Insurance news

Precautionary shutdowns, not confirmed breaches, are driving early PHP2Shell losses, Marsh Re said in a new report, putting cyber policy triggers in focus for brokers.

In an October report, the reinsurance broker examined two critical flaws in PHP, a scripting language it estimates runs 77% of websites. Emergency patches arrived October 21.

Marsh Re expects business interruption to be the main loss driver, rated medium to high, especially for online retailers that rely on web access. Recoverability depends on policy wording, trigger, waiting periods, sublimits and the treatment of precautionary shutdowns, the report said.

Dutch government services, Finland’s state IT center and a Danish municipal IT provider supporting schools temporarily restricted access or went offline, the report noted. Most services were restored after remediation.

Exploitation now confirmed

Marsh Re said that when it wrote the report, no widespread successful breaches had been confirmed. Since then, evidence of exploitation has grown.

The US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog on Monday. Federal agencies must patch by October 29, but the agency has not said which organizations were compromised.

Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots last week. He warned the single-worker setup may not reflect how reliably the exploit works on production servers.

Cybersecurity firm Dream said it found artifacts of a China-nexus campaign that chained PHP2Shell with a Linux kernel flaw and rooted 25 servers in four countries. Palo Alto Networks said Thursday it had observed active exploitation of internet-exposed management interfaces. Researcher Kevin Beaumont has said he is aware of a ransomware group using PHP2Shell against Palo Alto firewalls. Marsh Re had not confirmed ransomware activity when it published.

What brokers should check

Cowbell’s Simon Hughes said businesses that switch off as a precaution, and their brokers, “should check now how their cyber policy treats a voluntary shutdown and what waiting period applies, rather than finding out at claim stage.”

Coalition said its policy has no clause barring coverage if clients skip the patch. Brokers still need to confirm other carriers’ terms.

Beazley Security’s Francisco Donoso said firms focused on websites may overlook PHP embedded in appliances that protect their networks. “This will not be the last bad vulnerability that we see this month, this year or this quarter,” he told Insurance Business.

Marsh Re noted that insured portfolios skew toward better-resourced firms with faster patching cycles, which should moderate losses. It warned that small and mid-sized firms may face longer remediation tails, so losses could migrate toward those segments over time.

Marsh Re places PHP2Shell between acute catastrophe and routine patching, closer to the latter for now, but with a credible path to the former.

AM Best researchers said in a report: “The PHP vulnerability is a scenario of systemic risk that has long worried cyber insurers and resulted in a reluctance to increase their risk models aggressively.”

“We’ve never seen a true 1-in-200-year cyber catastrophe, but in theory the market is well capitalized for one,” said William Altman, CyberCube’s director of threat intelligence services. “That’s not what we’re facing today with PHP2Shell.”

Ransomware criminals doing their homework on a target do not stop at the balance sheet. Incident response teams have watched them work out where a company’s executives live and where their children go to school.

“They know where their children go to school and it becomes a very scary situation in that reality, whether there’s any truth to it or not, where we have had clients that have had to relocate as a result of that, at least on a temporary basis,” said Lindsey Maher (pictured left), head of global cyber development at specialist global insurer CFC in London.

CFC has written cover for that fallout into additions offered in its cyber policies through brokers globally. Trauma counselling and therapy services alongside temporary relocation costs and personal theft of funds can be covered for a firm’s executives.

“It speaks directly to the buyer and their own personal liability,” Maher said.

The person deciding whether to buy a cyber policy is usually the same person whose reputation, career and family arrangements are exposed when the business is attacked. Cyber has conventionally been sold as a balance-sheet product to a buyer whose own exposure is personal and the wording has rarely acknowledged it.

Read next: Why captive insurance for cyber and trade credit is growing

The insurer believes it is first to market globally with counselling offered in these C-suite policies. It is not the first to put counselling in a cyber policy. Berkley Cyber Risk Solutions has offered crisis counselling coverage since May 1 2024. Berkley writes cyber internationally, including through its Asia operation, though the counselling endorsement was announced in the US and the company has not published whether it is available in other markets.

However, CFC’s move underlines increasing recognition among insurers of the human as well as the material costs of a cyber attack.

What cyber claims teams kept seeing

Both insurers described the same origin, which is claims and response staff noticing what clients were going through.

