by November 7, 2022, the deadline by which U.S. states must adopt GCC requirements or face federal preemption in connection with “covered agreements” the United States reached with the EU and United Kingdom (UK) to address, among other things, group capital requirements (discussed under Dodd-Frank below). Certain states have already adopted the GCC requirements in their statutes. In 2021, the NAIC GCC Working Group conducted a GCC trial implementation using 2020 data with volunteer companies and their lead states.

State Guaranty Associations

U.S. states have state insurance guaranty associations in which insurers doing business in the state are required by law to be members. Member insurers may be assessed by the associations for certain obligations of insolvent insurance companies to policyholders and claimants. Typically, states assess member insurers in amounts related to the member’s proportionate share of the relevant type of business written by all members in the state. Some jurisdictions permit member insurers to recover assessments that they paid through full or partial premium tax offsets, usually over a period of years. The protection afforded by a state’s guaranty association to policyholders of insolvent insurers varies from state to state. The aggregate assessments levied against us have not been material to our financial condition in any of the past three years.

12 AIG | 2021 Form 10-K

TABLE OF CONTENTS

ITEM 1 | Business

Dodd-Frank

The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), signed into law in 2010, brought about extensive changes to financial regulation in the United States and established the Financial Stability Oversight Council (Council).

Dodd-Frank established the Federal Insurance Office (FIO) to serve as the central insurance authority in the federal government. While not serving a regulatory function, FIO performs certain duties related to the business of insurance and has authority to collect information on the insurance industry and recommend prudential standards. In addition, FIO monitors market access issues, represents the United States in international insurance forums, has authority to determine if certain regulations are preempted by covered agreements, and assists the Secretary of the Treasury in administering the Terrorism Risk Insurance Program under the Terrorism Risk Insurance Act of 2002.

Title V of Dodd-Frank authorizes the United States to enter into covered agreements with foreign governments or regulatory entities regarding the business of insurance and reinsurance. On September 22, 2017, the U.S. and the European Union (EU) entered into such an agreement, and on December 18, 2018, the U.S. signed a covered agreement with the UK, which is similar to the agreement with the EU. U.S. state regulators have five years from the dates the covered agreements were signed to adopt reinsurance reforms and group capital requirements that meet the prescribed conditions set forth in the applicable covered agreement or else state laws imposing such reinsurance collateral requirements may be subject to federal preemption, and Solvency II group capital requirements would apply to groups based in the United States. In June 2019, the NAIC adopted amendments to its credit for reinsurance model law and regulation to conform to the requirements of the covered agreements. In December 2020, the NAIC adopted a GCC that, if enacted by the states effective November 7, 2022, is expected to satisfy the conditions in the covered agreements. Certain states have already adopted the GCC requirements in their statutes.

Title VII of Dodd-Frank provides for significantly increased regulation of, and restrictions on, derivatives markets and transactions that have affected various activities of insurance and other financial services companies, including (i) regulatory reporting for swaps, including security-based swaps, (ii) mandated clearing through central counterparties and execution through regulated swap execution facilities for certain swaps (other than security-based swaps and (iii) margin and collateral requirements. Increased regulation of, and restrictions on, derivatives markets and transactions, including regulations related to initial margin for swaps and securities-based swaps, could increase the cost of our trading and hedging activities, reduce liquidity and reduce the availability of customized hedging solutions and derivatives.

Title II of Dodd-Frank (Orderly Liquidation Authority) provides that a financial company whose largest United States subsidiary is an insurer may be subject to a special orderly liquidation process outside the Bankruptcy Code. That process is to be administered by the Federal Deposit Insurance Corporation upon a determination that the company is: (i) in default or in danger of default, (ii) would have serious adverse effects on U.S. financial stability were it to fail and be resolved, (iii) is not likely to attract private sector alternatives to default and (iv) is not suitable for resolution under the Bankruptcy Code. Dodd-Frank authorizes possible assessments to cover the costs of any special resolution of a financial company conducted under Title II. U.S. insurance subsidiaries of any such financial company, however, would be subject to rehabilitation and liquidation proceedings under state insurance law.

ERISA

We provide products and services to certain employee benefit plans that are subject to the Employee Retirement Income Security Act of 1974, as amended (ERISA), and/or the Internal Revenue Code of 1986, as amended (the Internal Revenue Code). Plans subject to ERISA include certain pension and profit-sharing plans and welfare plans, including health, life and disability plans. As a result, our activities are subject to the restrictions imposed by ERISA and the Internal Revenue Code, including the requirement under ERISA that fiduciaries must perform their duties solely in the interests of ERISA plan participants and beneficiaries, and that fiduciaries may not cause a covered plan to engage in certain prohibited transactions. The applicable provisions of ERISA and the Internal Revenue Code are subject to enforcement by the Department of Labor (DOL), the Internal Revenue Service (IRS) and the Pension Benefit Guaranty Corporation.

Standard of Care Developments

We and our distributors are subject to laws and regulations regarding the standard of care applicable to sales of our products and the provision of advice to our customers. In recent years, many of these laws and regulations have been revised or reexamined while others have been newly adopted. We continue to closely follow these legislative and regulatory activities. Changes in standard of care requirements or new standards issued by governmental authorities, such as the DOL, the SEC, the NAIC or state regulators and/or legislators, have impacted, and may in the future impact, our businesses, results of operations and financial condition.

