When the Boston retail producer's Class 1 manufacturer renewal includes a cyber-coverage component that admitted-market carriers decline (cyber appetite tight across admitted-market carriers in 2026, particularly for industrial-IoT-connected manufacturing operations whose OT/IT convergence creates a risk surface that admitted-market underwriters have decided not to write at standard terms), the workflow shifts from retail renewal into surplus-lines wholesale placement. The retail producer hands off the cyber piece to a wholesale broker (Amwins, RT Specialty, CRC Insurance Services - the three dominant U.S. wholesale brokers in 2026). The wholesale broker accesses MGA delegated-authority markets including Coalition for cyber. Coalition issues a cyber binder with the affirmative AI endorsement (Coalition's 2026 affirmative-AI policy language explicitly addresses AI-driven cyber incidents and differentiates from competitor silent-AI exclusions). Surplus-lines tax plus stamping-office compliance fires per the insured's home-state rules. Bordereau reporting back to the fronting carrier (capacity provider) occurs on the agreed monthly or quarterly cadence. This lesson is the artifact-level build of the surplus-lines wholesale placement workflow with the worked Class 1 manufacturer cyber scenario, the Send + Amwins / RT / CRC platform comparison, the Coalition cyber binder structure including the affirmative AI endorsement language, the surplus-lines tax and stamping compliance workflow with Massachusetts as the worked home-state, and the bordereau reporting flow back to the fronting carrier. The detailed cross-state stamping-office workflow follows in Lesson 13 with the FSLSO / SLTX / SLA / ELANY / SOI map.

When Surplus-Lines Wholesale Fires

Surplus-lines (also called E&S, excess and surplus lines) placement fires when admitted-market carriers decline or refuse to quote. Triggers: appetite-out (NAICS or operation class is not in admitted-market appetite), capacity-out (admitted limits are insufficient for the risk size), terms-out (admitted exclusions exclude required coverage), pricing-out (admitted pricing is uncompetitive against surplus-lines alternatives). Cyber coverage in 2026 sees frequent admitted-market refusal on industrial-IoT-connected manufacturing, on multi-location healthcare, and on financial-services entities with offensive-AI exposure (AI-driven decisioning that could itself become the loss vector).

The Class 1 manufacturer cyber piece. The Boston Class 1 manufacturer has industrial-IoT-connected CNC machines, heat-treatment equipment with embedded controllers, ERP-connected inventory and quality systems, and remote-access maintenance contracts with equipment OEMs that allow vendor connections into the OT environment. Admitted-market cyber carriers decline on the industrial-IoT exposure (concern over OT/IT convergence risks, particularly when a vendor-introduced compromise can cross from IT into OT and produce property damage or business interruption that the cyber policy may or may not address). The retail producer hands the cyber piece off to a wholesale broker; the cyber placement moves to the surplus-lines market via Coalition (an MGA with delegated authority from carrier capacity providers including Lloyd's syndicates and traditional insurers).

The Amwins / RT Specialty / CRC Insurance Services Comparison

Three dominant U.S. wholesale brokers in 2026. Each has different capacity relationships, specialty depth, and AI deployment.

Amwins. Largest U.S. wholesale broker by revenue. Strengths: breadth across specialty lines (cyber, professional liability, environmental, transportation, energy, marine, healthcare professional, financial institutions, public entity), deep carrier-relationships with capacity providers including direct relationships with multiple Lloyd's syndicates and the Bermuda excess market, mature AI deployment including AI-assisted clearance, AI-assisted carrier-matching, and AI-assisted bind documentation. Pricing structure: wholesale commission typically 12.5-15% of premium with capacity arrangements varying by line and capacity provider. 2026 deployments: AI clearance reduces submission-to-quote elapsed time by 30-50% per Amwins' published agency case studies.

