In Johor Bahru, a city at the southern tip of Malaysia and 23 kilometres away from neighbouring Singapore, a burgeoning industry is emerging that could see it transform into a hub for data centres. In recent years, Silicon Valley behemoths like Alphabet, Microsoft, and chip giant Nvidia have invested billions into data centres in the Malaysian city.
But Johor Bahru is not alone. Asia Pacific (APAC) is experiencing a large-scale data centre boom with a strong pipeline of data centres planned and under construction. Insurance broker and risk adviser Marsh forecasts that the region’s data centre market will rise 12% annually to hit nearly US$54 billion by 2028 as ongoing digitalisation and the artificial intelligence (AI) upsurge continues to fuel demand.
The insurance sector is poised to capture Asia’s data centre boom with investments and capacity set to grow. Yet their operators and owners are also taking stock of the unique risks of operating data centres in the region, from constructing and managing centres in high-rise buildings to natural catastrophe exposures and energy vulnerabilities.
Build-out
In Malaysia and Indonesia, data centres are being constructed in locations that were once-lush rainforests and jungles. Facilities in mature markets like mainland China, Hong Kong, Japan, Singapore, and South Korea, are often placed in high-rise buildings.
Each market has differing local standards, meaning data centres “can be built to different protection levels,” says Matthew Day, Head of RE&LP Asia at Generali.
But all data centres must be constructed with safety, property protection, and business interruption top of mind. For instance, facilities require fire protection and detection systems that are designed and installed for the type of building they are situated in. Centres also need backup and maintenance systems and appropriate risk management strategies for electrical and cooling systems to operate 24 hours, seven days a week, sans interruption.
In Asia-Pacific, that translates into a “typical data centre project’s sum insured [that] ranges from US$275m to US$330m pending on a renovation of an existing building—typically seen in a city like Hong Kong—or a new facility being constructed from the ground-up,” says Dawood Yeung, Head of Engineering Underwriting, Asia, at Generali.
Yeung notes that there is “sufficient capacity from APAC’s construction insurance market to cover these projects.” Several key factors dictate the premium level and deductibles of the policy that engineering underwriters and risk engineers will consider and assess, he adds. These include the electrical power equipment where large battery storage systems are placed, fire protection design—including its compartmentation, detection and suppression systems—alongside fire and water damage via cable openings, equipment theft, and site congestion during construction.
Chris Tan
Loss Prevention Specialist for FMDespite the sector’s rapid growth in the region, the data centre industry “requires more insurance and underwriting capacity to meet its needs and ensure comprehensive risk coverage,” says Chris Tan, Loss Prevention Specialist for FM, a commercial insurer.
“Insurers are making efforts to expand capacity. But whether they are ready or not depends on the company… and if they have engineers to help capture risk appropriately for underwriting,” Tan adds.
Operational risks
Data centres operating in Asia-Pacific face specific risks, such as exposure to natural catastrophes. “With Asia hardest hit by extreme weather, it is important to note that there is potential physical damage and subsequent business interruption exposures for data centres in [Asia’s] typhoon and flood-prone geographies,” says Larry Liu, Marsh Asia’s Communications, Media, and Technology (CMT) leader.
Data centres located in high-rise structures typically place utilities at the top or side of the building, which creates additional hazards. For instance, if a backup power generator catches fire, it is difficult to contain in a vertical building where “fire can more easily spread throughout,” Tan says. The chilled water pumping systems that cool the centres “flow up, meaning greater potential for leakage. If any of these lines go through data halls where servers are located, all of them become perils,” he adds.
Certain markets, such as India and Indonesia, are particularly vulnerable to power outages. To mitigate these risks, operators should “build in areas where energy is resilient. Even if they can’t control the intensity or frequency of power outages where they are operating, they can build resilience to that by having dual power sources like backup power and maintenance of their electrical equipment,” Tan says.
Having engineering boots on the ground greatly supports on-site risk assessment, says Tan. They can “identify potential vulnerabilities and give operators tailored recommendations on how to mitigate these exposures and improve their overall risk,” he adds.
Regulatory compliance, alongside security and privacy, remain the key issues for data centre operators, according to Marsh’s Asia and Global Technology Risk Study 2024. The rules and regulations governing data centres in Asia “change quickly and frequently because of factors like energy needs. Fast changes in government policy mean data centre operators and their insurers need to react accordingly,” Tan says.
In 2019, for instance, the government of Singapore halted data centre construction because of its outsized energy and water usage. Singapore lifted the moratorium only in 2022 and called for new facilities to have improved efficiency and to be held to higher sustainability standards. “This sector is experiencing rapid growth, with numerous discussions focusing on cost-saving measures and sustainable practices—particularly concerning new technologies for power usage and cooling capabilities,” says Tan.
“Insurers are developing fresh insights into these risk exposures and should provide comprehensive coverage options and risk management solutions to help data centers navigate these evolving challenges effectively.”