AIG | 2021 Form 10-K 13

TABLE OF CONTENTS

ITEM 1 | Business

DOL Fiduciary Rule

In June 2020, the DOL issued final guidance on the definition of a “fiduciary” for purposes of transactions with ERISA qualified plans, related plan participants and Individual Retirement Accounts (IRAs). The DOL’s final rule confirmed use of a five-part test for determining who is an investment advice fiduciary, and also confirmed related exemptions. In December 2020, the DOL issued the final version of a new prohibited transaction exemption, for parties that qualify as investment advice fiduciaries. This final version is intended to align broadly with the SEC’s Best Interest Regulation as well as other relevant standards of care requirements. See “SEC Best Interest Regulation”. The terms of the DOL’s exemption impose impartial conduct standards (including a best interest standard), as well as:


disclosure obligations,


a duty to establish, maintain, and follow policies and procedures intended to comply with the exemption, and


a duty to perform an annual retrospective review for compliance with the exemption.

We have reviewed the final DOL exemption and associated preamble, both for applicability and for the impact the exemption may have on our businesses and operations, including the scope of any applicable fiduciary status and duties. As a general matter, where fiduciary status would be applicable, we would expect to be able to utilize the processes and procedures we implemented for the SEC’s Best Interest Regulation to satisfy some or all of the corresponding provisions in the DOL guidance. Nevertheless, implementation may still result in increased compliance obligations and costs for certain of our businesses.

The DOL is reviewing issues relating to its regulation of fiduciary investment advice and may take further regulatory actions. Among other impacts of potential changes, amendments could have an adverse effect on sales of annuities through our independent distribution partners. We continue to monitor developments with respect to the DOL Fiduciary Rule and prohibited transactions exemptions.

SEC Best Interest Regulation

On June 30, 2020, Regulation Best Interest (Regulation BI), which establishes new rules regarding the standard of care a broker must meet when making a recommendation to a retail customer in connection with the sale of a security or other covered recommendation, and Form CRS, which requires enhanced disclosure by broker-dealers and investment advisers regarding client relationships and certain conflicts of interest issues, became effective. Both had been adopted by the SEC in June 2019 as part of a package of final rulemakings and interpretations, at the same time as the SEC issued two interpretations under the Investment Advisers Act of 1940. The first interpretation addressed the standard of conduct applicable to SEC-registered investment advisers, including details regarding the fiduciary duty owed to clients, required disclosures and the adviser’s continuous monitoring obligations. The second interpretation clarified when investment advice would be considered “solely incidental” to brokerage activity for purposes of the broker-dealer exclusion from SEC investment adviser registration. These two SEC interpretations became final upon publication. The SEC has also issued multiple sets of frequently asked questions (FAQs) on certain aspects of Regulation BI and Form CRS, and the SEC could provide additional guidance regarding these final rules.

We have evaluated the impact of the regulation on us and our customers, distribution partners and financial advisers, and have made significant investments to implement and enhance tools, processes and procedures, where needed, to comply with the final rules and interpretations. These efforts and enhancements have resulted in increased compliance costs and may impact sales results and increase regulatory and litigation risk, primarily for our Group Retirement business.

FINRA Standard of Care Development

Effective June 30, 2020, The Financial Industry Regulatory Authority (FINRA) Rule 2111 was amended to provide that FINRA’s suitability requirements do not apply to recommendations that are subject to Regulation BI. This amendment was intended to mitigate any potential confusion regarding which standard of conduct applies to retail consumers. FINRA’s suitability rules still apply to recommendations that are not covered by Regulation BI, such as recommendations to institutional customers.

State Standard of Care Developments

In February 2020, the NAIC adopted revisions to its Suitability in Annuity Transactions Model Regulation (#275) (NAIC Model) implementing a best interest standard of care applicable to sales and recommendations of annuities. The new NAIC Model conforms in large part to Regulation BI, providing that all recommendations by agents and insurers must be in the best interest of the consumer under known circumstances at the time an annuity recommendation is made, without placing agents’ or insurers’ financial interests ahead of the consumer’s interest in making a recommendation. Specifically, the NAIC Model requires agents and insurers to act with “reasonable diligence, care and skill” in making recommendations. The revisions also include enhancements to the current model’s supervision system to assist in compliance. Certain states have already adopted amendments to their suitability rules based on the NAIC Model revisions, and we expect that additional states will do so. We are closely monitoring these developments, including state-level variations from the NAIC Model. We are also implementing and enhancing processes and procedures, where needed, designed to comply with the NAIC Model and state-specific revisions.

14 AIG | 2021 Form 10-K

TABLE OF CONTENTS

ITEM 1 | Business

In addition, certain state insurance and/or securities regulators and legislatures have adopted, or are considering adopting, their own standards of conduct, some of which are broader in scope than the NAIC Model. For example, in July 2018, NYDFS adopted a best interest standard of care regulation applicable to annuity and life insurance transactions through issuance of the First Amendment to Insurance Regulation 187 – Suitability and Best Interests in Life Insurance and Annuity Transactions (Regulation 187). The compliance date for Regulation 187 was August 1, 2019 for annuity products and was February 1, 2020 for life insurance products. As amended, Regulation 187 requires producers to act in their client’s best interest when making point-of-sale and in-force recommendations, and provide in writing the basis for the recommendation, as well as the facts and analysis to support the recommendation. The amended regulation also imposes additional duties on life insurance companies in relation to these transactions, such as requiring insurers to establish and maintain procedures designed to prevent financial exploitation and abuse. In April 2021, the Appellate Division of the NYS Supreme Court, Third Department, overturned Regulation 187 for being unconstitutionally vague. In June 2021, the NYDFS appealed this ruling to the New York State Court of Appeals, which automatically granted a stay, meaning that Regulation 187 remains in effect pending a decision by the Court of Appeals. We have implemented and enhanced processes and procedures, where needed, designed to comply with this regulation.

