Insurance Checklist for CCO’s

Chief Compliance Officers in the Registered Investment Advisor space play a critical role in managing regulatory exposure and ensuring the firm’s adherence to both legal and industry standards. An often-overlooked component of this responsibility is the firm’s corporate insurance program. Many RIAs adopt a “set it and forget it” mentality, which can lead to gaps in coverage, leaving firms—and their CCOs—vulnerable. This checklist helps CCOs navigate the complexities of insurance requirements and coverage.

Specialized knowledge from experienced advisors

Whether you're reassessing your current policies or considering new coverage, this checklist serves as a practical tool to ensure your firm’s insurance program meets the demands of today’s financial services environment.

General:

Our experience has been that many RIAs have a “set it and forget it” mentality toward their corporate insurance program. This approach can leave RIAs with sub-optimal coverage quality, which is particularly relevant to a CCO who has more regulatory exposure than other members of the firm

Compliance with Custodian Insurance Requirements – Every major custodian requires a RIAs to carry certain insurance coverages. Although these requirements can vary slightly, RIAs must carry insurance for E&O, Employee Theft, Theft By Hacker and Social Engineering. We have observed numerous instances where firms think they are in compliance with custodian requirements but are not due to working with a broker that is not approved by the custodians

Are you working with a specialist who has the product knowledge and market access / relationships to provide the most robust solutions? This is especially important in the Financial Institutions space where the risks are dynamic and coverage enhancements are available to brokers who know what to ask for and can provide guidance on how the policies may respond to different claims situations

E&O, D&O, Employment Practices:

Trade Error Coverage – Does your E&O policy include coverage for trade errors? Sometimes referred to as “Cost of Corrections” or “Execution Error”, we have found this critical coverage missing from E&O policies we’ve reviewed. It is also important to review the carrier notice requirements on this coverage as it can be as narrow as a few business days after the error is discovered
Does your firm advise on or manage alternative assets? Some RIA E&O policies will exclude these investments and coverage will need to be specifically requested
Outside Services – Is your RIA providing services outside of investment management / financial planning such as insurance product sales, trustee services, tax preparation, bill pay or other Family Office-type services? These activities are often not contemplated in the base form of an E&O policy and need to be negotiated and added via an endorsement or manuscripted wording to the policy
Private Funds – Does your RIA manage a private fund? Many E&O policies will have specific exclusions for fund management and coverage for this needs to be requested and underwritten
Coverage for Independent Contractors – Does your RIA use Independent Contractors? If so, make sure to review the definition of Employee in your E&O policy to ensure it includes coverage for Independent Contractors
Dedicated CCO Limit – Most RIA carriers are willing to add a dedicated sublimit of coverage specifically for the CCO and their associated regulatory exposure
Informal Investigations – The D&O section of the policy is designed to respond in the event of a targeted regulatory investigation, but many times regulatory bodies will initiate informal investigations that do not rise to the level of a formal inquiry. The carriers often have the ability to add coverage for at least some of the costs associated with these, but it needs to be requested specifically
Employment Practices can be an overlooked coverage for smaller to medium sized RIAs and should be considered given the litigious environment and number of third parties they interact with as advisors
No Coverage for Third Party Claims – We have observed instances where the coverage will not extend to third parties (clients, vendors etc.), which limits the coverage and can be added by our carrier partners

Cyber Liability / Crime:

Cyber Liability Insurance – While not a specific custodian insurance requirement, we recommend all RIAs carry a
cyber liability policy. There can be confusion around the difference between “Cyber Crime” (Theft By Hacker, Social
Engineering) and Cyber Liability which can address many other types of losses including, ransomware, breach response
services, regulatory fines/penalties, business interruption, client notification/credit monitoring, reputation harm, etc.
Oftentimes we will see a scaled down version of cyber liability provided through an RIA’s E&O or General Liability policies. We recommend that our clients purchase a standalone first and third party cyber liability policy as the coverage can be more robust and eliminates the dilution risk of having E&O and Cyber tied to the same aggregate limit of liability. It is important to work with a specialized broker when placing a cyber policy as we have performed coverage reviews where the policy is missing certain coverages or requires the insured to take certain actions in order for the policy to respond
Social Engineering Coverage (getting tricked into sending money to a fraudulent account) – When we review RIA’s Social Engineering insurance, we often find that the coverage in place is subject to specific verification requirements in order to respond, such as a documented call back confirming wiring instructions, which is not a requirement of all carriers
Social Engineering Coverage – We have also seen situations where this coverage only applies to the RIA’s own funds and not client money, which therefore negates custodian compliance. Several carriers we work with do not have this restrictive language

ERISA Bonding:

Does your firm act as a full fiduciary 3(38)? If so, you are likely required by ERISA to be bonded through an insurance product known as a 3^rd Party ERISA Bond, or a Fiduciary Dishonesty Bond

Specialized services that anticipate growth and change

Partnering with a broker who understands the nuances of the financial services industry can provide better solutions that address your firm’s unique needs and exposures. From addressing compliance with custodian mandates to evaluating specific protections like Errors & Omissions (E&O), Directors & Officers (D&O), Cyber Liability, and Employment Practices insurance, we can help you select the best coverage solutions. By addressing these considerations proactively, you can safeguard your firm while minimizing risk in an ever-evolving regulatory landscape.