Item 1. BUSINESS

As used in this report, references to “we,” “us,” “our,” “Arch” or the “Company” refer to the consolidated operations of Arch Capital Group Ltd. (“Arch Capital”) and its subsidiaries. All amounts are in millions, except per share amounts, unless otherwise noted. We refer you to Item 1A “Risk Factors” for a discussion of risk factors relating to our business.

OUR COMPANY

General

Arch Capital is a publicly listed Bermuda exempted company with approximately $21.1 billion in capital at December 31, 2023 and is part of the S&P 500 index. Arch provides insurance, reinsurance and mortgage insurance on a worldwide basis through its wholly owned subsidiaries. While we are positioned to provide a full range of property, casualty and mortgage insurance and reinsurance lines, we focus on writing specialty lines of insurance and reinsurance. For 2023, we wrote $13.5 billion of net premiums and reported net income available to Arch common shareholders of $4.4 billion. Book value per share was $46.94 at December 31, 2023, compared to $32.62 per share at December 31, 2022.

Arch Capital’s registered office is located at Clarendon House, 2 Church Street, Hamilton HM 11, Bermuda (telephone number: (441) 295-1422), and its principal executive offices are located at Waterloo House, Ground Floor, 100 Pitts Bay Road, Pembroke HM 08, Bermuda (telephone number: (441) 278-9250). Arch Capital makes available free of charge through its website, located at www.archgroup.com, its annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after such material is electronically filed with, or furnished to, the U.S. Securities and Exchange Commission (“SEC”). The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC (such as Arch Capital) and the address of that site is www.sec.gov.

Our History

Arch Capital was formed in September 2000 and became the sole shareholder of Arch Capital Group (U.S.) Inc. (“Arch-U.S.”) pursuant to an internal reorganization transaction completed in November 2000. In October 2001, Arch Capital launched an underwriting initiative to meet current and future demand in the global insurance and reinsurance markets that included the recruitment of new management teams and an equity capital infusion of $763.2 million, which created a strong capital base that was unencumbered by significant pre-2002 risks. Since then, we have attracted a proven management team with extensive industry experience and continued to build our global underwriting platform for our insurance, reinsurance and mortgage insurance businesses.

Our insurance underwriting platform initially consisted of our Bermuda and U.S. operations, followed by the establishment of our United Kingdom-based carrier, Arch Insurance (U.K.) Limited (“Arch Insurance (U.K.)”) in 2004 and Canadian operations in 2005. In 2009, we established a managing agency and syndicate at Lloyd’s of London (“Lloyd’s”) and significantly expanded our U.K. presence in 2019 through the acquisition of Barbican Group Holdings Limited (“Barbican Holdings”) and its subsidiaries (collectively, “Barbican”). Our U.S. platform grew with the 2018 acquisition of McNeil & Company, Inc. (“McNeil”), a U.S. nationwide leader in specialized risk management and program administration. See “Operations—Insurance Operations” for further details on our insurance operations.

Our reinsurance underwriting platform initially consisted of Arch Reinsurance Ltd. in Bermuda (“Arch Re Bermuda”) and Arch Reinsurance Company (“Arch Re U.S.”), our U.S.-licensed reinsurer. Our European reinsurance operations commenced in 2006 in Zurich, Switzerland followed by the formation of a Danish underwriting agency in 2007. In addition to the U.S. reinsurance treaty activities of Arch Re U.S., we launched our property facultative reinsurance underwriting operations in 2007, which underwrite in the U.S., Canada and Europe. In 2008, we formed Arch Reinsurance Europe Designated Activity Company (“Arch Re Europe”), our Ireland-based reinsurance company headquartered in Ireland with offices in Switzerland and the U.K. The acquisition of Barbican in 2019 also contributed to our reinsurance operations. In 2021, Arch Re Bermuda completed the acquisition of Somerset Bridge Group Limited, Southern Rock Holdings Limited and affiliates (“Somerset Group”). The acquisition included Somerset’s Group’s motor insurance managing general agent, distribution capabilities

ARCH CAPITAL			3			2023 FORM 10-K

through direct and aggregator channels, affiliated insurer and fully integrated claims operation. See “Operations—Reinsurance Operations” for further details on our reinsurance operations.

Our mortgage operations include U.S. and international mortgage insurance and reinsurance operations, as well as participation in government sponsored enterprise (“GSE”) credit risk-sharing transactions. The U.S. mortgage platform was established in 2014 and expanded greatly in 2016 through the acquisition of United Guaranty Corporation (“UGC”). Our U.S. primary mortgage operations provide mortgage insurance products and services to the U.S. market. These operations include providers which are also approved as eligible mortgage insurers by Federal National Mortgage Association (“Fannie Mae”) and Federal Home Loan Mortgage Corporation (“Freddie Mac”), each a GSE. The mortgage operations also include participation in GSE credit risk-sharing transactions and direct mortgage insurance to U.S. mortgage lenders with respect to mortgages that lenders intend to retain in portfolio or include in non-agency securitizations along with mortgage insurance and reinsurance on a global basis. The majority of our European business is written through our Ireland-based carrier, Arch Insurance (EU) Designated Activity Company (“Arch Insurance (EU)”), which was authorized in 2011 to provide mortgage insurance products and services to the European and U.K. markets. In 2019, Arch LMI Pty Ltd. (“Arch LMI”) was authorized by the Australian Prudential Regulation Authority (“APRA”) to write lenders’ mortgage insurance on a direct basis in Australia. We expanded our presence in Australia in August 2021 by acquiring Westpac Lenders Mortgage Insurance Limited, another APRA approved writer of lenders’ mortgage insurance, which has since been renamed Arch Lenders Mortgage Indemnity Ltd. (“Arch Indemnity”). In December 2022, we converted Arch LMI into a services company for our Australian LMI operations and the company relinquished its APRA authorization. See “Operations—Mortgage Operations” for further details on our mortgage operations.

It is our belief that our underwriting platform, our experienced management team and our strong capital base have enabled us to establish a strong presence in the markets in which we participate.

In 2014, we acquired approximately 11% of Somers Holdings Ltd. (formerly Watford Holdings Ltd.). Somers Holdings Ltd. is the parent of Somers Re Ltd. (formerly Watford Re Ltd.), a multi-line Bermuda reinsurance company (together with Somers Holdings Ltd., “Somers”). In the 2020 fourth quarter, Arch Capital, Somers, and Greysbridge Ltd., a wholly-owned subsidiary of Arch Capital, entered into an Agreement and Plan of Merger (as amended, the “Merger Agreement”). Arch Capital assigned its rights under the Merger Agreement to Greysbridge Holdings Ltd.

(“Greysbridge”). The merger and the related Greysbridge equity financing closed on July 1, 2021. Somers is wholly owned by Greysbridge, and Greysbridge is owned 40% by Arch, 30% by certain funds managed by Kelso & Company (“Kelso”) and 30% by certain funds managed by Warburg Pincus LLC (“Warburg”). In 2017, we acquired approximately 25% of Premia Holdings Ltd. Premia Holdings Ltd. is the parent of Premia Reinsurance Ltd., a multi-line Bermuda reinsurance company (together with Premia Holdings Ltd., “Premia”). In 2021, a Company completed the share purchase agreement with Natixis, a French financial services firm, to purchase 29.5% of the common equity of Coface SA (“Coface”), a France-based leader in the global trade credit insurance market. See “Operations—Other Operations” for further details on Somers, Premia and Coface.

The Board of Directors of Arch Capital (the “Board”) has authorized the investment in Arch Capital’s common shares through a share repurchase program. Repurchases under the share repurchase program may be effected from time to time in open market or privately negotiated transactions through December 31, 2024. Since the inception of the share repurchase program in February 2007 through December 31, 2023, Arch Capital has repurchased 433.6 million common shares for an aggregate purchase price of $5.9 billion. At December 31, 2023, the total remaining authorization under the share repurchase program was $1.0 billion. The timing and amount of the repurchase transactions under this program will depend on a variety of factors, including results of operations, market conditions and the development of the economy, as well as other factors. We will consider share repurchases on an opportunistic basis. During the 2023 fiscal year, we did not repurchase any shares under our share repurchase program.

OPERATIONS

We classify our businesses into three underwriting segments – insurance, reinsurance and mortgage and two operating segments – corporate and ‘other.’ For an analysis of our underwriting results by segment, see note 4, “Segment Information,” to our consolidated financial statements in Item 8 and “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Results of Operations.”

Insurance Operations

Our insurance operations are conducted in Bermuda, the U.S, the U.K., Europe, Canada, and Australia. Our insurance operations in Bermuda are conducted through Arch Insurance (Bermuda), a division of Arch Re Bermuda, and Alternative Re Limited.

ARCH CAPITAL			4			2023 FORM 10-K

In the U.S., our insurance group’s principal insurance subsidiaries are Arch Insurance Company (“Arch Insurance”), Arch Specialty Insurance Company (“Arch Specialty”), Arch Indemnity Insurance Company (“Arch Indemnity Insurance”) and Arch Property Casualty Insurance Company (“Arch P&C”). Arch Insurance is an admitted insurer in 50 states, the District of Columbia, Puerto Rico, the U.S. Virgin Islands and Guam. Arch Specialty is an approved excess and surplus lines insurer in 50 states, the District of Columbia, Puerto Rico and the U.S. Virgin Islands and an authorized insurer in one state. Arch Indemnity Insurance is an admitted insurer in 50 states and the District of Columbia. Arch P&C, which is not currently writing business, is an admitted insurer in 44 states and the District of Columbia and is filing applications for admission in all remaining states where it is not yet admitted. Our insurance group also operates McNeil, a specialized risk manager and a program administrator based in Cortland, New York. The headquarters for our insurance group’s U.S. support operations (excluding underwriting units) are in Jersey City, New Jersey. The insurance group has offices throughout the U.S., including five regional offices located in Alpharetta, Georgia; Chicago, Illinois; New York, New York; San Francisco, California; Dallas, Texas and additional branch offices.

Our insurance operations in Canada are conducted through Arch Insurance Canada Ltd. (“Arch Insurance Canada”), a Canada domestic company which is authorized in all Canadian provinces and territories. Arch Insurance Canada is headquartered in Toronto, Ontario.

In 2019, Arch Insurance (EU), based in Dublin, Ireland, received authorization from the Central Bank of Ireland (“CBI”) to expand its authorized classes of business as part of our plan to address the U.K.’s departure from the European Union (“Brexit”). At the end of 2020, Arch Insurance (U.K.) received court approval in the U.K. to transfer its legacy book of business written in the European Economic Area (“EEA”) to Arch Insurance (EU) under Part VII of the U.K. Financial Services and Markets Act 2000. From January 2020, all of the insurance business in the European Union (“EU”) previously written by Arch Insurance (U.K.) is now written through Arch Insurance (EU). Arch Insurance (EU) has branches in Italy, France, Spain and the U.K.

We conduct insurance operations on several platforms in the U.K., including Arch Insurance (U.K.) and our Lloyd’s syndicates: Arch Syndicate 2012 (“Arch Syndicate 2012”) and Arch Syndicate 1955 (“Arch Syndicate 1955” and, together with Arch Syndicate 2012, our “Lloyd’s Syndicates”). Arch Managing Agency Limited (“AMAL”) is the managing agent of our Lloyd’s Syndicates. These operations provide us access to Lloyd’s extensive distribution network and worldwide licenses. AMAL also acts as managing agent for third party members of Arch Syndicate

1955. Arch Underwriting at Lloyd’s (Australia) Pty Ltd, based in Sydney, Australia, is a Lloyd’s services company which underwrites exclusively for our Lloyd’s Syndicates. Collectively, the U.K. insurance operations are referred to as “Arch U.K.” Arch U.K. conducts its operations from London and other locations in the U.K. In December 2023, we signed an agreement for the sale of Castel Underwriting Agencies Limited, a managing general agency in the U.K. that we acquired as part of the Barbican acquisition. The sale is expected to close in the first half of 2024, subject to regulatory approvals and other closing conditions.

Strategy. Our insurance group’s strategy is to operate in lines of business in which underwriting expertise can make a meaningful difference in operating results. The insurance group focuses on talent-intensive rather than labor-intensive business and seeks to operate profitably (on both a gross and net basis) across all of its product lines. To achieve these objectives, our insurance group’s operating principles are to:

• Capitalize on profitable underwriting opportunities. Our insurance group believes that its experienced management and underwriting teams are positioned to locate and identify business with attractive risk/reward characteristics. As profitable underwriting opportunities are identified, our insurance group will continue to grow its product portfolio in order to take advantage of market trends. This includes adding underwriting and other professionals with specific expertise in specialty lines of insurance.

• Centralize responsibility for underwriting. Our insurance group consists of a range of product lines. The underwriting executive in charge of each product line oversees all aspects of the underwriting product development process within such product line. Our insurance group believes that centralizing the control of such product line with the respective underwriting executive allows for close management of underwriting and creates clear accountability for results. Our U.S. insurance group has five regional offices, and the executive in charge of each region is primarily responsible for all aspects of the marketing and distribution of our insurance group’s products, including the management of broker and other producer relationships in such executive’s respective region. In our non-U.S. offices, a similar philosophy is observed, with responsibility for the management of each product line residing with the senior underwriting executive in charge of such product line.

• Maintain a disciplined underwriting philosophy. Our insurance group’s underwriting philosophy is to generate an underwriting profit through prudent risk selection and proper pricing. Our insurance group believes that the key to this approach is adherence to uniform underwriting

ARCH CAPITAL			5			2023 FORM 10-K

standards across all types of business. Our insurance group’s senior management closely monitors the underwriting process.

• Focus on providing superior claims management. Our insurance group believes that claims handling is an integral component of credibility in the market for insurance products. We believe our ability to handle claims expeditiously and satisfactorily is a key to our success. Our insurance group employs experienced claims professionals and also utilizes experienced external claims managers (third party administrators) where appropriate.

• Promote and utilize an efficient distribution system. Our insurance group believes that promoting and utilizing a multi-channel distribution system provides efficient access to its broad customer base. We work with select international, national and regional retail and wholesale brokers and leading managing general agencies and program administrators, including McNeil, to distribute our insurance products. The Arch U.K. regional division has a retail distribution network in the U.K.

*•*Grow strategic partnerships or acquire strategic businesses in stable and niche areas. Our insurance group aims to build more integrated long-term alignment with strategic partners offering superior access to niche opportunities, quality scalable businesses, or lines with reliable defensive qualities. We may grow existing partnerships or look to acquire businesses which further this strategy.

Our insurance group writes business in the U.S. on both a U.S. admitted and U.S. non-admitted basis. Our insurance group focuses on various specialty lines, as described in note 4, “Segment Information,” to our consolidated financial statements in Item 8.

Underwriting Philosophy. Our insurance group’s underwriting philosophy is to generate an underwriting profit (on both a gross and net basis) through prudent risk selection and proper pricing across all types of business. One key to this philosophy is the adherence to uniform underwriting standards across each product line that focuses on the following:

• risk selection;

• desired attachment point;

• limits and retention management;

• due diligence, including financial condition, claims history, management, and product, class and territorial exposure;

• underwriting authority and appropriate approvals; and

• collaborative decision making.

Marketing. Our insurance group’s products are marketed principally through a group of licensed independent retail and wholesale brokers. Clients (insureds) are referred to our insurance group through a large number of international, national and regional brokers and captive managers who receive from the insured or insurer a set fee or brokerage commission usually equal to a percentage of gross premiums. Our insurance group may enter into contingent commission arrangements with some brokers that provide for the payment of additional commissions based on volume or profitability of business. Currently, some of our contracts with brokers provide for additional commissions based on volume. It is the practice for the brokers and producers to make the client aware of any contingent commission arrangements that may be in place with us. We have also entered into service agreements with select international brokers that provide access to their proprietary industry analytics. In general, our insurance group has no implied or explicit commitments to accept business from any particular broker and neither brokers nor any other third parties have the authority to bind our insurance group, except in the case where underwriting authority may be delegated contractually to select program administrators. Such administrators are subject to a financial and operational due diligence review prior to any such delegation of authority and ongoing reviews and audits are carried out as deemed necessary by our insurance group to assure the continuing integrity of underwriting and related business operations. See “Risk Factors—Risks Relating to Our Industry, Business and Operations—We could be materially adversely affected to the extent that important third parties with whom we do business do not adequately or appropriately manage their risks, commit fraud or otherwise breach obligations owed to us.” For information on major brokers, see note 18, “Commitments and Contingencies—Concentrations of Credit Risk,” to our consolidated financial statements in Item 8.

Risk Management and Reinsurance. In the normal course of business, our insurance group may cede a portion of its premium on a quota share or excess of loss basis through treaty or facultative reinsurance agreements. Reinsurance arrangements do not relieve our insurance group from its primary obligations to insureds. Reinsurance recoverables are recorded as assets, predicated on the reinsurers’ ability to meet their obligations under the reinsurance agreements. If the reinsurers are unable to satisfy their obligations under the agreements, our insurance subsidiaries would be liable for such defaulted amounts. Our principal insurance subsidiaries, with oversight by a group-wide reinsurance steering committee (“RSC”), are selective with regard to reinsurers, seeking to place reinsurance with only those reinsurers which meet and maintain specific standards of established criteria for financial strength. The RSC evaluates the financial viability of its reinsurers through financial analysis, research and review of rating agencies’ reports and also monitors

ARCH CAPITAL			6			2023 FORM 10-K

reinsurance recoverables and collateral with unauthorized reinsurers. The financial analysis includes ongoing qualitative and quantitative assessments of reinsurers, including a review of the financial stability, appropriate licensing, reputation, claims paying ability and underwriting philosophy of each reinsurer. See note 8, “Reinsurance,” to our consolidated financial statements in Item 8.

For catastrophe-exposed insurance business, our insurance group seeks to limit the amount of exposure to catastrophic losses it assumes through a combination of managing aggregate limits, underwriting guidelines and reinsurance. For a discussion of our risk management policies, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Summary of Critical Accounting Estimates—Ceded Reinsurance” and “Risk Factors—Risks Relating to Our Industry, Business and Operations—The failure of any of the loss limitation methods we employ could have a material adverse effect on our financial condition or results of operations.”

Claims Management. Our insurance group’s claims management function is performed by claims professionals, as well as experienced external claims managers (third party administrators), where appropriate. In addition to investigating, evaluating and resolving claims, members of our insurance group’s claims departments work with underwriting professionals as functional teams in order to develop products and services desired by the group’s clients.

Reinsurance Operations

Our reinsurance operations are conducted on a worldwide basis through our reinsurance subsidiaries, Arch Re Bermuda, Arch Re U.S., Arch Syndicate 2012, Arch Syndicate 1955 and Arch Re Europe. Arch Re Bermuda is dual-licensed as a Class 4 general business insurer and Class C long-term insurer and is headquartered in Hamilton, Bermuda. Arch Re Bermuda has been approved as a “certified reinsurer” in certain U.S. states that allow reduced collateral for reinsurance ceded to such reinsurers. Arch Re Bermuda has also been approved in certain U.S. states as a “reciprocal jurisdiction reinsurer,” which allows ceding companies to eliminate collateral requirements for reinsurance ceded to such reinsurers and still take credit for that reinsurance. Arch Re U.S. is licensed or is an accredited or otherwise approved reinsurer in 50 states, the District of Columbia and Puerto Rico, the provinces of Ontario and Quebec in Canada with its principal U.S. offices in Morristown, New Jersey. Treaty and facultative operations in Canada are conducted through the Canadian branch of Arch Re U.S. (“Arch Re Canada”). Arch Re U.S. is also an admitted insurer in Guam. Our property facultative reinsurance operations are conducted primarily through Arch Re U.S. The property facultative reinsurance operations have offices throughout the U.S., Canada, Europe and the U.K.

Arch Re Europe, licensed and authorized as a non-life reinsurer and a life reinsurer, is headquartered in Dublin, Ireland with branch offices outside the EEA in Zurich and London. AMAL is the managing agent for the reinsurance operations of Arch Syndicate 2012 and Arch Syndicate 1955.

In December 2022, Arch Group Reinsurance Ltd. (“AGRL”) was registered as a Class 3A general business insurer carrying on affiliated reinsurance business pursuant to the Insurance Act of 1978 of Bermuda. AGRL, a wholly-owned subsidiary of Arch-U.S., was established to provide internal quota share reinsurance covering certain U.S. lines of business. AGRL is a U.S. taxpayer through a section 953(d) voluntary election under the Internal Revenue Code of 1986, as amended.

