What Aspen Insurance Holdings Ltd. told the SEC could break it.

Mishandling of client/employee data exposes Aspen to GDPR penalties up to the higher of €20M or 4% of global annual revenue, plus regulatory enforcement and reputational harm. (FY2018 10-K.)

“sanctions for non-compliance with the GDPR could result in a penalty of up to the higher of (a) €20 million; and (b) 4% of a firm's global annual revenue for the preceding financial year for certain infringements, such as unlawful data transfer outside of the EEA.”

As a holding company with no material assets besides its subsidiaries, Aspen depends on dividends/distributions from regulated operating subsidiaries as its sole source of funds for debt service and dividends. (FY2018 10-K — latest available; company taken private by Apollo in 2019.)

“Dividends and other permitted distributions and loans from our Operating Subsidiaries are expected to be our sole source of funds to meet ongoing cash requirements, including our debt service payments and other expenses, and dividend payments, to our preference and ordinary shareholders, as appropriate.”

Aspen established an Irish subsidiary to keep serving EEA clients after the UK's exit from the EU and may need to transfer EEA insurance policies depending on Brexit negotiations. (FY2018 10-K.)

“Aspen Ireland will ensure that we can continue serving partners and clients in the EEA following the U.K.'s exit from the E.U. Subject to regulatory approval, it is anticipated that Aspen Ireland will be operational during the first half of 2019. Depending on the outcome of political negotiations associated with Brexit, it may be necessary for Aspen to undertake portfolio transfers of its EEA insurance policies”