PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT
PREPARED AT THE DIRECTION OF COUNSEL
NOTICE: This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of counsel for Quorum Insurance Holdings Corp. It is intended solely for the use of the Audit & Compliance Committee of the Board of Directors, and the individuals identified below. This memorandum contains confidential legal analysis, mental impressions, conclusions, and recommendations of counsel. Any disclosure, copying, distribution, or use of this memorandum or its contents by any person other than the intended recipients is strictly prohibited and may constitute a waiver of applicable privileges. If you have received this memorandum in error, please notify Marcus Delgado at Calderwood & Harkness LLP immediately at (212) 556-7200.
October 28, 2025
Right-click to update Table of Contents
I. Executive Summary
Calderwood & Harkness LLP ("C&H") was retained on August 19, 2025, pursuant to the August 12, 2025 directive of the Audit & Compliance Committee (the "Committee") of the Board of Directors of Quorum Insurance Holdings Corp. ("QIH" or the "Company"), to conduct a comprehensive market-conduct compliance refresh across all of QIH's regulated insurance subsidiaries and its managing general agent affiliate. This engagement replaced the prior outside regulatory counsel engagement with Hargrove & Sattler LLP, which concluded in June 2025. The Committee determined that a fresh, independent assessment was warranted in light of the scope and severity of the regulatory findings and internal audit deficiencies described in detail below.
The engagement is structured across four phases spanning approximately twenty-three (23) weeks, from August 19, 2025 through January 30, 2026. The scope of the engagement encompasses all three of QIH's licensed carrier subsidiaries — Quorum Indemnity Insurance Company ("QIIC," NAIC No. 41927, licensed in 28 states), Quorum Specialty Underwriters, Inc. ("QSU," NAIC No. 53812, licensed in 22 states), and Quorum Life & Annuity Company ("QLA," NAIC No. 67403, licensed in 19 states) — as well as Pinnacle Bridge MGA, LLC ("Pinnacle Bridge"), QIH's fintech distribution platform operating as a managing general agent and surplus lines broker licensed in 34 states. In total, the three carrier subsidiaries hold 79 state licenses across 38 unique states after de-duplication, presenting a complex, multi-jurisdictional regulatory landscape.
Phase 1 (Assessment & Gap Analysis) was completed on target on October 3, 2025. Phase 2 (Remediation & Policy Drafting) commenced on October 6, 2025 and is currently in progress, with a target completion date of November 14, 2025. Phases 3 (Training & Implementation) and 4 (Examination Preparation) remain on schedule for commencement in November and December 2025, respectively.
The key regulatory exposures confronting QIH are substantial and time-sensitive. The Florida Office of Insurance Regulation ("FL OIR") has imposed a Corrective Action Plan ("CAP") on QIIC, with a compliance certification deadline of December 31, 2025. The California Department of Insurance ("CDI") issued an Order to Show Cause on June 18, 2025, with a hearing that was scheduled for October 14, 2025. Additionally, C&H anticipates follow-up examinations by FL OIR, CDI, and the New York Department of Financial Services ("NYDFS") in Q4 2025 and Q1 2026. Each of these regulatory actions requires coordinated remediation, strategic engagement, and rigorous preparation.
Total regulatory penalties paid and assessed to date amount to $455,000, comprising a $275,000 civil penalty paid to the Connecticut Department of Insurance ("CTDOI") on July 15, 2025, and a $180,000 administrative fine assessed by FL OIR with a payment due date of September 30, 2025. Additional penalty exposure from the CDI Order to Show Cause remains uncertain pending the outcome of the hearing.
The total estimated cost of the remediation effort — including outside counsel fees, consulting fees, internal personnel reallocation, and technology upgrades — is $2,100,000. While material, this figure represents a modest investment relative to QIH's financial profile and is, in the view of C&H, both proportionate and necessary given the severity and breadth of the identified deficiencies.
Internal Audit Report No. IA-2025-017, issued August 4, 2025 by Neil Granger, Director of Internal Audit, rated the overall market-conduct compliance program as "Needs Significant Improvement," the second-lowest rating on QIH's five-tier internal audit assessment scale. This rating, combined with the FL OIR examination findings and the CDI enforcement action, underscores the critical nature of the compliance refresh currently underway.
The purpose of this memorandum is to provide the Committee with a comprehensive status update on the remediation effort, detail Phase 1 findings and Phase 2 progress, identify residual risks and anticipated regulatory proceedings, and recommend ongoing governance enhancements to ensure sustained compliance improvement beyond the conclusion of the C&H engagement.
II. Background and Engagement Overview
A. Triggering Events
The current compliance refresh engagement was precipitated by a series of interconnected regulatory and internal events spanning approximately two years.
In September 2023, the Connecticut Department of Insurance initiated a coordinated multi-state market-conduct examination of Quorum Indemnity Insurance Company under the National Association of Insurance Commissioners ("NAIC") Market Regulation protocols. Pursuant to the NAIC's coordination framework, the Florida Office of Insurance Regulation was designated as the lead examining state, with CTDOI, CDI, and the departments of insurance in Illinois, Ohio, and several additional states participating in the coordinated review. The examination covered the three-year period from January 1, 2021 through December 31, 2023, focusing on QIIC's claims-handling practices, advertising and marketing activities, complaint-handling procedures, and overall market-conduct compliance infrastructure.
The examination proceeded through late 2023 and into 2024, with FL OIR's examination staff conducting on-site and remote reviews of QIIC's records, policies, and procedures. On May 12, 2025, FL OIR issued its final examination report, containing fourteen (14) formal findings distributed across three categories: claims-handling timeliness (six findings), advertising and marketing violations (five findings), and complaint-handling procedures (three findings). The findings were both individually and collectively significant, reflecting systemic deficiencies in QIIC's market-conduct compliance program rather than isolated lapses.
On June 18, 2025, separately and in parallel with the FL OIR examination, the California Department of Insurance issued an Order to Show Cause directed at QIIC regarding advertising violations in the State of California. The CDI action focused on non-filed digital advertisements containing rate comparisons that were disseminated within California without the required prior filings and approvals. An administrative hearing was scheduled for October 14, 2025.
