Insurance news

More asbestos has been found across the Palace of Westminster and the wider parliamentary estate, according to figures the BBC obtained through a Freedom of Information request. Known asbestos items, including insulation, roofing, floor tiles and ropes, now number more than 1,650. That is an increase of 500 since 2021, even though 700 items have been removed over the past five years.

Parliamentary authorities said the additional items were found during surveys in preparation for the long-awaited refurbishment of the estate, a project that could cost up to £40bn and take 61 years. Most of the asbestos is classed as low risk under Health and Safety Executive guidelines, but almost 200 items are rated medium risk and may require remedial works.

Gaps in the record

Damien Abraham, director at DOA Underwriting, said the finds carry significant implications for the wider UK building stock, particularly offices, schools and hospitals. Asbestos records are rarely complete, he said, even after decades of extensive surveying, hidden voids, service risers, redundant plant rooms and boxed-in pipework can conceal asbestos-containing materials. Layers of alterations made between the 1950s and the 1990s have often obscured, encapsulated or simply overlooked them.

Survey limitations are also unavoidable. Management surveys are designed to identify asbestos during normal occupation rather than uncover every concealed material. Refurbishment and demolition surveys are more intrusive, but still depend on access and on details of past works and surveys.

“The broader message is that asbestos should still be treated as a live asset management issue, not a historical one. The absence of recorded asbestos is not necessarily evidence of absence,” Abraham said.

Polly Sayers, associate (RFL) and insurance market analyst at HCR Legal LLP, said asbestos may suffer from a degree of apathy because it has been a talking point for so long that it no longer feels like a new story for insurers. Yet it is still being identified in buildings and materials where it had previously been missed, and is being dealt with on a daily basis.

What underwriters should be asking

For contractors, an unexpected discovery during refurbishment can expose workers, occupants and third parties to fibres. It can also bring work stoppages, emergency remediation costs, delays and disputes over responsibility for the additional costs, Abraham said. Surveyors, project managers and designers can face allegations that surveys were inadequate or that controls were not implemented.

For insurers, the exposure spans employers’ liability, public liability, contractors’ all risks and professional indemnity. Because asbestos is present across large portions of the ageing building stock rather than confined to isolated properties, he said, insurers also face aggregation risk.

Abraham said refurbishment projects in pre-2000 buildings increasingly call for scrutiny of three things: the quality and age of asbestos surveys, whether a refurbishment and demolition survey has been completed before intrusive works, and the competence of asbestos consultants and licensed removal contractors.

On historic buildings, Jo Whyman, risk management director at Ecclesiastical Insurance, said work often requires specialist craftspeople who understand both traditional construction methods and the importance of appropriate controls. “The selection of competent contractors, supervision, permits and controls cannot be overstated, as they all play a vital role in managing these risks,” he said.

Exposure then, claims now

Sayers said exposure that happened decades ago still carries live claims potential, which is the defining feature of long-tail liability. Employers’ liability policies respond to mesothelioma claims according to when the exposure occurred rather than when the disease is diagnosed, as the Supreme Court confirmed in the 2012 “trigger” litigation, Durham v BAI (Run Off) Ltd.

“Just because you’ve put an exclusion in place going forward doesn’t protect you from that historical exposure point,” she said.

It is one reason the market is watching PFAS, the so-called forever chemicals, so closely. Sayers said PFAS mirrors asbestos in how widely it has been used and how quickly the science is evolving, and brokers should expect the same question: which policy was in force when the contamination began. The two differ, because PFAS does not break down in the environment and does not yet have a signature disease. But in both cases, she said, liability “can quietly build up in buildings, in land, and in policy archives and can surface long after the decisions that created it”.

Parliament’s surveys suggest that, for asbestos at least, the full extent of that exposure is still being uncovered.

Tim Johnson (pictured), partner and head of the insurance practice at Browne Jacobson, is seeing few disputes over AI so far. Businesses are cautiously weighing where liability might sit, he said, while lawyers have already faced action around the world for citing case names invented by AI. 