RT Specialty. Second-largest U.S. wholesale broker. Strengths: cyber, professional liability, and environmental specialty depth, MGA delegated-authority relationships with multiple capacity providers including Coalition for cyber, AI deployment focused on submission triage and carrier-matching, and a casualty practice that handles complex GL placements that admitted markets cannot or will not write. Wholesale commission similar 12.5-15% with line-specific variation.

CRC Insurance Services. Third-major U.S. wholesale broker. Strengths: broad specialty distribution, regional U.S. depth including strong middle-market coverage outside the major metros, AI deployment focused on AI-assisted underwriting support to capacity providers and AI-assisted bind workflow, and a property practice strong on cat-exposed risks. Commission similar 12.5-15%.

The retail broker's wholesale choice. Retail brokers maintain relationships with multiple wholesale brokers; for any given submission, the retail broker chooses based on specialty depth (cyber routes to Amwins or RT typically; complex GL routes to RT or CRC; cat-exposed property routes to CRC or Amwins), carrier relationships (which wholesale has access to the right capacity provider for the risk), and historical service quality. For the Class 1 manufacturer cyber piece, the retail broker selects Amwins or RT based on Coalition access and industrial-IoT cyber expertise. The wholesale broker named on the submission matters because the carrier appetite the wholesale can access determines the quote outcome.

Send - The Wholesale Broker Workflow Platform

Send (the same broker workflow platform from Lesson 11) supports wholesale brokers with specific wholesale-side capabilities through the Send Flow submission management module. Strengths on the wholesale side: real-time MGA capacity tracking across the surplus-lines market, carrier-appetite intelligence beyond what any single wholesale's internal database contains, AI-assisted clearance against the wholesale broker's prior placements plus the carrier-appetite database, AI-assisted carrier-matching for hard-to-place submissions, and a downstream bind-documentation workflow that hands off cleanly to the MGA's policy administration system.

Send's surplus-lines workflow. The retail broker submits to wholesale via the Send Flow secure portal. Send ingests the submission, AI classifies the line of business (cyber, professional liability, environmental, etc.) and the risk characteristics, and AI matches against the wholesale's capacity database. The wholesale broker reviews the AI's matching and decides which markets to approach. Send tracks market responses, manages the quote comparison, and supports the bind workflow. Send's market intelligence on appetite shifts (e.g., Coalition's cyber appetite expansion into industrial-IoT in 2026; Beazley's tightening on healthcare cyber in late 2025; Tokio Marine HCC's increased appetite for manufacturing-class cyber in mid-2026) informs the wholesale broker's market selection in real time rather than via the lagging quarterly broker briefing.

The Send vs. legacy wholesale workflow comparison. Legacy wholesale workflow runs on email plus a wholesale-internal CRM (often Salesforce or AMS360). Send Flow replaces the email triage and adds the AI-assisted classification and matching layer. The cycle-time compression: 30-50% on clearance, 20-40% on submission-to-quote, depending on the line and the complexity of the matching. The 2026 wholesale broker who has not yet adopted Send or a comparable platform is at a structural disadvantage against the wholesale broker who has, particularly on cyber and professional liability where appetite shifts weekly.

Coalition - The Cyber MGA with Delegated Authority

Coalition is a leading cyber MGA in 2026. Architecture: Coalition operates with delegated authority from carrier capacity providers (typically Lloyd's syndicates and traditional insurers including specific Bermuda excess market participants); Coalition handles underwriting, binding, and claims for cyber risks within delegated authority; the capacity providers fund the risk and reinsure as appropriate. Coalition's Control 2.0 platform ingests 829 trillion data points of cyber telemetry to feed the underwriting model; the Activate 2026 incident-response framework provides the bound insured with continuous monitoring and an embedded incident-response capability.

Coalition's cyber product. Cyber liability + first-party cyber + cyber crime + business interruption from cyber + technology errors and omissions. Coverage limits up to $25M aggregate for mid-market accounts; higher limits available via additional placements layered above. Pricing: AI-driven risk scoring based on Coalition's continuous monitoring of the insured's cyber posture (external attack surface, vulnerability disclosures, dark-web exposure, patch status of public-facing systems, endpoint detection coverage on the IT estate, and an emerging OT-monitoring capability through the 2026 Coalition agreement with industrial cybersecurity firms). Premium typically 0.1-0.5% of revenue for industrial-IoT-connected manufacturing, depending on the cyber-posture score.

