A data center aisle at night, locked server racks with status lights and bundled network cabling, an operations room behind glass — financial services cyber liability

California commercial insurance

Financial Services Cyber Insurance CA

Financial businesses are attractive cyber targets because attackers don't have to monetize stolen data later if they can manipulate money movement now. Lenders, fintech companies and finance firms handle account information, loan files, ACH instructions and privileged access to banking platforms — a single compromised credential can become a privacy event and a funds-transfer loss at the same time.

Funds-Transfer Fraud
Social Engineering
Data Breach Response

Reviewed by David Gleason, Principal — October 12, 2026

Start Quote Now 844-978-7283

Next Level Experience. Insurance Done Right.

Request a Quote Call 844-978-7283 See FAQs

CaliforniaGeneral information only, not legal advice — illustrative scenarios and coverage, subject to change without notice. Content may be out of date or contain errors, and requirements vary by city, county, state, agency, project, contract, carrier and policy, among other factors; verifying what applies to your own situation is your responsibility. Full disclaimer

Prefer to send everything at once? Complete a streamlined submission — just needs your review. Especially worth it if your business does $2M+ in annual sales — it can meaningfully speed up carrier turnaround.

Interactive coverage guide

Build a coverage stack around how the business actually operates.

Start with the preselected industry or trade, then adjust the operational questions. The commonly considered stack updates live. Keep the coverages you want GIB to evaluate, remove ones you do not want included in your quote request, and add other available lines before continuing.

Common Starting Coverages

Professional Liability / E&OErrors in professional services or advice

What it is

Professional Liability may address covered claims alleging errors, omissions or failures in professional services.

Why businesses like yours commonly carry it

Businesses providing design, engineering, consulting, specifications or professional advice commonly consider it.

Possible coverage gap

General Liability is generally not intended to replace coverage for economic loss arising from professional errors.

Learn more about Professional Liability / E&O

Cyber Liability & Data BreachCyber events, data and system interruption

What it is

Cyber insurance may address certain first-party and third-party losses from covered data breaches, cyberattacks, ransomware and system interruption, depending on the policy.

Why businesses like yours commonly carry it

Financial firms move client money and hold account data, which puts funds-transfer fraud and breach response at the center.

Possible coverage gap

General Liability generally should not be assumed to address data breach response, ransomware or network interruption.

Learn more about what cyber insurance costs in California

Commonly Added Based on Operations

General LiabilityThird-party injury and property damage

What it is

General Liability commonly addresses covered third-party bodily injury, property damage and certain personal or advertising injury claims, subject to the policy.

Why businesses like yours commonly carry it

Businesses commonly use it as a starting liability policy and to satisfy customer, landlord or contract requirements.

Possible coverage gap

General Liability is not intended to replace policies for employee injuries, business vehicles, owned property, cyber events or professional errors.

Learn more about General Liability

Commercial Crime / FidelityEmployee theft and certain fraud losses

What it is

Commercial Crime may address certain covered theft, fraud and funds-transfer losses, depending on the selected insuring agreements.

Why businesses like yours commonly carry it

Businesses handling money, inventory, payments or account access commonly consider crime coverage.

Possible coverage gap

Property and cyber policies do not necessarily cover every employee theft or social-engineering loss.

Learn more about Commercial Crime / Fidelity

Exposure-Dependent Coverages

Employment Practices LiabilityEmployment-related allegations

What it is

EPLI may address certain covered employment-related claims such as discrimination, harassment, retaliation or wrongful termination.

Why businesses like yours commonly carry it

Businesses with employees or managers commonly consider employment-practices protection as the workforce grows.

Possible coverage gap

Workers Compensation and General Liability generally do not replace employment-practices coverage.

Learn more about Employment Practices Liability

Directors & Officers Liability (D&O)Management decisions and alleged wrongful acts

What it is

Directors & Officers Liability may address certain covered claims alleging wrongful acts by directors, officers or organizational management, depending on the policy form.

Why businesses like yours commonly carry it

Organizations with directors, officers, investors, lenders or other stakeholders may consider D&O protection as governance and management exposures increase.

Possible coverage gap

General Liability and Professional Liability should not automatically be assumed to address management-liability allegations.

Learn more about Directors & Officers Liability (D&O)

Umbrella / Excess LiabilityAdditional limits above scheduled liability policies

What it is

Umbrella or Excess Liability may provide additional limits above identified underlying liability policies, subject to its own terms and exclusions.

Why businesses like yours commonly carry it

Businesses with larger contracts, vehicles, public exposure or higher severity potential commonly consider additional limits.

Possible coverage gap

An umbrella does not automatically broaden every exclusion or sit over every policy unless the issued terms say it does.

Learn more about Umbrella / Excess Liability

Do you have specific insurance requirements from a project, customer, vendor, landlord, lender, lease, or contract?

Yes — I have them nowOpen the Requirements Analyzer to review or upload them.Yes — but I don't have them available yetContinue now and flag the quote for follow-up.No — I don't have specific requirementsContinue directly to the quote request.

