Germany's BaFin Warns of Systemic Accumulation Risks in Growing Cyber Insurance Market

Germany's financial regulator has intensified its scrutiny of the cyber insurance market, reflecting the growing systemic importance regulators across Europe attach to digital risk coverage. The Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) conducted its third survey of the German cyber insurance market, with findings published in late May 2026 that offer insight into how regulators view this volatile and rapidly evolving sector.

A key structural development is the formal creation of a separate insurance class for cyber risks. As of the 2025 financial year, a standalone reporting obligation now applies to cyber insurance under the German Insurance Reporting Regulation (BerVersV) for the first time domestically — aligning with an EU-wide reporting requirement in force since the 2023 financial year. This enhanced reporting structure gives BaFin far better visibility into premium volumes, loss ratios, claims trends, and coverage terms across the German market, addressing one of the fundamental challenges of cyber underwriting: limited historical claims data.

BaFin's primary supervisory concern centres on what it terms 'accumulation risks' — the danger that a single large-scale cyberattack targeting critical infrastructure, a widely used software platform, or a major cloud provider could simultaneously trigger claims across a very large number of insurers and policyholders at once. This correlated risk profile is fundamentally different from most traditional insurance lines, where losses are typically uncorrelated and can be diversified across a portfolio. The regulator warns that the rapidly changing nature of cyber threats, combined with limited claims experience data, makes accurate pricing and reserving especially challenging.

The BaFin survey fits within Germany's broader 2026 regulatory agenda, which included a circular in April 2026 confirming the legal permissibility of ransom insurance under German supervisory law, and an expansion of BaFin's supervisory and investigative powers under the BRUBEG legislation effective March 31, 2026. At the global level, Munich Re estimates the cyber insurance market reached approximately $15 billion in premiums in 2025, with growth projected to continue at double-digit annual rates through 2030 — making robust regulatory oversight of accumulation risk an increasingly urgent priority for European supervisors.