market bulletin

Ref: Y5065

Title

US: TRIA compliance for cyber insurance policies

PurposeTo inform the market that TRIA compliance is required for cyber liability policies

Type

Scheduled

From

Yael Chen, Senior Manager, International Regulatory Affairs

Date

9 February 2017

Deadline

Effective 1 April 2017

Related links

FIO TRIA Cyber Liability Guidance

Summary
Terrorism Risk Insurance Act (“TRIA”) compliance is required for commercial lines ofproperty and casualty insurance (referred to herein as “covered lines”).
Last year, the Federal Insurance Office (“FIO”) confirmed to Lloyd’s that TRIA compliance isrequired for cyber policies that cover damage to physical property; i.e. the CZ risk code..
In December 2016 FIO issued guidance clarifying that cyber liability policies (as definedbelow) also require TRIA compliance. 1
Background
TRIA and subsequent reauthorizations – most recently the Terrorism Risk Insurance
Program Reauthorization Act of 2015 (TRIPRA / TRIA) – establish a US Federal
Government programme that provides a backstop of up to USD 100 billion for covered

181 Fed. Reg. 95312 (Dec. 27, 2016).

TRIA Cyber market bulletinLloyd’s is authorised under the Financial Services and Markets Act 2000

Page 1 of 4

MARKET BULLETINlines. 2 Please refer to the US Federal page on Crystal for more information on the TRIA
programme.
TRIA Requirements
Last year, the National Association of Insurance Commissioners (“NAIC”) added “CyberLiability” to the Uniform P&C Product Coding Matrix 3 as a sub-line under Line 17 – OtherLiability, which is a covered line under TRIA.
The NAIC defines “Cyber Liability” for state regulatory purposes as:
Stand-alone comprehensive coverage for liability arising out of claims related tounauthorized access to or use of personally identifiable or sensitive information
due to events including but not limited to viruses, malicious attacks or systemerrors or omissions. This coverage could also include expense coverage forbusiness interruption, breach management and/or mitigation services. Whencyber liability is provided as an endorsement or as part of a multi-peril policy, as
opposed to a stand-alone policy, use the appropriate Sub-TOI of the product towhich the coverage will be attached.
As a result of this change, Underwriters writing policies that fall within the NAIC definition of“Cyber Liability” are obligated to comply with the requirements of TRIA – namely the “makeavailable” and disclosure notice requirements. This applies to stand-alone cyber policies
and potentially policies covering cyber risk through an endorsement or as part of a multiperil policy (see below). TRIA compliance continues to be required for policies with a CZ
risk code. Importantly, failing to comply with TRIA requirements for cyber policies
potentially jeopardises an insurer’s eligibility for reimbursement under the TRIA programme
for all its business.
When cyber risk coverage is written as part of a multi-peril policy or as an endorsement,
Underwriters should comply with the requirements of TRIA if the cyber coverage is included
in a type of policy that is itself a covered line under TRIA. If cyber coverage is included in apolicy that is not in a covered line, then the existence of cyber cover is not enough to trigger
TRIA eligibility for the product as a whole. If Underwriters are writing a cyber insurance
policy which they believe does not fall within the above definition and is also not coded
under the CZ risk code, then Underwriters should document for their files as to why they
believe TRIA compliance is not required for that particular policy.

231 CFR§50.4(w) clarifies that TRIA covers commercial lines of property and casualty insurance includingexcess insurance, workers compensation and D&O liability. “Property and casualty insurance” has beenfurther defined to include the following lines from the NAIC’s Exhibit of Premiums and Losses; fire, allied
lines, commercial multiple peril (liability portion), commercial multiple peril (non-liability portion), oceanmarine, inland marine, workers’ compensation, other liability (i.e. Line 17), products liability, aircraft (allperils), and boiler & machinery.
3NAIC 2017 Uniform Property and Casualty Product Coding Matrix, Line 17.0028; N.B. The Product Coding
Matrix provides guidance as to how to categorize business for NAIC filings.

TRIA Cyber market bulletin

Page 2 of 4

MARKET BULLETIN“Make Available”
At the time of offer or renewal, insurers must “make available” terrorism coverage for all
policies written within covered lines on terms which "do not differ materially from the terms,amounts, and other coverage limitations applicable to losses arising from events other thanacts of terrorism". For cyber products, the “make available” requirement will be met so longas the product would provide coverage for losses resulting from a cyber terrorism event.
Underwriters should note that the “make available” requirement does not mandate that
insurers cover particular risks (e.g. cyber). TRIA requires only that if coverage for a risk that
falls within a covered line is included, terrorism coverage must also be offered on materiallysimilar terms.
Disclosure Notice
Insurers are required to provide a TRIA disclosure notice at the time the insurer first formallyoffers to provide insurance coverage or renew a policy. Additionally, insurers must makereference back to that disclosure notice at the time the transaction is completed. This may
be satisfied by including a “separate line item” within the policy referencing back to thenotice.
Notices must contain certain specific disclosures. The LMA has produced model disclosure
notices – based upon the NAIC model notices – which meet requirements of TRIA and areavailable on the Lloyd’s Wording Repository (LMA9103, LMA9104, LMA9105, LMA5217,
LMA5218 and LMA5219).
Next steps
Managing agents must now comply with TRIA for cyber liability policies as well as thosewith a CZ risk code. The guidance stipulates that new and renewal cyber liability policies
must comply with TRIA, effective 1 April 2017.
Lloyd’s will continue to monitor this issue closely for further developments and will informthe market accordingly.
Further information
If you require information regarding TRIA requirements, please contact:
Lloyd's International Trading Advice
Primary point of contact for advice and informationon Lloyd's trading status worldwide.
On line: For quick and easy access to Lloyd's international
regulatory and taxation information visit:www.lloyds.com/crystal

TRIA Cyber market bulletin

Page 3 of 4

MARKET BULLETIN

On site: Lloyd's International Trading Advice
Lloyd's Desk, Ground Floor, Underwriting Roomt: +44 (0) 20 7327 6677
e: lita@lloyds.com

TRIA Cyber market bulletin

Page 4 of 4