Rich Sheridan (pictured right), chief claims officer at Berkley Cyber Risk Solutions, cited the tremendous emotional impact that insureds experience when dealing with a breach event. He acknowledged that policyholders needed resources to cope with the stress rather than only to remediate the incident. Berkley extended the approach in June 2025 with an endorsement reimbursing cancelled holidays, child and elder care and corporate safety costs for the staff managing a breach, as Insurance Business reported when the endorsement covering incident responder costs was launched.

“It’s one of the most under-talked outcomes of cyber events, the mental health impact of it,” Maher said.

Read next: AI tops AXA’s risk ranking, and clients want to know if their cyber policy covers it

The research is some way ahead of the wordings. A 2024 study published in the Journal of Cybersecurity, drawn from the Royal United Services Institute’s work on the ransomware victim experience, catalogued harms among victim organisations including shame, guilt, isolation, loss of self-confidence and post-traumatic stress, and recorded outcomes at the severe end among small business owners in particular. The researchers found the impact is often greater at smaller firms, because the owner’s personal and working lives sit so close together.

“It should support the people responsible for leading the business through that crisis,” Maher said of cyber insurance.

Where the cover sits against the rest of the programme

Cover for an executive’s personal exposure is the kind of thing that can read like a directors’ and officers’ (D&O) question. Maher is clear that CFC does not see it that way. The executive protection language sits as primary within the cyber policy rather than overlapping with D&O and the point of writing it in explicitly is to settle the argument in advance.

“There’s no avoidance of doubt that we do intend to pick it up, and don’t want to be in a situation in the event of a claim where we’re finger-pointing across different policies,” she said.

Three of the best-known cyber writers, Beazley, Chubb and Coalition, lead on incident response, breach counsel, forensics and round-the-clock hotlines, with no counselling benefit in their public cyber material.

CFC’s move to offer counselling in its global cyber offerings reflects what its own response staff keep encountering rather than a gap in the market someone spotted. Maher said the decision came down to recognising that cyber insurance should not stop at the systems and the accounts.

“It’s trauma counselling services for clients, and really dealing with the victim impact and the human element of what transpires during most cyber events for clients that go through them,” she said.

The research points the same way. The Royal United Services Institute’s work found that psychological harm after a ransomware event is not confined to the people who handled the response, and that it can surface months later among staff who were nowhere near the incident. Maher said the hope is that putting the cover in writing does something beyond paying for sessions, by making the mental health consequences of an attack easier to raise at all. On her account it is among the least discussed outcomes of a cyber event, which is a strange thing to be true of a loss type where the frequency is now higher than property damage for many businesses.

What that leaves on the table is a question about the rest of the market. Counselling has been in one US cyber wording since 2024 and now appears in CFC’s globally for cover pitched to executives, while some of the largest cyber writers publish nothing comparable. Either the human cost of an attack is a real and insurable loss, in which case two insurers acknowledging it is an odd place for the market to have stopped, or it is a service that belongs outside the policy altogether. Cyber wordings offered globally currently say both. 

Aon’s third-quarter results show a business performing solidly on every revenue metric that matters. Organic revenue grew 6% in the quarter, with commercial risk and reinsurance each up 7% and health solutions up 6%. Adjusted operating margin expanded 70 basis points to 27.0%. Adjusted earnings per share rose 10% to US$3.36.

The balance sheet is less tidy. Long-term debt stood at US$14.66 billion at the end of 2025. By September 30, it had risen to US$26.32 billion, an increase of approximately US$11.66 billion in nine months. The jump is almost entirely attributable to the financing of Aon’s US$17 billion acquisition of USI Insurance Services from KKR, which is expected to close before the end of the year.

In September, Aon issued US$13.5 billion in senior notes across seven tranches, with maturities running from 2029 to 2056 and coupons ranging from 5.35% to 6.45%. The proceeds are currently sitting in short-term investments on the balance sheet, which jumped from US$1.6 billion to US$13.3 billion over the same period, awaiting the deal’s close. Once USI is absorbed, Aon will have completed two acquisitions totalling approximately US$30 billion in two years, following its US$13 billion purchase of NFP in April 2024.

Buybacks paused, restructuring accelerating

Aon repurchased no shares in the third quarter despite holding US$7.7 billion of remaining buyback authorisation, and has told investors it will prioritise debt repayment over shareholder returns as it targets a leverage ratio of 2.8x-3.0x within approximately 24 months of the USI close. The dividend continues, but the broader capital return programme is effectively suspended.

