D&O claims in Estonia: director liability and insurance

Directors' and officers' liability insurance written for Estonian companies, or for international groups with Estonian subsidiaries, responds to a liability regime that differs in important respects from English, US or German law. Estonian law imposes a strict standard of care, reverses the burden of proof, gives creditors and bankruptcy trustees independent standing to pursue the company's claim, and sets a five-year limitation period that cannot be shortened to the detriment of creditors. This guide outlines the liability regime and the D&O coverage issues that arise under Estonian law.

1. Corporate structure and terminology

The two most common Estonian company forms are the private limited company (osaühing, OÜ) and the public limited company (aktsiaselts, AS). Both have a management board (juhatus), which manages and represents the company (Commercial Code, äriseadustik, ÄS, § 180 lg 1 and § 306 lg 1).¹ An AS must have a supervisory board (nõukogu, ÄS § 316), which plans the company's activities, organises its management and supervises the management board; an OÜ may have one. Members of the supervisory board may not be members of the management board (§ 180 lg 3 for OÜ). Supervisory board consent is required for transactions outside the ordinary course of business, such as acquisitions and disposals of holdings, real estate transactions, loans and guarantees beyond the year's budget (§ 317 lg 1 for AS).¹

In D&O wordings, "director" should therefore be defined to cover both management and supervisory board members, and "officer" to cover procurators (prokurist) and employees with managerial functions. For other legal persons (foundations, non-profit associations, cooperatives), the general rule in the General Part of the Civil Code Act (tsiviilseadustiku üldosa seadus, TsÜS) § 37 applies.²

2. The standard of care and the burden of proof

Members of the management board must perform their duties with the diligence of a prudent businessperson (korraliku ettevõtja hoolsus) (ÄS § 187 lg 1 for OÜ, § 315 lg 1 for AS); the same standard applies to supervisory board members of an AS (§ 327 lg 1).¹

Members who cause damage to the company by breaching their duties are jointly and severally liable for the damage. A member is released from liability only if he or she proves that the duties were performed with the diligence of a prudent businessperson (§ 187 lg 2, § 315 lg 2, § 327 lg 2).¹ The reversal of the burden of proof is a central feature for defence strategy and for defence costs: the director must actively document the decision-making process, the information available, the advice obtained and the reasons for the decision.

Estonian law does not contain a statutory business judgment rule. In the author's assessment, the "prudent businessperson" standard nevertheless leaves room for entrepreneurial discretion where a decision was taken on an adequate information basis, without conflict of interest and in good faith in the company's interest; but a director cannot rely on that discretion if the decision violated the law, the articles or binding instructions of the competent body.

Under TsÜS § 37 lg 1, members of the managing body of any legal person are jointly and severally liable for damage caused by breach of their duties, but are not liable if they acted on a lawful resolution of the general meeting or another competent body.²

3. Who may claim?

3.1 The company

The primary claimant is the company itself. The decision to bring a claim against a board member, and the appointment of the company's representative in that dispute, lie with the shareholders in an OÜ without a supervisory board (as regards management board members, ÄS § 168 lg 1 p 10) and with the general meeting of an AS as regards supervisory board members (§ 298 lg 1 p 9).¹ Changes of control are the typical trigger: a new owner or a new management reviews past transactions and sues the former directors.

3.2 Creditors: the statutory derivative claim

A creditor of the company may claim compensation for the company from a board member if the creditor cannot obtain satisfaction of its claim from the company's assets (ÄS § 187 lg 4, § 315 lg 4, § 327 lg 4; TsÜS § 37 lg 2).¹ This is the Estonian form of a derivative claim. Two features make it particularly significant for D&O insurers:

• The creditor may bring the claim even if the company has waived its claim against the board member, settled with him, otherwise restricted the claim or shortened the limitation period by agreement (ÄS § 187 lg 5, § 315 lg 5, § 327 lg 5; TsÜS § 37 lg 3).¹ A release granted by a friendly general meeting therefore does not protect the director against creditors.
• Under TsÜS § 37 lg 3 the creditor may also claim where the board member's liability has been limited by law in comparison with the general rule.²

Shareholders do not have a general statutory derivative action comparable to US or English law; minority shareholders act through the corporate decision-making mechanisms and, in case of conflict, through the courts.

