Every life and pension insurer in Turkey runs two ledgers whether they admit it or not. The first is the policy administration system — the one everyone builds, tests, audits, and stares at. The second is the reinsurance ledger: cession records, treaty splits, ceded reserves, recoverable claims, reinstatement premiums, and the recovery rights that follow from all of it. That second ledger has to reconcile against the primary policy record on one side and the reinsurer's own submission on the other, and in most Turkish insurers it was built as an afterthought bolted onto whatever the policy system happened to expose at the time.
After a decade owning the data layer at Anadolu Hayat, I can tell you the structural failure is always the same shape. The cession is correct on day one. It goes wrong on day two, and no one notices until an auditor, a reinsurer, or the regulator forces the reconciliation.
The Shadow Ledger Nobody Owns
A reinsurance treaty is not a lookup table. It is a contract with:
- Retention limits per life, per policy, per treaty year
- Quota share and surplus splits that may vary by product, age band, sum assured, or underwriting class
- Premium cession rules that differ from claim cession rules
- Reinstatement clauses that reset capacity mid-year
- Commission and profit commission calculations tied to loss ratios that themselves depend on ceded figures
- Retroactive amendments that rewrite prior periods
At inception, someone — usually a competent actuary or a treaty administrator — sits down and produces a clean cession file. Every policy in scope gets a correct split. The reinsurer confirms it. Everyone signs. This is the moment the pipeline looks like it works.
Then life happens.
Where the Data Quietly Breaks
The failure modes are almost never at inception. They cluster in five places:
1. Endorsements and sum-insured changes. A pension policy increases coverage after a salary revision. The policy system updates cleanly. The cession recalculation is a downstream job that runs on a schedule, uses a snapshot, and applies the treaty rules that were valid at the time of the batch — not the treaty rules valid on the effective date of the endorsement. If the treaty year rolled over between the endorsement date and the batch date, the split is wrong.
2. Reinstatements and lapse-to-paid transitions. A lapsed policy comes back. Was it ceded before? Under which treaty year? Does the current treaty accept the reinstatement or does it stay on the old one? Most systems I have seen either double-cede or drop the cession entirely. Both are wrong, and both are invisible until claim time.
3. Retroactive regulatory restatements. SEDDK issues a circular. Reserving methodology changes. The actuarial team restates two years of technical reserves. The ceded reserve share must be restated in parallel — but the restatement runs on the primary ledger, and the reinsurance ledger keeps posting against the old numbers because the recalculation job was written to read current reserves, not as-of reserves. Now the ceded reserve on your books disagrees with the reinsurer's, and neither of you can reproduce how you got there.
4. Treaty amendments with retroactive effect. Reinsurers renegotiate. A treaty amendment signed in November is effective from January. Your pipeline has been cedeing under the old terms for ten months. Someone has to reverse and re-post ten months of cessions across every affected policy. In most systems this is a manual Excel exercise, which means it happens once, imperfectly, and never again.
5. Claim recoveries. A claim is paid. The recovery calculation reads the current cession record. But the cession that should govern the recovery is the one that was in force at the date of loss, which may have been amended twice since. If your ledger only stores the current state, the recovery is wrong and the reinsurer will find it before you do.
Why Pension Books Are Worse
Life books are bad. Pension books are worse, for three reasons:
- Policy durations are decades, so the number of amendments, contribution changes, and regulatory restatements per policy is an order of magnitude higher.
- The BES structure means state contribution rules interact with cession rules in ways that were never anticipated when the original treaty templates were drafted.
- Group pension contracts have member-level movements — joiners, leavers, salary changes, vesting events — that most reinsurance pipelines were never designed to handle at member granularity. They aggregate to the contract level and lose the audit trail.
The Reconciliation That Nobody Wins
Twice a year, or quarterly if the treaty demands it, someone sends a bordereau to the reinsurer. The reinsurer runs their own calculation from the same source data — or worse, from a different extract taken on a different date — and sends back a discrepancy list. The discrepancy list is worked manually. Some items get resolved, some get parked, some get netted against next quarter. Over five years the parked items become a structural difference that nobody can unwind because the people who understood the original treaty have moved on and the amendments were never modelled properly in any system.
At that point you have three options, all bad: accept the reinsurer's numbers, accept yours, or negotiate a lump-sum settlement that both sides know is arbitrary.
What Actually Works
The fix is not a better bordereau. The fix is treating the cession ledger as a first-class system with the same rigor as the policy ledger:
- Bitemporal storage. Every cession record needs both a business effective date and a system posting date. You must be able to answer "what did we think the cession was, as of last March, for a loss dated the previous November?" If you cannot answer that, you cannot defend a recovery.
- Treaty rules as versioned code, not configuration. The rules that govern splits, retentions, and reinstatements should live in versioned logic with test cases, not in a parameter table that someone edits in production.
- Event-driven recalculation. Every policy event — endorsement, reinstatement, reserve restatement, treaty amendment — must trigger a cession recalculation with the correct as-of context, not wait for a nightly batch that uses whatever state happens to be current.
- Independent reconciliation, not confirmation. Your monthly reconciliation should recompute the cession from primary data using treaty rules, not compare two summaries that both descend from the same broken pipeline.
- A dispute ledger. Parked discrepancies need their own audit trail with aging, owner, and expected resolution. If an item sits for two quarters it should escalate automatically.
None of this is exotic. It is the same discipline that exists on the primary policy side. The only reason it does not exist on the reinsurance side is that reinsurance was treated as a reporting problem instead of a transactional one.
The Uncomfortable Part
Most insurers will not fix this until a reinsurer refuses to pay a large recovery or the regulator asks a question the current pipeline cannot answer. Both are happening more often. Ceded reserves are large, ceded claims are volatile, and the assumption that "the reinsurer will sort it out with us" was always a management preference, never a control.
The cession ledger is a parallel reporting obligation. It deserves a parallel investment. Treating it as an appendix to the policy system is how you end up with five years of reconciliation drift and no one left in the building who can explain it.