The Accelerating Aon United restructuring programme, meanwhile, generated US$93 million in charges in the quarter, up 191% on the same period last year. The programme was launched in 2023 to streamline operations, cut headcount and consolidate real estate.

Aon describes the driver as “primarily costs related to workforce optimisation,” which is headcount reduction. The timing is notable: NFP integration costs were described as “substantially completed” at June 30, and USI has not yet closed. The restructuring charge spike suggests Aon is rationalising its combined workforce across the existing business and NFP simultaneously, ahead of adding USI’s 10,500 staff.

The programme was initially designed to deliver US$350 million in annual savings by end-2026, with total cash charges of approximately US$900 million over three years. Nine-month charges in 2026 already stand at US$281 million.

Ratings pressure

S&P Global affirmed Aon’s A- issuer credit rating after the USI announcement but moved the outlook to negative, stating that a downgrade remains possible if leverage does not return to its base case within two years of the close. Fitch separately assigned a BBB+ rating to the new senior notes themselves and placed that rating on negative watch. Both signals reflect that Aon is carrying substantially more debt than it has historically, at a moment when it must also integrate two major acquisitions and retain the broker talent that makes both businesses valuable.

According to KKR, USI’s revenue nearly tripled under its nine-year ownership through a combination of organic growth and more than 90 acquisitions. Retaining that network through a change of ownership and integration with NFP is the execution risk S&P and Fitch both flag in their ratings commentary.

Aon frames USI as the next stage of the same middle-market thesis it deployed with NFP: buying a PE-backed broker platform and integrating it onto Aon’s shared services and analytics infrastructure. The deal is expected to dilute adjusted EPS in 2027 before turning accretive in 2028, with US$395 million in projected annual run-rate synergies.

Organic performance holds

The operating results that fund all of this remain strong. Commercial risk segment’s organic growth of 7% in the quarter was driven by North America and EMEA, with M&A services and core P&C performing particularly well. Reinsurance organic growth of 7% reflected strong treaty placements, though net market impact was unfavourable as pricing continues to soften.

Health solutions grew 6% organically, with particular strength internationally. Wealth solutions grew 4%, with demand for UK and EMEA retirement advisory work linked to ongoing regulatory change providing a consistent tailwind.

Total revenue for the nine months reached US$13.38 billion, up 4%. Free cash flow for the same period was US$1.94 billion.

“Our Aon United strategy continues to advance and differentiate our platform for clients,” said Greg Case, president and chief executive. “We enter the fourth quarter with significant momentum, reinforcing confidence in our ongoing ability to deliver sustained, differentiated performance.”

The fourth quarter is when all the deferred consequences land at once: the USI close, the debt on the books, the integration beginning and the first real test of whether the synergy projections survive contact with reality.

When Insurance United Against Dementia (IUAD) launched in 2017, its founders were not sure whether the industry would give a couple of thousand pounds or a great deal more. Nine years on, the campaign has raised more than £13m for Alzheimer’s Society, with around 150 firms now committed to it year after year. 

Benedict Burke (pictured), one of its three co-founders, puts that down to how the market works. Insurers, brokers and loss adjusters may compete hard, he said, but they also trade with one another every day, and IUAD was built on the relationships that grow out of that.  Ahead of Insurance Day for Dementia on 26 November, though, he is candid about where that network has yet to reach. 

“We think we have been in the past a little too London-centric,” he said. 

Beyond London 

The IUAD board has 12 members, each with a specific remit, and will introduce a dedicated regional markets remit for 2027–28, Burke said. Engagement in Bristol and Manchester is growing, and he wants more brokers, insurers and the wider supply chain, from lawyers and engineers to forensic scientists and loss adjusters, involved wherever regional trading markets are concentrated. 

That means finding people prepared to lead locally, because the campaign runs on relationships. “It’s all about who do you know and how you can engage with them and how you can bring the proposition forward and how you can make the ask politely but with purpose,” he said. 

London is not the only gap. Life and protection firms are taking part in growing numbers, reflecting the sector’s exposure to an ageing population, but Burke sees considerable room to deepen their involvement. Reinsurance partnerships have grown too, though not yet at the scale he believes is possible. He framed both as an open invitation to leaders in those sectors. “Dementia has no boundaries, and therefore nor do we.” 

Why the ask is hard to refuse 

Much of the response comes down to shared experience. Someone in the UK develops dementia every three minutes, Burke said, and many of those working across the market have seen its effects in their own families. His mother, Betty, a schoolteacher, died of Alzheimer’s, and when he talks about her, others often talk about their own. That common ground, he said, is why most people asked over a drink at an industry event to get involved find it “a difficult no”. 

