Pool Re Presentation to the ACRSM

26 July 2023

Tom Clementi, CEO 
Contents 

1. Pool Re (Overview & Scheme Modernisation)

2. IFTRIP (Context and 2023 / 2024 activity) 

3. UK Cyber Landscape (Assessment of case for greater public/private collaboration)

4. Questions
Since its formation, Pool Re has enabled and leveraged the private (re)insurance sector to 

serve a public policy objective and underpin the UK’s economic resilience to terrorism 

Market failure in 

terrorism (re)insurance 

1992 Today

Pool Re 

Mutual

HM 

Government

c150 UK 

Property Insurers

× Commercial property 

insurance unavailable

× Economy and businesses 

vulnerable to further attacks

Large, competitive terrorism 

(re)insurance market

✓ £2.2 trn assets protected

✓ Comprehensive, available cover for 

all businesses in Great Britain 

✓ Business and lender confidence 

✓ Effective management of a 

contingent liability for HMT

Three decades of capacity building 

Public-Private Partnership 

established

Private market solution in 

support of national 

resilience objectives

∕ £1bn+ claims paid at no cost to HMG

∕ Proactive return of risk to the 

private market, stimulating growth 

∕ Coverage has evolved to 

match dynamic risk

∕ Supports national security 

efforts through partnerships 

with the Home Office

1) Pool Re 
4

Pool Re provides confidence and resilience to the UK economy through a £10bn+ risk financing 

structure which leverages global reinsurance and capital markets, insulating UK taxpayers from loss 

1) Pool Re 
Pool Re is preparing to convert its treaty arrangements with Members from a Facultative 

Obligatory model to an Aggregate XOL model, incepting in 2025

Growth & innovation opportunity for UK 

insurance industry

Optimal management of HMT’s contingent 

liability

Promotes confidence & resilience in the 

economy and the return of risk to the private 

market

The intended changes to the scheme... ... And will be facilitated by Pool Re 

on an ongoing basis

... Will lead to beneficial outcomes for HMT, 

policyholders, and Insurer Members ...

Enable Members to reintroduce terrorism 

cover as standard within their ‘All Risks’ 

policies

Split retention structure between 

CBRN/Cyber and other terrorism perils 

such that eventually HMG only supports 

the market in areas of genuine ‘failure’.

Operationally simpler scheme that is fit 

for contemporary digital insurance 

marketplace

Conduit between HMT, Members, Home

Office, and Academia to align interests, 

intelligence, and achieve shared national 

security and resilience objectives 

Terrorism risk intelligence, management, 

and transfer expertise available to 

Members 

Terrorism risk actuarial, pricing, and

exposure management expertise

available to Members

1) Pool Re 
Pool Re and the FIO are Members of the International Forum of Terrorism Risk 

(Re)Insurance Pools (IFTRIP)

6

× Only forum of its kind in the world, with over a dozen members.

× Builds international collaboration between national terrorism and disaster 

insurance programmes, governments, (re)insurance professionals, academics, 

and the security community. 

× IFTRIP coordinates and contributes to international and cross-sectoral working 

groups on a variety of topical issues, from cyber terrorism to nuclear pool 

coverage. 

× Annual conference provides a platform for the exchange of experience in 

mitigation and capacity building against economic loss resulting from terrorism:

2) IFTRIP

- 2021: Annual conference held virtually 

- 2022: Annual conference held virtually 

- 2023: Annual conference held in 

London (Pools only)

- May 2024: Next annual conference in 

Washington 

- 2015: IFTRIP established in London

- 2016: Annual conference in Canberra 

- 2017: Annual conference Paris 

- 2018: Annual conference in Moscow 

- 2019: Annual conference in Brussels 

The Value of IFTRIP IFTRIP in 2023 / 2024

× Current Chair: ARPC (Australia); Vice Chair: TRIP (US); Secretariat: Pool Re (UK).

× Expectation that US succeeds to Chair at the end of 2023.

× At the 2023 Pools meeting, the US Treasury became a full Member of IFTRIP, 

and the following areas were agreed as focus areas going forward: 

a) Growing the membership of IFTRIP by identifying additional Pools to invite 

to join the Forum

b) Thought leadership in the areas of: 

I. The challenges presented by systemic cyber events

II. Promoting the benefits of Public/Private Partnerships to governments 

and the global (re)insurance industry

III. The impact of climate change on terrorism threat

× July 2023 proposed collaboration with private sector partners: 

a) Report on catastrophic cyber risk 

b) Report on CBRN risk 
In 2023, Pool Re has worked with Oliver Wyman and UK industry cyber players to explore the 

state of the UK’s cyber insurance market, and initiatives to increase the UK’s overall resilience... 

Our learnings to date include: 

1. Market growth:

× The global cyber insurance market has been one of the fastest-growing over the last 

decade, with premiums more than doubling since 2015.

× The UK cyber insurance market has seen significant growth in recent years. The global 

cyber insurance market was estimated to have reached ~$12BN in 2022, of which the UK 

market represents ~$660MM.

× Both the global and UK markets are expected to grow at more than 20% per annum to 

2025, with the global market forecast to reach $22BN by 2025, and the UK market to reach 

between £1.3BN and £1.5BN by 2027. 

2. Protection gap:

× Annual economic losses from cyber incidents globally are estimated at over $0.9trn. 

There is no definitive figure for total cyber losses, as not all incidents are reported and 

quantified by businesses and national institutions

× Global claims paid annually by insurers: $6bn (extrapolated from USA loss ratios of 65%)

3. Penetration & cyber-attacks:

× 5% of UK businesses have a specific cyber security insurance policy and 38% have cyber 

security as part of a wider insurance policy.

