Notification and claims strategy across several policies

In short. Insurance does not work automatically: it must be activated at the right time, in the right form and with the right qualification. The same event can be qualified in several ways, so presenting a claim is not merely a matter of describing facts but a legal and tactical decision. The three central questions are when to notify, how to qualify the event and how to use several policies in parallel.¹

Claims handlers receiving an Estonian notification will see the approach described here from the other side: early notices under several policies, a qualification argued under each wording and requests for an advance payment.

1. When to notify?

Almost all policies contain a duty to notify. The law requires the policyholder to notify the insurer of the insured event without delay after becoming aware of it (Law of Obligations Act (võlaõigusseadus, VÕS) § 448 lg 1). In liability insurance, a third-party claim and circumstances that may give rise to the insurer's liability must be notified within one week, and the commencement of court proceedings must be notified without delay (VÕS § 514).²

Notice must be given when:

• a loss event has been identified;
• there is a reasonable basis to believe that a claim will be made;
• circumstances arise that may lead to an insured event.

The suspicion phase. In practice, the question often arises whether to notify at the stage of suspicion or to wait until the loss is clearer. Delay is as a rule more dangerous than early notice.

Example. A company discovers a possible fraud and decides to investigate it internally before notifying the insurer. The investigation takes several weeks. The insurer later argues that the delay prevented the money from being frozen and the circumstances from being investigated.

Consequences of breaching the duty to notify. Under Estonian law, late notification does not automatically lead to complete release. An agreement under which the insurer is released if an obligation is breached is effective only within the limits of VÕS § 452 lg 2; what matters, among other things, is whether the breach affected the occurrence of the insured event or the extent of the insurer's performance obligation.³ The burden of proving the breach and its effect lies with the insurer.⁴ The statutory consequences of a failure to notify the insured event are dealt with in VÕS § 449 (see notification and post-loss duties).

Special features of D&O insurance. D&O policies are mostly written on a claims-made basis: cover applies if the claim is made during the insurance period and notified in accordance with the policy terms. A supervisory authority's inquiry, a shareholder's written threat or an auditor's remark may therefore also require notification. A notice of circumstances given before the end of the insurance period can ensure that a later claim falls under that period's cover. This is particularly important if the policy is expiring or the insurer is changing.

In addition:

• the notice must meet the requirements of the policy (form, address, content);
• the notice must be documented (in writing, with confirmation of receipt);
• all insurers whose policy may be relevant must be notified, including the excess layer insurers.

2. How to qualify the event?

The same event can be treated in different ways depending on the policy under which the claim is made. A cyber incident may be a technical failure (cyber insurance), involve fraud (crime insurance) or lead to a claim against the board (D&O insurance). The qualification determines:

• which policy responds;
• which limits and sub-limits apply;
• which exclusions may apply.

Example 1. An employee makes a payment on a fraudster's instructions. If the event is described as "human error", the cyber policy may not cover it. If it is qualified as a fraudulent payment instruction, the crime policy may respond. If the attacker changed the supplier's details in the company's system before the payment, computer fraud cover, which often has a higher limit, may also come into question. In Canadian case law it was nevertheless held that where the policy contains a separate clause for social engineering, such an event must be assessed under that clause (see Future Electronics v Chubb in the case collection).

Example 2. A cyber incident has a possible geopolitical background. If the event is qualified as a state-sponsored operation, the war exclusion may apply; if it is treated as criminal activity, the cover remains. The burden and the standard of proof of attribution depend on the policy (see war exclusions and cyber insurance).

Qualification requires:

• technical analysis (what happened);
• a legal assessment (how it is to be treated);
• knowledge of the policy terms.

Honesty is the limit. Qualification means the correct legal assessment of the facts, not the adaptation of the facts to the policy. Knowingly giving the insurer false information may give the insurer grounds to be released under the contract and the Law of Obligations Act, and it may also be a criminal offence. These are different questions. The offence of insurance fraud covers causing the insured event, or creating a false impression that an insured event has occurred, in order to obtain an indemnity (Penal Code (karistusseadustik, KarS) § 212), while a knowingly false statement about the extent of a genuine loss may instead be assessed as fraud (KarS § 209). A calculation error or an honest but wrong valuation is neither.⁵

3. Using several insurance contracts in parallel

With modern risks it is not unusual for the same event to fall under several policies. The question is then not "which policy" but how to use the policies together:

• a claim is made under several policies for the same event;
• each policy covers its own part of the loss;
• the claims are coordinated.

