9 February 2026
INSURING OPERATIONAL RISKS
Q4 2025 Operational Risks Bulletin
Tom Falcon, Technical Director of Gallagher Specialty's Financial Institutions team, gives his commentary on the insurability of recently reported large operational risk events. Each month, Risk.net issues details of the top five events, and we consider the extent to which insurance coverage is available.
HSBC provisions USD 1.1 billion related to litigation with Herald Fund over Madoff losses
LOSS AMOUNT
USD 1.1B
BUSINESS LINE
Agency Services
EVENT TYPE
Clients, Products and Business Practice
RELEVANT POLICIES
Professional Indemnity Insurance

The provision is in response to a lawsuit brought by Herald Fund over assets lost in Bernard Madoff’s Ponzi scheme. Herald Fund was a Cayman Islands-registered entity that pooled smaller investments and directed them to Madoff’s wealth management firm.
Herald began using HSBC’s Luxembourg unit as a custodian bank for these investments in 2004. Madoff was arrested in 2008 and pleaded guilty to defrauding investors of around USD 65 billion. Herald sued HSBC Securities Services in 2009 to recover assets it claimed were lost in Madoff’s fraud, and after many years of litigation and appeals by HSBC, the bank provisioned USD 1.1 billion in its third-quarter financial results. It also intends to appeal the verdict.
It appears the lawsuit against HSBC relates to alleged oversight failures in acting as a custodian bank, i.e., it failed to carry out adequate checks on Madoff. Professional indemnity insurance should respond to claims of that nature, as it primarily covers claims alleging errors in the performance of professional services. The claim here is an illustrative example of the ‘long tail’ nature of many professional indemnity claims, where judgements and settlements may only materialise several years, or in this case well over a decade, after the alleged errors.
Macquarie Investment Management to pay AUD 321 million to customers following pension fund collapse
LOSS AMOUNT
USD 211M
BUSINESS LINE
Retail Banking
EVENT TYPE
Clients, Products and Business Practice
RELEVANT POLICIES
Professional Indemnity Insurance

The payment is to be made in compensation for losses experienced in its Shield Master Fund pension fund. According to the Australian Securities and Investments Commission (ASIC), Macquarie was aware of liquidity risks in the fund that had resulted in investors’ savings being eroded but failed to place the Shield’s classes on a watch-list for heightened monitoring, reporting, and due diligence — as required by its investment governance framework. Nearly 3,000 members’ retirement savings were threatened by Macquarie’s governance failings.
Professional indemnity insurance should respond to a loss of this nature, as it involves compensatory payments to customers in respect of alleged failures in the performance of financial services.
JP Morgan loses USD 170 million in asset-backed finance fraud by Tricolor
LOSS AMOUNT
USD 170M
BUSINESS LINE
Commercial Banking
EVENT TYPE
External Fraud
RELEVANT POLICIES
Asset-Based Finance Fraud Insurance

The loss relates to suspected asset-backed finance fraud by US subprime auto lender Tricolor Holdings. In September 2025, Tricolor filed for bankruptcy during an investigation into whether it had double-pledged collateral for loans from different financial institutions. Early reviews of Tricolor’s records showed that roughly 40% of 70,000 loans pledged to creditors were backed by vehicles already used as collateral to secure other loans. Both JP Morgan and Barclays were named as secured lenders in Tricolor’s bankruptcy petition. Barclays has also set aside USD 147 million.
Crime insurance for banks is unlikely to respond to a fraud of this nature. This is because the coverage for documentary fraud by third parties is limited to certain documents, which typically do not include those relied upon by lenders in asset-based finance. However, it is possible to purchase specific insurance for asset-based finance fraud, albeit it is not widely available and attracts a significant premium.
Emeraude Friends Investors lose EUR 106 million in alleged Ponzi scheme
LOSS AMOUNT
USD 116M
BUSINESS LINE
Asset Management
EVENT TYPE
Internal Fraud
RELEVANT POLICIES
Crime Insurance/ Professional Indemnity Insurance