Besides New York, other states have also adopted, or are considering adopting, legislative and/or regulatory proposals implementing fiduciary duty standards with applicability to insurance producers, agents, financial advisors, investment advisers, broker-dealers and/or insurance companies. The proposals vary in scope, applicability and timing of implementation. We are closely monitoring these developments and evaluating their potential impacts on our products and services, our customers, distribution partners and financial advisors, and the life and retirement industry overall in the United States.

Federal Retirement Legislation

SECURE Act

On December 20, 2019 the Setting Every Community Up for Retirement Enhancement Act (the SECURE Act) was signed into law. The SECURE Act includes many provisions affecting qualified contracts, some of which became effective upon enactment on January 1, 2020 or later, and some of which were retroactively effective. Some of the SECURE Act provisions that became effective on January 1, 2020, include, without limitation: an increase in the age at which required minimum distributions generally must commence, to age 72, from the previous age of 70 1/2; new limitations on the period for beneficiary distributions following the death of the plan participant or IRA owner; elimination of the age 70 1/2 restriction on IRA contributions (combined with an offset to the amount of eligible qualified charitable distributions by the amount of post-70 1/2 IRA contributions); a new exception to the 10 percent additional tax on early distributions for the birth or adoption of a child, which also became an allowable plan distribution event; and, reduction of the earliest permissible age for in-service distributions from pension plans and certain Section 457 plans to 59 1/2. We have implemented new processes and procedures, where needed, designed to comply with the new requirements.

COVID-19 Relief. The U.S. enacted federal legislation to mitigate the economic impacts of the COVID-19 pandemic in the Coronavirus Aid, Relief, and Economic Security (CARES) Act in March 2020, and the Consolidated Appropriations Act in December 2020. The two pieces of legislation contained provisions with impacts on retirement plans and products and services offered by Life Insurance, Individual Retirement and Group Retirement. We have evaluated the impacts of the collective legislation and have implemented processes where applicable. A number of the provisions focused primarily on actions taken in 2020 and are not expected to have material ongoing business impacts. As the COVID-19 pandemic evolves, we will continue to monitor federal legislative developments in this area.

Developments in Comprehensive Retirement Legislation

In 2021, comprehensive federal retirement legislation was introduced in both the House (the Securing a Strong Retirement Act of 2021) and the Senate (the Retirement Security and Savings Act). Both proposals may impact our products and services, including changes to required minimum distribution rules and enhanced obligations for retirement account reporting. In addition, other discrete proposals related to retirement are pending in Congress at this time that may impact our products and services, which could be included in any comprehensive federal retirement legislation. The likelihood of passage, scope, and implementation timing of significant retirement legislation is uncertain at this time, and we are closely monitoring these developments.

U.S. Securities, Investment Adviser, Broker-Dealer and Investment Company Regulation

Our investment products and services are subject to applicable federal and state securities, investment advisory, fiduciary, including ERISA, and other laws and regulations. The principal U.S. regulators of these operations include the SEC, FINRA, CFTC, Municipal Securities Rulemaking Board, state securities commissions, state insurance departments and the DOL.

AIG | 2021 Form 10-K 15

TABLE OF CONTENTS

ITEM 1 | Business

Our variable life insurance, variable annuity and mutual fund products generally are subject to regulation as “securities” under applicable federal securities laws, except where exempt. Such regulation includes registration of the offerings of these products with the SEC, unless exempt from such registration, and requirements of distribution participants to be registered as broker-dealers, as well as recordkeeping, reporting, and other requirements. This regulation also involves the registration of mutual funds and other investment products offered by our businesses, and the separate accounts through which our variable life insurance and variable annuity products are issued, as investment companies under the Investment Company Act of 1940, as amended (Investment Company Act), except where exempt. The Investment Company Act imposes requirements relating to compliance, corporate governance, disclosure, recordkeeping, registration and other matters. In addition, the offering of these products may involve filing and other requirements under the securities laws of the states and other jurisdictions where offered, including the District of Columbia and Puerto Rico. Our separate account investment products are also subject to applicable state insurance regulation.

We have several subsidiaries that are registered as broker-dealers under the Securities Exchange Act of 1934, as amended (Exchange Act) and are members of FINRA, and/or are registered as investment advisers under the Investment Advisers Act of 1940, as amended (Advisers Act). Certain of these broker-dealers and investment advisers are involved in our life and annuity product sales, including participating in their distribution and/or serving as an investment adviser to mutual funds that underlie variable products offered by us. Other subsidiaries are registered with the SEC as investment advisers under the Advisers Act and serve as an investment adviser to out-of-plan and in-plan participant customers, act as the primary investment advisers to our insurance subsidiaries and certain non-insurance subsidiaries, and also provide investment management and advisory services to unaffiliated institutional clients. In addition to registration requirements, the Exchange Act, the Advisers Act, and the regulations thereunder, impose various compliance, disclosure, qualification, recordkeeping, reporting and other requirements on these subsidiaries and their operations. Our investment adviser subsidiaries and our broker-dealer subsidiaries, and their licensed representatives, are also subject to standard of care obligations. See – “Standard of Care Developments” for further information. State securities laws also impose filing and other requirements on broker-dealers, investment advisers and/or their licensed representatives, except where exempt. The SEC, FINRA and other regulatory bodies also have the authority to examine regulated entities, such as our broker-dealer and investment adviser subsidiaries, and to institute administrative or judicial proceedings that may result in censure, fines, prohibitions or restrictions on activities, or other administrative sanctions.