Strategy. Our reinsurance group’s strategy is to capitalize on our financial capacity, experienced management and operational flexibility to offer multiple products through our operations. The reinsurance group’s operating principles are to:

• Actively select and manage risks. Our reinsurance group only underwrites business that meets certain profitability criteria, and it emphasizes disciplined underwriting over premium growth. To this end, our reinsurance group maintains centralized control over reinsurance underwriting guidelines and authorities.

• Maintain flexibility and respond to changing market conditions. Our reinsurance group’s organizational structure and philosophy allows it to take advantage of increases or changes in demand or favorable pricing trends. Our reinsurance group believes that its existing platforms in Bermuda, the U.S., U.K., Europe and Canada, broad underwriting expertise and substantial capital facilitate adjustments to its mix of business geographically and by line and type of coverage. Our reinsurance group believes that this flexibility allows it to participate in those market opportunities that provide the greatest potential for underwriting profitability.

• Maintain a low cost structure. Our reinsurance group believes that maintaining tight control over its staffing level and operating primarily as a broker market reinsurer permits it to maintain low operating costs relative to its capital and premiums.

Our reinsurance group writes business on both a proportional and non-proportional basis and writes both treaty and facultative business. In a proportional reinsurance arrangement (also known as pro rata reinsurance, quota share reinsurance or participating reinsurance), the reinsurer shares a proportional part of the original premiums and losses of the reinsured. The reinsurer pays the cedent a commission which is generally based on the cedent’s cost of acquiring the

ARCH CAPITAL			7			2023 FORM 10-K

business being reinsured (including commissions, premium taxes, assessments and miscellaneous administrative expenses) and may also include a profit factor. Non-proportional (or excess of loss) reinsurance indemnifies the reinsured against all or a specified portion of losses on underlying insurance policies in excess of a specified amount, which is called a “retention.” Non-proportional business is written in layers and a reinsurer or group of reinsurers accepts a band of coverage up to a specified amount. The total coverage purchased by the cedent is referred to as a “program.” Any liability exceeding the upper limit of the program reverts to the cedent.

The reinsurance group’s treaty operations generally seek to write significant lines on less commoditized classes of coverage, such as specialty property and casualty reinsurance treaties. However, with respect to other classes of coverage, such as property catastrophe and casualty clash, the reinsurance group’s treaty operations participate in a relatively large number of treaties where they believe that they can underwrite and process the business efficiently. The reinsurance group’s property facultative operations write reinsurance on a facultative basis whereby they assume part of the risk under primarily single insurance contracts. Facultative reinsurance is typically purchased by ceding companies for individual risks not covered by their reinsurance treaties, for unusual risks or for amounts in excess of the limits on their reinsurance treaties.

For additional information regarding the business written by the reinsurance group, please refer to note 4, “Segment Information,” to our consolidated financial statements in Item 8.

Underwriting Philosophy. Our reinsurance group employs a disciplined, analytical approach to underwriting reinsurance risks that is designed to specify an adequate premium for a given exposure commensurate with the amount of capital it anticipates placing at risk. A number of our reinsurance group’s underwriters are also actuaries. It is our reinsurance group’s belief that employing actuaries on the front-end of the underwriting process gives it an advantage in evaluating risks and constructing a high quality book of business.

As part of the underwriting process, our reinsurance group typically assesses a variety of factors, including:

• adequacy of underlying rates for a specific class of business and territory;

• the reputation of the proposed cedent and the likelihood of establishing a long-term relationship with the cedent, the geographic area in which the cedent does business, together with its catastrophe exposures, and our aggregate exposures in that area;

• historical loss data for the cedent and, where available, for the industry as a whole in the relevant regions, in order to compare the cedent’s historical loss experience to industry averages;

• projections of future loss frequency and severity; and

• the perceived financial strength of the cedent.

Marketing. Our reinsurance group generally markets its reinsurance products through brokers, except our property facultative reinsurance group, which generally deals directly with the ceding companies. Brokers do not have the authority to bind our reinsurance group with respect to reinsurance agreements, nor does our reinsurance group commit in advance to accept any portion of the business that brokers submit to them. Our reinsurance group generally pays brokerage fees to brokers based on negotiated percentages of the premiums written through such brokers. For information on major brokers, see note 18, “Commitments and Contingencies—Concentrations of Credit Risk,” to our consolidated financial statements in Item 8.

Risk Management and Retrocession. Our reinsurance group currently purchases a combination of per event excess of loss, per risk excess of loss, proportional retrocessional agreements and other structures that are available in the market. Such arrangements reduce the effect of individual or aggregate losses on, and in certain cases may also increase the underwriting capacity of, our reinsurance group. Our reinsurance group will continue to evaluate its retrocessional requirements based on its net appetite for risk. See note 8, “Reinsurance,” to our consolidated financial statements in Item 8.

For catastrophe exposed reinsurance business, our reinsurance group seeks to limit the amount of exposure it assumes from any one reinsured and the amount of the aggregate exposure to catastrophe losses from a single event in any one geographic zone. For a discussion of our risk management policies, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Summary of Critical Accounting Estimates—Ceded Reinsurance” and “Risk Factors—Risks Relating to Our Industry, Business and Operations—The failure of any of the loss limitation methods we employ could have a material adverse effect on our financial condition or results of operations.”

Claims Management. Claims management includes the receipt of initial loss reports, creation of claim files, determination of whether further investigation is required, establishment and adjustment of case reserves and payment of claims. Additionally, audits are conducted for both specific claims and overall claims procedures at the offices of selected ceding companies. Our reinsurance group makes use of outside consultants for claims work from time to time.

ARCH CAPITAL			8			2023 FORM 10-K

Mortgage Operations

Our mortgage operations include mortgage insurance and reinsurance in the U.S. and internationally, as well as participation in GSE credit risk-sharing transactions. Our mortgage group includes direct mortgage insurance in the U.S. primarily through Arch Mortgage Insurance Company, United Guaranty Residential Insurance Company, and Arch Mortgage Guaranty Company (together, “Arch MI U.S.”); mortgage reinsurance primarily through Arch Re Bermuda on both a proportional and non-proportional basis globally; mortgage insurance and reinsurance in the EEA and U.K. primarily through Arch Insurance (EU), and in Australia through Arch Indemnity; and participation in various GSE credit risk-sharing products primarily through Arch Re Bermuda.

In 2014, we entered the U.S. mortgage insurance marketplace, underwriting on the Arch Mortgage Insurance Company platform. Arch Mortgage Insurance Company is licensed and operates in all 50 states, the District of Columbia and Puerto Rico. In December 2016, we completed the acquisition of UGC and its primary operating subsidiary, United Guaranty Residential Insurance Company, which is licensed and operates in all 50 states and the District of Columbia. In November 2023, we signed an agreement to acquire RMIC Companies, Inc. and its subsidiaries that together comprise the run-off mortgage insurance business of Old Republic International Corporation. The sale is expected to close in the first half of 2024, subject to regulatory approvals and other closing conditions.

Arch Mortgage Insurance Company and United Guaranty Residential Insurance Company have each been approved as an eligible mortgage insurer by Fannie Mae and Freddie Mac, subject to maintaining certain ongoing requirements (“eligible mortgage insurer”). Arch Mortgage Guaranty Company offers direct mortgage insurance to U.S. mortgage lenders with respect to mortgages that lenders intend to retain in portfolio or include in non-agency securitizations. Arch Mortgage Guaranty Company, which is licensed in all 50 states and the District of Columbia, insures mortgages that are not intended to be sold to the GSEs, and it is therefore not approved by either GSE as an eligible mortgage insurer.

In 2019, Arch LMI was authorized by APRA to write lenders’ mortgage insurance. In August 2021, we acquired Arch Indemnity, which is also authorized by APRA to write lenders’ mortgage insurance. In December 2022, we converted Arch LMI to a services company for our Australian lenders mortgage insurance operations and the company relinquished its APRA authorization. Arch LMI and Arch Indemnity are headquartered in Sydney, Australia. Following the conversion of Arch LMI, Arch Indemnity is the primary provider of direct lenders’ mortgage insurance and reinsurance to the Australian market.

Strategy. The mortgage insurance market operates on a distinct underwriting cycle, with demand driven mainly by the housing market and general economic conditions. As a result, the creation of the mortgage group provides us with a more diverse revenue stream. Our mortgage group’s strategy is to capitalize on its financial capacity, mortgage insurance technology platform, operational flexibility and experienced management to offer mortgage insurance, reinsurance and other risk-sharing products in the U.S. and around the world.

Our mortgage group’s operating principles and goals are to:

• Capitalize on profitable underwriting opportunities. Our mortgage group believes that its experienced management, analytics and underwriting teams are positioned to identify and evaluate business with attractive risk/reward characteristics.

• Maintain a disciplined credit risk philosophy. Our mortgage group’s credit risk philosophy is to generate underwriting profit through disciplined credit risk analysis and proper pricing. Our mortgage group believes that the key to this approach is maintaining discipline across all phases of the applicable housing and mortgage lending cycles.

• Provide superior and innovative mortgage products and services. Our mortgage group believes that it can leverage its financial capacity, experience across insurance product lines and the mortgage finance industry, and its analytics and technology to provide innovative products and superior service. The mortgage group believes that its delivery of tailored products that meet the specific, evolving needs of its customers will be a key to the group’s success.

• Maintain our position as a leading provider of U.S. mortgage insurance business. With the acquisition of UGC in 2016, a leading provider of mortgage insurance products and services to national and regional banks and mortgage originators, we became a leading provider of U.S. mortgage insurance.

• Diversify revenues by capitalizing on international opportunities. With the acquisition of Arch Indemnity in Australia in 2021, and continued growth insuring and reinsuring European banks, we believe diversifying revenues on a global basis is a key operating principle.

Our mortgage group focuses on the following areas:

• Direct mortgage insurance in the United States. Under their monoline insurance licenses, each of Arch’s eligible mortgage insurers may only offer private mortgage insurance covering first lien, one-to-four family residential mortgages. Nearly all of our mortgage insurance written provides first loss protection on loans

ARCH CAPITAL			9			2023 FORM 10-K

originated by mortgage lenders and sold to the GSEs. Each GSE’s Congressional charter generally prohibits it from purchasing a mortgage where the principal balance of the mortgage is in excess of 80% of the value of the property securing the mortgage unless the excess portion of the mortgage is protected against default by lender recourse, participation or by a qualified insurer. As a result, such “high loan-to-value mortgages” purchased by Fannie Mae or Freddie Mac generally are insured with private mortgage insurance.

Mortgage insurance protects the insured lender, investor or GSE against loss in the event of a borrower’s default. If a borrower defaults on mortgage payments, private mortgage insurance reduces, and may eliminate, losses to the insured. Private mortgage insurance may also facilitate the sale of mortgage loans in the secondary mortgage market because of the credit enhancement it provides. Our primary U.S. mortgage insurance policies predominantly cover individual loans and are effective at the time the loan is originated. We also may enter into insurance transactions with lenders and investors, under which we insure a portfolio of loans at or after origination. Although not currently a significant product, we may offer mortgage insurance on a “pool” basis in the future. Under pool insurance, the mortgage insurer provides coverage on a group of specified loans, typically for 100% of all contractual or policy-defined losses on every loan in the portfolio, subject to an agreed aggregate loss limit. Pool insurance may be in a first loss position with respect to loans that do not have primary mortgage insurance policies, or it may be in a second loss position, covering losses in excess of those covered by the primary mortgage insurance policy.

• Mortgage insurance and reinsurance in Europe and other countries where we identify profitable underwriting opportunities. Since 2011, Arch Insurance (EU) has offered mortgage insurance to European mortgage lenders in order to reduce lenders’ credit risk and regulatory capital requirements associated with the insured mortgages. In certain European countries, lenders purchase mortgage insurance to facilitate regulatory compliance with respect to high loan-to-value residential lending. Arch Insurance (EU) offers mortgage insurance on both a “flow” basis to cover new originations and through structured transactions to cover one or more portfolios of previously originated residential loans. Increasingly, Arch Insurance (EU) and Arch Re Bermuda are providing protection to European banks on structured capital relief transactions. In Australia, Arch Indemnity provides lenders’ mortgage insurance on a flow basis to cover new originations and offers coverage through structured transactions to cover one or more portfolios of previously originated residential loans.

• Reinsurance. Arch Re Bermuda provides quota share and excess of loss reinsurance covering U.S. and international mortgages.

• Other credit risk-sharing products. In addition to providing traditional mortgage insurance and reinsurance, we offer various credit risk-sharing products to government agencies and mortgage lenders. The GSEs have reduced their exposure to mortgage risk by shifting a portion of it to the private sector, creating opportunities for insurers to assume additional mortgage risk. In 2013, Arch Re Bermuda became the first (re)insurance company to participate in Freddie Mac’s program to transfer certain credit risk in its single-family portfolio to the private sector. Since that time, Arch Re Bermuda and its affiliates have regularly participated in both Fannie Mae and Freddie Mac single family and multifamily risk sharing programs.

In 2019, we established Arch Credit Risk Services (Bermuda) Ltd. (“Arch CRS”). Arch CRS is licensed by the Bermuda Monetary Authority (“BMA”) as an insurance agent in Bermuda. Arch CRS offers mortgage credit assessment and underwriting advisory services with respect to participation in GSE credit risk transfer transactions.

Underwriting Philosophy. Our mortgage group believes in a disciplined, analytical approach to underwriting mortgage risks by utilizing proprietary and third party models, including forecasting delinquency and future home price movements with the goal of ensuring that premiums are adequate for the risk being insured. Experienced actuaries and statistical modelers are engaged in analytics to inform the underwriting process. As part of the underwriting process, our mortgage group typically assesses a variety of factors, including the:

• ability and willingness of the mortgage borrower to pay its obligations under the mortgage loan being insured;

• characteristics of the mortgage loan being insured and the value of the collateral securing the mortgage loan;

• financial strength, quality of operations and reputation of the lender originating the mortgage loan;

• home price trends and expected future home price movements which vary by geography;

• projections of future loss frequency and severity; and

• adequacy of premium rates.

ARCH CAPITAL			10			2023 FORM 10-K

Sales and Distribution. In the U.S., we employ a sales force to directly sell mortgage insurance products and services to our customers, which include mortgage originators such as mortgage bankers, mortgage brokers, commercial banks, savings institutions, credit unions and community banks. Our largest single mortgage insurance customer in the U.S. (including branches and affiliates) accounted for 7.3% and 7.1% of our gross premiums written for the years ending December 31, 2023 and 2022, respectively. No other customer accounted for greater than 2.9% and 2.8% of the gross premiums written for the years ending December 31, 2023 and 2022, respectively. The percentage of gross premiums written on our top 10 customers was 24.6% and 23.6% as of December 31, 2023 and 2022, respectively. In Europe, Bermuda and Australia, our products and services are distributed on a direct basis and through brokers. Each country represents a unique set of opportunities and challenges that require knowledge of market conditions and client needs to develop effective solutions.

Risk Management. Exposure to mortgage risk is monitored globally and managed through underwriting guidelines, pricing, reinsurance, utilization of proprietary risk models, concentration limits and limits on net probable loss resulting from a severe economic downturn in the housing market. Exposure to climate risk has also been incorporated into the risk management framework of our mortgage group to monitor and manage our exposure to potential (i) losses related to the direct physical impact of extreme weather conditions or events in certain transactions; and/or (ii) adverse economic or housing market conditions caused by the physical impact of extreme weather conditions or events on a region or the financial impact of transitioning to a zero or low carbon economy on a region. Generally, mortgage insurance policies exclude direct physical losses resulting from physical damages, such as damaged caused by extreme weather events, though we do have some exposure to physical damage in certain GSE credit risk transfer (“CRT”) transactions. Additionally, we actively monitor developments in the housing market, financial regulation and public policy in the geographies where our mortgage group operates to facilitate implementation of laws, regulations and policies which support sustainable environmental behavior and mitigate the effects of climate change. For a discussion of our risk management policies, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Summary of Critical Accounting Estimates—Ceded Reinsurance” and “Risk Factors—Risks Relating to Our Industry, Business and Operations—The failure of any of the loss limitation methods we employ could have a material adverse effect on our financial condition or results of operations.”

Our mortgage group has ceded a portion of its premium on a quota share basis through certain reinsurance agreements and through aggregate excess of loss reinsurance agreements which provide reinsurance coverage for delinquencies on portfolios of in-force policies issued between certain periods. See note 8, “Reinsurance,” to our consolidated financial statements in Item 8 for further details.

Reinsurance arrangements do not relieve our mortgage group from its primary obligations to insured parties. Reinsurance recoverables are recorded as assets, predicated on the reinsurers’ ability to meet their obligations under the reinsurance agreements. If the reinsurers are unable to satisfy their obligations under the agreements, our mortgage subsidiaries would be liable for such defaulted amounts. For our U.S. mortgage insurance business, in addition to utilizing reinsurance, we have developed a proprietary risk model that simulates the maximum loss resulting from severe economic events impacting the housing market. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Catastrophic Events and Severe Economic Events.”

Claims Management. With respect to our direct mortgage insurance business, the claims process generally begins with notification by the insured or servicer to us of a default on an insured loan. The insured is generally required to notify us of a default after the borrower misses two consecutive monthly payments. Borrowers default for a variety of reasons, including a reduction of income, unemployment, divorce, illness, inability to manage credit, rising interest rate levels and declining home prices. Upon notice of a default, in certain cases we may coordinate with loan servicers to facilitate and enhance retention workouts on insured loans. Retention workouts include payment deferral or forbearance, loan modifications and other loan repayment options, which may enable borrowers to cure mortgage defaults and retain ownership of their homes. If a retention workout is not viable for a borrower, our loss on a loan may be mitigated through a liquidation workout option, including a pre-foreclosure sale or a deed-in-lieu of foreclosure.

In the U.S., our master policies generally provide that within 60 days of the perfection of a primary insurance claim, we have the option of:

• paying the insurance coverage percentage specified in the certificate of insurance multiplied by the loss amount;

• in the event the property is sold pursuant to an approved prearranged sale, paying the lesser of (i) 100% of the loss amount less the proceeds of sale of the property, or (ii) the specified coverage percentage multiplied by the loss amount; or

ARCH CAPITAL			11			2023 FORM 10-K

• paying 100% of the loss amount in exchange for the insured’s conveyance to us of good and marketable title to the property, with us then selling the property for our own account.

While we select the claim settlement option that best mitigates the amount of our claim payment, in the U.S. we generally pay the coverage percentage multiplied by the loss amount.

Other Operations

In 2014, we and HPS Investment Partners, LLC (formerly Highbridge Principal Strategies, LLC) (“HPS”) sponsored the formation of Somers. Arch Re Bermuda invested $100.0 million in Somers common equity. Somers’ strategy is to combine a diversified reinsurance and insurance business with a disciplined investment strategy. Somers’ own management and board of directors are responsible for its results and profitability. Arch Re Bermuda has appointed three directors to serve on the seven person board of directors of Somers. In the 2020 fourth quarter, Arch Capital, Somers and Greysbridge, a wholly-owned subsidiary of Arch Capital, entered into a Merger Agreement pursuant to which, among other things, Arch Capital agreed to acquire all of the common shares of Somers not owned by Arch for a cash purchase price of $35.00 per common share. Arch Capital has assigned its rights under the Merger Agreement to Greysbridge. The merger and the related Greysbridge equity financing closed on July 1, 2021. Effective July 1, 2021, Somers is wholly owned by Greysbridge, and Greysbridge is owned 40% by Arch, 30% by certain investment funds managed by Kelso and 30% by certain investment funds managed by Warburg. See note 12, “Variable Interest Entity and Noncontrolling Interests,” to our consolidated financial statements in Item 8 for further details.

In 2017, we and Kelso sponsored the formation of Premia. Premia’s strategy is to reinsure or acquire companies or reserve portfolios in the non-life property and casualty insurance and reinsurance run-off market. Arch Re Bermuda and certain Arch co-investors invested $100.0 million and acquired approximately 25% of Premia as well as warrants to purchase additional common equity. Arch Re Bermuda is providing a quota share reinsurance treaty on certain business written by Premia, and subsidiaries of Arch Capital are providing certain administrative and support services to Premia, in each case pursuant to separate multi-year agreements. Arch has appointed two directors to serve on the seven person board of directors of Premia.

In 2021, the Company completed the share purchase agreement with Natixis to purchase 29.5% of the common equity of Coface. This is a long-term, strategic investment in Coface, and fits with Arch’s efforts to develop uncorrelated sources of underwriting income. Our companies share a focus

on specialty underwriting where knowledge and expertise create value for our clients, and trade credit contributes to Arch’s specialty-driven business model. Arch has appointed four directors to serve on the ten person board of directors of Coface.