“I think that’s where it’s starting, but you can be absolutely sure that civil liability claims will follow,” he said. 

His colleague Philip James, partner and head of UK data, privacy and cybersecurity group, sees the potential for those disputes to be significant, because emerging technologies commonly bring with them changing responsibilities and are more complex and unfamiliar than well-established software applications. 

Cyber disputes are another matter, Johnson said the gap between expectation and reality was the most common source of disputes between insurers and policyholders. A cyber policy can bundle covers from forensic IT to cyber extortion, but a business may not have bought the section an incident calls for. A firm whose operations are disrupted may find it never bought a cyber business interruption extension. 

That is not necessarily a flaw in the product, business owners can treat buying a cyber policy as completing their insurance checklist. 

“And they think, okay, cool, got cyber policy, tick,” he said. 

The risk with cyber, Johnson said, is that “it’s potentially too easy to buy because people aren’t necessarily taking the time or taking the advice to make sure it matches up.” 

Who is the supplier? 

With AI, the harder question is who is liable when something goes wrong. Parts of EU law have drawn on old product liability legislation to separate AI developers from deployers, but the line is rarely clear-cut because businesses customise what they buy and build on top of it. 

“And then it’s like, oh, well, we thought we were the deployer, but now we’re maybe part deployer and part supplier,” he said. 

Agentic AI complicates that further, James said. Beyond the legal question of how far an AI agent’s authority extends, even vendors themselves have expressed a desire to slow development until the technology can be implemented, and its full capabilities harnessed, securely. 

Johnson compared that customisation with a vendor mixing, treating or adapting a manufacturer’s product, which he said would typically fall outside the manufacturer’s vendor cover. AI adds another complication. 

“But I think with AI, it’s even more complex because the product itself is doing some of the changing to itself,” he said. That change comes partly from users’ prompts and partly from the model’s own characteristics, and no one can look inside the box. 

What brokers ask 

Johnson cautioned against reducing a client’s AI exposure to a single renewal question.  

“The one question I wouldn’t ask as a broker is, are you using AI? We’re beyond that now,” he said. AI is built into everyday software such as Outlook, so it is almost impossible for a business not to use it in some form. 

Brokers who understand the AI tools used in their clients’ markets can probe further, Johnson said. They ask what guardrails are in place, who is feeding in the data, who reviews the outputs and whether the tools are patched. 

The exposures behind those questions are already live, either in the public domain or in matters the firm has seen. They include staff putting confidential information into free, non-enterprise tools, vendors training models on client data, sometimes framed in contracts as service improvements, and recording tools used without everyone’s consent. 

After speaking with large US brokers at a recent conference, James said he could see specialists working alongside insurers to help clients check their controls, particularly smaller customers. He compared it with checking the locks and alarms on a house, though cyber calls for much closer work with technical security experts.  

“I can certainly see a market where there’s going to be more time spent under the bonnet,” he said. 

Cover that keeps pace 

Johnson said a business’s AI use 12 months from now may look very different from today, so brokers should remind clients to tell them about changes during the policy year. They might also check in when mainstream software adds a new AI function. 

“If something’s changed midway through the policy year, you should proceed on the assumption you’re not going to be covered for it unless you told your insurers,” he said. “That’s the cautious way to proceed.” 

Johnson’s anecdotal impression is that AI risks have become more apparent over the past year. Some businesses that initially rushed in are slowing down, having seen that it “can also do bad stuff very quickly and very well”. 

That more measured approach gives brokers a chance to find out what clients are actually doing with AI before a claim tests what their cover was built for. 

Two months after leaving Stamford Bridge, Mark Walter is reportedly looking for a buyer for another sports asset. This time it is the Cadillac Formula 1 team. And for anyone running a UK life book, the reason behind the sales is worth more attention than the sales themselves.

