could be required to publicly release the affected portions of our source code or re-engineer all or a portion of our technology systems, each of which could reduce or eliminate the value of our technology systems. Such risk could be difficult or impossible to eliminate and could adversely affect our business, financial condition, and results of operations.
Any cloud provider service failure or control weakness could adversely affect our business.
We employ cloud-based services to host our applications and intend to expand our use. As we expand our use of cloud-based services, we will increasingly rely on third-party cloud providers to maintain appropriate controls and safeguards to protect confidential information we receive, including personal, personally identifiable, sensitive, confidential or proprietary data, and the integrity and continuous operation of our proprietary technology platform. While we conduct due diligence on these cloud providers with respect to their security and business controls, we may not have the visibility to effectively monitor the implementation and efficacy of these controls. Outside parties may be able to circumvent controls or exploit vulnerabilities, resulting in operational disruption, data loss, defects or a security event. Migrating to the cloud increases the risk of operational disruption should internet service be interrupted. While we have implemented business contingency and other plans to facilitate continuous internet access, sustained or concurrent service denials or similar failures could limit our ability to write and process new and renewal business, provide customer service, pay claims in a timely manner or otherwise operate our business. Any such event or failure could have a material adverse effect on our business, financial condition and results of operations.
Risks Related to Laws and Regulations
We are subject to extensive regulation, which may adversely affect our ability to achieve our business objectives. In addition, if we fail to comply with these regulations, we may be subject to penalties, including fines and suspensions, which may adversely affect our financial condition and results of operations.
PSIC is subject to extensive regulation in Oregon, its state of domicile, California, where it is commercially domiciled, and to a lesser degree, the other states in which it operates. PESIC is subject to extensive regulation in Arizona, its state of domicile, and to a lesser degree, the other states in which it writes business. Our Bermuda based reinsurance subsidiary, Palomar Specialty Reinsurance Company Bermuda Ltd. (“PSRE”), is subject to regulation in Bermuda.
Most insurance regulations are designed to protect the interests of insurance policyholders, as opposed to the interests of investors or stockholders. These regulations generally are administered by a department of insurance in each state and relate to, among other things, capital and surplus requirements, investment and underwriting limitations, affiliate transactions, dividend limitations, changes in control, solvency and a variety of other financial and non-financial aspects of our business. Significant changes in these laws and regulations could further limit our discretion or make it more expensive to conduct our business. State insurance regulators and the Bermuda Monetary Authority (the “BMA”), also conduct periodic examinations of the affairs of insurance and reinsurance companies and require the filing of annual and other reports relating to financial condition, holding company issues and other matters. These regulatory requirements may impose timing and expense constraints that could adversely affect our ability to achieve some or all our business objectives.
Our U.S. insurance subsidiaries are part of an “insurance holding company system” within the meaning of applicable California, Oregon and Arizona statutes and regulations. As a result of such status, certain transactions between our U.S. insurance subsidiaries and one or more of their affiliates, such as a tax sharing agreement or cost sharing arrangement, may not be effected unless the insurer has provided notice of that transaction to the California Department of Insurance, the Oregon Division of Financial Regulation, or the Arizona Department of Insurance, as applicable, at least 30 days prior to engaging in the transaction and the California Department of Insurance, the Oregon Division of Financial Regulation, or the Arizona Department of Insurance, as applicable, has not disapproved such transaction within the 30-day time period. These prior notification requirements may result in business delays and additional business expenses. If any of our U.S. insurance subsidiaries fail to file a required notification or fail to comply with other applicable insurance regulations in California, Oregon or Arizona, as applicable, we may be subject to significant fines and penalties and our working relationship with the California Department of Insurance, the Oregon Division of Financial Regulation, or the Arizona Department of Insurance, as applicable, may be impaired.