Insurance can play a key role in demonstrating proactive risk management for potential applicants

Swipe through our latest carousel highlighting what we recommend, where each policy helps protect and why they should not be considered in isolation.

For a complimentary consultation, contact us today to safeguard your digital asset operations.

Artificial intelligence is rapidly transforming the insurance industry—reshaping underwriting, claims, fraud detection, and customer engagement. Yet while adoption is accelerating, insurance frameworks are struggling to keep pace.

Our latest Risk Insight Series (March 2026) explores a growing structural challenge: the widening gap between AI-driven risk and the insurance coverage designed to protect against it.

Today, most organisations operate within a “silent AI” environment—where policies neither explicitly include nor exclude AI-related losses. This ambiguity is quickly disappearing. Insurers are introducing broad AI exclusions, narrowing coverage across Technology Professional Indemnity (PI), Cyber, and even D&O policies.

At the same time, AI is fundamentally altering risk itself:

• Accountability is blurred — liability often sits with the deploying firm, not the AI provider
• New failure modes emerge — including hallucinations and opaque decision-making
• Cyber risk is amplified — with AI increasing both attack sophistication and exposure

The result is a fragmented insurance landscape, where no single policy fully addresses AI-related risks. Key gaps are emerging around:

• AI-assisted professional advice
• Third-party AI failures
• Regulatory and governance exposure
• Model training data and IP disputes

Compounding this, regulators across Asia and globally are increasing scrutiny on AI governance—while insurers simultaneously restrict coverage. This creates a growing misalignment between regulatory expectations and insurable risk.

While an affirmative AI insurance market is beginning to emerge, it remains nascent, complex, and governance-intensive.

AI is not uninsurable—but insurability now depends on proactive risk management. Firms must map AI use cases, reassess policy coverage, and treat governance as both a regulatory and insurance requirement.

The gap between AI adoption and insurance alignment is widening—but those who act early will be best positioned to close it.

Download the Full Report

For businesses operating across Asia, particularly those in technology-forward sectors, this dual reality has direct consequences for how risk gets managed, priced, and transferred. The operational benefits are real. So are the liabilities. Neither side can be ignored.

How AI Is Improving Insurance Operations

The efficiency gains AI brings to insurance are substantial and already reshaping the competitive landscape. Underwriters now process decisions in minutes rather than days. Routine claims move through triage, assessment, and settlement with far less human involvement than before.

For businesses seeking coverage in fast-moving sectors like technology and Web3, that speed matters. Policy binding that once took weeks now takes hours in many cases. Risk modelling updates in real time as new data arrives. Operational costs fall across the value chain, which gives carriers room to sharpen pricing and brokers room to offer more responsive service.

Fraud detection is where the gains are perhaps most striking. Traditional detection relied on experienced adjusters identifying anomalies in claim documentation. That approach was slow, inconsistent, and straightforward for sophisticated fraudsters to defeat.

AI systems trained on millions of historical claims now spot patterns no human investigator could catch at scale. Correlations between claim timing, policyholder behaviour, geographic data, and external sources combine to flag suspicious activity before payments go out. Detection happens earlier, more consistently, and at a fraction of the previous cost. For businesses with clean claims histories, a healthier market means more accurate pricing of legitimate risk.

The AI Insurance Risk That Most Businesses Overlook

The same AI capabilities driving those gains are also introducing risks that most businesses have not yet factored into their thinking.

The most significant is concentration risk. When a large proportion of insurers rely on the same AI models, or models trained on the same datasets, their decisions converge. Underwriters approve the same risks. Algorithms decline the same clients. Systems break down in the same ways under the same conditions.

Diversification, the quality that makes insurance markets resilient, quietly disappears when underlying judgment becomes homogeneous. This dynamic follows the same logic that produced correlated losses across financial institutions in 2008. Homogeneous judgment amplifies systemic shocks rather than absorbing them. A single model failure or a coordinated adversarial attack on a widely used AI system could affect claims-paying capacity across multiple carriers simultaneously.

Explainability is another growing pressure point. Regulators across Asia, including the Monetary Authority of Singapore and the Insurance Authority in Hong Kong, are increasing scrutiny on automated decision-making. A carrier whose model denies a claim without adequate explanation faces real legal and reputational exposure. That exposure does not stay with the insurer alone. It affects policyholders too.

