Commercial Crime Insurance: Employee Dishonesty, Funds Transfer Fraud & ERISA Master Guide
Why commercial property policies exclude internal theft, how social engineering sublimits trap businesses in BEC scams, and how to maintain statutory ERISA fidelity compliance.
Quick Takeaway
Commercial Crime Insurance protects organizations against direct economic losses of money, securities, and tangible property caused by employee embezzlement, forgery, robbery, computer fraud, and fraudulent wire transfers. Standard Commercial Property and CGL policies strictly exclude dishonest employee acts, making standalone crime policies mandatory for financial asset protection.
The 7 Primary Insuring Agreements of ISO Form CR 00 20
Under the standard Insurance Services Office (ISO) Commercial Crime policy structure, coverage is segmented into independent insuring agreements that can be bound individually or as a comprehensive blanket policy:
| Insuring Agreement | Covered Perils | Key Exclusions / Limitations | Deductible Rule |
|---|---|---|---|
| 1. Employee Theft | Direct theft/embezzlement by employees | Inventory shortages proven by calculation only | Standard Policy Retention |
| 2. Forgery or Alteration | Forged checks, drafts, promissory notes | Registered credit card fraud (separate rider) | Includes Defense Expenses |
| 3. Inside: Theft of Money | Theft, disappearance, destruction inside | Fire damage to premises (covered by Property) | Standard Retention |
| 4. Outside Premises | Money/securities in transit via armored car | Unattended personal vehicles | Standard Retention |
| 5. Computer Fraud | Direct unauthorized hacking of systems | Voluntary wire transfers via social engineering | Direct Hack Required |
| 6. Funds Transfer Fraud | Fraudulent wire instructions to financial institution | Requires Social Engineering Endorsement for BEC | Often Sublimited ($100k-$250k) |
| 7. Money Orders & Counterfeit | Good-faith acceptance of counterfeit currency | Foreign currencies without exchange verification | Typically $0 or Small Retention |
What This Means for Your Agency
In financial fidelity underwriting, ISO Form CR 00 20 draws a strict boundary between Computer Fraud (Insuring Agreement 5) and Social Engineering / Fraudulent Impersonation. Computer fraud requires an unauthorized third party to directly hack, alter, or breach the insured's computer system to cause a fraudulent electronic transfer. In contrast, Business Email Compromise (BEC) and vendor impersonation schemes trick legitimate employees into willingly executing wire transfers. Because the authorized employee authorized the transfer, standard computer fraud insuring agreements deny coverage. Brokers must attach specialized Fraudulent Impersonation endorsements (such as ISO CR 04 17) to cover deceptive funds transfer losses, which are commonly subject to secondary callback verification warranties.
Commercial Crime & Social Engineering Exposure Evaluator
Simulate financial crime loss scenarios across employee embezzlement, BEC wire fraud, forgery, and ERISA fiduciary theft.
Insuring Agreement 7 (Funds Transfer / Social Engineering)
$350k
Analysis: The loss was caused by Business Email Compromise (BEC) tricking staff into wiring funds. Under standard ISO CR 00 20, Computer Fraud denies because systems were not directly breached. Coverage is strictly capped at the $100k Social Engineering Sublimit, leaving a $260k out-of-pocket balance.
ERISA Section 412 Fidelity Bonds vs. Commercial Crime Policies
The federal Employee Retirement Income Security Act (ERISA) mandates that every plan fiduciary and individual who handles retirement plan funds must be bonded against theft. Key compliance rules include:
- 110% Asset Threshold FormulaThe bond must equal at least 10% of the total plan funds handled at the beginning of each fiscal year (minimum $1,000, maximum $500,000).
- 2Employer Securities Cap ($1,000,000)If the retirement plan holds employer securities (e.g. company stock or ESOPs), the statutory bond cap increases from $500,000 to $1,000,000.
- 3Absolute Prohibition on DeductiblesUnder federal law, ERISA fidelity bonds cannot carry a deductible. Any claim paid under the ERISA insuring agreement must be first-dollar.
- 4Named Insured Must Include the PlanThe bond must name the retirement plan itself (not just the corporate entity) as an insured to ensure plan participants directly recover losses.
Frequently Asked Questions: Commercial Crime & Fidelity Insurance
What does Commercial Crime Insurance cover?
Commercial Crime insurance protects businesses against direct financial losses resulting from employee theft, embezzlement, forgery, robbery, safe burglary, computer fraud, funds transfer fraud, and counterfeit money that are excluded by standard Commercial Property and General Liability policies.
What is the difference between Computer Fraud and Funds Transfer Fraud / Social Engineering?
Computer Fraud covers unauthorized third-party hacking directly into a computer system to transfer funds. Funds Transfer Fraud / Social Engineering covers deceptive manipulation (such as Business Email Compromise or spoofed executive requests) that tricks an authorized employee into voluntarily initiating a fraudulent wire transfer.
What is an ERISA Fidelity Bond and who is legally required to have one?
Under Section 412 of the Employee Retirement Income Security Act (ERISA), plan fiduciaries and trustees who handle 401(k) or pension plan funds must maintain a fidelity bond equal to at least 10% of total plan assets (minimum $1,000, maximum $500,000, or $1,000,000 for employer securities) to protect plan participants against fraud.
What is the difference between Discovery Form and Loss Sustained Form in Crime policies?
A Discovery Form covers losses discovered during the policy period, regardless of when the fraudulent act actually occurred. A Loss Sustained Form only covers losses that both occurred and were discovered during the active policy period (or within an agreed extended discovery period).
Does Commercial Property insurance cover employee embezzlement?
No. Standard Commercial Property policies (ISO CP 00 10) contain an absolute Dishonest Acts / Employee Theft exclusion. Embezzlement, payroll theft, and inventory skimming require dedicated Commercial Crime coverage or an Employee Dishonesty endorsement.
What is a Client / Third-Party Property endorsement in commercial crime?
Endorsement ISO CR 04 01 (Client's Property) extends Employee Theft coverage to protect money, securities, and property belonging to a client or customer while in the care, custody, or control of the insured's employees (essential for janitorial, IT managed services, and security contractors).
Related Management & Financial Risk Guides
More Guides in Commercial Auto & Executive Lines
Automate Commercial Crime Audits & Employee Dishonesty Tracking
Audit Form CR 00 21 coverage agreements, verify funds transfer fraud endorsements, and cross-reference ERISA compliance bounds in seconds with Becky.