Background on: Terrorism risk and insurance


In addition to the risk of natural disasters, the insurance industry faces the threat of terrorist attacks. Losses stemming from the destruction of the World Trade Center and other buildings by terrorists on September 11, 2001, totaled about $31.6 billion, including commercial liability and group life insurance claims—not adjusted for inflation—or $42.9 billion in 2016 dollars. About two thirds of these losses were paid for by reinsurers, companies that provide insurance for insurers.

Concerned about the limited availability of terrorism coverage in high-risk areas and its impact on the economy, Congress passed the Terrorism Risk Insurance Act (TRIA). The Act provides a temporary program that, in the event of major terrorist attack, allows the insurance industry and federal government to share losses according to a specific formula. TRIA was signed into law on November 26, 2002, and renewed again for two years in December 2005. Passage of TRIA enabled a market for terrorism insurance to begin to develop because the federal backstop effectively limits insurers’ losses, greatly simplifying the underwriting process. TRIA was extended for another seven years to 2014 in December 2007 and renewed again for six years in January 2015. The new law is known as the Terrorism Risk Insurance Program Reauthorization Act (TRIPRA) of 2015.


  • TRIA Renewal: Having failed to pass an extension of TRIA (HR26) before they adjourned in December, lawmakers voted to reauthorize TRIA as soon as they returned in January, making it the first bill to be passed by the 114th Congress. With bi-partisan support, the bill cleared both houses of Congress with only a handful of lawmakers voting against it.
  • The bill extends TRIA for six years through 2020; raises the threshold for the program to go into effect (the triggering event) from $100 million in losses to $200 million, in $20 million increments starting in January 2016; and increases the amount that insurers must cover as a whole though co-payments and deductibles, which is known in the industry as the aggregate retention. This amount will rise by $2 billion a year to $37.5 billion from $27.5 billion, starting in 2016. See Background for a more detailed explanation of the provisions of the law.
  • The failure of Congress to reauthorize TRIA had put nearly one million businesses nationwide at risk of losing coverage, insurance industry representatives said. But since most insurers providing terrorism insurance had included a grace period through the end of January, and lawmakers had acted with such speed to pass legislation, there was little coverage disruption.
  • Just before Congress adjourned in December, a measure to renew TRIA was included in an omnibus spending bill and then separated out and put into a bill setting out revisions to the financial services Dodd-Frank Act. One senator objected to a provision that would have set up a national board to help establish multistate operations for agents and brokers, asking for a change that would have allowed states to opt out of the multistate licensing system, but there was no time for the House to review the change so the effort to pass a TRIA extension before the end of the year failed. A provision to create multistate agent and broker operations was included in the 2015 bill.
  • A report from the Wharton Risk Management and Decision Processes Center found that under the current TRIA program, some insurers have already reached a level of exposure to losses from a terrorist attack that could jeopardize their ability to pay claims, based on a critical measure of solvency: the ratio of an insurer’s TRIA deductible amount in relation to its surplus. The report, TRIA After 2014: Examining Risk Sharing Under Current and Alternative Designs, found that as the deductible percentage rises, as it does under the Senate bill and proposals put forward in the House, more insurers have a deductible to surplus ratio that is above an acceptable level. The report also sets out in detail the amount the American taxpayer and federal government would have to pay under differing scenarios.
  • A RAND Corporation study published in April 2014 found that in a terrorist attack with losses up to $50 billion, the federal government would spend more dealing with the losses than if it had continued to support a national terrorism risk insurance program because it would likely pay out more in disaster assistance.
  • Availability and Affordability of Coverage:  A report by the President’s Working Group on Financial Markets made public in April 2014 generally supports the insurance industry’s view that the expiration of TRIA would make terrorism coverage more expensive and difficult to obtain.
  • The insurance broker Marsh released its annual study of the market, 2014 Terrorism Risk Insurance Report, in April. Among its many findings is that the current uncertainty surrounding the potential expiration of TRIA has significantly affected the property/casualty insurance market. Some employers with large concentrations of workers and companies with property exposures in major U.S. cities have found that terrorism insurance capacity is limited and prices are higher, and some have not been able to obtain coverage at all. If the law is allowed to expire or is significantly changed, the market is likely to become more volatile with higher prices and limited coverage, the study concludes.


