Cyber and PI overlap under the SRA MTC: how solicitor firms should think about the two policies together

Reviewed by Matthew Bartlett, Director (SMF3, SMF16, SMF17). Last reviewed 10 July 2026.

Almost every solicitor firm in England and Wales now runs two insurance policies side by side: professional indemnity cover on the SRA Minimum Terms and Conditions, and a standalone cyber policy. That was not the case five years ago. Criminal targeting of law firms has risen, SRA expectations on cyber security have tightened, and insurers have drawn a sharper line between what each policy answers for. This entry sets out what the SRA MTC does and does not cover on cyber-arising losses, what a standalone cyber policy fills, where the two overlap, and where firms most commonly find gaps at renewal.

Why solicitor firms carry both PI and cyber cover in 2026

Legal-sector cyber incidents are no longer occasional headline events. Law firms sit on a combination of client money, confidential transactional data, and high-value counterparty communications that is attractive to criminal actors. Ransomware attacks on mid-sized practices, business-email-compromise fraud in conveyancing chains, and data-exfiltration incidents are regular features of the market. The SRA's cybercrime thematic review, published in late 2024, described the position bluntly: the volume of reports has grown and the sophistication of the attacks has risen.

The regulatory expectation has moved in step. The SRA's Risk Outlook and cybersecurity guidance issued through 2024 and 2025 treat cyber security as a governance issue rather than an IT issue — covering client money protection, incident notification, staff training, multi-factor authentication, backup practice, and supplier due diligence. The underlying rules remain the SRA Principles and the Code of Conduct. Insurers have moved in parallel: most PI insurers on the SRA panel have reduced the cyber sub-limit inside the PI wording, added social-engineering carve-outs, or ceded first-party cyber costs to the standalone market.

What the SRA MTC covers on cyber-arising losses

The MTC is a civil liability wording. It is designed to protect third parties — typically clients — against loss caused by the firm's practice. Where that loss has a cyber cause, the MTC still responds to the client-facing side of the incident. In broad terms the MTC will pick up:

Third-party civil liability arising from the firm's practice where the underlying cause is a cyber event — for example a client claim alleging the firm's negligence in system security caused loss.
Client wire-fraud where a criminal intercepts the firm's communications and induces a payment to a fraudulent account, to the extent the firm is legally liable to the client.
Client claims for damage flowing from a data breach where the firm was negligent in its handling of the client's data.
Defence costs for regulatory investigations linked to a data breach, subject to the standard MTC defence-costs machinery.

The MTC does not carve out cyber-caused liability. If the ingredient of the civil claim is professional negligence, breach of duty, or breach of trust in the ordinary sense, the wording engages regardless of whether the underlying failure was a mis-drafted contract or a compromised email server. Aggregation of related client claims is dealt with by the MTC's aggregation clause — see the entry on aggregation clauses by regulator.

What the SRA MTC does not typically cover

The MTC is not a cyber policy. It is not designed to answer for the firm's own first-party losses or for its costs of managing an incident. The gaps are foreseeable:

First-party cyber costs — the immediate incident response, forensic investigation, digital evidence preservation, breach counsel, external communications, and public relations.
Cyber extortion and ransomware payments, whether the firm pays a ransom directly or engages a specialist to negotiate one.
Business interruption arising from a cyber outage — loss of fees, loss of margin, and the increased cost of working during downtime.
Reputational management costs beyond what the firm is legally liable to reimburse a client.
ICO administrative fines imposed on the firm itself. Whether a UK GDPR fine is insurable is a matter of English public policy and remains contested; PI insurers routinely exclude it.

Those categories add up. In a mid-scale ransomware event affecting a firm of thirty fee-earners, the first-party costs alone can run to six figures before any client claim has been quantified.

What standalone cyber policies cover

A modern standalone cyber policy is designed to sit alongside the MTC and pick up the first-party and operational costs the PI cannot reach. A typical wording will include:

First-party incident response — forensic investigation, breach counsel, notification specialists, and public-relations support.
Ransomware and extortion cover, subject to sanctions screening, insurer approval of the payment, and any policy sub-limit.
Business interruption arising from a cyber outage, usually with a waiting period of eight to twelve hours.
Data restoration and system rebuild costs.
Client notification, credit monitoring, and identity-theft support where required by law or as a matter of reasonable practice.
Legal defence for regulatory action — investigation costs and representation, and where lawful the associated liability.
Third-party liability for privacy breaches, often called network security and privacy liability.

