Market Bulletin Y5258 (affirmative cyber, 2019)
Lloyd's bulletin of July 4, 2019 requiring every policy to state whether it covers or excludes cyber losses, phased in from January 1, 2020.
On July 4, 2019, Lloyd's issued Market Bulletin Y5258 and ended the silent contract in its market. The bulletin creates no cover and removes none: it bans silence. Every policy written or renewed has to say whether it covers cyber losses or excludes them. The timetable started with first-party property damage on January 1, 2020, then reached the other classes in six-month phases through July 1, 2021. Behind it sat NotPetya, the Merck and Mondelez lawsuits, and the PRA, which had been asking since SS4/17 in July 2017 for firms to measure the cyber exposure hidden in policies written for fire. The market answered with model wordings: LMA 5400 and LMA 5401 in property, CL380 and its neighbors in marine, others in casualty and reinsurance. The bulletin has a limit that is easier to see now. It treats cyber as a cause, to be affirmed or excluded, and leaves aside the question of a state doing the attacking. That one was put to standalone cyber policies by Y5381 in August 2022.
Hypothetical: a syndicate renews, on February 1, 2020, the property policy of a cold-storage warehouse whose 2016 wording says nothing about cyber. The bulletin already applies to that contract. The underwriter can no longer roll it over as is. He has to add an endorsement excluding losses caused by a cyber attack, or draft and price an affirmation, for instance for a fire that follows a takeover of the compressors.
Y5258, bulletin Y5258, Lloyd's Y5258, Lloyd's Market Bulletin Y5258
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.