Best Crime Insurance for Nonprofits (2026)

Spot lists a provider only when its published Crime Insurance information includes a documented claim (verified or company-reported) about eligibility, role, coverage or application that mentions nonprofits. “Named for Nonprofits” marks a provider’s own statement of who it serves; “Related mention” marks a role, coverage or application claim.

Providers with both a Spot Score and a Review Score rank first, then providers with one of the two, then providers with neither. Within each group the order is the equal-weight average of the scores the provider has, as in the industry guides; ties break on fit, then the number of documented claims, then name.

The Spot Score comes from Spot’s reliability assessments and the Review Score from the provider’s rated review sources. Neither measures whether a policy fits your business or what it costs. How Spot Scores work.

Spot, a product of Tools for Enlightenment, publishes this research and works in the commercial insurance market. Editorial policy.

In the Association of Certified Fraud Examiners' 2024 study, nonprofit organizations, including non-governmental organizations, were 10% of cases and had the lowest median loss, USD 76,000. Across all organizations in the study the typical scheme ran 12 months before it was detected, and 43% of frauds were found by a tip. ACFE's cases come from fraud examiners it surveyed, so the figures describe cases those examiners handled, not how often fraud happens, and the duration and tip figures are not nonprofit-specific.¹

Two state attorneys general put asset safeguards on the board. California's attorney general says directors may be accountable for the misappropriation, waste or misuse of charitable assets if the loss resulted from deficient or nonexistent internal controls, among other causes, and lists among a director's responsibilities making certain the charity is properly using any restricted funds. New York's attorney general says every organization should have procedures that ensure no single individual is responsible for receiving, recording and depositing funds and for writing and signing checks, and that restrictions on the use of funds, such as contributions given for a restricted purpose, are obeyed.^3,4

Some funders require a fidelity bond. Texas's Public Safety Office, part of the Office of the Governor, says each non-profit corporation receiving its grant funds must hold a blanket fidelity bond covering the entire grant amount including matching funds, and that general liability, directors and officers and fiduciary coverage do not satisfy the requirement. Oregon's model clause for state grant agreements says the grantee shall provide employee dishonesty or fidelity bond coverage for dishonest acts of its employees, with the limit left blank. Federal rules make the cost of bonding required by a federal award allowable. Texas and Oregon word the requirement differently, so your own funding agreement is the one that counts.^6,7,8

Volunteers who handle money may fall outside a crime policy's definition of employee. In ISO's 2005 crime discovery form, as hosted by a brokerage's site, the core definition of an employee is someone you compensate directly by salary, wages or commissions and have the right to direct and control, with listed additions such as temporary and leased workers, interns, and directors or trustees performing employee duties or serving on a board-appointed committee, and the word volunteer does not appear in the form. California's attorney general lists misappropriation by a volunteer among the risks of using volunteers, and the IRS tells organizations to report diversions by volunteers. The Nonprofit Risk Management Center says, in a 2007 article, that you may be able to extend a crime policy to cover volunteers.^2,3,9,11

In both ISO forms, coverage for a dishonest employee ends when you learn of the dishonesty. The 2005 form's employee theft insuring agreement terminates as to any employee as soon as you, or any officer, director or trustee not in collusion with the employee, learns of theft or any other dishonest act by that employee; the 2022 edition ends the whole policy as to that person and adds an employee in your human resources department as a trigger. The 2022 edition, as hosted by a carrier, ties the discovery of a loss to a designated person, a term that includes directors, trustees and officers. Under either form, once someone in those groups learns of an employee's dishonesty, coverage for that employee ends.^9,10

A loss has to be proved, and by a deadline. The 2005 form defines discovery as when you first become aware of facts that would cause a reasonable person to assume a covered loss has been or will be incurred, even if the amount is unknown. Both forms require a detailed, sworn proof of loss within 120 days. The 2022 edition, under its employee theft, ERISA and client theft insuring agreements, also excludes loss whose existence or amount depends on an inventory computation or a profit and loss computation, unless you establish the loss apart from those computations.^9,10

Payment fraud has its own conditions. The FBI's Internet Crime Complaint Center recorded 21,442 business email compromise complaints and about $2.77 billion in reported losses in 2024, without breaking out nonprofits. In the 2022 edition, a condition on the fraudulent impersonation insuring agreement says you must make a reasonable effort to verify a transfer instruction or change of account request, not through email, and document the result before transferring any property. The FBI advises verifying account changes through a secondary channel and, after a fraudulent transfer, contacting your financial institution immediately to request a recall.^10,12,13

Ask who counts as an employee, in writing. Ask whether volunteers, committee chairs, the treasurer and event teams are included, for which acts, and whether the quote adds coverage for volunteers. Both ISO forms cited here start from pay and control but add listed groups such as temporary and leased workers, interns, and directors or trustees doing employee work; your own policy's wording may differ and is what governs.^9,10,11

Size the limit to the cash and other property you actually hold. Oregon's state risk management office, in its guidance on setting limits for state contracts and grant agreements, says that as a baseline, limits should equal or exceed the maximum amount of cash, negotiable securities or vulnerable property at risk at any time. Work out the most you could have at risk at once. Pair the policy with the controls regulators recommend: Oregon's justice department says bank statements should be reconciled monthly by someone who does not issue or sign checks and that event cash should be accepted and recorded by two people with a third arranging the deposit, and California's attorney general says checks should never be pre-signed.^3,5,7

Match the policy to your funder's wording. Texas's Public Safety Office says employee dishonesty insurance, which it also calls a fidelity bond, is sometimes referred to as a financial institution bond, a commercial crime policy or an employee dishonesty bond, and that the bond should cover at least the grant period. Ask your funder to confirm the wording and limit it accepts before you bind.⁶

Plan for the claim and the filings. California's attorney general says a charity should consult its insurance carrier on whether an embezzlement loss is covered, that some insurance policies include coverage of employee theft and dishonesty, and that the loss must be reported on Form 990 Part VI, item 5, for full 990 filers and, in California, on Form RRF-1. The IRS asks about significant diversions, measured before insurance recoveries.^2,3