Meta data center insurance: PML and residual risk

Picture a $14.3 billion industrial asset built for one user and financed with $12.6 billion of bonds. Now consider that its probable maximum loss during operations is estimated at $450 million. The tempting shortcut is to say that only 3% of the data center is insured. That shortcut is wrong. The two figures describe neither the same perimeter nor the same scenario. Yet they raise a valid question: when insurance stops at the modelled loss, who carries the casualty that exceeds the model?

The case is called Sopaipilla. This 960-megawatt IT-capacity campus, announced by Meta as a 1-gigawatt project, is under construction in El Paso, Texas. Ten data center buildings, a network building, six substations and other infrastructure are due to host Meta from December 2028. Meta’s 28 July announcement sets out the structure: BlackRock-managed funds own 80% of the venture, Meta owns 20%, leases the full campus and provides contractual support. S&P Global Ratings assigned a final A+ rating on 17 August to Sopaipilla Investor’s amortising notes.

The gap between $14.3 billion and $450 million reveals a change of scale rather than an absence of insurance. AI infrastructure has become so concentrated that financing must allocate risk among policies, corporate guarantees, project equity and creditors. Insurance remains central to the structure. It may no longer be its final layer.

What does the $14.3 billion asset actually include?

The public perimeter first removes a major source of confusion. Meta describes approximately $14 billion in total development costs for the buildings and long-lived power, cooling and connectivity infrastructure. S&P gives a more precise $14.3 billion commitment, consisting of a $13.7 billion initial development budget plus a 5% contingency. GPUs and servers do not appear in this published definition. Claiming that $450 million covers a $14.3 billion campus “including chips” would therefore add assets that the official source does not include.

The financing has also become clearer since the announcement. Meta referred to approximately $12.5 billion of debt. S&P’s final note describes $12.6 billion of amortising notes maturing in November 2048. These proceeds, $1.3 billion of equity from BlackRock-affiliated funds and $300 million of interest income will finance the issuer’s contribution to the project. Meta funds its 20% share through Bluebonnet Crossing LLC.

Meta will be the initial sole user. Six leases cover five data-building regions and the network data center; two additional leases cover the administration and support buildings. The initial term is four years, followed by four four-year options, for a maximum of twenty years. S&P says minimum rent applies even when campus utilisation is low. Meta guarantees the tenant’s payment obligations and carries operating, insurance, maintenance and some replacement costs. The credit therefore depends primarily on Meta’s signature and the contracts, far more than on the resale value of the walls alone.

The debt finances the majority interest held by BlackRock-affiliated funds. Meta’s rents and guarantees structure the credit.

Why does $14.3 billion divided by $450 million prove nothing?

The first figure is an aggregate development budget. The second is a probable maximum loss, or PML, estimated for a single property casualty during operations. S&P defines the PML in this case as the largest physical damage loss expected from one casualty event. The independent insurance consultant modelled an electrical or mechanical fire affecting two nearby data buildings and a mechanical yard: up to $427 million during construction and $450 million during operations.

This logic is common in large industrial risks. Insurance buyers do not always request a cheque equal to the replacement cost of every asset on a site. They seek a limit corresponding to the extreme loss that the model still regards as plausible, then retain or transfer the excess through other channels. The decisive questions concern the assumptions: how many buildings can one fire reach? Can shared infrastructure create a correlated loss? Does physical damage capture rent losses and the duration of interruption?

The Financial Times reported on 17 August, citing people familiar with the agreements, that the venture would pay about $5 million for all-risk property insurance capped at $427 million during construction and $450 million in operation, with the latter rising by 2% a year. The newspaper also described separate terrorism, rent-abatement and general-liability coverage. The full contracts are not public. These amounts must therefore be treated as attributed reporting on several policies, not as an exhaustive picture of the programme.

Risk family	Reported limit	What the source supports
Construction property damage	$427mn	PML used by S&P and all-risk limit reported by the FT
Operational property damage	$450mn	Single-event PML according to S&P; opening limit reported by the FT, rising 2% annually
Terrorism	$645mn	Separate coverage reported by the FT
Delay-related rent abatement	up to $218mn	Separate coverage reported by the FT
Commercial general liability	$50mn per event and $50mn aggregate	Limits reported by the FT

These limits cannot be added together to create $1.39 billion of general insurance. Each policy has its own trigger, exclusions, deductible, duration and likely definitions. A terrorism claim does not become an all-risk fire claim to top up a limit. Lost-rent coverage does not automatically pay for reconstruction. Adding the figures would produce a visually appealing but legally misleading total.

