Skip to main content
Readiness Authority
Category: Policy Exclusions

Territorial Exclusion

Also known as: Territorial Exclusion Clause, Territory Exclusion, Model Territorial Exclusion
Simply put

A territorial exclusion is a clause in an insurance policy that removes coverage for losses or liabilities connected to specific countries or geographic areas. For example, some policies have used territorial exclusions to carve out losses tied to entities, property, or people located in particular jurisdictions such as Belarus, Russia, and Ukraine. If a loss falls within the excluded territory, the insurer will typically not pay for it, even if the loss would otherwise be covered.

Formal definition

A territorial exclusion is a policy provision that restricts the geographic scope of coverage by excluding loss, damage, liability, cost, or expense arising from, caused by, or connected to specified territories, or to entities, properties, or individuals located within them. Insurance market bodies have published both named-territory forms (for example, one addressing Belarus, Russia, and Ukraine) and 'blank' model versions into which specific jurisdictions can be inserted, allowing insurers to tailor the excluded geography per risk. The exclusion can apply to both first-party and third-party exposures depending on the wording, and its precise operation, including how 'located in' or 'arising from' a territory is construed, depends on the specific clause language, any endorsements, and the governing jurisdiction. Territorial exclusions in a broadly analogous conceptual sense also appear outside insurance, such as in treaty practice where a treaty's territorial scope of application may be expanded or restricted; that usage is distinct and out of scope for insurance coverage analysis.

Why it matters

Territorial exclusions determine whether otherwise-covered losses will be paid based on where the loss, the affected entity, property, or person is connected geographically. For risk managers and brokers, this makes the exclusion a decisive factor in coverage analysis: a policy may respond to a given peril in one jurisdiction and provide nothing for the identical event in an excluded territory. Because the exclusion can be drafted to reach both first-party exposures (such as the insured's own property or business interruption losses) and third-party liabilities depending on the wording, its scope must be read carefully rather than assumed.

The practical significance grew as insurance market bodies published standardized forms addressing specific geographies. Following heightened conflict-related exposure, the Lloyd's Market Association published a territorial exclusion for Belarus, Russia, and Ukraine (LMA5583A) alongside a 'blank' model version into which insurers can insert other jurisdictions. This standardization means that similar or identical language can appear across many programs, so understanding how one such clause operates helps in interpreting others, though the presence of a model form does not guarantee uniform application, since endorsements and governing law affect construction.

Because coverage turns on interpretive phrases such as 'located in' or 'arising from' a territory, disputes can arise over whether a loss is sufficiently connected to an excluded jurisdiction to be caught. Whether a particular loss falls inside or outside the exclusion is ultimately subject to the specific wording, any endorsements, and the governing jurisdiction, so parties should not treat the exclusion's reach as self-evident from its title alone.

Who it's relevant to

Insurance brokers and underwriters
Brokers must identify when a territorial exclusion is attached, understand whether it uses a named-territory form (such as LMA5583A for Belarus, Russia, and Ukraine) or a 'blank' model with inserted jurisdictions, and explain the resulting coverage gap to clients. Underwriters use these clauses to tailor the excluded geography per risk. Both should note that the exclusion's reach depends on triggering language and governing law rather than the clause title alone.
Risk managers
Risk managers with operations, property, personnel, or counterparties connected to excluded territories need to assess whether otherwise-covered losses, potentially including both first-party losses and third-party liabilities depending on the wording, would fall outside the policy. Insurance is only one element of a risk strategy; a territorial exclusion may leave exposures that call for mitigation, avoidance, or acceptance rather than transfer.
Legal and compliance professionals
Because coverage can turn on how phrases such as 'located in' or 'arising from' a territory are construed, legal and compliance staff may be involved in interpreting the exclusion's scope, evaluating endorsements, and considering the governing jurisdiction. They should also distinguish the insurance meaning of 'territorial exclusion' from unrelated uses of the phrase, such as in treaty practice.

Inside Territorial Exclusion

Geographic scope limitation
A provision that restricts or removes coverage for losses arising from events, parties, or activities connected to specified countries, regions, or jurisdictions. The precise reach depends on the exact wording of the endorsement or clause and how the insured's operations map to those geographies.
Triggering nexus language
Wording that defines what connection to the excluded territory activates the exclusion, such as the location of the insured, the location of the loss, the situs of the affected data or systems, or the residence of affected data subjects. Because cyber events frequently span multiple jurisdictions, how this nexus is drafted materially affects application.
Interaction with sanctions and compliance provisions
Territorial exclusions often operate alongside separate sanctions clauses. They are distinct mechanisms: a territorial exclusion removes coverage for defined geographies, while a sanctions clause addresses the insurer's ability to pay under applicable trade and sanctions regimes. The specific wording determines whether and how they overlap.
Application across first-party and third-party coverage
A territorial exclusion may apply to first-party losses (such as the insured's own business interruption or data restoration tied to an excluded region) and to third-party liability (such as privacy claims or regulatory defense arising in an excluded jurisdiction). Whether it reaches one or both categories is subject to the specific policy wording.
Carve-backs and exceptions
Some forms include exceptions that preserve limited coverage despite the territorial exclusion, for example for incidental exposure or for transiting data. The availability and breadth of any carve-back depends entirely on the endorsement language and any negotiated amendments.

Common questions

Answers to the questions practitioners most commonly ask about Territorial Exclusion.

