Germany’s BaFin takes ‘close look’ at climate risks

Germany’s financial sector regulator has warned banks and insurers that it will take a closer look at how physical risks from climate change are being managed, as it also named emerging technology risks from AI and quantum computing and economic risks as its key regulatory areas for the year ahead. Mark Branson, president of Germany’s Federal Financial Supervisory Authority BaFin, said the three watch areas are all being driven by new areas of risk. “Some of the challenges we are facing today are the result of new risk drivers. In other words, they are the result of developments that cannot be precisely gauged – in part because we lack relevant historical experience. This makes risk management more difficult”, both for regulated firms and the regulator itself. “The trend arrows for the risks… are pointing in the wrong direction, symbolising a growing risk,” Branson said at a press conference to launch its Risks in BaFin’s Focus report. Branson said there is no single key risk for financial firms, but a situation that is “multifaceted and complex” and presents companies with a diverse range of risks, often closely interconnected. Branson said it will take a “close look” at how financial firms are addressing physical risks from climate change, particularly at banks and insurers at risk because of extreme weather, supply chain dependency or concentrated credit and market risks. He said firms must address these risks and the impact of extreme weather such as droughts and flooding “more intensively” and better manage the increasing physical risks from climate change. “Supervised companies must continue to address in detail the physical risks of climate change and, especially, integrate these risks into all areas of their risk management. We should not wait for the next disaster,” Branson said. “A forward-looking approach will not only protect the solvency of insurers and banks, but also be able to drive prevention measures forward. If risks are properly priced, it is more likely that they will be mitigated.” He admitted regulators and supervisors “have not paid sufficient attention to physical risks up to now”. BaFin will be focusing on these risks in the year ahead, he said, and while Branson said companies have made progress on managing sustainability risks, he added: “There is still room for improvement.” In particular, he said “many companies lack important data” to be able to assess individual natural hazards. Banks lack customer-related location data to identify flood risk to specific address, he said, while insurers “have gaps in their data” around public flood protection measures or building regulations of individual cities and municipalities in Germany. “It is our impression that banks, in particular, are still in the early stages in this regard,” Branson said, warning of the concentration of risk for regional banks. “If an extreme weather event were to occur in their home region, many of their customers could be affected at the same time. Not to mention numerous employees. This geographical concentration can be problematic. It can also particularly affect insurers and banks with specialised business models, for example in agriculture and forestry,” he said, adding that the situation is often made more difficult by the close links between banks and insurers through risk transfers. “Just think of real estate loans and the protection of properties against natural disasters. These risks in particular are becoming increasingly difficult to assess: how likely are they to occur? How severe could potential damage be? And will the property even be insurable for a reasonable price in future?” he asked. Moving on to emerging technology risks, Branson said IT security, cybersecurity and IT outsourcing to third parties “remain high on our agenda”. As well as increasing the number of IT inspections at regulated firms in Germany, Branson said BaFin will more closely monitor multi-client service providers in Europe and critical IT service providers. In the first nine months of 2024, BaFin recorded a significant increase in IT incidents in payment services, with two out of three incidents cases by a service provider. “Among others, the focus here will be on cloud hyperscalers,” Branson revealed. Financial sector firms and their key service providers form part of the critical infrastructure at high risk of state-initiated cyberattacks. Branson said many companies have invested in IT security, but he warned “we cannot become complacent”. “It is important to us that companies continuously monitor current developments and threats. That they adapt their security measures. And that they prepare for crisis situations. They are currently well positioned to do so: the financial institutions reported strong earnings in 2024. They should use these earnings to invest further in their IT security. This is what we expect of them,” Branson made clear. As well as risks of generative AI driving cyberattacks, Branson warned of the growing risks from quantum computing. “We don’t yet know when powerful quantum computers will be widely available. But there is much to suggest that we will see a breakthrough happen. Companies in the financial sector need to get ready for this development. They need to get ready today. “Why do I emphasise this so strongly? Because quantum computers will be able to overcome conventional encryption technologies. Current cryptography methods such as RSA1, which form the basis of IT security in the financial sector today, will no longer be an obstacle for quantum computers. This will pose a massive threat to data security in the financial industry,” he said, urging companies to identify data that could be jeopardised by quantum computing and develop a protection plan. “I would like to emphasise once again: the time to act is now. When the first powerful quantum computers are for sale, it will be too late.” Branson said geopolitical risks are clouding the growth prospects of the German economy, which he said is highly susceptible to geopolitical shocks. More protectionist trade policies globally and a rise in German corporate insolvencies in 2024 have increased the level of economic risk facing Germany’s banks and insurers, Branson said, directing its agenda in this area of risk for the year ahead. “BaFin will be taking a particularly close look at the risks arising from corporate loan defaults in 2025 – at banks and at insurance companies. In particular, we will be keeping a close eye on institutions that are heavily involved in sectors that could be significantly affected by an economic downturn or by geopolitical tensions. “We will also be monitoring the investment behaviour of insurers, with a particular focus on the risk management of alternative investments such as private debt,” he said. Overall, Branson said the new set of risk drivers facing Germany’s financial sector firms “makes it all the more important for companies in the financial sector to manage their risks wisely”. He said firms should think in terms of scenarios. “They must ask themselves: What can the risk situation mean for us? Where are we vulnerable? And how can we prepare for this? And of course, they need to be highly resilient to potential shocks.”

Germany’s BaFin takes ‘close look’ at climate risks

Risk management has been made difficult by emerging risks without any historical data

Want to read this article?

Read Next

IQUW launches active assailant cover

Talanx results boosted by HDI Global’s 43% jump in net income

VIG Re confirms Faucret as head of Western Europe

Spike in cloud service outages driven by Google Cloud downtimes

Canopius Group appoints group risk director

IQUW launches active assailant cover

Talanx results boosted by HDI Global’s 43% jump in net income

VIG Re confirms Faucret as head of Western Europe

Spike in cloud service outages driven by Google Cloud downtimes

Canopius Group appoints group risk director

Keep yourself informed

Sign up for Commercial Risk’s newsletters

Want to read this article?

Read Next

IQUW launches active assailant cover

Talanx results boosted by HDI Global’s 43% jump in net income

VIG Re confirms Faucret as head of Western Europe

Spike in cloud service outages driven by Google Cloud downtimes

Canopius Group appoints group risk director

Related Articles

Keep yourself informed

Sign up for Commercial Risk’s newsletters