BaFin's New Ransom Insurance Circular: Kidnapping, Cyber Extortion and Product Extortion Cover Allowed Under Strict Conditions

Germany's financial supervisor has updated its rules on insurance against ransom demands, confirming that such cover is allowed if strict conditions are met. The Federal Financial Supervisory Authority, BaFin, issued Circular 01/2026 (VA) on ransom insurance. According to a report by cash-online.de dated April 2, 2026, the circular covers kidnapping, cyber extortion and product extortion. It replaces a circular from 1998, and consolidates the rules for the first time in nearly three decades. The substance is largely unchanged, but the structure is clearer. Commercial Risk reported on April 16, 2026, that BaFin confirmed that ransom payments to cybercriminals can be covered by insurance, either as standalone cover or as part of cyber policies. This article summarises these reports. An earlier version of this article said that BaFin separately flagged systemic accumulation risks in the cyber insurance market. The reports we reviewed do not mention that, so it has been removed. The circular text itself was not available to us, so this description relies on the reports.

What does the circular say about permissibility? According to the report, insurers may offer this cover under strict conditions. It must not violate public order, known in legal terms as ordre public, and it must not hinder law enforcement. The older 1998 circular, which we could read in BaFin's archive, made a similar point for kidnapping and product extortion: it said such insurance did not contravene public policy if confidentiality was preserved, police investigations were not hindered and collusion between perpetrators, victims and insurance staff was prevented. The 2026 circular carries this approach forward and extends it expressly to cyber extortion.

What are the conditions on sales and contracts? Advertising for ransom insurance is prohibited. Bundling it into all-in products is generally banned, with one exception: combination with cyber insurance. Policy terms are capped at one year, so that risk and asset positions are reassessed regularly. Insured sums must be proportionate to the customer's financial situation, since excessive sums could make the insured a more attractive target for extortion. Before a contract is concluded, a specialised security firm must advise the client and prepare an individual security concept. The reports do not say how this applies to cyber extortion, where the security concept may involve IT security advice.

What are the confidentiality rules? Policyholders may disclose the cover to a small circle, generally no more than three named trusted persons who must be bound to secrecy. Insurers must run contract administration through a central unit reporting directly to the board, encrypt data and apply strict confidentiality rules for staff. The reason is that if criminals know a victim has ransom cover, they may demand more, so secrecy is central to the product's design.

What happens after a claim? Crimes must be reported immediately, and insurers, policyholders and trusted persons must support investigators. The report states that quiet settlement without involving police is ruled out. This means that insurance cannot be used to pay criminals without informing the authorities, a point that is important for the debate over ransom payments.

What about annual reviews? At each renewal, policyholders must provide up-to-date information on their financial circumstances and risk factors. If they fail to do so on time, the contract ends automatically. This requirement fits with the one-year cap and the proportionality of the sum insured.

How does it relate to the wider debate? Governments and regulators around the world are discussing whether to restrict ransom payments, and whether insurance encourages them. The BaFin circular does not ban payments; it sets rules to keep insurance from undermining policing. Commercial Risk's subtitle notes that Google warned Germany is a hotspot for ransomware in Europe, though the excerpt we saw did not give details. For comparison, Cowbell's 2026 claims report, covered separately on this site, says ransomware attacks rose 45% in 2025 while average ransom payments fell about 44% since 2022, which suggests that preparation matters as much as insurance.

What does it mean for German businesses? Companies that want cyber extortion cover should ask insurers whether it is included in their cyber policy and under what conditions. They should be ready to share financial information at renewal, to keep the cover confidential, and to involve the police if an attack occurs. The reports describe ransom insurance as a niche product whose importance is growing alongside cyber risks.

Why have such conditions existed for so long? Kidnap and ransom insurance has historically been sensitive because critics argue it could increase the risk of kidnapping, or that payments fund crime. The supervisory approach, as the 1998 circular shows, was to allow the product but surround it with secrecy, proportionality and police involvement. The 2026 circular keeps that balance while bringing digital extortion within the same framework, which gives insurers and customers legal clarity about a type of cover that is growing in relevance.

What remains unclear? The reports do not say how the security-concept requirement works for cyber extortion, whether existing cyber policies need changes to comply, or whether BaFin will publish further guidance. Insurers will likely update their wording, and customers should ask about any changes at renewal.

This article summarises press reports of a supervisory circular and is not legal advice. Companies should read the circular and their policy wording.