Islamic cyber insurance: protecting data and systems the takaful way

Takaful cyber insurance pools the cost of IT incidents such as a data breach, business interruption or fraud among participating companies, through a tabarru' fund run by an operator paid on a wakala basis and invested free of riba.

Why cyber risk falls within the scope of takaful

A cyberattack causes a real, measurable loss: restoring servers, notifying customers, lost revenue. According to the State Life takaful FAQ, only this kind of pure risk, with no possibility of gain, can be covered, which disposes of the maysir objection.

The common fund fed by member companies

Each company pays a contribution into a participants' risk fund, the PRF described in the IFSB-14 standard. The fund compensates whichever member suffers ransomware or an intrusion, while the operator merely administers it on behalf of the whole group.

How the operator is paid: fee or profit share

Under the model set out in our article on the wakala fee and the agent's role, the operator charges fees fixed in advance. Under mudaraba, it shares investment returns and, according to State Life, part of the surplus with shareholders.

Typical cover in a cyber policy

A cyber policy bundles first-party costs, such as IT forensics and data restoration, with liability towards third parties whose information has leaked. The takaful document should list every cover, because the verified notes cite no standard cyber wording.

The sensitive question of paying a ransom

Reimbursing a ransom handed to criminals raises an ethical problem that the operator's sharia board must settle in writing. No AAOIFI position on this point has been verified, so ask for the product's fatwa rather than relying on a sales claim.

Gharar and a precise definition of claims

Gharar, or excessive uncertainty, threatens any cyber contract with vague boundaries. The donation contract reduces it to a tolerable level, provided the triggering event, the discovery date and the limits are defined without ambiguity in the policy terms.

Investing contributions before any claim arises

Between claims, the fund's money is placed in sukuk, compliant equities or real estate. According to COVER magazine, takaful funds also exclude issuers earning their income from alcohol, tobacco, pornography or weapons, keeping the portfolio aligned with sharia.

Retakaful: absorbing a mass attack

A wave of simultaneous attacks can drain a small fund. The operator then protects itself through retakaful, the Islamic alternative to reinsurance, governed since April 2016 by IFSB-18, where risk is shared among contributing operators rather than transferred.

Interest-free loan when the fund runs a deficit

If claims exceed contributions, the operator injects a qard, an interest-free loan provided for by IFSB-14. The loan is repaid only from future surpluses, which spreads the cost of a bad year across several financial periods without any finance charge.

What happens to the surplus after a quiet year

When few incidents occur, the fund's underwriting surplus may be paid back to the companies, offset against future contributions or granted as a renewal discount. In Malaysia, the operator may not take more than 50 % of it.

Real availability of cover by market

The research notes identify no cyber takaful product sold in France, Belgium or Switzerland. A European business will therefore have to approach operators in the Gulf or Asia, or negotiate an adapted policy with an insurer subject to Solvency II.

Applicable prudential and accounting frameworks

Beyond IFSB-14 on risk management, the AAOIFI FAS 43 standard, in force since 1 January 2025, governs the accounting of takaful contracts. Smaller firms should also read our guide to takaful protection for small businesses before choosing cover.

Setting up compliant cyber cover

1. Map your critical systems, the personal data you hold and the cost of one day of downtime before requesting a quote.
2. Check that the operator holds a licence from the local regulator and has a sharia board whose members are named.
3. Obtain the product's fatwa, especially on any ransom reimbursement and on regulatory fines.
4. Compare the fund contribution, the wakala fee and the written rule for sharing the surplus.
5. Read the exclusions: cyber warfare, failure to install updates, attacks that predate the start of cover.
6. After an incident, notify the operator at once, keep the technical logs and follow the agreed crisis management procedure.

What makes up the price of takaful cyber protection

Documents required to apply

• Company registration extract and identity document of the manager
• Completed and signed IT security questionnaire
• Description of backups, firewalls and multi-factor authentication
• Record of cyber incidents over the last three to five years
• Latest annual accounts or declared turnover
• List of IT service providers and hosting contracts

Pitfalls to avoid with Islamic cyber insurance

• Accepting a cyber policy sold as halal with no identified sharia board and no written fatwa covering that specific product.
• Assuming a ransom will be reimbursed when the sharia board or the policy terms expressly exclude it.
• Mistaking a takaful window of a conventional insurer for a dedicated takaful operator, without checking that the funds are kept separate.
• Underestimating exclusions linked to uninstalled patches, which often void compensation for an intrusion that would otherwise be covered.
• Relying on a verbal promise of an annual surplus that appears neither in the contract nor in the operator's report.

Your questions on takaful cyber insurance