--- title: "Is the Applicant engaged in adult content, cryptocurrency, gambling, payment processing, or MSP/MSSP business?" url: https://insuranceposture.com/questions/business-profile/applicant-engaged-adult-content-cryptocurrency-gambling-payment-processing-msp category: "Business and financial profile" canonical_key: q_fin_003 evidence_state: attested updated: 2026-08-24 --- # Is the Applicant engaged in adult content, cryptocurrency, gambling, payment processing, or MSP/MSSP business? URL: https://insuranceposture.com/questions/business-profile/applicant-engaged-adult-content-cryptocurrency-gambling-payment-processing-msp Section: Business and financial profile Evidence state: Attested, not tenant-verifiable These categories are listed together because carriers manage appetite by business class before they look at controls, and each of these classes is commonly restricted for its own reason. ## What the carrier is actually asking The carrier is asking whether you operate in a set of classes it treats as elevated risk: adult content, cryptocurrency, gambling, payment processing, and managed service provision. Each is on the list for its own reason. ## Why it is underwritten Cryptocurrency businesses hold directly stealable assets. Payment processors hold concentrated card data. Managed service providers carry correlated exposure across their clients. Gambling and adult content attract targeted attacks and regulatory complexity. Carriers manage appetite by class before considering controls. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is a disclosure about your activities and it should reflect what you actually do rather than how you describe yourself. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Operations | Revenue by activity against the listed categories | An honest mapping, including secondary activities. Attested | | Services | Whether you manage IT for third parties | Managed service provision includes arrangements you might not label as such, including managing systems for affiliates | | Payments | Whether you process payments on behalf of others | Payment facilitation, which is different from accepting payments for your own goods | | Assets | Cryptocurrency held, accepted, or custodied | Any digital asset activity, including accepting it as payment | | Trajectory | Planned entry into any of these areas | Disclosed, since a mid-term change in operations is usually disclosable | **Managed service is the one people miss** Organisations that manage IT for affiliates, franchisees, or a handful of clients as a sideline frequently answer no. If you hold administrative access to systems you do not own, carriers treat you as a service provider, and the underwriting changes accordingly. ## What a defensible yes requires - Each category is considered against what you actually do rather than your self-description. - Secondary and incidental activities are included. - Managed service work is disclosed even where it is a small part of the business. - Digital asset activity is disclosed including acceptance as payment. - Planned entry into these areas is mentioned. ## How this answer goes wrong A technology company that manages infrastructure for three long-standing clients answers no because it does not call itself a managed service provider. If a client incident produces a claim, the undisclosed activity becomes the material fact. ## If this answer turns out to be wrong Revenue and record counts are the rating base, so a misstatement here is material as arithmetic, and it is the category where insurers have historically reached for rescission. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how rescission voids a policy from inception](https://insuranceposture.com/glossary/rescission). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Does a yes make us uninsurable? No, and it narrows the market. Specialist capacity exists for each of these categories, and it is better reached through accurate disclosure than discovered after a decline. ### Are we an MSP if we manage a few clients? Probably, for underwriting purposes. Holding administrative access to systems you do not own is the test that matters. ### Does accepting crypto count? Usually yes. Disclose it with the volume and how it is held, since custody is the part carriers care about. ### What if we plan to enter one of these areas? Mention it. Material changes in operations are usually disclosable during the policy period. ## Related questions - [What is the Applicant's industry classification (NAICS / industry select)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-s-industry-classification) - [Which technology service lines are a significant part of the Applicant's revenue (consulting, MSP/MSSP, development, BPO, QA/testing, IT staffing/project management, telecom/ISP, e-recycling/data destruction, etc.)?](https://insuranceposture.com/questions/services-and-contracts/technology-service-lines-significant-part-applicant-s-revenue) - [Is multi-factor authentication enforced for all access to clients' systems and remote monitoring and management (RMM) applications?](https://insuranceposture.com/questions/multi-factor-authentication/multi-factor-authentication-enforced-access-clients-systems-remote-monitoring) - [Is the Applicant engaged in any business other than its described operations?](https://insuranceposture.com/questions/business-profile/applicant-engaged-business-other-than-described-operations) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.