Adversarial fraud adds a further layer of AI insurance risk. Better detection tools and better deception tools are advancing in parallel. Generative AI has made it cheaper to fabricate documentation, synthetic identities, and convincing claim narratives. Assuming the fraud problem is solved because detection has improved is a mistake.

What This Means for Your Business

Standard commercial policies were designed before AI became a core operational dependency. Businesses that now rely on automated systems, data pipelines, or AI-driven decision-making carry exposures those policies never anticipated. Model failure, algorithmic bias claims, and liability arising from automated decisions all represent coverage gaps that remain common across the market.

Your underwriting experience is also changing as carriers adopt AI themselves. Pricing moves faster. Declines arrive with less explanation. Knowing how your insurer assesses your risk, and whether that assessment accurately reflects your actual exposure, is worth understanding before a claim arises.

Systemic concentration risk affects your business even if your own operations are straightforward. A correlated failure across multiple carriers puts pressure on the entire market’s ability to honour claims. Advisors who understand market structure, not just policy wording, become significantly more valuable in that environment.

Managing AI Insurance Risk in Asia

At Continuum, we work with companies navigating exactly this complexity. The intersection of AI and insurance is no longer a niche concern. Across Asia’s technology economy, managing AI insurance risk has become a core part of sound business strategy.

The risks AI creates are insurable. Getting there requires correctly identifying exposures, describing them accurately, and placing coverage with carriers who have both the appetite and the expertise to underwrite them. Businesses that treat insurance as a strategic function, rather than a compliance obligation, are far better positioned to do that.

AI is a powerful operational tool. It is also a growing source of liability. The businesses that manage both sides of that reality will be better prepared than those that only see one.

Most technology companies assume their Professional Indemnity (PI) and Cyber insurance policies cover them. They pay the premiums, tick the compliance boxes, and file the paperwork. What many never do, however, is check how their insurer now defines “AI-related activity.” That definition quietly reshapes what the policy covers when a claim arrives.

Over the past 18 months, insurers have accelerated the introduction of AI-specific exclusions across both PI and Cyber policy wordings. Some changes are explicit. Many, though, are not. The result is a growing gap between what businesses expect their policy to cover and what it will actually pay out on.

The silent AI exposure problem

The term “silent AI exposure” describes AI-related liability that a policy neither covers nor excludes. Historically, this ambiguity worked in the insured’s favour, because insurers tended to read general policy language broadly. That era is ending.

Today, insurers recognise how deeply AI activity sits inside standard software products. Consider the range of exposure: a coding assistant that introduces a vulnerability, a customer-facing chatbot that delivers legally actionable advice, or a fraud-detection model that produces biased outcomes. Each can generate a PI or Cyber claim. Yet each sits in a grey zone unless the policy wording addresses them directly.

The lesson here is not that firms should avoid AI tools. Rather, the moment AI generates a professional output a client relies on, the firm has likely assumed liability, whether its policy reflects that or not.

Copyright carve-outs: the exclusion that’s growing fast

Generative AI has introduced a category of IP risk that traditional PI policies never anticipated: the inadvertent reproduction of copyrighted material. In response, insurers now add copyright carve-outs to many policy wordings. These vary enormously in scope, and most policyholders never notice them until a claim arrives.

Some carve-outs apply only to deliberate reproduction. Others, however, exclude any claim that involves AI-generated content, regardless of intent or the firm’s level of control over the model. As a result, a media company, a marketing agency, or any firm producing AI-assisted content at scale could find its entire content liability exposure sitting outside its policy.

The deeper problem is that most firms using generative AI tools have little visibility into what data those models trained on. Consequently, the trigger for an exclusion can be entirely outside the firm’s control.

Model training data disputes: an emerging battleground

A newer category of exclusion now appears in more sophisticated policy wordings. These provisions carve out claims that arise from training data disputes, including data privacy violations, consent failures, and the unlicensed use of personal or proprietary data in AI development.

This matters because training data liability is no longer theoretical. Litigation is active across multiple jurisdictions, and regulators are building enforcement capacity. Firms that develop proprietary AI models, or that rely on third-party models with unclear training data provenance, carry an exposure that most Cyber policies simply did not account for.