Further, our licensed sales professionals appointed with certain of our broker-dealer and/or investment adviser subsidiaries and our other employees, insofar as they sell products that are securities, including wholesale and retail activity, are subject to the Exchange Act and to examination requirements and regulation by the SEC, FINRA and state securities commissioners. Regulation and examination requirements also extend to our subsidiaries that employ or control those individuals. The SEC, beginning in late 2020 and continuing through 2021, instituted a comprehensive regulatory agenda focusing on Environmental, Social and Governance (ESG) issues. The SEC commissioners and staff announced a number of actions, including forming an enforcement task force designed to harmonize the efforts of the SEC’s divisions and offices, considering potential comprehensive changes to ESG disclosure guidance and potential rulemakings for ESG and climate-specific disclosure for issuers, investment advisers and funds, announcing ESG as an examination priority, addressing shareholder rights and creating accountability in statements and conduct, and soliciting comments to potential changes to the “names rule” under the Investment Company Act to reflect the effect of ESG factors on a fund’s investment objectives and performance. The SEC’s Division of Examinations issued a risk alert in 2021 highlighting ESG deficiencies, internal control weaknesses and effective practices identified during recent examinations of investment advisers, registered investment companies and private funds. The increased regulatory and compliance burdens that we expect would result from the implementation of any of these initiatives could be costly.

Privacy, Data Protection and Cybersecurity

We are subject to U.S. laws and regulations that require financial institutions and other businesses to protect the security and confidentiality of personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information, including their policies relating to protecting the security and confidentiality of that information. We also are subject to U.S. laws and regulations requiring notification to affected individuals and regulators of security breaches. Congress and state legislatures are expected to continue to consider additional legislation relating to privacy and other aspects of customer information. Below we highlight a few, key, recently-enacted laws and regulations.

In October 2017, the NAIC adopted the Insurance Data Security Model Law (NAIC Model Law), which would require insurers, insurance producers and other entities required to be licensed under state insurance laws to develop and maintain a written information security program, conduct risk assessments, oversee the data security practices of third-party service providers and other related requirements.

A number of states, including Connecticut and Ohio, have enacted a version of the NAIC Model Law.

16 AIG | 2021 Form 10-K

TABLE OF CONTENTS

ITEM 1 | Business

On March 1, 2019, the NYDFS cybersecurity regulation became fully effective, requiring covered financial institutions to implement a cybersecurity program designed to protect information systems. The regulation imposes specific technical safeguards as well as governance, risk assessment, monitoring and testing, third-party service provider, incident response and reporting and other requirements. We annually file certifications of compliance as required by the NYDFS cybersecurity regulation. The requirements contained in the NYDFS cybersecurity regulation are similar in many, but not all, respects to those under the NAIC Model Law.

On October 21, 2019, the NAIC formed a Privacy Protections Working Group to review state insurance privacy protections regarding the collection, use and disclosure of information gathered in connection with insurance transactions. During its meeting on July 30, 2020, the Privacy Protections Working Group indicated that it would begin a gap analysis of existing privacy protections in order to identify differences in coverage between different privacy regimes, focusing on consumer issues, industry obligations, and regulatory enforcement. The Privacy Protections Working Group continues to work on this gap analysis, which could result in recommended changes to certain NAIC model laws and regulations related to privacy.

California enacted the California Consumer Privacy Act of 2018 (CCPA). The CCPA imposes a number of requirements on businesses that collect the personal information of California consumers, including requirements to provide individuals with certain rights to their personal information and make mandatory disclosures regarding how the businesses use and disclose consumers’ personal information. The CCPA also establishes a private right of action in some cases if consumers’ personal information is subject to a data breach resulting from a business’ failure to implement and maintain reasonable security practices. On November 3, 2020, California voters passed a ballot initiative, the California Privacy Rights Act (the CPRA), that imposes additional obligations on companies that collect California consumers’ personal information, including to provide a right to correct personal information, additional protections for certain uses of sensitive personal information, and certain limitations on data use and on data sharing that does not involve a sale of personal information. The CPRA also creates a new California Privacy Protection Agency which will be charged with enforcing both the CCPA and the CPRA. The CPRA will take effect on January 1, 2023.

In 2021, Virginia and Colorado passed comprehensive privacy laws that will become effective January 1, 2023 and July 1, 2023, respectively. Similar legislation has been proposed in other states and additional privacy and cybersecurity laws are expected to be enacted by the states or the federal government in the near future. The above-mentioned changes in the privacy and cybersecurity law landscape in the United States may require additional compliance investment and additional changes to policies, procedures, and operations.

With respect to our investment adviser subsidiaries and the mutual funds and registered separate accounts, the SEC continues to focus on cybersecurity in the asset management industry. The SEC has published periodic guidance on the topic, recommending periodic assessments of information, how it is stored and how vulnerable it is, as well as strategies to prevent, detect and respond to cyber threats, including access controls, governance and risk assessments, training, data encryption, restrictions on removable storage media, robust backup procedures, incident response plans and routine testing. Further, investment advisers to fund complexes must also focus on their growing network of third-party service providers. The SEC’s Division of Examinations issued examination observations in January 2020 related to cybersecurity and operational resiliency practices taken by market participants. The observations highlight certain approaches taken by market participants in the areas of governance and risk management, access rights and controls, data loss prevention, mobile security, incident response and resiliency, vendor management, and training and awareness. In its observations, the Division of Examinations highlighted specific examples of cybersecurity and operational resiliency practices and controls that organizations have taken to potentially safeguard against threats and respond in the event of an incident. In July 2020, the Division of Examinations issued a Risk Alert noting the increasing sophistication of ransomware attacks on SEC registrants and service providers to SEC registrants.

Thrift Regulator

AIG Federal Savings Bank, our trust-only federal thrift subsidiary, is supervised and regulated by the Office of the Comptroller of the Currency.

