TRIA's 2027 Sunset: What It Means for Your Terrorism Coverage

Somewhere in your commercial property renewal is a page you probably signed without reading: the terrorism disclosure notice. It points to a federal program, the Terrorism Risk Insurance Act (TRIA), that quietly shapes what your policy will and won't pay after an attack. That program has an expiration date, December 31, 2027, and Congress hasn't finished deciding what comes next. Here's what's actually at stake for your business.

The deadline, and where Congress stands

TRIA was passed after September 11 and has been extended four times, most recently by the 2019 reauthorization, which runs the program through December 31, 2027.

In 2026, both chambers moved, but not on the same bill:

• H.R. 7128 (TRIA Program Reauthorization Act of 2026) passed the House 373–15 on June 29, 2026. It extends the program through 2034, raises the certification threshold from $5 million to $10 million for acts occurring in 2029 or later, and requires Treasury to publish a Federal Register notice within 30 days of starting to consider a certification. Treasury would then have 90 days to decide, extendable to no more than a year after the event, and an act not certified in that window couldn't be certified later.
• S. 4395 (Terrorism Risk Insurance Program Reauthorization Act of 2026) passed the Senate by unanimous consent on September 28, 2026. It is a straight extension through 2034. Apart from updating the recoupment deadlines to match, it leaves the program unchanged.

As of November 13, 2026, the two versions have not been reconciled. The Senate bill has gone to the House, which hasn't voted on it, and industry groups are pushing to finish in the lame-duck session. Until one identical bill passes both chambers and is signed, plan around the 2027 date.

How TRIA actually works

TRIA isn't insurance you buy from the government. It's a federal reinsurance backstop that sits behind private insurers, which is why they're willing to offer terrorism coverage at all. The mechanics:

• Certification. An event only counts if the Treasury Secretary, in consultation with the Secretary of Homeland Security and the Attorney General, certifies it as an act of terrorism. Insured losses must exceed $5 million, and acts committed as part of a war declared by Congress are excluded (except for workers' comp).
• Program trigger. Industry-wide insured losses must exceed $200 million before the federal share applies.
• Insurer deductible. Each insurer first absorbs losses equal to 20% of its prior-year direct earned premium on covered lines.
• Federal share. Above that deductible, the government pays 80% of insured losses.
• Annual cap. Neither the government nor insurers pay for insured losses above $100 billion in a year.
• Recoupment. Federal payments up to a set industry retention must be recouped through policyholder surcharges, at 140% of the recouped amount.

On your side, the key rule is "make available." Insurers writing covered commercial lines must offer coverage for certified acts on terms that don't differ materially from the rest of the policy. You can decline it, and insurers typically document that with your signature on the disclosure notice. Since domestic terrorism was added in the 2007 reauthorization, an attack doesn't have to involve a foreign actor to qualify.

What TRIA does not do

TRIA is narrower than most owners assume:

• Non-certified acts. If Treasury doesn't certify an event, the federal backstop doesn't apply. Treasury has never certified an act of terrorism under the program.
• Excluded lines. Commercial auto, burglary and theft, surety, and most professional liability (other than D&O) fall outside the program.
• Riot, civil commotion, and political violence. Those aren't "terrorism" under TRIA. Your commercial property form handles riot on its own terms, and perils like insurrection or war-like acts need separate coverage.
• Nuclear, biological, chemical, radiological. TRIA doesn't override your policy's other exclusions. Standard property forms exclude nuclear hazard and limit pollution, so an NBCR attack can fall outside coverage even when it's certified. Workers' comp is the exception.

That gap is exactly what standalone terrorism and political violence insurance fills: non-certified attacks, sabotage, and in broader forms, insurrection and civil war, often regardless of what Congress does.

The gotcha: the exclusion already on your policy

Here's the trap most owners miss. Many commercial policies already carry a conditional terrorism exclusion, attached at issuance and dormant while the program exists. If the federal program ends or changes in the ways the endorsement spells out during your policy term, it springs into effect and removes terrorism coverage mid-policy, with no new endorsement and no new notice required.

The standard ISO versions include IL 09 95 (property and inland marine), CG 21 87 (general liability), BP 05 64 (businessowners), and CU 21 44 (umbrella), plus NBC-only and sub-limit variants. These aren't theoretical. TRIA lapsed from January 1 to January 12, 2015, and conditional exclusions could take effect. After Congress reauthorized the program, Treasury told insurers to put in writing that they had withdrawn those exclusions, or would not enforce them, back to January 1.

So a policy that renews in, say, mid-2027 could show terrorism coverage on the declarations and still lose it on January 1, 2028. If your renewal straddles the deadline, read the endorsement schedule, not just the dec page.

Who should be paying attention

• Owners of large or iconic properties: trophy office, hotels, stadiums, high-profile retail.
• Las Vegas hospitality and gaming: hotels, casinos, and event venues draw exactly the crowds and visibility that make this exposure real, and their property and business income values are large enough that losing terrorism coverage mid-term matters.
• Event operators: festivals and large gatherings, where liability for an attack can reach your umbrella as well as your property.
• Anyone with lender covenants: financed commercial real estate, especially apartment buildings under agency multifamily loans, commonly requires terrorism coverage on both property and liability. If coverage drops, you can be out of compliance with your loan, not just underinsured.

What to do before your next renewal

1. Find your terrorism forms. Did you accept or reject TRIA coverage? Is there a conditional exclusion? 2. Check your loan and lease. Pull the insurance section and confirm what's required if the federal program goes away. Our guide to commercial lease insurance requirements walks through how to read one. 3. Line up the umbrella. Confirm your excess layers follow the primary on terrorism. See how umbrella and excess liability work. 4. Get a standalone option on the table if you're large, visible, or lender-bound, so you aren't shopping it in December 2027.

If a contract or loan covenant ties you to a specific terrorism requirement, talk to your attorney about what happens if the program lapses.

Our approach

At Cory Washington & Co., we read the terrorism forms on every property and liability policy we place, including the conditional ones most people never see, and we line them up against your loan documents and leases. For hospitality, gaming, venue, and habitational clients, we look at whether TRIA-backed coverage is enough or whether a standalone terrorism and political violence policy belongs in the program. We'll keep watching Congress and update clients as the reauthorization moves.

Renewing in 2027, or not sure what your current policy says about terrorism? Request a coverage review and we'll walk through it with you.

Frequently Asked

This article is general information for business owners, not insurance or legal advice, and does not bind or alter coverage. Policy terms, eligibility, and pricing vary by carrier and state — confirm specifics with our licensed team before making decisions.