At a notary's office two things come together that are separate elsewhere: other people's money in the client account and an archive of deeds you have to be able to produce for decades.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
The client account makes your office a payment institution in miniature. Around every transfer of property and mortgage redemption there are payment instructions with amounts worth a fraudster's while to read for weeks. The attack is therefore rarely noisy: no ransomware, but a silent break-in to a mailbox that waits until the moment of payment.
You are also under a duty of retention that no other service provider has in the same form. Your protocol, the register of deeds and the digital copies have to remain available and unaltered for decades. An environment that is encrypted or manipulated therefore affects not only your operations but your official duties, with supervision by the Bureau Financieel Toezicht (the Dutch financial supervision office for the legal professions) and the disciplinary tribunal in the background.
On the other side of the same transaction are the estate agent and the mortgage adviser; the supply chain risk is only covered once all three mailboxes are in order.
What does cyber insurance for civil-law notaries cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Client money is a separate discussion, not automatic cover
If money disappears from the client account through a forged or intercepted payment instruction, that is not a data loss but financial loss. On an ordinary cyber policy that does not fall under the cover. It requires a separate section for deception in payments, with its own requirements on two-person authorisation and on telephone verification of changed account numbers. Arrange this in advance and put the working arrangement in writing, because afterwards the question is always whether someone skipped the procedure.
The duty of retention makes irreparable loss more expensive than downtime
At most firms an incident costs time; at yours it costs evidence. Digital copies, scans and the register of deeds have to remain reconstructable, even if an attacker takes all the online back-ups with him. Insurers therefore ask about immutable copies or copies kept offline and about the last time you tested a restore. The costs of data recovery and reconstruction are a core part of the cover; having a deed executed again is not.
Disciplinary law and supervision fall outside the policy
If an incident leads to a complaint to the chamber for the notarial profession or to measures by the Bureau Financieel Toezicht, the policy can usually fund the legal assistance, but not the consequences. Disciplinary measures are personal and not insurable, and neither are administrative fines of a punitive nature. Intent and wilful recklessness also remain outside the cover under Article 7:952 of the Dutch Civil Code, including where an employee showed that recklessness.
A professional error in a deed is something other than an incident
If a deed contains the wrong plot number or a mortgage has not been discharged, that is an official error belonging with your professional indemnity insurance (BAV). The cyber policy only starts with a security incident: a mailbox read by others, encrypted systems, a breach of the file archive. Insurers exclude each other's territory, so when taking out cover have it expressly checked that the join between the two policies is watertight.
What does your premium depend on?
Volume of payments through the client account. The number and size of outgoing payment instructions determines how attractive your office is for payment fraud.
Two-person authorisation on payments. Whether a second person confirms every payment instruction and every change of account number weighs heavily in the assessment.
Set-up of the digital protocol and archive. How many years of deeds, scans and files are available digitally and how they are protected.
Immutable back-ups and recovery tested. Back-ups that cannot be deleted from the production environment, and a restore that has demonstrably been tested.
Number of staff with access to payment systems. The more hands on the payment module, the more accounts an attacker can try to take over.
Whether or not payment fraud is covered. This extension is assessed and covered separately, with its own conditions and its own limit.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Is money that disappears from the client account insured?
Not automatically. A standard cyber policy pays for investigation, recovery, notification costs and liability, but not for the amount siphoned off. For that there is a separate section for financial loss through deception, which insurers offer only where there is demonstrable two-person authorisation and telephone verification of account numbers. Have it quoted expressly; for a notary's office this is the scenario with the largest financial outlier.
What if an employee deliberately bypassed the payment procedure?
Fraud or wilful recklessness by your own employee does not fall under ordinary cyber cover. Insurers treat that as an integrity risk requiring separate fidelity insurance. You can be liable for unlawful acts of subordinates towards third parties under Article 6:170 DCC; whether that reaches the policy depends on whether a security incident lay behind it.
We keep deeds for decades. Does that count towards the premium?
Yes. The volume of data and the retention period are two of the most heavily weighted factors, because they determine how many people have to be informed after a breach and how much reconstruction work there is. What helps is demonstrable protection of the old archive and back-ups that an attacker cannot reach or delete from the working environment.
Do we also have to report an incident to the insurer ourselves?
Yes, and quickly. Article 7:941 DCC requires you to report the incident as soon as you become aware of it. With cyber losses that is not merely a formality: the insurer's reporting line sets the forensic specialists in motion, and traces in log files disappear within days. So do not wait until you know the extent; report first and gather the facts with them afterwards.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
