Late last year, the UK Supreme Court ruled that a London investment bank was liable for the loss of $204 million from a corporate account after the institution complied with authorised payment instructions from the company’s director.

The ruling, which imposed a $153 million penalty against the bank, is one that Financial Crime staff operating in common law jurisdictions should be aware of, as it points to a risk that may arise when offering facilities to corporate clients.

The claimant, Singularis Holdings Limited, was incorporated in the Cayman Islands to manage the personal assets of Maan Al Sanea, who served as a company director as well as being its chairman, president and treasurer. Although Singularis had six other directors, they played no active part in managing the company’s affairs. Al Sanea had the sole signing powers over the company’s bank accounts, which had been used in prior years for legitimate purposes.

As the UK unit of a Japanese investment bank, Daiwa Capital Markets Limited provided loan facilities to Singularis in 2007 for the purchase of shares, which were the security for the repayment of the loan. By June 2009, the shares were sold, the loan repaid and Singularis had a credit balance of $204 million in its account with Daiwa.

The financial crisis of the late 2000s, however, put Al Sanea and his Saad Group of companies in financial straits. In fact, credit rating agencies had by then given the Saad Group “junk bond” status. Al Sanea issued eight instructions to Daiwa to pay out, in total, the $204 million in the Singularis account to two companies in the Saad Group, one being a hospital, the other being a private airline.

Daiwa complied with the instructions. All the payment instructions were approved by the bank’s Head of Compliance or the Head of Legal or a senior credit officer. The transfer of funds, however, represented a misappropriation by Al Sanea and left Singularis unable to pay its other creditors. Interestingly, at no point did Daiwa deny that the company’s funds had been stolen. In September 2009, the Grand Court of the Cayman Islands made a compulsory winding up order and joint liquidators were appointed.

The claims against Daiwa

In July 2014, the Singularis liquidators brought a claim in the High Court against Daiwa for $204 million, using two arguments:

1. Daiwa provided dishonest assistance to Al Sanea in his breach of his financial duty to act in the company’s best interests;

2. Daiwa breached its Quincecare duty of care by executing Al Sanea’s payment instructions.

The Quincecare duty was established in the 1992 case of Barclays Bank plc v Quincecare after the High Court ruled that an implied term of a contract between a bank and its customer was that the bank owes a duty of care not to execute the customer’s instruction if it knows the instruction has been dishonestly given, or it shuts its eyes to obvious dishonesty, or acts recklessly in failing to make inquiries. Barclays were found not to be liable to its customer in this case, and in the decades that followed, no bank had been found to have breached its Quincecare duty.

Whilst the High Court rejected the claim that Daiwa had dishonestly assisted Singularis, it ruled that the bank had breached its Quincecare duty to the Cayman firm, which was also found to be partially liable for the losses due to contributory negligence. Accordingly, the High Court awarded Singularis $153 million (75% of $204 million).

After the Court of Appeal dismissed Daiwa’s subsequent challenge to the ruling, the case advanced to the UK Supreme Court.

The Supreme Court hearing

Before five Supreme Court judges, Daiwa argued that as Singularis was, in effect, a one-man company fully controlled by Al Sanea and that any fraudulent act committed by the company’s president should be viewed as fraud committed by the firm itself. As such, the Quincecare claim should fail because Singularis had engaged in illegal activity that resulted in its own financial losses, Daiwa argued.

The bank also asserted that Al Sanea committed illegal acts by submitting fraudulent payment instructions to the bank and by breaching his fiduciary duty to Singularis. The High Court had noted that fiduciary duties are intended to protect a company from becoming the victim of a wrongful exercise of power by the company’s directors.

In an unanimous ruling, the Supreme Court held that Daiwa’s fiduciary duty to its client would not be enhanced if Singularis were barred from recovering funds that had been illegally removed from its bank account.

Daiwa’s Quincecare duty “struck a careful balance between the interests of the customer and those of the bank any denying the claim would not enhance the integrity of the law,” the court ruled.   

A denial of Singularis’ claim would also have a “material impact upon the growing reliance on banks and other financial institutions to play an important part in reducing and uncovering financial crime and money laundering,” according to the ruling.

