Know Your Customer is a familiar mantra to banks. But how many heed Know Your Policy? Adequate insurance coverage can make the difference between staying in business and going bankrupt should disaster strike. Yet insurance policies are complex documents, and they sometimes have obscure exclusions that banks may not realize until they file a claim. Insurance companies adapt coverage as threats evolve, so banks need to keep abreast of trends and monitor and update their policies.
Most banks carry the basics: D&O insurance that protects bank directors and officers from lawsuits (and helps attract qualified members to your board); blanket bond that covers criminal acts by employees; Employment Practice Liability Insurance for suits that may be brought by disgruntled workers; and property and casualty insurance. They probably need automobile coverage for business vehicles and worker's comp in case of an employee accident. Some have exposure for foreclosed properties, repossessed vehicles, trust properties, and leasing operations.
"Every time you add a new product, you add a new risk and have to protect against that," says Steve Wilson, chairman and CEO of LCNB National Bank, an $800 million-asset institution headquartered in Lebanon, Ohio. "You have to know the external threat. Is it phishing, debit-card fraud, credit-card fraud? It shifts, but you try to be as sure as you can that you're covering all your risks."
The latest trend he's seeing is customers scammed through cybercrimes, which the bank can do little to prevent because, while it may have protections in place, its customers may not. "They get hacked, and someone uses the information to come to the bank and order a wire transfer," he says.
Know your exposures
Insurance against cybercrime is a growing concern for bankers as internet fraud becomes more common and costly, says Scott Kannry, vice-president, Financial Services Group of New York-based Aon. "If somebody hacks into a bank and drains accounts, traditional coverage takes care of that. But notification costs; any measures of goodwill, such as identity monitoring; and the possibility that the bank can be sued by customers—that's what the new policies contemplate, the consequential costs."
A bank that has an older policy is unlikely to be covered for consequential costs, he says. "Know the insurance world is changing around cyber and be sure you're covered not only for traditional losses, but also for new liability with data breaches and customer information."
The latest progression in such insurance is coverage for future revenue loss. Until recently, the reputational component of a data breach was mostly uninsurable, Kannry says. Now there are policies that insure against losses if customers defect. These policies have only been in the market a few months and are not readily available, he says, but they represent "the next wave in what we're seeing develop from an insurance perspective."
Very large banks with specialized risk-management departments and brokers usually have a good sense of their exposures and have developed their coverage portfolios accordingly. For the rest, understanding precisely what their policies cover—or don't—can be a daunting challenge.
As partner-in-charge of Dempsey Partners' New York office, Jill Dalton leads the value-quantification practice and performs risk-consulting services, including property-policy wording reviews. She often sees a mismatch of expectations and a lack of understanding about what's covered. "A policy may have a limit for flood and a separate definition for 'high-hazard' flood," she gives as an example.
Another common area of misunderstanding is how deductibles apply. "A lot of policies will have a deductible that says 2% or 5% of values, but it may not be clear what it applies toward," Dalton says. "Two percent of what? Is that just the structure, or is it also the contents? Is it the selling price or the replacement price?"
Provisions about coverage for off-premises electrical power can be confusing as well. "Bankers need to read the words and see how coverage applies for their loss if their banks, branches, or data centers are affected by a lack of power," she says. Policies usually have distance limitations, and the cause of the outage may matter.
Buying an insurance policy should never be a hasty decision, Dalton says. "Mistakes get made because people want quick answers about what's covered."
Hurricane Sandy demonstrated the worst-case scenario and is a lesson on how to better prepare. "Businesses didn't expect that employees wouldn't be able to get to work, that buildings would be damaged for months, that employees wouldn't have power at home for weeks and couldn't get gas to drive to work," Dalton says. "You can't anticipate everything, but you can apply the lessons learned to future events so the level of disruption next time might be less."
Insurance that allows banks to keep their operations running when their physical plants are damaged is often overlooked, according to Gary Erickson, practice lead for property casualty at Travelers in St. Paul, Minn. "A lot of their needed coverage is extra-expense coverage, where we would provide dollars for a covered loss so they can set up operations in a building next door. Or maybe the phone system was destroyed, and they need that in the short term. Extra-expense coverage is money that lets them get back into business as fast as possible."
Know your insurer
The best way to buy the right insurance is to buy the right advice. "If bankers just go to the agent down the street or someone on their board who really doesn't understand bank coverages, that's a major mistake," LCNB's Wilson says. "Bank CEOs are not experts in insurance, but it's so important to the risk profile of our bank. This is a place you don't scrimp. Get good advisers. Get good bids."
One source: ABA Insurance Services (ABAIS), which offers D&O, bond, professional liability, and property and casualty coverage for community banks. According to Mike Read, the marketing and sales manager, banks should consider more than just premium cost.