Internally, the Company's Internal Audit department, led by Neil Granger, Director of Internal Audit, conducted an independent review of the market-conduct compliance program across all three carrier subsidiaries. Internal Audit Report No. IA-2025-017, issued on August 4, 2025, identified twenty-three (23) control deficiencies across QIIC, QSU, and QLA. The report found substantial overlap with the FL OIR examination findings but also identified additional deficiencies in QSU and QLA that had not been subject to the FL OIR examination. The report assigned an overall rating of "Needs Significant Improvement" — the second-lowest tier on QIH's five-tier internal audit assessment scale (the tiers being, from highest to lowest: "Strong," "Satisfactory," "Needs Improvement," "Needs Significant Improvement," and "Unsatisfactory").
In light of the FL OIR final examination report, the CDI enforcement action, and the Internal Audit findings, the QIH Board Audit & Compliance Committee convened a special session on August 12, 2025. At that session, chaired by Margaret Aldworth, the Committee concluded that the Company's prior outside regulatory counsel, Hargrove & Sattler LLP — whose engagement had concluded in June 2025 — had not achieved the level of remediation required to address the breadth and severity of the identified deficiencies. The Committee accordingly directed management to retain new outside counsel to conduct a comprehensive market-conduct compliance refresh with a clearly defined scope, phased timeline, and measurable deliverables.
B. Engagement Structure
Pursuant to the Committee's August 12, 2025 directive, QIH retained Calderwood & Harkness LLP effective August 19, 2025. The C&H engagement team is composed of the following professionals:
• Marcus Delgado, Responsible Partner (billing rate: $1,150/hr). Mr. Delgado leads C&H's Insurance Regulatory Practice and has over twenty-five years of experience advising insurance holding companies on market-conduct compliance, regulatory examinations, and enforcement proceedings before state insurance regulators nationwide.
• Catherine Bloom, Billing Partner (billing rate: $1,075/hr). Ms. Bloom serves as the billing partner for the engagement and provides strategic oversight, particularly with respect to the CDI Order to Show Cause proceedings and NYDFS-related compliance matters.
• Carlos Espinoza, Lead Associate (billing rate: $725/hr). Mr. Espinoza serves as the day-to-day engagement manager, coordinating work streams, managing deliverables, and liaising with QIH management and internal counsel.
• Hannah Brinkley, Working Associate (billing rate: $585/hr). Ms. Brinkley is responsible for research, drafting, and coordination of the training program (Phase 3), and supports document production and examination preparation.
The fee arrangement is structured on a hybrid basis. Phase 1 (Assessment & Gap Analysis) was billed on an hourly basis subject to a soft cap of $185,000. Phases 2 through 4 (Remediation & Policy Drafting, Training & Implementation, and Examination Preparation) are being billed at a combined fixed fee of $410,000. The total engagement budget is therefore $595,000. This arrangement was negotiated to provide cost certainty for the bulk of the engagement while allowing flexibility for the intensive assessment phase.
In addition to C&H, QIH has separately retained two additional service providers to support the compliance refresh:
• Ridgeline Consulting Group, LLC (Sandra Whitfield, Managing Director), retained by QIH for statistical claims-file sampling and complaint-ratio benchmarking, at a fee of $340,000. Ridgeline brings deep expertise in NAIC-standard statistical sampling methodologies and has performed similar work for other multi-state insurance groups.
• Cartwright & Eddings, P.A. (Rosa Delacroix, Lead Attorney), engaged as Florida local regulatory counsel for the FL OIR examination response and CAP implementation. Cartwright & Eddings maintains a well-established practice before FL OIR and brings valuable institutional knowledge and relationships that complement C&H's national regulatory practice.
C. Four-Phase Work Plan Timeline
The C&H engagement is organized into four sequential but overlapping phases, designed to move efficiently from assessment through remediation, training, and examination preparation within the timeframe dictated by the FL OIR CAP compliance certification deadline of December 31, 2025:
Phase 1 — Assessment & Gap Analysis: August 19, 2025 through October 3, 2025 (6.5 weeks). This phase encompassed a comprehensive review of all FL OIR examination findings, the CDI Order to Show Cause, Internal Audit Report No. IA-2025-017, and the existing compliance policies, procedures, and infrastructure across all three carriers and Pinnacle Bridge. The Phase 1 assessment memorandum was delivered to the Committee on October 3, 2025 and is attached hereto as Appendix A. STATUS: COMPLETED.
Phase 2 — Remediation & Policy Drafting: October 6, 2025 through November 14, 2025 (5.5 weeks). This phase involves the drafting and finalization of revised standard operating procedures ("SOPs"), the comprehensive revision of the Market-Conduct Compliance Manual, preparation of regulatory response materials, and implementation of interim remedial measures. STATUS: IN PROGRESS.
Phase 3 — Training & Implementation: November 17, 2025 through December 5, 2025 (2.5 weeks). This phase will deliver organization-wide training across three specialized tracks, ensure employee certification, and verify the operational implementation of the revised SOPs and compliance procedures. STATUS: UPCOMING.
Phase 4 — Examination Preparation: December 8, 2025 through January 30, 2026 (7.5 weeks). This phase will focus on preparing QIH and its subsidiaries for anticipated follow-up examinations by FL OIR, CDI, and NYDFS, including mock examination exercises, document production preparation, and witness preparation. STATUS: UPCOMING.
III. Phase 1 Assessment Findings and Remediation Priorities
The Phase 1 assessment, detailed in the Preliminary Assessment Memorandum delivered on October 3, 2025 (Appendix A), involved an exhaustive review of regulatory examination materials, internal audit findings, existing compliance policies and procedures, claims-handling data, advertising archives, and complaint logs across all three carrier subsidiaries and Pinnacle Bridge. The following sections summarize the key findings organized by category and identify the remediation priorities that are driving the Phase 2 work currently underway.
A. FL OIR Examination Report — Summary of 14 Formal Findings
The FL OIR Final Examination Report, dated May 12, 2025, identified fourteen (14) formal findings across three categories. C&H's Phase 1 assessment validated each finding, evaluated the root causes, and assessed the broader systemic implications for the Quorum enterprise.