Climate Change Considerations

We are taking steps to address the effects of climate change and facilitate the transition toward decarbonization in all our underwriting segments. We seek to identify business opportunities associated with environmentally friendly trends and incentivize responsible environmental behaviors. We have adopted a thermal coal policy and provide environmentally sustainable insurance solutions in certain product lines.

HUMAN CAPITAL

We are driven by our common purpose of “Enabling Possibility” for our customers, our communities and our employees. This purpose is supported by our collaborative, results-driven culture which relies on our dedicated, engaged and talented people. By continuously working to offer a meaningful and inclusive employee experience, we not only seek to help people perform at their best among colleagues who care, but also aim to support our strategy of delivering specialty products and innovative solutions to our customers in each of our business segments. As of February 16, 2024, we had just over 6,400 employees globally, compared to around 5,800 last year, which directly speaks to our ability to sustain our strong and unique culture as we grow, which is a key enabler to top talent retention. We have approximately 3,600 employees in North America (U.S., Canada and Bermuda), 1,700 employees in Europe and the U.K. and 1,200 employees in the Philippines, Australia and the rest of the world.

Our People and Culture. An important part of our culture is sustaining an inclusive, diverse workforce. By better reflecting the demographics in the markets in which we operate while also actively seeking to instill norms for inclusive behavior, we aim to leverage all the best contributions and thinking across our Company. To that end, we are committed to further integrating diversity and inclusion principles in our operations. In addition to “embedding” inclusion into our talent processes, e.g., promotion reviews, over 700 employees (mostly managers) have attended our intensive, six-week Fostering Inclusive Leadership program. Importantly, this program requires participants to complete a business-related project as well as attend group discussions, where participants focus on how to apply inclusive techniques into the work experience. Finally, in 2023 our six employee networks provided a forum for over 1,300 employees to share ideas, build community and

ARCH CAPITAL			12			2023 FORM 10-K

belonging, provide leadership opportunities for members and contribute meaningfully to business outcomes. Importantly, our networks include significant ally representation, which underscores the inclusive behavior of our people.

Talent Acquisition, Development, Rewards and Retention. Our employees are integral to the company, and we maintain a sharp focus on improving the ways we attract, develop and retain our high-performing talent. Our goal is to cultivate a workplace culture where all our employees can thrive by building awareness of inclusive practices and incorporating them into our regular course of business. In 2023, we launched a new talent acquisition model that modernizes our approach to the talent market and maximizes our ability to find and hire top talent across multiple talent pools and proactively source pipelines of key talent. In addition, the new model has streamlined this process across our Company by using a common platform that we can easily scale as we grow.

We provide career growth opportunities through a combination of on-the-job training and experience, exposure to top-notch colleagues who coach and mentor, and education and training programs designed to accelerate learning and applying new skills and behaviors. We offer competitive compensation and comprehensive benefits packages, including an employee share purchase plan, parental leave, contributions to retirement savings plans and programs to support employee mental and physical well-being. We recognize the financial burden of educational loans in the United States and have supported our employees with a student debt assistance program. Since the inception of the program in 2018, Arch has contributed approximately $5 million to this program, including $0.9 million in 2023. We also match eligible contributions to qualified charitable organizations and employees are offered two paid volunteer time-off days per calendar year with an eligible non-profit organization. Our Arch Achieve program has recognized over 500 employees for excellence since its inception in 2009, and each recipient is awarded a cash bonus to recognize their accomplishments.

In 2023, our senior leadership team met in person to discuss our strategy and vision for the future, foster continuous learning and a growth mindset for leaders and provide a forum for global executives to network across the Company.

To ease the impact on those most affected by inflation, effective in 2023, Arch introduced a salary-based premium structure for medical plans for U.S. based employees to help keep health care costs equitable and affordable. More than 65% of employees had reductions in medical premiums for the same plan and coverage tier.

We also encourage employees to continue their educational and professional development through tuition reimbursement

plans. To attract the best talent to our industry, we offer internship programs and an Early Career Program with an Underwriting Track which provides participants with a robust introduction and real technical skills to build a successful career at Arch. As part of our talent attraction, we have targeted programs aimed at diversifying our workforce. Experienced professionals at Arch may participate in manager and leadership development programs and, for our mortgage insurance segment employees, we offer the opportunity to seek a Mortgage Bankers Association Certified Banker designation.

RESERVES

Reserves for losses and loss adjustment expenses (“Loss Reserves”) represent estimates of what the insurer or reinsurer ultimately expects to pay on claims at a given time, based on facts and circumstances then known, and it is probable that the ultimate liability may exceed or be less than such estimates. Even actuarially sound methods can lead to subsequent adjustments to reserves that are both significant and irregular due to the nature of the risks written. Loss Reserves are inherently subject to uncertainty.

For detail on our Loss Reserves by segment and potential variability in the reserving process, see the Loss Reserves section of “Summary of Critical Accounting Estimates” in Item 7. For an analysis of losses and loss adjustment expenses and a reconciliation of the beginning and ending Loss Reserves and information about prior year reserve development, see note 5, “Reserve for Losses and Loss Adjustment Expenses,” to our consolidated financial statements in Item 8. For information on our reserving process, see note 6, “Short Duration Contracts,” to our consolidated financial statements in Item 8.

Unpaid and paid losses and loss adjustment expenses recoverable were approximately $7.1 billion at December 31, 2023. For detail on our unpaid and paid losses and loss adjustment expenses, see the Reinsurance Recoverables section of “Financial Condition, Reinsurance Recoverables” in Item 7.

ARCH CAPITAL			13			2023 FORM 10-K

INVESTMENTS

At December 31, 2023, total investable assets held by Arch were $34.6 billion. Our current investment guidelines and approach stress preservation of capital, market liquidity and diversification of risk. Our investments are subject to market-wide risks and fluctuations, as well as to risks inherent in particular securities. While maintaining our emphasis on preservation of capital and liquidity, we expect our portfolio to grow and, in the future, may expand into areas that are not part of our current investment strategy. For detail on our investments, see the Investable Assets Held by Arch section of “Financial Condition” in Item 7 and note 9, “Investment Information,” to our consolidated financial statements in Item 8.

RATINGS

Our ability to underwrite business is affected by the quality of our claims paying ability and financial strength ratings as evaluated by independent agencies. Such ratings from third party internationally recognized statistical rating organizations or agencies are instrumental in establishing the financial security of companies in our industry. We believe that the primary users of such ratings include commercial and investment banks, policyholders, brokers, ceding companies and investors. Insurance ratings are also used by insurance and reinsurance intermediaries as an important means of assessing the financial strength and quality of insurers and reinsurers, and are often an important factor in the decision by an insured or intermediary of whether to place business with a particular insurance or reinsurance provider.

The financial strength ratings of our operating insurance and reinsurance subsidiaries are subject to periodic review as rating agencies evaluate us to confirm that we continue to meet their criteria for ratings they have assigned to us. Such ratings may be revised or revoked at the discretion of such ratings agencies in response to a variety of factors, including capital adequacy, management, earnings, forms of capitalization and risk profile. A.M. Best Company (“A.M. Best”), Fitch Ratings (“Fitch”), Moody’s Investors Service (“Moody’s”) and Standard & Poor’s (“S&P”) are ratings agencies which have assigned financial strength and/or issuer ratings to Arch Capital and/or one or more of its subsidiaries.

The ratings issued on our companies by these agencies are announced publicly and are available directly from the agencies. Our website www.archgroup.com (Investor Relations-Credit Ratings) contains information about our ratings, but such information on our website is not incorporated by reference into this report.

COMPETITION

The worldwide insurance markets are highly competitive. We compete with major U.S. and non-U.S. insurers and reinsurers, some of which have greater financial, marketing and management resources and longer-term relationships with insureds and brokers than us. We compete primarily on the basis of overall financial strength, ratings assigned by independent rating agencies, geographic scope of business, strength of client relationships, premiums charged, contract terms and conditions, products and services offered, speed of claims payment, reputation, employee experience, and qualifications and local presence. See “Risk Factors—Risks Relating to Our Industry, Business and Operations—“We operate in a highly competitive environment, and we may not be able to compete successfully in our industry.”

In our property casualty insurance and reinsurance businesses, we compete with insurers and reinsurers that provide specialty property and casualty lines of insurance, including, but not limited to Allianz, American Financial Group, Inc., American International Group, Inc., Aviva, AXA XL, AXIS Capital Holdings Limited, Berkshire Hathaway, Inc., Chubb Limited, CNA Financial Corp., Convex Group Limited, Everest Group Ltd., Fairfax Financial Holdings Limited, Hannover Rück SE, The Hartford Financial Services Group, Inc., Liberty Mutual Group, Lloyd’s, Markel Corporation, Munich Re Group, PartnerRe Ltd., RenaissanceRe Holdings Ltd., RLI Corp., SCOR, Sompo International, Swiss Reinsurance Company, Tokio Marine, The Travelers Companies, Inc., W.R. Berkley Corp. and Zurich Insurance Group.

In our mortgage business, we compete with insurers and reinsurers that provide mortgage insurance, including the U.S mortgage insurance subsidiaries of Essent Group Ltd., Enact Holdings Inc., MGIC Investment Corporation, NMI Holdings Inc. and Radian Group Inc. The private mortgage insurance industry is highly competitive. Private mortgage insurers generally compete on the basis of underwriting guidelines, pricing, terms and conditions, financial strength, product and service offerings, customer relationships, reputation, the strength of management, technology, and innovation in the delivery and servicing of insurance products. Arch MI U.S. and other private mortgage insurers compete with federal and state government agencies that sponsor their own mortgage insurance programs. The private mortgage insurers’ principal government competitor is the Federal Housing Administration (“FHA”) and, to a lesser degree, the U.S. Department of Veterans Affairs (“VA”). Future changes to the FHA program, including any reduction to premiums charged, may impact the demand for private mortgage insurance.

ARCH CAPITAL			14			2023 FORM 10-K

In addition, Arch MI U.S. and other private mortgage insurers increasingly compete with multi-line reinsurers and capital markets alternatives to private mortgage insurance. The GSEs continued their respective mortgage CRT programs, including the use of front and back-end transactions with multi-line reinsurers, with approximately 25 unique (re)insurers that regularly participate in transactions in addition to funded credit investors. These transactions continue to create opportunities for multi-line property casualty reinsurance groups and capital markets participants.

In our non-U.S. mortgage insurance businesses, we compete with insurance subsidiaries of Helia Group Ltd. and QBE Insurance Group, Ltd. in Australia; in Europe, our competitors on structured capital relief transactions include approximately 5-10 highly rated multi-line (re)insurers in addition to over 30 funded credit investors.

ENTERPRISE RISK MANAGEMENT

General. Enterprise Risk Management (“ERM”) is a key element in our philosophy, strategy and culture. We employ an ERM framework that includes underwriting, reserving, investment, credit, group and operational risks. Risk appetite and exposure limits are set by our executive management team, reviewed with the Board and its committees and routinely discussed with business unit management. These limits are articulated in our risk appetite statement, which details risk appetite, tolerances and limits for each major risk category, and are integrated into our operating guidelines. Exposures are aggregated and monitored periodically by our corporate risk management team. The reporting, review and approval of risk management information is integrated into our annual planning process, capital modeling and allocation, and reinsurance purchasing strategy. Such information is reviewed at insurance business reviews, reinsurance underwriting meetings and board level committees.

Risk Management Process and Procedures. The following narrative provides an overview of our risk management framework and our methodology for identifying, measuring, managing and reporting on the key risks affecting us. It outlines our approach to risk identification and assessment and provides an overview of our risk appetite and tolerance for each of the following major risks: underwriting (insurance) risk including pricing, reserving and catastrophe; investment risk including market and liquidity risks; group risk including strategic, governance, rating agency and capital market risk; credit risk; and operational risk including regulatory, investor relations (reputational risk) and outsourcing risks. We view environmental, social and governance (“ESG”) related risks not as standalone risks but as an integral part of our enterprise-wide risk management strategy. Consequently, evaluations of these risks are embedded throughout our risk management framework.

The framework includes details of our risk philosophy and policies to address the material risks confronting us and the approach and procedures to control and or mitigate these risks. The actions and policies implemented to meet our business management and regulatory obligations form the core of this framework. We have adopted a holistic approach to risk management by analyzing risk from both a top-down and bottom-up perspective.

Risk Identification and Assessment. The Finance, Investment and Risk Committee (“FIR Committee”), Audit Committee and Underwriting Oversight Committee of the Board oversee the top-down and bottom-up review of our risks. Given the nature and scale of our operations, these committees consider all aforementioned risks within the scope of the assessment. Arch Capital’s Chief Risk Officer (“CRO”) assists these committees in the identification and assessment of all key risks. The CRO is responsible for maintaining Arch Capital’s risk register and continually reviewing and challenging risk assessments, including the impact of emerging risks and significant business developments. Any new high-level risks or changes in inherent or residual designations are brought to the Board’s or the relevant committee’s attention.

Risk Monitoring and Control. Arch Capital’s risk management framework requires risk owners to monitor key risks on a continuous basis. The highest residual risks are actively managed by the Board and relevant committees. The remaining risks are managed and monitored at a process level by the risk owners and/or the CRO. Risk owners have ultimate responsibility for the day-to-day management of each designated risk, reporting to the CRO on the satisfactory management and control of the risk and timely escalation of significant issues that may arise in relation to that risk. The CRO is responsible for overseeing the monitoring of all risks across the business and for communicating to the relevant risk owners if she becomes aware of issues, or potential and actual breaches of risk appetite, relevant to the assigned risks. A key element of these monitoring activities is the periodic evaluation of our position relative to risk tolerances and limits approved by the Board.

Risk Reporting. Quarterly, the CRO compiles the results of the key risk review process into a report to the Board and relevant committees for review and discussion at their next meeting. The report includes an overview of selected key risks; a risk dashboard that depicts the status of risk limit and tolerance metrics; changes in the rating of high-level risks in the Arch Capital risk register; and summaries of our largest exposures and reinsurance recoverables. If necessary, risk management matters reviewed at the committee meetings are presented for discussion by the Board. The CRO is responsible for immediately escalating any significant risk matters to executive management, the respective Board Committee and/or the Board for approval of the required remediation. As part of our corporate governance, the Board

ARCH CAPITAL			15			2023 FORM 10-K

and certain of its committees hold regular executive sessions with members of our management team. These sessions are intended to ensure an open and frank dialogue exists about various forms of risk across the organization.

Implementation and Integration. We believe that an integrated approach to developing, measuring and reporting our Own Risk and Solvency Assessment (“ORSA”) is an important part of the risk management framework. The ORSA process provides the link between Arch Capital’s risk profile, its board-approved risk appetite including approved risk tolerances and limits, its business strategy and its overall solvency requirements. The ORSA is the entirety of the processes and procedures employed to identify, assess, monitor, manage, and report the short and long-term risks we face or may face and to determine the capital necessary to ensure that our overall solvency needs are met at all times. The ORSA also makes the link between actual reported results and the capital assessment.

The ORSA is the basis for risk reporting to the Board and its committees and acts as a mechanism to embed the risk management framework within our decision making processes and operations. The Board has delegated responsibility for supervision and oversight of the ORSA to the FIR Committee. This oversight includes regular reviews of the ORSA process and output. An ORSA report is produced at least annually, and the results of each assessment are reported to the Board. The Board actively participates in the ORSA process by steering how the assessment is performed and challenging its results. This assessment is also taken into account when formulating strategic decisions.

The ORSA process and reporting are also important parts of our business strategy, tailored specifically to fit into our organizational structure and risk management system with the appropriate techniques in place to assess our overall solvency needs, taking into consideration the nature, scale and complexity of the risks inherent in the business.

We also take the results of the ORSA into account within our system of governance, including long-term capital management, business planning and new product development. The results of the ORSA also contribute to various elements of our strategic decision-making including how best to optimize capital management, establish the most appropriate premium levels and decide whether to retain or transfer risks.

For further discussion of our risk management policies, see the Ceded Reinsurance section of “Summary of Critical Accounting Estimates” in Item 7.

REGULATION

General

Our insurance and reinsurance subsidiaries are subject to varying degrees of regulation and supervision in the various jurisdictions in which they operate. We are subject to extensive regulation under applicable statutes in these countries and any other jurisdictions in which we operate. The current material regulations under which we operate are described below. We may become subject in the future to regulation in new jurisdictions or to additional regulations in existing jurisdictions.

Bermuda

General. Our main Bermuda insurance operating subsidiary, Arch Re Bermuda, is a Class 4 general business insurer and a Class C long-term insurer and is subject to the Insurance Act 1978 of Bermuda and related regulations, as amended (“Insurance Act”). Among other matters, the Insurance Act imposes certain solvency and liquidity standards, auditing and reporting requirements, the submission of certain period examinations of its financial conditions and grants the BMA powers to supervise, investigate, require information and demand the production of documents and intervene in the affairs of insurance companies. Significant requirements include the appointment of an independent auditor, the appointment of a loss reserve specialist, the appointment of a principal representative in Bermuda, the filing of annual Statutory Financial Returns, the filing of annual financial statements in accordance with U.S. generally accepted accounting principles (“GAAP”), the filing of an annual capital and solvency return, compliance with minimum and enhanced capital requirements, compliance with certain restrictions on reductions of capital and the payment of dividends and distributions, compliance with group solvency and supervision rules, if applicable, and compliance with the Insurance Code of Conduct (relating to corporate governance, risk management and internal controls).

Arch Re Bermuda must also comply with a minimum liquidity ratio and minimum solvency margin in respect of its general business. The minimum liquidity ratio requires that the value of relevant assets must not be less than 75% of the amount of relevant liabilities. The minimum solvency margin, which varies depending on the class of the insurer, is determined as a percentage of either net reserves for losses and loss adjustment expenses (“LAE”) or premiums or pursuant to a risk-based capital measure. Arch Re Bermuda is also subject to an enhanced capital requirement (“ECR”) which is established by reference to either the Bermuda Solvency Capital Requirement model (“BSCR”) or an approved internal capital model. The BSCR model is a risk-based capital model which provides a method for determining an insurer’s capital requirements (statutory capital and

ARCH CAPITAL			16			2023 FORM 10-K

surplus) by taking into account the risk characteristics of different aspects of the insurer’s business. The BMA has established a target capital level for each Class 4 insurer equal to 120% of its ECR. While a Class 4 insurer is not currently required to maintain its available statutory economic capital and surplus at this level, the target capital level serves as an early warning tool for the BMA, and failure to maintain statutory capital at least equal to the target capital level will likely result in increased regulatory oversight. As a Class C insurer, Arch Re Bermuda is also required to maintain available statutory economic capital and surplus in respect of its long-term business at a level equal to or in excess of its long-term enhanced capital requirement that is established by reference to either the Class C BSCR model or an approved internal capital model.

Arch Re Bermuda is prohibited from declaring or paying any dividends during any financial year if it is in breach of its general business or long-term business enhanced capital requirements, minimum solvency margins or its general business minimum liquidity ratio or if the declaration or payment of such dividends would cause such a breach. If it has failed to meet its minimum solvency margins or minimum liquidity ratio on the last day of any financial year, Arch Re Bermuda will be prohibited, without the approval of the BMA, from declaring or paying any dividends during the next financial year. In addition, Arch Re Bermuda is prohibited from declaring or paying in any financial year dividends of more than 25% of its total statutory capital and surplus (as shown on its previous financial year’s statutory balance sheet) unless it files (at least seven days before payment of such dividends) with the BMA an affidavit stating that it will continue to meet the required margins. Without the approval of the BMA, Arch Re Bermuda is prohibited from reducing by 15% or more its total statutory capital as set out in its previous year’s financial statements and any application for such approval must include an affidavit stating that it will continue to meet the required margins. Where such an affidavit is filed, it shall be available for public inspection at the offices of the BMA. Under the Bermuda Companies Act of 1981, as amended (the “Companies Act”), Arch Re Bermuda may declare or pay a dividend out of distributable reserves only if it has reasonable grounds for believing that it is, or would after the payment be, able to pay its liabilities as they become due and if the realizable value of its assets would thereby not be less than its liabilities.

Policyholder Priority. The Insurance Amendment (No. 2) Act 2018 amended the Insurance Act to provide for the prior payment of policyholders’ liabilities ahead of general unsecured creditors in the event of the liquidation or winding up of an insurer. The amendments provide inter alia that, subject to certain statutorily preferred debts, the insurance debts of an insurer must be paid in priority to all other unsecured debts of the insurer. Insurance debt is defined as a

debt to which an insurer is or may become liable pursuant to an insurance contract excluding debts owed to an insurer under an insurance contract where the insurer is the person insured.

