How we think about insuring companies that use blockchain.

At-Bay provides cyber insurance for the digital age. Learn more at at-bay.com.

Blockchain technologies and cryptocurrency businesses have been in the news a lot lately. This sudden proliferation of blockchain companies raises important questions for providers of cyber security insurance:

• How can we understand the scope of a blockchain company’s exposure?
• Which criteria should inform whether we insure a blockchain company?
• What is the correct risk appetite when insuring a blockchain company?

It is difficult to evaluate companies based on such a new and quickly-changing technology. To help you navigate the blockchain space we’ve shared how we think about these kinds of businesses. Below we segment these new companies into six distinct categories, define their business models, and explain our risk tolerance for each.

Businesses we confidently insure

I. B2B Solution providers

What they are: Businesses that provide blockchain technology services to third parties. The majority of these companies focus on private blockchain implementations for financial services companies.

Our risk tolerance: We treat these companies like we would any other technology provider. Because of their large corporate base, these companies have high exposure to cyber-attack liability. Cyber-attack remediation and business interruption are also large risks, but these risks fall within the normal bounds of a technology company.

Examples include: Chain.com, applied blockchain, digital assets holdings.

II. Saas providers

What they are: Business that use blockchain technology to provide distributed services to either business customers or consumers. We view these businesses the same way we view online services providers.

Our risk tolerance: The main exposures for these companies are business interruption and the cost of recovery from a cyber attack. We expect little private records exposure, and as a result feel comfortable insuring these kinds of businesses.

Examples include: storj

III. Media companies

What they are: Businesses that provide statistics and news about the cryptocurrency market.

Our risk tolerance: We view their main exposure drivers as business interruption and online media liability. As a result we view these businesses the same way we view other online media outlets.

Examples include: coindesk, bitcoincharts

Businesses we’re wary of

IV. Wallets

What they are: Businesses that provide cryptocurrency wallets for consumers and businesses. We view these businesses as in a similar category to retail and commercial banking.

Our risk tolerance: These businesses are deposit-taking institutions but deal with cryptocurrencies instead of traditional currencies. Since theft of digital cryptocurrencies is their major exposure they are even more vulnerable to attack than traditional financial institutions, and as such we are hesitant to insure these businesses.

Examples include: blockchain.info, bread

V. Exchanges

What they are: Businesses that provide exchange options from fiat currencies to cryptocurrencies or between different cryptocurrencies.

Our risk tolerance: We view these businesses like securities exchanges coupled with deposit-taking institutions. These companies maintain significant exposure to the underlying financial assets, and are especially vulnerable to cryptocurrency theft and business interruption. Given the extreme volumes of assets on their books, even a brief attack can be extremely expensive, and we generally avoid this kind of risk.

Examples include: coinbase, kraken.

VI. Payment Processing

What they are: Businesses that allow online merchants to accept cryptocurrencies as a means of payment.

Our risk tolerance: We view these companies as comparable to credit card merchants. Since almost all of these companies bundle their payment solution together with a wallet, an exchange, or both, we are hesitant to cover this kind of risk at this point in time.

Examples include: bitpay, coingate

—

Note: Since the blockchain space keeps changing, we expect to see new business models arise and our tolerance to grow as technology standardizes and matures. We will update this list over time.