Germany's Federal Financial Supervisory Authority (BaFin) issued a supervisory notice on how insurers should approach the fluctuation reserve for standalone cyber insurance, which becomes a separately reported insurance class with its own profit and loss account from reporting year 2025. BaFin concludes that there is no obligation to build a cyber fluctuation reserve for the 2025 balance sheet year because the required ten-year observation period for loss-ratio calculations is not yet available from either firms’ own records or BaFin-published loss ratios. Insurers that consider it necessary to build a cyber fluctuation reserve already from 2025 can apply for a case-by-case approval to deviate from the calculation rules under section 29 sentence 2 of the Insurance Undertakings Accounting Ordinance, but BaFin will not grant a blanket industry-wide permission. Eligibility still depends on meeting the minimum prerequisites in the annex to section 29, including criteria linked to earned premiums, the standard deviation of the loss ratio, and the loss and expense ratio, evidenced using the insurer’s own business records. BaFin may permit a shortened observation period of at least seven years for the loss-ratio calculation in approved cases, and BaFin’s published loss ratios cannot be used for this early build-up. Where early build-up is approved, the insurer must extract cyber-specific data from the line under which cyber business was previously reported for the full observation period to avoid double counting, and the approval becomes binding going forward while the prerequisites remain met; mandatory build-up would apply once ten years of cyber-specific data exist, with BaFin indicating that a firm writing cyber since 2017 could meet the conditions in 2027, and that from 2030 firms can use BaFin data to fill pre-underwriting years if needed. Alongside the guidance, BaFin published net loss ratios and gross expense ratios for standalone cyber insurance for 2020 to 2024, split between direct and assumed business for non-life insurers and assumed business for reinsurers, with 2024 net loss ratios of 50.4% in direct business, 70.9% in assumed business for non-life insurers, and 75.8% for reinsurers.
BaFin 2026-03-12
Germany's Federal Financial Supervisory Authority clarifies fluctuation reserve treatment for standalone cyber insurance and allows early build-up with seven-year data
Germany's Federal Financial Supervisory Authority (BaFin) issued guidance on the fluctuation reserve for standalone cyber insurance, to be separately reported from 2025. BaFin states there is no obligation to build a cyber fluctuation reserve for 2025 due to the lack of a ten-year observation period for loss-ratio calculations. Insurers may apply for case-by-case approval to establish a reserve earlier, subject to specific criteria, while BaFin published net loss ratios and gross expense ratios for 2020-2024.