The Coalition affirmative AI endorsement. The 2026 Coalition policy includes an affirmative AI endorsement explicitly addressing AI-driven cyber incidents: (1) Coverage applies to incidents arising from AI-driven operational technology compromises (an AI agent introduced into the OT environment that causes operational impact). (2) Coverage applies to incidents where an AI system trained on compromised data produces operational impact (data-poisoning attacks on the insured's AI infrastructure). (3) Coverage applies to insider AI-assisted social engineering attacks (deepfake voice or video that produces an authorized wire transfer or system access). (4) Exclusions: nation-state attacks (specific named-state list per the Lloyd's cyber war exclusion family of clauses), war and terrorism exclusions per the industry-standard wording, intentional acts by named insureds. (5) Notification requirements: cyber incident notification within 72 hours of discovery; preservation of forensic evidence including disk images and log files; cooperation with Coalition's incident response team via the Activate 2026 framework. The affirmative AI endorsement is differentiated from competitor cyber policies that may exclude AI-related incidents through silent-AI exclusions; the distinction matters because the silent-AI exclusion creates coverage uncertainty that a courtroom may or may not resolve in the insured's favor.

The Class 1 Manufacturer Cyber Binder

The wholesale broker submits the cyber piece to Coalition via the Send Flow portal. Coalition's underwriting runs through Control 2.0.

Coalition pre-bind underwriting. Coalition's continuous-monitoring service scans the Class 1 manufacturer's external attack surface: DNS records, exposed services, certificate issues, public-facing web applications, dark-web exposure (compromised credentials, mentions in attacker forums, leaked data sets), and patch status of public-facing systems. Output: a cyber-posture score. For the Class 1 manufacturer, the score is 78 (out of 100). Above 70 threshold for standard pricing; below 70 triggers remediation requirements before binding. Coalition's underwriting accepts at standard terms with no remediation requirements; the cyber-posture profile reflects the manufacturer's mature IT security investment over the past three years.

Coalition cyber binder terms. Limits: $5M aggregate cyber liability + $5M first-party + $1M cyber crime + $2M BI from cyber + $2M technology E&O. Retention: $25,000 per incident. Premium: $48,200 annual (calculated from $48M revenue × 0.1% base rate × adjustments for cyber-posture score and the industrial-IoT factor that Coalition applies to manufacturing accounts). The affirmative AI endorsement is included as the standard 2026 form. The effective date is 2026-07-01 matching the parent renewal effective date. The Activate 2026 incident-response framework activates at bind; Coalition's continuous monitoring continues throughout the policy period and feeds the renewal pricing 12 months later.

The bind packet. Coalition issues the binder via Send Flow; the wholesale broker forwards to the retail broker; the retail broker delivers to the client with the binder, the policy declarations, the affirmative AI endorsement, and the activation instructions for the Coalition Activate platform. Client onboarding includes the cyber-posture monitoring access plus the incident-response framework activation; the client's IT or CISO function receives the credentials and the escalation contact list.

Surplus-Lines Tax and Stamping Compliance

Surplus-lines placement triggers surplus-lines tax (varies by state, typically 2-6% of premium) and stamping-office compliance (varies by state - Florida FSLSO, Texas SLTX, California SLA, New York ELANY, Illinois SOI, Arizona SLA-AZ, Georgia GSLA, Washington WSLA). The Class 1 manufacturer headquartered in Cambridge, Massachusetts triggers the Massachusetts surplus-lines tax at 4% of premium and the Massachusetts Division of Insurance stamping requirement.