What does a 250-year or 500-year return period mean?

S&P and the FT report that the selected fire scenario has a frequency of 1 in 250 to 1 in 500 years. This wording does not mean that a countdown protects the site for two centuries. The USGS explains that a return period is the inverse of an annual probability and that rare events can occur close together.

Over twenty years, assuming a constant annual probability and independent years, a 250-year event has a cumulative probability of about 7.7%. For 500 years, it is about 3.9%. The calculation is correct under those assumptions. It says nothing about the quality of the fire model, changes in risk over time or the perimeter of damage captured.

RETURN-PERIOD CALCULATOR

What does a “1-in-250-year” event mean over twenty years?

The calculation converts a modelled annual frequency into a cumulative probability over the selected exposure period.

local calculation · zero tracker

Cumulative probability

7.7 %

Annual probability: 0.4 %
T: 250 years
N: 20 years

Formula

Cumulative probability = 1 − (1 − 1/T)ᴺ, where T is the return period and N is the number of years.

Limits

This calculation assumes a constant annual probability and statistically independent years. It validates neither Sopaipilla’s fire model, nor its scope, nor the adequacy of its coverage.

Methodological reference

USGS, Floods and Recurrence Intervals. The USGS notes that a return period is the inverse of an annual probability and does not describe a regular schedule.

The Sopaipilla model is more concrete than a frequency alone. S&P says the maximum potential damage would arise just before substantial completion, with a fire in one of two nearby data buildings and a mechanical yard. The agency also reports that the consultant characterised wildfire, flood, storm and earthquake risks as minimal. That conclusion belongs to the reviewed report and its assumptions. It is neither a guarantee that no casualty will occur nor an independent validation by l0g.

Why does an AI campus concentrate so many risks?

A traditional data center still resembled a highly electrified technical building. An AI campus now combines industrial systems that used to be assessed separately: buildings, high-voltage equipment, batteries, generators, liquid cooling, fibre, computing equipment, power supply and revenue contracts.

Swiss Re Institute says a single construction project can exceed $20 billion and that its value may double after GPUs and other technology are installed. The reinsurer writes that the traditional market can support only a fraction of the limits demanded at competitive rates for some construction risks. It does not conclude that campuses are uninsurable. It shows that accumulated value exceeds the familiar logic of an isolated building.

Geography compounds the concentration. Swiss Re estimates that more than a quarter of current and planned US capacity may lie in areas with at least three large-hail days a year, while about 40% may be in significant-to-very-high tornado-day zones. Those figures describe the US fleet, not Sopaipilla. They nevertheless illustrate the portfolio problem: a single storm, tornado or grid failure can affect several buildings, insured interests and lines of coverage.

Risk also sits in shared dependencies. Swiss Re says power accounts for 45% of data-center outages in Uptime Institute’s 2025 survey. Liquid cooling adds fluid networks above or near sensitive hardware. Lithium-ion batteries place a new ignition source inside data halls. Growing connectivity across power, cooling and security control systems also opens cyber scenarios with physical consequences.

Insuring concrete does not insure operations, rent or the hardware’s future value. Each layer requires a different contract.

Why does market capacity stop short of $14.3 billion?

The first constraint is concentration. An insurer can readily diversify thousands of distant assets. Diversifying several billion dollars behind the same substations, pipes and construction schedule is harder. Swiss Re notes that programmes can conceal their own accumulation: buildings, equipment and a power plant may be presented through separate policies even though one event could affect all three.

The second constraint is the size of each risk carrier. Munich Re says it can commit up to $250 million net on a construction project and up to $100 million on the cargo side. A multi-billion-dollar programme must therefore be assembled in layers across many insurers and reinsurers. The same article notes that servers are often outside the construction policy and move into separate cover later. There is no single insurer signing a cheque equal to the entire campus value.

The third constraint is information. Marsh offers a less alarming reading: according to the broker, occasional difficulty placing very large programmes often comes less from an absolute shortage of capital than from missing data and analytical frameworks that would let underwriters evaluate the risk. Marsh describes a capacity architecture combining retained risk, commercial insurance, reinsurance, captives, contract transfer and alternative capital. Its stated goal is to make the retained portion explicit, rather than transfer every dollar.

That position requires context. Meta says Marsh provided it with project risk analysis and insurance services, while Marsh also acted as a technical adviser to the BlackRock funds. The release establishes both roles. It discloses neither the detailed mandates nor the separation procedures. That is enough to raise a governance question about the independence of analysis used by several parties. It is not enough to establish a conflict of interest.

