Kidnap and ransom insurance in Germany: German Regulator allows conjunction with cyber insurance

20 October 2017

The German Federal Insurance Supervisory Authority (BaFin) has decided recently to allow the conjunction of kidnap and ransom insurance cover with cyber insurance cover in one contract and has published this decision on 15th September 2017 on its website. While allowing the conjunction of kidnap and ransom and cyber insurance, BaFin has indicated that the requirements of BaFin circular 3/1998 (VA) which have not been changed until now (with regard to the changes in 2000, 2008 and 2014 see below) remain in force and effect.


Therefore, for example, the cyber insurance itself can be advertised, though this does not apply for the kidnap and ransom insurance element. BaFin has highlighted further, that once the kidnap and ransom insurance has been distributed, the insurers are obliged to ensure that police investigations will not be affected. Furthermore, the insurers are in particular requested to guarantee adequate standards regarding data protection that have to adapt to the technical development.


The new decision of BaFin is aimed at all primary insurers authorized for direct insurance business regarding property and casualty insurance in Germany. It also applies to insurance companies from other member states of the European Union and contractual states of the European Economic Area with activity on the German insurance market.


The distribution of kidnap and ransom insurance has been prohibited in Germany for a long time. In 1998 the German Regulator has changed, however, its regulatory practice on the provision of kidnap and ransom insurance. With circular 3/1998 (VA) the German regulator insofar allowed the provision of kidnap and ransom insurance for the first time, yet under strict requirements. These requirements were inter alia set to avoid an offense against public policy (Section 138(1) BGB; Art. 6 EGBGB) due to apprehension the possibility of ransom claims could foster the risk of kidnapping for the purpose of extortion. Part of these requirements for example didn’t allow the kidnap and ransom insurances to be offered in conjunction with other insurance policies or granted in combination with other insurance segments or types of insurance cover.


Over the years, however, certain requirements of circular 3/1998 (VA) have been altered. While the requirement for a special authorisation was waived in 2000, the German Regulator allowed automatic contract renewals in 2008. Moreover, in 2014 it was allowed in case of commercial insurances that under special circumstances more than three persons on the side of the policyholder may obtain knowledge of the insurance cover. In line with this development the new decision of BaFin allows now to provide in Germany kidnap and ransom insurance cover with cyber insurance cover in one contract. Though, with regard to insurance segments or types of insurance cover other than cyber insurance the legal situation remains that a conjunction with kidnap and ransom insurance cover is not allowed in Germany. As well the other unchanged requirements of BaFin circular 3/1998 (VA) need to be observed as well in future by German insurers as well as insurers from other countries for the German market.

Show more Show less

Back to top

Agency Database

Future Dates

* Estimated date

  • 31 December 2017

    EBA guidelines on liquidity coverage ratio disclosure apply as of this date.

  • 1 January 2018

    A transitional period has been introduced up to this date to allow third countries to accommodate the rules. The third country regime provided by the existing CRA regulation remains unchanged; however, as the CRA III Regulation / Directive strengthen the regulatory framework for CRAs this transitional period has been introduced to allow third countries to adjust.

  • 1 January 2018

    Application date of PRIIPs Regulation in Member States. (UK - FCA's disclosure rules will also apply from this date)