We explore the impact of capital adequacy requirements on financial institutions’ risk-taking behavior from a novel perspective. Specifically, we show that an important feature of the risk-based capital (RBC) system—a built-in diversification benefit in aggregating risk categories—induces moral hazard. We find that insurers that face lower marginal RBC costs of fixed-income (FI) investment tend to purchase riskier FI securities. This relationship holds even when lower marginal RBC costs result from increased risk in other risk categories, which is an unintended consequence of the RBC's square root rule. Using Hurricanes Katrina and Sandy as exogenous shocks to the RBC cost, we find that insurers that suffered more in the two disasters undertook more risk in their FI investments and witnessed an increase in their overall risk. We further show that insurers with a high RBC cost sell similar risky bonds during the financial crisis, presenting a source of systemic risk. These results provide an important regulatory implication for minimum capital calculation in capital regulation regimes.

We develop a model where a firm has an optimal exposure to cyber risk. With rational, fully informed agents and with no hysteresis, a successful cyberattack should have no impact on a financially unconstrained target's reputation and post-attack policies. In contrast, when a successful attack involves the loss of personal financial information, there is a significant shareholder wealth loss, which is much larger than the attack's out-of-pocket costs. This excess loss is higher when the attack decreases sales growth more and lower when the board pays more attention to risk management before the attack. Further, an attack decreases a firm's risk appetite, as it beefs up its risk management and information technology and decreases the risk-taking incentives of management. Finally, successful cyberattacks adversely affect the stock price of firms in the target's industry. These results imply that successful attacks with personal financial information loss provide adverse information about cyber risk to target firms, their stakeholders, and their competitors.