Cyber risk may start with technology but for financial institutions, it rarely ends there. A breach can soon trigger regulatory inquiry, lawsuits and questions about board accountability. Taking such risks into account, GIB Insurance Brokers recently decided to launch a dedicated Financial Institutions division, led by Greg Harrup. Harrup brings 12 years of broking and underwriting experience to the role, including six years at Marsh.
Financial institutions offer protection of money and data through complex systems and third-party providers. Yet cyber, D&O (Directors and Officers), PI (Professional Indemnity) and crime policies are often organised independently of one another, which can create gaps when losses are exposed to multiple risks. GIB’s new division addresses this challenge by offering structured insurance policies across the organisation.
A changing risk landscape
According to Harrup, the division was created because clients needed a more integrated approach. “Financial institutions have always been specialist risks, but the way things go wrong for them has changed. A breach isn’t simply a breach anymore. Within a week you’re dealing with the regulator, worried clients, maybe lawyers, and the board wants to know who’s accountable.” According to SABRIC, digital banking crime claims reached R2.4 billion in 2025 (a 29.2% increase). Most of these losses were linked to social engineering and impersonation tactics.
Across Africa, cyber risk has become a board-level issue. According to EY, increased cyber risk is causing greater exposure within organisations, leading to operational disruption, regulatory issues and reputational damage. This means that cybersecurity is no longer an IT responsibility alone. It’s become a business risk that needs more strategic board oversight.
Phishing, cloned executive voices (using artificial intelligence / AI) and fraudulent payment requests continue to gain momentum, becoming more sophisticated in nature as tactics evolve. INTERPOL African Cyberthreat Assessment Report 2026 reinforces this, highlighting that AI is now linked to 55% of reported cybercrime across the continent. This shows that both the scale and effectiveness of attacks is accelerating. With increased digital connectivity, Africa, including South Africa, is especially attractive to such threats and the disruption it causes.
A policy does not guarantee protection
Harrup challenges the assumption that having insurance automatically means an institution is protected.
An organisation may offer both cyber and crime cover but still find that a fraud loss falls between the two. This may come down to how the respective policies are worded. It’s vitally important to assess if and how each policy type will respond sufficiently to a realistic loss scenario: which of the two policies should appropriately respond, where gaps may arise and what kind of recovery may be available.
Cyber belongs in the boardroom
The consequences of a cyber incident extend far beyond restoring affected systems. Clients may leave, reputation losses can occur, and regulators may require disclosures or request explanations.
As Harrup puts it: “None of that gets fixed by the IT department.”
Insurers increasingly assess governance alongside technical controls, including tested response plans and accountability for critical third-party relationships. These are enterprise resilience issues, not just IT challenges.
Third-party risk reinforces the point. “You can outsource the service, but you can’t outsource the blame,” Harrup says. Institutions should identify the suppliers they need for operational purposes, understand contractual liabilities and determine whether their insurance policies will respond sufficiently well to supplier issues or service disruptions.
From annual renewal to active resilience
Harrup recommends moving beyond annual renewals by bringing risk, compliance, IT, finance and the board together to test realistic scenarios and assess whether insurance policies would respond as their expected to. “Most institutions learn something uncomfortable the first time they do that. Better to learn it in a workshop than in the middle of a claim. That’s really what we’ve built this division to help with.”
As cyberthreats become more sophisticated, accountability becomes ever more important. This means that financial institutions need an insurance partner that sees the whole picture, not only the next renewal. The new division will focus on banks, asset and wealth managers, JSE-listed REITs, insurers, retirement funds, fintechs and other GIB clients.