Germany's BaFin Confirms Legal Permissibility of Ransom Insurance Amid Rising Cyber Extortion

Germany's financial regulator, the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), has provided important legal clarity on a sensitive and growing area of coverage: ransom insurance. In a circular issued in April 2026, BaFin confirmed the legal permissibility of ransom insurance under German supervisory law, consolidating previously scattered regulatory requirements into a clearer framework for both insurers and policyholders.

Ransom insurance — coverage that helps policyholders manage the financial consequences of extortion events, including kidnap-and-ransom and increasingly cyber-extortion scenarios — has historically operated in a legally ambiguous space in many jurisdictions, given concerns that such coverage might inadvertently encourage criminal demands. BaFin's circular addresses this uncertainty by confirming that, under German law, such insurance is permissible while consolidating the regulatory expectations that insurers must meet. This provides a more stable legal foundation for insurers offering these products and greater certainty for businesses and individuals seeking coverage.

The clarification arrives against a backdrop of intensifying cyber-extortion activity. BaFin has been closely monitoring the cyber insurance market, conducting its third survey of insurance companies on cyber coverage (published May 29, 2026) and introducing a separate insurance class for cyber risks with a dedicated reporting obligation under the German Insurance Reporting Regulation (BerVersV) for the 2025 financial year. The regulator's primary concern centres on 'accumulation risks' — the danger that a single large-scale cyberattack could trigger widespread simultaneous losses across many insurers and policyholders at once, an inherently different and more dangerous risk profile than traditional insurance lines.

The broader European context reinforces the importance of BaFin's guidance. Cyber-extortion and ransomware attacks have surged across the continent, with double-extortion and data-theft schemes becoming more common. The EU's Digital Operational Resilience Act (DORA) treats information and communications technology risk as central to financial-sector resilience, imposing strict incident reporting and testing requirements. As Europe's largest economy and a major hub for industrial and corporate insurance, Germany's regulatory positions carry significant weight for how the European cyber and specialty insurance markets develop.