From single deals to a whole program
The earlier guides in this rung gave you the building blocks: the cedant and the reinsurer, the split of every risk into a retention and a cession, and the two great families of structure — proportional covers like quota share that share every claim by a fixed fraction, and non-proportional covers like excess of loss that only bite above a threshold. This guide stops looking at one cover at a time and asks the practical question a real insurer faces: how do you stitch all of this into a single coherent reinsurance program that protects the company across every line and every kind of bad day?
Think of it the way a household thinks about insurance, but in reverse. A family buys a few policies — home, car, health — each tuned to a different danger, and together they form a protection plan. An insurer does the same with reinsurance, except it is the one buying. The very first decision is not *how much* to buy but *how* to buy it: one risk at a time, or a whole class in a single contract. That fork — facultative versus treaty — sets the tone for everything that follows.
Facultative vs treaty: one risk, or a whole class
Facultative reinsurance is bespoke, one risk at a time. The cedant takes a single unusual policy — a billion-dollar oil platform, a stadium, a film shoot with a famous star — and offers that one risk to a reinsurer, who is free to accept it, decline it, or quote a different price. The word *facultative* simply means the reinsurer has the faculty, the option, to say no on this particular risk. It is tailored and flexible, which is exactly why it is slow and expensive: each deal is underwritten and negotiated on its own, like commissioning a tailored suit for every single party you attend.
Treaty reinsurance is the opposite philosophy: one contract that automatically covers a whole defined class of business for a period, usually a year. The cedant and reinsurer agree the rules up front — "all our commercial property policies, you take 30% of each" or "all our motor business, you pay anything above 2 million per accident" — and then every qualifying policy the insurer writes is *automatically* reinsured under those rules, with no risk-by-risk haggling. The reinsurer cannot cherry-pick out the ugly individual risks; it takes the class as written, good and bad together. This is the facultative-versus-treaty distinction in a sentence: facultative is per-risk and optional; treaty is per-class and obligatory.
Building the tower: stacking layers
No single reinsurer wants to swallow the entire range of possible losses above a retention — the cost of capital for the rare, enormous loss is very different from the cost for the merely large one. So the protection is sliced vertically into layers, each defined by an attachment point and a limit. The attachment is where a layer starts paying; the limit is how much it pays before it is exhausted. Stack several layers on top of one another and you have built a reinsurance tower — a column rising from the insurer's retention at the bottom up to the highest loss it cares to protect against.
A loss of 18 million hits the tower. Who pays what?
Layer 3: 30m xs 20m (pays losses from 20m up to 50m) -> pays 0
Layer 2: 15m xs 5m (pays losses from 5m up to 20m) -> pays 13m
Layer 1: 4m xs 1m (pays losses from 1m up to 5m) -> pays 4m
Retention: first 1m, kept by the insurer -> pays 1m
---------------
total loss = 18m
"15m xs 5m" reads: a limit of 15m, in excess of (above) a 5m attachment.Why slice it this way instead of buying one giant cover? Because the layers have wildly different prices. The low layer just above the retention gets hit often — moderately large losses are not rare — so it carries a high rate relative to its limit. The top layer, attaching at 20 million, only ever pays in a true disaster, so it is cheap per dollar of cover and may be placed with reinsurers who specialise in remote risk. Splitting the tower lets the cedant shop each band separately and put each slice with whoever prices it best — and it lets many reinsurers each take a thin, digestible piece rather than one being asked to bear the lot.
One layer detail worth carrying forward: a layer can be exhausted by a single huge loss, or worn down by several. A reinstatement clause lets a layer be "reloaded" after it pays — usually for an extra premium — so the cover is restored for a later event in the same year. Without reinstatements, the second hurricane of the season might find the layer already empty. This is the kind of fine print that separates a tower that looks protective on paper from one that actually holds when the bad year delivers two disasters instead of one.
