Unknown knowns, Norwich Pharmacal Orders & banks’ duties to their customers
Sometimes a claimant knows (or thinks they know) a wrongdoing has happened but either they do not have the evidence to prove it or they don’t know the identity of the wrongdoer. In those circumstances, the Norwich Pharmacal Order can come to the rescue. A Norwich Pharmacal Order (NPO) obliges a third party to disclose information, subject to certain conditions. Banks are increasingly finding themselves on the receiving end of NPOs, possibly due to the rise in financial fraud such as authorised push payments. While complying with court orders is essential, banks need to ensure they deploy an appropriate response to applications for disclosure. Failure to do so can result not only in potential liability for breach of confidentiality but potential liability for the wrongdoing itself. In this article we consider a number of recent cases relating to banks and NPOs and some of the practical pitfalls to be avoided.
What is the test for obtaining an NPO?
Norwich Pharmacal relief derives from the court’s equitable jurisdiction. It is a flexible remedy continuously evolving through case law. The test for obtaining an NPO was recently clarified in the High Court case of Collier & Ors v Bennett  EWHC 1884 (QB). The requirements are as follows:
- There must be a good arguable case that a legally recognised wrong has been committed (the arguable wrong condition)
- The respondent must be mixed up in (innocently or not) so as to have facilitated the wrongdoing (the mixed up in condition)
- The respondent must be able, or likely to be able, to provide the information or documents necessary to enable the ultimate wrongdoer to be pursued (the possession condition); and
- The disclosure must be appropriate and proportionate in the circumstances, bearing in mind the exceptional but flexible nature of the jurisdiction (the overall justice condition).
How can the information obtained in an NPO be used?
The information cannot normally be used other than for specified purposes (typically considering and/or commencing proceedings against the ultimate wrongdoer) without the permission of the court. Undertakings to that effect must be provided by the applicant. NPOs are also not generally available against respondents likely to be party to the proceedings (pre-action disclosure under CPR 31.16 is the appropriate route in that instance). On that basis, banks disclosing information pursuant to NPOs do not generally anticipate litigation against them as a result of the disclosure.
However, that position has changed somewhat as a result of the recent case of I.F.T. S.A.L. Offshore v Barclays Bank Plc  EWHC 3125 (Comm). IFT was a victim of authorised push payment fraud. It transferred money to pay a supplier but that transfer was diverted by a fraudster to an account they had set up at Barclays Bank. Barclays in turn transferred it to an account in the U.A.E. IFT obtained a Norwich Pharmacal order against Barclays and in support of that application, stated “as of today…there is no intention to bring a claim against Barclays”. IFT also gave a standard undertaking that it would not use the information obtained for any civil or criminal proceedings except for specified purposes (which did not include bringing a claim against Barclays). On review of the information disclosed, however, (which showed that there was no possibility of recovery from the fraudsters, and that Barclays had failed to take action on being notified of the fraud for 4 days, despite having earlier made a Suspicious Activity Report regarding the account) ITF obtained permission to bring an application for pre-action disclosure and/ or proceedings against Barclays Bank.
Barclays Bank opposed the application for permission on the grounds that there was a public interest in the protection of bank confidentiality. It also contended that it would set a precedent for a claimant to sue the bank itself where the information disclosed under a NPO meant it was unable to proceed against the fraudster. This in turn, it argued, would facilitate victims of fraud bringing speculative cases against banks, putting banks to “expense and expenditure of time”.
The court dismissed the bank’s arguments. It held there were “cogent and persuasive reasons” to grant permission to use the documents. In relation to Barclays’ concerns about speculative claims, the court held that a bank could always resist a Norwich Pharmacal application and that the best way to discourage speculative claims against banks was by striking out such claims, rather than refusing permission to use information from NPOs.
So should a bank oppose a Norwich Pharmacal application?
The case of Zeus Investors v HSBC Bank Plc  EWHC 3272 (Comm) (a judgment given shortly after I.F.T. S.A.L. v Barclays) is a neat example of a bank appropriately, and successfully, opposing an application for a NPO.
The applicants/claimants in this case numbered approximately 200 and the proposed claim related to damages for breach of contract/negligence in relation to tax mitigation schemes relating to film production. The intended defendant in the ultimate claim (as well as the respondent in the NPO) was HSBC. This was one of the primary grounds upon which the application was successfully resisted. The court held “The real difficulty for the claimants is not so much that HSBC might be said to be “mere witness” or might not be in possession of the documents, but in the fact that HSBC is the proposed defendant and the real battle ground is in relation to the overall justice condition and whether the information sought is necessary in the interests of justice, in circumstances where, if a claim is brought, disclosure will be given (and specific disclosure if justifiable sought in the context of the disclosure process).”
In addition to the court’s conclusion that the overall justice condition was not met, the court also found that the disclosure sought was not necessary (a contingent part of the possession condition). In fact, the court held the disclosure sought was properly characterised as a “fishing expedition” that would not be granted in pre-action disclosure or standard disclosure. The NPO also failed to properly identify the applicants. The court highlighted that given the discretionary and intrusive nature of an NPO “it needs to be clear who is applying for it, who is receiving that information and who can use it, so it can be assessed whether they have any entitlement to such information and whether it is inappropriate to give them such information. It is also necessary to know who the claimants are, in the context of the envisaged order, and the undertakings being proffered and in relation to the cross undertaking in damages.”
Other recent Norwich Pharmacal cases
In Stokoe Partnership Solicitors v Mr Robinson & Ors  EWHC 3312 (QB), the court considered whether cross-examination can be ordered in relation to information provided under an NPO. It held that there is a jurisdiction to order cross-examination on information provided pursuant to an NPO, but that this should only be exercised in exceptional circumstances. Even though two NPO respondents had given conflicting accounts in their affidavits, this was not (bearing in mind all the circumstances of the case) such an exceptional circumstance.
In Burford v London Stock Exchange  EWHC 1183 (Comm), the court rejected Burford’s NPO application against the London Stock Exchange for disclosure of the identities of those trading in its securities to enable it to bring possible market manipulation claims. It found that Burford did not have a good arguable claim against the alleged wrongdoer. Further, the court also held that in circumstances where the FCA had also concluded no wrongdoing had taken place, ordering disclosure to facilitate a possible private prosecution would not satisfy the overall justice requirement. This was another case in which the application for relief was successfully resisted.
What lessons can banks learn from recent case law?
In Jofa v Benherst Finance & Anor  EWCA Civ 899, the court made it clear that banks need to tread carefully in relation to NPOs, in light of their duties to keep their customers’ affairs confidential. They may well be in breach of such duties if they disclose information without the protection of a court order. It is therefore crucial to await an actual court order before complying with any requests for disclosure.
Case law over the last year shows, however, that it may no longer be appropriate for banks to simply adopt a “neutral” position and await the outcome of the application. In particular, given the outcome in I.F.T. S.A.L. v Barclays, banks may need to be prepared to scrutinise more carefully the application and consider whether or not it should be vigorously defended either as a whole, or in terms of the scope of the information sought.
In particular, recent cases show that where there is any suggestion at the time of the NPO application that the bank itself is or may be an intended defendant, this may be a ground upon which disclosure can be resisted. Further, where it cannot be proved that the information is necessary or where it has the characteristics of a “fishing expedition”, careful consideration needs to be given to the appropriate response.