Director and Officer Indemnification: Bylaws, Agreements, and D&O Insurance

Ask a director what protects them personally and the answer is usually "the company indemnifies me." That is one third of an answer. Protection comes from three instruments — the charter and bylaws, an individual agreement, and an insurance policy — and each is drafted by a different party, at a different time, with different incentives.

The rules are state law. Delaware's General Corporation Law is used here as the worked example because it is the most litigated; Model Business Corporation Act states reach similar results by a different route, and LLCs are governed largely by their operating agreements.

The three layers, and what each is good for

The layers are meant to overlap. In practice they leave seams, and the seams are where individuals get hurt: a bylaw that is permissive rather than mandatory, an officer who never signed an agreement, or a policy whose run-off period expired before a claim was made.

What the statute permits and what it compels

Indemnification under Delaware's Section 145 divides along the type of proceeding. For third-party actions, the corporation may indemnify against expenses, judgments, fines, and settlement amounts where the person acted in good faith and in a manner reasonably believed to be in or not opposed to the corporation's best interests, and — in a criminal matter — had no reasonable cause to believe the conduct was unlawful.

Derivative actions are narrower. Because the suit is brought in the corporation's own right, indemnification generally reaches expenses only, and a person adjudged liable to the corporation cannot be indemnified unless a court determines that indemnification is nonetheless proper. That asymmetry is the reason insurance matters most in exactly the cases a company most wants covered.

One piece is mandatory: where a director or officer is successful on the merits or otherwise in defending a proceeding, the statute requires indemnification against expenses. "Or otherwise" carries real weight — a dismissal or a favorable resolution short of vindication on the facts can qualify. The statute is also non-exclusive, which is what allows bylaws and individual agreements to grant broader rights than the default, and it expressly authorizes buying insurance even for exposures the corporation could not lawfully indemnify. Read the current text in the Delaware Code, and note that Delaware has amended related provisions — including charter exculpation for certain officers, added in 2022 — more than once in recent years.

Verify before relying: "may indemnify" in a statute is not a promise to anyone. Unless the bylaws or an agreement convert the permission into an obligation, the decision belongs to the corporation at the moment it is least inclined to say yes.

Advancement is the live issue

Advancement is the company's obligation to pay defense costs as they are incurred, before anyone decides whether indemnification is ultimately owed. It is a separate right, and for an individual facing a multi-year proceeding it is the one that determines whether an adequate defense is even possible.

Delaware permits advancement upon receipt of an undertaking to repay if it is later determined the person was not entitled to indemnification. Permits — not requires. Mandatory advancement comes from the bylaws or the individual agreement, not from the statute, and disputes about it are litigated as summary proceedings precisely because delay defeats the purpose.

1. Claim arrives

   Notice obligations run in two directions at once: to the company under the indemnity documents, and to the carrier under a claims-made policy. Missing the carrier notice window can forfeit coverage entirely.

2. Within days

   The individual delivers an undertaking to repay and requests advancement. Well-drafted agreements set a fixed payment deadline and make the undertaking unsecured and independent of ability to repay.

3. Through the defense

   Invoices are submitted and advanced on a defined cycle. Disputes here concentrate on rate reasonableness and on allocation between covered and uncovered matters.

4. On resolution

   The indemnification determination is made under the standard set by the statute and the documents — who decides, on what evidence, and with what presumption in the individual's favor.

5. After the fact

   If entitlement fails, the undertaking is enforced. If it succeeds, insurance reimbursement follows under the company-reimbursement side of the policy, subject to the retention.

What the policy actually covers

A standard D&O tower is built in parts. One part pays individuals directly when the company cannot or does not indemnify — the layer that matters in insolvency and in derivative claims. Another reimburses the company for indemnification it does pay, subject to a retention. A third, in public companies, covers the entity itself for securities claims. An individual should know which part is expected to respond to their exposure, because the answer changes the negotiation.

Exclusions do the real work. A conduct exclusion removes fraud and improper personal profit, and the protective version applies only after a final, non-appealable adjudication in the underlying action. An insured-versus-insured exclusion bars claims brought by one insured against another, and it needs carve-backs for derivative suits and for claims brought by a bankruptcy trustee. Prior-acts and pending-litigation exclusions cut off matters that predate the policy. Bodily injury, professional services, and benefit-plan fiduciary claims are typically routed to other policies. Severability language decides whether one person's misstatement in the application voids coverage for everyone else.