Standalone wordings vary widely. Two policies described as "cyber" can look very different in the definitions of "cyber event", "extortion demand", or "business interruption loss".

Where the two policies overlap

The MTC and a standalone cyber policy are meant to complement rather than duplicate each other, but three areas of genuine overlap arise:

Client civil claims following a data breach. If a client sues the firm alleging negligence in handling their data, the claim is a civil-liability claim under the MTC. If the cyber wording also includes a network security and privacy liability limb, both policies may be triggered. The PI insurer will usually lead because the MTC is the primary wording, but coordination between insurers can be slow.
Notification. A cyber incident may generate a notification obligation under both wordings — a circumstance notification under the MTC's rolling clause and an incident notification under the cyber policy's much shorter deadlines. Both must be handled to preserve cover.
Aggregation of related claims. A single cyber event causing multiple client losses may aggregate under the MTC's "series of related matters or transactions" wording and under the cyber policy's "single event" trigger. Whether the firm is helped or harmed depends on the limit structure of each policy.

The SRA cyber guidance context

The SRA has not issued binding cyber rules in the way the FCA has for regulated financial firms. It has instead published thematic guidance and risk analysis that shape supervisory expectations. The 2024 cybercrime thematic review and the Risk Outlook material through 2024 and 2025 return to a consistent set of themes:

Client money and client account protection is a core control, aligned to the SRA Accounts Rules.
Cyber incidents that materially affect the firm or its clients are reportable to the SRA under the Code of Conduct for Firms.
Staff training in phishing and social-engineering awareness is expected across all levels of the firm.
Multi-factor authentication should be treated as a default, particularly for email and case-management access.
Backup, disaster recovery, and business continuity practices need to be tested rather than only documented.
Supplier due diligence and supply-chain security are increasingly part of the SRA's supervisory posture.

None of that is statutory in the strict sense. All of it affects how the SRA reads a firm whose cyber controls have failed and whose clients have suffered loss.

Common cyber incident scenarios and which policy responds

Ransomware. The cyber policy is the primary responder. Ransom payment, incident response, business interruption, and system rebuild sit within the cyber wording. If a client then sues alleging the ransomware disrupted their matter, that claim engages the MTC.

APP fraud and vendor impersonation. A criminal compromises the firm's email, impersonates a party in a transaction, and induces a client to send funds to a fraudulent account. The firm's civil liability to the client is an MTC exposure. The cyber policy may respond to the forensic and notification costs. The dividing line depends on whose account was compromised, the firm's warning practice, and how each wording defines social engineering. This is the classic boundary case.

Data breach with client personal data leaked. First-party breach management — forensic investigation, notification, credit monitoring — sits with the cyber policy. Client civil claims for distress and consequential loss are an MTC exposure. An ICO fine to the firm is typically not insurable; a civil award against the client that the firm reimburses may fall within the MTC subject to standard exclusions.

Business interruption from a cyber outage. The cyber policy is the first-party responder. The MTC does not answer for lost fees.

Professional advice failure with a cyber cause. The firm's case-management system is down during hearing preparation, deadlines are missed, and a client is prejudiced. The client's claim is a civil liability claim under the MTC. The cyber policy may respond to the operational cost of restoring the system.

How aggregation clauses interact

The MTC aggregates related client claims by reference to acts or omissions in a series of related matters or transactions. A cyber policy aggregates by reference to a single event. In a cyber incident triggering ten client claims across active files, the MTC may treat all ten as one aggregated claim answering to one limit, while the cyber policy may treat the underlying event as one occurrence with its own limit. The result can be favourable or unfavourable depending on where the limits sit.