Prior to September 11, 2001, when the World Trade Center in New York City was attacked by terrorists and completely destroyed, insurers provided terrorism coverage to their commercial insurance customers essentially free of charge because the chance of property damage from terrorist acts was considered remote. After September 11, insurers began to reassess the risk. For a while terrorism coverage was scarce. Reinsurers were unwilling to reinsure policies in urban areas perceived to be vulnerable to attack. Primary insurers filed requests with their state insurance departments for permission to exclude terrorism coverage from their commercial policies.

The Difficulty of Insuring Terrorism Risk: From an insurance viewpoint, terrorism risk is very different from the kind of risks typically insured. To be readily insurable, risks have to have certain characteristics.

The risk must be measurable. Insurers must be able to determine the possible or probable number of events (frequency) likely to result in claims and the maximum size or cost (severity) of these events. For example, insurers know from experience about how many car crashes to expect per 100,000 miles driven for any geographic area and what these crashes are likely to cost. As a result they can charge a premium equal to the risk they are assuming in issuing an auto insurance policy.

A large number of people or businesses must be exposed to the risk of loss but only a few must actually experience one so that the premiums of those that do not file claims can fund the losses of those who do.

Losses must be random as regards time, location and magnitude.

Insofar as acts of terrorism are intentional, terrorism risk doesn't have these characteristics. In addition, no one knows what the worst case scenario might be. There have been few terrorist attacks, so there is little data on which to base estimates of future losses, either in terms of frequency or severity. Terrorism losses are also likely to be concentrated geographically, since terrorism is usually targeted to produce a significant economic or psychological impact. This leads to a situation known in the insurance industry as adverse selection, where only the people most at risk purchase coverage, the same people who are likely to file claims. Moreover, terrorism losses are never random. They are carefully planned.

Assessing Risk: To underwrite terrorism insurance—to decide whether to offer coverage and what price to charge—insurers must be able to quantify the risk: the likelihood of an event and the amount of damage it would cause. Increasingly, they are using sophisticated modeling tools to assess this risk. According to the modeling firm, AIR Worldwide, the way terrorism risk is measured is not much different from assessments of natural disaster risk, except that the data used for terrorism are more subject to uncertainty. It is easier to project the risk of damage in a particular location from an earthquake of a given intensity or a Category 5 hurricane than a terrorist attack because insurers have had so much more experience with natural disasters than with terrorist attacks and therefore the data to incorporate into models are readily available.

One problem insurers face is the accumulation of risk. They need to know not only the likelihood and extent of damage to a particular building but also the company's accumulated risk from insuring multiple buildings within a given geographical area, including the implications of fire following a terrorist attack. In addition, in the United States, workers compensation insurers face concentrations of risk from injuries to workers caused by terrorism attacks. Workers compensation policies provide coverage for loss of income and medical and rehabilitation treatment from "first dollar," that is without deductibles.

Extending the Terrorism Risk Insurance Act (TRIA): There is general agreement that TRIA has helped insurance companies provide terrorism coverage because the federal government's involvement offers a measure of certainty as to the maximum size of losses insurers would have to pay and allows them to plan for the future. The structure of the program has encouraged the development of reinsurance for the layers of risk that insurers must bear themselves—deductible amounts and coinsurance—which in turn allows primary insurers to provide coverage. Without TRIA, there would be no private market for terrorism insurance. 

However, some contend that the existence of a federal backstop has retarded the growth of a more extensive private market. The private market is growing under TRIA. With each extension, the insurance industry’s share of losses has increased and the federal government’s share has dropped.   

The Terrorism Risk Insurance (Extension) Acts (TRIEA): Congress passed an extension of the 2002 Act at the end of December 2005. The legislation extending the Act to December 2007 greatly increased the portion of the loss insurers would pay in the event of a terrorist attack. Another extension was passed by Congress in January 2015.

Below are summaries of the various extensions TRIA.

  • The triggering event, the threshold for the program to go into effect, for the 2015 extension of the Act is now $200 million, rising from the previous $100 million level in increments of $20 million for five years. It rose from $5 million under the original Act to $50 million after March 2006 to $100 in. Only terrorist acts likely to produce total insurance industry losses above the threshold will result in payment of federal funds.
  • Under the 2015 reauthorization individual company deductibles—the amount an insurer must pay before the federal program kicks in—remain at 20 percent of commercial property/casualty insurance premiums, the same as in 2007. The figure rose from 15 percent in 2005 to 17.5 percent in 2006.
  • Copayments, the amount insurers must pay above their individual deductibles or retentions, will now be 20 percent, meaning that the federal share is 80 percent. It was 90 percent in 2006 and 85 percent in 2007.
  • The industry as a whole must cover a certain amount of the losses through deductibles and copayments. This amount, known as the insurance marketplace aggregate retention, will now stand at $37.5 billion. It has been steadily rising with each renewal, meaning that with each renewal, the federal or taxpayer’s potential bill has been falling. By contrast, the insurers’ bill moved from $15 billion in 2005, $25 billion in 2006 and $27.5 billion in 2007. Now it will increase by $2 billion each year until it reaches $37.5 billion. If, when all the computations have been made, the retention is found to be below the threshold, the federal government can recoup the difference between the actual amount it paid and the required retention. The payment must come from a surcharge on commercial insurance policies not to exceed 3 percent of premium for insurance coverages that fall under the TRIEA program. If the industry is found to have retained an amount that exceeds the threshold, federal expenditures may be recouped for amounts in excess of the threshold at the discretion of the Secretary of the Treasury.