Group Supervision. The BMA acts as group supervisor of our group of insurance and reinsurance companies (“Group”) and has designated Arch Re Bermuda as the designated insurer (“Designated Insurer”). As our Group supervisor, the BMA performs a number of functions including: (i) coordinating the gathering and dissemination of relevant or essential information for going concerns and emergency situations, including the dissemination of information which is of importance for the supervisory task of other competent authorities; (ii) carrying out supervisory reviews and assessments of our Group; (iii) carrying out assessments of our Group's compliance with the rules on solvency, risk concentration, intra-group transactions and good governance procedures; (iv) planning and coordinating through regular meetings held at least annually (or by other appropriate means) with other competent authorities, supervisory activities in respect of our Group; both as a going concern and in emergency situations (v) coordinating any enforcement action that may need to be taken against our Group or any Group members; and (vi) planning and coordinating meetings of colleges of supervisors in order to facilitate the carrying out of these functions. As Designated Insurer, Arch Re Bermuda is required to facilitate compliance by our Group with the group insurance solvency and supervision rules.

On an annual basis, the Group is required to file Group statutory financial statements, a Group statutory financial return, a Group capital and solvency return, audited Group financial statements, a Group Solvency Self-Assessment (“GSSA”), and a financial condition report with the BMA. The GSSA is designed to document our perspective on the capital resources necessary to achieve our business strategies and remain solvent, and to provide the BMA with insights on our risk management, governance procedures and documentation related to this process. In addition, the Designated Insurer is required to file quarterly group financial returns with the BMA. The Group is also required to maintain available Group statutory economic capital and surplus in an amount that is at least equal to the group enhanced capital requirement (“Group ECR”) and the BMA has established a group target capital level equal to 120% of the Group ECR.

Fit and Proper Controllers. The BMA maintains supervision over the controllers of all Bermuda registered insurers, brokers, agents and insurance marketplace providers. For so long as the shares of Arch Capital are listed on the Nasdaq or another recognized stock exchange, any person who, directly or indirectly, becomes a holder of at least 10%, 20%, 33% or 50% of our common shares must notify the BMA in writing

ARCH CAPITAL			17			2023 FORM 10-K

within 45 days of becoming such a holder (or ceasing to be such a holder). The BMA may object to such a person and require the holder to reduce its holding of common shares and direct, among other things, that voting rights attaching to the common shares shall not be exercisable.

Economic Substance Act. In December 2018, Bermuda enacted the Economic Substance Act 2018 (as amended) of Bermuda and its related regulations (together, the “ES Act”). The ES Act came into force on January 1, 2019, and provides that a registered entity other than an entity which is resident for tax purposes in certain jurisdictions outside Bermuda (“non-resident entity”) that carries on as a business any one or more of the “relevant activities” referred to in the ES Act must comply with economic substance requirements. The list of “relevant activities” includes carrying on any one or more of the following activities: banking, insurance, fund management, financing, leasing, headquarters, shipping, distribution and service center, intellectual property and holding entities. Under the ES Act, if a company is engaged in one or more “relevant activities”, it is required to maintain a substantial economic presence in Bermuda and to comply with the economic substance requirements set forth in the ES Act. A company will comply with those economic substance requirements if it: (a) is managed and directed in Bermuda; (b) undertakes “core income generating activities” (as may be prescribed under the ES Act) in Bermuda in respect of the relevant activity; (c) maintains adequate physical presence in Bermuda; (d) has adequate full time employees in Bermuda with suitable qualifications; and (e) incurs adequate operating expenditure in Bermuda in relation to the relevant activity undertaken by it.

Companies that are licensed under the Insurance Act and thereby carry on insurance as a relevant activity are generally considered to operate in Bermuda with adequate substance if they comply with the existing provisions of (a) the Companies Act relating to corporate governance; and (b) the Insurance Act, that are applicable to the economic substance requirements, and the Registrar will have regard to such companies’ compliance in his assessment of compliance with the economic substance requirements. That being said, such companies are still required to complete and file a Declaration Form, with the Bermuda Registrar of Companies and the Registrar will also have regard to the information provided in that Declaration Form in making his assessment of compliance with the ES Act.

Insurance Sector Operational Cyber Risk Management Code of Conduct (“Cyber Risk Management Code of Conduct”). The BMA recognized that cyber incidents can cause significant financial losses and/or reputational impacts across the insurance industry and implemented the Cyber Risk Management Code of Conduct in October 2020. All Bermuda insurers, insurance managers and intermediaries registered under the Insurance Act are required to comply with the

BMA’s Cyber Risk Management Code of Conduct, which established duties, requirements and standards to be complied by each registrant in relation to operational cyber risk management. This requires Arch Re Bermuda to develop a cyber risk policy, which is to be delivered pursuant to an operational cyber risk management program and appoint an appropriately qualified member of staff or outsourced resource to the role of Chief Information Security Officer. The role of the Chief Information Security Officer is to deliver the operational cyber risk management program.

It is expected that the cyber risk policy will be approved by the Arch Re Bermuda board of directors at least annually. The BMA will assess Arch Re Bermuda’s compliance with the Cyber Risk Management Code of Conduct in a proportionate manner relative to the nature, scale and complexity of its business. Failure to comply with the requirements of the Cyber Risk Management Code of Conduct will be taken into account by the BMA in determining whether Arch Re Bermuda is conducting its business in a sound and prudent manner as prescribed by the Insurance Act and may result in the BMA exercising its powers of intervention and investigation.

Notification of Cyber Reporting Events. Every Bermuda insurer is required to notify the BMA forthwith on it coming to the knowledge of the insurer, or where the insurer has reason to believe that a Cyber Reporting Event has occurred. Within fourteen (14) days of such notification, the insurer must also furnish the BMA with a written report setting out all of the particulars of the Cyber Reporting Event that are available to it. A Cyber Reporting Event includes any act that results in the unauthorized access to, disruption, or misuse of electronic systems or information stored on such systems of an insurer, including breach of security leading to the loss or unlawful destruction or unauthorized disclosure of or access to such systems or information where there is a likelihood of an adverse impact to policyholders, clients or the insurer’s insurance business, or an event that has occurred for which notice is required to be provided to a regulatory body or government agency.

Personal Information Protection Act 2016. Bermuda’s principal data protection and privacy legislation is the Personal Information Protection Act 2016 (“PIPA”). At present, the majority of the operative provisions of PIPA, which include detailed requirements around conditions for use and consent to use of personal information, specific obligations on organizations that use personal information, overseas data transfer assessment obligations and access, rectification and erasure rights for individuals, are not yet in force in Bermuda. In June 2023, the Bermuda Government and the Office of the Privacy Commissioner for Bermuda announced that the remaining operative provisions of PIPA will become fully implemented on January 1, 2025.

ARCH CAPITAL			18			2023 FORM 10-K

PIPA (once in force) applies to every organization (which includes any individual, entity or public authority) that uses personal information in Bermuda where that personal information is used by automated or other means which form,

or are intended to form, part of a structured filing system. For

the purposes of PIPA, “personal information” means any information about an identified or identifiable individual (meaning a natural person), and “use” or “using” are very broadly defined and effectively include possessing or carrying out any operation on personal information. Many of our Bermuda subsidiaries which use and hold personal information will be in scope and must comply with the provisions of PIPA.

Corporate Income Tax Act 2023 (the “Bermuda CIT Act”). On December 27, 2023, Bermuda enacted the Bermuda CIT Act. Entities subject to tax under the Bermuda CIT Act are the Bermuda constituent entities of multi-national groups. A multi-national group is defined under the Bermuda CIT Act as a group with entities in more than one jurisdiction with consolidated revenues of at least €750 million for two of the four previous fiscal years. If Bermuda constituent entities of a multi-national group are subject to tax under the Bermuda CIT Act, such tax is charged at a rate of 15% of the net income of such constituent entities (as determined in accordance with the Bermuda CIT Act, including after adjusting for any relevant foreign tax credits applicable to the Bermuda constituent entities). Although the commencement date of the Bermuda CIT Act is January 1, 2024, no tax is chargeable under the Bermuda CIT Act until tax years starting on or after January 1, 2025. All Arch Bermuda operations are subject to the requirements of the Bermuda CIT Act.

United States

General. Our U.S. based insurance operating subsidiaries are subject to extensive governmental regulation and supervision by the states and jurisdictions in which they are domiciled, licensed and/or approved to conduct business. The insurance laws and regulations of the state of domicile have the most significant impact on operations. We currently have U.S. insurance and/or reinsurance subsidiaries domiciled in Delaware, North Carolina, Missouri, Wisconsin, Kansas and the District of Columbia and we may acquire insurers domiciled in other states in the future. State insurance regulation and supervision is designed to protect policyholders rather than investors. Generally, state regulatory authorities have broad regulatory powers over such matters as licenses, standards of solvency, premium rates, policy forms, marketing practices, claims practices, investments, methods of accounting, form and content of financial statements, certain aspects of governance, ERM, amounts we are required to hold as reserves for future payments, minimum capital and surplus requirements, annual and other report filings and transactions among affiliates. Our

U.S. based subsidiaries are required to file detailed quarterly and audited annual statutory financial statements with state insurance regulators. In addition, regulatory authorities conduct periodic financial, claims and market conduct examinations. Certain insurance regulatory requirements are highlighted below. In addition to regulation applicable generally to U.S. insurance and reinsurance companies, our U.S. mortgage insurance operations are affected by federal and state regulation relating to mortgage insurers, mortgage lenders, and the origination, purchase and sale of residential mortgages. Arch Insurance (U.K.) is also subject to certain governmental regulation and supervision in the states where it writes excess and surplus lines insurance.

Holding Company Regulation. All states have enacted legislation that regulates insurance holding company systems. These regulations generally provide that each insurance company in the system is required to register with the insurance department of its state of domicile and furnish information concerning the operations of companies within the holding company system which may materially affect the operations, management or financial condition of the insurers within the system. Notice to the state insurance departments is required prior to the consummation of certain material transactions between an insurer and any entity in its holding company system and certain transactions may not be consummated without the applicable insurance department’s prior approval or non-disapproval after receiving notice. The holding company acts also prohibit any person from directly or indirectly acquiring control of a U.S. insurance or reinsurance company unless that person has filed an application with specified information with such company’s domiciliary commissioner and has obtained the commissioner’s prior approval. Under most states’ statutes acquiring 10% or more of the voting securities of an insurance company or its parent company is presumptively considered an acquisition of control of the insurance company, although such presumption may be rebutted.

State holding company acts and regulations also impose extensive informational requirements on parents and other affiliates of licensed insurers or reinsurers with the purpose of protecting them from enterprise risk, including requiring an annual enterprise risk report by the ultimate controlling person identifying the material risks within the insurance holding company system that could pose enterprise risk to the licensed companies and requiring a person divesting its controlling interest to make a confidential advance notice filing.

The National Association of Insurance Commissioners (“NAIC”) Insurance Holding Company System Model Act and Model Regulation includes provisions that, when adopted by states, will require the ultimate controlling person of an insurance holding company system to file an annual group capital calculation, unless the ultimate controlling

ARCH CAPITAL			19			2023 FORM 10-K

person or its insurance holding company system is exempt from the filing requirement. Arch’s U.S. lead state regulator, the Missouri Department of Commerce & Insurance, adopted the model group capital calculation provisions in 2021. The group capital calculation is designed to assist state insurance regulators in understanding the financial condition of non-insurance entities that are part of an insurance holding company system and the degree to which insurance companies are supporting those non-insurance entities.

Regulation of Dividends and Other Payments from Insurance Subsidiaries. The ability of an insurer to pay dividends or make other distributions is subject to insurance regulatory limitations of the insurer’s state of domicile. Such laws generally limit the payment of dividends or other distributions above a specified level. Dividends or other distributions in excess of such thresholds are “extraordinary” and are subject to prior notice and approval, or non-disapproval after receiving notice.

Credit for Reinsurance. Arch Re U.S. is subject to insurance regulation and supervision that is similar to the regulation of licensed primary insurers. However, except for certain mandated provisions that must be included in order for a ceding company to obtain credit for reinsurance ceded, the terms and conditions of reinsurance agreements generally are not subject to regulation by any governmental authority.

A U.S. primary insurer ordinarily will enter into a reinsurance agreement only if it is able to obtain credit for the reinsurance ceded on its U.S. statutory-basis financial statements. As a result of the requirements relating to the provision of credit for reinsurance, Arch Re U.S., Arch Re Bermuda and AGRL are indirectly subject to certain regulatory requirements imposed by U.S. jurisdictions in which ceding companies are domiciled. In general, credit for reinsurance is allowed if the reinsurer is licensed or “accredited” in the state in which the primary insurer is domiciled; or if none of the above applies, to the extent that the reinsurance obligations of the reinsurer are collateralized appropriately, typically through the posting of a letter of credit for the benefit of the primary insurer or the deposit of assets into a trust fund established for the benefit of the primary insurer.

U.S. primary insurers also may receive credit for reinsurance ceded to unauthorized reinsurers without collateral or with less than 100% collateral under revisions to the NAIC Credit for Reinsurance Model Law (#785) and the Credit for Reinsurance Model Regulation (#786) (collectively, the “NAIC Model Law and Regulation”). All U.S. states, the District of Columbia and Puerto Rico have adopted revisions to the NAIC Model Law and Regulation that allow full credit to U.S. ceding insurers for reinsurance ceded to reinsurers that have been approved as “certified reinsurers” based upon less than 100% collateralization. As of January 23, 2024,

Arch Re Bermuda is approved as a “certified reinsurer” for the 2024 calendar year in 44 states with applications pending in 8 additional states and territories. In addition, 2019 amendments to the NAIC Model Law and Regulation eliminate reinsurance collateral requirements for reinsurers that (1) have their head office or are domiciled in EU Member States, the U.K., NAIC accredited U.S. jurisdictions and other jurisdictions deemed “reciprocal jurisdictions” by the NAIC (although individual states may approve or reject the designation of such other jurisdictions as a “reciprocal jurisdiction”), and (2) have been approved as a “reciprocal jurisdiction reinsurer.” The NAIC list of approved reciprocal jurisdictions includes Bermuda, Japan and Switzerland. All U.S. states, the District of Columbia and Puerto Rico have adopted the 2019 amendments to the NAIC Model Law and Regulation. As of January 23, 2024, Arch Re Bermuda is approved as a “reciprocal jurisdiction reinsurer” for the 2024 calendar year in 44 states with applications pending in 8 additional states and territories. In addition, AGRL received approval as a “reciprocal jurisdiction reinsurer” from its lead state of Missouri in November 2023, which is effective for the 2023 calendar year. AGRL intends to seek renewal of its “reciprocal jurisdiction reinsurer” status from Missouri in 2024 and will potentially seek approval from additional states.

Risk Management and ORSA. The NAIC Risk Management and Own Risk Solvency Assessment Model Act (“ORSA Model Act”) provides that domestic insurers, or their insurance group, must regularly conduct an ORSA consistent with a process comparable to the ORSA Guidance Manual process. The ORSA Model Act also provides that, no more than once a year, an insurer’s domiciliary regulator may request that an insurer submit an ORSA summary report, or any combination of reports that together contain the information described in the ORSA Guidance Manual, with respect to the insurer and/or the insurance group of which it is a member. States may impose additional internal review and regulatory filing requirements on licensed insurers and their parent companies. All states have enacted the ORSA Model Act or substantially similar legislation.

Cybersecurity and Privacy. In July 2023, the SEC adopted new cybersecurity disclosure rules (“SEC Cybersecurity Rules”) mandating cybersecurity incident and risk management disclosure for public companies such as Arch. The SEC Cybersecurity Rules became effective in December 2023 and mandate that public companies report a cybersecurity incident on a Form 8-K within four days after they determine that the incident is material. Additional disclosure by registrants in the Form 10-K annual report should describe their processes for assessing, identifying and managing material risks from cybersecurity threats, the material impacts of cybersecurity threats and previous cybersecurity incidents. See Item 1C, “Cybersecurity” for further information about our disclosures.

ARCH CAPITAL			20			2023 FORM 10-K

In March 2022, the U.S. government passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which will require companies deemed to be part of U.S. critical infrastructure to report any substantial cybersecurity incidents or ransom payments to the federal government within 72 and 24 hours, respectively. The Cybersecurity & Infrastructure Security Agency considers financial services, which includes insurance companies, as a critical infrastructure sector. The implementing regulations are not expected for another one-to-two years.

In September 2022, the Federal Insurance Office (“FIO”) within the Department of Treasury requested public comment on potential federal insurance responses to catastrophic cyber incidents affecting critical infrastructure. In July 2023, the Biden Administration published a National Cybersecurity Strategy Implementation Plan that includes as a strategic objective the exploration of a federal cyber insurance backstop and identified FIO as the responsible agency for assessing the need for and possible structures of a federal insurance response. In November 2023, the FIO announced initiatives to further study the development of a federal insurance backstop for catastrophic cyber events.

The NAIC adopted an Insurance Data Security Model Law in 2017 that requires insurers, insurance producers and other entities required to be licensed under state insurance laws to comply with certain requirements under state insurance laws, such as developing and maintaining a written information security program, conducting risk assessments overseeing the data security practices of third party service providers and meeting expanded breach notification requirements. This model law has been adopted in states in which our U.S. subsidiaries are licensed and operate. In addition, certain state insurance regulators are developing or have developed regulations that may impose regulatory requirements relating to cybersecurity on insurance and reinsurance companies (potentially including insurance and reinsurance companies that are not domiciled, but are licensed, in the relevant state). Many regulators, including the Federal Trade Commission (“FTC”), the New York Department of Financial Services (“NYDFS”), and the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), have issued new guidance on managing cybersecurity risks (or amended existing regulations) that expand existing regulatory requirements.

Privacy legislation and regulation has also become an issue of increasing focus in many states. The California Consumer Privacy Act of 2018 (“CCPA”), which went into effect January 1, 2020 grants California consumers certain rights to, among other things, access and delete data about them subject to certain exceptions, as well as a private right of action related to cybersecurity breaches with statutory penalties. Additionally, the California Privacy Rights Act of 2020 (“CPRA”) which became fully effective on January 1,

2023, applies to some of our data collecting and processing activities, and it provides for additional consumer privacy rights, and additional regulatory obligations over certain data. It also created a new privacy focused California regulatory agency with enforcement authority, the California Privacy Protection Agency (“CPPA”). CPPA regulations that implement the CPRA became effective on March 29, 2023 and, as delayed by a state court decision, are expected to become enforceable in February 2024. Rulemaking is also underway on regulations mandated by the CPRA governing cybersecurity audits, risk assessments, and automated decision-making, but additional regulations have yet to be proposed. The CPPA draft rules govern consumer notice, access, and opt-out rights with respect to automated decision-making. Under the draft rules, businesses would also have to make significant disclosures about their implementation of automated decision-making. At the CPPA December board meeting, the board requested the CPPA staff to further evaluate the draft regulations, particularly its impact within the workplace and in the employment context.

A range of new cybersecurity and privacy laws are also under consideration in other states, as well as by the federal government. Several states, including Colorado, Connecticut, Utah, and Virginia adopted new comprehensive data privacy legislation that went into effect in 2023. Additional states, including Delaware, Florida, Iowa, Montana, New Jersey, Oregon, Tennessee, and Texas, adopted new data privacy legislation that will go into effect over the next two years (with a new Indiana data privacy law to take effect in 2026). While these state laws provide consumer privacy rights and protections like those in the CCPA and CPRA, they exempt entities subject to the Gramm-Leach-Bliley Act from their requirements.

Artificial Intelligence. The increased use of automated processes by insurers, including algorithms, artificial intelligence (generative and predictive) (“AI”) and predictive models that make use of large datasets and data analytics, has led to additional regulatory attention to insurer practices including in relation to risk selection, pricing and claims, as well as governance and oversight of AI and predictive models.

In late 2023, the NAIC adopted a model bulletin entitled “Use of Artificial Intelligence Systems by Insurers” that sets forth state insurance regulators’ expectations on how insurers should govern the use of advanced analytical and computational technologies used to make or support decisions impacting consumers. Such expectations include implementation of a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices, which program should be designed to mitigate certain risks. As of February 1, 2024, only one state has adopted the bulletin, but we expect it to be

ARCH CAPITAL			21			2023 FORM 10-K

adopted in states in which our U.S. subsidiaries are licensed and operate.

In addition, state agencies, departments and insurance regulators, including the California Department of Insurance, California Privacy Protection Agency, Connecticut Insurance Department, New York Department of Consumer and Work Protection and NYDFS, have adopted, proposed or released for comment laws, regulations and guidance that may impose regulatory requirements relating to the use of AI and automated decision-making on insurance and reinsurance companies. Such requirements include (or may include) risk management processes and controls, governance frameworks, vendor oversight and outcomes testing that may hinder or delay the implementation of new technologies available to other businesses.