The boundary between a “data breach” and a “training data dispute” is now one of the most contested areas in AI coverage. Firms should not assume existing Cyber protections extend to cover it.

What brokers and risk managers should do now

The bottom line

The insurance market is not anti-AI. Insurers want to cover viable businesses, and viable businesses now run on AI. Even so, the market is actively repricing AI-related risk, and the main mechanism for that repricing is exclusion clauses and narrowed definitions that most policyholders have not yet noticed.

The firms most at risk are those that enthusiastically adopt AI tools while leaving their insurance programmes on autopilot. The coverage gap rarely appears all at once. Instead, it builds slowly, renewal by renewal, endorsement by endorsement, until a claim arrives and the policy reads differently from what the firm expected.

In the AI era, reading the policy carefully is no longer optional. It is the first act of risk management.

For founders, this is progress. Clear rules create legitimacy and attract institutional capital.

But as regulatory frameworks mature, another reality becomes unavoidable. Regulation does not only define how a digital asset business must operate. It defines the benchmark against which leadership will be judged when losses occur.

That is where regulatory oversight turns into liability exposure.

The JPEX Example: From Licensing Issue to Investor Fallout

The JPEX case in Hong Kong illustrates how quickly this shift can happen.

In 2023, the Securities and Futures Commission issued a public warning that JPEX was not licensed under Hong Kong’s virtual asset regime. Shortly afterwards, the Hong Kong Police Force launched a major investigation following investor complaints. Reported losses exceeded HKD 1 billion.

Initially, the issue centred on licensing status. It then evolved into allegations relating to marketing representations, withdrawal restrictions and the safeguarding of client assets. Arrests followed. Assets were frozen. Civil claims and recovery efforts developed alongside the regulatory process.

The regulatory question was whether the platform complied with Hong Kong’s framework.

The liability question was who bore responsibility for investor losses.

Those are not the same inquiry.

Where Exposure Commonly Arises

Across Asia’s digital asset regimes, three areas consistently create pressure points.

Custody and segregation.

Regulators now require clearer separation of client assets and stronger safeguarding controls. If access to assets is disrupted or internal controls fail, the issue quickly moves beyond regulatory breach and into allegations of inadequate oversight by directors.

Disclosure and marketing.

Digital asset businesses often promote security, institutional-grade infrastructure or robust risk management. If those representations are later challenged, investors may argue that they relied on misleading statements, even if no formal regulatory breach is established.

Governance and fit and proper standards.

As regulators assess the competence and integrity of key individuals, personal accountability becomes embedded in the framework itself. When incidents occur, board minutes, internal controls and decision-making processes are examined in detail. Directors are frequently named personally in proceedings.

In each case, compliance may be reviewed by regulators, but financial responsibility is pursued through civil channels.

The Financial Reality Behind Enforcement

Even if allegations are defensible, responding to investigations and claims is expensive. Legal representation, cross-border coordination and forensic reviews can run for months or years. For digital asset founders who built technology platforms rather than regulated financial institutions, this layer of exposure is often underestimated.

Regulation establishes standards. It does not fund defence costs or protect personal assets.

How Insurance Actually Responds in These Scenarios

When a digital asset firm faces regulatory scrutiny and investor claims at the same time, different insurance products respond to different parts of the exposure.

1. Directors & Officers Liability Insurance (D&O)

If directors or senior management are named in civil proceedings or regulatory investigations alleging wrongful acts in their managerial capacity, D&O typically responds to:

• Defence costs for regulatory investigations

• Legal expenses in civil claims alleging mismanagement or breach of duty

• Settlements or judgments where insurable

In cases similar to the JPEX investigation, where enforcement action and investor recovery efforts develop simultaneously, D&O becomes critical because individuals are often named personally.

2. Professional Indemnity (Errors & Omissions)

Where claims arise from alleged misrepresentation, inadequate disclosure, or failures in services provided such as custody, staking, or tokenisation, Professional Indemnity cover may respond.

This is particularly relevant where investors argue that they relied on marketing statements or risk disclosures that did not accurately reflect operational risk.

