Financial Lines Insurance

D&O exposure isn’t limited to listed companies with public shareholders. Private and family businesses can face their own version of the risk, including disputes between family shareholders, related-party transaction scrutiny, and personal liability arising from informal governance, so being privately held isn’t a defence in itself.

Claims alleging a breach of duty by a director or officer, which can include a regulatory investigation, an employment-related claim, a creditor or insolvency-related action, or a shareholder dispute, depending on what your specific policy covers. This can include situations where a director is accused of failing to exercise proper oversight, not only situations involving active wrongdoing, though the precise scope varies by policy.

This depends on your policy’s “discovery period,” typically the length of time after a director departs during which a claim relating to their time in office can still be made against them. It’s worth confirming this explicitly with us, since claims often surface years after someone has left a board.

Side A cover is a common D&O policy feature that protects individual directors personally when the company is unable or unwilling to indemnify them, for example during insolvency. Without it, a director can be left personally exposed exactly when the company is least able to stand behind them. Whether your policy includes it, and on what terms, should be confirmed against your specific wording.

Many D&O policies are structured to respond to defence costs from the point a claim is first notified, not only if damages are eventually awarded, since legal costs accrue at every stage of a dispute regardless of the final outcome. Whether and how your specific policy does this is worth confirming with us directly, as this varies between insurers.

Any business that provides advice, a professional service, or a design or specification that a client relies on, including consultants, engineers, architects, financial advisers and similar professionals. If a client could argue they suffered a financial loss because of advice or work you provided, PI cover is relevant to you.

General Liability generally responds to physical injury or property damage, while PI responds to financial loss arising from an error, omission or negligent advice in the professional service you provided. Many businesses need both, since the two are designed to respond to different kinds of claims.

PI is typically written on a “claims-made” basis, meaning the policy in force when a claim is made responds, not the policy in force when the work was originally done. This makes continuous cover important, since a gap in your PI history can leave older work unprotected even years later. The exact trigger wording should be confirmed against your specific policy.

Not automatically. Whether their work is covered depends on your policy wording and how liability is allocated in your contracts with them. It’s worth confirming this specifically if a meaningful share of your delivery work is subcontracted out.

A policy that only covers the specific professional activities listed at inception, without being updated as the business’s services evolve. If you’ve expanded into new advisory or service areas since your last renewal, it’s worth checking your policy wording reflects your current scope of work.

No. Social engineering fraud and business email compromise can target businesses of any size, often through impersonation of a supplier or executive to redirect a genuine payment. Smaller businesses can be more exposed in practice, since they often have fewer internal verification controls in place.

A cyberattack typically involves unauthorized access to systems or data, such as through malware or ransomware, while social engineering fraud relies on deceiving a person, often through a convincing email or phone call, into authorizing a payment or disclosing sensitive information. Many policies treat these as related but distinct insuring clauses, so it’s worth checking both are included in yours.

Not always. Traditional Crime and Fidelity policies were built around theft by an employee, and some insurers treat social engineering fraud, where an employee is deceived rather than dishonest, as a separate extension that needs to be specifically added.

Cyber & Social Engineering Fraud cover typically responds to loss caused by deception, such as a fraudulent payment made after someone impersonates a supplier or executive. Broader employee theft or embezzlement that doesn’t involve that kind of deception generally sits outside this cover, so it’s worth confirming with us exactly what would and wouldn’t trigger a claim under your specific policy.

Not really. Cyber & Social Engineering Fraud cover responds to a direct financial loss suffered by your company, while D&O responds to third-party claims made against your directors and officers for a breach of duty. The two protect against different kinds of exposure, even where a single incident touches on both.

Yes, in certain circumstances. Under the Personal Data Protection Act, organisations must notify the Personal Data Protection Commission (PDPC) of a notifiable data breach as soon as practicable, and in any case no later than three calendar days after determining that the breach is notifiable, with unreasonable delay itself treated as a breach of that obligation (Personal Data Protection Commission Singapore, “Required to Notify the PDPC,” pdpc.gov.sg). This is a separate legal obligation from your insurance cover, though a cyber policy can help fund the cost of the investigation, notification and legal advice that follows.

Call-back verification for any request to change bank account details or make an unusual payment, dual sign-off for payments above a set threshold, and staff awareness of common impersonation tactics can all meaningfully reduce the chance of a loss occurring in the first place. Insurers increasingly look at these controls when underwriting cyber and fraud-related cover.

Not necessarily. Speed matters, since banks can sometimes recall or freeze a fraudulent transfer if notified within hours rather than days, but a policy claim can still proceed even where full recovery isn’t possible. Notify your bank, then us, as soon as a fraudulent payment is suspected.