Sportico reported earlier today that Walter is seeking over $3 billion for Cadillac, with at least seven parties interested. It follows a busy few months. In September, Walter and Todd Boehly sold their combined 25% stake in Chelsea to majority owner Clearlake Capital in a deal valuing the club at £5 billion. Walter had already agreed in August to sell the Los Angeles Lakers for $12.5 billion. In August, his holding company, TWG Global, had denied that the F1 team was for sale even as an insurance probe widened.

The problem across the Atlantic

That probe centres on two US life and annuity carriers Walter controls, Delaware Life and Clear Spring Life and Annuity. Manhattan federal prosecutors and the US Securities and Exchange Commission are examining whether private credit investments recorded as unaffiliated were in fact tied to other Walter businesses. No charges have been filed, and TWG Global denies wrongdoing.

The scale is what caught the market’s eye. AM Best said in July that after a restatement, Delaware Life’s affiliated investments had risen to 42% of invested assets at year-end 2025, up from 3%. The agency moved the outlooks on Walter’s life carriers to negative while affirming their A- ratings. It cited lower risk-adjusted capital and weaknesses in financial reporting controls. The full background is in IB’s coverage of the federal probe into Walter’s insurers.

Put simply, policyholder money was supporting the owner’s other ventures to a far greater degree than anyone outside had been told. That is exactly the kind of risk UK regulators have been warning about.

Read next: PRA outlines 2026 priorities, flags closer watch on bulk annuity market

Why it matters in the UK

The Prudential Regulation Authority’s 2026 priorities letter told life insurers to give particular attention to private credit exposures. It cited the Financial Policy Committee’s concerns about how private markets could behave under stress. The letter also stressed robust governance at legal-entity level and careful management of conflicts of interest, particularly under the new capital and ownership structures entering the sector. Conflicts of interest are the heart of the Walter case.

Three of the eleven insurers active in the UK bulk purchase annuity market announced acquisitions by international investors in 2025, consultancy LCP noted, as private capital drove a record wave of UK life M&A.

The PRA’s sharpest move has been on funded reinsurance. In this kind of deal, a UK annuity writer passes both the longevity risk and the backing assets to a reinsurer, often offshore, and holds collateral in return. Under consultation paper CP8/26, published in April, the regulator proposed aligning the capital held against these deals with the treatment of corporate bonds. That would lift the capital held for an average transaction from around 2% to 4% of the liabilities covered to roughly 10%.

The regulator’s worry is partly what is in the collateral, which is increasingly made up of illiquid, private-credit-linked assets. UK exposures to funded reinsurance stand at about £40 billion. The PRA has said they could reach £110 billion over the next decade without intervention. Its 2025 life stress test found that solvency coverage for firms forced to take these deals back onto their books fell by 10 percentage points.

New deals written from October 1 fall under the new approach, although the final rules are still pending. Full implementation is due from July 1, 2027.

Read next: PRA’s funded reinsurance deadline arrives with final rules still pending

Not the same market, but the same questions

None of this means a Walter-style problem is brewing in the UK. The structures differ, and the UK’s matching adjustment regime puts stricter limits on which assets can back annuities. In July, S&P Global Ratings concluded that UK bulk annuity writers’ capital would hold even under severe private credit stress. It also found UK writers are less exposed to middle-market loans than their US peers.

Even so, the US case is shaping the debate on both sides of the Atlantic. Apollo chief executive Marc Rowan, whose Athene business is a major player in funded reinsurance, criticised Delaware’s regulators in September for missing the misclassifications. He warned that “loss of trust comes from regulatory arbitrage.” He has also long been critical of loosely regulated offshore reinsurance hubs, the same concern behind much of the PRA’s thinking on where funded reinsurance collateral sits.

For UK brokers, pension trustees and their advisers, the practical lesson is about asking the right questions. When a buy-in or buyout is priced keenly, it is worth understanding where the backing assets sit, who originated them, and whether anyone on the other side of the trade shares an owner with the insurer. In Delaware Life’s case, regulators did not get a clear answer to that last question until federal subpoenas arrived.

