Standalone products that respond to a breach of cyber security (a malicious electronic attack) are coded to the cyber risk codes; loss of or damage to electronic data is not physical damage for this purpose. From the 2026 year of account the direct and facultative codes are split by territory: CY (cyber security, data and privacy breach, no physical damage) and CZ (the same where physical property damage is covered) now carry US exposures, and the new codes CG and CH carry the corresponding non-US exposures, all methods of placement, with the US or non-US choice made under section 3.5 of the guidance and Market Bulletin Y4886; the new codes are used in the 2026 business planning process and do not change 2025 or earlier reporting. Since the 2024 year of account inwards treaty reinsurance is coded RY or RZ, and the direct codes apply only to insurance and single-risk reinsurance such as facultative. From the 2027 year of account the code WY is used for affirmative cyber war cover, on or with standalone cyber policies or for affirmative war-only policies (all placements except treaty); WY is never approved as a way to use Type 4, 6 or 7 clauses, which stay governed by Y5433. Package policies whose predominant exposures are non-cyber may keep their existing codes, but where the lead underwriter judges cyber the predominant or a material peril the relevant portion of exposure, premium and claims is coded separately. In political violence and terrorism policies, including war, every form of cyber risk must be affirmative and coded to a cyber code regardless of materiality, and Lloyd's expects those policies to use cyber capability to assess, price and code the cover.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.