Common wording issues to review at renewal

The cyber sub-limit inside the PI wording. Many insurers cap cyber-arising cover under the MTC layer at between £250,000 and £1 million, well below the primary MTC limit. Firms often assume the full MTC limit is available and are surprised to find it is not.
The standalone cyber policy's retention and limit relative to the firm's realistic loss scenarios. A £1 million cyber policy with a £25,000 retention can look adequate in isolation and inadequate against a plausible ransomware plus business-interruption combination.
The APP fraud, social engineering, and funds-transfer-fraud carve-outs on both wordings. These are the common source of dispute between PI and cyber insurers on a wire-fraud loss.
Vendor and supply-chain cyber cover — whether the cyber policy responds to a compromise at a case-management provider, a document management vendor, or an outsourced service.
Retroactive date preservation across renewal on both policies. A change of insurer that resets the retroactive date is a serious exposure and often overlooked.
The cyber policy's regulatory investigation cover and how it interacts with the MTC's defence costs machinery.

How Apex approaches this

Apex Insurance Brokers Limited is FCA-authorised (firm reference number 724952) and places SRA MTC professional indemnity and standalone cyber cover for solicitor firms of all sizes. Matt Bartlett, our director, holds SMF3, SMF16, and SMF17 approvals and reviews the PI and cyber programme personally at renewal. We treat the two policies as a single risk-transfer programme: mapping the firm's realistic loss scenarios against both, identifying overlap and gaps in writing, and negotiating wording changes where the market allows. Where the boundary is likely to be contested — typically on wire-fraud and social-engineering cases — we document the position at inception so that a live claim does not begin with a coverage argument.

Frequently asked questions

Does solicitors PI cover a cyber attack?

The SRA MTC covers civil liability to third parties, including where the underlying cause is a cyber attack. It does not cover the firm's own first-party costs, business interruption, ransom payments, or ICO fines against the firm itself. That is why almost every solicitor firm now carries a standalone cyber policy alongside the PI.

Do I need cyber insurance if I have SRA MTC PI?

The MTC is not designed to answer for first-party cyber losses. Ransomware, incident response, notification, credit monitoring, business interruption, and data restoration sit outside the MTC. Whether the firm needs standalone cyber cover is a governance decision, but the practical answer for most firms is yes.

What SRA guidance applies to cyber security for law firms?

The SRA published a cybercrime thematic review in late 2024 and has addressed cyber risk in its Risk Outlook material through 2024 and 2025. These are not binding rules but shape supervisory expectations. The underlying obligations remain the SRA Principles, the Code of Conduct for Firms and Solicitors, and the SRA Accounts Rules. Firms should also consider UK GDPR and Data Protection Act 2018 obligations enforced by the Information Commissioner's Office.

Does PI cover ransomware payments?

The SRA MTC does not typically cover ransomware or extortion payments. That cover, where available, sits within a standalone cyber policy and is subject to sanctions screening, insurer approval, and any applicable sub-limit.

How do PI and cyber policies interact on a client wire fraud?

Where a client is induced to send money to a fraudulent account after the firm's system was compromised, the firm's civil liability to the client is an MTC exposure. Forensic, notification, and incident-response costs typically sit with the cyber policy. The dividing line depends on the social engineering and funds-transfer-fraud provisions in each policy, and on the facts of the incident.

How much cyber cover does a solicitor firm need?

There is no prescribed minimum. The right limit depends on the firm's size, client base, volume of client money handled, case-management stack, and business continuity resilience. Model a plausible worst-case scenario — a ransomware event that closes systems for two weeks, triggers notification to a substantial client population, and generates related client claims — and check that combined PI and cyber limits absorb it.

What might your PI premium look like?

A guideline range built from the premiums insurers have actually quoted on risks we handle. Pick your profession and enter a few details — it updates instantly.

Profession

Annual fee income — gross, last 12 months

Limit of indemnity

Any claims history?

Any higher-risk work? — e.g. large or overseas projects

Guideline range — this is not a quote

Choose your profession and enter your fee income to see a guideline range.

Get an actual quote →

How these figures are produced

This guide is built from Apex's own market data: the premiums insurers have actually quoted and charged on professional indemnity risks we have handled. Each night that data is aggregated into anonymised rate bands by profession, fee income and limit of indemnity. No client information is published — a band only appears where it contains at least five separate records, and unusually high premiums are excluded so a single atypical risk cannot distort the guide.

The range shown spans the typical spread of recent market outcomes for similar risks. Individual quotes can fall outside it in either direction. Figures exclude insurance premium tax at 12%.

This calculator is not a quote and is not an offer of insurance or advice. Your actual premium depends on full underwriting of your business, including your activities, claims record and insurer appetite at the time.