Read next: UK bulk annuity private credit risk remains manageable – S&P

The conversations at the MGAA’s Republic of Ireland Presentation Day on October 7 left me encouraged about the future of the Irish MGA market. We discussed some difficult trading conditions, but we also saw clear opportunities for specialist underwriting businesses that can demonstrate their value to brokers, customers and capacity providers. The task now is to turn that confidence into sustainable growth.

Many of these pressures will be familiar to MGAs across the UK. Competitive market conditions are squeezing margins, while insurers are expanding their appetite, albeit temporarily,  into areas that have traditionally been the territory of specialist MGAs. The growth of broker facilities and consolidation schemes adds to the competition. At the same time, businesses must balance immediate trading demands with investment in technology and digital products.

Regulation, capacity and digital threats

Our event brought those commercial pressures together with discussions about regulation, capacity and emerging digital threats. My strongest takeaway was how closely these issues connect. An MGA’s prospects depend on the quality of its underwriting, the reliability of its operations and its ability to explain both to its partners.

That starts with a clear understanding of where the business adds value. When insurers compete more directly in specialist areas, MGAs need to show what their expertise delivers. For a broker, that might mean access to cover for a difficult risk, a quicker underwriting decision or a product that better reflects the customer’s needs. Maintaining that distinction becomes more important as price competition intensifies.

Data is central to that relationship. Inconsistent demands from carriers can create an administrative burden, particularly when an MGA works with several capacity partners. Better alignment on reporting requirements would help businesses spend more time using information to improve underwriting and service. MGAs, in turn, need to provide partners with a credible view of performance and how their portfolios are developing.

Continued strong interest from capital markets

There are good reasons for optimism about capacity. We continue to see strong interest from capital and reinsurance markets, including reinsurance participation through fronting carriers. Longer-term capacity agreements and MGA consortium portfolio structures also offer opportunities to build relationships that support investment and product development. Mark McCormick, Chief Underwriting Officer, Europe, at Bridgehaven Insurance, brought an important capacity perspective to the afternoon’s discussions.

For Irish MGAs, the opportunity is to match specialist propositions with partners whose appetite and expectations fit the business, and where they can bring targeted value, insight and local relationships to expand underwriting on behalf of insurers. Capital availability alone cannot guarantee a successful partnership. Clear responsibilities, realistic growth assumptions and a shared understanding of underwriting performance provide a stronger basis for a lasting relationship.

Continued growth

New businesses are continuing to enter the sector. Across the MGAA, incubator membership is up 50% on 2025. That is an association-wide measure, but it is an encouraging sign of continued entrepreneurial interest in the MGA model. Alongside the appetite from capital providers, it gives us confidence that the sector can continue to develop despite current trading pressures.

Technology can help that development. Businesses with cleaner technology stacks may find it easier to adopt AI tools, reduce repetitive work and bring digital products to brokers more quickly. Better connections with broker platforms can also make specialist cover easier to access. The pace of adoption will depend on each firm’s resources and the quality of its data, and investment needs to deliver a measurable improvement in how the business operates.

Brendan Little, Head of Sales & Marketing at ARAG Legal Protection Limited, added another dimension through his session on digital threats. As customers face harm online, there is scope for specialist insurance and support services to respond to evolving needs. That discussion also reinforced the importance of considering the risks that accompany greater digital dependence.

Jerome Sebart, Director at Sicsic Advisory Ireland, provided the regulatory update. With Ireland’s revised Consumer Protection Code in effect since March, customer interests must inform business decisions as well as day-to-day service. My takeaway for MGAs is that growth and good customer outcomes need to develop together. Firms should be able to demonstrate how their approach to complaints, remuneration and operational resilience supports the customers they serve.

Discussions at the event also highlighted the fact that M&A remains challenging, with mismatched valuation expectations making transactions harder to agree. Businesses cannot assume that a sale or acquisition will provide their next stage of growth. Investing in underwriting performance and operational capability strengthens the business in the meantime and provides a firmer basis for future strategic choices.