Payment of TRIA Losses Above $100 Billion: The 2007 law included a provision that requires the U.S. Department of the Treasury to establish a process for the allocation of pro-rata payments in the event that terrorism-related insured losses exceed the federal government’s annual $100 billion program cap. The law states that no insurer may be required to make any payment for insured losses in excess of its deductible and its share of insured losses.

As outlined above, the 2007 extension of the law essentially maintained the prior TRIA structure but made several significant changes. In addition to extending the law for seven years rather than two as in previous renewals, the new law added domestic terrorism to acts defined as terrorism—the original legislation covered only acts committed by foreign terrorists. The longer renewal period reduced the uncertainty for long-term commercial projects that there would be coverage for damage caused by terrorism. The bill also provided for prorated payments by insurers when losses approach or exceed the $100 billion cap and requires periodic reports to Congress by the President’s Working Group on Financial Markets.

How TRIA Functions: The Terrorism Risk Insurance Act and its extensions authorized the creation of a federal reinsurance plan, which is triggered when insured terrorism losses exceed a predetermined amount. The program, a sharing of losses between the insurance industry and the federal government according to a preset formula—a type of reinsurance—has enabled the commercial insurance market to function, even though the threat of terrorism remains.

Under the 2007 amendment, to be covered by the federal program, an act of terrorism must be committed by individuals acting as part of an effort to influence the policy or conduct of the United States. The law also requires that the act be certified by the Secretary of the Treasury in concurrence with the Secretary of State and the Attorney General. Insurers do not pay the federal government for this reinsurance coverage. A single terrorist act must cause aggregate losses in excess of $5 million to be certified under TRIA.

Only commercial insurers and causes of losses specified in the underlying policies are covered. In addition to commercial lines insurers, insurers eligible for coverage under TRIA include residual market entities such as workers compensation pools, state-licensed captive insurers and risk retention groups. Personal lines insurance companies—those that sell auto and home insurance—and reinsurers are not covered. Neither are group life insurance losses. Most types of commercial insurance losses were covered under the original legislation, except some specialty coverages such as medical malpractice and crop insurance. Additional commercial insurance coverages were deleted under the 2005 extension including commercial auto insurance, professional liability except for directors and officers liability, surety, burglary and theft and farmowners multiperil, a coverage similar to homeowners. Directors and officers liability covers the top management of a company in the event of a lawsuit charging negligence or false statements.

In return for the federal backstop, commercial insurers must make terrorism coverage available and conspicuously state the premium charges; policyholders may, of course, reject the offer and choose to mitigate this class of risk in other ways. In offering terrorism coverage to their policyholders, commercial insurers must make it available on the same terms and conditions as they offer in their non-TRIA coverage.

After September 11, to minimize the likelihood of a wave of liability claims, Congress established the Federal Victims Compensation Act, which provided nearly $7 billion in payments to families of September 11 victims. In return, victims' families were required to give up the right to sue those they perceived as responsible parties. This provision is not part of TRIA or its extensions.

Mandated Coverages/Exclusions: Insurance in the United States is state regulated. Regulators oversee solvency, market conduct and rates. In addition, they can require insurers to cover certain risks, if they perceive it to be in the public interest.

For example, on-the-job injuries under workers compensation insurance are covered whatever their cause. No state permits some types or causes of injury to be covered and others excluded. The only requirement is that they be incurred in the course of employment. Thus, injuries in the workplace resulting from terrorist attacks are always covered. Workers compensation insurance is a mandatory coverage in all states but Texas and Oklahoma.

