Open research, August 2026
An open ontology for insurance and reinsurance, tested against every insurer in Europe
There was no open, usable ontology for insurance and reinsurance entity data, so we built one and proved it on the hardest available evidence: the European Union's own register of every authorised insurer and reinsurer, joined to the global identifier system that is supposed to name them, and cross-checked against a national regulator's separate register. The result is 276,683 triples of public data and eight findings that no single source could see. One in five active European insurers has no global identifier. Four of the identifiers that are filed cannot exist. Two different SCOR reinsurance companies share one. This page explains what we built, how, what it found, and how the same method applies to your own entity data.
The short version
- The artefact: an open OWL 2 ontology, two SKOS registries and a three-layer SHACL governance suite for insurance and reinsurance undertakings, their authorisations, their cross-border passports and their identifiers. Public under CC BY 4.0 and MIT.
- The evidence: the complete EIOPA Register of Insurance Undertakings, 33,924 rows covering 4,842 authorised undertakings and 29,082 cross-border operations, joined to a same-day harvest of all 3,630 identifiers it files from GLEIF, then cross-checked against BaFin's German register.
- The headline defects: 643 active insurers with no identifier, 4 arithmetically impossible identifiers, 42 direct contradictions about whether an insurer exists, 3 identifier collapses across distinct legal entities, 283 passports outliving their authorisation.
- The clean result: where both the European and German registers populate the identifier field, they agree perfectly across 344 matched undertakings, with zero conflicting values. The problem is coverage, not contradiction.
- Reproducibility: five commands, two public sources, no licensed data, no API keys.
Why insurance had no open ontology worth using
Insurance is the least served major financial vertical in open semantics, and this is verifiable rather than rhetorical. We checked the published sources directly in August 2026 rather than relying on secondary claims.
FIBO, the Financial Industry Business Ontology maintained by the EDM Council and released under an MIT licence, is the natural place to look. Its complete insurance content is four classes inside a guaranty module, InsurancePolicy, Insurer, InsuranceBackedGuaranty and Policyholder, plus InsuranceCompany and InsuranceService among the financial services entities. Insurance appears there in service of credit enhancement rather than as a modelled domain. Reinsurance is absent entirely: the string appears exactly once in the whole ontology, inside a free-text definition of an insurance company. There is no Reinsurer, no ReinsuranceContract, no Treaty, no Cession, no Retrocession.
The detailed models the industry actually runs on are real but closed. ACORD maintains substantial standards, including the reinsurance and large commercial families, and its Reference Architecture carries the closest thing the sector has to a canonical information model, but access requires membership or subscription. The Lloyd's Core Data Record, extended to proportional and non-proportional treaty reinsurance in version 3.3 during May 2026, is published through interactive portals rather than as a downloadable open artefact. The one unambiguously open standard, Oasis LMF Open Exposure Data under CC0, includes genuine reinsurance structures in its ReinsInfo and ReinsScope files, but it is a flat-file exposure schema for catastrophe modelling rather than an ontology, and no semantic serialisation of it exists. The OMG Property and Casualty Data Model is openly downloadable and relational, and has been frozen at version 1.0 since 2014.
So the field has shallow-but-open, deep-but-closed, or open-but-not-semantic. Nothing bridges them, and reinsurance structures have no public formal semantics at all. We started where the public evidence is richest and the consequences are most concrete: the register fabric that every regulated European insurer already sits inside.
What the ontology actually models
The model is deliberately small, because a large model that nobody validates is decoration. Four commitments carry all the weight.
Authorisation is a lifecycle, not an edge. An undertaking's home registration is a node carrying its own start date, end date and issuing authority. So is each cross-border operation. Modelling them as nodes is what allows the rule "an open passport must not outlive the authorisation it derives from" to exist as an executable constraint. Model the same facts as edges between companies and countries and that rule cannot be written at all, which is why in practice it becomes a spreadsheet somebody rebuilds each quarter.
Identifiers are assertions, not attributes. Every identifier in the graph is a node carrying three things a string column cannot: the scheme it belongs to, the source system that asserted it, and its computed validation state. This is the difference between a system that can represent "the European register and the German register disagree about this company's identifier" and one that silently overwrites one with the other. It is also what makes reconciliation a query rather than a project.
