Back-to-back coverage
Principle by which the conditions of a reinsurance treaty must faithfully mirror those of the underlying direct policies ceded, so that the two levels of coverage match exactly.
July 2019: Lloyd's requires every policy to state clearly whether it covers or excludes cyber risk, from January 1, 2020 for first-party property, and the question at once climbs up to the treaties. In reinsurance, back-to-back coverage means a perfect match between the scope of cover of a direct policy and that of the treaty covering it. When an insurer cedes a risk, the back-to-back ideal is that every loss covered by the direct policy is also covered by the treaty, and every exclusion in the direct policy also appears in the treaty. In practice the two often drift apart. Direct policy and treaty renewals do not fall on the same date. An endorsement to the direct policy may not have been carried over to the treaty. And exclusion wording differs: the cyber clause in the direct policy may be more or less restrictive than the treaty's. With Lloyd's Market Bulletin Y5258 on silent cyber, back-to-back alignment has become a front-line issue. An insurer whose direct property policies stay silent on cyber, but whose treaty excludes it, keeps the cyber accumulation alone: the losses are owed at the direct level and nothing passes to the reinsurer. Multi-year treaties predating 2019 are particularly exposed. Concluded before Lloyd's directives came into force, they can only be brought into compliance at maturity or by endorsement, which leaves residual exposures that are hard to quantify.
Textbook case: a French insurer signs on January 1, 2024 a three-year catastrophe XL treaty in which its reinsurers write in the LMA 5400 clause of November 2019. It does not exclude everything: it writes back fire and explosion arising from a non-malicious cyber incident, and nothing a malicious act has caused. Its professional multi-risk policies, renewed one by one on their anniversary dates, stay silent on cyber all year. Let ransomware tamper with the controllers of several of its industrial insureds and a furnace or a boiler there suffer the fate of the German blast furnace that attackers kept from shutting down normally, with "massive damage" according to the BSI report of December 2014, and the physical damage is owed at the direct level: the policy pays, whatever the cause, for want of an exclusion. In the treaty, LMA 5400 shuts it out, since the act was malicious. The accumulation sits entirely in its retention, and the reinsurer has nothing to dispute. Here the back-to-back divergence is paid by the cedant.
- Lloyd's Market Bulletin Y5258, "Providing clarity for Lloyd's customers on coverage for cyber exposures", July 4, 2019; BMS, "London Market Cyber Exclusions" (LMA5400 to LMA5403 clauses)
- Lloyd's Market Bulletin Y5277 (later phases); LMA, clauses LMA 5400 (endorsement, limited write-back) and LMA 5401 (exclusion), November 2019; BSI, "Die Lage der IT-Sicherheit in Deutschland 2014", December 2014 (blast furnace, massive damage)
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.