The surplus-lines tax workflow. The wholesale broker calculates the tax: $48,200 premium × 4% Massachusetts surplus-lines tax = $1,928 surplus-lines tax. The tax is collected from the insured at bind; remitted to the Massachusetts Division of Insurance via the stamping-office process. The retail broker reports the surplus-lines tax to the client invoice as a separate line item so that the client's accounting and the broker's commission base are both transparent.

The stamping-office filing. Coalition produces the policy and the binder; the wholesale broker submits the filing packet to the Massachusetts surplus-lines stamping process. The packet includes: policy declarations + the binder + the surplus-lines affidavit + the tax filing + the diligent-effort affidavit citing three admitted-market declinations. The stamping process stamps the policy as compliant and files in the state record. The stamping fee is separate (typically $25-$100 per filing in Massachusetts, depending on the policy's premium volume).

Diligent-effort documentation. Surplus-lines law in many states requires diligent-effort documentation - proof that the retail broker attempted admitted-market placement before resorting to surplus lines. The documentation: three or more admitted-market declinations from carriers normally writing the class. For the Class 1 manufacturer cyber, the retail broker collected declinations from three admitted-market carriers (Chubb, Travelers, Liberty Mutual) before the surplus-lines referral. The diligent-effort affidavit is signed by the retail broker and filed with the stamping office. Lesson 13 covers the cross-state stamping-office workflow in detail; the diligent-effort requirements vary materially (Texas requires 5 declinations; California, Florida, New York require 3 with specific documentation requirements; Washington is less strict).

Bordereau Reporting Back to Fronting Carrier

Coalition's MGA arrangement requires bordereau reporting back to the fronting carrier (capacity provider) on the agreed cadence - typically monthly. The bordereau contains all policies bound during the period including premium, limits, named insured, geographic location, NAICS, and risk attributes.

The Class 1 manufacturer's bordereau entry. Coalition writes the monthly bordereau to the fronting carrier including the Class 1 manufacturer: named insured (legal name and DBA if applicable), FEIN, effective date 2026-07-01, premium $48,200, limits ($5M aggregate cyber liability plus the component sublimits), surplus-lines tax remitted to Massachusetts ($1,928), retention ($25K per incident). The fronting carrier reconciles the bordereau against the treaty terms in the underlying capacity agreement, collects the premium share, and provides the capacity confirmation that closes the loop.

The fronting carrier's role. The capacity provider (a large insurer or a Lloyd's syndicate) provides the policy paper that Coalition issues under delegated authority. The fronting carrier does not underwrite individual risks (Coalition does), but it takes responsibility for capacity, regulatory filings (including NAIC Schedule F treaty disclosures and the holding-company Form B AI-disclosure additions in 2026), and the reinsurance program above the MGA's per-risk and aggregate retentions. Bordereau reconciliation occurs monthly; quarterly capacity reviews surface emerging exposure concentrations or appetite drift; annual treaty renewals between Coalition and the fronting carriers re-baseline the delegated authority parameters for the next renewal cycle. The 2026 trend is toward more frequent reconciliation and tighter authority caps as fronting arrangements have proliferated and capacity providers have become more demanding about exposure visibility.

The §4 Discipline on the Wholesale Side

NAIC Model Bulletin §4 applies to all insurance conduct including wholesale brokers and MGAs. Coalition's AI-driven underwriting (continuous monitoring + risk scoring + policy pricing through Control 2.0) carries §4 documentation requirements: the cyber-posture score with the rationale (which features drove the score), the pricing factors with attribution (the BI Score Posture features, the OT exposure factor, the industry coefficient), and the policy issuance with the §4 reason chain (which appetite rule the submission matched, which exception fired if any, the affirmative AI endorsement triggers, the bordereau cession entry). The wholesale broker's AI-assisted carrier-matching also carries E&O documentation discipline: which markets were considered, which were approached, the response tracking, and the recommendation rationale that the wholesale broker can defend to the retail broker and ultimately to the insured if a coverage gap dispute emerges downstream.