In addition to insurance specific AI regulation there are many general AI proposals and frameworks. For example, President Biden’s Executive Order 14110 on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, issued on October 30, 2023 establishes extensive new standards for AI safety and security.

Globally, many new AI laws are being proposed, the most significant of which may be in the EU. See “Regulation—Europe” for further details on our insurance operations.

Risk-Based Capital Requirements. Licensed U.S. property and casualty insurance and reinsurance companies are subject to risk-based capital requirements that are designed to assess capital adequacy and to raise the level of protection that statutory surplus provides for policyholder obligations. The risk-based capital model for property and casualty insurance companies measures three major areas of risk facing property and casualty insurers: underwriting, which encompasses the risk of adverse loss developments and inadequate pricing; declines in asset values arising from credit risk; and declines in asset values arising from investment risks. An insurer will be subject to varying degrees of regulatory action depending on how its statutory surplus compares to its risk-based capital calculation. Under the approved formula, an insurer’s total adjusted capital is compared to its authorized control level risk-based capital. If this ratio is above a minimum threshold, no company or regulatory action is necessary. Below this threshold are four distinct action levels at which an insurer’s domiciliary state regulator can intervene with increasing degrees of authority over an insurer as the ratio of surplus to risk-based capital requirement decreases. The mildest regulatory action requires an insurer to submit a plan for corrective action; the most severe requires an insurer to be rehabilitated or liquidated.

Our mortgage insurance operations are not currently subject to state risk-based capital requirements, but rather are subject to state risk to capital or minimum policyholder position

requirements. The NAIC adopted a revised Mortgage Guaranty Insurance Model Act in 2023. It is uncertain when or if it will be adopted in any jurisdiction.

Guaranty Funds. Most states require all admitted insurance companies to participate in their respective guaranty funds which cover certain claims against insolvent insurers. Solvent insurers licensed in these states are required to cover the losses paid on behalf of insolvent insurers by the guaranty funds and are generally subject to annual assessments in the states by the guaranty funds to cover these losses. Mortgage guaranty insurance, among other lines of business, is typically exempt from participation in guaranty funds.

Climate Change and Financial Risks. U.S. state insurance regulators have increased their oversight of insurance company governance, reporting and disclosure relating to the potential risks presented by climate change and one or more states may adopt climate-change-related requirements that impact our insurance and reinsurance companies. In 2020, NYDFS issued a circular letter stating that NYDFS expects insurers authorized in New York to integrate the consideration of climate risks into their governance frameworks, risk management processes and business strategies, including the designation of a board committee or member and senior management function to be accountable for the company’s assessment and management of the financial risks from climate change. In 2021, NYDFS issued additional guidance for New York Domestic Insurers on Managing the Financial Risks from Climate Change that reiterates many of the principles outlined in the 2020 circular letter. New York and other states also require licensed insurers with countrywide premium written of at least $100 million to annually provide disclosure of their assessment and management of climate related risks.

In November 2023, the FIO published a request to proceed with a climate-related data call that would collect five years of homeowners’ insurance underwriting data to evaluate the relationship between underwriting trends and weather-related events. Separately, in December 2023, the NAIC outlined plans for its own substantially similar climate-related data. The FIO and NAIC climate-related information gathering could culminate in recommendations for new federal or state legislation.

Other Federal Regulation. Although state regulation is the dominant form of regulation for insurance and reinsurance business, a number of federal laws affect and apply to the insurance industry. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank”) created the FIO, which is not a federal regulator or supervisor of insurance, but monitors the insurance industry for systemic risk, administers the Terrorism Risk Insurance Program (“TRIP”), consults with the states regarding insurance matters, develops federal policy on aspects of international

ARCH CAPITAL			22			2023 FORM 10-K

insurance matters, and is authorized to assist the U.S. Secretary of the Treasury in negotiating “covered agreements” between the U.S. and foreign governments that address insurance prudential measures.

In addition to provisions of Dodd-Frank pertaining to underwriting mortgages and a consumer’s ability to repay, certain other federal laws also directly or indirectly impact mortgage insurers, including the Real Estate Settlement Procedures Act of 1974, the Homeowners Protection Act of 1998, the Equal Credit Opportunity Act, the Fair Housing Act, the Truth In Lending Act, the Fair Credit Reporting Act of 1970, and the Fair Debt Collection Practices Act. Among other things, these laws and their implementing regulations prohibit payments for referrals of settlement service business, require fairness and non-discrimination in granting or facilitating the granting of credit, govern the circumstances under which companies may obtain and use consumer credit information, define the manner in which companies may pursue collection activities, and require disclosures of the cost of credit and provide for other consumer protections.

GSE Eligible Mortgage Insurer Requirements. GSEs impose requirements on private mortgage insurers so that they may be eligible to insure loans sold to the GSEs, known as the Private Mortgage Insurer Eligibility Requirements (“PMIERs”). The PMIERs apply to our eligible mortgage insurers, but do not apply to Arch Mortgage Guaranty Company, which is not GSE-approved. The PMIERs impose limitations on the type of risk insured, the forms and insurance policies issued, standards for the geographic and customer diversification of risk, procedures for claims handling, acceptable underwriting practices, standards for certain reinsurance cessions and financial requirements, among other things. The financial requirements require an eligible mortgage insurer’s available assets to meet or exceed “minimum required assets” as of each quarter end. Minimum required assets are calculated from PMIERs tables with several risk dimensions including origination year, original loan-to-value, original credit score of performing loans, and the delinquency status of non-performing loans.

Russian Sanctions. The U.S. first imposed sanctions on the Russian Federation following its annexation of Crimea in 2014. Since February 2022, the U.S. has imposed additional sanctions on Russia in response to the Russian invasion of Ukraine and the ongoing hostilities. Given the evolving situation, we are closely monitoring developments and the sanctions imposed, to ensure our business remains in compliance with any applicable sanctions measures imposed.

Canada

Arch Insurance Canada and Arch Re Canada are subject to federal, as well as provincial and territorial, regulation in Canada in the provinces and territories in which they underwrite insurance/reinsurance. The Office of the Superintendent of Financial Institutions (“OSFI”) is the federal regulatory body that, under the Insurance Companies Act (Canada), prudentially regulates federal Canadian and non-Canadian insurance and reinsurance companies operating in Canada. Arch Insurance Canada is licensed to carry on insurance business by OSFI and in each province and territory. Arch Re Canada is licensed to carry on reinsurance business by OSFI and in the provinces of Ontario and Quebec.

Under the Insurance Companies Act (Canada), Arch Insurance Canada is required to maintain an adequate amount of capital in Canada, calculated in accordance with a test promulgated by OSFI called the Minimum Capital Test, and Arch Re Canada is required to maintain an adequate margin of assets over liabilities in Canada, calculated in accordance with a test promulgated by OSFI called the Branch Adequacy of Assets Test. OSFI has implemented a risk-based methodology for assessing insurance/reinsurance companies operating in Canada known as its “Supervisory Framework.” In applying the Supervisory Framework, OSFI considers the inherent risks of the business and the quality of risk management for each significant activity of each operating entity. Under the Insurance Companies Act (Canada), approval of the Minister of Finance (Canada) is required in connection with certain acquisitions of shares of, or control of, Canadian insurance companies such as Arch Insurance Canada, and notice to and/or approval of OSFI is required in connection with the payment of dividends by or redemption of shares by Canadian insurance companies such as Arch Insurance Canada.

United Kingdom

General. The Prudential Regulation Authority (“PRA”) and the Financial Conduct Authority (“FCA”) regulate insurance and reinsurance companies and the FCA regulates firms carrying on insurance distribution activities operating in the U.K. under the Financial Services and Markets Act 2000 (the “FSMA”). In May 2004, Arch Insurance (U.K.) was granted the relevant permissions for the classes of insurance business which it underwrites in the U.K. AMAL currently manages Arch Syndicate 2012 and Arch Syndicate 1955 pursuant to its authorizations by the U.K. regulators and Lloyd’s. All U.K. companies are also subject to a range of statutory provisions, including the laws and regulations of the Companies Act 2006 (as amended) (the “U.K. Companies Act”).

ARCH CAPITAL			23			2023 FORM 10-K

The objectives of the PRA are to promote the safety and soundness of all firms it supervises and to secure an appropriate degree of protection for policyholders. The objectives of the FCA are to ensure customers receive financial services and products that meet their needs, to promote sound financial systems and markets and to ensure that firms are stable and resilient with transparent pricing information and which compete effectively and have the interests of their customers and the integrity of the market at the heart of how they run their business. Following the implementation of the Financial Services and Markets Act 2023 (“FSMA 2023”), the PRA and the FCA have a new secondary objective to facilitate the international competitiveness of the U.K. economy and its medium to long-term growth, subject to aligning with relevant international standards.

The PRA has responsibility for the prudential regulation of banks and insurers, while the FCA has responsibility for the conduct of business regulation in the wholesale and retail markets. The PRA and the FCA adopt separate methods of assessing regulated firms on a periodic basis. Arch Insurance (U.K.) and AMAL are subject to periodic assessment by the PRA along with all regulated firms. Arch Insurance (U.K.) and AMAL are subject to regulation by both the PRA and FCA. Castel is authorized and regulated by the FCA and is subject to periodic assessment and review by the FCA.

Lloyd’s Supervision. The operations of AMAL (as managing agent of Arch Syndicate 2012 and Arch Syndicate 1955) and each syndicate’s respective corporate members, are subject to the byelaws and regulations made by (or on behalf of) the Council of Lloyd’s, and requirements made under those byelaws. The Council of Lloyd’s, established in 1982 by Lloyd’s Act 1982, has overall responsibility and control of Lloyd’s. Those byelaws, regulations and requirements provide a framework for the regulation of the Lloyd’s market, including specifying conditions in relation to underwriting and claims operations of Lloyd’s participants. The Council of Lloyd’s has discretionary powers to regulate corporate members’ underwriting at Lloyd’s. Lloyd’s is also subject to the provisions of the FSMA. Lloyd's is authorized by the PRA and regulated by the PRA and FCA. Those entities acting within the Lloyd’s market are required to comply with the requirements of the FSMA and provisions of the PRA’s or FCA's rules, although the PRA has delegated certain of its powers, including some of those relating to prudential requirements, to Lloyd’s. Each corporate member of Lloyd’s is required to contribute a percentage of the member’s premium income for each year of account to the Lloyd’s central fund. The Lloyd’s central fund is available if members of Lloyd’s assets are not sufficient to meet claims for which the member is liable. Each corporate member of Lloyd’s may also be required to contribute to the central fund by way of a supplement to a callable layer of up to 5% of the

corresponding member’s premium income limit for the relevant year of account.

Principles for doing business at Lloyd’s (the “Principles”) replaced the Lloyd’s Minimum Standards (the previous regime which set out the Lloyd’s regulatory requirements for Lloyd’s managing agents) and became effective from the third quarter of 2022. The Principles set out the fundamental responsibilities expected of all managing agents, including AMAL, and is the basis against which Lloyd’s will review and categorize all syndicates and managing agents in terms of their capacity and performance. While offering greater flexibility, the principles-based oversight requires greater reliance on AMAL to interpret and apply the rules.

Financial Resources. The European solvency framework and prudential regime for insurers and reinsurers, the Solvency II Directive 2009/138/EC (“Solvency II”), took effect in full on January 1, 2016. See “European Union—Insurance and Reinsurance Regulatory Regime” below for additional details.

Arch Insurance (U.K.), and the corporate members of Arch Syndicate 2012 and Arch Syndicate 1955 are currently required to meet economic risk-based solvency requirements imposed under Solvency II. Solvency II, together with European Commission “delegated acts” and guidance issued by the European Insurance and Occupational Pensions Authority (“EIOPA”) sets out classification and eligibility requirements, including the features which capital must display in order to qualify as regulatory capital.

On January 31, 2020, the U.K. withdrew from the EU with the terms of Brexit set forth in the Withdrawal Agreement agreed by the U.K. Parliament and the EU Parliament. At the expiration of the transition period from January 31, 2020 until December 31, 2020 (the “Transition Period”), during which time the U.K. remained in the EU customs union and single market, the European Union (Withdrawal) Act 2018, as amended, has transposed all applicable direct EU legislation into domestic U.K. law, thus ensuring the continuing application of Solvency II under the U.K.’s financial services regulatory regime.

In November 2022, HM Treasury set out the U.K. government’s final reform package on the Solvency II framework in the U.K., in response to an earlier consultation paper from April 2022. Significant changes to be introduced by these reforms included the reduction in risk margin by 30% for non-life insurers and the proposal to remove branch capital requirements. This will benefit branches of foreign insurers based in the U.K. immediately upon implementation, as well as reduce barriers for foreign insurers wishing to establish a U.K. branch in the future. The U.K. government has also decided to introduce a new mobilization scheme for insurers which would create an optional stage in a

ARCH CAPITAL			24			2023 FORM 10-K

prospective insurer’s entry to the market, including adjusted entry requirements such as a lower capital floor, lower expectations for key personnel and governance structures, and exemptions from certain reporting requirements.

FSMA 2023 provides a framework for the revocation of retained EU law in financial services and its replacement with corresponding regulators’ rules (in the case of Solvency II, mainly in the PRA’s Rulebook). Since the Transition Period, Solvency II has been subject to a major review in its application in the U.K., corresponding with a parallel review in the EU (known as the 2020 review).

The Insurance and Reinsurance Undertakings (Prudential Requirements) Regulations 2023 came into force on December 31, 2023 and modified the current risk margin calculation. The PRA has also issued two consultations covering the Solvency II reform proposals for insurers. It is expected that the reforms forming part of what will then be known as “Solvency U.K.”, will be in place by the end of 2024.

The implementation of these reforms by the U.K. government and potential divergence between the U.K. and the EU may have an impact on whether the U.K. is granted Solvency II equivalence status by the EU in any of the three areas to which equivalence applies.

Financial Services Compensation Scheme. The Financial Services Compensation Scheme (“FSCS”) is a scheme established under FSMA to compensate eligible policyholders of insurance companies who may become insolvent. The FSCS is funded by the levies that it has the power to impose on all insurers. Arch Insurance (U.K.) could be required to pay levies to the FSCS.

Restrictions on Acquisition of Control. Under FSMA, the prior consent of the PRA or FCA, as applicable, is required, before any person can become a controller or increase its control over any regulated company, including Arch Insurance (U.K.), or over the parent undertaking of any regulated company. Therefore, the PRA's or FCA's prior consent, as applicable, is required before any person can become a controller of Arch Capital. Prior consent is also required from Lloyd’s before any person can become a controller or increase its control over a corporate member or a managing agent or a parent undertaking of a corporate member or managing agent. A controller is defined for these purposes as a person who holds (either alone or in concert with others) 10% or more of the shares or voting power in the relevant company or its parent undertaking.

Restrictions on Payment of Dividends. Under English law, all companies are restricted from declaring a dividend to their shareholders unless they have “profits available for distribution.” The calculation as to whether a company has

sufficient profits is based on its accumulated realized profits minus its accumulated realized losses. U.K. insurance regulatory laws do not prohibit the payment of dividends, but the PRA or FCA, as applicable, requires that insurance companies, insurance intermediaries and other regulated entities maintain certain solvency margins and may restrict the payment of a dividend by Arch Insurance (U.K.) or AMAL, for example.

European Union Considerations. During the Transition Period, there was no change in passporting rights for financial institutions in the U.K. Under our Brexit plan, since January 2020 nearly all of the EEA insurance business of Arch Insurance (U.K.) has been conducted by Arch Insurance (EU). As part of our Brexit planning, and in advance of the Transition Period expiring, a transfer of the EEA legacy business (excluding inwards reinsurance) from Arch Insurance (U.K.) to Arch Insurance (EU) was completed under Part VII of the U.K. Financial Services and Market Act 2000 at the end of December 2020 (“Part VII Transfer”).

Despite the loss of passporting rights, AMAL, Syndicate 2012 and Syndicate 1955 are still able to write business in the EEA via the Lloyd’s Insurance Company, S.A. (“Lloyd’s Brussels”). Lloyd’s continued to engage in discussions with the Belgium Financial Services Markets Authority (“Belgium FSMA”) and the National Bank of Belgium regarding the Lloyd’s Brussels operating model and the activities performed for it by managing agents and the question of whether it is possible that they could be construed as constituent insurance distribution under the Insurance Distribution Directive (Directive (EU) 2016/97) (“IDD”), which would therefore require them to be authorized within the EEA.

Economic relations between the U.K. and the EU are now governed by a Trade and Cooperation Agreement (the “TCA”). Following a report published by the European Affairs Committee in June 2022, which found that the TCA is limited in scope and silent as to EU equivalence in decisions over financial services, a Memorandum of Understanding (“MoU”) on regulatory cooperation between the U.K. and the EU was signed in June 2023. However, the MoU does not impose binding substantive commitments nor is there any mention of taking forward the commitment in the Political Declaration accompanying the TCA regarding mutual equivalence. As a result, under the provisions of the TCA, EEA financial institutions (including our Irish operating subsidiaries) lost their passporting rights into the U.K. Absent any future agreement between the U.K. and the EU on the provision of financial services into the U.K., the post-Brexit status and rules applicable to U.K. branches of EEA financial institutions will be primarily driven by U.K. law and regulation.

ARCH CAPITAL			25			2023 FORM 10-K

The ability of U.K. firms (including, Arch Insurance (U.K.) and AMAL) to continue doing business in the EEA similarly depends on applicable EEA state local law and regulation. There has been no decision yet made by the European Commission on whether or not the U.K.’s financial services regulatory regime will be granted third-country equivalence for the purposes of reinsurance, solvency calculation and/or group supervision under Solvency II. In the absence of such declarations, U.K. firms are subject to more stringent requirements in carrying out reinsurance business with EEA firms. See “Risk Factors—Risks Relating to Our Industry, Business and Operations—New legislation or regulations relating to the U.K.’s withdrawal from the EU could adversely affect us.”

ESG Considerations. The U.K. government has a long-term ambition to “green” the financial system and align it with the U.K.’s 2050 “Net Zero” target (i.e.,100% greenhouse gas emissions reduction) under the Climate Change Act 2008. As part of those efforts, on January 17, 2022, the U.K. passed mandatory climate related financial disclosure requirements under the Companies (Strategic Report) (Climate-related Financial Disclosure) Regulations 2022. The regulations apply to large companies (including some of our U.K. entities) for financial years starting on or after April 6, 2022. The regulations generally align risk disclosures with the recommendations of the Taskforce on Climate-related Financial Disclosures (“TCFD”).

In 2021, the U.K. government published its Greening Finance Roadmap to Sustainable Investing (the “Roadmap”), which announced proposals to extend the scope of the U.K.’s sustainable finance framework beyond climate change. Further to the Roadmap, the FCA issued its final Policy Statement on its sustainability disclosure requirements and the investment labels regime. The FCA is, among other things, introducing a general ‘anti-greenwashing’ rule to clarify that sustainability-related claims must be clear, fair and not misleading. The general ‘anti-greenwashing’ rule comes into force on May 31, 2024 and the FCA is also consulting on new guidance on the expectations for FCA-authorized firms subject to the general ‘anti-greenwashing rule’ which will take effect at the same time.

In October 2023, the Green Technical Advisory Group ("GTAG") published its final advice to the U.K. government on the development of the U.K. Green Taxonomy. Whilst not binding, the GTAG advice gives a likely indication as to what the U.K. Green Taxonomy may look like and how it might differ from the EU Sustainable Finance Taxonomy Regulation (“EU Taxonomy”). The GTAG final report outlines sustainable governance arrangements for the U.K. Green Taxonomy and sets out various options for achieving this. The recommended “least regrets” option involves the U.K. government establishing an advisory body to facilitate implementation and development. If the GTAG advice is

adopted, the U.K. Green Taxonomy should align with the EU Taxonomy except where doing so impact the simplicity or usability of the activity classification system or increases the risk of greenwashing.

On December 14, 2022, the U.K. government said it would delay secondary legislation under the taxonomy regulations (originally anticipated by the end of 2022). Instead, the U.K. will restate EU law around the taxonomy and take additional time to decide the U.K.’s approach. In addition, Lloyd’s has mandated that managing agents must create an ESG framework and strategy, which was to be considered in the 2023 business planning cycle. Lloyd’s has also imposed ESG focused outcomes by way of the Principles with a particular focus on culture, investment and underwriting profitability. See “Lloyd’s Supervision” above for additional details.

Russian Sanctions. Since the Russian invasion of Ukraine in February 2022, the U.K. government has instituted a new sanctions regime targeting Russia. The sanctions imposed include prohibitions on providing financial services (including insurance and reinsurance) to persons connected with Russia in relation to certain restricted goods and services, and the freezing of assets owned or controlled by designated persons. The U.K., U.S. and EU often consult with each other with respect to their respective sanctions programs.