The court rejected Daiwa’s argument that there were sufficient regulatory and legal reasons for banks to fight financial crime and money laundering, and that exposing them to further civil liability would not enhance this public policy. The Court said that a rejection of the claim would be a disproportionate response to any wrongdoing by Singularis and that the Court’s ability to make a deduction for contributory negligence would ensure an equitable resolution. Therefore, the Supreme Court upheld the rulings of both the High Court and the Court of Appeal, whether or not Singularis contributed, in any way, to its own loss.

The Supreme Court separately rejected Daiwa’s argument that the Quincecare duty did not apply to its actions because the Caymans firm had committed fraud that resulted in its own financial losses.

Instead, the Quincecare duty applied to the bank upon its receipt of the fraudulent instructions, according to the ruling. Daiwa breached this duty extensively in executing the “obviously fraudulent” instructions, the court noted.

The breach of duty by Al Sanea could not be attributed to Singularis for the purpose of the Quincecare claim, the court held. A properly established company has an identity and legal personality separate from those its shareholders and directors. Although the company has to act through humans, the acts of such persons are only deemed to be those of the company when the individuals act in accordance with the company’s constitution and in accordance with company law.

As such, holding Singularis responsible for the fraud of its director would render the Quincecare duty inoperable in cases where it was most needed and would be retrograde step, the court found.

Missed red flags

According to a High Court ruling upheld by the Supreme Court, “any reasonable banker would have realised that there were many obvious, even glaring, signs that Mr. Al Sanea was committing a fraud on his own company when he instructed that the money be paid to other parts of his business operations. He was clearly using the funds for his own purposes and not for the purpose of benefiting Singularis. In making the payments without any proper or any inquiry, Daiwa was negligent.”

In practical terms, the justices expected Daiwa to take into account the severe financial problems faced by Al Sanea and the Saad group at the time of the payments, as well as the fact that Singularis’ creditors, including other banks, may have an interest in the funds. What’s more, Daiwa had sufficient evidence in hand to determine that something was “seriously wrong” with the way in which Al Sanea made use of the account.

The High Court further opined that “the Quincecare duty does require a bank to do more than accept at face value whatever strange documents and implausible explanations are proffered by the officers of a company facing serious financial difficulties”. Daiwa was also aware of the possibility that the payments to the hospital company were a sham, yet the bank gave the transfers less scrutiny than it had to other, unrelated payments, the court said.

In short, although Daiwa’s senior managers recognised that the account needed to be closely monitored, no individual was tasked with monitoring the account and it was therefore not monitored.

The bank’s compliance lapses have proven costly over time. Although Daiwa was found to be liable to Singularis for $153 million, which is currently the equivalent of £117 million, the firm made a provision of £164 million in its 2019 financial statements to cover the award plus interest and costs. A very expensive lesson indeed!

Another Quincecare claim

The precedent set by the Singularis ruling could soon bear fruit in an unrelated case brought by the Federal Republic of Nigeria against the London unit of JPMorgan.

The African government’s claims center on an account, held in the name of Nigeria, that effectively served as an escrow account to hold the proceeds of the sale of disputed oil exploration rights. On the instruction of Nigerian officials, who were authorised signatories on the account, JPMorgan paid $875 million in six tranches to an offshore company owned by a former Minister of Oil.

JPMorgan had suspicions that the transactions may have represented the proceeds of crime and hence submitted a Suspicious Activity Report to the Serious Organised Crime Agency (SOCA, now the National Crime Agency) seeking supervisory consent (now known as a “Defence Against Money Laundering”) to make each of the payments. SOCA consented to the payments but reminded the bank that consent only provided an absolute defence against a criminal charge of money laundering and would not provide a defence against any civil claims.

Following discovery of the empty account, Nigeria launched a legal action arguing that JPMorgan had breached its Quincecare duty by accepting and executing fraudulent payment instructions. The lender asked the High Court dismiss the claim without a full trial, saying that there was no breach of the Quincecare duty and that, even if there were such a duty, the terms and conditions of the account excluded any liabilty. The High Court rejected both arguments, ruling that only a full trial could determine whether JPMorgan breached its duty and that the wording of its client agreement did not shield it from potential liability.

Upholding the ruling, the UK Court of Appeal later noted that Quincecare duty is comprised of two separate but equal obligations.

Firstly, a financial institution has a “negative” duty not to execute fraudulent payment instructions. A bank also has a positive duty “to do something more” to resolve its concerns or suspicions about apparently fraudulent instructions.

