Cyber Insurance for Fiduciaries and Tax Advisors in Switzerland
Fiduciary firms manage bookkeeping, tax declarations, payroll processing and banking details for multiple businesses and individuals. A compromise can therefore affect the firm and several clients at the same time.
Why Fiduciary Firms Are Particularly Exposed
From a cybercriminal’s perspective, Swiss fiduciary firms are exceptionally lucrative targets because they aggregate the financial data of many clients in a single location. One successful breach can yield AHV (social security) numbers, bank account details, tax records and salary information — a treasure trove for identity theft and financial fraud.
Fiduciary firms often depend on specialist accounting and payroll software as well as email-based document exchange. Missing updates, broad access rights or weak verification of payment instructions can expose multiple clients at once.
Under the nFADP, a data security breach must be reported to the FDPIC as soon as possible when it is likely to result in a high risk to the personality or fundamental rights of affected people. Whether further duties or sanctions apply depends on the specific facts and requires legal assessment.
Tax filing and year-end periods can increase operational pressure when systems are unavailable. Continuity and recovery plans should account for these business-critical periods.
Hypothetical Loss Scenarios
The following examples are hypothetical scenarios, not documented claims. Actual impact depends on the systems, data, contractual duties and incident response capability involved.
- Ransomware During Tax Season
- Payment Instruction Manipulation (BEC)
- Mass Data Exfiltration
Coverage Components to Review
Available cover depends on the insurer, policy wording, exclusions, sub-limits and agreed security requirements. Only the specific quote and policy wording are binding.
- First-party losses — IT forensics, data recovery and reinstallation of accounting software (Abacus, Bexio, Sage)
- Business interruption — revenue loss during system outages, including seasonal peaks (tax period, year-end)
- Third-party liability — claims from clients for data loss, payment fraud or missed deadlines
- Cyber fraud / BEC — coverage for manipulated payment instructions and business email compromise
- Required communications — costs of legally required communication to affected people
- Regulatory defence — legal costs for FDPIC proceedings; fines only where legally insurable and expressly covered
- Crisis management — incident hotline, PR advisory and client communications
- Credit monitoring — monitoring services for individuals whose personal data was exposed
Compare Quotes and Policy Terms
A suitable solution depends on the organisation’s actual risk profile. BTAG can obtain current quotes and explain differences in cover, exclusions, deductibles and security requirements.
Compare quotes against your actual risks and the binding policy wording.