Why 38% of Office Leasing Is an Insurance Signal, Not Just a Real Estate One
The headline number from the JLL India GCC Guide 2026 and the Wisemonk 2026 report is a real-estate statistic on its face. Global capability centres took 38% of gross office leasing across the top seven cities in 2025, roughly 31.3 million sq ft, a record year, with the wider market tracking toward 2,500-plus GCCs and 2.8 to 2.9 million jobs by 2030. Around 70% of that demand comes from US-headquartered parents. Brokers tend to read this as a landlord and fit-out story. It is also the leading indicator of a multi-line commercial insurance pipeline that most broking desks are underserving.
Every GCC that signs a Grade-A lease is standing up an India-incorporated entity that hires thousands of engineers, installs several crore rupees of IT hardware per floor, processes the parent's regulated data, and appoints a local board that carries statutory liability under Indian law. That entity does not inherit the parent's global insurance tower automatically. It needs locally admitted cover, because IRDAI's non-admitted rules mean a foreign master policy cannot lawfully pay an India-domiciled loss without a local admitted policy underneath it.
The practical point for a broker is sequencing. The lease is signed twelve to eighteen months before the centre reaches steady headcount. The property, business interruption and equipment covers are needed at fit-out. The cyber, technology E&O and D&O covers are needed the moment the entity starts taking client and employee data and the board is constituted. Group health is the retention tool that decides attrition. A broker who maps the leasing pipeline to this covers calendar is quoting the account a year before the incumbent renews it. The sections below break the GCC build-out into the specific lines it pulls, and where each one is routinely mispriced or left with a gap.
Grade-A Property and Business Interruption: The Fit-Out Values the Landlord's Policy Never Covers
A GCC leasing a bare shell in a Grade-A tower is exposed for far more than the developer's building cover contemplates. The landlord insures the structure under a Standard Fire and Special Perils or Industrial All Risks wording. The tenant's own exposure is the fit-out, the server and network room, the UPS and DG backup, the workstations, and the fixed IT hardware, and none of that sits on the landlord's policy. For a large floorplate this is frequently the single largest asset the Indian entity owns, and it is routinely underinsured because the parent assumes the lease transfers the risk.
Three covers do the work. A tenant's Standard Fire and Special Perils or property-all-risks policy on the fit-out and contents, valued on a reinstatement basis rather than book value so that the average clause does not bite at claim time. A Fire Loss of Profits or business interruption cover, which for a GCC is not lost sales but the continuing wage bill, the parent's service-level penalties, and the cost of shifting work to another site while the floor is rebuilt. And Electronic Equipment Insurance plus machinery breakdown on the server room and cooling plant, which the fire policy excludes.
The indemnity period is where brokers earn their fee. A twelve-month indemnity period is the reflex, but a GCC running a niche capability, actuarial modelling, chip design, or a regulated finance process, can take eighteen to twenty-four months to restore trained capacity and re-secure the parent's sign-off after a total floor loss. Sizing the sum insured to declared values, and the indemnity period to the real recovery timeline, is the difference between a policy that responds and one that pays a fraction. Most GCC property placements inherited from a landlord broker get both wrong.
Technology E&O and Professional Indemnity: Insuring the Intra-Group Service Contract
The GCC is not a cost centre in insurance terms. It is a service provider that delivers software, analytics, finance and engineering work back to its parent and, increasingly, to third parties under statements of work. That delivery creates errors-and-omissions exposure, and the way the intra-group service contract is written decides how much of it lands in India.
Many centres now bill the parent on a cost-plus or arm's-length basis to satisfy transfer-pricing rules, and that same arm's-length framing means the parent can, in principle, claim against the India entity for defective work, a missed regulatory deadline in the parent's home market, or a modelling error that flows into the parent's financial statements. A technology errors-and-omissions or professional indemnity policy on the Indian entity responds to those claims. The buyer question is whether the parent is a covered claimant at all, because standard PI wordings exclude claims by affiliated companies. Without an affiliate carve-back, the very contract the GCC exists to service is uninsured.
Two further terms matter for this vertical. First, the retroactive date must reach back to the entity's incorporation, not the policy inception, because a claim can surface years after the flawed deliverable. Second, the geographical and jurisdiction clause must accept the parent's home courts, US or UK typically, since a US-parented GCC will face any serious E&O claim under US law even though the work was done in Bengaluru or Hyderabad. A policy with an India-only jurisdiction clause is worthless against 70% of the demand base. Brokers placing GCC PI who copy a domestic IT-services wording, rather than reading the affiliate and jurisdiction language against the actual service agreement, leave the account exposed on exactly the risk it was bought to cover.
Cyber Cover for the India Node of a Global Attack Surface
A GCC is a concentrated node on the parent's global attack surface. It holds production access to the parent's systems, processes personal data of the parent's customers, and often runs the security operations centre for the whole group. When an attacker wants into a US or European enterprise, the India capability centre is frequently the softest lawful entry point, and that makes standalone cyber insurance on the Indian entity a core line rather than an add-on.
Two Indian regimes drive the wording. The Digital Personal Data Protection Act, 2023 exposes the GCC as a data fiduciary or significant data fiduciary, with penalties up to Rs 250 crore for a breach, and the cyber policy must confirm those administrative penalties are insurable to the extent Indian law allows. The CERT-In directions of April 2022 require reporting of specified incidents within six hours and mandate 180-day log retention, so the incident-response cover has to fund a forensic and reporting exercise that runs to a statutory clock, not the insurer's preferred timetable.