Scope is declared as data. The SKOS registry states that an LEI is entity-scoped and globally unique, while a national authority code is authority-scoped and unique only within one regulator's namespace. This matters immediately: a branch legitimately carries its head office's LEI while being registered under a host regulator's own code. Without declared scope that pattern looks like a duplicate identifier and generates false alarms. With it, the genuine collapses stand out, which is exactly how we isolated the three cases where one identifier names materially different companies.
Operation modes come from law, not from a dropdown. The five modes in the register vocabulary are given definitions grounded in Directive 2009/138/EC: freedom to provide services under Articles 147 to 149, establishment through a branch under Articles 145 and 146, and third-country branches under Article 162. A vocabulary whose concepts cite the legal instrument that creates them can be argued about with a regulator. A dropdown cannot.
The same design was first proved on the United States fund universe in our Investment Fund Ontology. Insurance is its second instantiation, which is itself a finding: the discipline transfers across regulated register fabrics without redesign.
The method, and the two things that nearly broke it
The EIOPA register has no stable export URL. Its export button is an ASP.NET postback inside a SharePoint application, so the pipeline fetches the page, lifts the view-state and event-validation fields, and replays the postback to obtain an 11 megabyte semicolon-delimited file. That is a fair summary of the state of insurance data infrastructure in 2026: the European Union's complete register of insurers is public, and reaching it programmatically requires emulating a button click. The identifier harvest then runs against the free GLEIF API in batches of fifty at unauthenticated rate limits, taking about ten minutes for 3,630 identifiers, with a resumable cache so an interrupted run costs nothing.
Two problems in the source data would have silently corrupted every number on this page, and both are worth stating because they are the kind of thing that survives into production systems unnoticed.
The date format. Every date in the export is formatted as day, month, year followed by a time component. A parser expecting a bare date silently discards all 41,920 date values rather than failing loudly. The consequence is that every registration appears to have no end date, so every undertaking appears active, and the rules that depend on activity inflate roughly threefold: 348 lapsed identifiers instead of the true 118, and 680 contradictions instead of the true 42. We caught it because the graph queries and the independent set-based pipeline disagreed, and the disagreement had to be explained. A single implementation would have published inflated numbers with total confidence.
The entity key. Branch rows frequently carry the host regulator's registration code rather than the home one. Measured precisely: of 298 identifiers appearing on both domestic and branch rows, 171 use a different code on the branch row. A naive single-pass join would either create phantom companies or merge distinct ones. The pipeline therefore resolves in two passes, joining branch rows to their home undertaking by key first and by unambiguous identifier second, and where neither works it creates an explicit RegisteredPresence node rather than guessing. 1,839 rows across 185 keys land there, third-country branches by construction plus branch rows the register itself does not link back to a head office. The join failure is recorded as data. An ontology that silently guessed would demonstrate better and govern worse.
Eight findings, and what each one costs
| Finding | Number | Class | Operational consequence |
|---|---|---|---|
| Active domestic insurance and reinsurance undertakings carrying no LEI at all, twelve years after EIOPA issued guidelines asking national authorities to ensure they hold one | 643 of 3,304 (19.5%) | gap | Any screening, exposure aggregation or counterparty query keyed on LEI silently omits one in five authorised EEA insurers. |
| LEI values that fail ISO 7064 check digits, meaning they cannot exist in the global system. One is twenty zeros. One is a letter O where the real identifier carries a zero | 4, all absent from GLEIF | defect | Each one severs an authorised insurer from every downstream system keyed on LEI, and each is detectable by arithmetic that takes microseconds. |
| Active undertakings whose LEI registration has lapsed at GLEIF: authorised to write business, not maintaining the identifier that names them | 118 (63 French) | signal | Lapsed records stop being refreshed, so any attribute you read from them ages silently while the entity trades normally. |
| Active undertakings whose LEI points at an entity GLEIF marks INACTIVE: one register says authorised to insure, the other says the company has ceased | 42 | defect | A direct contradiction about whether a live insurer exists. Whichever system is wrong, an automated decision that trusts either one alone is wrong too. |
| LEIs filed against more than one register key; of those, the number carrying materially different names; of those, hard collapses on domestic rows alone, including one identifier shared by SCOR Global Reinsurance France and SCOR Global Reinsurance Ireland | 227 / 56 / 3 | signal | Two distinct reinsurance legal entities resolving to one identifier is precisely the failure that corrupts treaty counterparty resolution and group exposure roll-up. |
| Open cross-border operation rows belonging to undertakings whose home authorisation has already ended: passports outliving the licence they depend on | 283 | defect | A passport is derived permission. If the source authorisation has ended, an open passport row is either a stale record or an unlicensed activity, and the register does not distinguish them. |
| Register names that disagree with the GLEIF legal name after aggressive normalisation, including MAPFRE MIDDLESEA against MAPFRE MALTA, a rename one side has not absorbed | 402 of 2,661 (15.1%) | signal | Name matching is the fallback when identifiers are missing, and this is the measured error rate of that fallback on official data. |
| Status of every distinct LEI filed anywhere in the register: issued, retired, lapsed, duplicate, annulled, absent | 2,590 / 680 / 351 / 3 / 1 / 4 | signal | A register is not a snapshot of live entities. Nearly a fifth of the identifiers in it name entities that have been retired. |
All figures are computed from the 14 August 2026 export and same-day harvest. Both sources are live systems, so a later run produces different totals while the method reproduces exactly.
