A community bank carries a $5 million cyber liability policy. The board sees $5 million on the declarations page and feels protected.
Then, a data breach exposes 45,000 customer records. Here is what happens next, and what the $5 million actually pays.
The Math
Breach response. Notify 45,000 individuals, engage forensics, retain breach counsel, set up credit monitoring, manage a call center. Some carriers provide these services outside the aggregate. Many treat them as “Claim Expenses” inside the limit.
Regulatory investigation, federal. The OCC opens an examination. The bank must produce documents, respond to examiner inquiries, and retain specialized regulatory counsel. A federal banking examination after a cyber event is not a quick conversation.
Regulatory investigation, state. The state banking department opens a parallel investigation. The state attorney general’s consumer protection division sends a civil investigative demand. Not every breach triggers both state agencies, but a 45,000-record exposure with PII usually does. Each requires separate counsel, separate document production, separate responses. These run concurrently with the federal investigation, not sequentially.
Class action defense. A plaintiff’s firm files on behalf of affected customers. Motion practice, discovery, mediation. Even cases that settle early generate significant defense fees. And if the bank wants to fight but the carrier wants to settle, the policy’s “hammer clause” can cap the carrier’s exposure at the settlement offer. The bank funds the rest.
Settlement or judgment. The class action settles for $1.5 million, a modest result for 45,000 affected records. Covered, but only if every prior cost came in at the low end.
Aggregate Erosion
Illustrative estimates, and the best case for the bank: every dollar of cost draws against the aggregate and the bank pays only its retention. The sublimits below do not allow that.
That is the optimistic version. Now add the sublimits.
The Sublimit Problem
The $5 million on the declarations page is not $5 million of usable coverage. Inside that aggregate, individual coverages have their own caps.
Ransomware sublimit: $1 million. If the breach also involves an extortion demand, the bank can recover up to $1 million for the ransom payment and associated costs, not the full $5 million. The rest of the aggregate covers the rest of the incident, but the extortion component has its own ceiling.
Breach response sublimit: $250,000. Forensics, notification, and credit monitoring draw against this cap rather than the full aggregate. This sublimit is also the one most likely to be stale: when a broker raises the aggregate at renewal or midterm, the breach response sublimit often stays where it was set at original placement.
Note what is not on this list. Social engineering and wire fraud are absent, because cyber carriers generally do not write that coverage to financial institutions. If a phishing attack enables a fraudulent wire, the cyber policy is not the policy that pays. The bond is, at whatever sublimit the bond carries.
Dependent business interruption: $1 million. If the breach originated at a vendor, the bank’s business interruption recovery is limited to the sublimit, not the full BI coverage.
Regulatory defense sublimit: $500,000. Some policies cap regulatory proceedings costs. The bank absorbs everything above that threshold out of pocket, even though the aggregate has not been exhausted.
These sublimits do not stack neatly. A single incident can trigger multiple sublimits simultaneously. Each cap reduces what the bank collects. The aggregate is the theoretical maximum. The sublimits define the actual maximum.
Run the same incident through those caps. Breach response cost $1.2 million and the sublimit pays $250,000. Federal and state regulatory defense together cost $900,000 and the regulatory sublimit pays $500,000. Class action defense and the settlement carry no sublimit, so they draw in full. The policy pays $3 million against $4.35 million of cost, the bank absorbs $1.35 million, and $2 million of the aggregate is never touched.
That last part is what boards find hardest to accept. The limit did not run out. The bank paid $1.35 million anyway, because the money it needed sat behind a cap rather than behind the aggregate. Sublimits do not drain the limit faster. They strand it.
The Retention Layer
Before any coverage responds, the bank pays the retention. A $25,000 retention sounds manageable. But retentions can apply per claim, per insuring agreement, or per coverage part. A multi-front incident that generates separate claims under different insuring agreements may trigger multiple retentions against the same event. A phishing attack that causes both a data breach and a wire transfer loss could trigger retentions under both the cyber and crime insuring agreements simultaneously.
Some policies apply the retention to defense costs. If the retention is $50,000 and regulatory defense counsel bills $75,000 before indemnity begins, the bank has already absorbed $50,000 before the policy pays anything.
A retail company that suffers a data breach deals with one regulator (the state AG) and one class of plaintiffs. A bank deals with its primary federal regulator (FDIC, OCC, or NCUA), the state banking department, the state attorney general, and potentially the CFPB.
Each investigation generates separate legal costs, separate document production, and separate defense counsel. The regulatory density is the multiplier that turns a manageable incident into an aggregate-exhausting event.
The Real Number
When regulators, plaintiff’s attorneys, and breach response teams are all drawing from the same policy at the same time, many community banks will discover that available recovery is materially lower than the stated aggregate limit. How much lower depends on the specific policy’s sublimits, retention structure, and whether defense costs erode the aggregate. But the pattern is consistent: the declarations page overstates what the bank can collect.
I see this in every bank insurance program I review. The limit is real. So is the language that erodes it.
The Fix
The limit on your declarations page is what the carrier promises at maximum. The sublimits, retentions, and carve-outs determine what the bank actually collects. The gap between those two numbers is the gap most boards have never seen.
Sublimit erosion is one of the structural issues that appears across all three bank policies. I map the full picture in Five Common Cyber Incidents, Three Policies, and the Gaps Between Them.
This is the kind of analysis a Risk Intelligence Report provides: the gap between the declarations page and the actual recovery, mapped against your specific policy language.
