I. Introduction
In what has been perhaps the most widely anticipated banking case of 2023, the UK Supreme Court in Philipp v Barclays Bank UK PLC has provided welcome clarification of the basis, scope and rationale of the so-called 'Quincecare' duty owed by a bank to its customer.1 Previously, the Quincecare duty was a free-standing duty owed by a banker to its customer in both contract and tort, whereby a banker had to refrain from executing a customer's payment order if the banker was 'put on inquiry' that it had reasonable grounds to believe that the order was an attempt to defraud the customer. Starting in 2017, there were a significant number of cases seeking to hold banks liable for fraudulent misappropriation based on breach of this duty. Most involved a similar fact pattern: in an attempt to misappropriate funds, a rogue agent of the bank's customer (i.e. a director seeking to defraud his or her company) gave unauthorised payment instructions to the bank purportedly on behalf of the customer, and sums were paid away.
In short, and specifically in the context of authorised push payment ("APP") fraud, as discussed further below, the UK Supreme Court in Philipp unanimously held that the Quincecare duty is not a free-standing duty, but simply forms part of the bank's duty to act with reasonable skill and care in carrying out its customer's payment instructions. Despite this clarification of the juridical basis of the duty, the test as to when a bank is put on inquiry remains largely the same. However, the clear focus is now on the circumstances in which a bank must verify whether the customer's agent (i.e. the rogue director) has actual or apparent authority to give the payment instruction in question. In other words, the law now asks whether the customer's agent has authority. Should that agent be dishonestly seeking to defraud its principal, then the rogue agent will lack authority, and the bank must confirm its customer's payment instructions if there are signs of irregularity. This conclusion was reached by the proper application of orthodox principles of agency in commercial law, and the re-set of the duty previously derived from Quincecare is to be welcomed. Moreover, the UK Supreme Court has confirmed that the so-called Quincecare duty has no application where the customer themselves gives the payment instruction, as in Philipp. This Client Alert examines the implications of the decision for pleading and proving a case involving misappropriation of funds from a bank's customer in England.
II. Brief re-cap of the so-called 'Quincecare' duty
Prior to Philipp, the modern scope of the Quincecare duty was understood as having been formulated by Steyn J in Barclays Bank v Quincecare ("Quincecare").2 The scope of duty had been expressed as follows:
"it is an implied term of the contract between the bank and the customer that the bank will observe reasonable care and skill in and about executing the customer's orders ... a banker must refrain from executing an order if and for so long as the banker is 'put on inquiry' in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate the funds of the company."3
On that formulation, the critical factual question for customers and banks alike was: what constituted having been "put on inquiry" that a payment instruction was actually an attempt to misappropriate funds from the customer? If the bank failed to make adequate inquiries and paid out sums on the basis of that purported payment instruction, it would have breached its duty in law to take reasonable skill and care "in and about" executing a payment instruction. The UK Supreme Court had, as recently as 2019, reiterated the correctness of the test from Quincecare: it determined that liability was generated "if and for so long as it [the bank] was put on inquiry by having reasonable grounds for believing that the order was an attempt to misappropriate funds."4
The development of the Quincecare duty has been highly unusual since Steyn J's decision (handed down in 1988) was first reported in 1992. It effectively lay dormant for 25 years and was only referred to a handful of times before 2017 in the United Kingdom. Following the successful trial decision in Singularis Holdings Ltd v Daiwa Capital Markets Ltd ("Singularis") and the UK Supreme Court's emphatic endorsement of that trial decision, the number of Quincecare claims accelerated.5 Including the UK Supreme Court's decision of the ultimate appeal in Singularis, the UK Supreme Court or the Privy Council have considered aspects of the so-called Quincecare duty four times since 2019.
The juridical basis, rationale and scope of the so-called Quincecare duty has now changed following the UK Supreme Court's latest decision in Philipp. We explore this decision itself in more detail below. Please also see our previous Quinn Emanuel Client Alert for further details on the pre-Philipp scope, policy rationale and juridical basis of the Quincecare duty.6
III. Facts of Philipp
The facts of Philipp are undeniably sad. Barclays' customer (Mrs Philipp) and her husband Dr Philipp were persuaded by a fraudster to transfer most of their life savings (over £700,000) from Mrs Philipp's Barclays account to offshore accounts in the UAE. The highly sophisticated fraud involved the fraudster pretending to be working for the National Crime Agency, and (following a similar pattern to other APP fraud cases) convincing Mrs Philipp that her money needed to be moved to 'safe accounts' to avoid her savings being lost. The fraudster was able to deploy techniques such as making phone calls to Mrs Philipps appear as if they were being received from the legitimate publicly available telephone number of the NCA, and from one of the police officers who visited the couple.