The campaign also holds itself to account. Its board asks itself what Burke calls the “so what” question: what will the money actually do? From the outset, the founders committed never to charge an expense, personally or collectively, against the funds raised, so every pound goes to Alzheimer’s Society. 

IUAD’s funding commitment to the UK Dementia Research Institute between 2018 and 2025 helped support research into blood biomarkers, which could offer a cheaper, more accessible route to diagnosis than brain scans. Industry contributions to Alzheimer’s Society’s Covid-19 Support Fund also helped launch its Companionship service, which made more than 140,000 calls to over 5,000 people affected by dementia between 2021 and 2025. 

From awareness to action 

Burke admits he was once sceptical about how sincere corporate social responsibility really was. Working with his own colleagues changed his mind. The most dementia-aware firms, he said, invite IUAD in, give staff time for Dementia Friends sessions, and, where appropriate, train claims handlers and contact centre teams to recognise when a customer is struggling. 

Firms new to Insurance Day for Dementia can get a toolkit from Alzheimer’s Society, join its Lunch & Learn webinar, and have funds raised by 4 December matched by the Z Zurich Foundation up to £100,000. 

Speaking personally rather than for Alzheimer’s Society, Burke said helping employees diagnosed with dementia stay in work should be a legal right as well as a duty of care, balanced against firms’ commercial needs. 

Burke also has a longer-standing frustration; that insurance is too often maligned. By 2030, he wants government and the public to recognise the industry’s contribution, and other sectors to copy the model, as Sports United Against Dementia already has. The more immediate task is taking the relationships that built IUAD in London out to the regions, and into the reinsurance and protection markets. 

Rival clubs and players considering compensation claims against Manchester City may have to wait until the club’s appeal is resolved to secure after-the-event (ATE) insurance, according to a specialist litigation insurance underwriter.

The Premier League announced on September 29 that an independent commission had found City in breach of more than 100 of its rules. City lodged an appeal on October 1 and denies wrongdoing. Arsenal, Liverpool, Manchester United and Tottenham reportedly lodged notices in 2024 reserving the right to claim compensation, while players and agents are said to be exploring loss-of-earnings claims if the verdict stands.

Rocco Pirozzolo, managing director and underwriting director at Harbour Underwriting, said: “With a live appeal, this creates uncertainty, and so I expect underwriters would want to wait for the outcome of the appeal.”

A three-member appeal board will hear the case and can dismiss or allow the appeal, send it back to the commission, or alter any sanction or compensation order. Sanctions will be considered at a separate hearing.

Under Premier League rules, the appeal hearing should be held within 12 weeks of being lodged, with a decision due within 30 days of it ending, which points to late January if the timetable holds. Sky Sports has reported the process could run later if City argue that the new appeal rules should not apply to their case.

A breach is only the first hurdle

Pirozzolo said the novelty of these claims may put them outside the appetite of some ATE insurers. For those willing to consider them, a finding that the rules were broken is only where the analysis begins.

“They know that the claimant has to connect that breach to a different sporting outcome and then translate that outcome into a financial loss,” he said.

That is the chain Burnley had to prove against Everton. In June, a Premier League commission ordered Everton to pay Burnley more than £35m in compensation and interest, finding that Everton’s breach of the Profitability and Sustainability Rules in 2021-22 gave it a sporting advantage that caused Burnley’s relegation. Burnley had sought around £51.7m, and the commission awarded £26m, with interest taking the total past £35m. Everton is appealing the decision.

For Pirozzolo, the award gives underwriters a roadmap for assessing such claims. The expert evidence Burnley relied on addressed both causation and the size of the loss, although Everton’s appeal leaves that roadmap under challenge.

Capacity and the cost of pursuing claims

These cases rely heavily on expert evidence, and Pirozzolo expects football clubs to “vigorously defend” them. They may therefore require significant limits of indemnity, although he believes the market has the capacity to provide them.

Third-party funding and dispute insurance are not only for claimants who could not otherwise afford to litigate. Premier League clubs and players with the means to bring claims can use them too.

Pirozzolo said “lawyers advising their clients in respect of these cases should consider both funding and insurance as ways to enable these cases to be brought.”

For brokers placing ATE, the timing of the appeals and the strength of each claimant’s causation evidence are likely to shape when cover becomes available and on what terms. Until claimants can show how a rule breach changed a sporting outcome and what that cost them, underwriters will have little to price.

