Guides
Terrorism insurance and TRIA: how the federal backstop works
TRIA requires insurers to offer terrorism cover and shares losses after a certified attack. How it works, what it costs, and what to decide at renewal in 2026.
The Terrorism Risk Insurance Act (TRIA) is a federal law that makes commercial insurers offer terrorism coverage and then shares the loss with them if the Treasury Secretary certifies an attack as an act of terrorism. It protects insurers from a catastrophic accumulation of claims; it does not pay your claim. You still buy terrorism coverage from your own insurer, usually as part of your property or liability policy, and you can decline it.
The program is authorized through December 31, 2027, and Congress is in the middle of extending it. That timing matters for any policy you renew from here on.
What TRIA does and does not do
Congress passed TRIA in 2002 after the September 11 attacks, which Treasury puts at roughly $59 billion of insured losses in 2024 dollars. Afterward insurers and reinsurers began excluding terrorism, and the law was meant to keep coverage available while the market rebuilt its capacity.
Three features define it:
- Mandatory offer. Insurers writing the covered commercial lines must "make available" terrorism coverage on terms that do not differ materially from the policy's coverage for other events (TRIA section 103(c), as described in Treasury's June 2026 report on the program).
- No mandate to buy, no price control. You can reject the offer. TRIA does not set the price. State rating laws govern that.
- Insurer backstop. After a certified act, the federal government reimburses insurers for a share of their losses. Treasury then recoups some of that money through surcharges on commercial policies.
The Federal Insurance Office runs the program for Treasury; see The Federal Insurance Office and federal reach. For a refresher on how insurers lay off catastrophic risk privately, see what is reinsurance, and why it affects your business premium.
What counts as a certified act of terrorism
Only a certified act triggers the backstop. Under the statute, the Secretary of the Treasury must certify, in consultation with the Attorney General and the Secretary of Homeland Security, that the event:
- is an act of terrorism and a violent act, or an act dangerous to human life, property or infrastructure;
- caused damage within the United States (with narrow exceptions for certain air carriers, vessels and U.S. missions); and
- was committed by one or more individuals as part of an effort to coerce the civilian population or influence U.S. government policy by coercion.
Two limits apply. Property and casualty insurance losses from the event must total at least $5 million, and the act cannot be part of a war declared by Congress (that exclusion does not apply to workers' compensation). The definition is not limited to foreign actors, so a domestic attacker can qualify.
Certification is rare. GAO reported in 2020 that Treasury had not certified any act (GAO-20-364), and 2026 industry material says that is still the case. This is the practical point for buyers: an attack that the news calls terrorism may never be certified, and what your policy pays then depends on its own terms rather than the federal program.
How the loss sharing works in 2026
Treasury's June 2026 effectiveness report gives the current mechanics. They are fixed through the end of 2027.
| Feature | Current rule |
|---|---|
| Program trigger | $200 million in industry insured losses from certified acts in a calendar year before any federal payment |
| Insurer deductible | 20% of the insurer's TRIP-eligible direct earned premium for the prior year |
| Federal share | 80% of the insurer's losses above its deductible |
| Insurer co-pay | 20% of losses above the deductible |
| Program cap | $100 billion per calendar year, combined insurer and federal payments |
| Recoupment | Treasury must recover 140% of federal payments by policy surcharge when industry payments fall below the 2026 retention amount of $58.7 billion; above it, recoupment is discretionary |
The recoupment surcharge is placed on all policies in the covered lines, including those of policyholders who declined terrorism coverage.
A hypothetical. Say an insurer earned $500 million of premium in TRIP-eligible lines in 2025, so its 2026 deductible is $100 million. A certified attack in 2026 pushes industry losses past the $200 million trigger and costs this insurer $300 million in covered claims. The insurer absorbs its $100 million deductible, then 20% of the remaining $200 million ($40 million), for $140 million in all. Treasury reimburses $160 million. The insured businesses collect from the insurer under their policies, subject to their own limits and exclusions; the federal share never reaches them directly.
Which policies the program covers
TRIA applies to commercial lines identified by Treasury's regulation at 31 CFR 50.4(w): fire, allied lines, commercial multiple peril (property and liability portions), ocean marine, inland marine, workers' compensation, other liability, products liability, aircraft and boiler and machinery. Directors and officers coverage is included, and so is stand-alone cyber liability written in the other-liability line (see Treasury's December 2016 cyber guidance).
It does not apply to commercial auto, burglary and theft, surety, professional liability other than D&O, medical malpractice, flood under the National Flood Insurance Program, health and life, farmowners, crop or reinsurance. Terrorism cover on those policies is a purely commercial matter.
Ordinary commercial property insurance: what it covers and what it doesn't and general liability insurance: what it covers and what it does not are in scope. So is inland marine insurance for tools, equipment and goods in transit.
