What Is Commercial Crime Insurance? Fidelity Bonds and Employee Theft Explained

Commercial crime insurance pays for money, securities, and other property stolen from your business, whether the thief is your own bookkeeper or an outside fraudster. The standard ISO policy offers eight insuring agreements, and the first of them, called Fidelity, is the modern form of the fidelity bond: it covers employee theft, ERISA plan official dishonesty, and employee theft of clients' property. You pick only the agreements you want, and each one gets its own limit and deductible on the declarations page.

Theft by insiders is the loss most businesses never see coming, and it is exactly the loss that general liability and property policies exclude.

What does commercial crime insurance cover?

The current commercial crime ISO program has eight types of losses that are covered by commercial crime insurance and those losses can be purchased as either a "Discovery" version (CR 00 20 06 22) or as a "Loss Sustained" version (CR 00 21 06 22) on the Commercial Crime Coverage Form. By default carriers will issue a loss sustained form on all standard placed business and a discovery form will require you to request. When purchasing the agreements, you select which ones you want to purchase. The Declarations will display a per occurrence limit and deductible for each agreement you chose to purchase. Fidelity is essentially three agreements in one: Employee Theft, ERISA plan official dishonesty, and employee theft of clients' property. The other agreements address theft from an outside source both at your premises and away from them. Fraudulent impersonation is not one of the eight base agreements but rather fraudulently impersonated coverage is added via endorsement and sublimited.

The eight base agreements that are offered in commercial crime coverage can be sorted into two categories based upon who is doing the taking and how much will be paid when an insured suffers a loss under each of these insuring agreements:

Fidelity agreements bundle every act by one employee, or one scheme by several in collusion, into a single occurrence subject to one limit. Two clerks who conspire to steal $50,000 from a policy with a $25,000 Employee Theft limit recover $25,000, not $50,000. And if the only evidence of theft is an inventory or profit and loss computation, there is no coverage. That inventory-shortage rule drives more claim disputes than any other condition in the form.

What is a fidelity bond?

A fidelity bond is coverage that reimburses an employer for theft or dishonesty committed by its own employees. The name survives from an era when this protection was written as a bond guaranteeing an individual's honesty, but today it is almost always issued as insurance, either as the Fidelity insuring agreement of a commercial crime policy or as a standalone employee dishonesty policy. Unlike a surety bond, which involves three parties and lets the surety recover from the principal, a fidelity bond is a two-party contract between insurer and employer, and the employee whose theft triggers the claim has no rights under it. If someone quotes you employee dishonesty insurance, a fidelity bond, or Employee Theft coverage, they are describing the same protection under three names.

Employee Theft of Clients' Property extends the coverage to property your employees steal from customers, though the claim must be presented by your business as the named insured, never by the client directly. One design choice deserves a hard position. The unendorsed form pays even when you cannot identify which employee stole, which matters because embezzlers hide well. The Employee Theft Name or Position Schedule endorsement (CR 04 08 06 22) trades that away, covering only named individuals or scheduled positions. For nearly every buyer, blanket coverage is worth the extra premium and the schedule endorsement is a false economy.

What is an ERISA bond and how much coverage is required?

ERISA requires anyone who handles the money in an employee benefit plan, such as a 401(k) or pension, to carry a bond equal to at least 10% of the funds that person handled the year before, with a $1,000 floor. The most any plan must carry is $500,000, which rises to $1,000,000 for plans holding employer securities. Those figures come from Section 412 of ERISA as read by the U.S. Department of Labor in Field Assistance Bulletin 2008-04, still the governing guidance.^[1] This bond protects the plan, not the company. The employer cannot collect a dime under it, and carrying it is not optional. Plans report the bond amount on the Form 5500, and a missing or inadequate bond is one of the most common audit flags the Department of Labor pursues.

DOL guidance prohibits any deductible on the required ERISA portion of the bond, which is why the deductible section of the ISO crime program's crime declarations clearly states N/A for ERISA Plan Official Dishonesty.^[2] DOL rules also require that the bond be issued by an insurer (surety) named on the Treasury Department's Listing of Approved Sureties, Circular 570.^[3] This coverage is provided under the ERISA Plan Official Dishonesty agreement which provides coverage to all plan officials, regardless of whether they are specifically identified, for fraudulent or dishonest acts, including those committed by a sole proprietor insured who steals from their own company's plan.

What is the difference between the loss sustained and discovery forms?

The loss sustained form and the discovery form provide the same coverages with different triggers. Under the Loss Sustained Form (CR 00 21 06 22), the theft must take place during the policy period and be discovered during the policy period or the extended discovery period, which runs 60 days after cancellation, or one year for an ERISA plan. Under the Discovery Form (CR 00 20 06 22), the theft can take place at any time, including years before the policy existed, so long as it is discovered during the policy period.

Discovery means more than suspicion: a designated person must learn facts that would cause a reasonable person to believe a covered loss occurred. The trigger difference is everything for embezzlement, which often runs for years before surfacing. The ACFE's 2024 Report to the Nations puts the median occupational fraud at 12 months from start to detection, and the longest-running schemes are the costliest ones.^[4] That median should also size your Employee Theft limit. Think about the largest checks your controller can sign and the wires your office manager can release, then multiply by a year of nobody looking. That is the floor.

Is crime insurance the same as cyber insurance?

Crime Insurance & Cyber Insurance intersect in just 1 area. Companies need both. The Crime Policy's Computer Fraud and Funds Transfer Fraud agreements cover a Hacker who steals funds from your company via hacking or sends fraudulent Bank Wire Transfer instructions in your name. Fraudulent impersonation is covered under a separate add-on endorsement (not part of the standard agreement) and represents the Social Engineering Loss to occur when an employee of yours is duped into sending money based upon some vendor/executive being posed as them. Be aware carriers will routinely sub-limit this section to well below the overall amount of your crime limits so review your declaration page prior to assuming all available limits apply.

What the crime policy never pays are breach costs. Forensics, customer notification, credit monitoring, ransomware response, and lost income while systems are down all live in a cyber insurance policy. The crime forms replace the stolen funds themselves, and everything spent responding to the incident is a cyber claim. Fraudulent Impersonation also carries a verification condition: you must confirm any change-of-account request or transfer instruction through a method other than email, a callback or text to the apparent sender, and document that verification before the money moves. An accounts payable clerk who wires $80,000 on a convincing email alone has likely failed the condition.

This guide is for educational purposes and summarizes standard ISO policy language. Your policy's specific terms, conditions, and endorsements control. Talk to a licensed broker about your actual exposures.

The Bottom Line

Commercial crime insurance replaces money and property stolen by your own employees or by outsiders, a loss your general liability and property policies exclude. Buy the insuring agreements you actually need, size the Employee Theft limit to a full year of what one trusted person can move, and confirm whether you hold a discovery or loss sustained form. Pull your declarations and check the deductible, sublimits, and form date against those exposures.