Aggregation is the underwriter's concern and should be the broker's too. A single ransomware event that hits the parent's shared platform can trigger the Indian entity's cyber policy, its business interruption cover, and its PI cover at the same time, and can correlate across several GCCs sharing the same tooling. Reading how the cyber, PI and property BI wordings interlock, so the buyer is neither double-recovering nor falling into a gap between them, is the analytical work that separates a placed programme from a coordinated one.
D&O for the India-Incorporated Entity: Directors Who Answer to Delhi
Every GCC is an India-incorporated company under the Companies Act, 2013, with its own board, its own statutory registers, and directors who carry personal liability that the parent's global directors and officers tower does not reliably reach into. This is the most consistently overlooked line in the GCC build-out, because the parent assumes its worldwide D&O programme covers the India board. Under IRDAI's non-admitted rules it often cannot pay an India-domiciled defence cost without a local admitted policy, and the exposures are specifically Indian.
A GCC director faces personal liability under Section 149 and Section 166 of the Companies Act for the affairs of the Indian entity, under the labour codes for provident-fund and gratuity defaults across a workforce of thousands, under the tax statutes for withholding and transfer-pricing positions, and under the new criminal codes for corporate offences. Several of these are offences where the director is presumed liable unless she proves due diligence, which reverses the usual burden and makes defence costs the dominant early exposure. A locally issued D&O policy, structured as a difference-in-conditions layer beneath the parent tower or as a standalone local programme, funds those defence costs from the first rupee rather than after a foreign insurer decides whether its master wording responds.
The wording checks are specific. The policy must cover investigation and inquiry costs, because Indian regulatory action usually begins as a summons or an inquiry long before any formal claim. It must include the non-executive and independent directors the entity is required to appoint, whose willingness to serve on a GCC board depends on the cover being real. And the insured-versus-insured exclusion must carve back claims driven by the parent, since intra-group governance disputes are a live risk when the parent restructures or exits. A copy-pasted listed-company D&O wording will not fit a wholly-owned subsidiary board, and most GCC placements never get read against these points.
Group Health, Crime and the People-Heavy Cost Base
A GCC is a headcount business before it is anything else, and two lines follow directly from that. The first is group health, which is not a compliance line but the retention weapon that decides attrition in a market where a skilled engineer has three competing offers. The second is crime and fidelity, which follows from thousands of employees holding privileged access to the parent's systems and money.
On health, the corporate group medical policy is the single largest employee-benefit spend a GCC carries, and 2026 is a hard renewal market. Medical inflation and loss ratios above 90% are pushing insurers to load premiums, tighten room-rent and co-pay terms, and cap parental cover. For a GCC competing on total rewards, the broker's job is to hold the benefit design that recruiting depends on while managing the premium, using wellness data, graded parental cover and a considered deductible structure rather than accepting a blunt across-the-board load. The employer's statutory floor sits under this: employees below the wage threshold fall under ESIC, and the Employees' Compensation Act, 1923 liability for work injury runs regardless of the group policy.
Crime and fidelity guarantee cover is the quieter line and the one parents most often assume is handled globally. A GCC running finance-and-accounting, treasury or payments operations for the parent gives hundreds of employees the ability to move the parent's money or divert its data. A commercial crime policy on the Indian entity responds to employee theft, social-engineering fraud and unauthorised funds transfer, and for a GCC the loss frequently lands on the parent's balance sheet rather than the subsidiary's, so the wording must name the parent as a covered loss payee. Reading whether the crime, cyber and PI wordings between them actually catch a social-engineering payment fraud, rather than each excluding it as the other's territory, is the coverage-mapping work these accounts need.
The Broking Opportunity in Servicing India-Parented Captives and GCC Programmes
The GCC build-out is a broking opportunity precisely because it does not arrive as one neat renewal. It arrives as a property placement at fit-out, a technology E&O and cyber placement at go-live, a D&O placement when the board is constituted, and a group health placement that reprices every year. A broker who treats these as separate accounts loses the coordination fee. A broker who treats the GCC as a single programme, sized to the intra-group service contract and to the parent's tolerance for uninsured exposure in India, becomes the adviser the parent's global risk manager actually needs on the ground.
The higher-value work is with India-parented captives and with the growing set of Indian conglomerates standing up their own capability centres. These buyers can retain more risk, structure a local programme beneath a global tower, and use a captive or a GIFT City vehicle for the retained layers, which turns a commodity placement into a structured-risk advisory engagement. The through-line across property, PI, cyber, D&O and crime is the same: the GCC is insured for its responsibility over the parent's assets, data and reputation, held in an India-incorporated entity that Indian law treats as fully answerable.
That work rests on reading wordings, not policy names. Whether the parent is a covered claimant under the PI affiliate clause, whether the cyber policy carries non-India jurisdiction, whether the D&O insured-versus-insured exclusion carves back parent claims, whether crime names the parent as loss payee, these are language questions, and the language differs sharply between insurers. Sarvada gives brokers and corporate risk teams searchable access to insurer policy wordings, so mapping a GCC's build-out to the covers that genuinely respond becomes a matter of reading the clauses side by side rather than trusting the product name. If you are quoting capability-centre programmes and want the wordings in front of you, Request Access.