Where terrorism coverage is thinner than it looks
- Nuclear, biological, chemical and radiological (NBCR) events. The mandatory offer does not force an insurer to cover what the policy already excludes, and many exclude NBCR. Workers' compensation is the main exception. Some states also have fire-following statutes that require a standard fire policy to pay for fire loss whatever the cause.
- Workers' compensation. State law bars insurers from excluding terrorism, including NBCR, so take-up is 100%. Insurers that write comp in dense cities carry heavy aggregation risk, which can push employers toward the residual market. See workers' compensation insurance: how it works.
- Cyber. A stand-alone cyber policy in the covered line is subject to TRIA, but most cyber losses are not certified terrorism, and many policies carry war and infrastructure limits. See war and state-backed attack exclusions in cyber policies and systemic cyber risk and cyber catastrophe bonds.
- Uncertified attacks. Standard terrorism exclusion endorsements target certified acts. The ISO exclusion of certified acts (
IL 09 53) leaves uncertified events to the rest of the policy, while some carriers use broader terrorism exclusions. Read which one you have; editions and carrier forms vary. - Sublimits and war. Carriers may sublimit terrorism or apply a war exclusion. Check the declarations for a sublimit.
What it costs and who buys it
Treasury's data call, covering 2023 to 2025, found embedded terrorism cover priced at 2.3% to 2.8% of total policy premium on average. About 31% of policies, measured by premium, included it at no additional charge. A Marsh comment cited in the report put the charge at 2% to 4% of property premium in some cases. Those are market averages, not a quote.
Take-up fell modestly. In 2025 about 75% of policies in the covered lines (excluding workers' compensation) contained some terrorism coverage. Measured by premium, take-up was 56% against 63% in 2018. By property limits it was 41% against 75% in 2018, while liability limits rose from 68% to 77%. Treasury says the decline could reflect broader market changes or buyers' own choices, and the data cannot separate the two. For places of worship, take-up by premium was about 72%, with terrorism making up 3.6% of premium against 2.2% for all policyholders.
Stand-alone policies fill gaps when a property is high-profile or the embedded offer is too narrow or too expensive. Treasury says they supply roughly 15% to 20% of terrorism premium but a small share of limits. They come in two forms: certified, which follows TRIA and its backstop, and non-certified, which responds to terrorism as the policy defines it whether or not Treasury certifies it. Non-certified policies sat at about 25% of stand-alone premium in 2025 and cost more per policy on average.
Deciding at renewal
- Find the disclosure. The insurer must disclose the premium charged for certified-act coverage and the federal share. ISO's notice is
IL 09 85; carriers may use their own. A $0 charge is allowed but should be stated. - Read the definition. Does the cover apply only to certified acts, or does the policy define terrorism more broadly? Check NBCR, fire following, business income and liability terrorism.
- Check contracts. Commercial mortgages, leases and some construction contracts require terrorism coverage. Declining it can breach a covenant.
- Look at your exposure. Proximity to landmarks, government tenants, transit hubs, large gatherings, a dense employee base in one building. Hotel and motel insurance and large Landlord insurance face these questions routinely.
- Price the downside. Compare the premium to the rebuild cost and the income you would lose.
- Cover the gap. An attack that is not certified, such as a shooting at your site, is often handled by a separate policy; see active assailant insurance: what it covers and what standard policies miss.
- Ask about 2027. Policies running past December 31, 2027 may carry wording that changes terrorism coverage if TRIA lapses. Ask your broker to find it.
The What business insurance do I need? helps with the wider review.
Where reauthorization stands
Both chambers have passed extensions, and neither is law as of October 10, 2026. The House passed H.R. 7128 on June 29, 2026, by 373 to 15 (Captive.com). The Senate passed S. 4395 by unanimous consent on September 28 (Insurance Journal). Both would run the program through 2034; the House bill also changes certification procedures. The two versions must be reconciled. The American Property Casualty Insurance Association told Treasury that carriers will begin excluding terrorism on policies with effective dates after January 1, 2027, which is why timing matters.
Key takeaways
- TRIA makes insurers offer terrorism coverage and reimburses them after a certified attack; it does not pay policyholders, and you can reject the offer.
- In 2026, the federal share is 80% above an insurer's 20% deductible once industry losses pass $200 million, with a $100 billion annual cap.
- Treasury reports embedded terrorism cover averaging 2.3% to 2.8% of policy premium for 2023 to 2025, so it is often cheap relative to the exposure.
- No act has been certified, so uncertified attacks, NBCR, cyber and active-assailant events turn on your policy wording.
- The program expires December 31, 2027 unless extended; check any 2027 renewal for lapse wording.