What happened: The High Court found a fund manager fabricated returns and awarded approximately £17.5 million

Who’s involved: Coleman Capital LLP (in liquidation), its Gibraltar holding company, and their controlling director

What’s at stake: Approximately £17.5 million in investment money, none of which has been returned

Why it matters: The fraud finding survives bankruptcy, putting PI and D’O underwriters on notice

Where it stands: Summary judgment entered October 9, 2026; remaining claims stayed

The monthly statements looked fine. They showed steady returns, Goldman Sachs custody, and a segregated account with the investor’s name on it. The custodian’s own trading records told a different story: the entity that actually controlled the money – Coleman Asset Management Group – carried a running negative balance with the custodian that had blown past US$18 million by the end of 2023.

That gap between what an investor was told and what was actually happening with his money is at the centre of a judgment handed down on October 9, 2026, in the High Court’s Business and Property Division. The court granted summary judgment of approximately £17.5 million against Coleman Capital LLP, its controlling director, and a Gibraltar-registered holding company, Coleman (Europe Holdings) Limited. The basis: fraudulent misrepresentation – in plain terms, deliberate deceit.

The investor, a chartered surveyor and businessman, placed a total of approximately £17.5 million with the firm and its director between September 2020 and April 2024. The money fell into three pools: roughly £3.7 million for what was described as the Coleman Funds, about £800,000 in equities transferred from a Kleinwort Hambros portfolio, and £13 million earmarked for a LIBOR-linked deposit account.

Goldman Sachs on paper, a deepening hole in practice

The pitch, as documented in emails, presentations, and a formal offering memorandum, was elaborate. The investor was told his money would go into a Cayman-based fund using Goldman Sachs as prime broker, independently administered, audited annually by BDO, and held in a segregated custodian account. He was told he could withdraw at any time.

None of that happened. Evidence from the custodian, Linear Investments Ltd, showed the money was instead routed to Coleman Asset Management Group – another entity controlled by the same director – and used for proprietary trading and to pay out other investors who were redeeming. The director himself conceded in a witness statement that “the accounts were not fully segregated in the way originally described and that the investment profile differed from initial expectations.”

Meanwhile, the investor received monthly statements bearing the firm’s name and FCA registration number, each purporting to show his balances growing with positive returns. The custodian’s trading data painted the opposite picture: Coleman Asset Management Group’s running balance with the custodian was negative by more than US$5 million at the end of 2021, nearly US$11 million by the end of 2022, and over US$18 million by the end of 2023. Data from the custodian showed the director instructed transfers to that entity on the same days the investor’s money arrived.

The investor’s case was that the director must have known the monthly statements he sent were untrue. In his evidence, the director did not say the statements were true, gave no explanation for them, and did not address them at all. The court, in granting summary judgment, found the defendants had no real prospect of a successful defence.

No defence, no money, no explanation

When the investor asked for £1 million back in March 2025, nothing came. When he asked for everything back, nothing came either. The court put it plainly: “Disaster may unfortunately strike the most careful of investment managers. But honest managers do not usually lose everything.”

The defendants never filed an acknowledgement of service or a defence. The director filed a witness statement denying fraud and blaming the losses on third-party failures – principally a default by a company called Omnia Group Holdings AG and the conduct of the custodian. But the court found the defence unparticularised and unsupported by any documentation. In the modern finance world, the court observed, “it is inconceivable that such documentation would not exist and be available to the defendants.”

There was one more detail the court did not overlook. The director, who had been based in the UK throughout the investment relationship, moved to Dubai after proceedings were issued. “The obvious inference,” the court said, “is that he is running away.”

The judgment that follows you

The court entered summary judgment on fraud specifically – rather than a simpler default judgment – for enforcement reasons. Under the Insolvency Act 1986, a debt arising from fraud is not wiped out when someone is discharged from bankruptcy. The director had been bankrupt from August 2025 to August 2026, but the fraud finding means the £17.5 million liability follows him regardless.

The court also set aside the loan agreement between the parties, removing a contractual cap that would have limited liability to 120% of the loans made. A cap in a contract obtained by fraud does not survive once the contract is unwound.

Damages were assessed at £3,669,796.42 for the Coleman Funds, £814,871.64 for the transferred equities, and £13,000,000 for the LIBOR deposit monies. Coleman Capital and the director are liable for the full amount; the Gibraltar holding company is liable only for the Coleman Funds portion. The remaining claims – including claims to trace and recover the actual assets – were stayed, with the investor’s legal team noting the full picture of where the money went remains incomplete.

