BaFin Warns Cyber Insurance Has Become a Volatile Market Facing Systemic Accumulation Risks

Germany's financial watchdog, the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), has surveyed domestic insurance companies on cyber insurance for the third time, publishing its findings and characterizing the sector as a notably volatile market. The survey reflects the growing weight BaFin places on cyber insurance as a critical pillar of Germany's economic resilience against escalating cyberattacks.

A major structural development is the formal creation of a separate insurance class for cyber risks. As of the 2025 financial year, a standalone reporting obligation now applies to cyber insurance under the German Insurance Reporting Regulation (BerVersV) for the first time domestically — aligning Germany with an EU-wide reporting requirement that has been in force since the 2023 financial year. This dedicated reporting structure gives BaFin far better visibility into premium volumes, loss ratios, claims trends, and coverage terms across the German market, which it needs given the limited historical claims experience data available for this relatively young line of business.

BaFin's primary supervisory concern centres on what it describes as accumulation risk: the danger that a single large-scale cyberattack — targeting critical infrastructure, a widely used software platform, or a major cloud provider — could simultaneously trigger claims across a very large number of insurers and policyholders. This is a fundamentally different risk profile from most traditional insurance lines, where losses are typically uncorrelated and geographically diversified. A single incident causing widespread losses on a global scale is precisely the scenario that makes cyber risk so challenging to price, reserve for, and reinsure.

The survey comes amid a broader BaFin regulatory agenda for 2026 that includes a circular issued in April confirming the legal permissibility of ransom insurance under German supervisory law, the expansion of BaFin's investigative and supervisory powers under the BRUBEG legislation effective March 31, 2026, and a proposed 9th revision of its Minimum Requirements for Risk Management (MaRisk) aimed at a more principles-based, proportionate approach. At the global level, Munich Re estimates the cyber insurance market reached approximately $15 billion in premiums in 2025, with growth projected to exceed 10% annually through 2030 — meaning the systemic concerns BaFin raises will only grow in importance as the market expands.