The MGA delegated-authority dimension. Coalition's authority is delegated by contract from the fronting carrier; the contract specifies what Coalition can write, at what limits, with what risk-acceptance rules, and with what bordereau reporting obligations. The fronting carrier's delegated-authority audit team reviews Coalition's compliance against the contract annually at minimum and on-demand if a concentration emerges. The §4 documentation that Coalition produces feeds the delegated-authority audit; failure to maintain the documentation creates contract-breach exposure for Coalition and the §4 violation that the home-state DOI may pursue against the fronting carrier as the licensed insurer of record.

Key Takeaways

• Surplus-lines wholesale fires when admitted-market carriers decline. Triggers: appetite-out, capacity-out, terms-out, pricing-out. Cyber on industrial-IoT-connected manufacturing in 2026 frequently surplus-lines because admitted-market cyber appetite is tight on OT/IT convergence risks. The retail broker hands off to a wholesale broker; the wholesale broker accesses MGA delegated-authority markets like Coalition.
• Three dominant U.S. wholesale brokers: Amwins (largest), RT Specialty, CRC Insurance Services. All offer 12.5-15% wholesale commission with capacity arrangements varying by line and capacity provider. Specialty depth differs: cyber and professional liability are dominant at Amwins and RT; broader distribution and regional middle-market depth at CRC. The retail broker chooses based on specialty depth, carrier relationships, and historical service quality.
• Send Flow supports wholesale-broker workflow with real-time MGA capacity tracking, carrier-appetite intelligence, AI-assisted clearance against the carrier-appetite database, AI-assisted carrier-matching for hard-to-place submissions. Retail broker submits via secure portal; Send ingests, classifies, and matches; the wholesale broker reviews and decides markets to approach. Cycle-time compression: 30-50% on clearance, 20-40% on submission-to-quote.
• Coalition is the leading cyber MGA in 2026. Architecture: delegated authority from carrier capacity providers; Coalition handles underwriting + binding + claims; capacity providers fund risk and reinsure. Cyber product: cyber liability + first-party + cyber crime + BI from cyber + technology E&O, limits up to $25M aggregate for mid-market. Control 2.0 ingests 829 trillion data points of telemetry; Activate 2026 provides the incident-response framework at bind.
• Coalition's 2026 affirmative AI endorsement explicitly addresses AI-driven cyber incidents. Coverage: AI-driven operational technology compromises, AI systems trained on compromised data producing operational impact, insider AI-assisted social engineering. Exclusions: nation-state attacks per the Lloyd's cyber war exclusion family, war and terrorism per industry-standard wording, intentional acts. 72-hour notification, forensic preservation, Activate 2026 cooperation. Differentiated from silent-AI exclusion competitor policies.
• Class 1 manufacturer cyber binder: $48,200 annual premium at $5M aggregate cyber liability plus component sublimits. Cyber-posture score 78 from Coalition's continuous monitoring. Premium calculation: $48M revenue × 0.1% base × cyber-posture adjustment × industrial-IoT factor. $25K retention per incident. Affirmative AI endorsement included. Effective 2026-07-01 matching parent renewal.
• Surplus-lines tax 4% Massachusetts × $48,200 = $1,928 surplus-lines tax remitted to Massachusetts Division of Insurance via the stamping process. Stamping process stamps the policy as compliant and files in the state record. Diligent-effort documentation: three admitted-market declinations from Chubb, Travelers, Liberty Mutual before the surplus-lines referral. Cross-state stamping workflow detailed in Lesson 13.
• Bordereau reporting monthly to the fronting carrier (capacity provider). Bordereau includes named insured, FEIN, effective date, premium, limits, surplus-lines tax, retention, risk attributes. Fronting carrier reconciles against treaty terms, collects premium share, provides capacity confirmation. Quarterly capacity reviews and annual treaty renewals between Coalition and fronting carriers. The 2026 trend is toward more frequent reconciliation and tighter authority caps as fronting arrangements have proliferated.