Publications
Insuring Against Cyber Risks: Coverage, Exclusions, Considerations
May 22, 2013
The risk of security breaches has become a serious concern for any commercial enterprise that maintains private records in digital form. As news stories reporting the latest theft of credit card data, Social Security numbers and ATM codes have become more prevalent, the issue of cyber security has only become more important to management and investors. Computer systems security has evolved into a significant issue with such broad implications that, in 2011, the Securities and Exchange Commission issued guidance concerning disclosure obligations relating to cyber risks and cyber security incidents. More recently, in 2013, the SEC and Commodity Futures Trading Commission (CFTC) jointly issued Identity Theft Red Flag rules which impose requirements on financial institutions and creditors to address reasonably foreseeable identity theft risks. As a result of the rise of cyber incidents and the increased focus on computer security, more insurance carriers have begun offering insurance to cover cyber risk liability. Not surprisingly, more companies are purchasing these policies, particularly those companies in the financial services, technology and health care industries. In this column, SRZ partner Howard B. Epstein and special counsel Theodore A. Keyes discuss the specific features of cyber risk liability policies based on a review of the policies available in the marketplace.
Attachments
Related Insights
Alerts
On June 28, 2024, the US Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) issued a notice of proposed rulemaking that would amend existing anti-money laundering/countering the financing of terrorism (“AML/CFT”) program[1] regulations to require that financial institutions establish, implement and maintain effective, risk-based and reasonably designed AML/CFT programs with certain minimum components, including a mandatory risk assessment process (hereinafter, “Proposed Rule”).[2] For purposes of the Proposed Rule, “financial institutions” include: banks; broker dealers; mutual funds; futures commission merchants (“FCMs”) and introducing brokers in commodities (“IB-Cs”); insurance companies; money services businesses (“MSBs”); casinos and card clubs; dealers in precious metals, precious stones or jewels; operators of credit card systems; loan or finance companies; and housing government sponsored enterprises.[3] In addition to establishing minimum risk assessment requirements for these AML/CFT programs, the Proposed Rule would require that financial institutions document each component of their AML/CFT programs and make this documentation available to FinCEN or its designee, which can include the appropriate agency to which FinCEN has delegated examination authority,[4] or the appropriate SRO.[5] The Proposed Rule would also require that these AML/CFT programs be approved and overseen by the financial institution’s board of directors or, if the financial institution does not have a board of directors, an equivalent governing body.
Alerts
On June 28, 2024, the US Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) issued a notice of proposed rulemaking that would amend existing anti-money laundering/countering the financing of terrorism (“AML/CFT”) program[1] regulations to require that financial institutions establish, implement and maintain effective, risk-based and reasonably designed AML/CFT programs with certain minimum components, including a mandatory risk assessment process (hereinafter, “Proposed Rule”).[2] For purposes of the Proposed Rule, “financial institutions” include: banks; broker dealers; mutual funds; futures commission merchants (“FCMs”) and introducing brokers in commodities (“IB-Cs”); insurance companies; money services businesses (“MSBs”); casinos and card clubs; dealers in precious metals, precious stones or jewels; operators of credit card systems; loan or finance companies; and housing government sponsored enterprises.[3] In addition to establishing minimum risk assessment requirements for these AML/CFT programs, the Proposed Rule would require that financial institutions document each component of their AML/CFT programs and make this documentation available to FinCEN or its designee, which can include the appropriate agency to which FinCEN has delegated examination authority,[4] or the appropriate SRO.[5] The Proposed Rule would also require that these AML/CFT programs be approved and overseen by the financial institution’s board of directors or, if the financial institution does not have a board of directors, an equivalent governing body.