Indeed, the customer had been deceived to such an extent that: (i) before the first payment of £400,000 was made, the couple visited their local Barclays bank branch and Dr Philipps falsely declared that the UAE petroleum payee company was one he had previously dealt with; (ii) before the payments were made, the couple were visited by a uniformed police officer who informed them that a sophisticated fraud was being perpetrated against them, but they nonetheless still refused to cooperate with the police; and (iii) even after the full £700,000 had been paid away, Mrs Philipp visited Barclays' branch a further time seeking to make a third payment of £250,000, falsely claiming that the money had to be urgently paid that day under a contract, which they would lose if the urgent payment was not made (this did not convince Barclays to lift a block on account, which by this point had been frozen at the instigation of the police).
The money was paid away and the sums lost. It was, of course, too late to recover the money by the time Mrs Philipp came to the realisation that she had been defrauded. Mrs Philipp formally notified the bank of the fraud on 27 March 2018; however, it was only two months later, on 31 May 2018, that Barclays actually made attempts to recall the funds. This point is relevant to the only surviving claim Mrs Philipp may have following the UK Supreme Court's decision.
IV. What did Philipp decide?
Two preliminary points
There are two important preliminary points to note about Philipp. First, its facts concerned APP fraud. APP fraud occurs where an account holder has been induced by a third party fraudster to pay out money from their account; the payment order from the customer to their bank is therefore 'authorised', in the sense it was given by the customer themselves, and is a 'push' instruction, to send money from their account. Philipp was therefore not concerned with the fact pattern described in the introduction above, as here there was no agent involved. The customer herself gave the relevant payment instruction.
Second, Philipp was an ultimate appeal from summary judgment at first instance. Mrs Philipp, as the claimant, succeeded in the Court of Appeal.7 The Court of Appeal held that the Quincecare duty was not limited to the traditional 'internal fraud' cases, and that banks could be liable for breach of the duty in the context of APP fraud, whereby it was the customer themselves giving the impugned payment instruction. Barclays appealed that finding to the UK Supreme Court and won. Given that it was an ultimate appeal against summary judgment, the UK Supreme Court was required to assume that the facts alleged by the claimant were true. The essential legal question for determination was therefore whether the Quincecare duty has any application in a case where the relevant payment instruction was not issued to the bank by an agent of the bank's customer.
No free-standing duty
The UK Supreme Court in Philipp unanimously made a number of findings about the juridical basis of the so-called Quincecare duty. First, in a judgment given by Lord Leggatt, the Court found that the relevant duty is not "some special or idiosyncratic rule of law".8 Rather, it is:
"simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer's instructions."9
In other words, the duty forms part of the banker's duty to act with reasonable skill and care in carrying out its customer's payment instructions. The Court confirmed there is no free-standing 'Quincecare' duty subject to any special rules outside of those known and routinely applied in English banking law. That is the reason that this Client Alert refers to the 'so-called Quincecare duty': it is no longer correct to say there is such a duty under English law. Instead, any claims for misappropriation—which would traditionally fit within the rubric of Quincecare-style claims—must now be pleaded as a breach of a bank's duty to act with reasonable skill and care to interpret, ascertain and act in accordance with its customer's payment instructions. We discuss the implications of this finding further below.
Compliance with primary mandate is strict
Perhaps most importantly, the UK Supreme Court held that, unless otherwise agreed, a bank's primary duty is to comply with properly authorised payment instructions from its customer under the contractual mandate. In the words of Lord Leggatt, "[t]his duty is strict".10 Accordingly, if the payment instruction is so properly authorised, it is improper for a bank to import considerations from outside of the contractual mandate and engage in an attempt at questioning the commercial wisdom of the transaction. A bank must therefore pay upon its customer's request if the instructions are unequivocal. There are several points which follow from this.
