The Quincecare duty: what do banks need to know?

Despite the recent trend for claims for breach of this duty, they are not often successfully invoked in the courts and, until recently, there was limited judicial discussion about the mechanics of the duty. In this article, we consider the key issues arising from this rapidly developing area of case law and what the future holds for the Quincecare duty.  

Origins of the Quincecare duty

The Quincecare duty can be traced back to the decision in Barclays Bank plc v Quincecare Limited [1992] 4 All ER 363. In this case, it was held that a bank owes an implied duty to exercise reasonable care and skill when executing customers’ instructions, which includes not executing payment instructions if there are reasonable grounds (although not necessarily proof) for believing they are an attempt to misappropriate funds. This is assessed against the objective standard of the ordinary prudent banker.

At the time of its inception, it was thought that such a duty struck a fair balance between the desire not to impose too burdensome an obligation on banks (and thereby hamper banking transactions) and the need to protect customers against fraud. The courts have since struggled to grapple with its application in the modern banking context, where the nature of fraudulent activity is altogether different from when the duty was first conceived. Indeed, it was not until 2019 that a bank was first held liable for breaching the Quincecare duty.

More than a duty to refrain?

The Quincecare duty was originally framed as a negative duty (i.e. the duty to refrain from following a customer’s instructions), but the recent Court of Appeal decision in the Federal Republic of Nigeria (FRN) v JP Morgan Chase (JPMC) [2019] EWCA Civ 1641 has cast doubt on this.

In dismissing JPMC’s appeal against the refusal of its application for summary judgment, the Court of Appeal in FRN found that the Quincecare duty will require “something more” from a bank than simply deciding not to comply with a payment instruction. It endorsed the comments of the judge at first instance that a duty of enquiry was in line with “sound policy”.

On the facts of the case, JPMC had complied with payment instructions made by authorised signatories of the FRN. The FRN later alleged that JPMC (which had submitted suspicious activity reports) should have realised that it could not trust the senior Nigerian officials from whom it took instructions and should not have made the payments it was instructed to make. The Court of Appeal did not make any finding on the facts, but it did indicate that the question of what JPMC should have done was a matter for the trial judge.

This decision appears to represent a shift in the balance recognised in the Quincecare judgment, placing greater weight on the role of banks in combatting fraud and expanding the scope of the duty beyond its original formulation to require some form of positive action. There is, however, a distinct lack of clarity surrounding what a bank’s so-called duty of enquiry means in practical terms and how this ought to be reconciled with a bank’s duty to follow its customers’ instructions.

The Supreme Court’s judgment in Singularis Holdings Ltd (in Official Liquidation) v Daiwa Capital Markets Europe Ltd [2019] UKSC 50, which was handed down just days after the FRN decision in 2019, did not shed any light on these issues.

In that case, the liquidator of Singularis had brought a claim against Daiwa in respect of payments in the sum of US$204 million to accounts in the names of other companies in the same corporate group in accordance with the instructions of Singularis’ sole shareholder (and a director), Mr Maan Al Sanea. Daiwa did not appeal the first instance findings that it owed a Quincecare duty and had breached that duty. It instead appealed on the basis that Singularis was effectively a one-man company controlled by Mr Al Sanea and that, as a result, the claim should fail for illegality, lack of causation or deceit. In dismissing Daiwa’s appeal, the Supreme Court did not address the steps that Daiwa ought to have taken to comply with its duty because it was said to be incontrovertible that there was a clear breach of duty. 

Further commentary on the judgment in Singularis is available in our article here and on the decision in FRN v JPMC here.

Individual account holders

The law does at least now appear to be clear when it comes to payment instructions from individual account holders. In Philipp v Barclays Bank plc [2021] EWHC 10 (Comm), the High Court held that a Quincecare duty is not owed in circumstances where an individual customer makes a payment instruction as a result of an “authorised push payment” (APP) fraud and granted Barclays’ application for summary judgment. The duty is instead limited to situations where payment instructions are not properly authorised i.e. they are made by a customer’s agent who is seeking to misappropriate funds (such as in Singularis).

In Philipp, Mrs Philipp had authorised the transfer of £700,000 to the UAE after she was tricked into doing so by fraudsters impersonating the FCA. She subsequently brought a claim against Barclays for its failure comply with a purported duty to protect her from the consequences of the payments she had made, willingly, but on a fraudulently induced basis.  Although the Court’s decision was in the specific context of APP fraud, it is useful for its wider discussion of the scope of the Quincecare duty. The Court noted that Mrs Philipp had sought to elevate the duty (which is subordinate to a bank’s primary duty to act on its customers’ instructions) to a point where too much doubt would be cast over the effectiveness of those instructions. The Court also observed that there was no clear framework by reference to which the duty, as articulated by Mrs Philipp, might sensibly operate; it would involve second-guessing customers’ instructions without being supported by some form of clearly recognised banking code.

