Hunton Insurance Recovery Blog

Ruling on cross motions for summary judgment, a federal court in New York held that AIG Specialty Insurance Company (AIG) must cover the settlement of an underlying action against its insured, SS&C Technologies Holdings, Inc. (SS&C), who was duped by e-mail scammers to issue millions in wire transfers.  The court rejected AIG’s assertion that the loss resulted from SS&C’s exercise of authority or discretionary control of client funds where SS&C only had limited administrative authority and further held that, even if SS&C had exercised the requisite authority, the exclusion was ambiguous.  A copy of the court’s decision can be found here.

The case arose from a contract between SS&C and its client, Tillage Commodities Fund, L.P. (Tillage), in which SS&C agreed to provide certain business processing management services, including the administrative ability to operate certain of Tillage’s bank accounts and issue funds as instructed by Tillage.  Thus, when SS&C received requests to issue wire transfers from spoof e-mail domains purporting to be Tillage, SS&C did so to the tune of approximately $5.9 million.

Shortly after discovering the illicit scheme, SS&C notified AIG of the potential claim under its professional liability policy.  AIG immediately recognized its duty to defend any action Tillage might bring, but denied any indemnity obligation pursuant to the policy’s “Modified Investment Advisor Exclusion Endorsement” (the Exclusion).  The Exclusion precluded coverage for damages arising out of:

Loss in connection with a Claim made against [SS&C] alleging, arising out of, based upon or attributable to … the exercise of any authority or discretionary control by [SS&C] with respect to any client’s funds or accounts.  Provided, however, that this exclusion shall not apply to any Claim arising out of your performance of Professional Services.  Notwithstanding the foregoing sentence, it is expressly understood and agreed that there shall be no coverage for the monetary value of any funds lost due to [SS&C’s] exercise of such authority or discretionary control ….

(Emphasis added.)

Tillage eventually commenced a lawsuit against SS&C seeking no less than $10 million.  AIG paid for SS&C’s defense.  SS&C and Tillage ultimately reached a settlement and SS&C paid the agreed amount.  AIG refused to indemnify SS&C, maintaining that the Exclusion barred coverage.  SS&C filed suit against AIG alleging, among other things, breach of contract.

The dispute on the applicability of the Exclusion turned initially on whether the claim against SS&C arose from SS&C’s exercise of authority or discretionary control over Tillage’s funds or accounts.  The court held that the undisputed facts established that SS&C clearly did not have such authority or discretion over Tillage’s funds and accounts.  In fact, as the court noted, the contract between SS&C and Tillage expressly stated that management and control of the funds was vested exclusively with Tillage and that SS&C had no such control.  AIG argued that SS&C nonetheless had authority and discretionary control over Tillage’s funds because certain SS&C employees had administrative rights over the funds, such as the ability to sign checks, issue stop payment orders, withdraw funds, release a wire transfer, and determine whether withdrawal requests were appropriate or more information was needed.  The court found that AIG’s argument erroneously conflated SS&C’s administrative operation of the account, which was undisputed, with SS&C’s authority and discretionary control over the account.  Accordingly, the court concluded that the Exclusion did not preclude coverage for the settlement.

AIG also argued that the exclusion barred coverage because the funds were lost as a consequence of SS&C’s professional services.  As noted, the Exclusion also contained a carve-back for “any Claim arising out of [SS&C’s] performance of Professional Services” but specified that, “notwithstanding” the carve-back, there was no coverage for “funds lost” in the performance of Professional Services.  AIG argued that the funds were lost as a consequence of SS&C’s professional services; SS&C disagreed, contending that the funds were stolen, not lost.

SS&C pointed to dictionary definitions that indicated that the two concepts were distinct, while AIG relied on dictionary definitions that supported a view that the two concepts were not mutually exclusive and, broadly speaking, one and the same.  The court concluded that both definitions were plausible and, therefore, the term was ambiguous requiring construction in favor of coverage.  Thus, the court found that, even if SS&C had authority or discretionary control over Tillage’s funds, the Exclusion did not apply because the funds were not “lost.”

The SS&C decision is illustrative of the nuanced issues that are likely to impact claims involving social engineering losses.  Whether the claim involves the use of a computer system or, as in SS&C, the insured’s “discretionary control,” the specific language and variations in policy wording can have a material impact on the availability and extent of coverage for these and other types of losses.  It is important, therefore, that policyholders take the time to review their policies before a loss occurs, to ensure that their policy wording comports with their expectations for coverage.  And, in the unfortunate even that a loss occurs, policyholders should engage experienced coverage counsel to ensure a proper application of their policy wording and a fair adjustment of their claim.