Aon: How digital asset insurance is underwritten, and where it stops

Underwriters now assess crypto firms using familiar business signals, such as financials and claims history. The harder questions concern who can move funds, how assets are held and where a policy stops. Glenn Morgan, Head of Digital Assets at Aon, joined Paula Pettit, VP of Strategy and Growth at Range, to trace how digital asset insurance got there. It began with two concerns, protecting the people running a business and protecting the assets customers entrusted to it. Since 2017, the market has expanded, but getting covered still depends on what insurers are willing to write, what buyers can afford and how well a company can explain its risks.

Aon is a broker. It advises companies on risk, connects them to insurance markets and puts together insurance programs. Glenn leads its book of business for crypto native clients, advises companies on digital assets and blockchain technology and supports Aon's own digital asset work. Range works on the evidence side of that conversation. We turn regulatory and reporting requirements into transaction controls, coordinate the risk and compliance providers a company already uses and run monitoring, reconciliation and reporting from one record.

From D&O to crime cover: how digital asset coverage evolved

Glenn came to crypto risk in 2017 from private equity and M&A in New York, where he focused on financial lines and transactional risk. He saw education as the first obstacle: insurers needed to understand what these businesses were trying to do before they would cover them. White papers raising large sums and projects that turned out to be scams gave underwriters reasons to stay away. For the most part, he said, companies were not buying much insurance.

The first demand came from the people running the business. Glenn put it in the voice of a typical founder leaving Goldman to start a crypto venture and asking where to begin: "I need to make sure that I'm not gonna have to sell my house if the SEC comes after me." Directors and officers coverage addressed that concern, protecting the business and the founder's personal assets. Customers and investors brought the next question. In Glenn's words, "you have to have a way to confidently tell investors or customers or regulators that their money is safe when they put it with you." As institutional money arrived, qualified custody mattered, as did the insurance behind it.

Buyers moved from D&O to asset loss coverage under a crime program. Hot wallet cover was almost impossible to obtain at first, so the market began with specie insurance for private keys in cold storage. Crime cover has since become more important because the most significant loss areas are warm and hot wallets, social engineering and computer fraud. Coverage still depends on insurer appetite, customer demand and budget. As Glenn noted, "the insurance industry is much more reactive than proactive when you look at the scale of financial institutions."

For a buyer, the starting point is where the assets sit. Document which keys are in cold storage, which wallets are warm or hot, who holds signing control and how funds move between them. That split shapes whether a loss falls under specie, crime or cyber cover.

Underwriting crypto firms on ordinary business signals

Glenn described a market in the early stages of maturity, where "businesses within the crypto industry can be easily identified as a legitimate business or not." Underwriters can now assess them using signals they have relied on for more than forty years: financials, debt, cash, runway, investors and past claims. He attributed part of that shift to the US regulatory picture, with Congress coming around, while noting that work remains on Clarity. The market previously moved in cycles. Capital flowed in and buyers had more money for insurance, then capacity left after FTX. Glenn sees coverage moving beyond that cycle and becoming more dependent on the risk appetite of insurers and their reinsurers. Other classes of business face the same friction. Some insurers will not cover crypto regardless of how much it matures.

The core requests remain consistent. Executives and board members want D&O protection first. Custody comes next: does the company use a qualified custodian, do hot wallets use MPC, who has signing control and who can access the flow of funds? Those answers help determine whether an exposure falls under crime or cyber and technology risk. Technology providers also face litigation if their service fails. Newer requests include smart contract and oracle failure cover for DeFi vaults used in yield strategies, alongside staking and slashing coverage.

Price remains a sticking point. Insurance is intended to smooth a balance sheet over time, but crypto businesses are comfortable with volatility, and insurers charge much higher rates on average. As Glenn put it, buyers end up asking, "well, if I'm gonna have to pay this much for it, what am I really smoothing out?" Some choose to retain the risk on their balance sheet.

Prepare for underwriting as you would for a lender: have current financials, cash, runway and claims history ready. If you decide to retain a risk, understand the size of the exposure you are keeping.

Why Aon started accepting stablecoins for premiums

Paula noted that Aon has started accepting stablecoins for premium payments. Glenn's interest in crypto payments dates to 2017 and 2018, when clients holding Ethereum after its first big run asked to pay with it. Stablecoins promise instant settlement, cross-border transactions and lower fees, though he questioned how fully they deliver those benefits today.

For Glenn, the answer depends on the size of the business. A nimble 100-person organization subject to less regulation can capture those benefits now. Pieces are still missing that, he said, "larger businesses need in order for it to make good on all those promises." Aon's pilot began with clients who already held stablecoins and wanted to use them.