First, the decision provides clarity on payment execution for investors, bank customers and banks alike. If the customer's instructions are unequivocal, the bank must comply with its duty and execute the payment. It therefore brings forward the Quincecare-style inquiry as to any suspect payment and locates it at the point of receipt of the payment instruction. If there are sufficient signs of irregularity or indicators of trouble at that point, such that the bank is on notice of a potential fraud upon its customer, the bank will be under a duty to properly ascertain its customer's instructions. In other words, the bank essentially has a duty to investigate the authority of the agent; the validity of the payment instructions is then evaluated through that lens.
Second, it removes the unresolved tension from the earlier Quincecare cases about the hierarchy of a bank's duties. The UK Supreme Court emphatically held that: "[t]he duty to exercise skill and care is subordinate to the bank's duty to carry out a customer's order to transfer money".11 The bank's primary duty is therefore to strictly perform its mandate, and pay money in accordance with those contractual obligations contained with the banker-customer contract. To suggest otherwise, in the words of Lord Leggatt, is "inconsistent with the first principles of banking law".12 Where the reasoning in the Quincecare line of cases went wrong, Lord Leggatt found, was that "it is impossible to derive from a duty to observe reasonable skill and care in and about executing a customer's order a duty not to execute the customer's order."13
Therefore, at common law in England, there are now no "conflicting" duties placed upon a bank, and accordingly, no need to reconcile any such presupposed conflict between (i) a bank's duty to pay and (ii) a duty to prevent a fraud from being perpetrated against its customer.
Duty of reasonable skill and care
As noted, instead of being conceptualised as a free-standing duty placed upon a bank by implication of law via the banker-customer relationship, the UK Supreme Court held that the results in the Quincecare line of cases are properly rationalised on the basis that the relevant duty is an application of the duty to act with reasonable skill and care to interpret, ascertain and act in accordance with its customer's payment instructions. A striking implication of this new basis for Quincecare-style claims is that claims for a bank's breach of the duty to act with reasonable skill and care will only be available where the contract permits the bank discretion in performing an obligation. This point was heavily emphasised by Lord Leggatt:
"The requirement to exercise reasonable care and skill only applies, and is only capable of applying, insofar as the contract gives the supplier any latitude in how the relevant services are carried out."14
To bring that point home to the reasoning in Philipp, one such area where there is discretion is in the interpretation and ascertainment of a customer's instructions. If those instructions are unclear, or have irregularities which a reasonable banker would consider warrants further investigation, it will be a breach of the bank's duty if payments are made prior to appropriate investigations being made.
Verification of agent's authority – agency analysis
As noted above, one of the key limits that the UK Supreme Court placed on Quincecare-style claims is that a bank will only be liable in these circumstances if it does not verify an agent's authority. Consequently, a customer—such as Mrs Philipp, acting as an individual and giving instructions for her own account—is unable to defraud themselves. The principles identified in Philipp therefore simply have no application in APP fraud, where the customer themselves provides the payment instruction.
Philipp affirmed that the reason why agency law provides the answer to resolving the Quincecare question is that, if the bank is put on inquiry by signs of irregularity or fraud, the rogue agent in these scenarios lacks apparent authority. To elaborate, a director or other agent of a company typically has actual and apparent authority to bind the company. The agent will have actual authority, insofar as he or she is expressly authorised by to bind the company; and apparent authority, insofar as he or she appears to third parties to have the requisite authority to bind the company (as principal) to relevant transactions. However, the UK Supreme Court explained that the authority conferred on an agent (i.e. a rogue director) does not include authority to act dishonestly, and therefore he or she will lack actual authority.15 As such, while the rogue agent will generally still hold apparent authority, if there are irregularities or signs of fraud, then they will also lack apparent authority: and the bank's duty requires the bank to investigate the situation to properly ascertain its instructions.
