What Insurance Does a New RIA Need?

The short answer: No federal rule requires an RIA to carry errors and omissions insurance, but Oregon and Oklahoma require it of state-registered advisers, at $1 million or more, and custodians can require it too. A new RIA weighs four kinds of protection: E&O for claims over professional mistakes, cyber coverage for breaches, the surety bond some states require when a firm with custody or discretion falls short of a minimum net worth, and the ERISA fidelity bond for anyone who handles retirement plan money. Which ones apply depends on where the firm registers, what authority it holds over client assets, and whose plans it serves.

The four kinds of coverage, side by side

Is E&O insurance required for an RIA?

There is no federal requirement for an RIA to carry errors and omissions insurance. At least two states require it of advisers they register. Oregon's statute requires every applicant for a license or renewal as a state investment adviser to file proof of an E&O policy of at least $1 million, with an exemption for advisers whose principal place of business is in another state, and its rule bars policy exclusions for investment management services performed in Oregon. Oklahoma requires an adviser registering with it to show a policy of at least $1 million per claim, to file proof every year, and to notify the state immediately if the policy is cancelled or substantially changed. In July 2026 Washington's Securities Division proposed the same $1 million per-claim requirement for the advisers it registers, with compliance due by January 1, 2027 if the rule is adopted as proposed.

E&O responds to claims that the firm's advice, analysis or paperwork went wrong, and can pay settlements, judgments and the costs of a regulatory investigation. Common exclusions include criminal or intentional misconduct, property damage, and incidents that began before the policy was in place. Premiums vary with the firm, its services and the limits chosen, and what an independent RIA platform actually costs sets out the rest of a practice's costs.

What does cyber coverage pay for?

Cyber coverage is written for the breach itself. First-party coverage typically pays the firm's own costs: legal counsel on notification duties, recovery of lost or stolen data, client notification and call centers, lost income from business interruption, crisis management, cyber extortion and forensic investigation. Third-party coverage typically pays the claims that follow, including payments to those affected, settlements and judgments, and the costs of responding to regulators.

For SEC-registered advisers, the amended Regulation S-P adds a duty the coverage helps pay for: written procedures to detect, respond to and recover from unauthorized access to customer information, and notice to affected individuals as soon as practicable and within 30 days. Smaller entities had to comply by June 3, 2026. A state-registered firm checks its own state's rules.

When does a state require a surety bond?

The NASAA model rule ties bonds to custody, discretion and net worth. Under it, a state-registered adviser with custody of client funds or securities keeps a minimum net worth of $35,000, one with discretionary authority but no custody keeps $10,000, and a firm below the minimum is bonded for the shortfall, rounded up to the nearest $5,000. The model rule also lets a state set a bond for any adviser with custody or discretion, based on its number of clients and assets under management. A firm with custody solely because it deducts its fees from client accounts, and that meets the rule's conditions, is excused from the net worth and bonding requirements; how custody actually works explains what counts as custody.

States set their own versions. New Jersey asks an adviser with custody for $35,000 of net worth or a $35,000 surety bond, plus annual audited financial statements. Oregon requires state investment adviser applicants to file a surety bond or letter of credit in an amount set by rule, capped by statute at $100,000. SEC-registered advisers have no minimum net worth or bonding requirement, which is one more difference that turns on where a firm registers, as what a small RIA is sets out.

Who needs an ERISA fidelity bond?

Section 412 of ERISA requires every person who handles the funds or other property of an employee benefit plan to be bonded unless an exemption applies, and the bond protects the plan against fraud or dishonesty. It is a separate product from fiduciary liability insurance, which covers losses from breaches of fiduciary duty. An investment adviser is subject to the bond only if it handles plan funds or property. An adviser who gives advice without discretionary authority to buy or sell for the plan is not required to be bonded solely for that advice.

The amount is at least 10% of the funds handled in the preceding year, with a $1,000 minimum, and the Department of Labor cannot require more than $500,000 per plan, or $1,000,000 for plans holding employer securities. The surety must be on the Treasury Department's list of approved sureties, the bond cannot carry a deductible, and a service provider can buy its own bond insuring the plan.

What do custodians and platforms require?

They set their own terms. In 2021 one of the largest custodians told the RIAs it serves that they must carry $1 million of E&O coverage plus protection for social engineering, hacker theft and, where applicable, employee theft. Requirements differ by custodian and platform, so ask for them in writing during the search; how to choose an independent RIA platform covers the rest of that diligence.

Coverage is one line in starting your own RIA, placed alongside counsel, the policies and the cybersecurity framework that Winthrop's RIA Search & Launch sequences against the registration clock. The RIA Launch Checklist lays the steps out on paper, and the advisor never pays Winthrop. Request an introduction.