Two structural features deserve attention at renewal. First, these are claims-made-and-reported policies, so the reporting date governs, not the date of the conduct. Second, in a sale or merger the policy is normally converted to run-off for a fixed number of years, and a departing director's protection depends on that tail being purchased and priced into the deal — which is why it belongs in the transaction documents alongside the terms discussed in representations and warranties in an asset purchase. Contract-based risk transfer generally, including additional insured status under someone else's policy, is a different mechanism with different failure modes; see commercial insurance clauses.

Where the layers fail to meet

• Permissive bylaws. A bylaw saying the company "may" indemnify to the fullest extent permitted gives a board discretion to refuse. Mandatory language and a defined determination procedure remove that discretion.
• Amendable protection. Bylaws can be amended after a claim arises. A non-retroactivity clause — protection fixed as of the date of service — closes this, and an individual agreement closes it more firmly.
• Officers without agreements. Companies routinely paper directors and forget officers, who face securities and employment claims at least as often.
• Former service uncovered. Departure ends the relationship but not the exposure. Both the agreement and the policy tail must cover acts during service, regardless of when the claim arrives.
• Insolvency. An indemnity from a company with no assets is worth its balance sheet. Individual-coverage insurance is the only layer that functions here.
• Regulated-entity limits. Federal rules restrict what insured depository institutions may pay in indemnification, including for civil money penalties; the FDIC administers those restrictions, so bank directors cannot assume ordinary corporate practice applies.
• Securities-law limits. The SEC has long taken the position that indemnification for liabilities arising under the Securities Act is against public policy, and registration statements carry an undertaking reflecting that view.

Note also that indemnity never reaches everything. A duty of loyalty breach, bad faith, and improper personal benefit sit outside exculpation, outside the statutory good-faith standard, and outside the conduct exclusion in the policy. That alignment is deliberate: the system protects honest judgment, not self-dealing. The fiduciary duty framework and the protection stack are two sides of the same design.

Questions the desk gets

Bylaws already cover me. Why sign a separate agreement?

Because bylaws are unilateral and amendable, and an agreement is neither. An agreement can also do things bylaws rarely do well: set a payment deadline for advancement, shift the burden of proof onto the company in an entitlement dispute, name who makes the determination when the board is conflicted, cover proceedings you initiate to enforce your own rights, and fix your protection as of the date you began service.

If I settle, have I lost indemnification?

Not necessarily. In a third-party action, settlement amounts can be indemnifiable where the good-faith standard is met, and success "or otherwise" for mandatory expense indemnification does not require a merits vindication. In derivative actions the analysis is tighter, since indemnity generally reaches expenses only. Separately, most policies require carrier consent before settling, so an unapproved settlement can cost coverage even where the statute would allow indemnity.

The company is being acquired. What should I confirm?

Three things, in the deal documents rather than in conversation: that the buyer assumes existing indemnification obligations and will not amend them retroactively for prior acts; that a run-off policy of adequate length and limit is purchased at closing and paid for out of the deal; and that your individual agreement survives the transaction by its own terms. Verbal assurances from a buyer do not survive a later change of management.

Does any of this apply to an LLC?

The framework transfers, but the source is different. LLC statutes in Delaware and elsewhere give the operating agreement broad freedom to define — and to limit — indemnification, advancement, and even fiduciary duties themselves. That flexibility cuts both ways: an operating agreement can be far more protective than a corporate bylaw, or can silently eliminate protections a manager assumes exist. Read the operating agreement, not the corporate analogy.

What to do next

Start with a document inventory rather than a policy review. Pull the charter, the bylaws, every executed individual agreement, and the current policy with all endorsements, and build a single grid of who is covered by which instrument. The most common finding is not a bad clause; it is an officer with no agreement and a policy that nobody has read since binding.

Then test three specific provisions. Is advancement mandatory, with a deadline and an unsecured undertaking? Is the protection fixed as of the date of service and immune from later amendment? Does the policy's insured-versus-insured exclusion carve back derivative claims and bankruptcy-trustee claims? Those three decide most real disputes.

Finally, tie the governance record to the protection. Indemnification determinations, conflict findings, and approval of individual agreements all belong in the board record, drafted with the discipline set out in board minutes and written consents. When a claim does arrive, preservation duties attach immediately, as described in demand letters and litigation holds, and the individual's own file — engagement letters, notices, undertakings — should be kept separately from the company's. Related fiduciary-administration duties are covered in fiduciary duties of executors and trustees.