As of 1 October 2026. Information only, not legal advice – see the disclaimer.
| Full title | Lloyd's Market Bulletin Y5381 “State backed cyber-attack exclusions”, 17 August 2022, with the model clauses LMA5564–LMA5567 of the Lloyd's Market Association (November 2021) |
|---|---|
| Type | Market requirement of an insurance market; model contract clauses |
| Adopted by | Lloyd's (Corporation of Lloyd's); Lloyd's Market Association |
| Adopted | 17 August 2022 |
| Legal status | Not law. Binding on managing agents at Lloyd's under Lloyd's market supervision; applies to standalone cyber-attack policies incepting or renewing from 31 March 2023. The clauses bind policyholders only as terms of their contracts |
| Official text | Lloyd's (Market Bulletin Y5381) |
| Subject area | Private actors, liability and insurance; Use of force, intervention and cyber operations |
Note: This entry describes the market requirements and model clauses as published. Clauses and market practice change; the wording of individual policies varies. The entry does not describe any particular policy and is not insurance advice.
After disputes about the application of traditional war exclusions to cyber-attacks, Lloyd's required all standalone cyber-attack policies written in its market to contain a suitable clause excluding liability for losses arising from State-backed cyber-attacks. The bulletin sets minimum requirements for such clauses. It is referred to in discussions on how private markets deal with cyber operations attributed to States and on the insurability of cyber war.
The bulletin requires that the exclusion, at a minimum:
The model clauses LMA5564–LMA5567 differ in the scope of cover they retain; their attribution provisions refer primarily to attribution by the government of the State in which the affected computer system is located.
The requirements transfer concepts from the law of State responsibility and armed conflict – war, attribution to a State, impairment of essential State functions – into private contracts. Whether a loss is covered can thus depend on public attribution by governments. For the prior case law see Merck v. Ace American (2023).