It is a question we are hearing more frequently from Singapore startups: a growth investor or enterprise client has raised the topic of insurance during a funding conversation or contract discussion, and the founding team wants to understand what is actually expected before the next conversation.
The question is a reasonable one. Insurance is rarely discussed in the early stages of building a company, and the requirements that emerge during a fundraise or a commercial negotiation can be unfamiliar. This post explains what growth investors and enterprise clients typically look for, what contracts commonly require, and why the timing of when a startup puts its insurance programme in place matters as much as what it contains.
Why insurance has become part of the investor conversation
Growth investors, whether institutional venture capital funds or family offices backing Series A and later rounds, are increasingly treating insurance as a governance indicator rather than purely a risk transfer mechanism. When a fund puts a partner on a company's board, that partner is personally exposed to the decisions made at board level. Directors and Officers (D&O) insurance is the product that addresses this personal exposure, and it is the cover that institutional investors most commonly ask about before a financing round closes.
Based on global market practice for institutional venture investment, D&O is typically expected to be in place by the time a company closes an institutional financing round, particularly at Series A and beyond when independent board members are appointed. The reason is structural: a board member who is asked to vote on strategy, acquisitions, or major expenditure without D&O in place is carrying personal liability for those decisions with no financial backstop.
Beyond D&O, investors with exposure to technology, data, or regulated sectors are increasingly reviewing a company's cyber insurance position as part of due diligence. A startup that holds significant customer data, processes payments, or operates a platform that clients depend on carries cyber risk that can materialise as regulatory action, third-party liability, or operational disruption. Institutional investors who have seen portfolio companies navigate cyber incidents understand that an uninsured event can consume management attention, damage client relationships, and affect the company's ability to operate and fundraise in a compressed timeframe.
A further consideration that is less widely discussed: the cyber insurance application process itself functions as a proxy for a startup's security maturity. An insurer who declines to offer cyber coverage, or who quotes a premium reflecting elevated risk, is signalling that the company's security practices may warrant further scrutiny. An investor who reviews a startup's cyber insurance position during diligence is also, in effect, receiving a market assessment of the company's cyber hygiene.
For startups with employees, investors may also ask about Work Injury Compensation (WIC) insurance, which is a statutory requirement under Singapore's Work Injury Compensation Act for employees in mandatory categories, and about whether workforce obligations are correctly structured.
What contracts commonly require
Investor expectations and contractual requirements address different moments in a startup's commercial life. While investor expectations arise at fundraising, contractual requirements arise when the startup signs an agreement with a client, a government agency, a financial institution, or a large corporate counterparty.
The most common insurance requirements in Singapore commercial contracts fall into the following categories.
Professional indemnity insurance is required in contracts where the startup is providing professional services, software, a platform, or advisory work, and where an error, omission, or failure to deliver could cause the client financial harm. The contract typically specifies a minimum indemnity limit and may require the policy to be maintained for a defined period after the contract ends, reflecting the claims-made nature of most PI policies. For technology startups, the policy wording needs to extend to software products and system deliverables, not only professional advice, since a standard PI policy may not cover errors in code or platform failures.
Cyber insurance is increasingly specified by financial institution clients, healthcare clients, and government agencies. MAS's Technology Risk Management framework requires financial institutions to impose contractual protections on their technology vendors, including security obligations, audit rights, and incident notification requirements. Separately, in April 2025, MAS and the Cyber Security Agency of Singapore announced that they are assessing whether to require vendors to hold the CSA's Cyber Essentials or Cyber Trust mark certification before they can participate in government procurement processes involving sensitive data or systems. This assessment has not concluded and the requirement is not yet in force as at July 2026, but it reflects the regulatory direction of travel for technology vendors serving the public sector.
Public liability insurance is a standard requirement in contracts that involve the startup's personnel accessing client premises, operating at client sites, or conducting activities in public spaces. Most commercial leases in Singapore also require tenants to hold public liability cover at a minimum specified limit as a condition of the tenancy. Minimum limits in commercial contracts range from S$1 million to S$5 million depending on the nature of the activities and the risk appetite of the counterparty.