1. Claims-Handling Timeliness (6 Findings)
The claims-handling timeliness category accounted for six of the fourteen formal findings and represents the single most significant area of regulatory exposure. The examination universe comprised a total of 12,400 claims files processed by QIIC during the examination period of January 1, 2021 through December 31, 2023. The FL OIR examiners selected a statistical sample of 625 files, representing a sample rate of 5.04%, consistent with NAIC Market Regulation Handbook sampling protocols.
Of the 625 sampled files, 74 files — representing an error rate of 11.8% — were found to contain one or more deficiencies related to claims-handling timeliness. This error rate substantially exceeds the generally accepted threshold for a satisfactory market-conduct examination result, which most regulators consider to be in the range of 5% to 7%.
The specific deficiencies identified within the claims-handling findings include:
(a) Late Acknowledgment Letters. QIIC's average claims acknowledgment time, as measured across QIIC's full claims inventory during fiscal year 2024, was 18.7 business days. This average significantly exceeds the statutory maximums applicable in the states where QIIC operates, which range from 10 to 15 business days depending on the jurisdiction. The most stringent standard — 10 business days — applies in several of QIIC's key domiciliary and operational states, including New York and Florida. The 18.7-day average represents a systemic failure to meet baseline regulatory expectations, not merely an isolated processing issue.
(b) Missed Investigation Deadlines. Multiple sampled files reflected failures to complete claims investigations within the timeframes prescribed by applicable state statutes and regulations. In several instances, investigation activities were not documented for periods exceeding 30 calendar days, creating gaps in the claims file that examiners cited as evidence of inadequate claims management practices.
(c) Failure to Document Claim Status Updates. QIIC's claims management system did not enforce documentation of interim claim status updates at the intervals required by certain state regulations. As a result, a significant number of sampled files lacked contemporaneous evidence that claimants were kept informed of the status of their claims, even where the underlying processing may have been occurring.
(d) Timely Claims Payment Rate. QIIC's timely claims payment rate for fiscal year 2024 — defined as the percentage of claims paid within the applicable statutory prompt-pay window — stood at 74.2%. This figure falls well short of QIIC's own internal target of 95% and reflects a material compliance gap. The deficiency is particularly pronounced in those states with the most aggressive prompt-pay windows, including Florida (which requires payment within 20 calendar days of proof of loss for most claim types) and New York (governed by NYDFS Regulation 64, discussed in Section VI below).
The six claims-handling findings collectively reflect deficiencies that are systemic in nature. Root cause analysis conducted during Phase 1 identified the following contributing factors: (i) insufficient claims adjuster staffing relative to claims volume growth; (ii) inadequate system-level alerts and escalation triggers within QIIC's legacy claims management system; (iii) absence of standardized claims-handling protocols keyed to state-specific regulatory requirements; and (iv) limited supervisory review and quality assurance processes within the claims operations function.
2. Advertising and Marketing Violations (5 Findings)
Five of the fourteen formal findings relate to advertising and marketing violations, reflecting a significant failure of QIIC's advertising compliance controls. During the course of the examination and the parallel CDI investigation, a total of 43 unique non-compliant digital advertising creatives were identified across multiple digital channels, including Severin Industries search and display advertising, Meta (Kestrel Services Inc. and Northpoint Services Inc.) advertising, and programmatic display channels served through third-party demand-side platforms.
The non-compliant advertisements included unapproved or non-filed rate comparisons disseminated in four states: Florida, California, Illinois, and Ohio. Each of these states requires prior filing and, in some cases, prior approval of insurance advertising materials that contain rate comparisons or competitive claims. The non-compliant advertising was disseminated over a period of approximately 32 months, from March 2022 through November 2024, representing a prolonged and systemic compliance failure.
Of the 43 non-compliant ad creatives, 31 — representing 72.1% of the total — were created and placed by Pinnacle Bridge MGA, LLC's in-house marketing team. These advertisements were published without being routed through QIIC's advertising compliance review process. This finding is of particular significance because it reveals a critical gap in the governance and oversight framework between QIIC, as the licensed carrier, and Pinnacle Bridge, as its managing general agent and fintech distribution platform.
Pinnacle Bridge operates as a technology-driven distribution channel for QIIC and QSU, managing approximately $890 million in premium during fiscal year 2024. Despite the scale of Pinnacle Bridge's operations and its direct engagement with consumers through digital marketing channels, the entity operated without adequate advertising compliance controls and without a formalized linkage to the carrier's compliance function for advertising review and approval. The MGA agreement between QIIC and Pinnacle Bridge contained only general compliance obligations and did not include specific advertising review and filing requirements, pre-publication approval workflows, or compliance reporting mechanisms.
The five advertising and marketing findings thus reflect not only individual creative-level violations but also a structural deficiency in the relationship between the carrier and its MGA — a deficiency that, if left unremediated, could expose QIH to continued regulatory risk across all 34 states in which Pinnacle Bridge holds licenses.
3. Complaint-Handling Procedures (3 Findings)
The remaining three formal findings relate to QIIC's complaint-handling procedures. The FL OIR examiners identified failures to log and respond to consumer complaints within the statutory deadlines applicable in three states. The deficiencies in this category are particularly concerning when viewed against QIIC's complaint ratios relative to industry benchmarks.
QIIC's 2024 complaint ratio — measured as the number of complaints per 1,000 policies in force — was 1.47. This ratio exceeds the NAIC median complaint ratio of 0.82 by 79.3%, placing QIIC well above the industry norm. While QSU and QLA exhibited lower complaint ratios (0.93 and 1.12 per 1,000 policies, respectively), both also exceed the NAIC median, by 13.4% and 36.6% respectively. In total, consumer complaints filed against all three QIH subsidiaries during 2024 amounted to 2,847 individual complaints.
The specific deficiencies identified within the complaint-handling findings include:
(a) Incomplete Complaint Logging. Consumer complaints received through certain intake channels — including email, web portal submissions, and social media communications — were not consistently logged into QIIC's complaint tracking system. The absence of a centralized, comprehensive complaint log meant that some complaints were handled informally by customer service representatives without being recorded, tracked, or reported to regulators as required.
