Crypto Business Insurance UK | Digital-Asset Broker

Published: 5 July 2026 | Reading time: 24 minutes | Category: Cyber & Tech | Author: John Miller, Miller & Partner

Why does a crypto business need specialist insurance treatment?

Crypto and digital-asset businesses occupy a strange position: they can carry enormous, concentrated value and serious institutional exposures, yet they remain one of the hardest sectors in the UK to insure. An exchange, custodian, trading firm or web3 startup faces a combination of risks almost no other business does — the theft of digital assets held in custody, directors exposed to a fast-tightening regulatory regime, smart-contract and technology failures, and the sheer volatility of the assets themselves. And with the FCA's new cryptoasset regime now finalised and approaching, the stakes for governance and compliance are rising sharply. Standard commercial and even conventional tech policies are simply not built for this.

This is the kind of genuinely difficult risk Miller & Partner exists to place. As a specialist broker for complex and emerging risks, we structure cover for crypto exchanges, custodians, trading firms, web3 startups and digital-asset businesses that generalist insurers won't quote — including firms told they're uninsurable. This guide explains why digital-asset custody crime is the exposure that defines the sector, how the new FCA regime changes your risk, why directors' and officers' cover is so critical, and how to present a crypto business so specialist underwriters engage. It sits in our technology cluster alongside our guides to AI liability insurance and SaaS business insurance.

What must a crypto policy include that a standard policy won't?

Crypto businesses are often offered a standard commercial combined or tech policy, and it doesn't fit the risk — assuming an insurer will engage at all. A conventional policy assumes tangible property, familiar liability and a settled regulatory backdrop. It doesn't contemplate the theft of an intangible bearer asset from a digital wallet, the personal exposure of directors under a brand-new regime, smart-contract code that can fail irreversibly, or assets whose value can swing violently overnight. The gaps show up exactly where a crypto firm is most exposed: custody crime, D&O, technology liability and valuation. The comparison below shows where a standard policy falls short. Our cyber insurance page covers the cyber layer that sits alongside.

Why is digital-asset custody crime the exposure that defines the sector?

If one exposure defines crypto insurance, it is the theft of digital assets held in custody. Cryptoassets are bearer instruments: whoever controls the private keys controls the assets, and a successful hack, insider theft or key compromise can move enormous value irreversibly in moments, with no chargeback and often no recovery. This is why specie and crime cover for assets in custody is the flagship — and the hardest — cover in the sector, and why the whole industry orients its security around protecting keys.

Crypto-custody policies are technical and tightly drawn. They wrestle with exclusions and sub-limits around exactly the things that determine whether assets are safe: private-key management, the split between "hot" (online) and "cold" (offline) storage, multi-signature and reconciliation controls. Notably, these are the very categories the FCA's new custody rules (CASS 17) also focus on — regulator and underwriter have independently converged on the same risk taxonomy. For a firm, that means the security architecture is simultaneously your regulatory story and your insurance story: a robust, well-documented custody and key-management regime is the single strongest thing you can put in front of a specie underwriter, and increasingly in front of the FCA too.

How does the new FCA cryptoasset regime change your risk?

The UK's regulatory treatment of crypto is changing fundamentally, and it reshapes the risk picture for every firm in the sector. Historically, crypto firms only had to register with the FCA for anti-money-laundering purposes. That has now changed: the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 brought cryptoassets within the FCA's remit, the FCA published its final rules and guidance on 30 June 2026, and the new regime is expected to come into force on 25 October 2027, with an authorisation application window opening in autumn 2026. Firms carrying on regulated cryptoasset activities — custody, trading, dealing, arranging, staking, stablecoin issuance — will need FCA authorisation, and those that miss the gateway may have to run off their UK business.

For insurance, the significance is that the regime imports the full weight of financial-services regulation: the Consumer Duty, operational-resilience requirements, client-asset custody rules (CASS 17), and the Senior Managers & Certification Regime (SM&CR). SM&CR in particular places personal accountability on named senior managers, which materially heightens directors' and officers' exposure. A firm that treats regulatory readiness and insurance as one exercise — evidencing governance, resilience and custody controls to both the FCA and its underwriters — is far better placed, both to secure authorisation and to secure cover on sensible terms. This is a defining moment for the sector, and the firms that prepare early will navigate it best.

Why is directors' & officers' cover so critical for a crypto firm?