As with earthquakes where ruptured gas pipes and other similar damage can lead to fires, fire following a terrorist attack could cause huge losses. Following September 11, 2001, states began to review their coverage of fire following terrorism. The standard commercial fire policy (SFP) does not exclude fire following terrorism and, prior to 2003, the SFP did not permit this exclusion with the result that a policyholder who had rejected terrorism coverage under TRIA would still have coverage for fire following an act of terrorism.  In a handful of states this is still the case: there are no exceptions for terrorism.  However, since 2003, some states have revised their SFP statutes to permit exclusions of fire following terrorism under certain circumstances. Thus, for a policyholder who has rejected terrorism coverage under TRIA, in these states there might be no coverage or limited coverage for fire resulting from an act of terrorism. Many states do not have a standard fire policy statute or have SFPs that unconditionally exclude fire following terrorism.  In these states there is no stipulated coverage for fire following terrorism.

Managing Risk, Proposals for the Use of Dedicated Capital: One proposal that has been discussed for a number of years, even before September 11, in conjunction with meganatural disasters like Hurricane Katrina to help insurers better manage risk, is allowing insurers to accumulate tax-deferred catastrophe reserves.

Under current tax law, insurers can only put money aside in special funds or "reserves" to pay for claims if an event, such as a terrorist attack, has already occurred. Funds to pay for catastrophic losses come from an insurer's policyholders' surplus, which acts as a financial cushion in such situations. As a general rule, an insurer must maintain a certain level of capital and surplus to support the insurance policies it has issued. If it allows its surplus to drop significantly below industry standards and claims from a major terrorist attack create a drain on its assets, it may become insolvent. But if it increases its policyholders' surplus to fund an event that may only happen once in a lifetime, it incurs opportunity costs—the loss of a chance to do something more economically productive with the money, such as generating additional business.

Various proposals for tax-deferred catastrophe reserves have been developed by insurers, the National Association of Insurance Commissioners and others. Some would make it mandatory for insurers to set aside pre-event reserves, while others would not. Some have a specific dollar target for total industry catastrophe reserves. However, each plan would allow tax deductions for amounts contributed to reserve accounts and then tax the funds withdrawn to pay claims.

Special Terrorism Insurance Programs in Other Countries: The United States is not the first country to establish a terrorism insurance program. Some countries created programs to cover terrorism after September 11 or earlier, following a terrorist attack on their own soil. Below are some examples. See for more information.

Australia: Legislation was passed in 2003, under which terrorism exclusions in commercial policies are nullified once the government has declared that a terrorist incident has occurred. The legislation also created a reinsurance pool to cover insurance company losses from property, business interruption and third-party liability coverages, subject to a certain insurance company deductible, about 4 percent of property insurance premium. Insurers pay premiums into the pool which is back-stopped by the government. The program covers chemical and biological attacks but not nuclear attacks.

Austria: A terrorism pool has been in operation in Austria since 2002. The pool provides reinsurance protection against property damage and business interruption up to a certain limit. Insurers issue a separate terrorism policy and then transfer, or “cede,” the business to the pool. Participation in the pool is voluntary, but almost all insurers belong.

Belgium: Under a 2008 law, coverage is available up to 1 billion euros, an amount that will be adjusted annually to keep pace with inflation. Participants in the Fund will pay the first EUR 700 million with the government paying the remainder up to the limit. Insurers will retain a part of the EUR 700 million, according to market share, and reinsure the rest. A committee that includes insurers will decide whether an event meets the definition of terrorism.

France: Under a law passed in 1986, terrorism must be covered. Since 2002, terrorism has been covered by a reinsurance pool to which terrorism risk above a certain retention level is transferred. Insurers pay premiums to the pool. They are divided up among the participants in each of the four different layers of risk with the government-owned Caisse Central de Reassurance receiving 10 percent of premiums for providing the top layer of unlimited coverage. The government pays for all terrorist claims that exceed a specific amount. Premiums are set according to the insured amount, not the riskiness of the location.

Germany: Private insurers cede commercial insurance coverage written above a certain limit to a pool set up in 2002. The pool, in turn, cedes all its risk to other insurance companies, which act as reinsurers. The ultimate layer of protection, for which insurers pay reinsurance premiums, is provided by the government. The government pays claims above an aggregate amount.

Netherlands: A terrorism reinsurance company was created to reinsure its member companies who retain a percentage of the risk. Coverage is limited per member and in the aggregate. Life and property/casualty insurers participate in the pool, as well as health insurers.

