Six Insurance Coverage Gaps That Could Leave Banks Financially Exposed

A bank may carry millions of dollars in insurance and still face a significant loss that its leadership expects an insurer to cover. The issue is often not the size of the policy limit, but whether the claim satisfies the policy’s definitions, exclusions, conditions and reporting requirements.

In Citibank Texas, N.A. v. Progressive Casualty Insurance Co., Citibank held a financial institution bond with up to $7 million in coverage for forgery, unauthorized signatures and other fraudulent activity. The bank paid $845,000 to settle a customer claim involving 16 checks that an authorized signatory deposited into another account and used improperly. When Citibank sought reimbursement, the court ruled that the endorsements were not unauthorized under the bond because the individual had authority to sign. The bank recovered nothing from its insurer for the settlement.

The case highlights a central lesson for financial institutions: insurance coverage cannot be assessed by a policy title or coverage limit alone. Financial institution bonds, directors and officers liability policies, professional liability insurance, property coverage and business interruption policies respond only when a loss falls within their specific terms.

An exclusion, sublimit, missing endorsement or missed reporting deadline can leave a bank responsible for a cost it expected to transfer. A denied or restricted claim may reduce earnings, consume liquidity, require an unexpected reserve or create personal exposure for directors and officers.

The Office of the Comptroller of the Currency has identified fraud and scams, operational risk and compliance risk among the key concerns facing banks. The following six areas illustrate where commercial insurance may fall short and how bank leaders can prepare before a claim puts the policy to the test.

1. Gaps in Financial Institution Bond Coverage

A financial institution bond does not automatically cover every loss associated with dishonesty, forgery or fraud. Standard protection may address traditional banking risks, while separate coverage options can apply to computer fraud, check kiting, fraudulent mortgages, servicing contractors and other specialized exposures.

As a bank expands its products, payment channels and third-party relationships, its activities may outgrow the original insurance program. This can happen gradually, making the gap difficult to identify until a loss occurs.

What banks should do: Compare current lending, deposit and payment activities with each insuring agreement. Test realistic loss scenarios to determine whether they would trigger coverage. The review should also address direct-loss requirements, documentation standards, proof-of-loss deadlines and procedures that must be followed before a transaction takes place.

2. Social Engineering and Fraudulent Transfers

Criminals increasingly use impersonation, business email compromise and other social engineering tactics to persuade customers or employees to approve fraudulent transfers. Recent Federal Reserve risk findings indicate that wire fraud continues to increase, while many surveyed institutions have reported account-holder scams involving ACH payments.

Insurance may treat a transfer authorized after deception differently from a transaction that was genuinely unauthorized. Coverage may also depend on written funds transfer agreements, call-back procedures, dual approval controls and other verification requirements.

A transfer request alone may not satisfy the conditions of a financial institution bond. Bank leaders need to determine which policy applies to losses involving the bank’s money, customer funds and social engineering events. They should also compare relevant sublimits with the largest plausible transfer the institution could face.

What banks should do: Confirm that written agreements and verification procedures match policy requirements. Review whether employee deception, customer deception and third-party fraud are treated differently. The bank should also establish clear escalation and incident-reporting procedures for suspicious transfers.

3. Check Fraud and Endorsement Losses

Check fraud remains a widespread threat. Banks may encounter counterfeit checks, altered checks, forged endorsements, stolen checks and other schemes. Each type of event can involve different liability rules, recovery rights and insurance provisions.

Treating all check fraud as a single insurance category can create false confidence. The applicable policy may distinguish between a counterfeit instrument, an altered check and an unauthorized endorsement. Deductibles, exclusions and notice requirements can also vary.

What banks should do: Identify the check fraud schemes most likely to affect the institution. Review the relevant bond language and endorsements, including deductibles and sublimits. Insurance recovery should be coordinated with return deadlines, customer claims and potential recovery actions against other financial institutions.

4. Regulatory Claims and Directors and Officers Liability

Directors and officers liability insurance can provide important protection for bank executives and board members, but exclusions may limit coverage for regulatory claims. Federal banking agencies have warned that broad exclusions can restrict protection involving regulators, failed institutions and other specified parties.

Federal law also prevents a bank or holding company from purchasing insurance that reimburses an institution-affiliated party for a civil money penalty imposed by a federal banking agency.

Even when a penalty itself is not insurable, a regulatory matter may generate substantial defense costs, remediation expenses, investigation costs and operational disruptions. These expenses can extend well beyond the amount of the announced penalty.

What banks should do: Separate potentially insurable defense costs from penalties, restitution and corrective actions that the institution may have to fund directly. Review policy exclusions with regulatory counsel and insurance advisers, particularly when coverage is renewed or the bank’s regulatory risk profile changes.

5. Business Interruption and Critical Vendor Failures

Bank leaders may assume that business interruption insurance will replace income whenever operations are disrupted. Traditional business interruption coverage generally requires covered physical damage to property. That requirement can leave a bank exposed when a core processor, telecommunications provider, payment platform or other critical vendor fails without physical damage at the bank’s premises.

A prolonged outage can create overtime expenses, customer notification costs, fee refunds, temporary processing charges and lost revenue. These costs may not all be covered under a standard property policy.

What banks should do: Evaluate dependent business interruption, service interruption and extra expense coverage. Compare waiting periods and sublimits with realistic outage scenarios, including failures involving essential vendors and technology providers. Vendor contracts should also address indemnification, liability caps and the recovery of expenses caused by service disruptions.

6. New Products, Affiliates and Professional Services

Banks continue to expand through internal departments, affiliates, partnerships and third-party providers. New lending programs, wealth management services, trust activities and other specialized offerings can create professional liability exposures that do not automatically fit an existing insurance policy.

Insurance programs often define covered services narrowly. A bank may therefore create a coverage gap by launching a product, acquiring a business, entering a new partnership or changing its legal structure without updating the program.

What banks should do: Require an insurance review before approving a new service, product or strategic partnership. The review should identify the legal entity providing the service, the activities covered by existing policies and any need for professional liability, cyber, errors and omissions or additional excess coverage.

How Banks Can Close Insurance Coverage Gaps

No bank can eliminate every retained risk, but institutions can manage exposure more deliberately. A comprehensive insurance review should connect policy language with realistic events and examine exclusions, sublimits, deductibles, waiting periods, notice requirements and definitions of covered services.

Leadership teams should model losses that could affect earnings immediately, continue for several months or exceed an available sublimit. The results can support decisions about stronger internal controls, updated vendor contracts, higher policy limits, additional endorsements, excess coverage, formal reserves and clearer incident-reporting procedures.

Some institutions may also evaluate alternative risk financing. Depending on size, profitability, loss history and risk tolerance, options may include higher deductibles, contractual risk transfer, dedicated reserves, pooled arrangements or captive insurance.

A properly structured captive may help a qualifying institution finance selected risks that commercial insurers exclude, sublimit or price inefficiently. It can also improve loss data and support more informed risk decisions over time. However, alternative risk financing should complement a well-designed commercial insurance program rather than replace essential coverage.

Insurance remains an important financial backstop for banks, but it cannot protect against a loss that falls outside the policy’s terms. Institutions that identify coverage gaps before a claim occurs can better protect earnings, preserve liquidity and make deliberate decisions about the risks they choose to retain.

Source: thefinancialbrand.com