Call us now:
Regulatory capital is challenging to predict for financial services organizations. Credit risk is relatively straight forward, operational risk is mainly internally focused. Cyber risk for insurers however is a different challenge, how do you identify the impact of a cyber attack that could have a national, regional and international economic impact (Not Petya)?
The contagion and non affirmative losses from cyber are hard to predict without coming up with large mind blowing numbers. Requiring unrealistic levels of solvency capital on one hand, with lower figures resulting in catastrophic insurance losses on the other. One only has to look at the BoEs 2022 cyber stress test of insurers (https://lnkd.in/ee7qbqH6) to understand how hard (page 190. The chosen scenarios, may have been good at the time? But they did not cover systemic attack on banking infrastructure, or a destructive attack on a systemically important CNI provider. Are the gross loss figures realistic, if the Merck judgement at $1.4Bn is an indicator of one corporate loss?
If predicting Basel 2 capital for cyber is anything to go by, Solvency 2 capital is hard to predict. Cyber is an unpredictable, contagious and systemic risk. Lloyds exclusion clauses will help, but as the Bank of America article in the FT pointed out, the effect of exclusions clauses is to pass the cyber problem onto some else (loan books and credit risk)
One suspect that for Lloyds syndicates forward planning for cyber risk will be challenging. One wonders if the evaluation of solvency capital led, amongst other things, to the exclusion clauses in 2023.
Gerry Kennedy Ted Dziekanowski
#cybersecurity #regulatorycapital #solvencyII
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7065021185578672130