Government-guaranteed insurance against systemic risk (Pool Re)

Faced with risks seen to be too large, too uncertain, or too highly correlated for private companies to offer insurance against, the Government has previously extended guarantees to private insurers, ‘re-insuring’ the risks they take onto their balance sheet and seeking to take on the ‘systemic risk’ element that would overwhelm any individual insurer.^a For example, during the pandemic temporary reinsurance schemes were introduced to deal with the high levels of Covid-related risk in certain sectors – including the Live Events Reinsurance Scheme and the broader Trade Credit Reinsurance Scheme.^b The Government also intervened in the market for flooding insurance on homes through the ‘Flood Re’ scheme. This was set up in the aftermath of the damaging 2012 floods and allows insurers to offer flooding insurance on homes at much lower prices than would be commercially viable, funded by a government levy on the sector instead of a guarantee.^c

The longest-running government-guaranteed reinsurance scheme (and most relevant as a comparator to the cyber insurance market) is Pool Re. Pool Re was set up in 1993, in the wake of the 1992 Baltic Exchange bombing by the IRA which, alongside other attacks perpetrated by the IRA throughout the early 1990s, had destabilised the market for terrorism insurance on commercial properties. Given both the potentially very high costs associated with terrorist attacks on commercial property and the high degree of uncertainty associated with predicting the frequency and severity of those attacks, many insurers had withdrawn from the terrorism insurance market. Given the damaging impact on the wider economy should commercial properties become uninsurable, government intervention was deemed necessary.

Pool Re functions as a ‘pooled reinsurance’ scheme, through which around 95 per cent of the UK’s terrorism commercial property insurance market operates. The scheme covers insurance on nearly £2 trillion of assets in the UK in respect of physical damage (and associated business interruption) relating to conventional terrorist attacks and chemical, biological, radiological and nuclear attacks, as well as physical damage relating to cyber-attacks. Since April 2018, Pool Re has provided cover for insurers of ‘remote digital interference’, which relates to terrorist attacks with a cyber trigger, but specifically those resulting in physical damage. This is different from the broader cyber risks quantified throughout this chapter, which often include impacts on revenue and intangible assets.

Insurers pay premia to Pool Re, which are then invested to create pooled reserves that can be drawn on by members when a terrorist event occurs. These reserves now amount to over £6.9 billion (Chart B), in addition to which Pool Re holds further reinsurance from the global insurance sector worth £2.5 billion. Pool Re pays part of the premia it receives (around half), and some of its investment returns (around a quarter) to the Treasury, in exchange for an unlimited guarantee should Pool Re require additional funding to meet its members’ needs after a terrorist event. These payments have resulted in a further £1.4 billion ‘buffer’ to costs incurred by the scheme, above which the Treasury guarantee would take over. Therefore, taking into account the ‘excess’ paid by members, Pool Re is in total able to absorb £9.5 billion of losses from its own balance sheet, and £11 billion before needing to call on the guarantee and hitting the public finances.^d

Chart B: Pool Re hierarchy of obligations

Fiscally, while an unlimited guarantee is a significant exposure on the part of the Government, Pool Re has thus far been self-contained in absorbing terrorist risk in respect of commercial property damage. The scheme has paid out over £1.25 billion in relation to 17 terrorist attacks since its formation but has never called on the government guarantee. However, this is not to suggest that in the event that signs of weakness in the cyber insurance prompted a similar intervention, a parallel scheme would be equally resilient. Given Pool Re has had nearly 30 years to amass the reserves now able to absorb significant future losses, the more imminent threat of cyber risks, and the potentially high impact of a catastrophic attack could combine to make an unlimited exposure to this risk more fiscally challenging than terrorism risk has proved to date.