AIG | 2021 Form 10-K 17

TABLE OF CONTENTS

ITEM 1 | Business

INTERNATIONAL REGULATION

Insurance and Financial Services Regulation

A substantial portion of our business is conducted in foreign countries. The degree of regulation and supervision in foreign jurisdictions varies. Generally, our subsidiaries operating in foreign jurisdictions must satisfy local regulatory requirements; licenses issued by foreign authorities to our subsidiaries are subject to modification or revocation by such authorities, and therefore these subsidiaries could be prevented from conducting business in certain of the jurisdictions where they currently operate. For our international operations, a decline in capital and surplus over capital requirements would limit the ability of our insurance subsidiaries to write business or make dividend payments or distributions. Additionally, regulators in the countries in which such subsidiaries operate may deem it necessary to impose restrictions on dividend distributions in the event of a significant financial market or insurance event which creates uncertainty over our future capital and solvency position.

Certain jurisdictions require registration and periodic reporting by (re)insurance companies that are licensed in such jurisdictions and are controlled by other entities. Applicable legislation typically requires periodic disclosure concerning the entity that controls the registered insurer and the other companies in the holding company system and prior approval of intercompany transactions and transfers of assets, including in some instances payment of dividends by the (re)insurance subsidiary within the holding company system. Our subsidiaries are registered under such legislation in those jurisdictions that have such requirements.

In addition to these licensing and other requirements, our foreign operations are also regulated in various jurisdictions with respect to currency, policy language and terms, advertising, amount and type of security deposits, amount and type of reserves, amount and type of capital to be held, amount and type of local investment and the share of profits to be returned to policyholders on participating policies. Our foreign operations are subject to local tax laws and regulations as well. Some foreign countries regulate rates on various types of policies. Certain countries have established reinsurance institutions, wholly or partially owned by the local government, to which admitted insurers are obligated to cede a portion of their business on terms that may not always allow foreign insurers, including our subsidiaries, full compensation. In some countries, regulations governing constitution of technical reserves and remittance balances may hinder remittance of profits and repatriation of assets.

The Prudential Regulation Authority (PRA), the UK’s prudential regulator, is the lead prudential supervisor for our UK insurance operations. The UK’s Financial Conduct Authority has oversight of AIG’s insurance operations for consumer protection and competition matters. For example, we are subject to the UK’s Senior Managers and Certification Regime (SMCR), legislation that is intended to reduce harm to consumers and strengthen market integrity by making senior individuals more accountable for their conduct and competence. The SMCR comprises 3 elements: the Senior Managers Regime, which requires that firms appoint an individual with responsibility for each senior management function and subjects such individuals to regulatory pre-approval; the Certification Regime, which requires firms to certify (on an on-going basis) the fitness and propriety of certain employees who could harm the firm, its customers or the market; and the Conduct Rules, which are high-level standards of behavior expected of those working in financial services. The UK Financial Conduct Authority (FCA) has also published Policy Statement PS21/3 titled “Building operational resilience: Feedback to CP19/32 and final rules” which will require, amongst other things, firms to strengthen their operational resilience by identifying important business services and setting tolerance levels for operational disruption. These rules will come into force in March 2022.

Legislation in the EU could also affect our international (re)insurance operations. The EU issues Directives and Regulations on a wide range of topics that impact financial services. Insurance companies operating in the EU are subject to the Solvency II framework. The Luxembourg insurance regulator, the Commissariat aux Assurances, is the insurance regulator for AIG Europe SA, which serves our European Economic Area (EEA) and Swiss policyholders. In addition, financial companies that operate in the EU are subject to a range of regulations enforced by the national regulators in each member state in which that firm operates. The EU has also established a set of regulatory requirements under the European Market Infrastructure Regulation (EMIR) that include, among other things, risk mitigation, risk management, regulatory reporting and clearing requirements. Solvency II governs the insurance industry’s solvency framework for the EU, including minimum capital and solvency requirements, governance requirements, risk management and public reporting standards. In accordance with Solvency II, the European Commission is required to make a determination as to whether a supervisory regime outside of the EU is “equivalent.”

On September 22, 2017, the U.S. Treasury Department and the Office of the U.S. Trade Representative, on behalf of the U.S., and the EU signed the bilateral Covered Agreement, which is intended to address issues regarding the application of Solvency II requirements to U.S.-based insurance groups as well as other (re)insurance regulatory issues. Certain aspects of the agreement remain subject to an implementation timetable in the U.S. and the EU, which may delay or even prevent the agreement from being fully implemented. In particular, the U.S. states have been given a period of five years to comply with the agreement’s reinsurance collateral provisions. The agreement may be terminated (following mandatory consultation) by notice from one party to the other effective in 180 days, or at such time as the parties may agree.

18 AIG | 2021 Form 10-K

TABLE OF CONTENTS

ITEM 1 | Business

Under the agreement, AIG will be supervised at the worldwide group level only by its relevant U.S. insurance supervisors, and will in general not have to satisfy EU Solvency II group capital, reporting and governance requirements for its worldwide group. The agreement, however, would permit the imposition of EU Solvency II group capital requirements if, after five years from the signing of the agreement, a U.S. insurer is not subject to a group capital assessment by its applicable state regulator. As referenced elsewhere (see “NAIC Activities and Model Laws” section) the NAIC has developed a GCC which is designed to satisfy this requirement. Certain states have already adopted the GCC requirements in their statutes. Remaining states have until November 7, 2022 to implement the GCC provisions after which they will be subject to federal preemption. The Covered Agreement further provides that if the summary risk reports submitted to the supervisory authority of a host jurisdiction expose any serious threat to policyholder protection or financial stability in such host state, the host supervisor may request further information from the insurance group and/or impose preventive or corrective measures with respect to the (re)insurer in its jurisdiction. The agreement also seeks to impose equal treatment of U.S. and EU-based reinsurers that meet certain qualifications. In the U.S., once fully implemented, the agreement requires U.S. states to lift reinsurance collateral requirements on qualifying EU-based reinsurers and provide them equal treatment with U.S. reinsurers or be subject to federal preemption. While this provision does not preclude AIG from continuing to request collateral from an EU reinsurer that is party to a bilateral reinsurance transaction, it is generally difficult to obtain collateral from reinsurers when it is not required for AIG to take credit for the reinsurance.

