EIOPA Warns Interacting Private Credit, Funded Reinsurance, and ICT Risks Form Insurance Polycrisis

Key Takeaways

• EIOPA's Eurofi article argues that private credit, Asset Intensive Reinsurance (AIR), and ICT third-party dependencies should be assessed together, because their capacity to interact and amplify one another is what creates systemic risk.
• The article is not a binding rule, but it signals supervisory priorities.
• Compliance teams should expect closer scrutiny of AIR, illiquid asset exposures, and DORA implementation.

Deep Dive

EIOPA's Eurofi article argues that private credit, Asset Intensive Reinsurance (AIR), and ICT third-party dependencies should be assessed together, because their capacity to interact and amplify one another is what creates systemic risk. The article is not a binding rule, but it signals supervisory priorities. Compliance teams should expect closer scrutiny of AIR, illiquid asset exposures, and DORA implementation.

On the three focus areas, EIOPA considers private credit manageable in aggregate, at around 5% of EEA (re)insurer total assets at the end of 2025. It still calls for continued attention to valuation, liquidity, concentration, and interconnectedness. AIR use remains relatively limited in Europe, but its cross-border nature creates growing supervisory challenges. These include increased counterparty exposure, procyclicality, and recapture risk (operational, legal, and valuation). Building on its July 2021 Opinion on risk mitigation techniques, EIOPA is working with national supervisors on potential risks and supervisory expectations for AIR. No timeline has been given, but firms should anticipate further guidance or supervisory engagement.

ICT risk is identified as the most immediate source of systemic operational stress. The 2023 pre-DORA ESA analysis identified roughly 15,000 ICT third-party providers serving EU financial entities, about 9,000 of which support critical or important functions, and many services are non-substitutable. EIOPA has made DORA implementation a Union-wide Strategic Supervisory Priority for 2026. It also notes that the ESAs have established the Oversight Framework for critical ICT third-party providers (CTPPs). Supervisors will further analyze Register of Information and incident reporting data, benchmarking across sectors and years. Data quality and consistency in those submissions will therefore matter. EIOPA also flags AI-enabled cyber capabilities that may shorten the time between vulnerability discovery and exploitation.

Recommended actions:
- Review and validate the Register of Information and incident reporting processes for accuracy.
- Reassess concentration risk and exit or substitutability plans for critical ICT providers.
- Incorporate combined, multi-risk scenarios (valuation shock, counterparty stress, and ICT outage) into ORSA, stress testing, and operational resilience testing.
- Review AIR and funded reinsurance arrangements for counterparty, collateral, and recapture readiness, including cross-border legal and valuation issues.
- Strengthen private credit valuation, liquidity, and concentration governance.
- Monitor EIOPA and national supervisor communications on AIR expectations.

Overall impact is moderate and forward-looking. Direct obligations are unchanged, but the article indicates supervisory focus areas that could shape examinations, data requests, and future guidance. Firms with significant AIR use, private credit allocations, or reliance on a few critical ICT providers face the highest exposure.

Source: European Insurance and Occupational Pensions Authority