3. Crime and Custody-Related Cover

If losses arise from internal fraud, asset misappropriation or certain operational failures involving client assets, Crime or custody-related policies may be triggered, depending on structure and wording.

Each policy addresses a different part of the financial consequence. Regulation creates the standard. Insurance determines how the financial impact is absorbed.

How Continuum Supports Digital Asset Firms

At Continuum, we advise financial institutions including exchanges, custodians, funds and technology platforms operating across Asia’s evolving regulatory landscape. Our focus is on identifying where regulatory obligations translate into liability exposure and structuring Directors and Officers, Professional Indemnity and related cover accordingly.

We work alongside management teams to ensure that insurance programmes reflect real enforcement trends and investor behaviour, not just theoretical risk.

If you are reassessing your risk framework in light of tightening digital asset regulation in Hong Kong, Singapore or elsewhere in Asia, we would be pleased to discuss how your current arrangements respond to both regulatory scrutiny and civil liability exposure.

A New Risk Landscape Emerges

Three forces are reshaping professional services risks across Asia: ESG expectations, AI-enabled workflows, and accelerating regulatory change.

ESG Expectations Are Rising Across All Sectors

Environmental, social, and governance scrutiny has shifted from investor reports into daily operations. Firms must demonstrate responsible data handling, ethical advisory processes, transparent governance structures, and sustainable operations. This matters even more for practices advising high-growth sectors, where ESG-linked risk often influences partner and client selection.

AI Tools Are Redefining Workflows and Risk Exposure

AI is becoming foundational to legal research, document review, financial modeling, and workflow automation. These tools improve efficiency but introduce new categories of professional services risks. Data provenance, confidentiality exposures, model bias, and third-party dependencies can all create grounds for disputes or regulatory challenges. Firms adopting AI must reassess governance controls and coverage structures to avoid unmanaged exposure.

Regulation Continues to Tighten in Asia’s Fastest-Moving Sectors

Fintech, digital assets, payments, corporate governance, and data protection frameworks continue to evolve quickly. Professional advisors supporting these sectors face heightened exposure, particularly when guidance intersects with shifting compliance requirements. A single oversight or outdated interpretation can escalate into a claim with financial and reputational impact.

Resilience Is Now a Competitive Advantage

Firms that integrate risk resilience into internal controls, advisory frameworks, and insurance planning gain a clear competitive edge. Coverage is no longer a contractual formality. It supports governance credibility, reinforces institutional partnerships, and signals readiness to clients operating in high-pressure environments.

This is where forward-thinking risk transfer becomes essential.

How Continuum Helps Firms Stay Future-Ready|

Continuum supports professional services across Asia by aligning Professional Indemnity, Cyber Insurance, and emerging technology coverage with the realities of modern advisory work. Our approach addresses ESG-linked issues, AI-driven workflows, and sector-specific regulatory risks. Firms advising high-growth industries rely on protection that adapts at the same pace as their clients.

Strengthen your coverage posture and reduce exposure across your advisory operations. Contact Continuum to review the risks shaping your practice and ensure your protection remains future-ready.

When a vendor fails — whether due to cyber breach, operational error, or compliance lapse — the fallout rarely stops with them. Regulatory scrutiny, customer backlash, and financial loss often lands squarely on the institution that outsourced the service. This is the essence of third-party risk: even when you don’t directly cause the harm, you still bear the responsibility.

Real-World Impact: When Vendors Slip, Institutions Pay

Case 1: Wirecard Scandal and Compliance Fallout in Singapore

In 2023, the Monetary Authority of Singapore (MAS) imposed fines totaling S$3.8 million on Citibank, DBS Bank, OCBC, and Swiss Life due to inadequate AML/CFT controls in transactions linked to Wirecard-related entities. While the misconduct originated with Wirecard, financial institutions were held accountable for their insufficient oversight.

Key Lesson: Regulatory fines and compliance failures can trigger direct financial losses, even when the root issue lies with an external partner.

Case 2: Accellion Vulnerabilities and the Singtel Fallout

In late 2020 and early 2021, software vulnerabilities in Accellion’s File Transfer Appliance (FTA) triggered a series of data breaches affecting multiple organizations—including Singapore’s telecommunications giant, Singtel. The breach exposed personal data of approximately 129,000 customers, leading to regulatory concern and reputational impact. In the broader fallout, Accellion paid $8.1 million to settle class-action lawsuits brought by affected institutions globally.