Privacy and Cybersecurity. The U.K. has implemented the European General Data Protection Regulation (“EU GDPR”) as the U.K. GDPR which sits alongside the U.K. Data Protection Act 2018 (the “U.K. GDPR”). The U.K. GDPR has direct effect where an entity is established in the U.K. (as applicable) and has extra-territorial effect where an entity established outside of the U.K. processes personal data in relation to the offering of goods or services to individuals in the EEA and/or the U.K. or the monitoring of their behavior. The U.K. GDPR imposes obligations on controllers, including, among others: (i) accountability and transparency requirements, requiring controllers to demonstrate and record compliance with the GDPR and to provide detailed information to individuals regarding the processing of their personal data; (ii) requirements to process personal data lawfully including specific requirements for obtaining valid consent where consent is the legal basis for processing; (iii) obligations to consider data protection when any new products or services are developed and designed (e.g., to limit the amount of personal data processed); (iv) obligations to comply with individuals’ data protection rights including a right: (a) of access to, erasure of, or rectification of personal data, (b) to restriction of processing or to withdraw consent to processing, (c) to object to processing or to ask for a copy of personal data to be provided to a third party, and (d) not to be subject to solely automated decision-making; and (v) an obligation to report personal data breaches to: (i) the data protection supervisory authority without undue delay (and no

ARCH CAPITAL			26			2023 FORM 10-K

later than 72 hours) after becoming aware of the personal data breach, unless the personal data breach is unlikely to result in a risk to the data subjects’ rights and freedoms; and (ii) affected individuals, where the personal data breach is likely to result in a high risk to their rights and freedoms. Processors are required to notify the controller without undue delay after becoming aware of a personal data breach.

The U.K. GDPR also imposes similar international data transfer restrictions to the EU (see below) on transfers of personal data from the U.K. to jurisdictions that the U.K. government does not consider adequate, including the U.S. The U.K. government has published its own form of the EU Standard Contractual Clauses (“SCCs”), known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new EU SCCs. Further, on September 21, 2023, the U.K. Government established a U.K.-U.S. data bridge or adequacy decision, through the U.K. extension to the EU-U.S. Data Privacy Framework (“DPF”). Effective as of October 12, 2023, U.S. organizations which self-certify to the DPF can now transfer personal data from the U.K. to the U.S. without using SCCs.

The U.K. Information Commissioner’s Office (“ICO”) has the power under the GDPR to (amongst other things) impose fines for serious breaches of up to the higher of 4% of the organization’s annual worldwide turnover or £17.5 million. Individuals also have a right to compensation, as a result of an organization’s breach of the U.K. GDPR which has affected them, for financial or non-financial losses (e.g., distress).

Cybersecurity requirements are laid down in the U.K. GDPR, which requires controllers and processors to implement appropriate technical and organizational measures to safeguard personal data to a level of security appropriate to the data protection risk.

The U.K. GDPR does not provide for a specific set of cybersecurity requirements or measures to be implemented, but rather requires a controller or processor to implement appropriate cyber and data security measures in accordance with the then-current risk, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The U.K. GDPR however does explicitly require that controllers notify personal data breaches under certain circumstances.

Artificial Intelligence. The U.K. has adopted a “soft law” approach to AI regulation meaning it has not adopted formal legislation to regulate AI but has adopted soft law guidelines in the form of a White Paper published on March 29, 2023. The U.K. intends to develop a sector-specific, principle centered approach to AI regulation, with the relevant sectors being responsible for enforcement.

Ireland

General. The CBI regulates insurance and reinsurance companies and intermediaries authorized in Ireland. Our three Irish operating subsidiaries are Arch Re Europe, Arch Insurance (EU) and Arch Underwriters Europe Limited (“Arch Underwriters Europe”). Arch Re Europe was licensed and authorized by the CBI as a non-life reinsurer in October 2008 and as a life reinsurer in November 2009. Arch Insurance (EU) was licensed and authorized by the CBI as a non-life insurer in December 2011. As part of our Brexit plan, Arch Insurance (EU) received approval from the CBI to expand the nature of its business in 2019 and commenced writing expanded insurance lines in the EEA in 2020 with the Part VII Transfer completed at the end of December 2020. Arch Underwriters Europe was registered by the CBI as an insurance and reinsurance intermediary in July 2014. Arch Re Europe, Arch Insurance (EU) and Arch Underwriters Europe are subject to the supervision of the CBI and must comply with Irish insurance acts and regulations as well as with directions and guidance issued by the CBI.

Arch Re Europe and Arch Insurance (EU) are required to comply with Solvency II requirements. See “European Union —Insurance and Reinsurance Regulatory Regime” below for additional details. As an intermediary, Arch Underwriters Europe is subject to a different regulatory regime and is not subject to solvency capital rules but must comply with requirements such as to maintain professional indemnity insurance and to have directors that are fit and proper. Our Irish subsidiaries are also subject to the general body of Irish company laws and regulations including the provisions of the Companies Act 2014.

The CBI operates a risk-based supervision framework, entitled PRISM, in respect to its regulation of Irish regulated entities. Under PRISM, the CBI applies an impact rating to each entity it regulates, ranging from Low to High, based on the nature, scale and complexity of its business. The level of supervision applied by the CBI is commensurate with the impact rating applied under PRISM with higher rated entities subject to more focused supervision engagement from the CBI on a more frequent basis.

Financial Resources. Arch Re Europe and Arch Insurance (EU) are required to meet economic risk-based solvency requirements imposed under Solvency II. Solvency II, together with European Commission “delegated acts” and guidance issued by EIOPA sets out classification and eligibility requirements, including the features which capital must display in order to qualify as regulatory capital.

Restrictions on Acquisitions. Under Irish law, the prior consent of the CBI is required before any person can acquire or increase a qualifying holding in an Irish insurer or reinsurer, including Arch Insurance (EU) and Arch Re

ARCH CAPITAL			27			2023 FORM 10-K

Europe, or their parent undertakings. A qualifying holding is defined for these purposes as a direct or indirect holding that represents 10% or more of the capital of, or voting rights, in the undertaking or makes it possible to exercise a significant influence over the management of the undertaking.

Restrictions on Payment of Dividends. Under Irish company law, Arch Re Europe, Arch Insurance (EU) and Arch Underwriters Europe are permitted to make distributions only out of profits available for distribution. A company’s profits available for distribution are its accumulated, realized profits, so far as not previously utilized by distribution or capitalization, less its accumulated, realized losses, so far as not previously written off in a reduction or reorganization of capital duly made. Further, the CBI has powers to intervene if a dividend payment were to lead to a breach of regulatory capital requirements.

In response to the COVID-19 pandemic, the CBI issued guidance in April 2020, based on guidance issued by EIOPA, that insurance firms postpone any payment of dividend distributions or similar transactions until they can forecast their costs and future revenues with a greater degree of certainty. However, the CBI modified its guidance, with effect from October 1, 2021, so that the general restrictions on the payment of dividend distributions or variable remuneration are no longer in place. The CBI still requires (re)insurance firms to notify it in advance of any proposed distribution.

European Union Considerations. As Arch Re Europe, Arch Insurance (EU) and Arch Underwriters Europe are authorized by the CBI in Ireland, a Member State of the EU, those authorizations are recognized throughout the EEA. Subject only to certain notification and application requirements, Arch Re Europe, Arch Insurance (EU) and Arch Underwriters Europe can provide services, or establish a branch, in any other Member State of the EEA. Although, in doing so, they may be subject to the laws of such Member States with respect to the conduct of business in such Member State, company law registrations and other matters, they will remain subject to financial and operational supervision by the CBI only. Arch Insurance (EU) has branches in Italy and the U.K. Arch Re Underwriting ApS in Denmark (“Arch Re Denmark”) is an underwriting agency underwriting accident and health and other reinsurance business for Arch Re Europe. Arch Re Europe also has branches in the U.K. and Switzerland (“Arch Re Europe Swiss Branch”).

From January 1, 2021, under the provisions of the TCA our Irish regulated entities have lost their passporting rights into the U.K. See “Risk Factors—Risks Relating to Our Industry, Business and Operations—New legislation or regulations relating to the U.K.’s withdrawal from the EU could adversely affect us.”

ESG Considerations. ESG matters have been on the CBI's agenda for a number of years. In November 2021, the CBI issued its expectations in respect of climate and broader ESG issues for all regulated firms in Ireland (including (re)insurers). The CBI's expectations focus on five key areas: governance, risk management, scenario analysis (including, but not limited to, stress testing for the purposes of the ORSA), disclosures and strategy and business model risk. The CBI has indicated that its expectations will be applied in a proportionate manner. In August 2022, the CBI published a Consultation Paper setting out its proposed guidance on climate change risk for the (re)insurance sector. The finalized guidance was published by the CBI in March 2023 and clarifies the CBI’s expectations on how (re)insurers should address climate change risks in their business and to assist (re)insurers develop their governance and risk management frameworks to do this. It is expected that over time, disclosures in respect to ESG matters may be captured in the Solvency and Financial Condition Reports of Arch's Irish entities. Arch continues to consider the impact of this guidance on its Irish entities. See also “European Union – ESG Considerations.”

Irish Individual Accountability Framework Act 2023. The Central Bank (Individual Accountability Framework) Act 2023 (the “IAF Act”) was signed into law in March 2023 with the relevant provisions and obligations under the IAF Act coming into effect on a phased basis. The majority of provisions came into effect in December 2023, with remaining provisions coming into effect on July 1, 2024 and July 1, 2025. The IAF Act implements substantive changes to the fitness and probity regime maintained by the CBI in Ireland and imposes certain additional obligations and liability for senior executives in Irish regulated financial service entities, including (re)insurance companies. Arch has considered the impact of the IAF Act on its business and has catered for this accordingly. See Item 1, “Business—Regulation, European Union – ESG Considerations.”

Third Country Governance Arrangements. In September 2023, in response to a supervisory statement issued by EIOPA in February 2023 on the use of third country governance arrangements (such as branches) by EU authorized (re)insurers, the CBI published its formal views on the use of third country governance arrangements. The CBI’s key expectations are that (i) third country branches should primarily serve the market in which they are established, with their sole objective to not simply support an Irish based (re)insurer and (ii) third country governance arrangements should not undermine the substance of Irish based (re)insurers. The CBI instructed Irish (re)insurers to review their current business models in light of EIOPA’s supervisory statement and the CBI’s own expectations. Arch reviewed, and continues to consider, the impact of this supervisory statement on its Irish and European operations.

ARCH CAPITAL			28			2023 FORM 10-K

European Union

Insurance and Reinsurance Regulatory Regime. Solvency II took effect in full on January 1, 2016. Solvency II imposes economic risk-based solvency requirements across all EU Member States and consists of three pillars: Pillar I-quantitative capital requirements, based on a valuation of the entire balance sheet; Pillar II-qualitative regulatory review, which includes governance, internal controls, enterprise risk management and supervisory review process; and Pillar III-market discipline, which is accomplished through reporting of the insurer’s financial condition to regulators and the public. Solvency II is supplemented by European Commission Delegated Regulation (EU) 2015/35 (the “Delegated Regulation”), other European Commission “delegated acts” and binding technical standards, and guidelines issued by EIOPA. The Delegated Regulation sets out more detailed requirements for individual insurance and reinsurance undertakings, as well as for groups, based on the overarching provisions of Solvency II, which together make up the core of the single prudential rulebook for insurance and reinsurance undertakings in the EU.

In December 2020, EIOPA provided an opinion to the European Commission in relation to the review of the Solvency II regime. This review was initiated by the European Commission to determine whether the Solvency II regime remains fit for purpose. In its opinion, EIOPA confirms that the overall Solvency II framework is working well from a prudential perspective, suggesting that there are no fundamental changes needed but that a number of amendments are required to ensure the regime continues as a well-functioning risk-based regime. In September 2021, the European Commission published legislative proposals for amendments to the Solvency II Directive arising out of EIOPA's review of the Solvency II regime. The proposed amendments cover a number of areas including proportionality, quality of supervision, sustainability risks and group and cross-border supervision. The European Parliament and the Council reached provisional agreement on the Solvency II amendments in December 2023, with formal approval expected in 2024.

In addition to the above Solvency II reform proposals, the European Commission continues to promote the development of the Insurance Recovery and Resolution Directive (“IRRD”). The proposal aims to harmonize national laws on recovery and resolution of (re)insurance undertakings. In December 2023, the European Parliament and Council reached provisional agreement on the IRRD. Currently, it is anticipated that the IRRD will enter into force during the course of 2024. It should be noted that the CBI has already introduced certain insurance recovery requirements under Irish law that apply to Arch’s Irish operations, including the preparation of recovery plans. We will continue to monitor

the development of the IRRD and its potential impact on our operations.

Following entry into the TCA by the U.K. and the EU, and the U.K.’s withdrawal from the EU under the provisions of the TCA, U.K. financial institutions have lost their passporting rights into the EU. It was originally envisaged that there would be a level of cooperation in relation to financial services, to be reflected in a MoU between the U.K. and the EU. However, the text of the MoU does not impose any binding substantive commitments nor is there any mention of taking forward the commitment in the Political Declaration accompanying the TCA regarding mutual equivalence.

In early February 2023, EIOPA issued its finalized Supervisory Statement on the use by EU-authorized (re)insurers of governance arrangements (such as branches) in third countries to perform functions or activities in respect of EU policyholders and risks. Arch is assessing the impact of the Supervisory Statement on its EU operations. See “Risk Factors—Risks Relating to Our Industry, Business and Operations—New legislation or regulations relating to the U.K.’s withdrawal from the EU could adversely affect us.”

Arch Re Europe and Arch Insurance (EU), being established in Ireland and authorized by the CBI, are able to establish branches and provide reinsurance services and, in respect of Arch Insurance (EU), insurance services in all EEA states. This is subject to certain regulatory notifications and there being no objection from the CBI and the Member States concerned.

Solvency II does not prohibit EEA insurers from obtaining reinsurance from reinsurers licensed outside the EEA, such as Arch Re Bermuda. As such, and subject to the specific rules in each Member State, Arch Re Bermuda may do business from Bermuda with insurers in EEA Member States, but it may not directly operate its reinsurance business within the EEA. Article 172 of Solvency II provides that reinsurance contracts concluded by insurance undertakings in the EEA with reinsurers having their head office in a country whose solvency regime has been determined to be equivalent to Solvency II shall be treated in the same manner as reinsurance contracts with undertakings in the EEA authorized under Solvency II. From January 1, 2016, Bermuda was deemed by the European Commission to be equivalent for Solvency II purposes. Solvency II also includes specific measures providing for the supervision of insurance and reinsurance groups. However, as a consequence of the above determination of equivalence, pursuant to Article 260 of Solvency II, regulators within the EEA are required to rely on the worldwide group supervision exercised by the BMA. EIOPA has also indicated that, on a case by case basis, groups subject to this worldwide supervision may be exempted from any EEA sub-group

ARCH CAPITAL			29			2023 FORM 10-K

supervision, where this results in more efficient supervision of the group and does not impair EEA supervisors in respect of their individual responsibilities.

The IDD was published in February 2016. EEA Member States were required to transpose the IDD by October 1, 2018. The IDD replaces the existing Insurance Mediation Directive. The IDD applies to all distributors of insurance and reinsurance products (including insurers and reinsurers selling directly to customers) and strengthens the regulatory regime applicable to distribution activities through increased transparency, information and conduct requirements. The principal impact of the IDD is on the insurance market, however, requirements that apply across insurance and reinsurance include more specific conditions regarding knowledge and continuing professional development for those involved in distribution of (re)insurance products. The IDD continues the pre-existing ability of intermediaries established in a Member State of the EU to establish branches and provide services to all EEA states. Arch Underwriters Europe, being established in Ireland and authorized by the CBI, is able, subject to regulatory notifications and there being no objection from the CBI, to establish branches and provide services in all EEA states.

Privacy and Cybersecurity. The EU GDPR came into effect on May 25, 2018. The EU GDPR governs the collection, use, disclosure, transfer or other processing of personal data. Its scope extends to certain entities not established in the EEA if they process personal data or offer goods or services to, or monitor the behavior of, EEA data subjects. The EU GDPR contains a number of requirements regarding the processing of personal data about individuals, including mandatory security breach reporting, new and strengthened individual rights, evidenced data controller accountability for compliance with the GDPR principles (including fairness and transparency), maintenance of data processing activity records and the implementation of “privacy by design,” including through the completion of mandatory Data Protection Impact Assessments in connection with higher risk data processing activities.

In addition, the EU GDPR increases scrutiny of transfers of personal data to jurisdictions which the European Commission does not recognize as having “adequate” data protection laws. In particular, on July 16, 2020, the Court of Justice of the EU (Court of Justice) in Schrems II invalidated the European Union-United States (EU-U.S.) Privacy Shield on the grounds that the EU-U.S. Privacy Shield failed to offer adequate protections to EU personal information transferred to the U.S. While the Court of Justice upheld the use of other data transfer mechanisms, such as the Standard Contractual Clauses (“EU SCCs”), the decision has led to some uncertainty regarding the use of such mechanisms for data transfers to the U.S., and the Court of Justice made clear that reliance on EU SCCs alone may not necessarily be sufficient

in all circumstances. The European Data Protection Board issued additional guidance regarding international transfers which may require us to implement additional safeguards to further enhance the security of data transferred out of the EEA. The European Commission published new versions of the EU SCCs in June 2021, which place onerous obligations on the parties. On October 7, 2022, the U.S. President introduced an Executive Order to facilitate a new Trans-Atlantic Data Privacy Framework to act as a successor to the invalidated EU-U.S. Privacy Shield. On July 10, 2023, the European Commission adopted an adequacy decision relating to the transfer of personal data from the EU to the U.S. which takes place under the DPF. The DPF is the successor to the EU-U.S. Privacy Shield and allows companies that participate in the DPF to transfer personal data freely to the U.S. without the need for alternative data protection transfer mechanisms (such as SCCs or binding corporate rules).

The EU GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of global turnover). The EU GDPR allows data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR.

Cybersecurity and information security are an area of increasing focus for the EU. The Digital Operational Resilience Act (“DORA”) entered into force in January 2023. The core aim of DORA is to prevent and mitigate cyber threats and sets uniform requirements for the security of network and information systems of financial sector entities (including (re)insurers) as well as critical third parties which provide ICT (information and communication technology)-related services, such as cloud platforms or data analytics services. In scope entities will be required to comply with the obligations set out under DORA from January 2025.

In addition to the above, EIOPA continues to publish detailed guidelines, recommendations and expectations relating to cyber matters and how these should be managed and considered by the (re)insurance sector.

Artificial Intelligence. On December 9, 2023, the EU Parliament and Council reached provisional agreement on the text of the Artificial Intelligence Act (the “EU AI Act”). The EU AI Act aims to regulate AI and will apply directly, on a phased basis, in all EU Member States. In February 2024, representatives of the governments of EU Member States signed off on the final text of the EU AI Act. A vote in the European Parliament on the adoption of the EU AI Act is expected in April 2024.

The EU AI Act will introduce a categorization system for AI risks with the level of protection linked to the level of risk posed by the relevant AI. Based on the final text, certain AI applications utilized by (re)insurers will fall within the scope

ARCH CAPITAL			30			2023 FORM 10-K

of the EU AI Act and will be subject to regulation. Arch continues to monitor development of the EU AI Act and its potential impact on Arch’s operations.

ESG Considerations. A comprehensive package of measures to facilitate the progression towards sustainable economic activities was approved in principle by the European Commission in April 2021. In August 2021, two delegated regulations (the “EC Regulations”) amending sectoral legislation, including the Solvency II Directive and the IDD, were published. The EC Regulations focus on the integration of sustainability into key activities including product oversight and governance, risk management and suitability assessment procedures. The EC Regulations apply from August 2022.

The Corporate Sustainability Reporting Directive (“CSRD”), which replaces the Non-Financial Reporting Directive (“NFRD”), was published in the Official Journal of the EU on November 16, 2022 and entered into effect on January 5, 2023. Certain of our European subsidiaries are subject to NFRD. The CSRD expands the scope of sustainability reporting obligations to any European listed company or any company (including (re)insurers) meeting certain criteria. Companies which are already subject to NFRD must start reporting relevant information for financial years starting on or after January 1, 2024 beginning in 2025. Reporting obligations for other companies fulfilling certain criteria will commence in 2026 for financial years starting on or after January 1, 2025. In addition, the reporting standards under the CSRD, which provides in-scope companies with the technical detail on the information that will need to be disclosed and reported, were adopted by the European Commission in July 2023. Certain of our European entities will fall within the scope of certain reporting obligations under the CSRD.