Loading quote and requirements options…

Continue With These Coverages

Educational guidance only. Results are not a coverage recommendation, quote, binder, policy interpretation, or guarantee of coverage. Actual needs, availability, forms, limits, exclusions and requirements vary. A licensed insurance professional should review the complete risk and issued policy terms.

Verified Google reviews

What our cyber insurance clients say about us

5.0 / 5from 7 Google reviews

Reviews reflect individual client experiences and are not a guarantee of coverage, pricing or results.

91 Enterprise LLC

March 24, 2026

We are using Gleason insurance for our commercial auto policy and GL policy. David is the best insurance broker I've worked with — very honest, responsive, and knowledgeable. Highly recommend.

Fito Plumbers

February 20, 2026

We have been working with David at Gleason Insurance Brokers for 8+ years. David always goes above and beyond to make sure we have the appropriate coverages. He explains everything in detail and makes sure we feel confident and understand all of our policies. He is always available and responds right away!

Barry Stay

February 17, 2026

David provides great service and I highly recommend him for your insurance needs.

Why Advisers, Lenders and Fintechs Are Prime Targets

For California financial-service businesses, cyber insurance should be designed around both data risk and transaction risk. A policy with broad privacy language but a small social-engineering sublimit can leave the insured exposed exactly where the actual loss is most likely to occur.

Attackers increasingly study normal payment patterns, copy writing styles and enter existing email threads rather than sending an obviously fraudulent message — which is why business email compromise at a financial firm looks different from the phishing scenario most people picture.

Financial firms combine sensitive data with the ability to move real money

A small social-engineering sublimit can leave the real exposure uncovered

Modern BEC schemes study payment patterns and mimic existing threads

Data risk and transaction risk both need to be underwritten deliberately

What a Financial-Firm Cyber Policy Can Address

Attackers may impersonate executives, borrowers, vendors or financial partners to redirect legitimate payments. Some policies distinguish between computer fraud, funds-transfer fraud, fraudulent instruction and social engineering — those definitions should be reviewed before a loss, not after money leaves the account.

Covered breach-response costs may include forensic work, breach counsel and notification, while liability coverage may address certain claims alleging failure to protect information. Policy definitions of personal information can be broader or narrower than an insured expects.

Computer fraud, funds-transfer fraud and social engineering can be defined differently

Review these definitions before a loss, not after money has moved

Breach-response coverage may include forensic work, counsel and notification

Personal-information definitions can be broader or narrower than expected

Client Money, Client Data and Where Each Loss Lands

For a firm that moves client money, the first question after an incident is not what was stolen but which policy holds the loss. The firm's own costs — forensics, legal review, client notice and restoring systems — sit in the cyber policy's first-party coverage. A transfer sent on a fraudulent instruction may sit in a social-engineering line inside the cyber policy, in a crime policy's computer-fraud or funds-transfer agreement, or partly in each, and the limits for those lines are frequently smaller than the headline number.

Claims from clients and regulators form the other side. Non-banking financial institutions under the FTC's Safeguards Rule must notify the FTC no later than 30 days after discovering an event involving unencrypted information of at least 500 consumers, a requirement in effect since May 13, 2024. SEC-registered firms face amended Regulation S-P, which requires a written incident-response program and customer notice no later than 30 days, with compliance dates of December 3, 2025 for larger entities and June 3, 2026 for smaller ones.

Own costs: forensics, legal review, notice and restoration

Stolen funds may sit in cyber, crime or both — check the sublimits

FTC Safeguards Rule: notify the FTC within 30 days (500+ consumers)

Regulation S-P: customer notice within 30 days for covered SEC firms

Where Financial-Firm Exposure Concentrates

A stolen mailbox or cloud credential can give an attacker access to customer communications, loan documentation and internal payment workflows. MFA is important, but underwriters may also evaluate conditional access, privileged accounts, and user provisioning and offboarding procedures.

Fintech and financial businesses may rely on hosted core systems, identity providers, payment processors and data aggregators — dependent business interruption and contingent-system coverage can be critical where the insured's own network stays up but a key provider is down.

Account takeover can expose loan files and payment workflows at once

Underwriting review commonly looks past MFA to privileged-access and offboarding procedures

A core-system or identity-provider outage can stop transactions company-wide

Dependent-business-interruption coverage matters when a key vendor goes down

California and Federal Duties After a Breach

California breach-notification requirements can apply when qualifying personal information is acquired or reasonably believed to have been acquired by an unauthorized person. Certain businesses subject to California privacy rules also face new risk-assessment and cybersecurity-audit requirements on phased schedules.

Financial organizations should determine which laws govern their specific activities with qualified counsel, since federal or state financial-privacy rules may apply in addition to general California requirements depending on the business model.

