In the following guest post, Geoffrey B. Fehling and Michael S. Levine review and analyze a September 2, 2021 Fifth Circuit decision in which the appellate court reversed a lower court ruling and held that a D&O insurance policy must cover a settlement related to a social engineering loss. Geoffrey is a counsel in Hunton Andrews Kurth’s Boston office and Michael is a partner in the firm’s Washington, D.C. office. I would like to thank the authors for allowing me to publish their article as a guest post on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is the authors’ article.
******************
The Fifth Circuit recently reversed a lower court’s no-coverage ruling, holding that a D&O insurer must indemnify a financial services firm for money wired to a fraudster pretending to be a customer. The ruling in HM International v. Twin City, No. 20-20122, 2021 WL 3928970 (5th Cir. Sept. 2, 2021), shows the breadth of defense and indemnity coverage under many D&O policies for tort claims alleging that the insured’s misconduct resulted in financial losses and highlights the need for financial services firms to carefully construct a comprehensive liability program to avoid overbroad application of “professional services” exclusions like what the policyholder had to correct on appeal.
Background
HMI provided various accounting and financial services to Greg and Kathy Geib. One day, HMI’s CFO received an email from Mr. Geib’s account, requesting that HMI send $1 million to a certain bank account. HMI complied and executed the order. Unbeknownst to HMI, the email was from a fraudster impersonating the Geib’s, and when the firm received a second email for another transfer two days later and contacted the Geib’s, it discovered the fraud. But the damage had been done, causing the Geib’s to lose $1 million, much of which was unable to be recovered.
Three months later, the Geibs accused HMI of negligence and demanded that HMI compensate them for their losses. HMI notified its D&O liability insurer, Twin City, of the demand, but Twin City refused to provide coverage, contending the claim was excluded under the policy. HMI sued Twin City alleging breach of the policy and, while the coverage litigation was pending, HMI settled the Geibs claim for $470,000 and assigned its right to pursue recovery of the stolen funds from Twin City. The Geibs never filed suit against HMI.
The parties cross-moved for summary judgment. The district court ruled in favor of Twin City, finding that it had no obligation to provide coverage for the settlement payment to the Geibs because the settlement was made after the limitations period had run. Specifically, the court held that the settlement payment was not a “loss” because it was not an amount HMI was “legally liable to pay solely as a result of a claim.” The court reasoned that, “[i]n the very sense of the words ‘legally liable,’ a claim barred by the statute of limitations cannot be a claim in which HMI faced legal liability—the law actually bars liability.” HMI appealed the ruling to the Fifth Circuit.
The Opinion
Applying Texas law, the Fifth Circuit reversed the district court’s ruling on multiple grounds.
First, the district court misapplied the D&O policy’s definition of “claim” by equating it with “cause of action,” which was apparent from the district court’s reference to a claim barred by the statute of limitations. A cause of action can certainly be barred by the statute of limitations, the Fifth Circuit reasoned, but the policy’s definition of “claim,” which broadly includes a “written demand for monetary damages or other civil non-monetary relief—i.e., a Demand Letter—cannot.”
Second, the district court erred by barring coverage under the assumption that “HMI actually lost or would have lost had the Geibs filed suit” and, as such, HMI could not ever be “legally liable to pay” the claim because any suit by the Geibs would have been time-barred. The Fifth Circuit ruled that this view was inconsistent with Texas law, which interprets “legally liable to pay” to include a “contractual obligation to pay” through settlement. The broader view of “legally liable to pay” is further bolstered because the policy includes “settlement amounts” among the list of covered damages.
Clarifying those two misinterpretations, the Fifth Circuit found that coverage for HMI’s settlement payment to the Geibs becomes clear—the demand letter constitutes a “claim” because it is a “written demand for monetary damages or other civil non-monetary relief” and “HMI’s settlement payment constitutes a Loss because it is an amount that HMI is legally liable—through contract—to pay to the Geibs as a result of the demand letter.”
