Directors’ and officers’ liability insurance (D&O) – What every board member should know

Serving as a board member or chief executive officer is a responsible role – literally. The Finnish Limited Liability Companies Act imposes personal liability on company management that can extend to their private assets. Directors’ and Officers’ Liability Insurance (D&O insurance) is a key instrument for managing this risk. Nevertheless, the insurance is frequently misunderstood in practice – or its limitations only come to light after a loss has already occurred.

The following provides an overview of the operating logic of D&O insurance, its most important pitfalls, and current developments from a legal perspective. The purpose is to offer a general picture of the questions that management and their advisors should consider.

Why must personal liability of management be taken seriously?

Many companies operate under a misconception: because a limited liability company is a separate legal entity, management cannot be held personally liable for the company’s actions. This holds true with respect to ordinary business risk – a failed investment decision alone does not give rise to personal liability. The situation changes when management has neglected its statutory duties or acted intentionally or negligently in violation of the Limited Liability Companies Act.

A claim may come from several directions. The company itself, or its bankruptcy estate, may seek compensation from management for poor decision-making. Shareholders may bring an action if they consider that management has acted against their interests. Contractual counterparties or other external parties may seek compensation if management’s conduct has directly harmed them. Authorities, for their part, may initiate an investigation that does not lead directly to a compensation claim but causes significant legal costs for the defence.

The reversed burden of proof makes the situation particularly challenging: it is not sufficient for a board member to have acted with due care – they must also be able to prove it. The primary function of D&O insurance is to enable an adequate defence in precisely these situations.

Domestic versus international D&O – a difference that often catches people off guard

In Finland, directors’ and officers’ liability insurance comes in two main types, the difference between which is significant in a claims situation but can easily remain unclear at the point of sale.

Insurance following domestic practice covers the personal liability of the CEO and board members to the extent that it is based on the Limited Liability Companies Act. This insurance is often part of a company’s broader package policy; it is affordable but correspondingly limited. For example, it does not cover employment-related claims – such as allegations of discrimination or wrongful termination – nor does it typically extend to managers acting in subsidiary roles.

Insurance following international practice has a broader structure. It does not confine its scope of coverage to Limited Liability Companies Act situations but covers the personal liability of management personnel more broadly. In addition, it typically includes reimbursement of defence costs even before a formal written claim has been submitted – for example, during a regulatory investigation.

International D&O programmes are typically structured in three layers, known as Side A, Side B, and Side C. The Side A layer covers the personal liability of an individual manager in situations where the company is unable – for whatever reason, such as insolvency – to reimburse their defence costs. The Side B layer covers costs incurred by the company itself when it has indemnified the manager for such costs. The Side C layer, also known as entity coverage, extends the cover to the company itself, typically in connection with securities-related claims. Domestic products generally do not include this three-tiered structure at all.

From a legal perspective, the most important thing is to identify the group structure and operating environment in which the company operates, and to assess whether the insurance product is appropriate for that context.

Claims made – the temporal logic of insurance that you must understand

D&O insurance almost invariably operates on what is known as the claims made basis, which differs from most other types of insurance. What is decisive is not when the act or decision giving rise to the claim was made, but when the claim is presented to the insurer. In practice, this means that the policy must be in force at the moment the claim arrives – not at the time the error was made.

This structure creates two concrete risks. First, a former manager may be left entirely without protection if the company does not renew its policy after his or her departure and a claim is presented only later. Broader international programmes address this through what is known as an extended reporting period, which provides former managers with cover even after the policy has expired. This feature is often entirely absent from limited domestic products.

Second, the notification obligation – that is, the obligation to notify the insurer of a potential loss as soon as it comes to the insured’s attention – must be taken seriously. If management is aware of a situation that may lead to a claim but fails to notify the insurer during the policy period, the policyholder may lose the right to indemnity even if the formal written claim arrives later.