Spain: Beginning in 1941, Spain has had a government-sponsored but privately managed pool which provides coverage against injury, property damage and business interruption due to catastrophes, natural and man-made. Personal lines as well as commercial are covered. Coverage for extraordinary risks is mandatory. The original need for terrorist coverage stemmed from acts of violence carried out by the Basque separatist movement, which has been active in Spain for many decades. The 2004 Islamic terrorist bomb attacks in Madrid exacerbated the risk. Private insurers may provide catastrophe coverage but they are still required to make payments to the pool, which is backed by an unlimited guarantee from the government.

Switzerland: Beginning in 2003, insurers can cede all property risk insured for a sum above a certain amount to a reinsurance facility.

United Kingdom: The government formed a mutual reinsurance pool for terrorist coverage in 1993, following acts of terrorism by the Irish Republican Army. Insurance companies pay premiums at rates set by the pool. There are two geographic zones, one for major cities, with an adjustment for a "target risk," and the other for the remainder of the country. The primary insurer pays the entire claim for terrorist damage but is reimbursed by the pool for losses in excess of a certain amount per event and per year. This is based on its share of the total market. The maximum industry retention increases annually per event and per year. Following the World Trade Center disaster, coverage was extended to cover all risks, except war, including nuclear and biological contamination, aircraft impact and flooding, if caused by terrorist attacks. The government acts as the reinsurer of last resort, guaranteeing payments above the industry retention.


Top 20 Costliest Terrorist Acts By Insured Property Losses

(2017 $ millions)

Rank Date Country Location Event Insured
loss (1)
1 September 11, 2001 United States New York, Washington DC,
Hijacked airliners crash into
World Trade Center and Pentagon
$26,215 2,982
2 April 24, 1993 United Kingdom London Bomb explodes near NatWest tower
in the financial district
1,266 1
3 June 15, 1996 United Kingdom Manchester Irish Republican Army (IRA) car bomb
explodes near shopping mall
1,038 0
4 April 10, 1992 United Kingdom London Bomb explodes in financial district 937 3
5 February 26, 1993 United States New York Bomb explodes in garage of World Trade Center 872 6
6 July 24, 2001 Sri Lanka Colombo Rebels destroy 3 airliners, 8 military aircraft and
heavily damage 3 civilian aircraft
555 20
7 February 9, 1996 United Kingdom London IRA bomb explodes in South Key Docklands 361 2
8 June 23, 1985 North Atlantic Irish Sea Bomb explodes on board of an Air India Boeing 747 227 329
9 April 19, 1995 United States OK, Oklahoma City Truck bomb crashes into government building 203 166
10 September 12, 1970 Jordan Zerqa, Dawson's Field
(disused RAF airstrip in desert)
Hijacked Swissair DC-8, TWA Boeing 707,
BOAC VC-10 dynamited on ground
178 0
11 September 6, 1970 Egypt Cairo Hijacked PanAm B-747 dynamited on ground 154 0
12 April 11, 1992 United Kingdom London Bomb explodes in financial district 134 0
13 November 26, 2008 India Mumbai Attack on two hotels; Jewish center 117 172
14 March 27, 1993 Germany Weiterstadt Bomb attack on a newly built, still unoccupied prison 99 0
15 December 30, 2006 Spain Madrid Bomb explodes in car garage at Barajas Airport 82 2
16 December 21, 1988 United Kingdom Lockerbie Bomb explodes on board of a PanAm Boeing 747 80 270
17 July 25, 1983 Sri Lanka   Riot 65 0
18 July 7, 2005 United Kingdom London Four bombs explode during rush hour in a tube and bus 65 52
19 November 23, 1996 Comoros Indian Ocean Hijacked Ethiopian Airlines Boeing 767-260 ditched at sea 62 127
20 March 17, 1992 Argentina Buenos Aires Bomb attack on Israel's embassy in Buenos Aires 53 24

(1) Includes bodily injury and aviation hull losses. Updated to 2017 dollars by the Insurance Information Institute using the U.S. Bureau of Labor Statistics CPI Inflation Calculator.
(2) Differs from inflation-adjusted estimates made by other organizations due to the use of different deflators.

Source: Swiss Re.

View Archived Tables




($ 2015 billions)

(1) Adjusted to 2015 dollars by the Insurance Information Institute using the U.S. Department of Labor BLS Calculator.
(2) Loss total does not include March 2010 New York City settlement of up to $657.5 million to compensate approximately 10,000 Ground Zero workers or any subsequent settlements.

Source: Insurance Information Institute.

View Archived Graphs


© Insurance Information Institute, Inc. - ALL RIGHTS RESERVED

Back to top