Over the past months, I audited the insurance policies at five community banks and credit unions. I read the policy forms, endorsements, and amendments across their cyber and D&O policies, and their fidelity bonds. Different carriers. Different program structures.
Each bank engaged Breezy Risk for a Risk Intelligence Report: a line-by-line review of its cyber liability policy, fidelity bond, and directors and officers policy, read together against the bank’s operations, vendor contracts, and regulatory requirements. Not a checklist. Every finding comes from reading the policy forms themselves. Institutions and carriers are anonymized.
The coverage gaps across the banks were strikingly similar. Five structural problems appeared in every program. That pattern changes the conversation. One bank with a gap is a broker discussion. Five banks with five different programs and the same gaps is an industry problem.
Scorecard
| Finding | Bank A | Bank B | Bank C | Bank D | Bank E |
|---|---|---|---|---|---|
| 1. Wire fraud | Severe | Partial | Severe | Partial | Severe |
| 2. D&O cyber exclusion | Severe | Partial | Partial | Severe | Severe |
| 3. Vendor BI sublimit | Severe | Partial | Adequate | Partial | Severe |
| 4. Headline vs. recovery | Partial | Severe | Severe | Partial | Severe |
| 5. Interest income | Severe | Partial | Adequate | Severe | Partial |
Five findings. Five for five on wire fraud conditions, D&O exclusions, and headline overstatement. Four of five on vendor coverage and interest income. Bank C had the strongest program. It still had three of the five gaps.
Wire Fraud: Zero Clean Paths to Full Recovery
On a $500,000 wire fraud loss, recovery ranged from $0 to $250,000.
All five banks had conditions that could void coverage entirely.
Wire fraud is not the loss a community bank suffers most often. Check fraud is, by a wide margin. Wire fraud is the loss the bond is actually asked to pay. A check fraud incident averages around $45,000 and mostly sits below the bond deductible, absorbed as an operating loss that never reaches an insurer. A wire fraud incident averages $141,000 to $295,000, clears every deductible in this sample, and lands squarely on a sublimit. Every bank had social engineering coverage on its fidelity bond. Not the cyber policy. Hardly any cyber carrier writes eCrime coverage for financial institutions, so the bond carries the load.
The problem is what the endorsement says. Four of five banks had sublimits between $250,000 and $500,000. All five had a verification warranty written as a condition precedent: if the employee skips the callback, coverage drops to zero. That warranty was designed for email-based BEC, not deepfake voice calls. One bank had a 50% co-payment clause the board did not know about. And in two banks, recovery swung by $4.5 to $4.75 million depending on how forensics classified the attack after the fact, a judgment the bank does not control.
What to check
- Is the social engineering sublimit at least $500,000?
- Is the verification warranty a condition precedent (coverage voided) or best-efforts (coverage reduced)?
- Is there a co-payment clause? What percentage does the bank absorb?
- What is the difference in recovery between a computer fraud and social engineering classification?
The Wire Nobody Covers · What Your Fidelity Bond Won’t Pay
D&O Cyber Exclusion: Every Board Was Pushed Onto the Cyber Policy
Every D&O policy had a cyber exclusion. Zero banks had a Side A layer to fall back on.
After a breach, regulators investigate the board. Did they approve a cybersecurity strategy? Did they allocate adequate resources? The FFIEC, FDIC, and state regulators have all increased scrutiny of board cybersecurity oversight. These investigations are D&O claims.
Every D&O policy I reviewed had a cyber exclusion, though they were not uniform. One preserved individual director coverage and excluded only entity-level claims. Another carved back privacy violations while still blocking breach claims. One capped investigative costs at $100,000, against a multi-regulator defense that can exceed $500,000 in the first six months. A fourth had no pre-claim investigative coverage in its loss definition at all. Four carriers, four failure modes, same destination for the most common scenario.
The board is not left with nothing. Directors are named in the cyber policy’s definition of Insured, so the cyber policy picks up what the D&O drops. What it does not do is behave like a D&O policy. No Side A, so the directors share one limit with breach response, and breach response spends first.
What to check
- Does your D&O policy have a cyber exclusion? Does it use “arising from” language (broad) or something narrower?
- Is there a carve-back for regulatory investigations of individual directors?
- Open the cyber policy’s definitions and confirm your directors are named as insureds. Then read the securities exclusion, which is where a post-breach derivative suit can still fail.
- If the breach response spends the cyber limit in the first sixty days, what is left for the board six months later?
The D&O Cyber Exclusion That Leaves Your Board Exposed
Vendor BI Sublimit: $0 to $5 Million. Most Banks on the Wrong End.
Vendor BI sublimits ranged from $0 to $5 million.
Only one bank had its core vendor named by endorsement.
