Germany's BaFin Warns of Volatile Cyber Insurance Market and Systemic Accumulation Risks

Germany's financial watchdog, the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), has released findings from its third survey of the domestic cyber insurance market, characterizing it as a volatile and fast-changing segment that demands heightened supervisory attention. The survey reflects the growing importance BaFin attaches to cyber insurance as a pillar of Germany's economic resilience against the rising tide of cyberattacks.

A significant structural development is the formal creation of a separate insurance class for cyber risks. As of the 2025 financial year, a standalone reporting obligation now applies to cyber insurance under the German Insurance Reporting Regulation (BerVersV) for the first time domestically — bringing Germany in line with an EU-wide reporting requirement that has been in force since the 2023 financial year. The dedicated reporting framework gives BaFin far greater visibility into premium volumes, loss ratios, claims trends, and policy terms across the German cyber insurance market.

BaFin's central supervisory concern is what it terms 'accumulation risk' — the danger that a single large-scale cyber event, such as an attack on widely used software, a major cloud provider, or critical infrastructure, could simultaneously trigger claims across a very large number of insurers and policyholders at once. This represents a fundamentally different risk profile from most traditional insurance lines, where losses are typically uncorrelated and geographically dispersed. The regulator emphasizes that the rapidly evolving threat landscape, combined with limited historical claims data, makes pricing and reserving for cyber risk especially challenging.

The survey forms part of BaFin's broader 2026 regulatory agenda, which has also included a circular confirming the legal permissibility of ransom insurance under German supervisory law, and an expansion of BaFin's investigative and supervisory powers under the BRUBEG legislation that came into force on March 31, 2026. Globally, Munich Re estimates the cyber insurance market reached approximately $15 billion in premiums in 2025 and projects average annual growth exceeding 10% through 2030, even as intense competition has put downward pressure on average premium rates in the near term.