An additional ESG framework, the EU Taxonomy, came into force in July 2020, with in-scope companies required to comply with certain reporting obligations from January 1, 2022. The EU Taxonomy (which is a classification standard for reporting) sets out six environmental objectives with which companies' economic activities must comply if they are to be described as environmentally sustainable. These six environmental objectives are: (1) climate change mitigation, (2) climate change adaptation, (3) sustainable use and protection of water and marine resources, (4) transition to a circular economy, (5) pollution prevention and control and (6) the protection and restoration of biodiversity and ecosystems. In addition, reporting obligations apply to in-scope companies regarding (1) the financial products they provide and (2) the environmental sustainability of an in-scope company's activities, which is to be disclosed in non-financial statements that are required under the NFRD and the CSRD.

In February 2022, the European Commission adopted a proposal for the Corporate Sustainability Due Diligence Directive (“CSDD”). Provisional agreement was reached between the European Parliament and Council in December 2023 however the text of the agreed CSDD has not yet been officially published. Formal approval of the CSDD is expected to be provided in early 2024. While the main focus of the CSDD is on conducting due diligence on human rights and environmental impacts within a company and across its value chain, there are also additional sustainability requirements for certain in-scope entities. It is anticipated that certain obligations under the CSDD will apply to financial services entities (including (re)insurers) however it is expected that financial services entities (including (re)insurers) will be temporarily excluded from the obligation to conduct due diligence on their customers.We will closely monitor the continued development of the CSDD and its potential impact on Arch’s European operations.

In tandem with all of the above, EIOPA continues to engage with stakeholders in the (re)insurance sector and publish detailed guidelines, recommendations and expectations relating to ESG matters and how these should be managed and considered by the (re)insurance sector.

Russian Sanctions. Since February 2022, the EU has imposed significant sanctions on the Russian Federation in response to its invasion of Ukraine. These sanctions are similar to those imposed by the U.K. and U.S. Given the evolving situation, we are closely monitoring developments and the sanctions imposed, to ensure our European entities remain in compliance with any sanctions measures imposed.

Inflation. The EU has adopted a range of measures to combat unprecedented levels of inflation, with EIOPA issuing a supervisory statement outlining its expectations of (re)insurers on inflation-related issues in December 2022. We are monitoring ongoing developments and considering the impact of EU and EIOPA guidance on inflation on its business.

Third Country Governance Arrangements. In February 2023, EIOPA published a supervisory statement on the use by EU authorized (re)insurers of governance arrangements (such as branches) in third countries to perform functions or activities in respect of EU policyholders and risks. See also “Ireland – Third Country Governance Arrangements.”

ARCH CAPITAL			31			2023 FORM 10-K

Switzerland

In December 2008, Arch Re Europe opened Arch Re Europe Swiss Branch as a branch office. As Arch Re Europe is domiciled outside of Switzerland and its activities are limited to reinsurance, the Arch Re Europe Swiss Branch in Switzerland is not required to be licensed by the Swiss insurance regulatory authorities.

In August 2014, Arch Underwriters Europe opened a branch office in Zurich (“Arch Underwriters Europe Swiss Branch”) to render reinsurance advisory services to certain group companies. Arch Underwriters Europe Swiss Branch is registered with the commercial register of the Canton of Zurich. Since its activities are limited to advisory services for reinsurance matters, the Arch Underwriters Europe Swiss Branch is not required to be licensed by the Swiss insurance regulatory authorities.

Australia

APRA is an independent statutory authority responsible for prudential supervision of institutions across banking, insurance and superannuation and promotes financial stability in Australia. Arch Indemnity has been authorized to conduct monoline lenders’ mortgage insurance business in Australia since June 2002 and was acquired by Arch Capital on August 30, 2021. Arch LMI, which was formerly authorized by APRA in January 2019 to conduct monoline lenders’ mortgage insurance business in Australia, relinquished its APRA authorization in December 2022 and has been converted to a services company for our Australian lenders mortgage insurance operations. Major regulatory requirements that are applicable to Arch Indemnity as a general insurance provider in Australia include requirements on minimum capital levels, remuneration practices, and compliance with corporate governance standards, including the risk management strategy for our Australian mortgage insurance business.

In addition to its APRA authorization, Arch Indemnity has been licensed by the Australian Securities and Investments Commission (“ASIC”) since March 2011 to engage in credit activities in Australia. Arch LMI has been licensed by ASIC since October 2023 as a Financial Services Licensee in Australia.

Our group also conducts property and casualty insurance business in Australia through Lloyd’s. This insurance business is managed by and distributed through local coverholders and is subject to Lloyd’s Supervision. In addition, the business is subject to local Australian prudential regulatory oversight by APRA, and additional separate financial services market conduct regulation by ASIC.

In addition, there are other Australian legislation and regulations applicable to the financial services sector that our group operates in, such as:

• privacy legislation on the collection, use and storage of personal information and sensitive information of individuals and a mandatory data breach notification regime, which are overseen by the Office of the Australian Information Commissioner;

• cyber security obligations imposed by APRA and ASIC as part of their respective licensing regimes for insurers, and also on larger insurers in Australia under Australian security of critical infrastructure legislation;

• modern slavery legislation which imposes a statutory reporting regime for larger companies operating in Australia; and

• anti-money laundering and counter-terrorism financing legislation, which is administered by the Australian Transaction Reports and Analysis Centre.

In Australia, businesses which develop and use AI are subject to various Australian laws relating to privacy, corporations and anti-discrimination which apply across all sectors of the economy. There are also financial services sector specific laws in Australia administered by APRA and ASIC which impact the development and deployment of AI in the sector in which our group operates, although such existing laws are technology-neutral.

The Australian Government has been undertaking consultation on “Safe and Responsible AI” regulation in Australia since June 2023. In January 2024, the Australian Government published its Interim Response to the consultation, which indicates that:

• the Australian Government considers that Australia’s existing laws and current regulatory framework do not sufficiently address the risks presented by AI (particularly in “high-risk” applications and frontier models);

• the Australian Government will seek to regulate AI (rather than relying solely on voluntary standards) by adopting a risk-based regulatory approach to implement additional guardrails for AI in “high-risk” settings;

• the Australian Government is currently undertaking work to strengthen existing laws in areas that will help to address known harms with AI, including proposed privacy law reform.

The Australian Government’s final regulatory response to AI is subject to further consultation with industry before either amending existing laws or implementing new laws to regulate AI in Australia.

ARCH CAPITAL			32			2023 FORM 10-K

Hong Kong

The insurance industry is regulated by Hong Kong Insurance Authority (“HKIA”), whose principal function is to regulate and supervise the insurance industry for the promotion of the general stability of the insurance industry and for the protection of existing and potential policyholders. Arch MI Asia Limited (“Arch MI Asia”) is not writing new business but is authorized to carry on general business Class 14 (Credit) and Class 16 (Miscellaneous Financial Loss), in or from Hong Kong.

Major regulatory requirements that are applicable to Arch MI Asia as a general business insurer include requirements on minimum paid-up capital, minimum solvency margin and maintenance of assets in Hong Kong.

TAX MATTERS

The following summary of the taxation of Arch Capital and the taxation of our shareholders is based upon current law and is for general information only. Legislative, judicial or administrative changes may be forthcoming that could affect this summary.

The following legal discussion (including and subject to the matters and qualifications set forth in such summary) of certain tax considerations (a) under “—Taxation of Arch Capital—Bermuda” and “—Taxation of Shareholders—Bermuda” is based upon the advice of Conyers Dill & Pearman Limited, Hamilton, Bermuda and (b) under “—Taxation of Arch Capital-United States,” “—Taxation of Shareholders-United States Taxation,” “—Taxation of Our U.S. Shareholders” and “—United States Taxation of Non-U.S. Shareholders” is based upon the advice of White & Case LLP, New York, New York (the advice of such firms does not include accounting matters, determinations or conclusions relating to the business or activities of Arch Capital). The summary is based upon current law and is for general information only. The tax treatment of a holder of our common or preferred shares, or of a person treated as a holder of our shares for U.S. federal income, state, local or non-U.S. tax purposes, may vary depending on the holder’s particular tax situation. Legislative, judicial or administrative changes or interpretations may be forthcoming that could be retroactive and could affect the tax consequences to us or to holders of our shares.

Taxation of Arch Capital

Bermuda. Under current Bermuda law, Arch Capital does not pay any tax on income or profits, and is not subject to payment of any tax on withholding, capital gains or capital transfers. Arch Capital has obtained from the Minister of Finance under the Exempted Undertakings Tax Protection Act 1966 of Bermuda an assurance that, in the event that

Bermuda enacts legislation imposing tax computed on profits, income, any capital asset, gain or appreciation, or any tax in the nature of estate duty or inheritance, the imposition of any such tax shall not be applicable to Arch Capital or to any of our operations or our shares, debentures or other obligations until March 31, 2035. However, on December 27, 2023, the Government of Bermuda enacted the Bermuda CIT Act, which will become effective for tax years beginning on or after January 1, 2025. Given the potential for the new corporate income tax regime in Bermuda to supersede the Minister of Finance’s assurance, the Company is likely to become subject to taxes in Bermuda before March 31 ,2035. See Item 1A,“Risk Factors — Risks Relating to Taxation” for additional information. We pay annual Bermuda government fees, and our Bermuda insurance and reinsurance subsidiary pays annual insurance license fees. In addition, all entities employing individuals in Bermuda are required to pay a payroll tax and other sundry taxes payable, directly or indirectly, to the Bermuda government.

United States. Arch Capital and its non-U.S. subsidiaries believe they have conducted their operations and currently intend to conduct their operations going forward in a manner that has not caused them and will not cause them to be treated as engaged in a trade or business in the U.S. and, therefore, has not been and will not be required to pay U.S. federal income taxes (other than U.S. excise taxes on insurance and reinsurance premiums and withholding taxes on dividends and certain other U.S. source investment income). However, because definitive identification of activities which constitute being engaged in a trade or business in the U.S. is not provided by the Internal Revenue Code of 1986, as amended (the “Code”), U.S. Treasury regulations (“Treasury Regulations”) or court decisions, there can be no assurance that our position on being engaged in a trade or business in the U.S. is correct. A foreign corporation deemed to be so engaged would be subject to U.S. federal income tax, as well as the branch profits tax, on its income, which is treated as effectively connected with the conduct of that trade or business unless the corporation is entitled to relief under a tax treaty. Such income tax, if imposed, would be based on effectively connected income computed in a manner generally analogous to that applied to the income of a domestic corporation, except that deductions and credits generally are not permitted unless the foreign corporation has timely filed a U.S. federal income tax return in accordance with applicable Treasury Regulations. Penalties may be assessed for failure to file tax returns. In addition, in such case, a 30% branch profits tax would be imposed on net income after subtracting the regular corporate tax and making certain other adjustments.

Under the income tax treaty between Bermuda and the U.S. (the “Treaty”), Arch Capital's Bermuda insurance subsidiaries will be subject to U.S. income tax on any insurance premium income that is effectively connected with

ARCH CAPITAL			33			2023 FORM 10-K

a U.S. trade or business only if that trade or business is conducted through a permanent establishment in the U.S. No Treasury Regulations interpreting the Treaty have been issued. While there can be no assurances, Arch Capital does not believe that any of its Bermuda insurance subsidiaries has a permanent establishment in the U.S. Such subsidiaries would not be entitled to the benefits of the Treaty if (i) 50% or less of Arch Capital's shares were beneficially owned, directly or indirectly, by Bermuda residents or U.S. citizens or residents, or (ii) any such subsidiary's income were used in substantial part to make disproportionate distributions to, or to meet certain liabilities to, persons who are not Bermuda residents or U.S. citizens or residents. While Arch Capital believes that its Bermuda insurance subsidiaries have been eligible for Treaty benefits to date, there can be no assurance that this is the case or that the Bermuda insurance subsidiaries will continue to be eligible for Treaty benefits.

The Treaty clearly applies to premium income but may be construed as not protecting investment income. If Arch Capital’s Bermuda insurance subsidiaries were considered to be engaged in a U.S. trade or business and were entitled to the benefits of the Treaty in general, but the Treaty were not found to protect investment income, a portion of such subsidiaries’ investment income could be subject to U.S. federal income tax.

Non-U.S. insurance companies carrying on an insurance business within the U.S. have a certain minimum amount of effectively connected net investment income, determined in accordance with a formula that depends, in part, on the amount of U.S. risk insured or reinsured by such companies. If any of Arch Capital's non-U.S. insurance subsidiaries is considered to be engaged in the conduct of an insurance business in the U.S., a significant portion of such subsidiary’s investment income could be subject to U.S. federal income tax.

Non-U.S. corporations not engaged in a trade or business in the U.S. are nonetheless subject to U.S. income tax on certain “fixed or determinable annual or periodic gains, profits and income” derived from sources within the U.S. as enumerated in Section 881(a) of the Code (such as dividends and certain interest on investments), subject to exemption under the Code or reduction by an applicable treaty.

The U.S. also imposes an excise tax on insurance and reinsurance premiums paid to non-U.S. insurers or reinsurers with respect to risks located in the U.S. The rates of tax, unless reduced by an applicable U.S. tax treaty, are 4% for non-life insurance premiums and 1% for life insurance and all reinsurance premiums.

The Tax Cuts and Jobs Act of 2017 (the “Tax Cuts Act”) was signed into law by the President of the United States in 2017. For taxable years beginning after 2017, the Tax Cuts Act

imposes a 10% minimum base erosion and anti-abuse tax (increased to 12.5% for taxable years after 2025) on the “modified taxable income” of a U.S. corporation (or a non-U.S. corporation engaged in a U.S. trade or business) over such corporation’s regular U.S. federal income tax, reduced by certain tax credits. The “modified taxable income” of a corporation is determined without deduction for certain payments by such corporation to its non-U.S. affiliates (including reinsurance premiums). Final Treasury Regulations interpreting the base erosion and anti-abuse tax were issued in December 2019 and October 2020.

United Kingdom. Our U.K. subsidiaries are companies that are incorporated and have their central management and control in the U.K. and are therefore resident in the U.K. for corporation tax purposes. As a result, they are subject to U.K. corporation tax on their respective profits. The U.K. branches of Arch Re Europe and Arch Insurance (EU) are subject to U.K. corporation tax on the profits (both income profits and chargeable gains) attributable to each branch. The blended rate of U.K. corporation tax for the 2023 financial year is approximately 23.5% on profits (the rate increased from 19% to 25% with effect from April 1, 2023).

Canada. Arch Insurance Canada is taxed on its worldwide income. Arch Re U.S. is taxed on its net business income earned in Canada. The general federal corporate income tax rate in Canada is currently 15%. Provincial and territorial corporate income tax rates are added to the general federal corporate income tax rate and generally vary between 8% and 16%.

Ireland. Each of Arch Re Europe, Arch Insurance (EU) and Arch Underwriters Europe is incorporated and resident in Ireland for corporation tax purposes and will be subject to Irish corporate tax on worldwide profits, including the profits of the branches of Arch Re Europe, Arch Insurance (EU) and Arch Underwriters Europe. Any foreign branch corporate tax payable is creditable against Arch Re Europe’s Irish corporate tax liability on the results of Arch Re Europe’s branches with the same principle applied to Arch Insurance (EU)’s branches and Arch Underwriters Europe’s branches. The current rate of Irish corporation tax applicable to such trading profits is 12.5%.

Switzerland. Arch Re Europe Swiss Branch and Arch Underwriters Europe Swiss Branch are subject to Swiss corporation tax on the profit which is allocated to each branch. The effective tax rate is approximately 19.65% for Swiss federal, cantonal and communal corporation taxes on the profit. The effective tax rate of the annual cantonal and communal capital taxes on the equity which is allocated to Arch Re Europe Swiss Branch and Arch Underwriters Europe Swiss Branch is approximately 0.17%.

ARCH CAPITAL			34			2023 FORM 10-K

Denmark. Arch Re Denmark, established as a subsidiary of Arch Re Bermuda, is subject to Danish corporation taxes on its profits at a rate of 22%.

Hong Kong. Arch MI Asia is subject to Hong Kong corporate tax on its assessable profits at a rate of 16.5%. Assessable profits are the net profits for the basis period, arising in or derived from Hong Kong.

Australia. Arch LMI and Arch Indemnity, Australian incorporated and tax resident companies, are subject to Australian corporate tax on its worldwide profits. The current rate of Australian corporation tax applicable to such profits is 30%.

OECD’s Pillar II.

Under Pillar II, a global minimum tax at the rate of 15% would be imposed on certain in-scope entities. Under the European Union’s minimum tax directive, unanimously agreed by the member states in 2022, each member state is required to adopt domestic legislation implementing the minimum tax rules effective for periods beginning on or after December 31, 2023, with the “under-taxed profit rule” to take effect for periods beginning on or after December 31, 2024. Legislatures in multiple countries outside of the European Union have also drafted legislation to implement the OECD’s minimum tax proposal.

Given the OECD's continued release of guidance regarding Pillar II, that only certain jurisdictions have currently enacted laws to give effect to Pillar II, and that jurisdictions may interpret such laws in different manners, the overall implementation of Pillar II remains uncertain and subject to change, possibly on a retroactive basis. Although certain jurisdictions in which we and our affiliates do business have enacted an “under-taxed profit rule”, such rule is only expected to take effect for taxable periods beginning on or after December 31, 2024. The adoption of the tax laws described above (in particular, the adoption of an “under-taxed profit rule” by certain countries in which we and our affiliates do business) are expected to result in an increase to our effective tax rate and aggregate tax liability. See Item 1A, “Risk Factors – Risk Relating to Taxation” for additional information.

Taxation of Shareholders

Bermuda. Currently, there is no Bermuda withholding tax on dividends paid by us.

United States—General. The following summary sets forth certain U.S. federal income tax considerations related to the purchase, ownership and disposition of our common shares and our non-cumulative preferred shares (“preferred shares”). Unless otherwise stated, this summary deals only with shareholders (“U.S. holders”) that are U.S. Persons (as defined below) and to common shares and preferred shares

beneficially owned by such holder and held as capital assets. The following discussion is only a general summary of the U.S. federal income tax matters described herein and does not purport to address all of the U.S. federal income tax consequences that may be relevant to a particular shareholder in light of such shareholder’s specific circumstances. In addition, the following summary (except as to matters explicitly discussed therein) does not describe the U.S. federal income tax consequences that may be relevant to certain types of shareholders, such as banks, insurance companies, and other financial institutions, regulated investment companies, real estate investment trusts, financial asset securitization investment trusts, brokers, dealers or traders in securities, entities or arrangements classified as partnerships or pass-through entities for U.S. federal income tax purposes or holders of equity interests therein, tax exempt entities, “individual retirement accounts” or “Roth IRAs”, expatriates and former citizens or long-term residents of the United States, persons whose functional currency for U.S. federal income tax purposes is not the U.S. dollar, persons that own, directly, indirectly or constructively, ten percent (10%) or more of the total voting power or value of all of our outstanding shares, persons owning our common shares or preferred shares in connection with a trade or business conducted outside the United States, U.S. holders that hold our common shares or preferred shares through a non-U.S. broker or other non-U.S. intermediary, persons who hold our common shares or preferred shares as part of a hedging or conversion transaction or as part of a straddle or wash sale, who may be subject to special rules or treatment under the Code or persons required for U.S. federal income tax purposed to recognize income no later than such income is reported on such persons’ applicable financial statements, and persons subject to the alternative minimum tax. This discussion is based upon the Code, the Treasury Regulations promulgated there under and any relevant administrative rulings or pronouncements or judicial decisions, all as in effect on the date of this annual report and as currently interpreted and does not take into account possible changes in such tax laws or interpretations thereof, which may apply retroactively. This discussion does not include any description of the tax laws of any state or local governments within the U.S., or of any foreign government, that may be applicable to our common shares or preferred shares or the shareholders. There can be no assurance the U.S. Internal Revenue Service (“IRS”) or a court will not take a contrary position to that discussed below regarding the tax consequences of the purchase, ownership and disposition of our common shares and preferred shares. Persons holding or considering an investment in the common shares or preferred shares should consult their own tax advisors concerning the application of the U.S. federal tax laws to their particular situations as well as any tax consequences arising under the laws of any state, local or foreign taxing jurisdiction prior to making such investment.

ARCH CAPITAL			35			2023 FORM 10-K

If an entity that is treated as a partnership holds our common shares or preferred shares, the tax treatment of a partner will generally depend upon the status of the partner and the activities of the partnership. If you are a partnership holding or considering an investment in our common shares or preferred shares or a partner therein, you should consult your tax advisor.

