Cyber Liability Insurance for Payment Processors and ISOs
Your binding security standard is not a statute, it is a contract with the card networks. Cyber Insurance Group has agents dedicated to cyber liability, comparing payments coverage across 12+ A-rated carriers.
Compare your payments business across 12+ A-rated carriers in about 4 minutes. Free, no obligation, and no need to know your limits in advance. We are an independent agency, so the recommendation is based on what covers your risk, not on one carrier’s product sheet.
Get My QuoteYou Hold a Portfolio of Other People’s Revenue
A processor or ISO sits between merchants and the card networks, holding the records that decide where money lands.
Settlement details
Merchant deposit accounts are changeable records in your system, and changing one is an ordinary support request until it is not.
Underwriting files
Merchant applications carry owner identity, financials and bank data, which is a complete package per business in your book.
Merchant incidents become yours
A compromise at a business you boarded pulls you into the investigation and often into the financial conversation.
Obligations by contract
Your security requirements arrive through network rules and acquirer agreements, so the consequences are commercial and negotiated rather than published.
Binding, But Not By Law
This is the structural difference between payments and every other financial sector on this site, and it changes what your policy needs to do.
What PCI DSS actually is
A standard written by the card networks and enforced through contract: your agreements with the networks, with acquirers and with the merchants you board. It is not a statute, and no government agency enforces it. Saying so plainly matters, because the mechanism of enforcement determines where the money comes from after a failure.
Why that changes the insurance question
Fines and assessments passed down the chain are contractual amounts. Many cyber wordings exclude contractual penalties as a class, which can leave the single most likely financial consequence in this sector uninsured unless PCI fines and assessments cover is specifically granted. Ask for that grant by name rather than assuming a general cyber policy reaches it.
And the merchant side is a separate conversation
What the current rules require of a merchant’s own payment page is covered on our e-commerce page, including the change most merchants get wrong. This page is the other side of that relationship: you are the party they are contracting with.
Who actually sets your rules
- Insurance agencies answer to your home state’s insurance commissioner, on a clock that changes when you cross a state line.
- Mortgage brokers and lenders answer to the FTC, which names mortgage brokers and mortgage lenders expressly in the rule.
- Payment processors and ISOs answer to the card networks, through contract rather than statute, which is a different kind of binding.
Why it changes the policy conversation
Three things to confirm before you compare premiums: whether PCI fines and assessments are covered, whether contractual liability is excluded, and whether the policy responds when the compromise happened at a merchant rather than at you. Our data breach response guide walks through the sequence.
Built for a Contractual Consequence
Fines and assessments
Where specifically granted, PCI fines and assessments cover answers the amounts passed down the chain after a compromise.
Merchant and consumer data
Breach response and third-party liability respond when merchant underwriting files or cardholder data are exposed.
Redirected settlements
Funds transfer fraud and social engineering cover answer deposit account changes made on fraudulent instruction.
Processing cannot stop
Business interruption and dependent business interruption respond when your platform or an upstream provider is unavailable.
Before You Decide
The objections we actually hear from business owners, answered straight.
Is PCI DSS actually a law?
No, and the distinction matters more than most people in payments admit. PCI DSS is a standard set by the card networks and enforced through your contracts with them and with acquirers. Non-compliance is a commercial and contractual consequence rather than a regulatory penalty. That makes it binding in a different way: there is no regulator to petition, and the remedy is applied by a counterparty.
What is actually at risk for a processor or ISO?
Your merchant portfolio, which is somebody else’s revenue. You hold merchant underwriting files, settlement bank details, transaction histories and in many arrangements the credentials to change where money lands. An attacker who reaches that does not need cardholder data to do serious harm.
Could someone redirect merchant settlements?
It is the characteristic fraud in this sector. Changing the deposit account on a merchant record is a routine support request, which is exactly why it is imitated. The merchant discovers it when a deposit does not arrive, by which time several settlement cycles may have gone elsewhere.
Who pays for fines and assessments after a breach?
It flows down the chain, and the contracts decide where it stops. Card networks assess acquirers, acquirers look to processors and ISOs, and everyone looks at the agreements. Whether your cyber policy includes PCI fines and assessments cover is therefore a specific question to ask, because a general cyber wording may exclude contractual penalties altogether.
Do we carry our merchants’ problems as well as our own?
Frequently. A compromise at a merchant you boarded becomes your investigation, your escalation to the acquirer and sometimes your financial exposure under the agreement, even where the failure was entirely on their side. The portfolio is an asset and a liability in the same breath.
What does cyber liability insurance not cover for a payment business?
It does not cover chargebacks, merchant credit losses or the cost of a portfolio you lose after an incident. It may exclude contractual penalties unless PCI fines and assessments cover is specifically granted. It covers the incident response, the data exposure, the liability claims and the interruption.
What Would Cyber Liability Insurance Cost Your Payments Business?
Pricing follows portfolio size, the data you hold on merchants, how settlement changes are verified, what your agreements expose you to, and the controls you can evidence. See the breakdown in our cost guide, or get a number for your business.
Compare 12+ A-rated carriers for your business
Free, no obligation, about 4 minutes.