Tackling cyber fraud

A cyber attack can be devastating for any company that’s targeted. But keeping on top of rapidly evolving cyber threats and the risks involved is a challenge for both corporates and insurers alike.

Earlier this year, one US company announced that it was suing its insurer after claiming for damages caused by the highly destructive NotPetya virus in 2017. Its insurer refused to pay out on the claim, citing an exclusion in the policy for ‘hostile or warlike’ actions. Although the case continues, it is the first legal dispute of its kind over the extent of cyber security cover.

Globally, cybercrime will cost companies $5.2 trillion in extra costs and lost revenue over the next five years, according to estimates by Accenture¹.

Several cyber security breaches in recent years, including those related to the NotPetya virus, have underlined the challenge for insurers to consider how data is now shared and stored – and how it can be compromised.

Filling a gap in the market

Commercial insurers have been cautious about jumping into the cyber marketplace. Captive insurance companies – wholly owned insurance companies which allow corporations to provide their own cover – are an increasingly popular solution.

There are a number of advantages for corporates. A captive provides a dedicated risk management structure that helps tackle fast-evolving cyber risks and is able to promote more rigorous and focused underwriting. This is essential for handling the variety and complexity of cyber risks. A captive can also facilitate long-term risk management in a more cost-effective and controlled way.

Captives may not be right for every type of business, partly due to the amount of capital that needs to be held in reserve to pay for claims, along with the additional resources required to manage operations.

However, cyber liability will increase as technology connects us in ever more complex ways and digital data continues to grow at such a phenomenal rate, according to Simon Phillips, Head of Captive Insurance at Barclays.

“There is currently a gulf between the need for cyber insurance and what is available commercially, but captives can help corporates to bridge that gap and take control of new and emerging risks,” he says.

Specific advantages

Whereas commercial cyber insurance is geared towards providing standard cover and typically has a narrower focus, captives can customise cover to suit a particular business, industry sector or type of exposure.

That flexibility extends to highly correlated risks, such as reputational damage as a result of a hacking incident, or when a cyber attack causes business interruption and consequent loss of revenue. Such contingent risks are often out of scope with commercial insurance packages.

What’s more, using captives to insure against cyber threats has additional benefits, according to Peter Child, managing director at Artex Risk Solutions, a captives insurance manager. “When existing captives add cyber to their risk portfolio, they increase diversity, boosting their solvency position under regulations such as Solvency II.

“For captive owners, this means they can reduce the overall level of capital required to satisfy solvency requirements. So, by bringing cyber risks into their captives, corporates can optimise their cash flows and return on capital.”

As well as Solvency II, the General Data Protection Regulation (GDPR) reinforces the value of captives. It imposes very strict rules governing how personal data is used, with heavy fines for those who fall foul of the regulation. Because of the heightened risks, companies are keen to manage their exposure in the most secure and controlled way. Captives provide an added layer of diligence and risk management.

Acting as incubators

As cyber insurance is relatively new, and the associated risks remain uncertain, it means that captives have a useful role to play as ‘incubators’ for the commercial insurers, according to Child.

“To accurately measure cyber risks, we need more data. We need to build a firm statistical base and a risk history with quantifiable insights. Captives allow companies to incubate this intelligence over time, and because a captive is integrated with the company and all its functions and dependencies, it can draw on a wide variety of corporate information to build a more complete risk profile.

“This knowledge leads to a granular understanding of cyber risks, and therefore more informed and precise underwriting. In other words, captives map current and emerging cyber risks and are one of the best ways to negotiate unfamiliar territory.”

Tapping the reinsurance market

Another advantage of writing cyber insurance through a captive is that it affords direct access to the reinsurance market, which has significantly greater capacity in comparison to the primary insurance market. Risk transfer from a captive is a more attractive proposition for reinsurers.

By taking the first line of exposure and demonstrating a sound risk management strategy, captives increase reinsurers’ confidence and hence their appetite for carrying some of the risk.

How Barclays helps captives

Barclays provides a wide range of solutions for the captive insurance industry, including Letters of Credit. For the asset held within the captive to ensure it is solvent, Barclays offers tailored investment options as well as treasury services for captives supported by more liquid assets. These services are offered from globally significant captive insurance jurisdictions.

To support our corporate customers who establish captive insurance companies, we also offer a range of innovative products, including banking, cash management, foreign exchange and investment services.

Our corporate booking centres in Jersey, Guernsey, Isle of Man and London provide banking and investment services in stable, trusted jurisdictions. Banking in these areas can have advantages, such as legal transparency, security and specialist industry or sector knowledge.

Please note that not all products and services described or offered by our captive insurance team are provided by Barclays Bank PLC. Some may be provided by associated companies in the Barclays Group. We do not offer captive insurance services in Jersey.