The French investment fund is alleged to have pilfered from investors through a fraudulent Ponzi scheme. The fund had promised investors monthly interest rates of up to 27%, but by the start of April 2025, investors had not received any interest for the year. According to media reports, the firm’s founder, listed on the official French companies register as Pascal Nanot, stated that for personal reasons he was forced to accept the offer of a Luxembourg-based broker who had made him an ‘attractive’ business deal and transferred the company’s funds to the broker.
In February 2025, Nanot closed the company and claimed that he had requested the broker to return the funds, but the broker had failed to do so. The French judicial authorities have opened an investigation after receiving complaints from the fund’s investors.
Crime insurance provides broad coverage for the loss of funds due to dishonest, fraudulent or malicious acts by employees. However, coverage can be challenging where directors are involved, as most policies will exclude the acts of directors unless they are acting in an employee capacity. Beyond that, professional indemnity insurance can respond to claims in respect of dishonest or fraudulent acts by employees committed in the provision of professional services. However, as with crime insurance, coverage can be challenging where directors are involved, because the acts of the most senior individuals within an insured company are often imputed to it for the purposes of the dishonesty exclusion.
Colonial First State and AIA to pay AUD 140 million to settle class action over excessive fees
LOSS AMOUNT
USD 91M
BUSINESS LINE
Life Insurance
EVENT TYPE
Clients, Products and Business Practice
RELEVANT POLICIES
Professional Indemnity Insurance

The class action lawsuit is for alleged excessive charges on certain premiums. These included premiums for life, total permanent disability, and income protection cover. The lawsuit alleged that Colonial First State (CFS) arranged superannuation group policies with insurer AIA that were not ‘in members’ best interests’ while similar, cheaper policies were available elsewhere. CFS settled without admitting liability. The settlement amount ranks as one of Australia’s largest-ever payouts related to superannuation insurance.
It is worth noting that excessive fees claims are one of the most frequent causes of operational risk losses suffered by financial institutions, according to published data. Professional indemnity insurance does not cover payments of wrongly charged fees or interest, as almost all policies will have an exclusion in that respect (often described as a Fees Exclusion or a Disgorgement Exclusion). Beyond that, coverage may be available for legal costs in defending such claims, and a well-drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services, including the charging of excessive fees.
BMP Sociedade de Crédito loses up to BRL 541 million after cyber-attack on C&M Software
LOSS AMOUNT
USD 99M
BUSINESS LINE
Corporate Items
EVENT TYPE
External Fraud
RELEVANT POLICIES
Crime Insurance

The bank lost the funds after a cyber-attack on C&M Software — a third-party technology company that provides connectivity infrastructure to financial institutions in Brazil. After an employee of C&M allegedly sold his login credentials to cybercriminals, threat actors gained unauthorised access to BMP’s reserve account and stole funds. Five other financial institutions were affected by the cyber-attack.
Crime insurance provides coverage for various forms of fraud, including the theft of funds by third parties via unauthorised access to computer systems. Where third-party service providers are at fault, as appears to be the case here, insurers are likely to seek to subrogate against the service provider for the insured financial institution’s losses.
National Australia Bank to incur AUD 130 million in costs for underpaying wages to staff
LOSS AMOUNT
USD 85M
BUSINESS LINE
Retail Banking
EVENT TYPE
Employee Practices and Workplace Safety
RELEVANT POLICIES
Employment Practices Liability Insurance