Directors' and officers' cover is often the most important liability protection a crypto business carries, because the people running these firms are personally exposed on multiple fronts at once. Crypto companies are typically venture-backed and milestone-driven, operate in a sector under intense regulatory scrutiny, and — under the incoming regime and the SM&CR — will have named senior managers who are personally accountable for the firm's conduct. Investors who back a crypto firm may bring claims against directors if the business fails, if a hack destroys value, or if regulatory approval is delayed or refused; regulators may pursue senior managers directly.

D&O cover responds to these personal exposures — defence costs and liability arising from claims against directors and officers in their management of the company. In crypto it needs to be structured with the sector's specific risks in mind: regulatory investigation and enforcement, investor and shareholder claims, and the governance failures that a hack or collapse can expose. Given how many high-profile crypto failures have ended in claims against the individuals at the top, D&O is not a box-ticking cover here — it is core protection for the people steering a firm through a volatile market and a tightening regulatory regime, and it belongs in the programme from an early stage.

What are the technology, smart-contract and cyber risks?

Beneath the custody and regulatory exposures sits a layer of pure technology risk, because a crypto business is, at bottom, a software business handling value. Smart contracts — self-executing code that moves assets automatically — can contain bugs or vulnerabilities that, once deployed, may be exploited or may fail irreversibly, causing direct financial loss to the firm or its clients. Platform errors, failed transactions, and the operational-resilience failures the FCA now scrutinises all sit alongside this. These are professional and technology exposures that a standard policy neither contemplates nor covers.

A properly structured programme therefore includes technology and professional liability for code, platform and service failures, and cyber cover for the hacking, data-breach and system-compromise risks that overlap heavily with custody crime. Given that a single smart-contract exploit or platform breach can affect many users simultaneously and irreversibly, robust code auditing, penetration testing and operational-resilience controls are both good practice and central to insurability. A crypto firm that can evidence rigorous technology governance — audited contracts, tested systems, resilient operations — is protecting its clients and presenting a far stronger risk to the specialist market.

What insurance does a crypto or digital-asset business need?

A crypto programme is a genuine stack of specialist covers, and they must be structured together to fit a business that is part custodian, part software firm and part regulated financial-services entity. The core structure looks like this:

Digital-asset custody (specie / crime)

The flagship cover: specie and crime protection for cryptoassets held in custody against theft, hacking and key compromise — tightly drawn around your storage and key-management model.

Directors' & officers' liability

D&O geared to regulatory scrutiny, investor claims and SM&CR senior-manager accountability under the new FCA regime.

Technology & professional liability

Professional and technology indemnity for smart-contract, platform and service failures, plus errors in advice or execution.

Cyber

Cyber cover for hacking, data breach, system compromise and business interruption — overlapping closely with custody crime.

Commercial & management covers

Employers' and public liability for staff and premises, plus business interruption and the general covers any growing company needs.

Why do so many insurers refuse crypto businesses?

It's worth understanding why crypto is so hard to insure, because it explains how to overcome it. Part of the reason is genuine: the risks are real, large and, in custody crime, potentially catastrophic and unrecoverable. But a large part is reputational and unfamiliarity-driven — many generalist insurers simply decline anything with "crypto" attached, regardless of how well-governed the firm is, because they don't understand the risk and don't want the association. The result is that a well-run, well-capitalised digital-asset business can be turned away by the mainstream market as reflexively as a poorly-run one.

The consequence is that crypto is a specialist placement, not a mainstream one. Cover is written by a comparatively small number of specie, D&O, technology and cyber underwriters — much of the capacity sitting at Lloyd's — who understand digital-asset risk and will engage with a firm that presents it properly. A comparison site or a generalist broker will rarely reach them. This is precisely the gap a specialist broker fills: knowing which markets have appetite, and presenting the custody model, governance and regulatory readiness in the way those underwriters need to see. Being refused by the mainstream market is the norm for crypto — and it is not the end of the conversation.

Why is valuing digital assets for cover so difficult?

A final distinctive challenge is valuation. Cryptoassets are famously volatile — the value of assets held in custody, or of a firm's own positions, can swing dramatically in hours, which makes setting and maintaining an appropriate sum insured genuinely difficult. Insure to a figure set months ago and a loss at a market peak could leave a serious gap; the exposure a custody policy needs to cover is a moving target in a way it simply isn't for tangible property. This is compounded by the technical question of how a loss of a bearer digital asset is valued and settled at all.

The answer is to treat valuation as an active part of the programme rather than a set-and-forget number: understand how the policy values and settles a digital-asset loss, keep sums insured under review against the assets actually held, and be clear on the basis of settlement in advance. The same discipline that protects against underinsurance in any sector applies here, but with volatility turning an occasional review into an ongoing one. A firm that can show it manages this deliberately is both better protected and a more credible risk to a specie underwriter.