The MGAA as the voice of the market

The MGAA has a clear role in helping the Irish market pursue these opportunities. We will work with our Market Practitioner members to promote capacity opportunities in the Republic of Ireland and double down on our efforts to share knowledge and insight across the market. Ireland’s MGAs have strong momentum to build on.

Precautionary shutdowns, not confirmed breaches, are driving early PHP2Shell losses, Marsh Re said in a new report, putting cyber policy triggers in focus for brokers.

In an October report, the reinsurance broker examined two critical flaws in PHP, a scripting language it estimates runs 77% of websites. Emergency patches arrived October 21.

Marsh Re expects business interruption to be the main loss driver, rated medium to high, especially for online retailers that rely on web access. Recoverability depends on policy wording, trigger, waiting periods, sublimits and the treatment of precautionary shutdowns, the report said.

Dutch government services, Finland’s state IT center and a Danish municipal IT provider supporting schools temporarily restricted access or went offline, the report noted. Most services were restored after remediation.

Exploitation now confirmed

Marsh Re said that when it wrote the report, no widespread successful breaches had been confirmed. Since then, evidence of exploitation has grown.

The US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog on Monday. Federal agencies must patch by October 29, but the agency has not said which organizations were compromised.

Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots last week. He warned the single-worker setup may not reflect how reliably the exploit works on production servers.

Cybersecurity firm Dream said it found artifacts of a China-nexus campaign that chained PHP2Shell with a Linux kernel flaw and rooted 25 servers in four countries. Palo Alto Networks said Thursday it had observed active exploitation of internet-exposed management interfaces. Researcher Kevin Beaumont has said he is aware of a ransomware group using PHP2Shell against Palo Alto firewalls. Marsh Re had not confirmed ransomware activity when it published.

What brokers should check

Cowbell’s Simon Hughes said businesses that switch off as a precaution, and their brokers, “should check now how their cyber policy treats a voluntary shutdown and what waiting period applies, rather than finding out at claim stage.”

Coalition said its policy has no clause barring coverage if clients skip the patch. Brokers still need to confirm other carriers’ terms.

Beazley Security’s Francisco Donoso said firms focused on websites may overlook PHP embedded in appliances that protect their networks. “This will not be the last bad vulnerability that we see this month, this year or this quarter,” he told Insurance Business.

Marsh Re noted that insured portfolios skew toward better-resourced firms with faster patching cycles, which should moderate losses. It warned that small and mid-sized firms may face longer remediation tails, so losses could migrate toward those segments over time.

Marsh Re places PHP2Shell between acute catastrophe and routine patching, closer to the latter for now, but with a credible path to the former.

AM Best researchers said in a report: “The PHP vulnerability is a scenario of systemic risk that has long worried cyber insurers and resulted in a reluctance to increase their risk models aggressively.”

“We’ve never seen a true 1-in-200-year cyber catastrophe, but in theory the market is well capitalized for one,” said William Altman, CyberCube’s director of threat intelligence services. “That’s not what we’re facing today with PHP2Shell.”

Ransomware criminals doing their homework on a target do not stop at the balance sheet. Incident response teams have watched them work out where a company’s executives live and where their children go to school.

“They know where their children go to school and it becomes a very scary situation in that reality, whether there’s any truth to it or not, where we have had clients that have had to relocate as a result of that, at least on a temporary basis,” said Lindsey Maher (pictured left), head of global cyber development at specialist global insurer CFC in London.

CFC has written cover for that fallout into additions offered in its cyber policies through brokers globally. Trauma counselling and therapy services alongside temporary relocation costs and personal theft of funds can be covered for a firm’s executives.

“It speaks directly to the buyer and their own personal liability,” Maher said.

The person deciding whether to buy a cyber policy is usually the same person whose reputation, career and family arrangements are exposed when the business is attacked. Cyber has conventionally been sold as a balance-sheet product to a buyer whose own exposure is personal and the wording has rarely acknowledged it.