"Insurance tends to be viewed as a commodity, and I'm not sure that's the best way to do it," he says. "There are big differences in the coverage breadth and scope. Look at the coverage terms and conditions. Look at the exclusions in the policy. Look at the coverage definitions—are they as broad as they can or should be?"
Endorsed by the American Bankers Association and 28 state banking associations, ABAIS is the only banker-owned and bank-directed program in the market.
Travelers, too, views its business as partnerships, relying on independent brokers and agents to make recommendations, so insurance policies can be customized to a particular bank's needs. "Each individual risk has unique exposures," says Mark Horton, practice lead for specialty products. "That's where the agent comes in."
The Bank of Fayette County, a $320 million-asset institution that serves the Memphis, Tenn., metro area, has its own insurance agency. Yet CEO and President McCall Wilson worries. "Banking has gotten so complicated that insuring banking has gotten really complicated," he says. "If some guy in Eastern Europe drains all our accounts and goes to the Bahamas, are we really insured? We believe we're adequately covered, but you just don't know."
Know your limitations
As McCall Wilson knows particularly well, not all threats can be insured against. Because Memphis sits on the New Madrid fault, the U.S. Geological Service considers the area at risk for an earthquake of 7.0 to 8.0 magnitude. In such an event, it predicts older highways, bridges, and overpasses likely would be damaged or collapse.
Like Hurricane Sandy, an earthquake in bridge-bound Memphis would bring widespread calamity. Bank employees wouldn't be able to get to work and probably couldn't work from their homes. The bank has its own generators, but if bridges collapse, the natural gas to run them couldn't get through.
An earthquake would be particularly calamitous because of the region's sandy soil, explains Will Fussell, sales manager for the Bank of Fayette County's insurance agency. "If we have an earthquake, our soil will aquify." Given such potential for loss, most big-name carriers won't write earthquake insurance for western Tennessee, he says. What is available is unaffordable. "We have $60 million in home loans that could be destroyed, and more than half of them are uninsured [for earthquake damage]," McCall Wilson says. "That's bankruptcy waiting to happen."
Yet, there is no way to protect against that. If the government required earthquake insurance, customers couldn't afford it. Insurance companies that sold it would go bankrupt because they couldn't charge premiums high enough to cover losses. "Earthquake insurance is a lot like flood insurance—super expensive—but the government has a flood insurance program; it doesn't have an earthquake insurance program," he says. "Our elected officials and regulators haven't thought through natural disasters."
Know your plan
To increase your bank's odds of surviving calamity, experts recommend having insurance policies plus prevention procedures and contingency plans. If customers have concerns about their buildings, Travelers will perform inspections and give tips on loss control. The company also sends customers articles on protecting pipes for winter, for example.
Have a plan, Kannry says, especially if the emergency is a security breach. Banks that respond well and quickly generally face little customer churn or reputational damage. "If you have to scramble, you have a higher risk of customer defection."
From his long career at LCNB National Bank, Steve Wilson has learned there always will be people angling to sue, whether they're dissident shareholders unhappy with the board or a customer who thinks the bank wronged him. Unfounded or not, the bank has to defend itself, he says, so adequate insurance is crucial. Also, you get what you pay for. "The least expensive policy is not always best because in today's world, the coverages are very, very important," he points out.
Bank procedures are the first line of defense. "But if something fails," says Wilson, "you want to be sure you have a good insurance policy to protect you."
More about ABA Insurance Services
ABA Insurance Services (ABAIS) offers D&O, liability insurance, financial-institution bond, and property and casualty services specifically for community banks. In business since 1987, ABAIS now has a sustained market share of more than 20% and the ability to write banks in all 50 states, according to Mike Read, marketing and sales manager. "A local broker or an agent can access our program," he says.
Among its competitive advantages is a wide array of coverage options to fit a bank's specific needs, as well as loss-control resources and an experienced underwriting staff. Perhaps its principal benefit is the profit-sharing program. "Banks that are insured in our program and belong to ABA are eligible to participate in a distribution program," Read says. "Distribution has been declared every year for the past 22 years. So that's a neat way to lower their overall insurance cost a little bit, and we're the only program in the country that offers a distribution for bond and D&O."
ABAIS upholds an excellent standard of service for its clients. Submissions are acknowledged within 24 hours of receipt and claims are acknowledged within 48 hours.
"ABAIS was formed to keep the price reasonable and to be sure the coverages were in place," says Steve Wilson, ABAIS chairman and chairman and CEO of LCNB National Bank, Lebanon, Ohio. "ABAIS offers policies done by bankers, so they care about getting the best."