Beyond single-risk thinking: polycrisis consideration for the insurance sector

As insurers and financial institutions navigate a prolonged period of economic uncertainty, geopolitical fragmentation, market volatility, and rapid technological change, risks are increasingly interacting; and amplifying one another. These interactions create vulnerabilities spanning business models, balance sheets, and operational infrastructures. It is this interaction and amplification of risks – not simply their simultaneous presence – that characterises a polycrisis. 

In this context, three areas warrant particular attention: 

1. insurers’ growing exposure to private credit and other illiquid assets,
2. the expansion of Asset Intensive Reinsurance (AIR) or funded reinsurance arrangements across markets and jurisdictions; and 
3. financial institutions’ growing dependence on complex digital ecosystems and third-party providers (ICT risks). 

The nature and immediacy of these risks differ. Private credit exposures remain manageable in aggregate, and use of AIR remains relatively limited in Europe, although its cross-border nature creates growing supervisory challenges. ICT and operational risks, by contrast, can disrupt multiple entities simultaneously and therefore represent the most immediate potential source of systemic operational stress. 

1. Private credit

EIOPA’s recently published factsheet shows that private credit accounted for around 5% of EEA (re)insurer’s total assets at the end of 2025. While these investments can support diversification and liability matching, they require continued attention to valuation, liquidity, concentration and interconnectedness. 

2. Asset Intensive Reinsurance

Asset-intensivereinsurance (AIR) or funded reinsurance can improve capital efficiency by transferring investment and insurance risks, providing capital relief and broadening access to investment opportunities. At the same time, AIR can increase counterparty exposures and insurers' links to financial markets, potentially amplifying procyclicality during periods of stress. AIR transactions can also create recapture risk, including operational, legal, and valuation challenges, particularly where assets are held through complex cross-border structures or under different regulatory regimes. 

Building on its July 2021 Opinion on the use of risk mitigation techniques by insurance undertakings, EIOPA is currently working with national supervisors on potential risks and supervisory expectations on AIR transactions.

3. Digital ecosystems and third-party providers

ICT risk has meanwhile evolved from a largely technical concern into a potential systemic threat. In today’s interconnected financial ecosystem, the failure of a single ICT provider can disrupt critical services across multiple entities, sectors and jurisdictions. 

The shift toward this new reality was evidenced in a pre-DORA analysis conducted by the European Supervisory Authorities (ESAs) in 2023. This high-level exercise identified approximately 15,000 ICT third-party providers (TPPs) directly serving EU financial entities, with around 9,000 of those supporting critical or important functions (CIF). The analysis also revealed that many of these services are non-substitutable, creating clear single points of systemic failure.

The development and first full year of application of the Digital Operational Resilience Act (DORA) have acted as a powerful diagnostic tool, revealing the extent of the financial sector’s co-dependence on a limited number of technology giants and of the overall cyber security maturity of the financial sector. The ESAs have also established an Oversight Framework as foreseen under DORA, for those ICT providers deemed critical (CTPPs). 

EIOPA has elevated DORA implementation to a Union-wide Strategic Supervisory Priority for 2026. The relevance of this agenda is reinforced by rapid advances in AI-enabled cyber capabilities, which may shorten the time between the identification and exploitation of vulnerabilities. ICT risk management must therefore evolve as fast as the capabilities it guards against.

Further supervisory analysis of the new data on the Register of Information and incident reporting, benchmarking it across sectors and years, will allow the supervisory community to get a better understanding of the actual risk and inform actions that should be taken to improve the overall resilience of entities and the EU financial sector.

The way forward

The hallmark of a polycrisis is not the presence of multiple risks, but their capacity to interact and magnify one another. For instance, decline in private credit valuations could pressure insurers’ capital and liquidity; AIR could transmit that pressure across counterparties and jurisdictions; and an ICT incident could impair the systems needed to value assets, manage collateral or execute recapture plans. Building resilience in the years ahead will depend not only on understanding each risk, but also on anticipating how multiple shocks may interact, amplify, and propagate across the insurance sector.

Thanks to Matteo Sottocornola, Michiel Kuhlmann and Thierry Frigout for their contribution to this article.