The letter O that cut a Danish insurer out of the global identifier system
An LEI carries two check digits under ISO 7064 MOD 97-10. Expand each character to its base-36 value, concatenate, divide by 97, and a valid identifier leaves a remainder of exactly one. The check costs microseconds and requires no network call, no licence and no vendor. Four values in the European Union's register of insurers fail it.
One is twenty zeros, filed as the legal entity identifier of an insurance company. The most instructive is 5493O00MN7XN3BBKCE67, filed for AP Skadesforsikring of Denmark. The fifth character is the letter O. The company's real identifier, which resolves correctly in GLEIF to the same insurer, carries a zero in that position. Somebody typed it, no form divided by 97, and the transposition now sits in the official register of a European supervisory authority, quietly disconnecting that insurer from every system keyed on the global identifier. All four impossible values are absent from GLEIF, which is the expected result and a useful confirmation: the arithmetic and the global register agree with each other, and both disagree with what was filed.
The contradictions run deeper than typing errors. 118 active undertakings hold identifiers that have lapsed at GLEIF, meaning the company is authorised to write insurance while the identifier naming it is no longer being maintained, so any attribute read from that record ages silently. More seriously, 42 undertakings that the European register shows as authorised carry identifiers whose entity GLEIF marks INACTIVE, meaning the company has ceased to exist. One of the two systems is wrong about a live European insurer, 42 times over. The graph records the disagreement and refuses to adjudicate it, because adjudicating without evidence is how bad data becomes confident data.
The finding with the sharpest commercial edge is the smallest. Of 227 identifiers filed against more than one register key, most are legitimate branch structures that the scope declarations explain away. 56 carry materially different names. Three are hard collapses on domestic registrations alone, and one of those three is 549300KCPG3666EE4546, filed for both SCOR Global Reinsurance France and SCOR Global Reinsurance Ireland Designated Activity Company. Two distinct reinsurance legal entities, in different jurisdictions, sharing one identifier in the European register. Any system that resolves treaty counterparties, aggregates group exposure or computes concentration limits from that identifier is treating two companies as one.
Testing the gap against a second regulator: the German case
The largest finding needed a second opinion. 643 active insurers with no identifier is either a real absence or a transmission failure between national regulators and the European register. 492 of the 643 are German, so Germany is the test: BaFin publishes its own register with its own identifier column, reachable by a similar export mechanism. We built the join with deliberately strict matching, on the European identification code against BaFin's registration numbers, or an exact match on a normalised legal name.
The result cuts both ways, and both directions are useful. BaFin's own file carries an identifier for only 505 of the 4,824 German-supervised entities it lists, which is 10.5 per cent. So most of the missing identifiers are genuinely missing at source, not lost in transmission, and the European register is if anything the more complete of the two. But the pipe leaks as well: among the strictly matched subset, 14 undertakings that the European register records as having no identifier demonstrably have a valid one published by their own regulator, including Gothaer Lebensversicherung, Nürnberger Lebensversicherung, HDI Lebensversicherung and Generali Versicherung. Every one of those 14 passes the check-digit test. They are real, valid, free to obtain, and absent from the European view.
Two further results deserve stating plainly because they are honest negatives. First, only 44 of the 492 matched at all under strict rules, so this measures a floor rather than the full extent; a fuzzier match was tested and rejected after it collapsed two distinct Saarland insurers onto a single identifier, which is precisely the error class this work exists to catch, and shipping a number produced by a method we had just watched fail would have been indefensible. Second, and more encouragingly, among the 344 undertakings where both registers populate the field, the two agree on every single value. Zero conflicts. European insurance entity data has a coverage problem, not a contradiction problem, and coverage problems are the cheaper kind to fix.
