Germany's BaFin Confirms Legal Permissibility of Ransom Insurance Amid Rising Cyber Extortion

Germany's financial regulator has provided important clarity on a sensitive and increasingly relevant insurance product. The Federal Financial Supervisory Authority (BaFin) issued a circular confirming that ransom insurance — coverage that protects against extortion demands, including cyber ransom and kidnapping scenarios — is legally permissible under German supervisory law. The circular consolidates previous regulatory requirements and offers welcome clarity for both insurers offering such products and the policyholders purchasing them.

The guidance is timely. Cyber extortion, particularly ransomware, has become one of the most prevalent and damaging forms of cybercrime globally — a reality underscored by the recent ShinyHunters campaign that struck more than 100 organizations worldwide. Ransom insurance occupies a legally and ethically complex space, raising questions about whether coverage might inadvertently encourage extortion. By formally confirming its permissibility while consolidating the regulatory framework, BaFin has sought to provide a clear basis on which the German market can operate.

The ransom insurance circular is part of BaFin's broader and intensifying focus on cyber and digital risk. The regulator recently conducted its third survey of the cyber insurance market and, as of the 2025 financial year, introduced a separate insurance class for cyber risks with a dedicated reporting obligation under the German Insurance Reporting Regulation — the first time such domestic reporting has been required. This gives BaFin far greater visibility into premium volumes, loss ratios, and coverage terms across the German market.

BaFin's primary supervisory concern in the cyber space centers on systemic accumulation risk — the danger that a single large-scale cyberattack could simultaneously trigger claims across many insurers and policyholders at once. The regulator has warned that the rapidly evolving nature of cyber threats and the limited historical claims data make pricing and reserving especially challenging. BaFin has also gained expanded supervisory and investigative powers under the BRUBEG legislation, which came into force on March 31, 2026, strengthening its ability to oversee insurers and other regulated entities. Together, these developments position Germany — Europe's largest economy and a major industrial and corporate insurance hub — at the forefront of cyber and digital risk regulation.