No mention of what was done when the policy was sold. Most insurance companies do a check to minimize their liability. I would think that the insurance company

No mention of what was done when the policy was sold. Most insurance companies do a check to minimize their liability. I would think that the insurance company would do a PCI and whatever other audits are used to verify security of the financial institution before writing a policy. An audit (and corresponding mitigation) would save the bank money on their insurance cost.