Reasoning along these lines was widely anticipated in the market both prior to and following the hearing in Philipp. In essence, the UK Supreme Court has brought the juridical basis of the so-called Quincecare duty into line with wider, orthodox principles of English commercial law. Indeed, the decision closely aligns with a recent decision of Lord Sumption sitting as a Non-Permanent Justice in the Hong Kong Court of Final Appeal. There, Lord Sumption NPJ held:
"... But if there are features of the transaction apparent to a bank that indicate wrongdoing unless there is some special explanation, then an explanation must be sought before it can be assumed that all is well. In other words, if a bank actually knows of facts which to their face indicate a want of actual authority, it is not entitled to proceed regardless without inquiry."16
V. The duty's elements: a closer look
Despite each of the findings identified above in the UK Supreme Court's decision, from a practitioner's perspective, there has actually been little practical change in the applicable test that banks must apply when facing potential situations involving misappropriation of their customer's funds. Lord Leggatt succinctly summarised the new principle, properly characterised in the context of the bank's duty of reasonable skill and care, as follows:
"Where a bank is "put on inquiry" in the sense of having reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, this duty requires the bank to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. If the bank executes the instruction without making such inquiries and the instruction proves to have been given without the customer's authority, the bank will be in breach of duty. It will also in making the payment be acting outside the scope of its own authority from the customer and will therefore not be entitled to debit the payment to the customer's account."17
Compare that formulation to the original test laid down in Quincecare, as extracted above:
"it is an implied term of the contract between the bank and the customer that the bank will observe reasonable care and skill in and about executing the customer's orders ... a banker must refrain from executing an order if and for so long as the banker is 'put on inquiry' in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate the funds of the company."18
Accordingly, all that has really changed in practice is that: (i) the duty to refrain from executing the instruction only now arises when instructions are given on behalf of an agent of the customer; and (ii) there is now an explicit focus on the requirement that the bank must make inquiries to "verify" the authority of the purported agent.
VI. Revised scope of Quincecare-style claims
Insofar as Quincecare-style claims are concerned, the new scope of the duty of reasonable skill and care as in England may be stated as follows:
- the duty of reasonable skill and care to interpret, ascertain and act in accordance with a customer's payment instructions means the bank must verify the authority of a customer's agent if the bank is 'put on inquiry' that executing those payment instructions may facilitate a fraud on the customer;19
- a bank will be 'put on inquiry' where there are reasonable grounds for believing that the payment order is an attempt to misappropriate the customer's funds;20
- the relevant duty is contractual, owed by a bank to its customer (as a term implied by law);
- no claim will lie against the bank if the performance of the contractual obligation involves no exercise of discretion by the bank—the key example being the bank's primary obligation to pay on the customer's instructions—which is a strict duty under its contractual mandate from the customer;21
- there is no conflict between the primary duty of a bank under its mandate, which is to execute its payment instructions, and the subordinated duty to verify a customer's payment instructions if there are signs of irregularity or fraud;22
- while the situations where claims will lie against banks for breach of duty will typically arise in scenarios involving agents of corporate customers, in theory the duty is not limited to corporations: it can apply where two individuals have a joint account, whereby one person has the power to bind the other acting as agent;23
- the relevant duty arises in relation to the specific payment instruction given to the bank, and the focus is squarely on whether the matters of which the bank has notice vitiate that specific instruction;24
- the duty of care is owed only to a bank's customers, and is not owed to any third parties;25 and
- finally, both within and outside of an insolvency context, claimants must clearly identify the loss suffered, which does not include payment of existing debts.26
VII. Pleading and proving a Quincecare claim post-Philipp
In light of Philipp and the new scope of the duty as set out above, certain modifications are necessary to pleading a claim that a bank has breached its duty of reasonable skill and care by failing to prevent fraudulent misappropriation. We consider that the following elements should (or should not) be pleaded:
- The claim must plead that the relevant contract is a banker-customer contract into which there is implied a contractual duty that the bank will act with reasonable skill and care in executing payment instructions.
- The claim should no longer contain a plea of negligence which is coextensive with the implied contractual duty. The UK Supreme Court in Philipp found that any duty in tort adds nothing to the contractual analysis.27
- The claim must plead out precisely which facts should have put the bank on notice that the specific impugned payment instruction was irregular and/or potentially fraudulent.28
- The claim must plead that the bank failed adequately to verify the authority of the rogue agent to act on behalf of the bank's customer.29 This includes pleading out the specific 'red flags' that were ignored or downplayed by the bank.
- The claim should specifically plead any contractual modifications to the scope the contractual duty of reasonable skill and care; in particular, any modifications to the mandate by a bank's general terms and conditions.30
- Claimants should plead out how and why the bank failed to conform to the applicable standards of modern banking practice that require maintenance of adequate controls to prevent such fraud.31
- Proving why the bank has failed to meet the applicable standards of modern banking practice will require expert evidence (and, following the JPM v Nigeria decision, claimants should not, generally speaking, adduce evidence about applicable money laundering safeguards – the focus is on the prevention of fraudulent payments, not proceeds of crime).32
- Following the UK Supreme Court's decision in Stanford, both within and outside of an insolvency context, claimants must clearly particularise the loss suffered by the customer.