× 39% of all UK businesses reported a cyber breach or attack in 2022

4. There are clear market failures preventing a narrowing of the 

protection gap for cyber insurance.

We can distinguish between demand side failures, which impact 

mostly SMEs, and supply side failures, which impact mostly 

large corporates:

× Many SMEs have a low level of cyber awareness and 

consequently are not well prepared for cyber events when they 

occur – both in terms of risk mitigation and in terms of their 

purchase of cyber insurance

× Large corporates are unable to obtain covers proportionate to 

the material threat which cyber poses to their businesses

These market failures could lead to catastrophic damage to UK 

businesses and the economy in a systemic event. 

We see a strong case for pre-emptive, public-private efforts to 

mitigate the risk.

3) UK Cyber
We have formulated a set of recommendations for consideration for each of our 

potential initiatives – focused on strengthening demand

3) UK Cyber

Potential Initiatives Recommendations How could HMG support?

1

Raise awareness, Education and 

skill level on cyber risks & best 

practices

• Establish a cyber security education hub providing businesses with educational material on cyber threats, 

mitigants and insurance options (e.g., guidance on mitigating malware and ransomware attacks, event response 

and recovery, etc.)

• Create a wide-reaching communications strategy to promote cyber awareness and skills across UK businesses 

(esp. SMEs)

Encourage the insurance industry to 

provide input on cyber risk 

management for existing platforms, 

and collaborate on opportunities to 

achieve consistency of guidance 

provided to businesses. Magnify the 

reach of this guidance via various 

government touchpoints with 

businesses.

2

Support firms to take timely 

action via Early warning 

mechanisms

• Launch an early warning system that proactively distributes information on emerging cyber threats to 

businesses (focusing on SMEs) to enable them to take pre-emptive action to address vulnerabilities

• This mechanism could be established as part of the above cyber security education hub or through the National 

Cyber Security Centre’s (NCSC) existing activities

3

Improve uptake & raise 

standards of Cyber certifications

• Given the promising results to date, continue enhancing the existing Cyber Essentials scheme (e.g., encouraging 

a more aspirational posture around cyber culture, cyber event response and planning, etc.) and focus on

increasing uptake

• Explore options for insurers to better integrate cyber certifications into the underwriting process

Encourage collaboration between 

the insurance industry and the 

NCSC on enhancements to the 

Cyber Essentials scheme 

4

Incentivise uptake 

of cyber insurance 

• Explore the case for requiring cyber insurance as part of corporate commitments for major government 

outsourcing contracts (similar to the requirement for net zero commitments from businesses bidding for 

government contracts worth more than £5MM)

• Explore the case and feasibility of encouraging the uptake of cyber insurance by firms via sector regulation, 

corporate procurement, bank lending, and other touchpoints 

Review public procurement 

requirements, and explore the case 

for encouraging regulators, 

corporates, and banks to promote 

uptake of cyber risk mitigants and 

insurance
We have formulated a set of recommendations for consideration for each of our 

potential initiatives – focused on strengthening supply

3) UK Cyber

Potential Initiatives Recommendations How could HMG support?

5

Improve sharing of cyber data in 

the insurance industry

• Encourage increased sharing of aggregated data and insights by insurers to raise market-wide standards for 

risk modelling

• Create a central body for producing aggregate insights from granular event data

• Collaborate across the industry and government to quantify cyber catastrophe risks

Endorse the initiative, facilitate 

appropriate information 

sharing, and engage the insurance 

industry on government-led efforts 

to quantify cyber risk

6

Create a shared cyber event 

declaration and Classification 

mechanism

• Create a size/scale-based event classification system which will support insurers to draw boundaries between 

attritional and systemic losses and provide a clear understanding of losses that can be covered in the 

commercial market. The criteria should be as objective as possible, in order to support speed of determination 

and minimise uncertainty and disagreements

• Establish or identify an independent body to be responsible for event declaration and classification. Although a 

mechanical outcome, an appointed body would still be required to officially declare the event; it is also essential 

that the body is able to identify and classify emerging risks quickly and reliably

Consider government’s role with 

respect to declaring cyber events, in 

particular whether it should be 

responsible for officially declaring 

events in line with the framework 

(analogous to the role Treasury 

plays for Pool Re)

7

Establish a cyber catastrophe 

reinsurance scheme with a 

Government backstop

• Consider a programme of work to design and set up a public-private cyber catastrophe reinsurance scheme with 

a government backstop. Solution design should holistically consider a broad set of dimensions, seeking to bolster 

the UK’s resilience to systemic cyber events whilst enabling insurance innovation

• The different stakeholders that will need to be engaged in this work include:

– Government: Ensure the design aligns with objectives, notably on contingent liabilities and protecting public 

finances

– Insurance industry: Ensure the scheme addresses private sector coverage gaps, and industry can effectively 

implement changes required to enable distribution, underwriting and claims payments

– Businesses: Understand how the design can impact willingness to adopt risk mitigants and purchase cyber 

insurance

• A clear definition of what is covered and how this is determined will be pivotal to the establishment of a cyber 

catastrophe reinsurance scheme, and as such initiative 6 is a requirement for this scheme 

• This is not a completely novel initiative as it builds on previous successful government interventions on hard to 

insure risks, notably Pool Re for terrorism (with a government backstop) and Flood Re for flood

Support with the design of the 

scheme and agree to providing the 

backstop
Questions