NAB disclosed it underpaid staff wages and entitlements and would make payments to resolve and remediate the issues. The disbursements hiked the bank’s full-year operating expenses by approximately 4.5%. NAB said it first identified issues with its payroll system during a 2019 review and that further issues surfaced during preparatory work to transition to a new enterprise agreement.
Employment practices liability insurance responds to compensatory claims against companies in respect of alleged employment wrongs, e.g., discrimination. However, it does not cover amounts that the company was due to pay employees. That includes amounts such as redundancy payments and, as per this example, payments to correct the underpayment of wages. Beyond that, coverage may be available under policies for legal costs incurred in responding to regulatory investigations into underpayment of wages.
TOPICAL ISSUES
The UK government considers banning critical infrastructure ransomware payments
The UK Home Office is considering imposing legislation barring owners and operators of critical national infrastructure from paying ransoms to hackers. If that transpires, it would be a world first. Some countries have imposed certain requirements around ransomware payments but have stopped short of a ban. For example, Australia has instituted a system of mandatory reporting of ransom payments.
A ban on critical national infrastructure ransomware payments would prevent cyber insurers from paying ransoms in that respect. That would be a significant development given ransomware coverage is a major aspect of cyber insurance. Indeed, recent data released by the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) show that ransom payments in the US alone hit USD 2.1 billion between 2022 and 2024.
Beyond a ban, it is worth noting that insurers may be prevented from paying ransoms due to various sanctions regimes — as a significant number of ransomware attacks are thought to be made from sanctioned territories, e.g., North Korea. That is often evidenced by sanctions exclusions in policies that clarify the insurer is not required to make payments that fall foul of certain sanctions regimes.
The UK government’s considerations are only in respect of critical national infrastructure. So, if a ban were to be imposed, it would not apply to the great majority of companies. Further, it is far from certain the UK government will progress with legislation, and there are several issues that will need to be resolved before that occurs. For example, it would need to be established what constitutes critical national infrastructure in this context.
“UK cyber ransom ban risks collapse of essential services”, Financial Times, 17 Nov 2025.
Aircraft leasing firms win multibillion-dollar lawsuit over planes ‘lost’ in Russia
In June, aircraft leasing companies won a multibillion-dollar lawsuit against insurers in relation to planes stranded in Russia after the invasion of Ukraine in February 2022. The High Court in London ruled in favour of six leasing firms, including Ireland’s AerCap and Dubai Aerospace Enterprise (DAE), that had brought a USD 4.7 billion (GBP 3.4 billion) lawsuit against their insurers in one of the biggest insurance disputes of 2025.
The Court ruled that the planes had been lost in March 2022, and the aircraft leasing companies could therefore recover losses from their war risks insurers (AIG, Lloyd’s, Chubb and Swiss Re) as the cause of the loss was ‘an act or order of the Russian government’.
Western sanctions forced aircraft leasing companies to cancel their contracts with Russian carriers by 28 March 2022, initially leaving the industry with losses estimated to be USD 10 billion. Russia faced demands to return the stolen planes, but Moscow refused, prompting the claim against insurers. Many of the planes were re-registered by Russia without their owners’ consent and sold on to Russian airlines.
The Court concluded insurers were not prevented by EU or US sanctions from indemnifying the claimants for the loss of aircraft that had been leased to Russian airlines. The London trial related to 147 aircraft and 16 standalone engines that the companies could not retrieve after war broke out. AerCap’s law firm said the judgement secured USD 1.035 billion from insurers for the leasing firm, ‘in addition to substantial recoveries achieved in prior settlements’.
Coverage disputes have always been a part of the insurance world. As this example shows, on occasions they can involve huge sums. A key to lessening the chances of disputes with insurers is clear policy language, coupled with insured-friendly terms and conditions. Thankfully, in our experience, coverage disputes are decreasing in the financial institutions market. We believe that is due in part to broker-led improvement to FI insurance policies.
“World’s biggest aircraft owner set for $1bn payout in Russian planes case”, Financial Times, 11 Jun 2025.
Let's talk


The Walbrook Building 25 Walbrook London, EC4N 8AW
Privacy Policy - Do Not Sell or Share My Personal Information (U.S. Residents Only)
Arthur J. Gallagher (UK) Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: The Walbrook Building, 25 Walbrook, London EC4N 8AW. Registered in England and Wales. Company Number: 119013.