3.3 The bankruptcy trustee

Once the company is declared bankrupt, the claim on behalf of the company may be brought only by the bankruptcy trustee (pankrotihaldur) (ÄS § 187 lg 4, § 315 lg 4, § 327 lg 4; TsÜS § 37 lg 2).¹ Trustee claims are the most frequent source of D&O losses in Estonia. They typically allege that the directors continued trading while insolvent, made payments after the onset of insolvency, failed to file for bankruptcy in time, entered into transactions with related parties at an undervalue, or failed to keep proper accounts. The trustee may also pursue claims that creditors could have pursued before bankruptcy, and the waiver and settlement protections in § 187 lg 5 and § 315 lg 5 apply equally to the trustee.

3.4 Third parties in tort

Third parties (customers, investors, the tax authority, employees) may sue directors personally in tort where the director personally committed an unlawful act within the meaning of the Law of Obligations Act (võlaõigusseadus, VÕS) §§ 1043 ff., for example by breaching a statutory provision intended to protect the claimant.³ Such claims are in principle exceptional, since the director acts for the company, but they matter for D&O cover because they are brought by third parties and are not subject to the insured-vs-insured exclusion.

4. Insolvency-related duties

Since the 2022 amendments, the Commercial Code sets out explicit duties for the period of financial distress:¹

• If the company's economic situation has deteriorated and insolvency is likely in the future, the management board must take steps to overcome the economic difficulties, restore liquidity, improve profitability and ensure sustainable management, including considering a restructuring application (ÄS § 180 lg 5¹ for OÜ, § 306 lg 3¹ for AS).
• If the company is insolvent and the insolvency is not temporary, the management board must file a bankruptcy petition without delay, but no later than 20 days after the insolvency became apparent.
• After insolvency has become apparent, management board members may not make payments on behalf of the company except payments consistent with the diligence of a prudent businessperson in an insolvency situation; members are jointly and severally liable for breaches of these rules.

These provisions translate directly into trustee claims: the trustee will reconstruct the date on which insolvency became apparent and seek compensation for payments made thereafter and for the increase in the deficit caused by late filing.

5. Limitation

Claims against management and supervisory board members of an OÜ or AS become time-barred five years after the breach, unless the articles or an agreement with the board member provide otherwise (ÄS § 187 lg 3, § 315 lg 3, § 327 lg 3). For other legal persons the period is five years from the breach (TsÜS § 37 lg 4).¹ A contractually shortened period does not bind creditors and the trustee (ÄS § 187 lg 5, § 315 lg 5, § 327 lg 5). Exceptionally, the ten-year period in TsÜS § 146 lg 4 applies where the board member intentionally caused damage contrary to good morals, typically by an intentional breach of the duty of loyalty without disclosing a conflict of interest to the persons supervising them; it does not apply if those persons knew of the conflict. Both periods run from the breach.⁶

Note that the five-year period runs from the breach, not from the company's knowledge, so trustee claims often concern acts committed shortly before the window closes. For the director's claim against the D&O insurer, see section 7 and the limitation guide.

6. Regulatory exposure

D&O exposures increasingly arise from regulatory duties placed directly on management:

• Cybersecurity. Under the Cybersecurity Act (küberturvalisuse seadus, KüTS) § 6¹, an entity within its scope must designate at least one management board member who approves the security measures, monitors their implementation and is responsible for it; that member must undergo regular training. If no member is designated, the duties apply to all board members.⁴ Fines for breaches of the security and notification duties can reach EUR 10 million or 2% of worldwide annual turnover for essential entities, and EUR 7 million or 1.4% for important entities (KüTS §§ 18², 18³), and fines can also be imposed on natural persons.
• Sanctions. A transaction violating an international sanction is void (International Sanctions Act, rahvusvahelise sanktsiooni seadus, RSanS, § 7 lg 1), and the Act imposes extensive due diligence and reporting duties on obliged entities.⁵

Whether fines and penalties are insurable under Estonian law is not regulated expressly. In the author's view, cover for administrative or criminal fines imposed on the insured personally is generally contrary to public policy and the purpose of the sanction, while defence costs in such proceedings can be covered (VÕS § 511 lg 2 allows cover of costs in criminal and administrative proceedings where the facts may ground civil liability).³

7. D&O coverage issues under Estonian law

Applicable insurance law. A D&O policy for an Estonian company may be a large risk under Rome I art 7(2), in which case a foreign choice of law is effective, and the contract may also meet the class and size conditions in VÕS § 427 lg 3 (general liability or financial loss class, and at least two of the three size criteria, with group figures on a consolidated basis under § 427 lg 4). Where these conditions are not met, the mandatory VÕS rules apply.³ See the choice of law guide.