Every bank runs on a single core platform. When the core vendor goes down, the bank goes down. The Marquis Software Solutions breach in August 2025, a ransomware attack that exposed data at 700+ banks and credit unions, made vendor risk an examiner priority.
One bank had no vendor coverage at all. One had $100,000; a three-day outage would exhaust it in two. One had coverage narrowed mid-term by a carrier amendment that excluded sub-vendor supply chain exposure after the policy was in force. Only one bank had its core vendor named by endorsement with a $5 million limit. And two of five only covered vendor outages caused by security breaches, not system failures. A software crash that shuts down the platform is not a security breach.
What to check
- Is dependent BI present? If “Not Included” on the declarations, you have zero vendor coverage.
- What is the sublimit? Model a 5-day outage at your core vendor.
- Does it cover system failure, or only security breach?
- Is your core vendor named, or covered only by a class definition?
Headline vs. Recovery: $12 Million in Limits, $500,000 in Recovery
Combined headline limits: $12 million to $27 million.
Realistic recovery on a multi-front incident: $500,000 to $3 million.
The declarations page shows what the board approved at renewal. Combined limits ranged from $12 million to $27 million. The realistic recovery on a multi-front incident, wire fraud, breach response, regulatory investigation, and board liability at the same time, ranged from $500,000 to $3 million.
The erosion comes from sublimits that share the aggregate, defense costs paid inside the limit, D&O cyber exclusions, verification warranties, and the gaps between the three policies where each carrier points at the others. A $5 million cyber policy with typical sublimits can pay $650,000 on a $4.2 million ransomware loss. Stack that against a bond sublimit and a D&O exclusion, and the bank’s total recovery is a fraction of the headline number. One bank: $12 million in combined limits, approximately $500,000 in realistic recovery.
What to check
- List every sublimit. Note which are “part of and not in addition to” the aggregate.
- Are defense costs inside or outside the limit?
- Model a multi-front scenario. Map each cost to the policy that responds. Compare the total to the headline.
- Does the board know the difference between the headline number and the realistic recovery?
The Fine Print Inside the Coverage
Interest Income: The Exclusion That Bites in the Long Outage
Four of five BI definitions excluded interest income or left it ambiguous.
It costs little in a five-day outage and becomes the whole loss in a three-week one.
The BI definition in most cyber policies either excludes “interest or investment income” by name or never mentions it. The definition was written for commercial businesses, where interest income is incidental. For a bank it is the largest line on the income statement, so the exclusion looks devastating.
It is not, in the outage most banks tabletop. A loan accrues interest under its note and a deposit accrues interest expense under its terms whether or not the servicing platform is available. Five days down, the accruals are still there when the system comes back. What the bank genuinely loses is fee income: overdraft charges, interchange, wire fees, service charges, earned per transaction and gone when the transaction does not happen. Most BI definitions cover that.
The exclusion bites in the extended event. Two or three weeks down, depositors who cannot reach their money move it, replacement funding costs more, and borrowers under stress push loans toward non-accrual, reversing booked interest. Deposit runoff and non-accrual reversals are interest income losses, and they are exactly what the exclusion bars.
Two banks were on a carrier program that pays BI at a flat $500 per hour, a rate set without reference to what the bank actually lost, which can overpay a short outage and badly underpay a long one. Two others had ambiguous definitions, worded so the largest line on the income statement gets characterized by a carrier at claim time. One bank had an endorsement deleting the interest income exclusion outright. Where it is offered it costs between nothing and $2,000 a year.
What to check
- Does the BI definition use a flat hourly rate? A flat rate is not a measure of your loss.
- Look for the phrase “interest or investment income.” If it is excluded, the extended-outage loss is outside the definition.
- Ask whether an Interest Income endorsement is available. If it is not, get written confirmation that “income from business operations” includes net interest income for a financial institution.
- Size the short outage from the non-interest income line on your call report, not from net interest income, and model the extended event separately.
The Revenue Your Policy Ignores
The Pattern
These findings compound. A single cyber incident touches all three policies, but none of them respond the way the board expects. The cyber carrier denies under a sublimit. The bond carrier denies under a verification condition. The D&O carrier denies under a cyber exclusion. The BI definition stops paying at the point the outage turns serious. Each carrier points to the others.
Every bank in this sample was paying for insurance. None had a clear picture of what it would pay. The gaps are not broker errors. They are policy language designed for commercial businesses, applied to financial institutions without modification.
The fix is not more insurance. It is reading the insurance you already have.
About Breezy Risk
Joerg Proeve is Founder & Principal of Breezy Risk. Corporate strategy and M&A integration at a global carrier, technology strategy and innovation at a national carrier, operations leadership at a cyber insurance MGA. He does not place policies. He audits them.