California breach-notification duties turn on acquisition of qualifying personal information

Phased cybersecurity-audit rules apply to certain covered businesses

Sector-specific federal or state financial-privacy rules may also apply

Determine which rules govern your specific business model with counsel

An Illustrative Wire-Fraud Event at an Advisory Firm

An employee receives what appears to be a legitimate request from a senior officer and sends funds to a fraudulent account — an executive-impersonation loss that tests exactly how the policy defines fraudulent instruction.

In a separate pattern, a core vendor platform suffers a cyberattack and the firm cannot process normal transactions for several days, turning what started as someone else's incident into the insured's own business-interruption loss.

This example is illustrative, not a report of an actual case or a promise of how any real claim would resolve — real outcomes depend on the specific policy, the facts involved, and the carrier's own review. For a situation that's actually happened or is happening, talk to your broker, a licensed attorney, or the relevant regulatory authority directly.

Executive impersonation tests the policy's fraudulent-instruction definition directly

A core-vendor outage can become the insured's own interruption loss

Credential stuffing and account takeover both trigger response obligations

This is illustrative — real claims depend on the actual policy and facts

Preparing a Financial Services Cyber Submission

Expect questions about annual revenue, transaction volume, maximum funds transferred, dual authorization, call-back verification, MFA, privileged access, vendor management, incident response and regulatory history.

We coordinate cyber, crime and, for technology-driven firms, Tech E&O so a diverted transfer is not assumed to sit in a policy that excludes it. Call 844-978-7283 or request a quote with Cyber Liability selected.

For the overlap that causes the most disputes, see wire fraud under cyber and crime policies.

Describe transaction volume, maximum funds transferred and dual-authorization controls

Note MFA, privileged-access management and vendor management practices

Disclose prior claims and any regulatory history

Reach a broker on 844-978-7283, or request a quote

Frequently asked questions

10 questions — start typing to filter

Does cyber security insurance cover funds we transfer by mistake?

Not always, and it is the question worth asking first. Many cyber policies cover the breach that led to the fraud while the stolen funds themselves sit under a crime policy or a funds-transfer-fraud endorsement. For a lender or a fintech moving client money daily, confirm which form carries the money and at what limit rather than assuming one policy reaches both.

Does cyber insurance cover wire fraud?

It can, but not every wire-fraud event is covered the same way — fraudulent instruction, social engineering, computer fraud and funds-transfer fraud may have separate definitions, limits and verification requirements.

Is crime insurance still necessary if we buy cyber insurance?

Often it should at least be evaluated. Crime and cyber forms can divide financial-loss exposures differently, and some employee-theft or forgery losses may fit better under a crime policy.

What cyber controls do lenders usually need?

Carriers commonly review MFA, endpoint security, backups, email protection, patch management, user-access controls and payment verification. Large transaction limits can lead to deeper underwriting.

Can a cyber policy cover a cloud-provider outage?

Potentially, if the event and provider meet the policy's dependent-system or dependent-business-interruption wording. Definitions and waiting periods vary significantly.

Does cyber insurance satisfy California privacy requirements?

No. Insurance can transfer some financial consequences of a covered event, but it does not replace legal compliance, cybersecurity controls or required risk assessments.

Should a fintech company buy Tech E&O too?

Frequently, yes. Cyber coverage addresses network, privacy and related first-party loss, while Tech E&O can address claims alleging the technology product or service failed to perform.

How are cyber limits determined for a financial company?

Revenue is only one factor — transaction size, customer records, regulatory exposure, business interruption and contractual limits can be more important.

Can prior cyber incidents make coverage unavailable?

Not necessarily, but underwriters typically want details about the event, remediation and current controls. Undisclosed known incidents or vulnerabilities can create serious underwriting and coverage issues.

How does this differ from escrow or title cyber risk?

Escrow and title operations that actually hold or transmit closing funds face a more concentrated funds-transfer exposure. See our Escrow & Title Cyber Insurance page for that distinct profile.

Official resources

Verify current licensing, regulatory and program requirements directly with the responsible agency — this is general information, not legal advice, requirements change without notice, and what is summarized here may be out of date or contain errors. Confirming what applies to your own city, project, contract and policy is your responsibility.

California Privacy Protection Agency — CCPA RegulationsVerified 2026-09-10 California Department of InsuranceVerified 2026-09-10 California AG — Data Security Breach ReportingVerified 2026-09-10 FTC — Safeguards Rule: What Your Business Needs to KnowVerified 2026-10-11 SEC — Regulation S-P Amendments (May 2024)Verified 2026-10-11

Explore Related Coverage and Resources

Related coverage

Cyber insurance quotes by industry Management liability: D&O, EPLI and crime Professional liability and errors and omissions General liability insurance in California Commercial property insurance Business owners policy for smaller operations Workers compensation insurance in California Umbrella and excess liability limits Commercial auto and fleet insurance

Guides and resources

Payment diversion and insurance Which cyber page fits your business Escrow and title cyber coverage Technology and SaaS cyber coverage Manufacturers and industrial operations Business insurance in California AI-driven cyber threats

Updated October 12, 2026

Next Level Experience. Insurance Done Right.

One Stop. We Shop. Real Results.

Get a Quote