Read next: Why captive insurance for cyber and trade credit is growing

The insurer believes it is first to market globally with counselling offered in these C-suite policies. It is not the first to put counselling in a cyber policy. Berkley Cyber Risk Solutions has offered crisis counselling coverage since May 1 2024. Berkley writes cyber internationally, including through its Asia operation, though the counselling endorsement was announced in the US and the company has not published whether it is available in other markets.

However, CFC’s move underlines increasing recognition among insurers of the human as well as the material costs of a cyber attack.

What cyber claims teams kept seeing

Both insurers described the same origin, which is claims and response staff noticing what clients were going through.

Rich Sheridan (pictured right), chief claims officer at Berkley Cyber Risk Solutions, cited the tremendous emotional impact that insureds experience when dealing with a breach event. He acknowledged that policyholders needed resources to cope with the stress rather than only to remediate the incident. Berkley extended the approach in June 2025 with an endorsement reimbursing cancelled holidays, child and elder care and corporate safety costs for the staff managing a breach, as Insurance Business reported when the endorsement covering incident responder costs was launched.

“It’s one of the most under-talked outcomes of cyber events, the mental health impact of it,” Maher said.

Read next: AI tops AXA’s risk ranking, and clients want to know if their cyber policy covers it

The research is some way ahead of the wordings. A 2024 study published in the Journal of Cybersecurity, drawn from the Royal United Services Institute’s work on the ransomware victim experience, catalogued harms among victim organisations including shame, guilt, isolation, loss of self-confidence and post-traumatic stress, and recorded outcomes at the severe end among small business owners in particular. The researchers found the impact is often greater at smaller firms, because the owner’s personal and working lives sit so close together.

“It should support the people responsible for leading the business through that crisis,” Maher said of cyber insurance.

Where the cover sits against the rest of the programme

Cover for an executive’s personal exposure is the kind of thing that can read like a directors’ and officers’ (D&O) question. Maher is clear that CFC does not see it that way. The executive protection language sits as primary within the cyber policy rather than overlapping with D&O and the point of writing it in explicitly is to settle the argument in advance.

“There’s no avoidance of doubt that we do intend to pick it up, and don’t want to be in a situation in the event of a claim where we’re finger-pointing across different policies,” she said.

Three of the best-known cyber writers, Beazley, Chubb and Coalition, lead on incident response, breach counsel, forensics and round-the-clock hotlines, with no counselling benefit in their public cyber material.

CFC’s move to offer counselling in its global cyber offerings reflects what its own response staff keep encountering rather than a gap in the market someone spotted. Maher said the decision came down to recognising that cyber insurance should not stop at the systems and the accounts.

“It’s trauma counselling services for clients, and really dealing with the victim impact and the human element of what transpires during most cyber events for clients that go through them,” she said.

The research points the same way. The Royal United Services Institute’s work found that psychological harm after a ransomware event is not confined to the people who handled the response, and that it can surface months later among staff who were nowhere near the incident. Maher said the hope is that putting the cover in writing does something beyond paying for sessions, by making the mental health consequences of an attack easier to raise at all. On her account it is among the least discussed outcomes of a cyber event, which is a strange thing to be true of a loss type where the frequency is now higher than property damage for many businesses.

What that leaves on the table is a question about the rest of the market. Counselling has been in one US cyber wording since 2024 and now appears in CFC’s globally for cover pitched to executives, while some of the largest cyber writers publish nothing comparable. Either the human cost of an attack is a real and insurable loss, in which case two insurers acknowledging it is an odd place for the market to have stopped, or it is a service that belongs outside the policy altogether. Cyber wordings offered globally currently say both. 

When the Louvre kept its gates locked on Saturday, October 24, nothing inside had been damaged. The museum, along with the Musée d’Orsay, the Picasso museum and much of the city’s cultural sector, closed as a precaution ahead of planned protests, a week after cost-of-living demonstrations spilled into looting and vandalism. Five days earlier, students had blockaded the Louvre’s entrances and shut it for the day, and Art Basel Paris cancelled its weekend programme at the Grand Palais.

