Commercial Crime Insurance and Fidelity Bonds

Commercial crime insurance pays for money, securities, and other property stolen from your business, whether the thief is your own bookkeeper or an outside fraudster. The standard ISO policy offers eight insuring agreements, and the first of them, called Fidelity, is the modern form of the fidelity bond: it covers employee theft, ERISA plan official dishonesty, and employee theft of clients' property. You pick only the agreements you want, and each one gets its own limit and deductible on the declarations page.

Theft by insiders is the loss most businesses never see coming, and it is exactly the loss that general liability and property policies exclude.

Commercial Crime Insurance

Commercial crime insurance covers loss of money, securities, and other tangible property from theft, fraud, forgery, and related criminal acts committed by employees or outsiders. Businesses select individual insuring agreements, each with its own limit, rather than buying one blanket coverage.

Menlo

What does commercial crime insurance cover?

Commercial crime insurance covers eight kinds of loss under the current ISO program, written on the Commercial Crime Coverage Form in a Discovery version (CR 00 20 06 22) or a Loss Sustained version (CR 00 21 06 22). Carriers issue the loss sustained version by default on standard placements; the discovery version is the exception you have to ask for. You choose which agreements to buy, and the declarations show a per-occurrence limit and deductible for each one. Fidelity is really three agreements in one: Employee Theft, ERISA Plan Official Dishonesty and Employee Theft of Clients' Property. The rest cover theft by outsiders, on and off your premises. Fraudulent Impersonation, the social engineering coverage, is not one of the eight base agreements: it is added by endorsement, usually with a sublimit.

The eight base agreements sort cleanly by who steals and what each one pays:

Insuring Agreement	Who steals	What it pays
Fidelity (Employee Theft, ERISA Plan Official Dishonesty, Employee Theft of Clients' Property)	Insiders	Theft of money, securities, and other property by employees or ERISA plan officials
Forgery or Alteration	Outsiders	Forged or altered checks, drafts, and promissory notes, plus forged payment card instructions as a sublimit
Inside the Premises: Theft of Money and Securities	Outsiders	Theft, disappearance, or destruction of money and securities inside your premises or a bank
Inside the Premises: Robbery or Safe Burglary of Other Property	Outsiders	Robbery of a custodian or safe burglary of property other than money and securities
Outside the Premises	Outsiders	Money, securities, and property in the care of a messenger or armored car off premises
Computer Fraud	Outsiders	Hacking that fraudulently transfers your money, securities, or property out of your systems
Funds Transfer Fraud	Outsiders	Fraudulent instructions sent to your bank, purportedly from you, directing a transfer of funds
Money Orders and Counterfeit Money	Outsiders	Money orders that are never paid and counterfeit currency accepted in good faith

Fidelity agreements bundle every act by one employee, or one scheme by several in collusion, into a single occurrence subject to one limit. Two clerks who conspire to steal $50,000 from a policy with a $25,000 Employee Theft limit recover $25,000, not $50,000. And if the only evidence of theft is an inventory or profit and loss computation, there is no coverage. That inventory-shortage rule drives more claim disputes than any other condition in the form.

What is a fidelity bond?

A fidelity bond is coverage that reimburses an employer for theft or dishonesty committed by its own employees. The name survives from an era when this protection was written as a bond guaranteeing an individual's honesty, but today it is almost always issued as insurance, either as the Fidelity insuring agreement of a commercial crime policy or as a standalone employee dishonesty policy. Unlike a surety bond, which involves three parties and lets the surety recover from the principal, a fidelity bond is a two-party contract between insurer and employer, and the employee whose theft triggers the claim has no rights under it. If someone quotes you employee dishonesty insurance, a fidelity bond, or Employee Theft coverage, they are describing the same protection under three names.

Employee Theft of Clients' Property extends the coverage to property your employees steal from customers, though the claim must be presented by your business as the named insured, never by the client directly. One design choice deserves a hard position. The unendorsed form pays even when you cannot identify which employee stole, which matters because embezzlers hide well. The Employee Theft Name or Position Schedule endorsement (CR 04 08 06 22) trades that away, covering only named individuals or scheduled positions. For nearly every buyer, blanket coverage is worth the extra premium and the schedule endorsement is a false economy.

What is an ERISA bond and how much coverage is required?

ERISA requires anyone who handles the money in an employee benefit plan, such as a 401(k) or pension, to carry a bond equal to at least 10% of the funds that person handled the year before, with a $1,000 floor. The most any plan must carry is $500,000, which rises to $1,000,000 for plans holding employer securities. Those figures come from Section 412 of ERISA as read by the U.S. Department of Labor in Field Assistance Bulletin 2008-04, still the governing guidance.^[1] This bond protects the plan, not the company. The employer cannot collect a dime under it, and carrying it is not optional. Plans report the bond amount on the Form 5500, and a missing or inadequate bond is one of the most common audit flags the Department of Labor pursues.

