More companies are using captive insurers, regulated subsidiaries that finance risks within the same corporate group, as they look for greater control over insurance costs, coverage gaps and claims data.
A captive does not make a loss disappear. It changes where the loss is financed. Instead of transferring every insured risk to an outside carrier, a business can retain an agreed layer through a company it owns and then buy reinsurance for larger or less predictable claims.
The structure is well established among large businesses. The US National Association of Insurance Commissioners says about 90% of Fortune 500 companies have captive subsidiaries. Captives are also used by non-profits and other organisations, although the costs and governance requirements mean they are not a simple substitute for an ordinary insurance policy.
What a captive insurer actually does
A captive is an insurance or reinsurance company owned by the business, or group of businesses, whose risks it mainly covers. The parent pays premiums to the captive, which holds capital and reserves and pays claims that meet the policy terms.
That differs from setting money aside for a possible emergency. A captive is a regulated insurer. Its domicile and business model determine the detailed requirements, but regulatory capital, reserves, reporting, governance and actuarial work are part of the arrangement.
Many programmes divide the risk among several parties. A company might retain small and recurring losses, place a defined layer with its captive, and use a commercial insurer or reinsurer above that. Reinsurance is insurance purchased by an insurer to limit the losses it keeps.
Where a contract or local law requires a policy from an authorised commercial insurer, the programme can use a fronting arrangement. The fronting carrier issues the policy and may pass much of the economic risk to the captive through reinsurance, while remaining responsible to the policyholder under the policy.
Why the economics can appeal
Commercial insurers charge for expected claims, operating costs, capital, the uncertainty around a loss and a return on the capital they commit. A business with a large, reasonably measurable exposure may decide that retaining part of that risk is preferable to paying an outside insurer for every layer.
The calculation goes beyond premium cost. A captive can give a group a single view of losses across subsidiaries and countries. That data can show whether a problem sits in a particular factory, supplier relationship, vehicle fleet, benefit plan or cyber control. It can then inform spending on loss prevention as well as future insurance purchases.
Our earlier coverage of commercial insurance rates that are falling unevenly shows why this can matter even in a buyer-friendly market. An average reduction in premiums does not guarantee affordable cover for a business exposed to severe weather, litigation, hazardous operations or a poor claims record.
Captives can also fund risks that commercial insurers exclude or price cautiously. The trade-off is direct: if claims exceed expectations, the captive and its owner bear the result unless they have transferred enough risk onward. A captive is a financing decision, not evidence that a risk has become safer.
Cyber risk has widened the use case
Cyber exposures have made the model relevant to risks that can be hard to map into a conventional annual policy. Ransomware, supplier failures, privacy claims and business interruption can affect several parts of a group at once.
Aon said nearly a quarter of respondents with captives in its 2025 Global Risk Management Survey used them to underwrite cyber risk, up from 1% in 2014. The survey is evidence of how its respondents use captives, not a measure of every company in the market. Aon also said commercial cyber cover has become more accessible in recent periods, so a captive can sit alongside a conventional policy instead of replacing it.
The choice requires the same discipline as any other risk decision. Our coverage of cybersecurity budgets based on expected losses explains the underlying problem: businesses need to estimate both the cost of an incident and how much prevention reduces its likelihood. A captive can finance a retained loss, but it cannot repair a weak backup system or restore a disrupted supplier.
The UK is trying to attract captive business
The UK’s Financial Conduct Authority and Prudential Regulation Authority opened consultations in July on a tailored regime for single-parent captives. The proposals cover subsidiaries that insure or reinsure risks belonging to their parent group, not conventional insurers selling to the public.
The regulators have proposed a faster authorisation process, lower capital and reporting requirements than conventional insurers face, and tailored conduct rules. They have also proposed safeguards: a captive could reinsure employee-benefits policies but could not insure them directly. The FCA consultation closes on 14 October 2026, and the regulators say they intend to launch the regime in summer 2027 after considering responses.
The proposed framework matters because UK companies have commonly established captives in other jurisdictions despite London’s strength in commercial insurance and reinsurance. It could bring more of the related actuarial, legal, management and reinsurance work into the UK, but the regime is still a proposal and no captive has yet been authorised under it.
For any company considering the model, the central question is whether its retained risks are predictable enough, large enough and well understood enough to justify an insurer of its own. The answer depends on capital, claims history, access to reinsurance and the company’s ability to run a regulated financial business when losses are higher than expected.
Aon’s survey analysis of cyber captives is available here. The PRA’s detailed consultation paper sets out the proposed UK framework.