(b) Lack of Centralized Tracking System. QIIC did not maintain a single, enterprise-wide complaint tracking system. Instead, complaints were tracked in separate spreadsheets, email folders, and departmental databases, making it impossible to generate reliable complaint data for regulatory reporting, trend analysis, or management oversight.
(c) Inconsistent Response Timelines. Even where complaints were logged, response timelines varied significantly and did not consistently conform to state-specific requirements. Several states mandate initial acknowledgment of consumer complaints within defined windows (ranging from 3 to 15 business days), and QIIC's response practices did not systematically account for these varying requirements.
The elevated complaint ratios, when combined with the procedural deficiencies in complaint logging and response, present a compounding risk: not only is QIIC receiving a disproportionately high volume of complaints, but it lacks the infrastructure to manage and respond to those complaints in a manner that satisfies regulatory expectations. This dynamic, if not corrected, is likely to draw continued and heightened regulatory scrutiny.
B. Internal Audit Report Correlation
Internal Audit Report No. IA-2025-017, prepared by Neil Granger, Director of Internal Audit, and issued on August 4, 2025, provides an independent internal perspective that substantially corroborates the FL OIR examination findings while also expanding the identified universe of control deficiencies beyond QIIC to encompass QSU and QLA.
The report identified a total of 23 control deficiencies distributed across all three carrier subsidiaries. There is substantial overlap between the Internal Audit findings and the 14 formal findings in the FL OIR examination report, confirming that the deficiencies identified by the regulators are not artifacts of examination methodology but rather reflect genuine weaknesses in the compliance program. However, the Internal Audit report also identified additional deficiencies in areas not covered by the FL OIR examination, including QSU-specific underwriting documentation gaps, QLA-specific policyholder communication failures, and enterprise-wide information technology control weaknesses affecting data integrity within the compliance management system.
The overall rating of "Needs Significant Improvement" reflects the Internal Audit department's assessment that the weaknesses are systemic — involving governance, monitoring, and documentation shortcomings that pervade the compliance program rather than being confined to isolated processes or functions. This rating served as a critical input to the Committee's decision to authorize the comprehensive compliance refresh that C&H is now conducting.
C. Identified Remediation Priorities
Based on the Phase 1 assessment, C&H has identified four tiers of remediation priority, which are driving the Phase 2 work plan and resource allocation:
Priority 1 — Claims-Handling Timeliness. This is the highest-priority remediation area, given the breadth of the FL OIR findings (six of fourteen), the magnitude of the performance gap (18.7-day average acknowledgment against a 10-business-day standard in the most stringent jurisdictions), and the direct nexus to consumer harm. The remediation objective is to reduce average acknowledgment time to 10 business days or fewer and to increase the timely payment rate from 74.2% toward the 95% internal target. Achievement of these targets will require a combination of revised SOPs, technology enhancements (system-level alerts and escalation triggers), staffing adjustments, and supervisory process improvements.
Priority 2 — Advertising Compliance. The advertising remediation must address both the specific violations and the structural governance gap with Pinnacle Bridge. The Phase 2 deliverables include a centralized pre-publication advertising review workflow applicable to all marketing content, with a dedicated module governing Pinnacle Bridge MGA's advertising activities. In addition, retroactive filings are being prepared in Florida, California, Illinois, and Ohio for the previously non-filed advertisements, to the extent such filings remain available and advisable.
Priority 3 — Complaint Management. The complaint-handling remediation focuses on implementing a 24-hour complaint logging standard across all intake channels, establishing a 3-business-day acknowledgment window for all complaints (aligned with the most stringent state requirement), and deploying state-specific response deadline protocols. This priority also encompasses the procurement and implementation of a centralized complaint-tracking platform to replace the fragmented and informal tracking practices currently in use.
Priority 4 — Technology and Systems. Underlying each of the first three priorities is a need for technology investment. The claims management system requires enhanced alerts and workflow automation to enforce timeliness standards. The advertising review process requires a workflow management tool to ensure all creatives are routed through compliance review before publication. And the complaint-tracking function requires a dedicated platform with regulatory reporting capabilities. The technology budget of $680,000 (see Section VII.B below) addresses these needs.
IV. Florida Office of Insurance Regulation — CAP Implementation Status
A. CAP Timeline and Milestones
On July 1, 2025, QIIC submitted a Corrective Action Plan to FL OIR in response to the fourteen formal findings contained in the final examination report. The CAP outlined QIIC's proposed remediation steps, responsible personnel, and implementation timelines for each finding.
On July 28, 2025, FL OIR accepted the CAP with certain modifications. The modifications principally involved the acceleration of certain milestone dates and the addition of enhanced reporting and documentation requirements. As modified and accepted, the CAP establishes a final deadline of December 31, 2025, by which date QIIC must have completed all remediation actions and submitted a compliance certification to FL OIR. The compliance certification must be signed by an officer of QIIC attesting to the completion of all remediation steps and the implementation of controls sufficient to prevent recurrence of the identified deficiencies.
The following QIH personnel have been designated as responsible for CAP implementation across the three categories of findings:
• Thomas Raeburn, Senior Vice President, Claims Operations — responsible for all six claims-handling timeliness findings, including revision of claims acknowledgment and prompt-pay procedures, claims adjuster workflow redesign, and claims management system enhancement.
• Lena Fujimoto, Director, Market Conduct & Consumer Affairs — responsible for the three complaint-handling findings, including implementation of the centralized complaint-tracking system, revised complaint response procedures, and complaint-ratio reduction initiatives.
• Priya Venkatesh, Vice President, Regulatory Affairs — responsible for the five advertising and marketing findings and for overall CAP coordination, including preparation and submission of the compliance certification to FL OIR.