Glenn connected the decision to the regulatory outlook around GENIUS. Aon expects stablecoins to remain and become a regular part of everyday business. Explaining why Aon chose to get involved, he said, "We wanted to be someone who said, let's start learning about this now" and contribute to solving the problems large institutions face. The aim is that when Aon advises stablecoin issuers and payment providers, it does so from firsthand experience.

If you plan to pay or accept stablecoins at scale, establish the process before the first transfer: how each payment is approved, matched to its invoice and recorded in the books. A pilot built around those steps gives finance a process it can repeat and an auditor evidence to follow.

NORS and the case for standards insurers can underwrite

Glenn traced NORS to growing demand for ETFs, which he called the first domino in the US institutional story. Asset managers preparing Ethereum ETFs wanted to stake rather than leave yield on the table, and node operators competed for their business. The managers were told slashing was highly unlikely, but the potential loss was still unacceptable. They also could not tell which validator had better controls. Larger node operators did not want to compete against operators with lower controls. They came together around an institutional-grade standard for node operators, which Glenn described as "kind of like a SOC two plus, if you will."

Aon was already working with many of those validators. As Glenn put it, "insurers are having the same problem as asset managers." Insurers also have far less upside: they receive only a small premium in return for covering the loss. Aon became involved to understand what makes an operator safe and to provide the capacity node operators were seeking. The goal was a framework insurers could use, leading to a policy with extended coverage, a cost advantage and a more streamlined process.

Glenn was careful to say that certification is not the only thing that makes an operator insurable. Still, he said, "now we've gotten to a place to where we can issue policies on back of all of this work" and provide meaningful amounts of coverage. The standard has yet to be adopted at scale.

Similar work is underway on vault structures, though Glenn could share little about it. As asset managers examine onchain vaults more closely, the risks center on smart contracts and oracles. The aim is to help insurers and the industry understand what can be insured. Some in the industry assume insurance can cover whatever they cannot handle themselves, yet regulated options are scarce. If insurers covered every DeFi hack, Glenn said, "the insurance industry is not gonna be around for very long."

Where controls and evidence part ways

Paula asked where the gap is widest between the controls a company believes it has and the evidence an underwriter will accept. Glenn's answer drew on incident postmortems. He has asked underwriters whether a sequence of events would have been covered. In some instances the answer is yes, yet numerous times the company that suffered the incident had no insurance. In his view, "the process that people put themselves through to obtain coverage says a lot about their risk appetite to begin with." Underwriting is iterative. An underwriter challenges a control, and a company may change it because the suggestion makes sense. Glenn said of companies that respond that way, "those are the types of people that aren't getting claims."

Coverage gaps are narrowing. Policies now being placed for stablecoin issuers include protection against fraudulent minting, and elements of DeFi cover, still developing, would not have existed several years ago. But availability and value are separate questions. Glenn repeated an old adage: "everything is insurable at a price." A buyer might pay a 90% premium. Some do pay very high premiums because they need a policy to satisfy an investor, in which case they are not buying it for risk management.

His advice to crypto native companies was to treat the broker as a friend and start discussing a strategy early, though Aon will work with a company at any stage. Its role, he said, is to help clients understand the life cycle of their risk and the available solutions. Its scale also matters: if something exists in traditional insurance, such as credit or counterparty risk cover, there is a good chance it has been done for the digital asset industry or can be.

Treat underwriting as a review of your controls. Keep signing policies, wallet access, approvals and reconciliations documented and current. Each answer to an underwriter should point to an existing record.

Evidence that your controls operate

Underwriters, auditors and investors ask many of the same questions: who can move funds, where assets sit, how transactions were approved and whether the books reconcile.

Answering them takes one record across wallets, accounts and counterparties, spanning stablecoins and fiat. At Range, we build controls that apply before money moves, with monitoring, reconciliation and reporting drawing on the same data.

If you are preparing to show an underwriter, auditor or investor how your controls operate, talk to us: See how Range supports stablecoin operations

About Aon

Aon is a global professional services firm that helps clients make better risk and people decisions. Its Digital Asset Practice works with digital asset companies, institutional investors, technology providers and traditional organizations adopting blockchain, helping them manage custody, cyber, operational, management and professional liability, and staking risk, and connecting them to insurance capacity worldwide. Learn more at aon.com.

Want to appear on Range Stablecoin Fireside? If you are building with stablecoins and want a seat on the show, get in touch by email or on X.