Germany's BaFin Releases Third Cyber Insurance Survey, Warns of Systemic Accumulation Risks

Germany's financial watchdog, the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), has conducted its third survey of the domestic cyber insurance market and published findings on May 29, 2026, offering important insights into how German regulators view the evolving and volatile world of digital risk coverage. The survey reflects the growing weight that BaFin attaches to cyber insurance as a critical component of Germany's economic resilience against cyberattacks.

A major structural development from the regulator is the formal creation of a separate insurance class for cyber risks. As of the 2025 financial year, a standalone reporting obligation now applies to cyber insurance under the German Insurance Reporting Regulation (BerVersV) for the first time domestically — a step aligned with an EU-wide reporting requirement that has been in force since the 2023 financial year. This new reporting structure will give BaFin far better visibility into premium volumes, loss ratios, claims trends, and coverage terms across the German market.

BaFin's primary supervisory concern centres on what the regulator describes as 'accumulation risks': the danger that a single large-scale cyberattack — targeting critical infrastructure, a widely used software platform, or a global cloud provider — could simultaneously trigger claims across a very large number of insurers and policyholders at once. This is an inherently different risk profile from most traditional insurance lines, where losses are typically uncorrelated. The regulator warns that the rapidly changing nature of cyber threats and the limited historical claims data make pricing and reserving especially challenging.

The BaFin survey comes in the broader context of Germany's Solvency II framework and its 2026 regulatory agenda, which also includes the issuance of a circular in April 2026 confirming the legal permissibility of ransom insurance under German supervisory law, and the expansion of BaFin's supervisory powers under the BRUBEG legislation effective March 31, 2026. At the global level, Munich Re estimates the cyber insurance market at approximately $15 billion in premiums in 2025, with growth projected at 10%+ annually through 2030.