For any business weighing a similar decision, the insurance question is simple and the answer is uncomfortable. Tony Collman, property VP, speciality lines, at Intact Insurance, said a standard property damage and business interruption policy does not respond when a business closes because it fears unrest.

What usually decides it, he said, is who makes the call to shut.

Three extensions, one hurdle

Collman said a typical BI policy carries three extensions that can come into play when trading is disrupted: prevention of access following damage, non-damage denial of access, and loss of attraction. Each usually needs either physical damage or action by a relevant authority to trigger it.

Prevention of access is the simplest. If a fire next door to a retailer leads to the area being cordoned off, the shop is covered because damage has stopped customers reaching it. Non-damage denial of access goes further, responding where police set up a security zone or close roads, for example after a bomb threat linked to unrest, even though no property has been damaged. Even then, Collman said the incident usually has to happen close to the insured premises, often within a mile, and the cover tends to carry a time-based excess, such as the first 12 hours, rather than a monetary one.

“There’s also usually a time limit on there, or a time deductible rather than your standard deductible, because time is always of the essence,” he said.

Loss of attraction applies where a business stays open but a nearby incident drives visitors away. Collman said the cover grew out of shopping centres, where an incident at an anchor tenant can hit footfall for every smaller shop around it. It still needs a serious incident to have actually happened, and the business has to prove its footfall fell as a result. That means records of usual visitor numbers against the same period last year, with other factors such as the cost of living stripped out.

Why the authority’s word matters

Where there is no damage, Collman said Intact’s wordings require the closure to be ordered by a public authority, a condition designed to stop businesses claiming for disruption that never arrives. Social media can whip up a frenzy around an event that may never happen, he said.

Protest groups publishing their plans in advance does not change that. London’s marches are well publicised by police, Collman said, yet very little closes for them.

The result is an awkward incentive. “It’s unfortunate because in a sense you’re encouraged to stay open,” Collman said. If unrest then damages the premises, a material damage claim follows and the BI cover with it. Where police do advise closure, he said they tend to issue formal notices rather than a word at the door, and that authorities work well with insurers because much of the decision comes down to public safety.

Insurers also have to be careful about how far cover extends, Collman said, because some disruption nearby, such as roadworks, is simply part of everyday life.

Where specialist cover fits

The same logic applies when staff or customers cannot reach a site. Collman said a train strike that stops employees getting to work is not an insured peril, so no trigger is met.

For risks like these, he said the answer lies in the specialist parametric market, which Intact does not write. A parametric policy pays out when an agreed event occurs and agreed conditions are met, such as a measurable drop in footfall. He cited a major British supermarket whose cover is triggered when the Met Office issues an amber weather warning and drops compared with the same period the year before.

“So it’s not about did the insured damage occur, but did the agreed event occur?” he said.

A business worried about civil unrest could arrange cover on the same basis, Collman said, though that decision has to be made before the event, not after it.

For clients weighing a closure now, he said brokers should sit down with insurers to agree clear guidelines on what closing would mean for the policy, and encourage clients to speak to their local public authority to understand exactly what is being asked of them. “I would always make it a tripartite decision between insurance company, broker, and the customer,” he said.

The cafés and kiosks around a closed landmark are in a similar position, losing trade from a decision that was never theirs.

Collman said it is the small high street shop, rather than an institution like the Louvre, that he has in mind when he thinks about this gap. He said events like these are becoming more common, and the conversation about what a policy will and will not pay for is one brokers are better having before the next protest date is announced than after it.

Aon’s third-quarter results show a business performing solidly on every revenue metric that matters. Organic revenue grew 6% in the quarter, with commercial risk and reinsurance each up 7% and health solutions up 6%. Adjusted operating margin expanded 70 basis points to 27.0%. Adjusted earnings per share rose 10% to US$3.36.

