Germany's BaFin Flags Systemic Accumulation Risk in Volatile Cyber Insurance Market

Germany's financial regulator has intensified its scrutiny of the cyber insurance market, reflecting the growing importance the authority attaches to digital risk coverage as a pillar of economic resilience. The Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) conducted its third survey of insurance companies on cyber insurance, with findings published in late May 2026 highlighting both the market's rapid growth and its inherent volatility.

A significant structural development is the formal creation of a separate insurance class for cyber risks. As of the 2025 financial year, a standalone reporting obligation now applies to cyber insurance under the German Insurance Reporting Regulation (BerVersV) for the first time domestically — a step aligned with an EU-wide reporting requirement that has been in force since the 2023 financial year. This new reporting structure gives BaFin substantially improved visibility into premium volumes, loss ratios, claims trends, and coverage terms across the German cyber insurance market.

BaFin's foremost supervisory concern is what it describes as 'accumulation risk' — the danger that a single large-scale cyberattack targeting critical infrastructure, a widely used software platform, or a global cloud provider could simultaneously trigger claims across a very large number of insurers and policyholders at once. This risk profile differs fundamentally from most traditional insurance lines, where losses are typically uncorrelated. The regulator warns that the rapidly changing nature of cyber threats, combined with limited historical claims data, makes pricing and reserving especially challenging.

The BaFin survey comes within a broader regulatory context that includes the issuance of a circular in April 2026 confirming the legal permissibility of ransom insurance under German supervisory law, and the expansion of BaFin's supervisory powers under the BRUBEG legislation effective March 31, 2026. The findings echo concerns raised globally: Munich Re estimates the worldwide cyber insurance market reached approximately $15 billion in premiums in 2025, with growth projected to exceed 10% annually through 2030. For German businesses and insurers, BaFin's heightened oversight signals that cyber coverage terms, pricing, and underwriting criteria will face continued regulatory attention as the market matures.