By contrast to the Court’s approach in Philipp, the Financial Ombudsman has frequently made findings in relation to breaches of the Quincecare duty in the context of APP fraud. In December 2020 alone, the Ombudsman upheld four complaints in which it was argued the Quincecare duty was breached. By way of example, in a recent decision¹ in which it concluded the duty had been breached, it observed:

“HSBC has placed emphasis on the legal case of Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363. It says the Quincecare ruling means its responsibility to be alert to fraud is subordinate to its contractual duty to promptly execute a payment order. HSBC went onto say that it would not be fair and reasonable to impose standards that prevent the effective operation of its retail banking services and said that it does have systems in place to monitor accounts, but these will consider the whole relationship with the Ref: DRN5297527 2 customer, not just the last couple of months. It pointed out Mr L has banked with HSBC for 23 years. I recognise there is a balance here and I don’t expect HSBC to unreasonably disrupt its banking services where payments appear (and are) legitimate. However, I do think there are certain cases where, on those specific facts, it would have been fair and reasonable for a bank to take action because the fraud alerts that they are supposed to deploy for regulatory and legal reasons, probably could and should have been triggered.”

The Financial Ombudsman is not bound by the law but has regard to what it considers to be fair and reasonable in all of the circumstances. However, the difference in approach is stark. It is arguable that the Financial Ombudsman is effectively "creating" new law in relation to claims by individuals by imposing additional obligations in circumstances where the courts would likely find that the banks had complied with the Quincecare duty.  This is obviously an uncomfortable state of affairs for banks.

Refusals to strike out Quincecare claims on an interim basis

Notwithstanding the lack of guidance on the scope of the duty in relation to corporate customers, the Courts have nonetheless shown a reluctance in recent years to strike out claims for breach of the Quincecare duty on a summary basis. Examples of such cases include:

• Hamblin v World First Ltd [2020] EWHC 2383 (Comm): In this case, the Court refused an application for summary judgment by World First, a payment services provider. The claimants brought representative proceedings against World First on the basis that (amongst other things) they had breached their Quincecare duty to the second defendant, a company which had been hijacked by fraudsters and into whose account the claimants paid around £140,000. Although here, the claimants were not the bank’s customers – and the fraudulent directors who had given the bank instructions were obviously aware of the fraud - the Court held that the Quincecare duty was owed to the company itself, not to those who control it. On that basis, the knowledge of the fraudsters could not be attributed to the company and it was realistically arguable that the bank had breached its Quincecare duty.
• Stanford International Bank Limited (In Liquidation) v HSBC Bank Plc [2020] EWHC 2232 (Ch): The liquidators of the claimant bank alleged that HSBC had breached its Quincecare duty, which had required it to freeze payments out of accounts by 1 August 2008; this was not in fact done until February 2009 (by which time, around £118 million had been paid out). HSBC applied for summary judgment on the basis that the claimant bank had suffered no loss as a result of the payments made, and this was refused by the High Court.
• IFTSAL v Barclays Bank Plc [2020] EWHC 3125 (Comm): The claimant, a victim of APP fraud, applied for permission to rely on documents obtained from the bank under a Norwich Pharmacal order. The claimant argued that that the documents showed that it was at least possible that Barclays (the only available, solvent defendant) had notice of the potential wrongdoing prior to the fraud. Exceptionally, the High Court granted the claimant permission to use the documents

In somewhat of a departure from the above line of cases, the High Court in Roberts v Royal Bank of Scotland Plc [2020] EWHC 3141 (Comm) granted RBS’ application for summary judgment. This was, however, on the basis that the claimant’s claims for breach of Quincecare duty (and breach of mandate) were time-barred under the Limitation Act 1980.

An increased duty for financial institutions?

There are a number of claims for breach of the Quincecare duty, which remain to be determined at trial, and no sign of the trend for claims of this nature abating. The analysis of the recent decisions in this area shows there is real need for a definitive ruling on precisely what does and does not constitute breach of the Quincecare duty when acting on the instructions of corporate customers.

Is it enough for a bank to refrain from taking action? If not, what positive action is a bank required to take and how can this be balanced against its primary duty to follow its customers’ instructions?

In Quincecare, there was evidence that the bank would have made further enquiries of the solicitors to whom the funds were being sent if fraud was suspected and, in Singularis, it was said at first instance that Daiwa should have paid the funds into a bank account in the name of the company rather than in the name of other companies within the same corporate group. However, neither of these steps are likely to have assisted JPMC in FRN. In that case, it remains wholly unclear from whom it should have sought to verify the propriety of the payments it made. The instructions it received emanated from senior levels of the Nigerian government and it is difficult to see how it could have determined whether other individuals with whom it consulted were also in league with those perpetrating the fraud.

Absent further judicial guidance, banks are left in an uncertain position when it comes to ensuring compliance with the Quincecare duty. While the scope of the duty in relation to individual account holders appears to have been clarified (at least by the courts if not the Financial Ombudsman), it remains to be seen how far the duty will be deemed to extend in relation to corporate customers.