Six Ways Coverage Fails at Claim Time
These patterns show up in every community bank and credit union I review. Different carriers. Different policy forms. Same gaps. Each one creates a scenario where the institution assumes it is covered and discovers at claim time that it is not.
Community banks and credit unions carry three policies that touch cyber risk: a cyber policy, a fidelity bond, and a directors and officers (D&O) policy. These policies were never designed to work together. Each carrier points the finger at the other two. The bank holds the loss.
The six gaps below are the ones I find most often. They come from actual policy reviews.
The Wire That Never Comes Back
Spoofed instructions, real wire. The cyber policy never included social engineering coverage. The fidelity bond excludes "voluntary parting" because the employee had authority and willingly sent the funds. Both carriers point at each other.
The Board on the Hook
After a breach, regulators go after the directors personally. The D&O policy has a cyber exclusion nobody knew was there. The cyber policy does not cover board liability. Directors face personal exposure.
The Vendor You Cannot Replace
A core processor goes down for three days. The cyber policy covers vendor outages under dependent business interruption, but sublimits it to around $1M within the aggregate. A multi-day core platform outage easily exceeds that.
The Ransom You Cannot Pay
Ransomware encrypts the bank's data. The carrier will not authorize payment because the threat actor is on an OFAC sanctions list. The bank chooses between an illegal payment and an indefinite outage.
The Application That Cancels the Policy
After a loss, the carrier reviews the application the bank submitted at renewal. MFA not enforced everywhere? Backups not tested? The policy can be voided as if it never existed.
The Fine Print Inside the Coverage
The policy responds, but sublimits, retentions, and carve-outs shrink the recovery. A $5 million policy can become a $500K payout. The limit on the declarations page is the ceiling. The floor is buried in language the bank never read.
For a side-by-side map of how all three policies respond to each incident type, see Five Common Cyber Incidents, Three Policies, and the Gaps Between Them.
Find Out Where Your Coverage Fails
One report. Plain English. Before your next claim, board review, or examination.
Get in Touch