B. Current Progress Against CAP Milestones
As of the date of this memorandum, Phase 2 remediation work is actively underway, and meaningful progress has been achieved against the CAP milestones:
Claims-Handling Remediation. C&H has completed a draft of the revised Claims Acknowledgment and Prompt-Pay Standard Operating Procedure, which establishes state-specific acknowledgment and payment timelines keyed to the most stringent applicable deadline, with system-alert escalation triggers at defined intervals (e.g., alerts at 50%, 75%, and 90% of the applicable deadline window). The system-alert configuration specifications are currently under development by QIH's IT department in coordination with the claims management system vendor. Thomas Raeburn is leading a parallel effort to redesign the claims adjuster workflow to reduce processing bottlenecks and improve throughput without sacrificing quality. The revised SOP is expected to be finalized by November 7, 2025, with system-alert implementation targeted for completion by December 1, 2025 — ahead of the CAP compliance certification deadline.
Advertising Remediation. C&H has drafted a comprehensive Advertising Review and Filing Standard Operating Procedure that establishes a centralized pre-publication review workflow for all advertising materials produced by or on behalf of QIIC, QSU, and QLA, including a dedicated module governing Pinnacle Bridge MGA's advertising activities. Under the revised procedure, all advertising creatives must be routed through the carrier's compliance function for review, state-specific filing determination, and approval prior to publication. The SOP includes clear escalation pathways for non-compliance and provides for periodic audits of Pinnacle Bridge's marketing output. Retroactive filings of previously non-filed advertising materials are currently underway in Florida, California, Illinois, and Ohio. Priya Venkatesh is coordinating these filings with the respective state insurance departments and with Rosa Delacroix of Cartwright & Eddings, P.A. for the Florida filings specifically.
Complaint-Handling Remediation. C&H has drafted a revised Complaint Response Standard Operating Procedure establishing a 24-hour logging requirement for all consumer complaints received through any intake channel, a 3-business-day acknowledgment window, and state-specific response deadlines calibrated to each jurisdiction's requirements. Lena Fujimoto is overseeing the implementation of a centralized complaint-tracking platform, with vendor selection expected to be completed by November 8, 2025 and initial deployment targeted for December 1, 2025. In the interim, QIIC has implemented manual processes to ensure that all complaints are logged within 24 hours and acknowledged within 3 business days, pending deployment of the automated system.
Remaining Phase 2 and Phase 3 Work. The revised SOPs are expected to be finalized during the remainder of Phase 2 (target completion: November 14, 2025). Phase 3 training delivery (November 17 through December 5, 2025) will ensure that all affected personnel are trained on the revised procedures before the December 31, 2025 compliance certification deadline. Technology upgrades — particularly the claims management system alerts and the centralized complaint-tracking platform — are targeted for deployment by December 1, 2025, allowing approximately four weeks of operational use before the certification date.
C. FL OIR Administrative Fine
FL OIR assessed a $180,000 administrative fine against QIIC in connection with the examination findings. The payment was due on September 30, 2025. As of the date of this memorandum, the fine has been paid in full. This payment follows the earlier payment of the CTDOI civil penalty of $275,000, which was satisfied on July 15, 2025. The combined regulatory penalties paid to date total $455,000.
D. Compliance Progress Report to FL OIR
C&H has prepared a draft letter to FL OIR, for signature by Priya Venkatesh in her capacity as Vice President, Regulatory Affairs, reporting on QIIC's remediation progress under the CAP. The letter details the steps taken and in progress across all three categories of findings, identifies the remaining milestones, and provides a timeline for completion of all remediation actions ahead of the December 31, 2025 certification deadline. C&H recommends that this progress letter be submitted to FL OIR on or before November 30, 2025, approximately one month before the certification deadline, to demonstrate proactive engagement and good-faith compliance efforts. Rosa Delacroix of Cartwright & Eddings, P.A. (Orlando, Florida) is coordinating all Florida-specific regulatory filings and communications, and will review and co-sign the progress letter as appropriate.
The final compliance certification is anticipated to be prepared by C&H during Phase 4, with a target submission date of no later than December 29, 2025, allowing a margin of two business days before the December 31, 2025 deadline.
V. California Department of Insurance — Order to Show Cause
A. Background
On June 18, 2025, the California Department of Insurance issued an Order to Show Cause directed at QIIC regarding advertising violations within the State of California. The CDI action is related to, but distinct from, the FL OIR examination findings, and focuses specifically on a subset of the 43 non-compliant digital advertising creatives that were disseminated in California without the required filings under California Insurance Code provisions governing insurance advertising. The non-filed advertisements at issue contained rate comparisons and competitive claims that, under California law, required prior filing with CDI before publication.
The CDI Order to Show Cause represented an independent regulatory action that, while arising from the same factual circumstances as the broader FL OIR coordinated examination, carries its own procedural posture, evidentiary standards, and penalty exposure. An administrative hearing was scheduled for October 14, 2025, before a CDI Administrative Law Judge.
B. Hearing Strategy Summary
C&H prepared a detailed hearing strategy memorandum (privileged and confidential, not appended to this memorandum due to the sensitivity of the litigation strategy content). The recommended approach, which was reviewed and approved by the Committee and QIH management, focused on the following elements:
(a) Demonstration of Good-Faith Remediation. The hearing strategy emphasizes QIIC's proactive and comprehensive remediation efforts, including the retention of new outside counsel, the Phase 1 assessment, the development of revised advertising compliance procedures, and the retroactive filing of previously non-filed advertising materials in California.
(b) Presentation of Revised Advertising Procedures. The revised Advertising Review and Filing SOP, currently being finalized as a Phase 2 deliverable, was presented at the hearing as mitigating evidence demonstrating QIIC's commitment to preventing recurrence. The SOP's Pinnacle Bridge-specific module was highlighted to show that QIIC has addressed the structural governance gap that contributed to the original violations.
(c) Witness Preparation. Lena Fujimoto (Director, Market Conduct & Consumer Affairs) and Priya Venkatesh (Vice President, Regulatory Affairs) were prepared to provide testimony regarding the scope and nature of the remediation efforts, the root cause analysis conducted during Phase 1, and the specific controls being implemented to ensure future compliance. Witness preparation sessions were conducted by Mr. Delgado and Mr. Espinoza in early October 2025.
(d) Settlement Posture. C&H evaluated the advisability of seeking a negotiated resolution prior to the hearing and recommended proactive engagement with CDI staff to explore the possibility of a consent agreement or stipulated resolution. The potential penalty exposure under applicable California Insurance Code provisions was assessed and communicated to the Committee in a separate privileged communication.