For PI and D&O underwriters providing cover to regulated investment managers, this is a textbook scenario: fabricated performance reporting, misappropriated client funds, a controlling director who is the sole point of failure – and a fraud judgment that no insolvency process can extinguish.

The claims in this case have been determined by the High Court on a summary judgment application. The court found the defendants liable for fraudulent misrepresentation on the balance of probabilities. The remaining claims to trace and recover assets have not yet been adjudicated. No recovery from the settled fourth party, Linear Investments Ltd, has been disclosed.

For the first time since devolution began, Wales, Scotland and Northern Ireland all have first ministers who want to leave the UK. Last month all three signed a memorandum declaring that “Westminster’s time is coming to an end”.

No vote is imminent. Andy Burnham has said a second Scottish referendum remains off limits, and Plaid Cymru has ruled out a Welsh vote before 2030.

For insurers and brokers, though, the practical differences already matter. Scotland’s separate legal system shapes claims costs, reserving and settlement strategy today.

Where Scottish claims cost more

Andrew Lothian, partner in DWF’s major injury and casualty team in Scotland, said the biggest difference is in costs on lower-value personal injury work, whether road traffic accidents or employers’ and public liability. Based on recent data, he estimated that roughly £2 goes on claimants’ costs for every £1 of damages in lower-value Scottish personal injury claims.

He contrasted that with England, where fixed recoverable costs apply to low-value whiplash-type motor injuries. Scotland has no equivalent, which he said gives claimant firms a margin on that work that is not available in England.

Fatal claims are the second gap. They are a small share of the total, but Lothian said a widow in Scotland might receive around £120,000 or more, while the statutory bereavement award in England and Wales is £15,120.

A third difference concerns the treatment of dishonest claims. Scotland has qualified one-way costs shifting, which protects claimants who litigate, and that protection can be lost for fraudulent conduct, manifestly unreasonable behaviour or abuse of process. What Scotland lacks is the fundamental dishonesty defence that applies in England and Wales, and efforts to bring it in through test cases have not succeeded.

“It’s likely that it’s going to need legislation rather than somebody trying to persuade a judge that it’s a good idea,” Lothian said.

The rules that introduced qualified one-way costs shifting are due for review after five years, which Lothian said should happen around now. The case for bringing fundamental dishonesty and fixed recoverable costs to Scotland continues to be made, but he said there is little appetite for either at present.

Those differences often feed straight into reserves. Where a fatal claim could be litigated or presented in Scotland, insurers need higher damages reserves, and at the lower-value end, claimant cost reserves run higher than in England and Wales.

The continued accrual of claimant costs gives insurers an incentive to settle early, while reducing the financial incentive for claimant firms to do so. Lothian described many Scottish claimant solicitors as highly skilled at staying within the rules while keeping their businesses highly profitable.

What independence would change

Further divergence is hard to call while Scotland remains part of the UK. Full independence could look like the position in the Republic of Ireland, with policies covering one jurisdiction only.

If cover became restricted to one jurisdiction, brokers placing business for clients on both sides of the border would need to scrutinise territorial limits. The bigger open questions, Lothian said, are structural, including whether a UK-wide single market would cover financial services and who would regulate in Scotland.

Scotland would at least start with the legal infrastructure in place, from its own legislature and courts to its own legal qualifications, which Lothian said leaves it able to be “fairly nimble”. He said Northern Ireland, also its own jurisdiction, is probably the closer comparison, while an independent Wales would likely start with English law and diverge over time.

Lessons from the last split

For now, Lothian said, client questions about independence remain informal, because nobody knows what it would look like in practice. His standing advice to insurers and brokers is simpler.

“If you forget every single thing I’ve said to you, as you probably will, and you only remember one thing, remember that Scotland is a foreign country,” he said. Firms that try to handle Scottish claims “in an English way” are the ones that come unstuck, he said, while those that recognise the difference know to bring in local help.

The structural questions, he said, would need answers ready in advance rather than a decision to “just cut it off and see what happens”. Brexit showed the scale of restructuring a split can force. By early 2019, the ABI estimated UK insurers had moved around 29 million contracts and set up about 40 new EU hubs.

Whatever the constitutional outcome, insurers already need to reflect Scotland’s distinct claims environment in their reserves and settlement strategies.