Lastly, while the U.S. has not been deemed an “equivalent” jurisdiction under European law, U.S. groups are expected to receive treatment under Solvency II that reflects the soundness of U.S. supervision, Covered Agreement safeguards, and the enhanced bilateral relationship between U.S. and EU authorities. Based on proposed changes to Article 262 in Solvency II, as part of EIOPA and the European Commission’s current review of the Solvency II framework, there is a desire to bring increased conformity to the supervision of groups from non-equivalent jurisdictions across all EU member states. These potential changes could include limits on intragroup transactions, governance changes and requiring information on risk exposures from parent companies. It is currently unclear how these potential changes would apply to US groups.

On December 18, 2018, the U.S. Treasury Department and the Office of the U.S. Trade Representative signed the Bilateral Agreement between the U.S. and the UK on Prudential Measures Regarding Insurance and Reinsurance. The terms of the agreement are substantially similar to the U.S.-EU Covered Agreement. The agreement has been entered into in order to maintain regulatory certainty and market continuity in connection with the UK’s exit from the EU. In addition, the agreement notes with respect to the date of entry into force that the UK must take into account its obligations arising in respect of any agreement between the EU and the UK pursuant to Article 50 of the Treaty on European Union, which sets out the process under which an EU member state may withdraw from the EU.

Bermuda’s Insurance Act 1978 and its related regulations impose solvency and liquidity standards and auditing and reporting requirements on Bermuda (re)insurance companies and grant the Bermuda Monetary Authority (BMA) powers to supervise, investigate and intervene in the affairs of (re)insurance companies. The BMA regulates AIG’s operating (re)insurance subsidiaries in Bermuda. A variety of requirements and restrictions are imposed on our Bermuda operating (re)insurance subsidiaries including: the filing of annual/quarterly statutory financial information including, but not limited to, the preparation of an annual Financial Condition Report for commercial (re)insurers providing details of measures governing the business operations, corporate governance framework, solvency and financial performance; the filing of annual audited financial statements prepared in accordance with GAAP International Financial Reporting Standards or other generally accepted accounting principles as the BMA may recognize; compliance with minimum enhanced capital requirements; compliance with the BMA’s applicable Codes of Conduct; compliance with minimum solvency margins and liquidity ratios (the latter for general business (re)insurers); limitations on dividends and distributions; and notification obligations to the BMA on certain changes in control of regulated (re)insurers.

The Registrar of Companies (ROC) regulates the compliance by AIG’s entities in Bermuda which carry on a Relevant Activity, as defined in Bermuda’s Economic Substance Act 2018 and related Economic Substance Regulations 2018 (as amended, the ES Laws). The purpose of the ES Laws is to ensure that Bermuda does not facilitate the use of structures which attract profits but which do not reflect real economic activity that is being undertaken in Bermuda. The ROC imposes the filing of an annual declaration form demonstrating compliance with the requirements of the ES Laws by entities which carry on a Relevant Activity.

The Japan Financial Services Agency (JFSA) regulates AIG’s operating insurance subsidiaries in Japan. The JFSA has extensive authority under the Insurance Business Act and related regulations to oversee company licensing, sales practices, business conduct, investments, reserves and solvency, among other items. Our Japanese insurance operations are required to maintain a minimum solvency margin ratio (SMR), which is a measure of capital adequacy. The failure to maintain an appropriate SMR, or comply with other similar indicators of financial health, could result in the JFSA imposing corrective actions on our operations.

AIG | 2021 Form 10-K 19

TABLE OF CONTENTS

ITEM 1 | Business

Derivatives

Regulation of, and restrictions on, derivatives markets and transactions were adopted outside the United States in conjunction with similar regulation promulgated by U.S. regulators. For instance, the EU and UK established a set of regulatory requirements for EU and UK derivatives activities under EMIR and English law, respectively. These requirements include, among other things, various risk mitigation, risk management, margin posting, regulatory reporting and, for certain categories of derivatives, clearing requirements, that are broadly similar to, but also deviate in certain respects from U.S. regulations of these activities. There remains the possibility of increased administrative costs with respect to our EU and UK derivatives activities and/or our derivatives activities with EU or UK counterparties and overlapping or inconsistent regulation depending on the ultimate application of cross-border regulatory requirements between and among U.S. and non-U.S. jurisdictions.

Markets in Financial Instruments Directive (MiFID) II

The Markets in Financial Instruments Directive (MiFID II) and Markets in Financial Instruments Regulation (MiFIR) took effect in Europe on January 3, 2018. MiFID II and the related regulations are intended to create transparency in market trading by, for example, imposing trade and transaction reporting and other requirements. AIG Asset Management (Europe) Limited has implemented and continues to implement new policies, procedures and reporting protocols required to ensure compliance with this legislation and its related rules.

EMIR, which governs derivatives, and MiFID II were adopted by the UK government as part of the Brexit legislative “onshoring” process. The MiFID requirements were implemented in the UK before the UK’s exit from the EU and then amended to reflect the UK’s exit from the EU. MiFIR was onshored in the UK by the Markets in Financial Instruments (Amendment) (EU Exit) Regulation 2018 (as amended). Brexit has not, as yet, had a material impact on the UK regulation of derivatives and financial markets. The UK government is conducting a wholesale markets review that proposes changes to MiFID rules governing trading venues and equity markets (such as the possible repeal of the obligation to trade equities on a regulated market or trading venue) and changes to MiFID rules on client reporting and disclosure, and minor changes to EMIR. However, substantive obligations on AIG Asset Management (Europe) Limited arising from EMIR and MiFID II are unlikely to change in the UK context in the near future.