C. Status Update
The CDI administrative hearing took place as scheduled on October 14, 2025. QIIC appeared through counsel (Marcus Delgado and Carlos Espinoza of C&H) and presented testimony and documentary evidence consistent with the hearing strategy described above. Lena Fujimoto and Priya Venkatesh testified on behalf of QIIC. The CDI Administrative Law Judge took the matter under advisement, and a decision is expected within 45 to 60 days of the hearing date, which would place the expected decision in the late November to mid-December 2025 timeframe. C&H will provide the Committee with an update promptly upon receipt of the decision.
In the meantime, C&H has continued to finalize the revised advertising compliance procedures specifically addressing CDI requirements, including California-specific filing protocols and pre-publication review standards. These procedures are incorporated into the broader Phase 2 deliverables and will be implemented during Phase 3 training.
VI. NYDFS Regulation 64 Compliance Posture
The New York Department of Financial Services Regulation 64 (11 NYCRR Part 216) governs claims prompt-pay requirements for insurers operating in the State of New York. Regulation 64 imposes specific timeframes for acknowledgment of claims, investigation, and payment, and provides for penalties and enforcement actions in the event of non-compliance. As a property-casualty insurer licensed in New York, QIIC is subject to Regulation 64 with respect to all claims arising under policies issued or delivered in New York.
The Phase 1 assessment identified gaps in QIIC's compliance with Regulation 64 timeliness standards that are consistent with, and indeed a product of, the broader claims-handling timeliness deficiencies described in Section III.A.1 above. Specifically, QIIC's average claims acknowledgment time of 18.7 business days significantly exceeds the 10-business-day acknowledgment requirement under Regulation 64. Similarly, the timely claims payment rate of 74.2% is likely below Regulation 64 standards, although the precise New York-specific performance has not yet been isolated from the aggregate data. Ridgeline Consulting Group is in the process of stratifying claims-handling performance data by state, which will provide a more precise assessment of QIIC's New York-specific compliance posture.
The revised Claims Acknowledgment and Prompt-Pay SOP being drafted during Phase 2 explicitly incorporates Regulation 64 requirements, including the 10-business-day acknowledgment window, the 30-calendar-day investigation period, and the payment timeframes specified in the regulation. The SOP is designed to key system-level alerts to the most stringent applicable deadline for each claim based on the jurisdiction of the underlying policy, ensuring that Regulation 64 requirements are met as a default baseline.
C&H anticipates that NYDFS may initiate a follow-up examination of QIIC in Q1 2026, potentially in coordination with or following the FL OIR CAP verification review. NYDFS has historically been an active market-conduct regulator, and the availability of the FL OIR examination results — which are shared among participating states under the NAIC coordinated examination protocol — may prompt NYDFS to conduct its own targeted review. Accordingly, Phase 4 examination preparation will include NYDFS-specific mock examination exercises, including simulation of document requests and examiner interviews focused on Regulation 64 compliance.
VII. Financial Summary — Penalties and Remediation Costs
A. Regulatory Penalties Paid and Assessed
The following table summarizes the regulatory penalties paid and assessed to date in connection with the market-conduct examination findings and enforcement actions:
In addition to the penalties reflected above, QIIC faces potential additional penalty exposure arising from the CDI Order to Show Cause. The amount of any potential CDI penalty is not determinable at this time, as the CDI Administrative Law Judge has taken the matter under advisement following the October 14, 2025 hearing. C&H will advise the Committee promptly when the decision is issued.
The Committee should also be aware that if QIIC fails to achieve compliance with the FL OIR CAP by the December 31, 2025 deadline, additional penalties and potential license-related sanctions could follow. Similarly, if QSU or QLA are subjected to independent market-conduct examinations, additional findings and penalties are possible. These contingent exposures are not quantified in the table above but are addressed in the Residual Risk Assessment in Section IX.
B. Total Estimated Remediation Cost
The total estimated cost of the comprehensive market-conduct compliance refresh, including all professional fees, internal costs, and technology investments, is $2,100,000, broken down as follows:
The Ridgeline Consulting Group fees cover the engagement period through January 2026, including the claims-file sampling and complaint-ratio benchmarking work that will support Phase 4 examination preparation and the FL OIR CAP compliance certification. The internal FTE reallocation costs represent an estimate of the opportunity cost of management and staff time dedicated to remediation activities that would otherwise be allocated to revenue-generating or other operational functions. The technology/systems upgrade budget of $680,000 encompasses capital and implementation costs for the three technology components identified in Section III.C as Priority 4 remediation items.
A detailed remediation cost breakdown is provided in Appendix G.
C. Context Against QIH Financial Position
To place the remediation costs in appropriate context, the following financial data points are relevant:
• QIH reported total revenue of $4.92 billion and net income of $318 million for fiscal year 2024.
• QIH's approximate market capitalization was $2.8 billion as of August 2025 (Nasdaq: QIHC).
• Annual gross written premium ("GWP") for fiscal year 2024 was $4.16 billion, consisting of $2.14 billion in direct written premium ("DWP") written by QIIC, $1.38 billion in DWP written by QSU, and $640 million in DWP written by QLA. Of the combined QIIC/QSU premium, approximately $890 million was managed through the Pinnacle Bridge MGA platform.
• QIH's compliance department annual budget for fiscal year 2025 is $12.4 million.
• The total remediation cost of $2,100,000 represents approximately 16.9% of the compliance department's annual budget and approximately 0.66% of QIH's 2024 net income.
While the remediation cost is significant in absolute terms, it is manageable in the context of QIH's financial position. The Committee should view this investment as both necessary and proportionate given the severity of the regulatory findings and the potential for substantially greater financial exposure if remediation is not completed in a timely and thorough manner.
D&O Insurance Coverage. QIH maintains directors and officers liability insurance through Ashford Mutual Insurance Group. The current policy provides limits of $25 million per occurrence and $50 million in the aggregate, subject to a $1 million self-insured retention. C&H has evaluated the potential applicability of the D&O policy in the event that the regulatory actions and associated compliance failures give rise to shareholder litigation, regulatory derivative exposure, or personal liability claims against directors and officers. The coverage analysis is addressed in greater detail in Section X.E below. At this time, C&H recommends that Derek Mallory, as General Counsel, ensure that timely notice of the regulatory proceedings has been provided to Ashford Mutual, to the extent required under the policy's notice provisions.