For purposes of this discussion, the term “U.S. Person” means a person that is, for U.S. federal income tax purposes:

• an individual who is a citizen or resident of the U.S.;

• a corporation created or organized under the laws of the U.S., any state thereof or the District of Columbia;

• an estate, the income of which is subject to U.S. federal income taxation regardless of its source; or

• a trust, if either (i) a court within the U.S. is able to exercise primary supervision over the administration of such trust and one or more U.S. persons have the authority to control all substantial decisions of such trust or (ii) the trust has a valid election in effect to be treated as a U.S. person for U.S. federal income tax purposes.

United States—Taxation of Dividends. The preferred shares should be properly classified as equity rather than debt for U.S. federal income tax purposes. Subject to the discussions below relating to the potential application of the controlled foreign corporation (“CFC”), “related person insurance income” (“RPII”) and passive foreign investment company (“PFIC”) rules, as defined below, cash distributions, if any, made with respect to our common shares or preferred shares will constitute dividends for U.S. federal income tax purposes to the extent paid out of our current or accumulated earnings and profits (as computed using U.S. tax principles). If a U.S. holder of our common shares or our preferred shares is an individual or other non-corporate holder, dividends paid, if any, to that holder that constitute qualified dividend income generally will be taxable at the rate applicable for long-term capital gains (generally up to 20%), provided that such person meets a holding period requirement. Generally, in order to meet the holding period requirement, the U.S. holder must hold the common shares for more than 60 days during the 121-day period beginning 60 days before the ex-dividend date and must hold preferred shares for more than 90 days during the 181-day period beginning 90 days before the ex-dividend date. Dividends paid, if any, with respect to common shares or preferred shares generally will be qualified dividend income, provided the common shares or preferred shares are readily tradable on an established securities market in the U.S. in the year in which the shareholder receives the dividend (which should be the case for shares that are listed on the Nasdaq Stock Market or the New York Stock Exchange) and Arch Capital is not considered to be a passive foreign investment company in either the year of the distribution or the preceding taxable year. No assurance can be given that the preferred shares will be considered readily

tradable on an established securities market in the U.S. See “—Taxation of Our U.S. Shareholders” below.

A U.S. holder that is an individual, estate or a trust that does not fall into a special class of trusts that is exempt from such tax, will be subject to a 3.8% tax on the lesser of (1) the U.S. holder’s “net investment income” for the relevant taxable year and (2) the excess of the U.S. holder’s modified adjusted gross income for the taxable year over a certain threshold (which in the case of individual will be between $125,000 and $250,000, depending on the individual’s circumstances). A U.S. holder’s net investment income generally will include its dividend income and its net gains from the disposition of our common shares and preferred shares, unless such dividend income or net gains are derived in the ordinary course of the conduct of a trade or business (other than a trade or business that consists of certain passive or trading activities).

Distributions with respect to the common shares and the preferred shares will not be eligible for the dividends received deduction allowed to U.S. corporations under the Code. To the extent distributions on our common shares and preferred shares exceed our earnings and profits, they will be treated first as a return of the U.S. holder's basis in our common shares and our preferred shares to the extent thereof, and then as gain from the sale of a capital asset.

United States—Sale, Exchange or Other Disposition. Subject to the discussions below relating to the potential application of the CFC, RPII and PFIC rules, U.S holders of common shares and preferred shares generally will recognize capital gain or loss, if any, for U.S. federal income tax purposes on the sale, exchange or other taxable disposition of common shares or preferred shares, as applicable in an amount equal to the difference between the amount realized on the sale, exchange or other taxable disposition and the U.S holder’s adjusted tax basis in the shares. Such gain or loss generally will be long term capital gain or loss if the U.S. holder’s holding period for the shares exceeds one year. Long-term capital gains of certain non-corporate U.S. holders (including individuals) are generally eligible for reduced rates of taxation. The deductibility of capital losses is subject to limitations.

United States—Redemption of Preferred Shares. A redemption of the preferred shares will be treated under Section 302 of the Code as a dividend to the extent we have earnings and profits allocable to such shares, unless the redemption satisfies one of the tests set forth in Section 302(b) of the Code enabling the redemption to be treated as a sale or exchange, subject to the discussion herein relating to the potential application of the CFC, RPII and PFIC rules. Under the relevant Code Section 302(b) tests, the redemption should be treated as a sale or exchange only if it (1) is substantially disproportionate, (2) constitutes a complete

ARCH CAPITAL			36			2023 FORM 10-K

termination of the holder's stock interest in us or (3) is “not essentially equivalent to a dividend.” In determining whether any of these tests are met, shares considered to be owned by the holder by reason of certain constructive ownership rules set forth in the Code, as well as shares actually owned, must generally be taken into account. It may be more difficult for a U.S. holder who owns, actually or constructively by operation of the attribution rules, any of our other shares to satisfy any of the above requirements.

In order to meet the substantially disproportionate test, the percentage of our issued and outstanding voting shares actually and constructively owned by the U.S. holder immediately following the redemption of our shares must, among other requirements, be less than 80% of the percentage of our issued and outstanding voting shares actually and constructively owned by the U.S. holder immediately before the redemption. There will be a complete termination of a U.S. holder’s interest if either (i) all of our shares actually and constructively owned by the U.S. holder are redeemed or (ii) all of our shares actually owned by the U.S. holder are redeemed and the U.S. holder is eligible to waive, and effectively waives in accordance with specific rules, the attribution of shares owned by certain family members and the U.S. holder does not constructively own any other of our shares. The redemption of our shares will not be essentially equivalent to a dividend if such redemption results in a “meaningful reduction” of the U.S. holder’s proportionate interest in us. Whether the redemption will result in a meaningful reduction in a U.S. holder’s proportionate interest in us will depend on the particular facts and circumstances. However, the IRS has indicated in a published ruling that even a small reduction in the proportionate interest of a small minority shareholder in a publicly held corporation who exercises no control over corporate affairs may constitute such a “meaningful reduction.” The determination as to whether any of the alternative tests of Section 302(b) of the Code is satisfied with respect to a particular holder of the preferred shares depends on the facts and circumstances as of the time the determination is made.

If none of the foregoing tests are satisfied, then the redemption of any of our shares will be treated as a distribution and the tax effects will be as described under “—United States—Taxation of Dividends” above. After the application of those rules, any remaining tax basis of the U.S. holder in the redeemed shares will be added to the U.S. holder’s adjusted tax basis in its remaining shares, or, possibly, in other shares constructively owned by it. A U.S. holder should consult with its own tax advisors as to the tax consequences of a redemption of ours shares.

U.S. holders who actually or constructively own five percent or more of our shares (by vote or value) may be subject to special reporting requirements with respect to a redemption

of our shares, and such holders are urged to consult with their own tax advisors with respect to their reporting requirements.

Taxation of Our U.S. Shareholders

Controlled Foreign Corporation Rules. We or any of our non-U.S. subsidiaries generally will be treated as a CFC with respect to any taxable year if at any time during such taxable year, one or more “10% U.S. Shareholders” (as defined below) collectively own more than 50% of us or such non-U.S. subsidiary (as applicable) by vote or value (taking into account shares actually owned by such U.S. holder as well as shares attributed to such U.S. holder under the Code or the Treasury Regulations thereunder). Moreover, with respect to insurance income (including reinsurance income), the “more than 50%” requirement described in the preceding sentence is replaced with a more expansive “more than 25%” requirement. A 10% U.S. Shareholder means any U.S. Person who was considered to own, actually or constructively, 10% or more of the total combined voting power or total combined value of our shares or those of our non-U.S. subsidiaries (as applicable). As a result of a change in law for taxable years beginning after December 31, 2017, the voting cut-back limitation contained in our bye-laws that limits the votes conferred by the Controlled Shares (as defined in our bye-laws) of any U.S. Person to 9.9% of the total voting power of all our shares entitled to vote will not prevent any U.S. holder from being treated as a 10% U.S. Shareholder. Due to the repeal of Section 958(b)(4) of the Code under the Tax Cuts Act, all non-U.S. subsidiaries directly or indirectly owned by Arch Capital are treated as constructively owned by its U.S. subsidiaries, and therefore are treated as CFCs.

Status as a CFC would not cause us or any of our non-U.S. subsidiaries to be subject to U.S. federal income tax. Such status also would have no adverse U.S. federal income tax consequences for any U.S. holder that is not a 10% U.S. Shareholder with respect to us or any such non-U.S. subsidiary (as applicable). If we or any of our non-U.S. subsidiaries are or were a CFC with respect to any taxable year, a U.S. holder that is considered a 10% U.S. Shareholder would be subject to current U.S. federal income taxation (at ordinary income tax rates) to the extent of all or a portion of the undistributed earnings and profits of Arch Capital and our subsidiaries attributable to “subpart F income” (including certain insurance premium income and investment income) or global intangible low-taxed income and may be taxable at ordinary income tax rates on any gain recognized on a sale or other disposition (including by way of repurchase or liquidation) of our common shares or preferred shares to the extent of the current and accumulated earnings and profits attributable to such common shares or preferred shares.

Related Person Insurance Income Rules. In general, with respect to RPII (a limited category of insurance income, as defined below), the CFC rules are expanded in two

ARCH CAPITAL			37			2023 FORM 10-K

significant respects. First, in determining CFC status, as well as determining which U.S. shareholders are subject to current taxation with respect to a CFC’s RPII (whether or not currently distributed), all U.S. shareholders (as opposed to only 10% U.S. Shareholders) are taken into account. Second, the amount of stock in a foreign corporation that all U.S. shareholders, in the aggregate, must own for such corporation to be treated as a CFC is reduced from more than 50% (by vote or value), and more than 25% (by vote or value) with respect to insurance income generally, to 25% or more (by vote or value). Generally, RPII is insurance income (including reinsurance income) of a foreign corporation with respect to which the insured is a United States shareholder of the foreign corporation or a related person to such a shareholder.

Under one exception to the foregoing RPII rules, U.S. shareholders are not required to include a CFC’s RPII currently in income if the CFC’s gross RPII is less than 20% of its total gross insurance income for the taxable year in question (the “RPII 20% gross income exception”).

Under current law, we currently expect each of our non-U.S. subsidiaries to satisfy the RPII 20% gross income exception, and therefore we currently do not expect any U.S. shareholder to be required to include RPII in income (although there can be no assurance that this is or will continue be the case). However, proposed Treasury Regulations issued on January 24, 2022, if finalized in their current form, would for the first time (on a prospective basis) expand the definition of RPII to include certain intercompany insurance income (including reinsurance income) in a manner that could cause certain of our foreign subsidiaries not to satisfy the RPII 20% gross income exception. In such event, (1) as noted above, all U.S. shareholders (not just 10% U.S. Shareholders) would be required to include RPII in income currently, whether or not distributed, and (2) as noted below, U.S. shareholders that are tax exempt entities would be required to treat such RPII inclusions as unrelated business taxable income. Current and prospective U.S. holders should consult their own tax advisors as to the potential impact of these proposed Treasury Regulations.

Section 953(c)(7) of the Code generally provides that Section 1248 of the Code (which generally would require a U.S. holder to treat certain gains attributable to the sale, exchange or disposition of common shares or preferred shares as a dividend) will apply to the sale or exchange by a U.S. shareholder of shares in a foreign corporation that is characterized as a CFC under the RPII rules if the foreign corporation would be taxed as an insurance company if it were a U.S. corporation, regardless of whether the U.S. shareholder is a 10% U.S. Shareholder or whether the corporation qualifies for the RPII 20% gross income exception. Although existing Treasury Regulations do not

address the question, proposed Treasury Regulations issued in April 1991 create some ambiguity as to whether Section 1248 and the requirement to file Form 5471 would apply when the non-U.S. corporation has a foreign insurance subsidiary that is a CFC for RPII purposes and that would be taxed as an insurance company if it were a domestic corporation. We believe that Section 1248 and the requirement to file Form 5471 will not apply to a less than 10% U.S. Shareholder because Arch Capital is not directly engaged in the insurance business. There can be no assurance, however, that the IRS will interpret the proposed Treasury Regulations in this manner or that the Treasury will not take the position that Section 1248 and the requirement to file Form 5471 will apply to dispositions of our common shares or our preferred shares.

If the IRS or U.S. Treasury were to make Section 1248 of the Code and the Form 5471 filing requirement applicable to the sale of our shares, we would notify shareholders that Section 1248 of the Code and the requirement to file Form 5471 will apply to dispositions of our shares. Thereafter, we would send a notice after the end of each calendar year to all persons who were shareholders during the year notifying them that Section 1248 of the Code and the requirement to file Form 5471 apply to dispositions of our shares by U.S. holders. We would attach to this notice a copy of Form 5471 completed with all our information and instructions for completing the shareholder information.

Tax-Exempt Shareholders. Tax-exempt entities may be required to treat certain Subpart F insurance income, including RPII, that is includible in income by the tax-exempt entity as unrelated business taxable income. Current and prospective U.S. holders that are tax exempt entities should consult their own tax advisors as to the potential impact of the unrelated business taxable income provisions of the Code.

Passive Foreign Investment Companies. Sections 1291 through 1298 of the Code contain special rules applicable with respect to foreign corporations that are PFICs. In general, a foreign corporation will be a PFIC if 75% or more of its income constitutes “passive income” or 50% or more of its assets produce passive income. If we were to be characterized as a PFIC, U.S. holders would be subject to a penalty tax at the time of their sale of (or receipt of an “excess distribution” with respect to) their common shares or preferred shares imposed at the highest applicable rate under the Code for the applicable tax year. In general, a shareholder receives an “excess distribution” if the amount of the distribution is more than 125% of the average distribution with respect to the shares during the three preceding taxable years (or shorter period during which the taxpayer held the stock). In general, the penalty tax is equivalent to an interest charge on taxes that are deemed due during the period the shareholder owned the shares, computed by assuming that the excess distribution or gain (in the case of a sale) with respect

ARCH CAPITAL			38			2023 FORM 10-K

to the shares was taxable in equal portions throughout the holder’s period of ownership. The interest charge is equal to the applicable rate imposed on underpayments of U.S. federal income tax for such period. A U.S. shareholder may avoid some of the adverse tax consequences of owning shares in a PFIC by making a qualified electing fund (“QEF”) election. A QEF election is revocable only with the consent of the IRS and has the following consequences to a shareholder:

• For any year in which Arch Capital is a PFIC, the shareholder would include in its taxable income a proportionate share of the net ordinary income and net capital gains of Arch Capital and certain of its non-U.S. subsidiaries.

• For any year in which Arch Capital is not a PFIC, the shareholder would not be subject to the QEF inclusion regime described in the preceding paragraph for such taxable year.

For taxable years beginning on or before December 31, 2017, the determination of whether the active insurance company exception applies to an insurance company was made on a case-by-case basis and the analysis was inherently subjective. Under the Tax Cuts Act, for taxable years beginning after December 31, 2017, the active insurance company exception applies only if (i) the company would be taxed as an insurance company were it a U.S. corporation and (ii) either (A) loss and loss adjustment expense and certain reserves constitute more than 25% of the company’s gross assets for the relevant year or (B) loss and loss adjustment expenses and certain reserves constitute more than 10% of the company’s gross assets for the relevant year and, based on the applicable facts and circumstances, the company is predominantly engaged in an insurance business and the failure of the company to satisfy the preceding 25% test is due solely to run-off related or other specified circumstances involving the insurance business. The PFIC statutory provisions contain a look-through rule that states that, for purposes of determining whether a foreign corporation is a PFIC, such foreign corporation shall be treated as if it “received directly its proportionate share of the income” and as if it “held its proportionate share of the assets” of any other corporation in which it owns at least 25% of the stock. We believe that we were not a PFIC for any taxable year ended on or before December 31, 2023, and we currently are not expecting to become a PFIC for any subsequent taxable year. However, due to the complexity and uncertainty of the PFIC rules and the limited guidance interpreting them, there can be no assurance that we have not been a PFIC to date or that we will not become a PFIC at some time in the future. In addition, our U.S. counsel expresses no opinion with respect to our PFIC status for our current or future taxable years.

On December 4, 2020, the IRS issued certain final Treasury Regulations (the “2020 final PFIC insurance regulations”)

and revised proposed Treasury Regulations (the “2020 proposed PFIC insurance regulations”) regarding the application of the insurance company exception. While we believe that the 2020 final PFIC insurance regulations and the 2020 proposed PFIC insurance regulations should not adversely impact our ability to satisfy the insurance company exception and avoid being treated as a PFIC, there can be no assurance that such exception will in fact apply and/or will continue to apply at all times in the future. Each U.S. holder should consult its own tax advisor as to the effects of these rules.

Backup Withholding and Information Reporting. Payments of dividends and sales proceeds from a sale, exchange or other taxable disposition (including redemption) of our common shares or preferred shares that are made within the United States, by a U.S. payor or through certain U.S.-related financial intermediaries to a U.S. holder generally are subject to information reporting, unless the U.S. holder is a corporation or other exempt recipient, and if required, demonstrates that fact. In addition, such payments may be subject to backup withholding, unless (1) the U.S. holder is a corporation or other exempt recipient or (2) the U.S. holder provides a correct taxpayer identification number and certifies that it is not subject to backup withholding in the manner required. Backup withholding is not an additional tax. The amount of any backup withholding from a payment to a U.S. holder will generally be allowed as a credit against the U.S. holder’s U.S. federal income tax liability or may entitle the U.S. holder to a refund, provided that the required information is timely furnished to the IRS.

Foreign Financial Asset Reporting. Certain U.S. persons are required to report information relating to interests in “specified foreign financial assets”, including shares issued by a non-U.S. corporation, for any year in which the aggregate value of all specified foreign financial assets exceeds certain thresholds, subject to certain exceptions (including an exception for shares held in a custodial account maintained with a U.S. financial institution). Penalties may be imposed for a failure to disclose such information. U.S. holders are urged to consult their tax advisers regarding the effect, if any, of these additional reporting requirements on their ownership and disposition of our common shares or preferred shares.

United States Taxation of Non-U.S. Shareholders

Taxation of Dividends. Cash distributions, if any, made with respect to common shares or preferred shares held by a holder that is, for U.S. federal income tax purposes, an individual, corporation, estate or trust that is not a U.S. holder (a “Non-U.S. holder”) generally will not be subject to U.S. withholding tax (subject to certain exceptions that may apply if we were determined to be engaged in a trade or business in the United States and 25% or more of our gross

ARCH CAPITAL			39			2023 FORM 10-K

income were to be effectively connected to such U.S. trade or business).

Sale, Exchange or Other Disposition. Non-U.S. holders of common shares or preferred shares generally will not be subject to U.S. federal income tax with respect to gain recognized upon the sale, exchange or other disposition of such shares unless such gain is effectively connected with a U.S. trade or business of the Non-U.S. holder or such person is present in the U.S. for 183 days or more in the taxable year the gain is recognized and certain other requirements are satisfied.

Information Reporting and Backup Withholding. Non-U.S. holders of common shares or preferred shares will not be subject to U.S. information reporting or backup withholding with respect to dispositions of common or preferred shares effected through a non-U.S. office of a broker, unless the broker has certain connections to the U.S. or is a U.S. person. No U.S. backup withholding will apply to payments of dividends, if any, on our common shares or our preferred shares.

FATCA Withholding. Sections 1471 through 1474 to the Code, known as the Foreign Account Tax Compliance Act (“FATCA”), impose a withholding tax of 30% on U.S.-source interest, dividends and certain other types of income, which is received by a foreign financial institution (“FFI”), unless such FFI enters into an agreement with the IRS to obtain certain information as to the identity of the direct and indirect owners of accounts in such institution. In addition, a 30% withholding tax may be imposed on the above payments to certain non-financial foreign entities which do not (i) certify to each applicable withholding agent that they have no “substantial U.S. owners” (i.e., a U.S. 10% direct or indirect shareholder), or (ii) provide such withholding agent with the certain information as to the identity of such substantial U.S. owners. The U.S. has entered into intergovernmental agreements to implement FATCA (“IGAs”) with a number of jurisdictions. Bermuda has signed an IGA with the U.S. Different rules than those described above may apply under such an IGA.

Although dividends with respect to our common shares or preferred shares generally will be treated as foreign source for U.S. federal withholding tax purposes, it is unclear whether, for FATCA purposes, some or all of our dividends may be recharacterized as U.S. source dividends. Treasury Regulations addressing this topic have not yet been issued.

Current and prospective investors should consult their own tax advisors as to the filing and information requirements that may be imposed on them in respect of their ownership of our common share or preferred shares.

Other Tax Laws. Shareholders should consult their own tax advisors with respect to the applicability to them of the tax laws of other jurisdictions.