This article is by Jonathan York, CTO and co-founder, Luzern Risk
If you have underwritten or placed data center risk recently, you know how big the gaps in coverage are. A single hyperscale AI campus can carry $20 to $30 billion in insurable value. Placing it is hard, and disagreements on pricing and terms are leading owners to absorb much of the risk on their balance sheets. According to S&P, the insured portion is often around a third of the value, half at best. The gap is mostly structural. Securing even $10 billion in coverage on one site means stacking many carriers, and investment in AI infrastructure is only going to grow.
The market is acting rationally by adding capacity, including the multi-billion-dollar facilities the largest brokers have built to pool limits from insurers into a single placement. But the current efforts won’t be enough. While the physical property can often be covered, business interruption is much harder to gauge. The cover that exists for downtime tends to come with waiting periods, sub-limits, and exclusions that leave the businesses running on the campus less protected than they need to be. Some cyber policies, for example, only respond to an outage at a named cloud provider such as AWS or Azure once it has lasted 72 hours, and then at a reduced limit.
The exposure is also correlated across owners, since campuses often cluster on the same grids. There are important similarities to banking before 2008 here. A handful of firms provide services the whole economy requires, yet the risk they carry is largely opaque to others. It’s worth working on proactive solutions now so that we aren’t scrambling in response to a crisis.
What closing the gap would take
Conversations with data center owners, brokers, and service providers point toward a need for a structural solution to a structural problem. I see two layers of that solution. The first is a single-parent captive for each hyperscaler and major colocation provider, holding a defined first-loss layer of data center risk and keeping a share of whatever it cedes upward.
The second is a new capital markets layer above the captives and reinsurers, to bring institutional capital in at scale. Realistically, that is only possible once the captives are measuring and reporting the risk.
First layer: a captive that holds the first loss
Why not just leave the risk on the balance sheet? Held that way it doesn’t have to be modelled, and nobody, including the company’s own creditors, can say how much capital it is using. Once it’s in a captive, like any other insurance risk, it has to be priced and reserved for. That gives the company, stakeholders, and whoever takes the layer above a clearer picture of the risk and how it is performing. A captive also changes the owner’s incentives.
Once its own capital funds the first loss, decisions about where to build and how much resilience to pay for show up in the captive’s loss experience. The captive still buys its reinsurance from the same carriers, and brokers still place it, so the commercial market is not being cut out. If anything I’d expect it to do better with a buyer that is keeping a share of the risk. Second layer: capital markets for the volume
With the captives in place, the reinsurance market takes what it is able to above them. The rest can go to the capital markets, where there is far more capacity. There is a large untapped opportunity to create markets for this kind of risk. Over the coming years, pension funds, sovereign funds, and ILS managers will hold a variety of positions in risk as a diversifying asset class, at a scale that looks more like equity investing than the specialised risk investing that exists today. The closest precedent is the catastrophe bond market. It works well, but at around $65 billion outstanding, it is also small when compared to the current data center market.
The whole of it would cover about two or three campuses. However, it took about 30years to get there, and it needed shared infrastructure that investors trusted before it could grow. Data center risk needs the same, plus a way to pool risk across owners and it needs to develop much faster. How the risk is packaged for investors can take many forms.
One idea is instruments specific to a peril or a region, which investors can model more easily than a single data center bond. For example, a parametric instrument that pays out on a sustained grid outage.
Where to start
The captive is the part owners can do on their own. Many data center owners want to understand how it would work for them. Brokers and reinsurers can start on the reporting standards the first instruments will need. The gap is going to keep growing in the meantime, and it is a lot easier to put this in place before a loss than after one.
Be the first to comment