Directors & Officers Insurance: how protected are the people who actually run a company?

This is perhaps the most important misunderstanding around D&O. A limited company is a separate legal entity. That does not mean, however, that the word “limited” removes the personal duties a person takes on when they accept an appointment as a director.

This matters particularly in Cyprus. The Companies Law, Cap. 113, sets out specific duties for company directors. Where insolvency is a likelihood, for example, directors are expected to have regard to the interests of creditors, members and other stakeholders, to consider measures to avoid insolvency, and to refrain from certain actions that could threaten the viability of the business.

There are also duties concerning conflicts of interest, and collective responsibilities of directors in relation to certain financial and corporate reporting. The Institute of Certified Public Accountants of Cyprus (ICPAC) has itself noted, in training aimed at directors, that breaches of fiduciary and statutory duties can, depending on the circumstances, lead to civil or criminal consequences.

In plain terms: the limited liability of a shareholder is one thing, and the duties a person assumes as a director are another. This applies equally to a purely Cypriot company and to a foreign or international business that has established operations or a corporate structure in Cyprus.

Take a simple business example. A company is growing quickly and decides to make a large investment. A year later things have not gone as expected, the company is in financial difficulty, and shareholders lose a significant part of their investment.

That alone does not mean the directors did anything wrong; business decisions always involve risk. But if a shareholder alleges that the board held material information it did not disclose, that it presented a misleading picture of the financial position, or that it failed to discharge its duties properly, the situation changes. The conduct of specific individuals — not only the company's results — may need to be examined.

Now change the example. The company is close to insolvency and the directors must decide whether to keep trading, which creditors to pay, what measures to take, and whether there is a realistic prospect of rescuing the business. In Cyprus, the law sets out specific duties of directors where insolvency is a likelihood.

Or consider a regulated company. The board may not itself perform every compliance function day to day, but that does not necessarily mean it carries no supervisory duties. The cases differ, yet they share a common denominator: a director's seat carries responsibility for the way the company is managed and supervised.

We do not need to look only at the United States or the United Kingdom to see why this matters. In a recent Cyprus matter, the Cyprus Securities and Exchange Commission examined the conduct of board members of a Cyprus investment firm in relation to the oversight of the firm's governance arrangements.

What is interesting here is not which firm it was, or who the directors were — which is precisely why there is no reason to name them. What matters is what the case shows.

A board's supervisory responsibility is not necessarily limited to whether a director personally carried out a particular act. It may concern whether the board monitored, assessed and exercised the oversight its role required.

That is particularly relevant for a non-executive or independent director. Being absent from a company's day-to-day operations should not be confused with being absent from the responsibility that comes with a board seat. This is exactly the value of real cases: they remind us that sitting on a board is not simply a corporate title. It is a position of responsibility.

This is perhaps the point at which the usefulness of D&O insurance becomes genuinely clear. Imagine a shareholder brings a claim against a director. The director considers the allegation entirely unfounded. Two years later, he is vindicated. Excellent. But who paid for the journey to that point?

Defending a serious corporate dispute can require specialist lawyers, advisers, expert witnesses and a great deal of time. In a regulatory investigation, costs can arise long before there is any final decision. And that is the crucial point: financial exposure can begin before it is established whether the director bears any liability at all.

This is why, when a D&O policy is reviewed, the question is not only whether the limit is €1m, €2m or €5m. What the particular wording actually provides for defence costs, investigations, insured persons, exclusions, territorial scope and other relevant terms needs to be examined.

D&O is not a licence for a director to act as they please. Nor should it be assumed that fraud, deliberate misconduct, fines or any unlawful conduct would be covered. Insurability depends on the nature of the claim, the applicable law and the specific terms of the policy.

What properly structured D&O cover can do is quite different: it can provide financial protection for specific risks connected with an insured person's management role.

The collapse of the British company Carillion is a striking example of how closely the conduct of the people at the top of a company can be examined when things go seriously wrong.

After the collapse, the UK authorities did not confine themselves to examining what happened to Carillion as a corporate entity. The conduct of individuals who held management positions was examined too. Among the outcomes were multi-year disqualifications of former directors from running companies, including an eight-year disqualification of a former chief executive.

Carillion is not evidence that a D&O policy would have covered those particular consequences — the case should not be presented that way. It demonstrates something different and far more useful: a company may have ceased to exist while the decisions of the people who ran it are still being examined years later.

In the United Kingdom alone, the Insolvency Service recorded 1,222 director disqualifications from its own enforcement activity in 2023/24, with an average disqualification period of 8.4 years. Management liability, then, is not merely a theoretical concept invented by insurers. The consequences for directors are real.

Another reason many businesses never consider D&O is that they associate it with multinationals, listed companies and the chief executives of large organisations. Yet size alone does not tell us enough about risk.

A ten-person company may have two external investors, significant bank borrowing and directors taking decisions worth millions of euro. A startup may have raised substantial investor capital. A small Cyprus holding company may form part of a much larger international group. A family business may take on new shareholders, and suddenly board decisions are scrutinised by people outside the family.

So instead of asking “how big is the company?”, it is often more useful to ask: “to how many people and organisations is management accountable, and how serious could the financial consequences of a contested decision be?” That is where the real exposure starts to become visible.

There is no checklist saying that every company with X employees must buy D&O. There are, however, characteristics that make examining this cover particularly important.

A business with external shareholders or investors has more accountability relationships. A company with significant borrowing has obligations towards creditors. A regulated business operates within a heightened supervisory framework. A company in rapid growth, restructuring, acquisition or financial pressure takes more high-impact decisions.

The same applies to international businesses operating through Cyprus. Where there are subsidiaries, directors in different countries, international investors or operations across multiple jurisdictions, it is also necessary to examine whether the geographical and jurisdictional scope of the cover matches the actual structure of the business.

And there is one more group that is often forgotten: people who accept a board seat because they were asked to do so professionally, without holding any real ownership in the company. The fact that someone does not own the business does not mean their position as a director carries no responsibility.

Even when a company already has D&O, the discussion should not stop there. Who counts as an insured person? What happens with past, present and future directors? What about subsidiaries? How are defence costs treated — are they within the overall limit, or do they work differently? What is provided for investigations? Which jurisdictions are covered? What are the significant exclusions? Are there circumstances that must be notified to the insurer?

And, perhaps most importantly: is the limit adequate for that particular company's real exposure? A €1m limit can sound large when read in isolation on a policy schedule. If it must protect several directors and officers and absorb a long legal process, the same figure takes on a different dimension.

The limit should therefore not be chosen simply because “that is the usual figure”. The business behind the number needs to be examined.

Directors today operate in a very different environment from twenty years ago. There are heightened requirements around compliance, corporate governance, financial reporting, AML, data, employment practices and many other areas. Companies operate across borders more easily. Investors and shareholders have far greater access to information. Regulators have more supervisory tools. And almost every significant corporate decision now leaves a digital trail — emails, board minutes, reports, approvals and internal communications.

In Cyprus itself, ICPAC devoted dedicated training in 2026 to the duties and liabilities of directors, precisely because breaches of statutory and fiduciary duties can have real consequences.

This does not mean anyone should be afraid to become a director. It means they should understand precisely what they are taking on when they do.