BaFin's file carries one defect class the European register does not: five identifiers failing the check digit, three of which are 19 characters long. A 19-character identifier is not a typing error, it is a truncation, which points at a field width or an export path rather than a person. That is a different remediation entirely, and you can only tell the two apart by running the arithmetic and looking at the length.
The transferable method, in seven steps
None of the findings above depend on insurance. They depend on a method that applies to any entity data governed by more than one register, which describes almost every regulated dataset in financial services. Here is the method, stated so you can apply it without us.
1. Key entities on the register that governs them, never on the identifier you wish were clean
IRO keys an undertaking on home country plus national authority code, because that is the register’s own primary key. The LEI is treated as an assertion to be validated, not as identity. Had we keyed on LEI, the 643 undertakings without one would have vanished from the graph and the three shared identifiers would have silently merged distinct companies.
2. Make every identifier a node, not a string column
An identifier assertion carries the scheme it belongs to, the system that asserted it, and its computed validation state. Two systems asserting different identifiers for one company then becomes representable and queryable rather than an overwrite. This single decision is what turns reconciliation from a project into a query.
3. Declare scope as data
The SKOS registry states that an LEI is entity-scoped and globally unique while a national authority code is authority-scoped and unique only within one regulator. A branch legitimately carrying its head office’s LEI under a host regulator’s code is then modelled correctly instead of raising a false alarm.
4. Reify anything with a lifecycle
Authorisations and passports have start dates, end dates and issuing authorities. Model them as nodes and "a passport outliving its authorisation" becomes a rule that runs. Model them as edges and it becomes a spreadsheet someone rebuilds each quarter.
5. Compute arithmetic in code, enforce policy in shapes
Check digits are computed by the pipeline and asserted into the graph; the shapes then require the recorded result. Encoding modulo 97 arithmetic in SPARQL is possible and unwise. The independent validator re-finds exactly the four impossible identifiers from the recorded state, which is how you know the two halves agree.
6. Grade severity honestly
An impossible identifier is a Violation. A missing one is a Warning that creates a work queue. A lapsed one is a signal to investigate. Systems that flag everything at one level get ignored at every level, and a validation report nobody reads is worse than no report.
7. Join a second source and record the disagreement rather than resolving it silently
Joining the European register to the global identifier system produced 118 lapsed, 42 contradicted and 402 name mismatches. Joining it to a national register recovered 14 identifiers Europe does not hold. None of these were visible inside any single source.
Where this bites inside an insurance business
The findings on this page come from public register data, but the defect classes are the ones that appear inside carriers, brokers and reinsurers, usually with more sources and less discipline. Four places where they surface:
Counterparty and sanctions screening. Screening keyed on a global identifier misses every entity that has none. On the European register that is one in five active insurers, and the fallback is name matching, whose measured error rate against official data on this evidence is 15.1 per cent. Knowing both numbers changes how you configure the control and what you tell an auditor about its coverage.
Treaty and facultative counterparty resolution. Cession chains resolve parties by identifier. When two legal entities in the same group share one, exposure aggregates wrongly and concentration limits are computed against a fiction. The SCOR pair on this page is a public example of a private problem, and the reason reinsurance is the hardest place to run this discipline is that nobody has published formal semantics for treaties at all.
Regulatory reporting plumbing. Solvency II reporting depends on stable entity identity across group structures and reporting periods. Entities whose identifiers lapse, retire or change while the company continues trading break period-on-period comparability quietly, and the break usually surfaces as an unexplained variance rather than as a data-quality alert.
Grounding for automated systems. Every serious insurance data programme in 2026 wants language models and agents reading its entity data. A model grounded in a graph that contains an impossible identifier, or that merges two reinsurers, will answer confidently and wrongly, and the confidence is the dangerous part. Validation is not a step before the interesting work. It is what makes the interesting work safe to deploy.
Common questions
Is there an open ontology for insurance and reinsurance?
