Kidnap, ransom and extortion insurance

Kidnap, ransom and extortion (K&R) insurance pays the costs when an employee is kidnapped, detained or hijacked, or when a criminal threatens harm unless the company pays. The ransom is the smallest part of the cover for many buyers. What the policy mostly buys is a crisis response consultant on the phone within minutes, plus reimbursement of the many expenses that follow. Because of sanctions law and U.S. policy against paying hostage-takers, no policy promises that a ransom will be paid.

What the policy covers

K&R forms are written by specialty underwriters on the carrier's own wording, so there is no standard ISO form. The insurers that publish product pages describe a similar set of events and expenses.

Events. Chubb's primary K&R page lists kidnapping, express kidnapping, extortion, wrongful detention, disappearance, hijacking and hostage crisis. AIG's CrisiSolution lists kidnap and ransom, extortion, wrongful detention and hijacking, with extensions that can include threat, disappearance, child abduction, evacuation and repatriation, and express kidnapping. Tokio Marine HCC, part of Tokio Marine, adds virtual kidnapping, in which a caller falsely claims to hold a family member.

Losses. Typical heads of cover, as the carriers describe them:

• Ransom or extortion payment, which Chubb says can be paid in money, cryptocurrency or property.
• Loss in transit of the money on its way to the kidnappers.
• Crisis consultant and incident expenses, including negotiators, security, travel, legal and public relations costs.
• Medical, psychological and accidental death or injury benefits, and in some forms lost salary and legal liability.
• Emergency evacuation or repatriation.
• Optional business income from an extortion event, offered by Chubb as an extension.

Who is insured. Chubb's page says employees and their direct family members can be insured persons and that coverage is 24/7, with travel not required to be business-related. Tokio Marine HCC says its cover can be written for a single trip or an entire organization, including relatives and guests of insured persons.

Who buys it

Tokio Marine HCC lists corporations with traveling employees, organizations with international operations, journalists, religious groups, NGOs working in high-risk areas, professional athletes and entertainers, academic institutions and high net worth individuals. Travelers lists financial institutions, nonprofits, private companies and public companies, and AIG points to energy, mining, maritime, multinationals, charities and NGOs.

Domestic businesses are in the market too. Extortion cover answers threats to employees, executives, customers or products, and a company with a high-profile executive or a record of threats may buy it with no foreign exposure at all. Unlike a typical general liability insurance: what it covers and what it does not policy, this is a first-party policy for the insured's own loss and expenses.

What the policy does not do

The limits and conditions are as important as the cover.

• Payment is subject to law. Chubb states that coverage is worldwide "subject to applicable law." A policy cannot require or authorize a payment that is illegal.
• Insurer involvement. Wordings typically require the insured to notify the carrier immediately and use its consultant or a consultant the insurer approves. Paying without telling the insurer can forfeit reimbursement.
• Confidentiality. Most K&R forms require the insured to keep the existence of the policy secret from all but a few people, on the theory that a known policy makes the insured a target. Tokio Marine HCC says its policies can be issued under a code name.
• Dishonest acts and collusion. Policies exclude events arranged by an insured person or family member, and typically payments made to an insured.
• Cyber extortion overlap. Ransomware threats usually belong to a cyber policy (ransomware and cyber insurance: how claims work), and some K&R forms exclude or limit cyber extortion. Check both policies for how they coordinate.

Legal limits on paying a ransom

U.S. policy discourages ransoms, and several laws can apply to a payment.

The State Department's Foreign Affairs Manual says the U.S. will make no concessions to those holding U.S. citizens hostage and denies hostage-takers any benefit, including ransom. It also says the government "strongly urges" companies and private citizens not to pay ransom, that embassies cannot help develop or carry out a ransom strategy, and that anyone who takes a different path does so without U.S. approval (see 7 FAM 1820). That is a policy position, not a statute that bans every payment. Executive Order 13698 (June 2015) created the FBI-led Hostage Recovery Fusion Cell to coordinate government response.

The legal risk is sanctions and terrorism law. OFAC's September 21, 2021 advisory on ransomware payments states that U.S. persons are generally prohibited from transacting, directly or indirectly, with persons on the SDN list or in comprehensively sanctioned jurisdictions, and that penalties can be imposed on a strict liability basis, even if the payer did not know the recipient was sanctioned. The advisory addresses ransomware, but the sanctions principle applies broadly; see paying a ransom: sanctions risk and reporting rules. Counsel, not the insurer, decides whether a payment is permitted. The consultant and counsel assess who the demand comes from before any money moves.

Local law also matters. Countries differ on whether paying or insuring a ransom is lawful, which is another reason for the "applicable law" qualifier and for using specialists who know the jurisdiction.

A hypothetical

Say a mid-size engineering firm sends staff to project sites in Latin America. A project manager is stopped at a fake checkpoint and held for two days by armed men who call the company demanding $250,000.

1. The first call goes to the policy's hotline, not to the kidnappers. The insurer's panel consultant deploys, advises on contact with local authorities and the FBI, and coaches the company's crisis team.
2. A negotiator takes over communication. The company does not improvise.
3. Counsel screens the demand, checking sanctions lists and local law.
4. If a payment is made lawfully, the funds are moved and tracked by the consultant, and the policy reimburses ransom, any loss in transit and expenses within the limit and retention.
5. After release, the policy covers medical and psychological care for the project manager.

In the example, most of the dollars the policy spends may be consultant and aftercare expenses rather than the ransom. The figures are illustrative.

Underwriting and buying

Carriers ask where employees travel and live, how many go to higher-risk countries, whether the firm uses local national staff, its security protocols, prior incidents and executive profile. Premiums follow that exposure: country mix, number of insured people, limit and retention. A broker with a specialty crisis desk will place the policy, often through Lloyd's syndicates or specialty carriers.

Questions for your broker:

1. Is the response consultant guaranteed and its fees outside the limit, or inside it?
2. Which events are covered: kidnap, detention, extortion, express and virtual kidnapping, disappearance?
3. Who counts as an insured person, including family and local hires?
4. How does the cover coordinate with the business travel accident policy, cyber, and political risk insurance: what it covers and who needs it?
5. What are the notice and confidentiality conditions?
6. What does the policy say about illegal payments or sanctioned recipients?

The related risk of an armed attack on premises is a different product; see active assailant insurance: what it covers and what standard policies miss.

Key takeaways

• K&R insurance is a first-party policy that pays for crisis response, expenses and losses from kidnapping, detention, extortion and similar events, and a ransom if one is lawfully paid.
• The most valuable feature is usually immediate access to a response consultant.
• Policies are confidential, subject to applicable law, and typically require insurer notice before any payment.
• U.S. policy discourages ransom payments, and OFAC sanctions are enforced on a strict liability basis, so legal screening comes first.
• Domestic businesses with high-profile executives may buy it; ransomware itself usually belongs on a cyber policy.