Our sponsor bank’s annual review landed this week and the insurance section is longer than everything else in it combined. They want E&O and cyber, both at higher limits than we carry now, with the bank named on the certificate, inside 60 days.
Quick background. We’re a payment facilitator for independent restaurants and food trucks, about two years in, 14 people, based in New Jersey. We onboard the merchants, run underwriting and risk on them, and fund their settlements through the sponsor bank. Card data is tokenized through our processor, so we never store full card numbers, but we do hold bank account details and ID documents for every merchant we board.
What we have today is a cheap cyber policy one of the founders bought online when we launched, and no E&O at all. I’m the COO, so this is now my problem.
What I can’t untangle is where one policy stops and the other starts. If a bug in our settlement file delays funding for a few hundred merchants for two days and a couple of them claim lost business, is that E&O or cyber? And the bank keeps bringing up PCI fines and card brand assessments. Does cyber normally cover those, or are we on the hook regardless? I’m also going back and forth on one combined policy versus two from different carriers.
Payfac folks, what are you spending on E&O and cyber? Anyone in payments been through a sponsor bank insurance review?