Absent an out-of-court settlement, the High Court is currently expected to rule whether JPMorgan owed a Quincecare duty to Nigeria and, if so, whether that duty was breached. Due to the nature of precedent in the English legal system, the High Court in its judgment will be very strongly influenced by the Supreme Court’s ruling in the Daiwa case.

Many lessons to be drawn

There are lessons that financial crime staff may learn from these two cases.

Firstly, relevant bank staff, including compliance officers, credit officers, in-house lawyers, relationship managers and operations staff should be aware of the Quincecare duty and when it may apply to a customer. It is quite apparent that Daiwa staff did not consider such obligations when they discussed the financial problems that Singularis faced. For example, although a Compliance Officer signed off on some of the fraudulent transactions, he was only concerned about whether the payments were intended for sanctioned entities and did not take into account any Quincecare factors.

Secondly, although these two cases were civil in nature, there was an underlying predicate criminal offence in the Daiwa case and possibly in the JPMorgan case. Al Sanea appears to have been guilty of the criminal offence of fraudulent trading as set out in the Companies Act 2006 of trading with intent to defraud the company’s creditors. The author is not aware of any official guidance that mentions fraudulent trading as an underlying criminal offence. Should bank staff suspect that fraudulent trading has occurred or is being attempted, consideration should be given to whether a Suspicious Activity Report should be submitted.

Thirdly, the JPMorgan case is a reminder to compliance staff that the granting of consent by the authorities is only absolutely effective against a criminal laundering charge aimed at a financial institution. Consent is not an instruction to a firm to execute the transaction nor does it provide a defence against a claim of civil liability. It is noteworthy that JPMorgan did not proffer this argument in the court hearings so far.

Fourthly, the Daiwa case illustrates that not only are authorised banks and deposit takers subject to the Quincecare duty, but other institutions such as security dealers and asset managers who hold funds or assets belonging to customers are also subject to the duty to protect their funds and assets.

Fifthly, bank staff should understand when the Quincecare duty may apply to a customer—namely, when a reasonably prudent banker believes there are grounds for suspecting an order is an attempt to misappropriate the funds of its customer. Appropriate “red flags”, such as a company being financially distressed, should be outlined in any training material or session on this particular risk.

Sixthly, these cases demonstrate that not only may inadequate financial crime controls expose a firm to regulatory sanctions, they also show that a firm may face a punitive civil claim.

Seventhly, with two Quincecare cases before the courts in rapid succession, firms may expect similar claims from company liquidators seeking to recover funds for the benefit of a company’s creditors or from anyone who has suffered a loss following an authorised account signatory submitting fraudulent payment instructions.

Eighthly, while firms may seek to expressly exclude any civil Quincecare duty by means of revised terms and conditions, and while the Courts may or may not uphold this exclusion, there can be no exemption from the legal obligation to submit a Suspicious Activity Report should a particular situation warrant it.

Finally, one unintended consequence of the Daiwa decision is that firms may wish to increase the level of due diligence they apply to corporate customers. Firms that are in a position to detect payment instructions will be better placed to successfully resist a Quincecare claim. The more a bank understands the nature of a corporate client’s usual business and the nature of receipts into and payments from the account, the better suited it will be able to detect unusual instructions and payments.

An expensive education

Daiwa has learned a very costly lesson through its failure to properly consider its Quincecare duty and act accordingly. JPMorgan may soon learn a far more expensive lesson due to a failure to address its duty to a client. As compliance staff will not want their firms to learn such equally expensive lessons, they would be well advised to carefully the facts and implications of both the Daiwa and JPMorgan cases.

Denis O’Connor is both a Fellow of the Institute of Chartered Accountants in England & Wales and the Chartered Institute of Securities and Investment. He was a member of the British Bankers’ Association Money Laundering Committee from 2003 -10; and a member of the JMLSG’s Board and Editorial Panel between 2010 and 2016.

He has been a frequent speaker at industry conferences on financial crime issues, both in the UK and abroad.

This article is expressing personal opinions and is meant for information purposes only. The article does not intend to replace professional or legal advice. It is recommended that readers seek independent professional or legal advice, or speak to authorised persons/organisations.

RiskScreen: Eliminating Financial Crime with Smart Technology