Who pays after a covered casualty?

The insurer pays first if the event meets the policy terms, after the deductible and up to the limit. For Sopaipilla, S&P says the project must procure property insurance equal to the PML. During construction, Meta also provides up to $427 million, less insurance proceeds, for certain insurable casualty events. If the project cannot obtain the full PML insurance during operations, Meta must fund the difference between insured amounts and the repairs required within that envelope.

The second layer is contractual support. Meta guarantees tenant payments, certain construction costs, costs above 105% of the budget in specified cases, and mechanisms tied to residual value. The official announcement gives the residual value guarantee an aggregate threshold of approximately $13 billion, declining over time. S&P believes this guarantee and termination fees cover outstanding debt in most foreseeable early-exit scenarios.

That support is not $13 billion of all-risk insurance. The residual value guarantee responds to contractual events and to a shortfall between market value and a guaranteed threshold. It does not automatically convert every property loss into a full payment. The order of protection depends on the affected lease, the casualty cause, the repair timetable and accrued rent credits.

Project equity comes next, held 80% by BlackRock-affiliated funds and 20% by Meta. Within the contractual and security structure, equity ordinarily absorbs economic losses before debt. The public documents do not allow a universal dollar-by-dollar waterfall to be reconstructed. Finally, if rent disappears, guarantees fail to trigger or prove insufficient, and recovery value remains below the debt, creditors are exposed.

This waterfall describes an economic logic, not an exhaustive legal priority. The published terms do not resolve every case.

What scenario can reach creditors?

A fire contained within one campus region illustrates the expected PML logic. The property policy responds, Meta fills gaps in the cases described by S&P, repairs remain compatible with the lease timetable and rent resumes. That is the scenario in which $450 million can be coherent with a much larger asset: the design compartmentalises the campus and prevents a loss from spreading throughout it.

The next scenario is less visible: the campus remains standing, but shared infrastructure cannot operate. A long power outage, cooling failure or external disruption can stop computing without destroying $14.3 billion of buildings and equipment. The answer then depends on questions the public documents do not fully resolve. Is physical damage required? Is a failure at the electricity supplier covered? How long are interruption or rent-abatement losses indemnified? Where does retained risk begin?

The third scenario turns industrial risk into credit risk. S&P says rent is abated for the first eighteen months of a repair period after certain operating casualties. If the estimated repair period exceeds eighteen months, Meta may terminate the affected lease without a termination payment or residual value guarantee payment. The agency considers this exposure sufficiently limited by relying on the insurance report, which estimates a construction-phase PML repair period of no more than twelve months.

That conclusion therefore relies on two models lining up: the extreme fire remains within $450 million and repair remains below twelve months, while the termination right starts beyond eighteen months. If one event escaped both envelopes, a major protection could be absent. The clause predicts neither default nor certain loss. It identifies the exact point where a physical catastrophe could interrupt the rent that repays the notes.

The A+ rating does not contradict that risk. S&P rates the debt one notch below Meta partly because lenders lack direct security over the physical assets and contracts at the joint-venture and landlord levels. Security mainly covers equity interests and certain accounts. The agency itself says project credit quality is determined by Meta’s strength, construction-risk transfer, minimum rent and residual value guarantee.

Which risk can no property policy solve?

A campus may never burn and still become a poor investment. Property insurance pays for a covered loss. It does not guarantee future compute demand, the economic usefulness of an architecture, the resale price of a server or the suitability of a cooling system for a new generation of chips.

Marsh acknowledges that the GPU insurance market is not yet mature and that participants are still working through residual values, insurability and coverage terms. Allianz Commercial says operational risks, supply-chain constraints, uncertainty around AI monetisation and future adaptability increasingly determine project value. A functioning machine can lose much of its value without an insurable event.

This is where Sopaipilla connects to two earlier l0g analyses without repeating them. The debt behind AI followed SPVs and private credit. The residual value guarantee examined the wager on future asset values. Sopaipilla adds the physical boundary: before considering resale value, investors need to know which loss the insurance market is actually willing to carry.

Can insurance constrain the size of future campuses?

The market is growing rapidly. Swiss Re expects global data-center insurance premiums to rise from $10.6 billion to $24.2 billion by 2030. That increase demonstrates insurance demand, not full coverage. The same report says financing needs push lenders to request very high limits while reinsurers can provide only a fraction of total cost at competitive prices for some traditional risks.

