Why RIA Firms May Still Have a Crime Coverage Gap Despite Carrying Cyber Insurance

Many Registered Investment Advisors (RIAs) carry Cyber Liability, Professional Liability, and Fidelity/Crime Insurance. Yet one of the most common misunderstandings we encounter is the belief that a cyber policy adequately addresses theft exposures involving both firm assets and client assets arising from today's most common fraud schemes.

In reality, many cyber policies were not primarily designed to address the broad range of crime exposures facing advisory firms. This becomes especially important when discussing social engineering, funds transfer fraud, and fraudulent instructions. Understanding the difference may help an RIA identify a significant crime coverage gap that could otherwise go unnoticed.

The Misconception: "Our Cyber Policy Covers That."

When reviewing insurance programs for RIAs, we frequently encounter firms that believe their cyber policy provides broad protection for losses arising from social engineering, fraudulent instructions, or hacking-related theft.

Part of the confusion comes from the fact that many cyber policies include endorsements or insuring agreements for certain types of cybercrime and social engineering. However, these coverages are often significantly narrower than many firms realize.

Most importantly, social engineering coverage found in many cyber policies is commonly focused on protecting the insured firm's own assets, not losses involving client assets.

That distinction is critical.

An RIA may assume that because social engineering coverage exists within its cyber policy, losses resulting from fraud involving client assets would be addressed. Depending on the policy wording, that assumption may be incorrect.

In addition, social engineering coverage is frequently subject to much lower limits than the overall cyber policy limit. It is common to see cyber policies with limits of several million dollars while social engineering coverage is limited to a fraction of that amount.

As a result, firms may believe they have substantial protection for a fraud event when the actual available coverage for that specific crime exposure is much lower than expected.

How Fidelity Coverage Has Evolved

Historically, Fidelity or Crime coverage was commonly associated with employee theft, embezzlement, and dishonest acts committed by trusted insiders. Today's fraud environment looks very different.

Modern fraud schemes often involve external actors using deception, compromised communications, spoofed emails, account takeovers, hacking events, and fraudulent requests to trigger the unauthorized movement of money or securities. As these threats evolved, Fidelity coverage evolved as well.

Today, many modern Fidelity policies are designed to address crime exposures created by sophisticated fraud schemes that may not be fully contemplated by Professional Liability coverage or addressed as broadly as expected under Cyber Insurance.

For many RIAs, the value of modern Fidelity coverage is not simply employee dishonesty protection. The value is its ability to help close crime coverage gaps involving social engineering, fraudulent instructions, hacking-related theft, and losses involving client assets.

Three Fraud Exposures Every RIA Should Understand:

1) Social Engineering

• An employee receives what appears to be a legitimate request from a trusted source directing funds to be transferred.

• The communication appears authentic, references actual business details, and passes routine inspection. Believing the request is legitimate, the employee voluntarily initiates the transaction. The transfer is later discovered to be fraudulent.

• Many cyber policies provide some level of social engineering coverage, but those coverages are often sublimited and frequently focused on losses involving the firm's own assets.

• Firms should carefully review whether their current insurance program addresses exposures involving client assets and whether any crime coverage gap exists.

2) Funds Transfer Fraud

• A threat actor gains unauthorized access and initiates the movement of funds without authorization from the insured.

• Unlike social engineering, no employee is tricked into approving the transaction. Instead, the transfer occurs through unauthorized access or manipulation.

• The distinction matters because policy triggers for funds transfer fraud and social engineering are often different.

• Many firms assume any theft involving technology automatically falls under cyber coverage. In reality, coverage often depends on how the policy defines the loss and which policy was designed to address the exposure.

3) Fraudulent Instructions

• The firm receives instructions that appear legitimate and acts on those instructions.

• The documentation, email correspondence, or supporting information appears genuine and consistent with expectations.

• Only after the transfer occurs does the firm discover that the instruction itself was fraudulent.

• These scenarios are increasingly common and can create confusion because technology was involved. However, coverage outcomes often depend on whether the loss meets the requirements of cyber, crime, or fidelity coverage.

The Real Question RIAs Should Be Asking

Instead of asking:

"Do we have social engineering coverage?"

A better question is:

"Does our social engineering coverage apply only to our firm's assets, or does it also address losses involving client assets?"

That distinction is frequently where the most significant crime coverage gap exists. For many RIAs, modern Fidelity coverage is not duplicating Cyber Insurance. Rather, it is addressing crime exposures that cyber policies may address only partially through limited sub-limits, narrower coverage triggers, or protection focused primarily on the insured's own assets.

What RIAs Should Take Away

The issue is rarely whether a firm has insurance. The real issue is whether the firm's insurance program addresses the specific crime exposures created by modern fraud schemes involving social engineering, fraudulent instructions, unauthorized transfers, and hacking-related theft. As these threats continue to evolve, RIAs should evaluate how their Cyber, Professional Liability, and Fidelity coverage work together and whether any gaps exist between them.

At Distinction Risk Solutions, we help advisory firms understand how these coverages interact so they can make informed decisions about protecting both their business and the clients they serve.

Key Questions Answered

Doesn't our cyber policy already cover social engineering?

Not necessarily. While many cyber policies include social engineering coverage, that coverage is often sublimited and commonly focused on losses involving the insured firm's own assets rather than losses involving client assets.

If we have a $5 million cyber policy, do we automatically have $5 million of social engineering coverage?

Not necessarily. Many cyber policies provide social engineering coverage through separate endorsements or insuring agreements that may carry significantly lower limits than the overall cyber policy.

What's the difference between Social Engineering, Funds Transfer Fraud, and Fraudulent Instruction coverage?

Generally speaking, social engineering involves an employee being deceived into voluntarily transferring funds, funds transfer fraud involves unauthorized transfers initiated without authorization, and fraudulent instruction coverage addresses reliance on instructions that appeared legitimate but were later discovered to be fraudulent.

Why are RIAs reviewing Fidelity coverage more closely today?

Many advisory firms are discovering that fraud exposures involving social engineering, hacking-related theft, unauthorized transfers, and fraudulent instructions may not be addressed as broadly as expected under Cyber Insurance. Modern Fidelity coverage may help address crime-related exposures that can otherwise create gaps, particularly when client assets are involved.

"This article is intended for educational purposes only and should not be construed as legal or insurance coverage advice. Coverage varies by insurer, policy form, endorsements, exclusions, and individual circumstances. Coverage should be reviewed with a qualified insurance professional."