Example. In a ransomware attack, cyber insurance covers the restoration of the systems and the business interruption, crime insurance the payments made as a result of fraud and D&O insurance the claims made against the board.

A problem arises when the policies limit liability where another insurance might apply: other insurance clauses, exclusions referring to another policy, priority rules. Under Estonian law, in the case of multiple insurance the insurers are jointly and severally liable to the policyholder and share the loss between themselves (VÕS § 486).⁶ The policyholder cannot, however, recover more in total than the amount of the loss.

It is therefore necessary to:

• make claims under all potentially relevant policies;
• ensure that the notices are consistent in substance;
• coordinate communication with the insurers (one contact person, one document package);
• divide the loss into components corresponding to the cover of each policy.

4. A strategic approach

Two extremes must be avoided:

1. too narrow an approach: the claim is made under one policy only, although several would be relevant;
2. too diffuse an approach: the claim lacks a clear structure and reasoning, which gives the insurer grounds to call the whole claim into question.

The best course is a balanced and coordinated strategy. A practical sequence:

1. an initial notice to all relevant insurers (within 24 to 72 hours);
2. gathering facts and evidence with the help of forensics;
3. calculating the loss by component;
4. analysing the cover, exclusions and limits of each policy;
5. presenting a structured claim, in stages where necessary;
6. requesting an advance payment if the process drags on, that is, where the extent of the insurer's performance has not been determined within one month of notification although the insured event has been established (VÕS § 450 lg 3);⁷
7. in the event of a refusal, requesting written reasons and monitoring the one-year period for bringing an action (VÕS § 475 lg 3).⁸

5. Typical mistakes

• late notification;
• a wrong or too narrow qualification;
• using only one policy although several would be relevant;
• inconsistent information to different insurers;
• lack of documentation;
• ignoring the time limit stated in the insurer's refusal decision.

The result may be a reduced indemnity, rejection of the claim or a long dispute. Insurance is not a passive protection mechanism but an active tool whose effectiveness depends on how it is used.

6. What the initial notice should contain

The initial notice to the insurer must be quick but not superficial. Recommended content:

• the policy number and the policyholder's details;
• the time when the event was discovered and a short description of the facts (only verified facts; assumptions are marked as assumptions);
• the measures taken so far (isolation, bank, police, authorities);
• a preliminary assessment of the type of loss (restoration, business interruption, monetary loss, third-party claims), without confirming a final amount in a binding way;
• a contact person and a request to confirm receipt of the notice;
• a request for instructions (service providers, inspection, documents);
• a statement that notice is also being given under the other relevant policies and that the claim will be supplemented.

7. Communication with the insurer during the process

• Reservation of rights. At the start of the process the insurer may state that it is handling the loss but reserves the right to rely on exclusions. This is not a refusal, but it shows which questions are in dispute. Reply in writing and explain your position early (see reservation of rights and declination letters under Estonian law).
• Requests for information. The policyholder has a duty to cooperate: it must provide the information and documents that are needed to determine the extent of the insurer's obligation.⁹ If requests are too broad, reasons may be asked for.
• Claims handler and experts. The insurer's claims handler works in the insurer's interest. In a large loss, it is worth involving one's own expert.
• Advance payment. If determining the amount of the loss drags on, an advance payment may be requested (VÕS § 450 lg 3).⁷
• Refusal. A refusal must be reasoned. Record the date of receipt, because the one-year period for bringing an action runs from it, provided that the insurer has informed the policyholder of that period (VÕS § 475 lg 3).⁸

Related pages

• How to present a claim
• Typical coverage disputes
• Cyber, crime and D&O insurance: interplay and boundaries
• Reservation of rights and declination letters under Estonian law
• Estonian Supreme Court: limitation of insurance claims

References