The Fifth Circuit explained further that the Geibs’ failure to timely file suit is immaterial because the D&O policy “does not require that the party suing the insured win a judgment” or even that they file suit at all. Likewise, the policy does not require a policyholder to “meet a threshold likelihood of losing the threatened lawsuit before a settlement can be recovered.” In defending the lawsuit, HMI had the right to “measure the legal risk it presents and decide whether to settle,” which is why Texas law holds that “insurers that breach their duty to defend cannot challenge the reasonableness of a subsequent settlement. The merits of the hypothetical suit by the Geibs do not change that “basic tenet of insurance law.”
The Fifth Circuit also quickly dispatched Twin City’s two alternative theories against indemnifying HMI. Twin City argued that it had no duty to indemnify HMI because the settlement “was not the result of an adversarial process.” The court disagreed because the lack of an adversarial process “only releases an insurer that breached its duty to defend from being fully bound by the settlement.” Stated differently, “showing the settlement did not result from a fully adversarial process gives insurers the opportunity to contest the amount and validity of the settlement, but it does not give them a get-out-of-coverage free card.”
The court also disagreed with Twin City concerning the adversarial nature of HMI’s settlement, which turned on whether HMI bore an actual risk of liability for the damages agreed upon or had other meaningful incentives to ensure that the settlement accurately reflected the Geibs’ claimed damages. The court found that the “possibility of being liable for damages or the settlement if the insurer does not ultimately cover it” was an adequate incentive to make the settlement “adversarial.” In HMI’s case, it settled with full knowledge that if it lost the pending coverage dispute it would be responsible for the settlement, which is enough incentive to reach a fair settlement.
Finally, Twin City argued that coverage was barred by the policy’s “professional services” exclusion for loss “in connection with any Claim based upon, arising from, or in any way related to any actual or alleged . . . rendering of, or failure to render, any services for or on behalf of others for a fee.” It contended that HMI “regularly performed wire services for the Geibs for a fee” and that the Geibs’ threatened suit arose from a wire service. HMI disputed that the wire transfer it provided was “for a fee.” Citing evidence that the parties’ services agreement did not list “wire transfers” among the services for which HMI charged the Geibs and testimony from an HMI employee that wire transfers were free, the Fifth Circuit found that Twin City was not entitled to summary judgment based on the professional services exclusion due to a genuine dispute of material fact.
The court vacated summary judgment in favor of Twin City and remanded for further proceedings.
Discussion
The HM International decision touches on a number of important coverage issues for policyholders to consider, both in pursuing recovery for social engineering losses and, more generally, in purchasing and renewing D&O policies.
The first is not to overlook D&O policies as a potential source of recovery for cyber scam liability. With a continued uptick in both the frequency and severity of social engineering, business email compromise, phishing, malware, and other cyber threats, companies are facing more risk than ever, some of which may be covered by D&O, E&O, general liability, and other non-cyber policies.
Second, policyholders must remain vigilant in aggressively pursuing coverage based on the actual policy language used and not based on the insurer’s preferred narrow reading of coverage grants or expansive reading of exclusions where those interpretations conflict with the policy’s plain language. In the case of HMI’s claim, the insurer (and later, the court) adhered to readings of “claim” and “legally liable to pay” that artificially constricted coverage inconsistent with the policy’s broad grant of coverage for “demands” for monetary and non-monetary relief that could result in legal liability for settlement payments. The Fifth Circuit’s reversal is a good reminder to meticulously review every applicable policy provision compared to the insurer’s grounds for denying or limiting coverage to ensure that the insureds are getting the benefit of the purchased coverage.
Third, be wary of broad language in “professional services” and other exclusions. The lead-in language in HMI’s policy, which applied to any loss “based upon, arising from, or in any way related to any actual or alleged” professional services, was especially broad. Policyholders often can negotiate more reasonable causation language or narrower definitions of “professional services,” especially when a significant portion of the insureds’ business is to provide services that could be deemed professional in nature. Financial services firms—or really any business that performs services for a fee—should pay close attention to “professional services” exclusions that may result in large swaths of business potentially outside the scope of D&O coverage. Coordinating appropriate types of liability coverage across multiple policies, including by purchasing a separate E&O policy to respond to professional liability claims, can mitigate the risk of disputes like those in HM International that can result in significant gaps in coverage.