International Securities, Investment Adviser, Broker-Dealer and Investment Company Regulation

We operate investment-related businesses in, among other jurisdictions, the UK and Ireland. These businesses may advise on and market investment management products and services, investment funds and separately managed accounts. The regulatory authorities for these businesses include securities, investment advisory, financial conduct and other regulators that typically oversee such issues as: (1) company licensing; (2) the approval of individuals with positions of responsibility; (3) conduct of business to customers, including sales practices; (4) solvency and capital adequacy; (5) fund product approvals and related disclosures; and (6) securities, commodities and related laws, among other items. For example, our regulated asset manager in the UK is subject to the SMCR regime described above. We also participate in investment-related joint ventures in jurisdictions outside the United States, primarily in Europe and Asia. In some cases, our international investment operations are also subject to U.S. securities laws and regulations.

Privacy, Data Protection and Cybersecurity

The EU General Data Protection Regulation (GDPR) took effect in May 2018. The GDPR’s scope extends to entities established within the EEA (i.e., EU member states plus Iceland, Liechtenstein and Norway) and to certain entities not established in the EEA (in certain instances, if they solicit or target individuals in the EU by offering goods or services to EEA data subjects or monitoring the personal behavior of EEA data subjects (e.g., in an online context)). The GDPR was also onshored in the UK through the European Union (Withdrawal Agreement) Act 2018, with adjustments as provided in the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

We have sought to address these new requirements on the processing of personal data about individuals, including mandatory security breach reporting, new and strengthened individual rights, evidenced data controller accountability for compliance with the GDPR principles (including fairness and transparency), maintenance of data processing activity records and the implementation of “privacy by design”, including through the completion of mandatory Data Protection Impact Assessments in connection with higher risk data processing activities. Sanctions for non-compliance with the GDPR are onerous, with the potential for fines of up to 4 percent of global revenue for the most serious infringements of the GDPR.

20 AIG | 2021 Form 10-K

TABLE OF CONTENTS

ITEM 1 | Business

We also are subject to other international laws and regulations that require financial institutions and other businesses to protect personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information and to obtain consent pertaining to such processing. We are also subject to laws and regulations requiring notification to affected individuals and regulators of security breaches. In addition, we must comply with laws and regulations regarding data localization and the cross-border transfer of information. For example, in 2021, the European Commission approved revised Standard Contractual Clauses (SCCs) for international data transfers from the EEA. The SCCs are required to be used for new agreements involving the cross-border transfer of personal data from the EEA and must be supplemented by an assessment and due diligence of the legal and regulatory landscape of the jurisdiction of the data importer, the channels used to transmit personal data and the subprocessors that receive personal data in the process.

The EEA and the UK have also taken steps to regulate the use of personal data, including external data, and algorithms used for the purpose of AI and automated decision-making. In April 2021, the European Commission published its Proposal for a Regulation on a European approach for Artificial Intelligence (the Artificial Intelligence Act, which recommends a risk-based approach to restricting, regulating and permitting different AI systems. European countries, and supranational political organizations like the EU and the Council of Europe, are expected to take an active role in regulating AI in ways that may impact the insurance industry in the future.

For additional information on U.S. privacy, data protection and cybersecurity regulation, see U.S. Regulation – Privacy, Data Protection and Cybersecurity.

FSB and IAIS

The Financial Stability Board (FSB) consists of representatives of national financial authorities of the G20 countries. The FSB is not a regulator but is focused primarily on promoting international financial stability. It does so by coordinating the work of national financial authorities and international standard-setting bodies as well as developing and promoting the implementation of regulatory, supervisory and other financial policies. The FSB has issued a series of frameworks and recommendations to address such issues as systemic financial risk, financial group supervision, capital and solvency standards, effective recovery and resolution regimes, corporate governance including compensation, and a number of related issues associated with responses to the financial crisis.

The International Association of Insurance Supervisors (IAIS) represents insurance regulators and supervisors of more than 200 jurisdictions (including regions and states) in nearly 140 countries and seeks to promote globally consistent insurance industry supervision. The IAIS is not a regulator, but one of its activities is to develop insurance regulatory standards for use by local authorities across the globe. The FSB has charged the IAIS with developing a framework for measuring and mitigating systemic risks posed by the insurance sector, and the IAIS has developed standards relative to many of the areas of focus of the FSB, which go beyond the IAIS’ basic Insurance Core Principles. The IAIS has adopted ComFrame, a Common Framework for the Supervision of Internationally Active Insurance Groups (IAIGs). ComFrame sets out qualitative and quantitative standards tailored to the international activity and size of IAIGs. These standards assist supervisors in collectively addressing an IAIG’s activities and risks, identifying and avoiding supervisory gaps and coordinating supervisory activities, particularly between the group-wide supervisor and other involved supervisors. ComFrame provides standards for group supervision, governance and internal controls, enterprise risk management, and recovery and resolution planning. As part of ComFrame, the IAIS is developing a risk-based global insurance capital standard (ICS) applicable to IAIGs, with the purpose of creating a common language for supervisory discussions of group solvency of IAIGs. We currently meet the criteria set forth to identify an IAIG, and the NYDFS, as our group-wide supervisor, has publicly disclosed us as an IAIG on the IAIS’ register of IAIGs.