DOL guidance prohibits any deductible on the required ERISA portion of the bond, which is why the deductible section of the ISO crime program's crime declarations clearly states N/A for ERISA Plan Official Dishonesty.^[2] DOL rules also require that the bond be issued by an insurer (surety) named on the Treasury Department's Listing of Approved Sureties, Circular 570.^[3] This coverage is provided under the ERISA Plan Official Dishonesty agreement which provides coverage to all plan officials, regardless of whether they are specifically identified, for fraudulent or dishonest acts, including those committed by a sole proprietor insured who steals from their own company's plan.

What is the difference between the loss sustained and discovery forms?

The loss sustained form and the discovery form provide the same coverages with different triggers. Under the Loss Sustained Form (CR 00 21 06 22), the theft must take place during the policy period and be discovered during the policy period or the extended discovery period, which runs 60 days after cancellation, or one year for an ERISA plan. Under the Discovery Form (CR 00 20 06 22), the theft can take place at any time, including years before the policy existed, so long as it is discovered during the policy period.

Discovery means more than suspicion: a designated person must learn facts that would cause a reasonable person to believe a covered loss occurred. The trigger difference is everything for embezzlement, which often runs for years before surfacing. The ACFE's 2024 Report to the Nations puts the median occupational fraud at 12 months from start to detection, and the longest-running schemes are the costliest ones.^[4] That median should also size your Employee Theft limit. Think about the largest checks your controller can sign and the wires your office manager can release, then multiply by a year of nobody looking. That is the floor.

Is crime insurance the same as cyber insurance?

No. Crime and cyber insurance overlap in one narrow area, and most businesses need both. The crime policy's Computer Fraud and Funds Transfer Fraud agreements cover a hacker who moves money out of your systems or sends your bank fraudulent wire instructions in your name. Fraudulent Impersonation, added by a separate endorsement, covers social engineering: an employee tricked into sending money by someone posing as a vendor or executive. Carriers routinely sublimit this coverage well below your crime limits, so check your declarations before assuming the full limit applies.

What the crime policy never pays are breach costs. Forensics, customer notification, credit monitoring, ransomware response, and lost income while systems are down all live in a cyber insurance policy. The crime forms replace the stolen funds themselves, and everything spent responding to the incident is a cyber claim. Fraudulent Impersonation also carries a verification condition: you must confirm any change-of-account request or transfer instruction through a method other than email, a callback or text to the apparent sender, and document that verification before the money moves. An accounts payable clerk who wires $80,000 on a convincing email alone has likely failed the condition.

Frequently asked questions

Is a fidelity bond the same as a surety bond?

No. A surety bond is a three-party agreement in which a surety guarantees your performance to someone else, and the surety can recover its payout from you. A fidelity bond is two-party insurance that pays your business for theft committed by your own employees, and the insurer's recovery target is the dishonest employee. Fidelity bonds today are usually issued as the Employee Theft coverage of a commercial crime policy.

Does commercial crime insurance cover theft by the business owner?

No. The policy excludes theft and dishonesty by the named insured, its partners (in a partnership) or its LLC members, acting alone or together, whatever coverage you buy. The one exception is ERISA Plan Official Dishonesty, which covers a sole proprietor who steals from the company's benefit plan, because that agreement exists to make the plan whole and the owner has no claim on its proceeds.

Do I have to identify which employee stole to collect under Employee Theft?

Not under the standard unendorsed form, which pays as long as you can prove an employee theft happened, even if you never learn who did it. Proving it is your job, though. The base form's indirect loss exclusion bars the costs you incur to establish that a loss happened or how much it was, so the forensic accountant who rebuilds the books is your expense unless the policy has the Include Expenses Incurred To Establish Amount Of Covered Loss endorsement (CR 25 40 06 22), which pays those fees within the limit. A policy with the Employee Theft Name or Position Schedule endorsement (CR 04 08 06 22) covers only listed names or positions, so it does require identifying the thief. Either way, the proof cannot rest only on inventory or profit and loss computations.

How much fidelity bond coverage does ERISA require for a 401k plan?

Each person who handles plan funds must be bonded for at least 10% of the funds they handled in the prior year, with a $1,000 minimum and a $500,000 maximum required amount. If the plan holds employer stock, the required amount can reach $1,000,000. Department of Labor rules also say the bond can have no deductible and must be written by a surety on the U.S. Treasury's approved list.

This guide is for educational purposes and summarizes standard ISO policy language. Your policy's specific terms, conditions, and endorsements control. Talk to a licensed broker about your actual exposures.

Sizing your crime coverage

Commercial crime insurance replaces money and property stolen by your own employees or by outsiders, a loss your general liability and property policies exclude. Buy the insuring agreements you actually need, size the Employee Theft limit to a full year of what one trusted person can move, and confirm whether you hold a discovery or loss sustained form. Pull your declarations and check the deductible, sublimits, and form date against those exposures.