What DyGIST tells us about market resilience — and why it matters beyond the stress test

For three weeks in May 2026, something unprecedented happened in UK general insurance regulation. The Prudential Regulation Authority ran a stress test that didn't ask firms to fill in a template and wait six months for results. Instead, it unfolded in real time — a sequence of escalating adverse events, delivered week by week, demanding immediate responses from participating firms.

That exercise was the Dynamic General Insurance Stress Test — DyGIST. It's now complete. The PRA is analysing submissions and will publish aggregate findings later this year. But the exercise has already sent clear signals about what resilience looks like in a market where crises don't arrive in neat, standalone packages.

What made DyGIST different?

Previous general insurance stress tests — the 2022 GIST, for example — followed a familiar pattern. The regulator published a scenario, firms modelled the impact on their balance sheets, and results were published months later. Useful, but static. The test measured whether firms would have survived a past hypothetical.

DyGIST changed the question. Instead of “would you survive this scenario?”, it asked: “how would you respond if this was happening right now?”

This is more than a methodological shift. It reflects the PRA's evolving view that financial resilience can't be separated from operational capability. A firm with adequate capital but no ability to mobilise its people, make decisions under pressure, or communicate credibly with supervisors is not resilient — no matter what the numbers say.

The five scenarios

The exercise was built around five distinct adverse events, each designed to stress different parts of a general insurer's operations:

1. Hurricane Taurus (North Atlantic)

A major hurricane making landfall, requiring exposure assessment, reinsurance recovery analysis, and claims response planning — all while the event footprint continued to develop.

2. Pacific Northwest earthquake

Aligned to Lloyd's Realistic Disaster Scenarios (RDS), this tested catastrophe modelling capability and the ability to translate modelled losses into solvency impacts at speed.

3. Windstorm Nevis (UK)

A domestic windstorm event, stressing UK property exposure and the interplay between gross and net positions after reinsurance.

4. Supply chain cyberattack (Manufacturing Downtime)

A systemic cyber event disrupting manufacturing supply chains, testing firms' ability to assess non-physical damage business interruption exposures — notoriously difficult to model.

5. Global market downturn

A macroeconomic stress hitting asset values and liability adequacy simultaneously, compressing both sides of the balance sheet.

The five scenarios didn't run in sequence — they overlapped. By the second week, firms were managing multiple concurrent events, each at a different stage of development, each demanding different analytical responses.

Each week brought new “injects” — additional detail, revised parameters, unexpected developments — that required firms to revisit earlier assumptions and update their submissions.

The dynamic element: what it tested

The live, multi-week format exposed dimensions of resilience that a static exercise never would. KPMG's post-exercise analysis identified five key lessons that cut across participating firms:

1. Regulatory engagement isn't secondary

Firms that treated PRA communication as something to handle after the analysis was complete found themselves in trouble. The dynamic format meant supervisors expected ongoing, credible updates — even when numbers were preliminary. The best-performing firms embedded regulatory engagement into their response workflow, not bolted it on at the end.

2. Rehearsal separates the ready from the scrambling

Firms that had run dry-run exercises before the live phase were visibly more effective. They had clarified roles, identified data dependencies, and built confidence in producing outputs at speed. Those that hadn't spent the first week doing that work under live pressure — while also trying to respond to the scenarios.

3. Imperfect data can't mean no decision

This was perhaps the most uncomfortable lesson. The exercise required firms to submit numbers and explain their positions before analysis was fully refined — exactly as a real crisis would demand. Teams accustomed to precise, fully-validated outputs had to adapt to producing credible ranges, transparent assumptions, and timely judgement calls. Some found this harder than others.

4. Exposure management and reinsurance are the pinch points

The live phase placed intense pressure on specialist teams. Understanding contract terms, calculating net positions, and maintaining BAU activities like reinsurance renewals all had to happen simultaneously. For many firms, these teams emerged as the binding constraint — and a single point of failure if not adequately resourced.

5. Governance gets tested under time pressure

Clear ownership, decision rights, and escalation routes proved essential. Firms that had ambiguous governance — where it wasn't obvious who could sign off on a submission or management action — lost time to internal friction that they couldn't afford.

What this signals about market resilience

The exercise hasn't produced pass/fail results, and aggregate findings won't be published for months. But we can already draw several conclusions about what DyGIST tells us about the state of market resilience:

Capital adequacy isn't the issue — or at least, not the interesting one. The firms selected — over 20 participants representing more than 80% of the PRA-regulated GI market by gross written premium — are, by and large, well-capitalised. The test wasn't designed to find firms that would fail; it was designed to find out how the market functions under pressure.

The gap between modelled and actual resilience is real. Having the right systems, data, and models is necessary but not sufficient. The exercise exposed how much depends on people — on clear roles, practised workflows, confident decision-making, and the ability to communicate under uncertainty.

Multi-peril stress is the new normal. The overlap of nat cat, cyber, and market scenarios wasn't an artificial construct — it reflects the world insurers actually operate in. A hurricane doesn't wait for the cyber incident to resolve. The PRA's choice to run concurrent scenarios signals that future supervisory expectations will demand this kind of integrated thinking.

Operational resilience and financial resilience converge under pressure. The firms that struggled most weren't necessarily those with the weakest balance sheets — they were those where governance, data flows, or team coordination broke down under time pressure. DyGIST demonstrated that these are not separate domains.

The market learned — fast. By the third week, participating firms were demonstrably better at the exercise than they had been in the first. Mobilisation was quicker, submissions were more confident, engagement was smoother. This is itself a resilience signal: the market's capacity to learn and adapt under stress is perhaps the most important capability of all.

What happens next?

The PRA will publish aggregate findings later in 2026. These will include thematic observations on sector-wide strengths and vulnerabilities. The PRA has also signalled that it will engage with stakeholders to reflect on lessons learned and inform the design of future exercises.

One thing seems clear: the dynamic element is unlikely to be a one-off. Even if the PRA doesn't run a full DyGIST every two-year cycle, the principles it tested — real-time response, multi-peril scenarios, operational capability alongside financial metrics — will influence supervisory expectations going forward.

For life insurers, too, there are signals here. The PRA has already noted that a similar dynamic approach could be applied to a future Life Insurance Stress Test (LIST). The next LIST is planned for launch in January 2028.

The opmodal perspective

At opmodal, we work with firms that are building the operational infrastructure to handle exactly this kind of challenge. DyGIST confirmed something we see repeatedly in transformation work: resilience lives in the processes, not just the policies.

The firms that performed best in DyGIST didn't necessarily have more capital or better models. They had clearer ownership of critical processes. They had rehearsed decision-making workflows. They knew who was accountable for what, and they had practised operating under time pressure.

This is what good operational design delivers — not just efficiency in business-as-usual, but the ability to function when things go wrong. A business blueprint that defines clear process ownership, governance, and escalation isn't just a transformation tool; it's a resilience asset.

The PRA has sent a clear signal: resilience is a capability, not a metric. And like any capability, it can be designed, built, and tested — before the crisis arrives.

The PRA's aggregate findings from DyGIST 2026 are expected later this year. We'll cover them here when they land.