The balance sheet is less tidy. Long-term debt stood at US$14.66 billion at the end of 2025. By September 30, it had risen to US$26.32 billion, an increase of approximately US$11.66 billion in nine months. The jump is almost entirely attributable to the financing of Aon’s US$17 billion acquisition of USI Insurance Services from KKR, which is expected to close before the end of the year.

In September, Aon issued US$13.5 billion in senior notes across seven tranches, with maturities running from 2029 to 2056 and coupons ranging from 5.35% to 6.45%. The proceeds are currently sitting in short-term investments on the balance sheet, which jumped from US$1.6 billion to US$13.3 billion over the same period, awaiting the deal’s close. Once USI is absorbed, Aon will have completed two acquisitions totalling approximately US$30 billion in two years, following its US$13 billion purchase of NFP in April 2024.

Buybacks paused, restructuring accelerating

Aon repurchased no shares in the third quarter despite holding US$7.7 billion of remaining buyback authorisation, and has told investors it will prioritise debt repayment over shareholder returns as it targets a leverage ratio of 2.8x-3.0x within approximately 24 months of the USI close. The dividend continues, but the broader capital return programme is effectively suspended.

The Accelerating Aon United restructuring programme, meanwhile, generated US$93 million in charges in the quarter, up 191% on the same period last year. The programme was launched in 2023 to streamline operations, cut headcount and consolidate real estate.

Aon describes the driver as “primarily costs related to workforce optimisation,” which is headcount reduction. The timing is notable: NFP integration costs were described as “substantially completed” at June 30, and USI has not yet closed. The restructuring charge spike suggests Aon is rationalising its combined workforce across the existing business and NFP simultaneously, ahead of adding USI’s 10,500 staff.

The programme was initially designed to deliver US$350 million in annual savings by end-2026, with total cash charges of approximately US$900 million over three years. Nine-month charges in 2026 already stand at US$281 million.

Ratings pressure

S&P Global affirmed Aon’s A- issuer credit rating after the USI announcement but moved the outlook to negative, stating that a downgrade remains possible if leverage does not return to its base case within two years of the close. Fitch separately assigned a BBB+ rating to the new senior notes themselves and placed that rating on negative watch. Both signals reflect that Aon is carrying substantially more debt than it has historically, at a moment when it must also integrate two major acquisitions and retain the broker talent that makes both businesses valuable.

According to KKR, USI’s revenue nearly tripled under its nine-year ownership through a combination of organic growth and more than 90 acquisitions. Retaining that network through a change of ownership and integration with NFP is the execution risk S&P and Fitch both flag in their ratings commentary.

Aon frames USI as the next stage of the same middle-market thesis it deployed with NFP: buying a PE-backed broker platform and integrating it onto Aon’s shared services and analytics infrastructure. The deal is expected to dilute adjusted EPS in 2027 before turning accretive in 2028, with US$395 million in projected annual run-rate synergies.

Organic performance holds

The operating results that fund all of this remain strong. Commercial risk segment’s organic growth of 7% in the quarter was driven by North America and EMEA, with M&A services and core P&C performing particularly well. Reinsurance organic growth of 7% reflected strong treaty placements, though net market impact was unfavourable as pricing continues to soften.

Health solutions grew 6% organically, with particular strength internationally. Wealth solutions grew 4%, with demand for UK and EMEA retirement advisory work linked to ongoing regulatory change providing a consistent tailwind.

Total revenue for the nine months reached US$13.38 billion, up 4%. Free cash flow for the same period was US$1.94 billion.

“Our Aon United strategy continues to advance and differentiate our platform for clients,” said Greg Case, president and chief executive. “We enter the fourth quarter with significant momentum, reinforcing confidence in our ongoing ability to deliver sustained, differentiated performance.”

The fourth quarter is when all the deferred consequences land at once: the USI close, the debt on the books, the integration beginning and the first real test of whether the synergy projections survive contact with reality.