Aggregate
Total maximum amount the insurer commits to pay for all losses of a given category over the policy period, regardless of the number of events that occur.
On November 25, 2021, the Lloyd's Market Association published four war and cyber operation exclusion clauses, LMA 5564 to 5567. Under LMA 5565, the residual cover exists only if the policy states a limit per operation and an aggregate. The aggregate (or aggregate limit) is the overall limit of an insurer's commitment over a defined period, generally the underwriting year. It differs from the per-loss or per-occurrence limit. The per-occurrence limit caps indemnity for a single event; the aggregate caps the sum of all indemnity paid over the period. In a cyber policy, the aggregate is a critical parameter because of correlation and accumulation risk. A single cause (zero-day vulnerability, state-backed cyber operation) can generate multiple losses for the same insured within the same period. LMA 5565 writes back cover for non-systemic cyber operations only if two limits are set: a per-cyber-operation limit and an aggregate limit for the period of insurance. If the policy leaves these amounts blank, LMA 5565 grants no coverage for those cyber operations, and the clause effectively becomes a total exclusion. For the underwriter, this is one of the most important operational features of the clause.
Textbook case: an underwriter uses LMA 5565A for a commercial cyber policy. They fail to fill in the two amounts the clause leaves blank, the per-cyber-operation limit and the aggregate. In the event of a non-systemic state-backed cyber loss, the insured will discover at claims time that residual coverage is nil: the clause behaves like LMA 5564. This is a major underwriting malpractice risk.
- Lloyd's Market Association, LMA5565 (War, Cyber War and Cyber Operation Exclusion No. 2) and LMA5565B clause wordings, as published on the LMA website
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.