Insolvency – the greatest risk, the weakest protection

Experience shows that D&O insurance is most needed precisely when the company has run into financial difficulties. The administrator of a bankruptcy estate is obliged to examine management’s conduct prior to the bankruptcy, and claims against management are very common in such situations.

And yet it is precisely in this situation that the insurance cover may be at its most deficient. When a company’s financial position deteriorates, insurers tend to offer policy renewals only on the condition that a so-called insolvency exclusion is added to the policy. This clause excludes cover for claims relating to the company’s insolvency – in other words, the very claims for which the insurance was originally obtained.

In the international programmes described above, the Side A layer provides the solution to this problem: the insolvency exclusion does not apply to it, meaning that it protects an individual manager personally even when the company is in bankruptcy and unable to reimburse their defence costs.

From a legal perspective, the board should review the content of its insurance proactively – in particular, which clauses have been included or may be included in the next policy period.

A tax law question – KHO 2023:116 and the structure of defence cost payments

The Supreme Administrative Court of Finland issued a significant precedent on 11 December 2023, KHO 2023:116, which has attracted considerable attention at the intersection of insurance law and tax law. The decision concerned a situation in which an employer had paid directly the legal costs arising from criminal proceedings against one of its employees. The Supreme Administrative Court of Finland held that such costs may be treated as a taxable benefit to the employee – in practice as salary subject to withholding tax. Although the decision arose from a situation involving a journalist and their employer, its legal principle is applicable more broadly to situations in which a company pays the defence costs of a manager directly, without a D&O policy.

This underscores the significance of the D&O insurance structure: an indemnity paid directly to the insured person under a D&O policy is in a different tax position from a reimbursement paid directly by the company. The payment structure of the policy – and in particular whether the indemnity is paid by the insurer directly to the manager or channelled through the company – is a legally relevant question that should be clarified before a loss situation arises.

ESG and sustainability reporting – a growing area of liability

The EU’s Corporate Sustainability Reporting Directive (CSRD) significantly expands the scope of management liability. Application of the Directive is phased according to company size: large public interest entities began reporting for the 2024 financial year, other large companies for the 2025 financial year, and SMEs progressively thereafter. The obligation also extends, through supply chains, to smaller companies operating within the value chains of larger undertakings.

Deficient or misleading sustainability reporting may give rise to management liability vis-à-vis shareholders, creditors, or regulators. International developments – particularly in the United Kingdom and the United States – clearly demonstrate that the number of ESG-based claims against corporate management is increasing. In Finland, this development is still in its early stages, but the trend is unmistakable.

The legal question is whether current D&O policy terms also cover claims arising from breaches of sustainability reporting obligations. This should be assessed by reviewing the policy conditions.

Discharge from liability – a common misconception

Many managers believe that a discharge from liability granted by the general meeting permanently eliminates the risk of a compensation claim. This is a misconception. Under the Limited Liability Companies Act, a discharge from liability binds only the company, and even then only to the extent that correct and sufficient information was provided to the general meeting as the basis for its decision.

A discharge from liability never binds external parties, such as creditors or a bankruptcy estate, if the company becomes insolvent. Nor does a resolution of the general meeting have any bearing on regulatory investigations or criminal liability. For this reason, continuity of insurance cover is of paramount importance even when the financial statements are in order.

Conclusions: three questions for every board

D&O insurance is an essential component of responsible board governance, but its value depends entirely on whether the policy is genuinely fit for purpose. Every board should address at least the following questions.

• Does our insurance actually cover our situation? Do we have subsidiaries, international operations, or managers acting in other roles that fall outside the scope of the domestic product?

• How does our insurance work if the company runs into financial difficulties? Is an insolvency exclusion in effect, and are we aware of its significance? Does the policy include a separate Side A layer?

• Is the position of our former managers protected? If board service ends, does the insurance remain in effect against claims that may be presented later?

These are legal questions whose assessment requires familiarity with both the policy conditions and the applicable legislation. Seeking expert legal advice before the next policy renewal is well justified – not only after a loss has occurred.

Read more about our Insurance & Tort Law services