Two interpretations remain available. The first sees a size constraint: as a campus concentrates more value, extreme cover becomes more expensive, scarce and difficult to syndicate. Beyond a threshold, the project becomes its own insurer for part of the loss. The second, advanced by Marsh, sees an immature market: better data, deeper engineering, captives and alternative capital could unlock more capacity.

Both propositions can be true at once. Capacity may be sufficient for losses judged plausible and insufficient at an acceptable price for every conceivable loss. The real boundary is therefore not the policy limit alone. It is the amount of risk that Meta, the funds and creditors agree to retain after the technical analysis.

Which answers are still missing from the public record?

Documents available as of 23 August 2026 establish the structure, budget, leases, final debt, several forms of Meta support and the PML. They do not publish the full policies. Several questions remain open:

does the property limit apply per event, per year or under another contractual aggregation?
which assets enter each policy, including computing equipment installed by Meta?
which non-damage outages and supplier failures are covered?
how would several policies respond to one correlated event affecting buildings, power and revenue?
what share of extreme risk is formally retained by the venture?
which exclusions or sub-limits reduce the published headline limits?
how do the residual value guarantee, rent credits and casualty clauses interact in an unmodelled case?
which procedures separated Marsh’s two assignments for Meta and the BlackRock funds?

The absence of a public answer does not prove a weakness. It sets the boundary of what can be claimed. A more precise conclusion would require the insurance contracts, the consultant’s full reports and the lease schedules.

Where does the risk ultimately sit?

Sopaipilla is insured. The project also has substantial contractual protection and a tenant whose credit quality supports the A+ rating. The public record does not support describing it as an almost naked asset facing catastrophe.

It establishes something else. Property insurance is calibrated to a $450 million probable maximum loss, while the campus brings together $14.3 billion of long-lived infrastructure. Beyond the modelled scenario, risk does not disappear. It changes contract and carrier: Meta in some cases, venture shareholders in others, then creditors if rent, guarantees and recovery value no longer suffice.

The useful boundary lies between what insurance is willing to price and what finance is willing to retain. Future AI campuses can continue to grow while their sponsors have the balance sheet, guarantees and investors required to absorb that gap. The $450 million figure finally makes the open question visible: do holders of the $12.6 billion notes know precisely where each protection stops and their own exposure begins?

Established perimeter

This analysis relies on Meta’s 28 July 2026 announcement, S&P’s final 17 August note, insurance figures reported by the Financial Times on 17 August, and sector work by Swiss Re, Marsh, Munich Re and Allianz available as of 23 August 2026. The cumulative-probability calculations can be reproduced in the local tool above.

Limitations

The insurance policies, complete lease schedules and the insurance consultant’s full report are not public. The article therefore does not assign an exact legal payment priority and concludes neither that the project is underinsured nor that a conflict of interest exists. The three scenarios test the structure; they do not predict a casualty.

Sources

Meta Platforms, venture announcement with BlackRock-managed funds, 28 July 2026: 80/20 ownership, cost perimeter, leases, residual value guarantee and adviser roles.
S&P Global Ratings, final A+ rating on $12.6 billion of Sopaipilla Investor notes, 17 August 2026: $14.3 billion budget, PML, Meta support, leases, security, casualty cases and credit sensitivities.
Financial Times, Meta and BlackRock’s $14bn data centre exposes lenders to insurance gap, 17 August 2026: amounts and premiums across separate covers, attributed to people familiar with the agreements.
Fitch Ratings, Sopaipilla Investor entity page, July 2026: expected $12.274 billion issue and AA- expected rating at presale. This analysis uses S&P’s more recent final note for realised amounts.
Reuters, Meta-BlackRock project announcement, 28 July 2026: external-financing context for AI infrastructure.
Swiss Re Institute, Insuring AI: data centre value accumulation risks, 27 March 2026: market capacity, natural hazards, fire, water, power, cyber and expected premiums.
Marsh, The market has appetite. The question is how much capacity is there?, August 2026: capacity architecture, information needs and the maturity of GPU insurance.
Munich Re, From $1.8bn to $28bn: Insurers race to keep up with data center boom, July 2026: syndication, transitions between policies and insurer capacity.
Allianz Commercial, The data center construction boom: risks and claims trends, August 2026: operational constraints, climate, supply chain and adaptability.
U.S. Geological Survey, Floods and Recurrence Intervals: return-period definition and annual exceedance probability.