Until now, effectively no. FIBO, the open financial industry ontology from the EDM Council, contains four insurance-related classes inside a guaranty module plus two entity classes, and the string "reinsur" appears exactly once in the entire ontology, inside a free-text definition. There is no Reinsurer class, no Treaty, no Cession. ACORD standards and the Lloyd's Core Data Record are real and detailed but sit behind membership or portal access. Oasis LMF Open Exposure Data is genuinely open under CC0 but is a flat-file exposure schema rather than an ontology. The Insurance Register Ontology published at github.com/fabio-rovai/insurance-register-ontology is an open OWL 2, SKOS and SHACL artefact for insurance and reinsurance entity data, licensed CC BY 4.0 and MIT.
Does FIBO cover insurance or reinsurance?
Barely. Verified against the published FIBO source on GitHub in August 2026, the complete insurance content is InsurancePolicy, Insurer, InsuranceBackedGuaranty and Policyholder in the FBC guaranty module, plus InsuranceCompany and InsuranceService in the financial services entities module. Insurance appears there in service of credit enhancement rather than as a modelled domain. Reinsurance is not modelled at all: no Reinsurer, no ReinsuranceContract, no Treaty, no Cession, no Retrocession.
How many EU insurers are missing a Legal Entity Identifier?
In the EIOPA Register of Insurance Undertakings as exported on 14 August 2026, 643 of 3,304 active domestic insurance and reinsurance undertakings carry no LEI at all, which is 19.5 per cent. 492 of those are German. The German national register published by BaFin is not more complete: it carries an LEI for only 505 of the 4,824 German-supervised entities it lists, which is 10.5 per cent.
How do you validate a Legal Entity Identifier?
An LEI is 20 characters under ISO 17442: 18 alphanumerics followed by two decimal check digits computed with ISO 7064 MOD 97-10. To validate, expand every character to its base-36 numeric value, concatenate the digits, and confirm the resulting integer modulo 97 equals 1. This is pure arithmetic and takes microseconds. Applying it to the EIOPA register finds four values that cannot exist, and to the BaFin register five more, three of which are 19 characters long and therefore truncated rather than mistyped.
What is the difference between an insurance data model and an insurance ontology?
A data model fixes the shape of records inside one system. An ontology fixes the meaning of entities and relationships across systems, independently of any storage layout, and can carry executable constraints. The practical difference in insurance is that a data model can hold two systems that disagree about which company an identifier names without noticing, whereas an ontology with reified identifier assertions makes that disagreement a query. The OMG Property and Casualty Data Model is an open relational data model, frozen at version 1.0 since 2014. An ontology such as IRO adds scope semantics, provenance per assertion, and SHACL rules that run continuously.
What is SHACL used for in insurance data governance?
SHACL is the W3C standard for validating graph data against declared shapes. In insurance entity data it lets a policy such as "an active undertaking must hold a valid LEI" or "a cross-border passport must not outlive the authorisation it derives from" exist as an executable artefact rather than a paragraph in a procedures manual, running continuously against live data instead of during a quarterly remediation project. Severity grading matters: a missing identifier is a Warning that creates a work queue, while an arithmetically impossible identifier is a Violation.
Open, reproducible, and free to use
The ontology, both SKOS registries, the three-layer SHACL suite, the register fetcher, the identifier harvester, the two-pass entity resolution, the cross-register test and the query library are public. Ontology and documentation under CC BY 4.0, code under MIT. Every figure on this page traces to five commands run against two public sources, with no licensed data, no API key and no vendor. The build report lists what could not be obtained as carefully as what could, because a study that only reports its successes is marketing.
Working with us
We build this for insurers, reinsurers, brokers and supervisors on their own data. The public version took a few days against two sources; the private version is the same discipline applied to policy administration, claims, treaty and finance systems that disagree with each other in ways nobody has measured yet.
A typical first engagement is bounded and diagnostic: take your entity data as it is, build the identifier fabric, run the validation layers, and return a graded findings report that separates the impossible from the missing from the merely stale, with the queries attached so your team can re-run it. That report is useful whether or not the work continues, which is the point. After that the usual paths are an ontology and shape suite your systems validate against continuously, an entity resolution layer across internal and external registers, or grounding work that makes your entity graph safe for automated systems to read.
If you run insurance entity data, register reconciliation, Solvency II reporting plumbing, or treaty counterparty resolution, write to fabio@thetesseractacademy.com. Send a description of the sources that disagree and we will tell you which of the defect classes on this page we would expect to find, before any commitment.
Related work: the Investment Fund Ontology applies the same identifier discipline to the United States fund universe, and our machine-validated ontologies study measures when an ontology can actually reject a wrong statement.