Key Lesson: When third-party software fails, financial institutions can face dual exposure—from both direct remediation costs (legal, technical, reputational) and external legal actions. Vendor risk, if unmitigated, can escalate into multimillion-dollar liabilities.

From venture capital firms to private equity funds and asset managers, the risks are not just reputational. They’re legal, financial, and systemic. Yet, many firms still operate with outdated governance frameworks and insurance programs that fall dangerously short of real-world exposure. To mitigate governance failures at financial institutions, a tailored risk and insurance strategy is essential.

The High Stakes of Governance Missteps

Financial institutions manage billions in assets, investor trust, and systemic responsibility. A single lapse in governance—be it undisclosed conflicts of interest, failed fiduciary oversight, or executive misconduct—can trigger investor lawsuits, regulatory action, and irreversible damage to market credibility.

Recent cases across APAC and beyond have revealed a troubling pattern: governance gaps are often not due to a lack of rules but a failure to anticipate how emerging risks—digital infrastructure, cross-border operations, decentralized investment models—interact with old playbooks.

Common Policy Gaps

1. Directors & Officers (D&O) Insurance Misalignment

   Many financial institutions carry D&O policies that were designed years ago, with little adjustment for today’s realities. Cross-jurisdictional risks, ESG-related litigation, and investor activism demand bespoke protection that reflects the institution’s risk profile—not boilerplate coverage.

2. Professional Indemnity (PI) Exclusions

   Errors in financial advice, misrepresentation, or operational failure can all trigger client lawsuits. Yet many PI policies include narrow definitions or outdated exclusions that fail to reflect the institution’s current service offerings, especially in digital asset or algorithm-based models.

3. Cyber & Operational Risk Blind Spots

   Increasing reliance on cloud infrastructure, third-party vendors, and digital platforms means institutions are only as secure as their weakest link. But few align cyber insurance with their actual tech exposure—leaving critical systems uninsured or underinsured.

4. Lack of Crime & Fidelity Coverage

   Internal fraud, rogue employees, and vendor collusion continue to represent substantial threats—particularly in firms with decentralized teams or rapid deal flow. Crime insurance is often treated as an afterthought despite its relevance in both front-office and back-office operations.

Real-World Example: Internal Governance Failures at Saigon Joint Stock Commercial Bank 

Between 2012 and 2022, Saigon Joint Stock Commercial Bank (SCB) in Vietnam became the epicenter of one of Southeast Asia’s most significant financial scandals, primarily due to internal governance failures. Truong My Lan, a prominent real estate tycoon, clandestinely gained control over SCB through a network of proxies and shell companies. Over this period, she orchestrated the embezzlement of approximately $12.5 billion from the bank by approving over 2,500 fraudulent loans to entities under her control. 

This massive internal fraud was facilitated by a lack of effective oversight within SCB. Key executives and board members failed to implement robust risk management practices, allowing Lan to manipulate the bank’s operations extensively. The bank’s internal audit and compliance mechanisms were either ineffective or complicit, failing to detect or report the irregularities over a decade.

The consequences were severe: SCB faced a liquidity crisis, leading to a loss of customer confidence and significant financial instability. The scandal not only tarnished the bank’s reputation but also raised concerns about the robustness of internal governance frameworks within financial institutions in the region.

This case underscores the critical importance of strong internal governance structures, including independent oversight, effective risk management, and a culture of accountability, to prevent such catastrophic failures.

The Continuum Approach

At Continuum, we work with financial institutions to close these policy gaps—before they become liabilities.

Our approach includes:

• Crime Insurance that aligns with operational infrastructure and addresses insider threats.

• D&O Coverage that reflects current regulatory realities, shareholder activism trends, and global exposures.

• Modernized PI Policies tailored for firms offering complex or cross-border financial services.

• Cyber Insurance that aligns with the use of third-party vendors and decentralised IT operations to address unknown external and threats.

We believe risk management should evolve with innovation. Because in a fast-moving financial landscape, governance isn’t just about compliance—it’s about resilience.