The NAIC's freeze on designations assigned through the filing exempt and private letter rating process is now fully over. The two events that had to happen before insurers stopped filing on the 17 June snapshot happened a week apart — and the second landed two days after the filing deadline it existed to protect. That gap is the whole lesson.
NAICFiling exemptRBCOperational resilienceOn 2 July 2026 the NAIC made the permission to file on frozen designations conditional on two events, not one. Insurers could use the 17 June designations:
"until the CRP ratings symbol data feed suspension has been lifted and regular publication of NAIC designations in AVS+ has resumed."
On 8 July it narrowed the first limb, inserting three words so that it read "the CRP ratings symbol data feed suspension impacting FE/PLR Designations has been lifted". Both limbs have now been satisfied, and the two events they turn on fell on different dates.
The first was addressed in the entry of 10 August, 1:30 p.m. ET: "All credit rating provider feeds required for the filing exempt process have resumed." The second in the entry of 18 August, 4:00 p.m. ET, which dates the resumption itself to 17 August:
"The NAIC is receiving all of the credit rating provider (CRP) rating data feeds needed to assign NAIC Designations to insurer investments that are based upon a public or private CRP rating (i.e. NAIC Designations assigned through the Filing Exempt (FE) and Private Letter Rating (PLR) process). Effective August 17, 2026, these NAIC Designations are once again published for insurers in the NAIC's AVS+ system, and the status information is being updated in VISION and STS systems."
The same entry adds a piece of relief that had not been trailed in any earlier entry on the page: the Investment Designation Analysis (E) Working Group "approved permitting the Securities Valuation Office to temporarily extend the private rating filing deadlines for a period equivalent to the outage period that began on June 17, 2026" — a working group authorising an office to grant an extension, rather than the extension itself — and "This update has been implemented in the VISION application."
One scope point, stated expressly in the 8 July entry: designations assigned by the Securities Valuation Office or the Structured Securities Group were never affected. The freeze reached only designations assigned through the FE/PLR process.
Designation assignment and publication through the FE/PLR process was suspended from 18 June 2026. Feeds had resumed by 10 August — 53 days. Publication in AVS+ resumed effective 17 August — 60 days. Between the two sits a seven-day window in which the data was flowing and the designations were still not being published.
That window is the practical case for reading a two-limb condition as two limbs. A reader who took 10 August as the end of the permission would have been wrong by a week, in a direction that matters: they would have believed themselves obliged to move off the frozen snapshot while the restored designations were not yet published to move onto.
It also settles a scope question that was genuinely open on 10 August. That entry named only the feeds required for the filing exempt process; it did not mention private letter ratings, and we said at the time that PLR should be treated as unstated rather than rounded up. The 18 August entry names both processes expressly. Note what follows for the first limb as the 8 July wording defines it: since that limb is framed by reference to FE and PLR designations, it was not demonstrably satisfied on 10 August either — the entry that completes it is the same 18 August entry that completes the second. On the strictest reading, the two limbs closed together, and the seven-day window is the gap between the feeds returning and the designations being published, not between two independently confirmed conditions.
Second-quarter statutory filings were due 15 August. The permission to file on the frozen basis ended, on its own terms, on 17 August — two days later — and was announced on 18 August, a day after it took effect.
For filers this is benign, and worth saying plainly: anyone who filed second-quarter statements on the 17 June basis filed on a basis that was expressly permitted, and remained permitted, for the whole of the filing window. Quarterly reporting was not to be delayed and did not need to be. We read nothing in the restoration as reaching back.
But look at the shape of it. A conditional permission was issued to keep a market-wide control working through an outage. It expired on an event rather than a date; the event occurred after the deadline the permission was designed to protect; and the announcement of the event came the day after the event itself. Every one of those is defensible in isolation. Together they describe a control whose end state could not be known in advance by anyone relying on it.
Record the basis and the date you checked it. The evidence a reviewer will want in twelve months is not the designation set — it is proof of when you looked and what the page said when you looked. A permission that ends on somebody else's announcement makes the monitoring record part of the filing record.
Reconcile the frozen and restored designations. For FE-dependent positions that saw rating action between 17 June and 17 August, there is a difference between the risk-based capital figure filed on the frozen snapshot and the figure on restored designations. Size it now as a disclosed sensitivity rather than meeting it at year-end. The reconciliation window is now closed and fully bounded, which makes this a finite exercise.
Check whether the private-rating deadline extension applies to you. The working group has approved permitting the Securities Valuation Office to extend private-rating filing deadlines by a period equivalent to the outage period, which the NAIC dates from 17 June 2026; the NAIC states the update has been implemented in VISION. It was announced in a security-incident update. Confirm with the Securities Valuation Office what that means for your own filings.
One housekeeping point remains open on the page's own face. The updates of 23 and 26 June each listed two departures from normal operations: assurance meetings with credit rating providers, and online invoice payment via PeopleSoft. On the first, the 26 June wording had already moved from "to provide third-party assurances" to "have provided third-party assurances", and feeds and publication have since resumed — so we read it as satisfied, but that reading is our inference rather than something the NAIC has stated. No later entry, including 18 August, retires the second at all.
The thesis we set out during the outage does not weaken on restoration; it completes. A supervisor's own data infrastructure became a single point of failure for a market-wide control for 60 days, across a quarter-end. The remedy — a frozen snapshot plus a conditional permission — was the right call, and it kept the market filing. It also transferred the monitoring cost onto every filer and left the end of the permission undated, and the actual end arrived two days after the deadline and was announced a day late.
This generalises well beyond one regulator. Any dependency whose failure mode is answered with "carry on using the last known good value until we tell you otherwise" has quietly created a second obligation: somebody must keep checking, and the checking has no deadline attached. That obligation is rarely written into a control description, rarely owned by a named function, and almost never tested.
Ours was tested and failed once during this episode. We re-read the source on 27 July, 31 July, 7 August and 9 August, each time correctly finding no change — and then the next scheduled re-read did not happen, and we picked up the 10 August restoration five days late. We record that because it is the finding about us, and it is the same finding a firm should be hunting in its own dependency register. The 18 August entry we caught within a day, which is what the control is supposed to do.
So the transferable question for a risk function is not "were we affected by the NAIC incident". It is: which of our controls currently depend on a permission that expires on somebody else's announcement — and who is rostered to notice the day it does?
A firm-specific walk-through of externally-conditioned controls — dependency map to operational-risk tail to capital consequence, evidenced end to end, with the monitoring obligation made explicit and owned.