VIII. Training Program Status
A. Overview
Phase 3 of the engagement — Training & Implementation — is scheduled for November 17, 2025 through December 5, 2025, a window of approximately 2.5 weeks. The training program is a critical component of the overall remediation effort, as it will operationalize the revised SOPs and compliance procedures drafted during Phase 2 and ensure that all affected personnel understand and can apply the new requirements in their daily work.
The total training audience encompasses approximately 815 full-time equivalent employees across three specialized training tracks. The training program has been designed to deliver targeted, role-specific content to each audience segment, ensuring that the training is practical, relevant, and immediately applicable.
B. Training Tracks
The following table summarizes the three training tracks, their target audiences, approximate headcounts, and content focus areas:
C. Delivery and Certification
The training program will be delivered through a combination of live webinar sessions and recorded on-demand modules. Live sessions will be conducted by C&H attorneys, QIH compliance personnel, and Ridgeline Consulting Group subject matter experts. Recorded modules will be available for employees unable to attend live sessions, ensuring full coverage across all shifts, locations, and time zones.
Each training track will conclude with a knowledge-check assessment designed to verify that participants have absorbed the key content and can apply the revised procedures in practice. A minimum passing score will be required, with employees who do not achieve the passing threshold directed to retake the training and reassessment.
Upon successful completion of the assessment, each employee will be required to execute a certification sign-off confirming that they have received the training, understand the revised procedures, and commit to compliance. These certifications will be maintained in a centralized registry to support the FL OIR compliance certification, the CDI remediation evidence, and future examination readiness.
Attendance tracking and completion reporting will be managed through QIH's existing learning management system, with regular status reports provided to Lena Fujimoto (Director, Market Conduct & Consumer Affairs) and Derek Mallory (General Counsel & Chief Compliance Officer). Hannah Brinkley of C&H is coordinating with Ms. Fujimoto and Mr. Mallory on curriculum finalization, session scheduling, and the design of the knowledge-check assessments. The training curriculum outline and delivery schedule are attached as Appendix E.
IX. Residual Risk Assessment and Anticipated Examinations
A. Anticipated Follow-Up Examinations (Q4 2025 / Q1 2026)
Based on the current regulatory landscape and C&H's experience with similar multi-state market-conduct matters, the following follow-up examinations are anticipated:
The timing and scope of these examinations are not confirmed and may vary depending on regulatory priorities, resource availability, and the outcome of the CDI hearing. However, C&H believes it is prudent for QIH to prepare as though all three examinations will occur within the anticipated timeframes.
B. Phase 4 — Examination Preparation Activities (December 8, 2025 – January 30, 2026)
Phase 4 is designed to ensure that QIH and its subsidiaries are fully prepared for the anticipated follow-up examinations. The key activities planned for Phase 4 include:
Mock Examination Exercises. C&H will conduct mock examination exercises simulating regulator document requests, data calls, and on-site or remote examiner interviews. These exercises will be tailored to each anticipated examination (FL OIR, CDI, and NYDFS) and will involve the participation of key QIH personnel, including Thomas Raeburn, Lena Fujimoto, and Priya Venkatesh.
Regulatory Correspondence Templates. C&H will prepare standardized templates for common regulatory correspondence, including responses to examination opening letters, document production cover letters, interview confirmation protocols, and follow-up response letters. These templates will be incorporated into the revised Market-Conduct Compliance Manual to ensure consistent and professional engagement with regulators on an ongoing basis.
File-Sampling Dry Runs. Sandra Whitfield and the Ridgeline Consulting Group team will conduct file-sampling dry runs using NAIC-standard statistical sampling methodologies. These dry runs will involve the selection and review of claims files, advertising files, and complaint files to identify and remediate any residual deficiencies before the actual regulatory examinations. The dry run results will be reported to management and the Committee, with any identified issues addressed on an expedited basis.
Witness Preparation. C&H will conduct focused witness preparation sessions for the key personnel who are most likely to interact with regulatory examiners during the anticipated follow-up examinations. These sessions will cover substantive knowledge of the remediation efforts, procedural expectations during examinations, and communication best practices for regulatory interactions. The primary witnesses for preparation are Thomas Raeburn (claims), Lena Fujimoto (complaints and market conduct), and Priya Venkatesh (advertising, regulatory affairs, and overall coordination).
C. Residual Risks
Notwithstanding the progress achieved to date and the comprehensive remediation plan in place, the Committee should be aware of the following residual risks:
1. CAP Compliance Deadline Risk. There is a risk that certain remediation measures — particularly the technology and systems upgrades requiring $680,000 in investment and coordination with QIH's IT department — may not be fully implemented by the December 31, 2025 CAP compliance certification deadline. The claims management system alert configuration and the centralized complaint-tracking platform deployment both depend on vendor performance, IT resource availability, and testing cycles. C&H is monitoring these work streams closely and has recommended that QIH escalate these items within its IT governance framework to ensure prioritized attention.
2. QSU and QLA Examination Risk. The FL OIR coordinated examination focused on QIIC. However, the Phase 1 assessment and Internal Audit Report No. IA-2025-017 identified compliance gaps in QSU (licensed in 22 states) and QLA (licensed in 19 states) that mirror many of the QIIC deficiencies. If either QSU or QLA is subjected to an independent market-conduct examination — whether initiated by the domiciliary state, a coordinated multi-state action, or a targeted inquiry by a state in which the entity is licensed — additional findings, penalties, and remediation obligations could result. The current remediation effort encompasses all three carriers to the extent practicable, but QSU and QLA have not been the primary focus of regulatory enforcement to date, and the depth of remediation for those entities is necessarily less intensive than for QIIC.