The catastrophe program: surviving the one bad day
Everything above protects against a large *individual* loss — one fire, one liability claim, one platform. But the danger that keeps insurers awake is different: a single event that strikes thousands of policies at once. A hurricane, an earthquake, a flood does not produce one big claim; it produces fifty thousand ordinary claims on the same afternoon, and their sum can dwarf any single risk. This is the realm of catastrophe risk, and the tower built to absorb it is the catastrophe excess-of-loss programme, or cat XL.
The crucial twist is the word per occurrence. An ordinary excess-of-loss treaty attaches per *risk* — it looks at each policy separately. A catastrophe XL attaches per *event*: it adds up every claim arising from one named storm or quake, treats that whole pile as a single loss, and pays once it climbs above the attachment. So a cat programme of, say, "400 million in excess of 100 million per occurrence" means the insurer eats the first 100 million of total losses from any one disaster, and the reinsurers absorb the next 400 million. The same layered tower idea applies — a cat programme is usually several stacked layers, sold to many reinsurers worldwide so that no single event can topple any one of them.
Retrocession: who reinsures the reinsurers?
A reinsurer that absorbs catastrophe layers from hundreds of insurers has, in effect, become a giant insurer of its own — with its own terrifying concentration of one-event risk. So it does exactly what its clients did: it buys protection. A reinsurer ceding part of its accepted risk to *another* reinsurer is called retrocession; the buyer is the retrocedent, the seller the retrocessionaire. The structures look familiar because they are the same — proportional and excess-of-loss covers, layered into towers — just one rung further up the chain.
Retrocession spreads a catastrophe ever more thinly around the world, which is its great strength. But it carries a real and famous danger: the spiral. If reinsurers keep passing the same catastrophe risk around among a small circle of each other, a single event can come back to bite a company that thought it had laid the risk off — sometimes through several hands, so that one firm ends up exposed to the same hurricane many times over without realising it. The London market learned this the hard way in the LMX spiral of the late 1980s. The lesson endures: passing risk up the chain is not the same as making it disappear, and a chain you cannot see the end of is a chain you do not fully understand.
Partly because of the spiral's danger, much catastrophe risk today is pushed beyond the reinsurance circle entirely, out to capital markets through instruments like catastrophe bonds — a topic for the next guide. For now, hold the shape of the whole chain in mind: a homeowner's risk flows to a primary insurer, which retains a slice and cedes the rest by treaty and facultative covers; the reinsurer retains a slice of *that* and retrocedes the rest; and the residue may finally be parcelled out to investors who never sold a single policy. Risk does not vanish at any link — it is divided, again and again, until each holder is carrying a piece small enough to survive.
Reading a program as a whole
When an actuary finally lays the whole reinsurance program on the table, it is rarely one neat cover. It is a portfolio of decisions, each plugging a different gap. Reading it well means tracing, for any given disaster, exactly which euro lands on which party.
- Start with the retention: how much of each risk, and of each event, does the insurer keep for its own account before any reinsurance pays?
- Identify the proportional treaties that share routine business across the board, then the per-risk excess-of-loss tower that catches large single losses above the retention.
- Layer the catastrophe XL program on top, attaching per occurrence, sized to a modelled extreme event — and check how many reinstatements it carries for a second disaster.
- Reach for facultative covers only where a single risk pokes out beyond what the treaties were built to hold, and remember that above the cedant sits the reinsurers' own retrocession.
Put it all together and a reinsurance program is best understood not as a pile of contracts but as a deliberately shaped picture of *who carries what, and when*. The cedant tunes its retention to what it can afford from ordinary earnings; the treaty and facultative covers and the layered towers decide where the cliffs are cut; the catastrophe program guards the one bad day; and retrocession quietly redistributes the residue around the planet. Done well, the program turns a balance sheet that could be wrecked by a single hurricane into one that merely has a disappointing year — which, in this field, is the difference between survival and the front page.