Directors and Officers insurance is sometimes specified in shareholders agreements, investment agreements, and joint venture contracts as a condition that the company must maintain throughout the term of the agreement. Where an investor or joint venture partner has board representation, they may require the company to hold D&O cover at a specified minimum limit as a contractual obligation, not only as an investor expectation.
Product liability insurance is required in contracts where the startup supplies a physical product or a product with a physical component. A startup supplying hardware, medical devices, consumer goods, or any product that could cause injury or damage if it fails needs product liability cover, and most enterprise and retail distribution contracts will specify this as a condition of supply.
Why the timing of putting cover in place matters
Two features of professional indemnity and D&O insurance create a timing consideration that is worth understanding before a fundraise or a contract negotiation begins.
Both products are written on a claims-made basis. This means the policy that responds to a claim is the one in force at the time the claim is first made against the company or its directors, not the policy in force when the underlying act or event occurred. A company that puts D&O in place at Series A, having operated for two years without it, will hold a policy with a retroactive date at or near the Series A inception date. A claim arising from a board decision made before that date falls outside the coverage window.
A company that puts D&O and PI in place at an early stage, close to incorporation, captures a retroactive date that covers the full period of the company's operations. This means that professional acts, board decisions, and governance conduct from the earliest stage of the company's life fall within the coverage period of the claims-made policy. The earlier the policy is in place, the further back the coverage window extends.
This has a practical implication: waiting until a fundraise is imminent or a contract requires it to arrange PI and D&O for the first time means the policy covers only forward-looking acts. The period before the policy was in place is uninsured on a claims-made basis, even after the policy is arranged.
The same consideration applies to cyber insurance. An insurer underwriting cyber coverage for the first time will assess the company's current security posture. A company that has operated for two years without documented security practices, incident response procedures, or data protection policies may find the underwriting process more complex and the resulting policy more restricted than one that has maintained these practices from an early stage.
What a well-structured startup insurance programme looks like
A startup's insurance programme should reflect its stage, its business model, and the obligations it has taken on through its contracts and its shareholder agreements. There is no single standard programme, but the most common structure for a Singapore technology or professional services startup that is approaching or has completed an institutional fundraise covers the following.
D&O insurance covering the personal liability of directors and officers for decisions made in their capacity as decision-makers, at a limit that reflects the scale of the company and the expectations of its investors and board members.
Professional indemnity or technology professional indemnity insurance covering claims arising from errors, omissions, or failures in the professional services or technology products the company delivers, at a limit that reflects the value of the contracts the company holds and the potential financial harm a failure could cause to clients.
Cyber insurance covering first-party incident response costs and third-party liability for data breaches and system failures, at a limit that reflects the volume and sensitivity of the data the company holds and the operational impact of a disruption.
Public liability insurance covering third-party bodily injury and property damage arising from the company's business activities, at a minimum limit that meets the requirements of the company's commercial leases and client contracts.
WIC insurance covering the statutory obligations of the company as an employer under Singapore's Work Injury Compensation Act, for all employees in mandatory categories.
The structure above is not a product recommendation. It is a description of the coverage dimensions that commonly arise in investor due diligence and commercial contract requirements for Singapore startups. The appropriate limits, policy wordings, and specific products for any company depend on that company's specific circumstances and should be reviewed with a qualified insurance adviser.
You can read more about our D&O cover, professional indemnity cover, cyber insurance, public liability cover, and WIC cover on the products page.
If you are a Singapore startup approaching a fundraise or negotiating a significant commercial contract and would like to understand what your insurance programme should look like for your specific stage and business model, we would be glad to work through it with you.
This article provides general information only. It is not insurance, legal, financial, or investment advice. Regulatory requirements cited reflect the position as at July 2026 and are subject to change. References to investor expectations reflect general market practice observed globally and in Singapore and do not constitute advice on fundraising, corporate governance, or securities matters. The MAS and CSA Cyber Trust mark assessment referenced reflects a joint announcement dated April 2025 and does not represent a current mandatory requirement. Policy availability, terms, conditions, and exclusions vary by insurer and product, and cover is subject to the full policy wording. Founders and directors should seek qualified legal, financial, and insurance advice specific to their circumstances. Please contact TZY CO for advice on your specific insurance situation.