Banks, be on inquiry - Quincecare is coming!

Key takeaways

• A bank must comply with two legal obligations when effecting payments: i) its mandate (which includes only making payments with the customer's authority); and ii) its duty as the customer's agent to exercise reasonable skill and care in making the payment. The standard of duty in both cases is the same: 'the law cannot coherently treat compliance with an authorised instruction as a breach of duty; or treat a transfer made in breach of duty as authorised'.
• The critical question is what constitutes notice of a lack of authority and when a bank has a duty to make further inquiries before making payment.
• Notice has traditionally been referred to as being 'on inquiry' but this is misleading. It needs to be understood in its commercial context. There is no general obligation 'spontaneously to inquire into an agent's authority'. The starting point is what is actually known and whether that information itself calls for inquiry. In other words, it is only if a bank actually knows facts suggesting an agent lacks actual authority, that it must investigate further before proceeding. This analysis is endorsed by Quincecare and Singularis².
• While the Quincecare duty itself is presently limited to payment instructions and does not extend to administrative instructions (including account closure), when a bank is 'on inquiry' as to the authority of an agent, it should not take any steps (including closing an account) without undertaking further inquiries to ensure the instructions are properly authorised.

The claim – at a glance

Between 1994 and 1998, two of the three authorised officers of the appellant, PT Asuransi Tugu Pratama Indonesia TBK (Tugu) instructed the respondent, Citibank N.A. (Citibank) to make a series of transfers to the accounts of four individual Tugu officers of over US$50 million. Once the bank account was emptied, the bank complied with a further request from two of the authorised Tugu officers to close the account. Lord Sumption observed in relation to the underlying facts that 'payment of such large sums from a corporate account to its signatories and officers personally is unlikely to have been for the benefit of the company'. In 2006 (many years later), the bank alleged that the transfers had been 'dishonestly authorised', demanded repayment and ultimately brought proceedings.

At first instance, the court found that the transfers were dishonest and that the reasonable and prudent banker would have been on notice of this by the time of the third transfer (in a series of 26). It was apparently accepted that the bank made no inquiries and the court held this to be a breach of duty entitling Tugu to have all but two of the transfers reversed. However, the court held that the instruction to close the bank account was properly authorised, meaning that Tugu's cause of action arose on the date of closure and the claim was therefore time barred. That decision was upheld on appeal, albeit instead of accepting that the bank had made no inquiries, the court found that it had not made 'necessary' inquiries. The Court of Appeal held that instead of only contacting the authorised signatories, the bank should have contacted directors 'independent of the operators and beneficiaries of the fraud'. Further, while it found that the banker/customer relationship had terminated when the bank closed the account, the Court of Appeal analysed this as an unauthorised and repudiatory termination, which nevertheless had the effect of bringing the contract to an end unilaterally because Tugu (the innocent party) had no legitimate interest in performing the contract rather than claiming damages.

On appeal to the CFA, Lord Sumption allowed the appeal. He held that the instruction to close the account, while an administrative action rather than a payment instruction, could not be separated from the fraudulent transfers. It was a 'principal to principal' instruction, whose validity was a 'pure question of authority'. Accordingly, not only were the transfers 'dishonestly authorised' but so too the instruction to close the account. The repudiatory breach by which Citibank purported to terminate the account was not accepted by Tugu. The prior unauthorised transfers were 'nullities' which operated as a 'reconstituted debt' at the time of the repudiatory breach. Accordingly, Tugu (as the innocent party) could not have claimed damages at the time as it had no loss. The contract was not terminated and Tugu's debt claim subsisted until it demanded repayment in 2006, depriving Citibank of the limitation defence.

What does this mean for Quincecare?

This case revolved around questions of authority, and not specifically a bank's Quincecare duty. However, it seems clear that Lord Sumption's analysis of the operation of the Quincecare duty excludes payment instructions that come directly from the customer themselves. In his words, 'the law cannot coherently treat compliance with an authorised instruction as a breach of duty'. On its face, this would suggest that the Court of Appeal's view that a bank could be in breach of its Quincecare duty for failing to second-guess the motivation of its individual customer in giving an authorised instruction is unsustainable.

It is also interesting that instead of analysing the Quincecare duty as one which operates 'in tension with' a bank's primary duty to execute its customer's instructions, Lord Sumption views both duties on a more harmonious basis: 'the duty of care is a duty in the performance of the mandate'.

On the one hand, this judgment (which it must be remembered is not binding in England and Wales) narrows the scope of the duty by excluding claims by individual account holders (such as victims of APP fraud who are duped into giving authorised payment instructions). On the other hand, it potentially extends the scope of the duty by engaging it not only in making payments but in verifying all instructions, including decisions to close accounts. While such decisions may not have a detrimental effect on the customer (and consequently may not incur significant liabilities for banks) they may, in certain circumstances, extend the limitation period for a customer to bring a Quincecare claim.

Other potential concerns for banks within the judgment relate to the ongoing question of what exactly a bank is supposed to do once it is 'on inquiry'. In this case, the Court of Appeal suggested the bank should have verified the instructions with directors 'independent of the operators and beneficiaries of the fraud'. No guidance was provided by the court, however, as to how Citibank was supposed to find out which of the other directors of its corporate customer were potentially benefiting from the fraud. While it has long been recognised that banks are not obliged to become 'amateur detectives' in order to comply with their Quincecare duties, it seems a level of detective work is still necessary in deciphering the latest guidance from the courts.