VIII. Future developments
While the UK Supreme Court has certainly clarified the basis of the so-called Quincecare duty—which is now no longer 'the Quincecare duty' at all—there are still some lingering questions about how banking law will develop in this space.
First, claimants may seek to draft around the strict duty of a bank to pay under its mandate (which leaves very little room for Quincecare-style claims) by specifying in their banking contract that the bank has a discretion for the particular obligation in question. As noted above, where a bank has a discretion as to whether or not to do something, that will potentially open the door for misappropriation claims.
Second, Lord Leggatt made a somewhat cryptic reference in the Philipp judgment to an Australian case called Ryan v Bank of New South Wales.33 In that case, the Australian court held that there may be an implied restriction in a contract whereby a person subject to a duty is not required to literally always comply with the duty, if doing so was not reasonable. One of the examples given in that case where such an implied restriction may apply was where: "[a] paymaster ordered by his employer to take the employees' weekly pay to the pay office would act unreasonably in complying with the order if, on the way, he learnt that the pay office was occupied by a gang of armed robbers." While Lord Leggatt found that the Court did not have full argument on the point, as some commentators have pointed out, this comes close to saying—in the banking context—that there is (or could be) an implied restriction on the mandate that the bank should not have processed the payment, if there are glaring signs of fraud. It is an open question as to how different that type of analysis is to the previous, and now defunct, conceptualisation of the Quincecare duty.34
Given the present preponderance of fraudulent misappropriation claims and the volatile economic environment, it appears likely that there may be substantial further litigation to come in England and other common law jurisdictions on the application and nature of the duty as laid down in Philipp.
Footnotes
1. Philipp v Barclays Bank UK PLC [2023] UKSC 25 ("Philipp").
2. [1992] 4 All ER 363
3. Quincecare at 376 (bold emphasis added).
4. Singularis at [1].
5. [2019] UKSC 50.
7. [2022] EWCA Civ 318.
8. Philipp at [97].
9. Philipp at [97].
10. Philipp at [3].
11. Philipp at [64] (underline emphasis added).
12. Philipp at [3].
13. Philipp at [64].
14. Philipp at [35]. See also Selangor United Rubber Estates Ltd v Cradock (No 3) [1968] 1 WLR 1555.
15. Philipp at [91].
16. PT Asuransi Tugu Pratama Indonesia TBK (formerly known as PT Tugu Pratama Indonesia) v Citibank N.A. [2023] HKCFA 3 at [17].
17. Philipp at [97] (bold emphasis added).
18.Quincecare at 376 (bold emphasis added).
19. Nigeria v JPM at [2].
20. Philipp at [97]. See also The Federal Republic of Nigeria v JPMorgan Chase Bank, N.A. ("Nigeria v JPM") [2022] EWHC 1447 (Comm) at [152] citing Rose LJ at [127] in the Court of Appeal earlier in that litigation. Rose LJ in turn cited Lady Hale in Singularis at [1].
21. Philipp at [3] and [35].
22. Philipp at [64].
23. Philipp at [98].
24. Nigeria v JPM at [158].
25. Royal Bank of Scotland International Ltd v JP SPC 4 [2022] UKPC 18 at [40].
26. Stanford International Bank Ltd v HSBC Bank Plc [2022] UKSC 34.
27. Philipp at [34]. Lord Leggatt held that: "A similar duty is owed in tort; but as the duty in tort arises out of the contractual relationship, it can be no more extensive than the contractual duty and adds nothing to the analysis for present purposes."
28. The Federal Republic of Nigeria v JPMorgan Chase Bank, N.A. ("Nigeria v JPM") [2022] EWHC 1447 (Comm).
29. Philipp at [97].
30. Philipp at [26]. Lord Leggatt held that: "These implied terms and duties apply automatically by default unless modified or excluded by express agreement."
31. Philipp at [39]. For example, in Philipp, at trial Barclays' conduct would fall to be judged against the standard expected of a bank employee in a local branch faced with a request by a customer to transfer significant sums to an overseas payee.
32. Philipp at [39].
33. [1978] VR 555.
34. Paul Downes KC and Emily Saunderson, 'Philipp v Barclays: A Fraud too Far?' (Quadrant Chambers seminar, 26 July 2023'.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.