A bank's duty of (Quince)care stops with its customer: RBS v JP SPC 4

Background

JP SPC 4, a Cayman Island based investment fund (the Fund) was set up as an investment vehicle for a scheme to lend money to solicitors to finance high-volume, low-value litigation. The Fund lent to Synergy (Isle of Man) Ltd, (SIOM), which held accounts with RBS. The investors in the Fund alleged that of the approximate £110 million lent to SIOM, only £65 million went to law firms and the rest was fraudulently misappropriated by SIOM and individuals connected to it.  The Fund claimed that RBS owed it (as the beneficial owner of the account) a tortious duty to exercise reasonable skill and care in acting on its customer's instructions. Specifically, it argued that if RBS were on notice of the possibility of the Fund being defrauded, it should have delayed acting on its customer's instructions until it had made reasonable enquiries as to their propriety. In effect, the Fund claimed that despite the fact it had no contractual relationship with the bank, RBS owed it a Quincecare duty to take reasonable care to protect it from fraud. RBS successfully appealed (having failed at first instance) to the High Court of Justice of the Isle of Man to strike out the claim against it on the grounds there was no arguable basis such a duty existed. Permission to appeal was then granted by the Privy Council.

The Privy Council's Quincecare analysis

Of particular interest in relation to the scope of the Quincecare duty, the Fund argued that Steyn J, in Barclays Bank plc v Quincecare Ltd², had opened the door to the possibility of claims by third parties when he stated 'the law should guard against the facilitation of fraud, and exact a reasonable standard of care in order to combat fraud and to protect bank customers and innocent third parties'. However, on analysis the Privy Council concluded that this meant nothing more than acknowledging that protecting a customer against fraud (through the Quincecare duty) indirectly protects innocent third parties. Nothing in that case or in the other Quincecare authorities supported the argument that a bank's tortious duty of care extends beyond its customer.

The Privy Council also took the opportunity to formally overrule the decision in Baden v Société Générale³ (a case decided before Barclays v Quincecare). In that case, the court had held that a duty of care was owed by the defendant bank to third party beneficiaries in circumstances where the bank knew that accounts were held by its customer as a fiduciary for known beneficiaries. However, Baden had been decided during a period of expansion of the law of negligence, in which only a two-stage test applied: 1) was it reasonably foreseeable to the defendant that the claimant would be likely to suffer loss from its careless conduct; and 2) were there any good reasons (of policy) why the duty should not apply. Since that period, the duty of care in negligence has been significantly curtailed to either the three-stage test for novel duties of care (foreseeability, proximity, and whether fair, just and reasonable) and/or the incremental approach. The duty of care held to exist in Baden, could not stand as good law because of the demise of the two-stage test from which it derived.

Finally, the Privy Council rejected the Fund's alternative argument that if the duty were not already established, it should now be recognised as an appropriate incremental development from existing case law. While, exceptionally, a duty of care in respect of pure economic loss has been found to be owed by a bank to a third party, that has been in circumstances where the purpose of the service was to benefit the third party and / or where the bank knew (or should have known) that the third party was directly relying on the bank's services⁴. Neither such factor applied in this case: the Fund did not place direct reliance on RBS; RBS neither knew nor ought to have known that such reliance was being placed; and the purpose of its service was not to benefit the Fund, it was to benefit its actual customer. In those circumstances, the Privy Council held that without a close analogy in terms of purpose and reliance (and without a legal lacuna which justice demanded should be filled by a remedy⁵), it would not be fair, just and reasonable to impose a duty of care on RBS to the Fund.

In particular, the Privy Council clarified that it saw no good reason for incrementally developing the law of negligence, beyond the existing confines of the Quincecare duty, to impose an equivalent duty of care on a bank in relation to third parties. It also accepted RBS’s    submission  that additional caution should be exercised when considering incremental extensions of the duty of care in circumstances where the alleged failure related to an omission (i.e. a failure to step in to prevent harm) rather than an active harmful step.

Contracting duty of care?

The scope of a bank's duty of care has been in a state of flux in recent years. Where the Quincecare duty applies, quite how it will work in practice remains to be seen, and the outcome of any trial in Philipp v Barclays along with the judgment in Federal Republic of Nigeria v JP Morgan Chase Bank is eagerly awaited.

What appears to be clear for now is that the Quincecare duty is only owed to a bank's customers and not more widely. The reasoning of the Privy Council in this case echoes that of the recent judgment in Tulip Trading Ltd v Bitcoin Association for BSV⁶, which confirmed (albeit by way of analogy in the context of software developers), that the Quincecare duty is only owed to the contracting counterparty, not a wider class. In that case the court was also hesitant to incrementally extend the duty where the harm arose from an omission (an alleged failure to create a software patch) rather than an active harmful step. In conclusion, while a co-extensive duty of care in the tort of negligence may exist, the Quincecare duty itself arises from an implied contractual term and does not exist outside of a contractual relationship.