Employee theft coverage and fidelity bonds: what they cover and who needs one

A fidelity bond, or employee theft coverage written inside a crime policy, pays when someone on your payroll steals money, securities or property. Despite the name, the usual fidelity bond is not the three-party guarantee described in surety bonds explained: how they differ from insurance. It is a two-party contract that works like crime insurance. The one version you may be required to buy by law is the bond for a retirement or welfare plan under ERISA section 412.

Fidelity bond, crime policy, surety bond: sorting out the vocabulary

The words overlap in the market, and carriers use them differently, so read the form rather than the label. Conventionally, the products break down like this.

A true surety bond is different in kind: three parties, a guarantee of performance, and an indemnity agreement under which you repay the surety. A fidelity bond is a promise by the bonding company to the insured, and you generally do not sign an indemnity agreement to repay the bonding company.

Who counts as an "employee"

The employee definition decides most disputes. In the ISO commercial crime policy (June 2022 edition, CR 00 22 06 22 discovery form, as reproduced in an AmTrust specimen.pdf)), an employee is a person you pay directly by salary, wages or commissions and have the right to direct and control. The definition adds temporary workers who fill in for a permanent employee on leave or cover seasonal or short-term workload, workers leased from a labor leasing firm under a written agreement, guest students and interns, former employees retained as consultants, and directors or managers while acting as employees. A person remains an employee for 30 days after leaving, unless service ended because of theft or dishonesty.

The same definition excludes any agent, broker, factor, commission merchant, consignee or independent contractor. So the bookkeeper who is a 1099 contractor, the freelance buyer and the outside collections agent are not covered by standard employee theft. If you rely on contractors who touch money, ask for an endorsement or a separate third-party bond.

Client property and the business services bond

If your people work in other people's buildings, your customers will ask for protection against your employees stealing from them. The ISO policy answers with the insuring agreement for employee theft of clients' property. Three features are worth knowing before you sign a contract that requires it:

1. It pays only when the theft is by an identified employee. Missing stock with no named suspect does not qualify.
2. It reaches "clients," meaning people you serve for a fee or under a written agreement.
3. The policy is for your benefit only. The client has no direct rights under it, and you must present the claim. Contracts that want the client paid directly ask for a loss payee endorsement or a stand-alone bond, so clear this with your broker before a customer's insurance requirements arrive. Cleaning business insurance, Home health care insurance, Security guard company insurance and Staffing agency insurance meet this requirement most often.

The ERISA bond: the legal requirement

ERISA section 412 requires every person who handles funds or other property of an employee benefit plan to be bonded. The Department of Labor's Field Assistance Bulletin 2008-04 sets out the rules:

• Amount. At least 10% of the funds handled in the preceding year, with a minimum of $1,000 and a maximum of $500,000 ($1,000,000 for a plan holding employer securities).
• No deductible. The bond must cover the plan from the first dollar of loss, up to the required amount.
• Approved surety. The bond must come from a surety listed on Treasury's Circular 570 (updated August 1, 2026, per Treasury), or from Lloyd's underwriters under certain conditions.
• The plan must be named. The plan has to be specifically named or otherwise identified on the bond.
• One year to discover. A plan must have a one-year period after the bond ends to discover losses.
• Plan assets can pay. A plan may pay the premium for a compliant bond.
• Exemptions. Unfunded plans paid only from the employer's or union's general assets are generally exempt, as are qualifying banks, insurers and broker-dealers.

The bulletin also says a plan can be added to an existing employer bond or crime policy, possibly through an "ERISA rider," if the bond meets section 412. It calls a "knew or should have known" exclusion unacceptable, and says a bond that excludes the company owner does not protect the plan if that owner handles plan funds. For small employers this is the most common defect.

Form 5500 asks whether the plan was covered by a fidelity bond and whether it had a loss from fraud or dishonesty. A fiduciary liability policy cannot be reported as the bond, because it insures breaches of duty, not theft. The ERISA Advisory Council's November 2018 report cited EBSA's review of 2015 Form 5500 filings: of 140 plans reporting a fraud or dishonesty loss, 58 reported a loss larger than the bond amount, and only about two-thirds of small plans said they had a bond at all. See ERISA fidelity bonds vs fiduciary liability insurance, fiduciary liability insurance for employee benefit plans and form 5500 for health and welfare plans: who files and when.

Hypothetical example. A 40-person engineering firm sponsors a 401(k) plan that held $2.4 million at the start of the year, so the required bond is at least 10%, or $240,000. Its crime policy has a $100,000 employee theft limit and a $5,000 deductible, excludes owner theft, and does not name the plan. The owner-trustee approves the deposits. That policy does not satisfy section 412 on four counts: the amount, the deductible, the plan not being named and the owner exclusion. The fix is an ERISA insuring agreement or rider at $240,000 or more with no deductible, naming the plan, and no owner carve-out for a person who handles plan funds.

What to do when you find the theft

1. Notify the insurer as soon as possible. The ISO policy requires prompt notice, a sworn proof of loss within 120 days, records for examination and an examination under oath if asked.
2. Preserve everything. Bank statements, ledgers, access logs, emails. Do not repair the books before the accountant sees them.
3. Expect coverage to end for that person. Under the ISO wording, coverage terminates as to the employee as soon as a designated person or someone in HR, not in collusion, learns of the dishonesty. Remove access and change payment approvals the same day.
4. Do not impair recovery rights. Do not release the employee or settle with them without the insurer's agreement.
5. Mind the suit clause. The specimen requires suit to be brought within two years of discovery, subject to state law.
6. Call your attorney about employment, restitution and referral to law enforcement. Those decisions belong to you, not the insurer, and they affect the claim.

Choosing between a bond and a policy

For most operating businesses the question is academic: a crime policy's employee theft agreement, with a limit sized to your exposure, is the usual vehicle, and a bond form is used when a contract or plan rule names a bond. Check three items on either. First, the trigger: discovery or loss sustained, covered in commercial crime insurance: what it covers and what it excludes. Second, whether the limit applies per loss or per employee, since ISO's occurrence wording treats collusion among several employees as a single occurrence with one limit. Third, whether the person you worry about is actually an "employee" under the form.

Key takeaways

• A fidelity bond is a two-party, crime-insurance-style contract; it differs from a surety bond, where you repay the surety.
• "Employee" is defined narrowly: independent contractors, agents and brokers are generally outside standard employee theft coverage.
• Client-property coverage pays only for an identified employee's theft, and the client cannot claim directly.
• ERISA requires a bond for plan handlers: 10% of funds handled, $1,000 minimum, $500,000 maximum ($1 million with employer securities), no deductible, plan named.
• Coverage ends for an employee when a designated person learns of the dishonesty, so act on the same day.