Does a territorial exclusion mean my policy won't respond to any incident that originates overseas?
Not necessarily. A common misconception is that a territorial exclusion bars coverage whenever an attack, threat actor, or affected system is located abroad. In practice, these clauses are drafted around defined concepts such as where the loss is sustained, where the insured operates, where a claim is brought, or where data resides, rather than simply where an attacker sits. Because most cyber events involve infrastructure or threat actors spread across multiple jurisdictions, the origin of an attack is often not the operative trigger. Whether coverage responds depends on the specific wording of the exclusion and any coverage territory or worldwide-operations language elsewhere in the policy. You should read the exclusion together with the definitions and the coverage territory provisions rather than in isolation.
Is a territorial exclusion the same thing as a war or state-backed cyber exclusion?
No. These are distinct provisions that are sometimes confused because both can limit coverage for events with an international dimension. A territorial exclusion is generally concerned with geography, meaning the location of the insured, the loss, the claim, or the affected assets. A war or hostile-act exclusion is concerned with the nature or attribution of the event, meaning whether it arises from war, warlike action, or state-sponsored activity. The two can interact within a single claim, but they are not interchangeable, and satisfying one analysis does not resolve the other. Each must be assessed on its own wording, and different insurer forms define both categories in different ways.
How do I confirm which territories my cyber policy actually covers?
Review the coverage territory definition and any territorial or jurisdictional exclusions together, since one may broaden and the other narrow the geographic scope. Check how the policy defines the operative connecting factor, such as where the loss is sustained, where the insured is domiciled or operates, where a claim or suit is brought, or where affected data or systems are located, because these tests can produce different outcomes. Also examine whether first-party coverages (such as business interruption or data restoration) and third-party coverages (such as privacy liability or regulatory defense) carry different territorial scopes, as they sometimes do. Where the wording is ambiguous, seek written clarification from your broker or insurer before binding rather than relying on assumptions.
My organization has operations or data in multiple countries. How should a territorial exclusion factor into placement?
Map your operational footprint, data locations, and the jurisdictions in which claims or regulatory actions against you could realistically arise, then compare that map against the policy's coverage territory and any territorial exclusions. Pay particular attention to whether cloud-hosted data or processing in a jurisdiction could fall outside the covered territory even if your headquarters does not. Consider whether an endorsement expanding the coverage territory is available and appropriate. Because the practical effect turns on the specific wording and on how the connecting factor is defined, this is best worked through with your broker on a jurisdiction-by-jurisdiction basis rather than assumed to be handled by a general worldwide reference.
What is the relationship between a territorial exclusion and my ability to transfer international cyber risk?
A territorial exclusion can leave a gap in risk transfer for exposures tied to certain jurisdictions, meaning that even a placed policy may not respond to losses or claims with the excluded geographic connection. This is a limitation of the insurance as a risk transfer mechanism, and it does not affect the underlying likelihood of an incident. Where an exclusion removes coverage for a jurisdiction where you have material exposure, you are effectively retaining or accepting that risk unless it is addressed through an endorsement, a locally admitted policy, or another arrangement. Identifying these gaps before an incident allows you to decide whether to transfer, mitigate, or knowingly accept the residual exposure.
During a claim, how is a territorial exclusion typically assessed?
Assessment generally focuses on the connecting factor the exclusion uses and whether the facts of the specific loss or claim fall within it, subject to the exact wording and the governing law of the policy. Because cyber events frequently touch multiple jurisdictions at once, disputes can arise over which location controls, for example the place where the business interruption was suffered versus where the compromised system was hosted. The interaction with the coverage territory definition, other exclusions, and any endorsements is also relevant. Outcomes can vary with jurisdiction and with how courts or regulators in the relevant forum interpret the language, so early engagement with coverage counsel and your broker is advisable when a territorial question is in play.

Common misconceptions

A territorial exclusion only concerns where the insured is physically located.
Depending on the wording, the exclusion may key off the location of the loss, the situs of affected systems or data, or the jurisdiction of affected individuals, not merely the insured's domicile. In cyber events that cross borders, coverage can be affected even for an insured based outside the excluded territory. The determinative factor is the triggering nexus language in the specific policy.
A territorial exclusion and a sanctions clause are the same thing.
They are distinct mechanisms. A territorial exclusion removes coverage for losses connected to defined geographies, while a sanctions clause addresses the insurer's legal ability to provide coverage or make payment under applicable sanctions regimes. A policy may contain both, and each must be read on its own terms.
If the policy is silent on carve-backs, some coverage for excluded regions will still be available.
Absent explicit carve-back or exception wording, a territorial exclusion is typically applied as drafted. Whether any residual coverage exists depends on the exact language, applicable endorsements, and jurisdiction rather than on an assumption of implied coverage.

Best practices

Map the organization's operations, data flows, system locations, and customer or data-subject populations against the territories named in the exclusion to identify where coverage could be affected.
Read the triggering nexus language carefully to determine whether the exclusion keys off the insured's location, the situs of the loss, the location of data or systems, or affected individuals, since cyber events commonly span jurisdictions.
Confirm whether the exclusion applies to first-party coverage, third-party coverage, or both, and document how it interacts with any separate sanctions clause in the same policy.
Identify and evaluate any carve-backs or exceptions, and where exposure gaps exist, discuss negotiating amended wording or targeted endorsements with the broker and underwriter.
Involve legal and compliance colleagues to assess how the exclusion may be applied differently across relevant jurisdictions and how it aligns with the organization's regulatory obligations.
Recognize that a territorial exclusion is a risk-transfer limitation, not a substitute for risk mitigation; maintain resilience and incident response measures for operations in excluded regions where coverage may be unavailable.
Promotional banner for the Pentest Readiness checklist download