3. Pinnacle Bridge MGA Oversight Risk. The fact that 72.1% of non-compliant advertising originated from Pinnacle Bridge MGA's in-house marketing team highlights a significant governance and oversight challenge. The revised advertising review and filing SOP includes Pinnacle Bridge-specific provisions, and the Phase 3 training program includes dedicated content for Pinnacle Bridge marketing personnel. However, the decentralized nature of Pinnacle Bridge's operations and its technology-driven marketing approach may require more intensive and sustained oversight than is currently planned. C&H recommends that QIH consider the appointment of dedicated compliance personnel embedded within or assigned to the Pinnacle Bridge operation, as discussed in Section X.B below.
4. Elevated Complaint Ratios. The complaint ratios across all three QIH subsidiaries remain significantly above the NAIC median. While the complaint-handling remediation efforts (revised SOPs, centralized tracking, training) will improve the Company's procedural compliance, sustained reduction of complaint ratios to levels at or below the NAIC median will require ongoing investment in customer service quality, claims-handling responsiveness, and policyholder communication — factors that extend beyond the scope of the current C&H engagement and will require continued management attention and resource allocation.
5. CDI Penalty Uncertainty. The CDI Order to Show Cause hearing has been conducted, but the outcome remains pending. The potential penalty amount is not determinable at this time. A significant penalty, or an adverse finding that imposes conditions beyond those already contemplated in the remediation plan, could require adjustments to the timeline, budget, or scope of the engagement.
6. Additional State Inquiry Risk. The identification of non-compliant advertising in Illinois and Ohio creates potential exposure to inquiries or enforcement actions from the Illinois Department of Insurance and the Ohio Department of Insurance. While no formal actions have been initiated by those states to date, the advertising violations occurred within their jurisdictions, and the FL OIR examination findings have been shared under NAIC Market Regulation protocols. C&H recommends proactive monitoring of any communications from Illinois and Ohio regulators and preparation of responsive materials as a contingency.
7. Reputational and Securities Disclosure Risk. As a Nasdaq-listed company (ticker: QIHC), QIH is subject to securities disclosure obligations under Regulation S-K and the Securities Exchange Act of 1934. The existence of material regulatory findings, enforcement actions, and a compliance remediation program of this magnitude may trigger disclosure obligations in QIH's periodic reports (Forms 10-K and 10-Q) and proxy materials. The Company should coordinate with its securities counsel to evaluate whether additional or enhanced disclosures are required. In addition, the reputational impact of publicly disclosed regulatory actions — particularly if reported in insurance trade media — could affect QIH's competitive position, rating agency assessments, and stakeholder confidence.
X. Recommendations for Ongoing Board Oversight and Governance Enhancements
Based on the Phase 1 assessment findings, the current remediation progress, and the residual risks identified above, C&H recommends the following governance enhancements to ensure sustained improvement in QIH's market-conduct compliance posture beyond the conclusion of the current engagement.
A. Governance Structure
Quarterly Market-Conduct Compliance Reports. C&H recommends that the Audit & Compliance Committee institute a standing requirement for quarterly market-conduct compliance reports to be presented by Derek Mallory, General Counsel and Chief Compliance Officer, and Lena Fujimoto, Director, Market Conduct & Consumer Affairs. These reports should cover claims-handling performance metrics (including acknowledgment times and prompt-pay rates by state), complaint ratios and trends, advertising compliance review activity, regulatory correspondence and examination developments, and progress against any outstanding remediation items. The quarterly cadence will ensure that the Committee maintains visibility into the compliance program's performance on an ongoing basis and can identify emerging issues before they escalate to the level of regulatory enforcement.
Market Conduct Compliance Subcommittee. C&H recommends the establishment of a standing Market Conduct Compliance Subcommittee or working group, composed of relevant management personnel (including Mr. Mallory, Ms. Fujimoto, Mr. Raeburn, and Ms. Venkatesh), reporting to the full Audit & Compliance Committee. This working group would meet monthly (or more frequently as needed) to monitor compliance metrics, coordinate remediation activities, and escalate matters requiring Committee attention. The working group structure would provide a dedicated management-level forum for market-conduct compliance issues, ensuring that these issues receive sustained attention rather than being subsumed within the broader compliance function.
Periodic Independent Compliance Assessments. C&H recommends that QIH engage independent compliance consultants — whether C&H or another qualified firm — to conduct periodic assessments of the market-conduct compliance program on an annual or semi-annual basis following the conclusion of the current engagement. These assessments would provide the Committee with an independent perspective on the program's effectiveness and identify any areas requiring enhancement or recalibration. The first such assessment should be scheduled for approximately six months after the conclusion of Phase 4 (i.e., approximately July 2026).
B. Compliance Infrastructure
Pinnacle Bridge MGA Advertising Oversight. C&H recommends the formalization of Pinnacle Bridge MGA advertising oversight within the revised Market-Conduct Compliance Manual. The revised manual should include a dedicated chapter addressing Pinnacle Bridge-specific compliance requirements, pre-publication advertising review workflows, and reporting obligations. The MGA agreement between QIIC and Pinnacle Bridge should be amended to incorporate specific advertising compliance obligations, including a requirement that all Pinnacle Bridge advertising materials be submitted to the carrier's compliance function for review and approval prior to publication.
Centralized Compliance Management Technology. C&H recommends continued investment in centralized compliance management technology, as contemplated within the $680,000 technology and systems upgrade budget. The technology investments should be viewed not merely as remediation measures but as long-term infrastructure enhancements that will improve the efficiency and effectiveness of the compliance function across all three carriers and Pinnacle Bridge.
Dedicated Compliance Personnel for Pinnacle Bridge. C&H recommends the assignment of one or more dedicated compliance full-time equivalent(s) to the Pinnacle Bridge MGA operation. Given that Pinnacle Bridge manages approximately $890 million in premium, operates across 34 licensed states, and was the source of 72.1% of the non-compliant advertising identified in the FL OIR examination, the current level of compliance oversight of Pinnacle Bridge is inadequate. Embedded compliance personnel would provide real-time oversight of Pinnacle Bridge's marketing activities, ensure adherence to the centralized advertising review workflow, and serve as a direct liaison between Pinnacle Bridge and the carrier's compliance function.
C. Internal Audit Follow-Up
Follow-Up Review of IA-2025-017 Deficiencies. C&H recommends that the Internal Audit department, under the leadership of Neil Granger