The IAIS has adopted ICS Version 2.0 for a five-year monitoring phase, an initial phase commencing January 2020, during which ICS Version 2.0 is used for confidential reporting to group-wide supervisors and discussion in supervisory colleges, but will not trigger supervisory action. The purpose of the monitoring period is to monitor the performance of the ICS over a period of time, and not to assess the capital adequacy of IAIGs. During the monitoring period, the IAIS will collect and consider feedback from supervisors, stakeholder engagement, a public consultation, and the results of an economic impact assessment, all of which could result in changes to ICS Version 2.0.

At the conclusion of the five-year monitoring period, the IAIS has agreed to a second phase of implementation, whereby the ICS will be applied as a group-wide prescribed capital requirement, defined as a solvency control level above which the supervisor does not intervene on capital adequacy grounds.

AIG | 2021 Form 10-K 21

TABLE OF CONTENTS

ITEM 1 | Business

Confidential reporting of ICS Version 2.0 will include reporting by IAIGs of a reference ICS, a consolidated group-wide measure based on a standard method for determining capital requirements and a market adjusted valuation of assets and liabilities. In recognition that the United States and other interested jurisdictions are developing an Aggregation Method (AM) to a group capital calculation, the IAIS is aiding in the development of the AM, including the collection of data from interested jurisdictions. Although the AM is not part of ICS Version 2.0, the IAIS aims to be in a position by the end of the monitoring phase to assess whether the AM provides substantially the same outcome as the ICS, in which case it will be considered an outcome-equivalent approach to the ICS. The IAIS is developing criteria to assess whether the AM provides comparable outcomes to the ICS, including a project plan focused on delivery by the end of the monitoring period.

The IAIS has adopted a Holistic Framework for the assessment and mitigation of systemic risk in the insurance sector, with implementation beginning in 2020. The Holistic Framework recognizes that systemic risk can emanate from specific activities and exposures arising from either sector-wide trends or concentrations in individual insurers. The Holistic Framework consists of:


an enhanced set of supervisory policy measures for macroprudential purposes (including supervisory requirements applied to insurers targeting liquidity risk, macroeconomic exposure, and counterparty exposure; enhanced macroprudential supervision; crisis management and planning; and supervisory powers of intervention),


an annual IAIS global monitoring exercise to assess trends and to detect the potential build-up of systemic risks (including an assessment of the possible concentration of systemic risks at individual insurers),


mechanisms for collective IAIS discussion and assessment, including coordinated supervisory responses when needed, and


an IAIS assessment of the consistency of implementation across jurisdictions.

In light of the IAIS adoption of the Holistic Framework, the FSB decided to continue its suspension of the identification of global systemically important insurers (G-SII). In November 2022, based on the initial years of implementation of the Holistic Framework, the FSB will review the need to either discontinue or re-establish an annual identification of G-SIIs.

The standards issued by the FSB and/or the IAIS are not binding on the United States or other jurisdictions around the world unless and until the appropriate local governmental bodies or regulators adopt laws and regulations implementing such standards. At this time, as these standards have been adopted only recently and in some cases remain under development, in some cases there is uncertainty about how the IAIS’ frameworks and/or standards might be implemented in the United States and other jurisdictions around the world, or how they might ultimately apply to us.

Climate Change

There have been a number of climate related policy developments throughout 2021, mostly focused on the UK (which we expect will impact AIG’s UK operations) and European markets, however there is increasing activity in certain jurisdictions across Asia (such as Singapore, Australia, Taiwan and New Zealand).

In the UK, the PRA’s 2021 Climate Change Adaptation Report sets out an expectation that they will be asking the largest firms in the UK for a report describing how the firm has embedded management of climate related financial risks into their existing management frameworks, and in particular, “how [the firm] has gained assurance that capital positions cover material climate related financial risks”.

In the EU, the upcoming Corporate Sustainability Reporting Directive and EU taxonomy initiatives will introduce additional disclosure requirements for large EU entities covering how sustainability is reflected in the balance sheet, business strategy and governance in the short, medium, and long-term horizons. If proposed timeframes are met, the new requirements would apply to AIG’s EU subsidiaries commencing in 2024 for reports covering 2023. Around the same timeframe, there could also be additional non-financial disclosure requirements associated with new corporate governance requirements, as well as the ongoing EU taxonomy initiatives, which include a requirement to set out the proportion of environmentally sustainable economic activities in investment & underwriting portfolios. AIG is already working on developing internal policies and frameworks to ensure we are ready to comply with these emerging standards when they become effective.

22 AIG | 2021 Form 10-K

TABLE OF CONTENTS

ITEM 1 | Business

Available Information about AIG

Our corporate website is www.aig.com. We make available free of charge, through the Investor Information section of our corporate website, the following reports (and related amendments as filed with the SEC) as soon as reasonably practicable after such materials are electronically filed with, or furnished to, the SEC:


Annual Reports on Form 10-K


Quarterly Reports on Form 10-Q


Current Reports on Form 8-K


Proxy Statements on Schedule 14A, as well as other filings with the SEC

Also available on our corporate website:


Charters for Board Committees: Audit, Nominating and Corporate Governance, Compensation and Management Resources and Risk and Capital Committees


Corporate Governance Guidelines


Director, Executive Officer and Senior Financial Officer Code of Business Conduct and Ethics (we will post on our website any amendment or waiver to this Code within the time period required by the SEC)


Employee Code of Conduct

Except for the documents specifically incorporated by reference into this Annual Report on Form 10-K, information contained on our website or that can be accessed through our website is not incorporated by reference into this Annual Report on Form 10-K. Reference to our website is made as an inactive textual reference.

AIG | 2021 Form 10-K 23

TABLE OF CONTENTS