For Hong Kong virtual asset intermediaries
Professional Indemnity, Directors & Officers, Crime and Cyber in one policy, built around how VA dealers, advisers and managers actually operate.
One policy
One renewal · one claims process
Professional IndemnityClaims made
Execution errors · AI-assisted services
Directors & OfficersClaims made
Cyber oversight claims after a hack · optional Side A
CrimeDiscovered
Fraudulent withdrawals from Scheduled VATPs · deepfakes
CyberDiscovered / claims made
Hosted & cloud system breaches
Separate limits as standard, so a theft doesn't reduce your D&O limit.
5+
410+
70+
80%
The threat in numbers
Standard PI, D&O, Crime and Cyber policies were not built around VA dealing, and many exclude these losses.
+55%
rise in value stolen in crypto hacks from 2024 to 2025
44%
of value stolen in 2024 came from compromised private keys
HK$200m
lost by one Hong Kong office to a deepfake video call in 2024
Source: Chainalysis Crypto Crime Reports
Attackers target the VATP accounts dealers trade through, not just wallets.
AI-generated voices and video now impersonate clients, counterparties and colleagues.
A routing bug or faulty algorithm can mis-execute client orders at scale.
Directors and responsible officers answer to the SFC for controls and client assets.
The package
Buy one Section or combine all four. Each has its own limit and retention, with optional extensions.
Claims made
Client claims for errors in dealing, advice and portfolio management, with defence costs and settlements.
Built for VA: client claims when routing, execution or AI tools mishandle orders.*
Claims made
Personal protection for directors, officers and responsible officers, plus company reimbursement and securities claims.
Built for VA: defence costs and cyber oversight claims after a hack.
Discovered
Theft by employees or outsiders and fraudulent transfers of money and digital assets.
Built for VA: fraudulent withdrawals from your own and omnibus accounts at your listed VATPs.
Discovered / claims made
Incident response, business interruption, data recovery, extortion and privacy liability.
Built for VA: liability for breaches of your contracted hosted and cloud systems, excluding systemic events.
* Optional extension, where purchased. Subject to policy terms.
What makes it different
Fraudulent withdrawals from your own and omnibus client accounts at your listed VATPs, including instructions sent with stolen logins or API keys.
Transfers made after AI-generated voice, video or messages impersonate someone you trust, including spoofed biometrics.*
Optional extension for client claims when routing, execution or AI tools mis-handle orders, normally excluded as “technology failure”.
Client claims from errors in AI-generated output.*
After a hack, D&O still covers defence costs and claims over how directors oversaw cyber security. Optional Dedicated Side A limit.
Option to buy extended reporting for PI and D&O if you stop VA dealing or your licence is refused or revoked.
* Optional extension, where purchased. Subject to policy terms.
Built around how you operate
Your clients
Place orders with you
You, the VA dealer
Hold VATP logins and API keys
Licensed VATP
Holds the assets and executes
Covered
Fraudulent withdrawals from your Scheduled VATP accounts, own or omnibus, including through API instructions.
Covered
Costs to revoke and reissue compromised logins and API keys and re-secure your accounts.*
* Optional extension, where purchased. Subject to policy terms.
Coverage map
Each Section pays the loss it covers. If one event triggers several Sections, nothing is paid twice and only the highest retention applies.
7 scenarios
Stolen API key used to withdraw from your listed VATP accounts
Deepfaked counterparty asks you to pre-fund a trade*
Clients sue after a covered theft (defence costs only)*
Routing bug executes orders at the wrong price*
Shareholders sue directors over security after a hack
Ransomware locks your trading systems
Clients claim after data is stolen from your cloud provider
* Optional extension, where purchased. Subject to policy terms.
Real incidents
AlertHong Kong · 2024
HK$200m
A finance employee joined a video call where the CFO and colleagues were all AI-generated, then made 15 transfers to five accounts.
Crime · Social Engineering
Transfers induced by synthetic media impersonation are covered under the Social Engineering Extension, where purchased.
AlertGlobal · 2022
~100,000
Keys connecting trading tools to exchange accounts were leaked, and used to trade without consent and the funds were subsequently withdrawn.
Crime · Funds Transfer Fraud
For your own VATP accounts: fraudulent instructions sent with stolen keys, plus the cost of reissuing them.
AlertHong Kong · 2025
¥1bn
Two staff of a crypto and luxury goods firm were ambushed in Sheung Wan carrying about HK$50m in yen to an exchange shop.
Crime · Transit
Money stolen while carried by your employees is covered where Transit cover is purchased.
AlertUS · 2025
$180–400m
Attackers bribed outsourced support staff to take customer data, then demanded US$20m. The exchange refused and offered a reward instead.
Cyber
Incident response, extortion costs, criminal reward payments and privacy liability claims.
AlertUS · 2012
45 min
A faulty deployment sent millions of erroneous orders and cost the broker about US$440m before it was stopped.
PI · Execution and Systems Error
Client claims for mis-executed orders are covered under the Execution and Systems Error Extension, where purchased. The firm’s own trading loss would not be.
AlertUS · 2023
CISO
A regulator charged a company and its security chief personally over cyber disclosures. Most claims were dismissed in 2024, after months of defence.
D&O
Defence costs and regulator claims about cyber governance are carved back into cover.
Based on public reports. How the policy would respond is illustrative only; every claim is assessed on its facts and the policy terms.
Built your way
Each Section has its own limit, or share one aggregate.
Strong controls keep you on the standard retention.
Extra personal protection for directors, outside all limits.
Extended reporting options by Section.
Proposal
One form for all four Sections.
Review
We assess your VATP, cyber and AI controls.
Terms
Limits and retentions set to your exposure.
Issue
Policy issued and claims contact set up.
Controls that earn better terms:
Main exclusions only. The policy wording sets out the full terms.
FAQ
Can’t see yours? Our team can walk you through the wording clause by clause.
No. You can buy any one Section or any combination. The definitions and general conditions apply to whichever Sections you buy.
Many standard wordings exclude the losses VA dealers most often face: transfers made with stolen VATP logins or API keys, deepfake instructions, execution and algorithm errors, and directors’ liability after a cyber incident. This policy addresses each of these directly.
Yes, for services you are legally permitted to perform at the time. A service is not excluded merely because your licence application is pending. If the application is refused, you can buy an Extended Reporting Period for PI and D&O.
No. With the AI-Assisted Professional Services Extension, no PI exclusion applies just because AI contributed to an error. For high-risk AI uses, a higher retention applies unless you had and followed a documented AI governance framework.
Yes, where you hold them in an account you maintain at a VATP listed in the Schedule and you are legally liable or contractually responsible for them.
Yes, under the Social Engineering Extension, including instructions using AI-generated voice, video or messages. Verify instructions with an out-of-band call-back to known contact details; otherwise a higher retention applies.
Breaches of a VATP’s or custodian’s own systems are excluded. These are the platform’s responsibility and are typically handled through its compensation arrangements.
Email contact@oneinfinity.global with details of the claim or incident. PI and D&O claims must be notified no later than 30 days after the policy period ends; Crime and Cyber incidents within 30 days of discovery.
Send us your proposal form or book a call. We’ll review your VATP, cyber and AI controls and set terms to your exposure.
Notify a claim or incident
This page is a summary for information only and does not form part of any insurance contract. Cover is subject to the policy wording, Schedule, endorsements and underwriting acceptance. OneInfinity is a brand of OneDegree Hong Kong Limited, authorised and regulated by the Insurance Authority of Hong Kong.