Claims-made and notification. Estonian statutory liability insurance law is built on an occurrence model (VÕS § 510), but claims-made D&O wordings are standard in the market. The policyholder must notify circumstances that may lead to an insured event and the assertion of a claim within one week (§ 514 lg 1), and the commencement of proceedings without delay (§ 514 lg 3). A late notification releases the insurer only within the limits of § 452 lg 2: for post-event duties, only intentional breach or grossly negligent breach with consequences.³

Defence costs. Liability insurance covers necessary legal costs even if the claim proves unfounded (§ 511 lg 1), and the insurer must advance costs of criminal and administrative proceedings on request where it so instructed (§ 511 lg 2). Costs of litigation conducted at the insurer's request or recommendation are payable even beyond the sum insured (§ 511 lg 3).³ Section 511 is not among the provisions listed in VÕS § 427 lg 1, so it is not semi-mandatory as such and a "costs inclusive" limit can in principle be agreed; in standard terms, however, a clause departing from § 511 lg 3 must still pass the incorporation, transparency and fairness tests of §§ 37–42, and it should be drafted expressly. Where the insurer merely consents to defence counsel, the question whether the litigation was conducted at its "request or recommendation" becomes decisive.

Intentional acts. The insurer is released if the policyholder intentionally and unlawfully caused the event giving rise to liability (§ 513). In D&O, the policyholder is usually the company while the insureds are the directors; § 465 attributes the insured person's knowledge and conduct to the policyholder where a third party's risk is insured.³ Severability clauses therefore matter. "Final adjudication" wording in conduct exclusions is consistent with Estonian law and protects defence costs funding until an intentional breach is established.

Insured vs insured. Claims by the company against its own directors are the core exposure in Estonia, and claims by the trustee or creditors "on behalf of the company" (section 3) should be carved back expressly. An unqualified insured-vs-insured exclusion would, in standard terms, be at risk under VÕS § 42 lg 1 if it deprives the cover of its essential purpose.

Allocation. Where a claim combines covered and uncovered matters or insured and uninsured persons, Estonian law contains no specific allocation rule; contractual allocation clauses are generally enforceable if transparent.

Settlement and consent. A clause releasing the insurer where the insured settles without consent is void if refusing to settle would have been manifestly contrary to good faith (§ 515 lg 2).³

Payment. The indemnity falls due when the liability has been established by judgment, acknowledgement or settlement, and must be paid within two weeks; defence costs within two weeks of notification of their total (§ 515 lg 1).³

Third-party protection. D&O is voluntary insurance. Claimants have no direct action, but the director's claim against the insurer cannot be disposed of to the claimant's detriment (§ 517 lg 3), and in the director's bankruptcy the claimant has a preferential right over the insurance claim (§ 518). See the direct action guide.

8. Practical recommendations for D&O insurers

1. Define "insured persons" to include management and supervisory board members, procurators and de facto managers.
2. Expressly carve back claims by trustees and creditors under ÄS § 187 lg 4, § 315 lg 4, § 327 lg 4 and TsÜS § 37 lg 2 from the insured-vs-insured exclusion.
3. Review notification and cooperation clauses for consistency with VÕS §§ 452, 514 and 515.
4. Address defence costs advancement, priority of payments and the interplay with § 511 lg 3.
5. Address insolvency: company's insolvency should not affect Side A cover; consider the trustee's access to policy information.
6. Address cyber and sanctions-related regulatory proceedings explicitly.

Related pages

• D&O claims counsel in Estonia (service)
• Liability insurance and direct action (VÕS §§ 510–525)
• Insolvency of a policyholder or tortfeasor in Estonia
• D&O insurance in Estonia: director liability after leaving office
• Limitation periods for insurance claims in Estonia
• Supreme Court: liability insurance and direct claims

References