In the recent case of Nemonia Investments Ltd v AmBank Islamic Berhad & 3 Ors [2023] 8 AMR 201, the High Court considered, among other issues, the duty of care of banks upon receiving notices regarding invalid payments / fraudulent transactions.
 
Background facts
 
Funds in the plaintiff’s account held in the Bank of Cyprus were transferred through the four defendants which are Malaysian banks into the accounts of Matt Advance Trading (“Matt”) or Weez Global Trading (“Weez”). The plaintiff contended that its lawyer was duped by unknown individuals to cause the said funds to be fraudulently transferred out of their account. The transactions were carried out by the defendants through the SWIFT system upon instructions from the instructing banks overseas. Various notices concerning the invalid payments / fraudulent transactions were issued by the overseas banks concerned to the defendants. The plaintiff then initiated legal proceedings, claiming that the defendants had been negligent in undertaking their business as bankers which caused damage to the plaintiff. The defendants argued that they acted under the instruction given by the overseas banks and / or they did not owe any duty of care to the plaintiff as the plaintiff was not their client and it was too remote to expect the defendants’ action to have any impact on the plaintiff.
 
The issues before the High Court include the following: 

The High Court’s decision
 
The High Court partially allowed the plaintiff’s claims against the 1^st defendant, but dismissed its claims against the 2^nd to 4^th defendants.
 
Whether a duty of care is owed to the plaintiff
 
The High Court first considered whether a duty of care is owed by the defendants to the plaintiff by applying the three-fold test laid down by the House of Lords in Caparo Industries Plc v Dickman [1990] 2 AC 605, namely: (i) whether there is a relationship of proximity between the plaintiff and the defendants (the proximity test); (ii) whether it is foreseeable that the defendants’ conduct could harm the plaintiff (the foreseeability test); and (iii) whether it is fair, just and reasonable to impose liability to the defendants for such harm (policy consideration).
 
The High Court held that the defendants did owe a duty of care to the plaintiff irrespective of the fact that the plaintiff is not a customer of the defendants. There was an indirect relationship between the defendants and the plaintiff as the defendants were aware that the monies were transferred from the plaintiff’s accounts with the Bank of Cyprus, thus the proximity test was fulfilled. The learned Judge was satisfied that it was foreseeable that the defendants’ conduct could harm the plaintiff and that it was fair, just and reasonable to impose liability on the defendants for such harm. According to Justice Emran, “Banks in this era should bear some responsibility and owe a duty of care to users of the financial system irrespective of whether they are their customers or otherwise.”
 
Standard of care and burden of proof
 
The High Court held that the burden of proof lies on the plaintiff to show the standard that must be complied with by the defendants and that the defendants did not comply with the said standard. Despite numerous reminders by the High Court, the plaintiff failed to produce evidence to show the standard of a reasonably competent banker or at least the standard expected by the Central Bank of Malaysia or internally by the defendants as to: (i) how accounts are to be opened; (ii) how accounts are to be monitored; (iii) how monies received overseas are certified; (iv) what anti-money laundering standards are to be complied with; and (v) what a reasonably competent banker would have undertaken. As such, the High Court held that the plaintiff failed to discharge the burden of proof required of it in its claim for negligence concerning the issue of: (i) opening of the accounts by the defendants on behalf of Matt and Weez; (ii) compliance with money laundering regulations; and (iii) enabling fraudsters to utilise banking transactions.
 
Whether the defendants were negligent when the monies were received
 
In considering whether the defendants should have made enquiries as to the purpose of the payment and ensured that the payments made from the plaintiff’s account were genuine, the High Court held that the said transactions were not on its face value suspicious as the monies were transferred through instructions received within the SWIFT system from credible financial institutions such as Deutsche Bank and Societe General which are international financial institutions of credible standing who would be expected to have undertaken their internal queries before payment instructions were given. As such, on the issue of monitoring the accounts of the alleged scammers when the monies were received, the High Court held that there was no breach of duty of care by the defendants.
 
Whether there is a duty to act when notices of fraud were received
 
As mentioned earlier, notices of fraud were received by the defendants from the overseas banks concerned, namely the instructing banks, Deutsche Bank and Societe General as well as the Bank of Cyprus.
 
The High Court held that the 2^nd to 4^th defendants were not liable because when the said notices were issued by the overseas banks to them, monies in the accounts at issue had already been withdrawn and the 2^nd to 4^th defendants could not have taken any action to freeze the accounts.
 
However, the High Court found the 1^st defendant liable for the monies transferred (RM315,000) after it received notice through the SWIFT system in MT999 format from the Bank of Cyprus alerting them of the fraudulent transaction. In the course of the trial, the 1st defendant’s witness suggested that it is their practice to ignore messages in the MT999 format and that the first defendant did not have any relationship with the Bank of Cyprus. Taking into consideration the growth of scams and fraudulent activities in the banking industry, the High Court held that the 1st defendant should not have ignored the notice merely because of the form used by the Bank of Cyprus. According to the learned Judge, a prudent and reasonable banker would have at least frozen the accounts and undertaken an investigation immediately upon receipt of the notice to ascertain the validity of the claim / notice. The learned Judge acknowledged that generally the court will not second guess the practice undertaken within an industry. However, when the practice is unreasonable, it is the obligation of the court to correct the practice and set the standards that should be undertaken by the banks.
 
Comments
 
This decision raises three noteworthy points.
 
First, banks may owe a duty of care to users of the financial system irrespective of whether they are the banks’ customers or otherwise.
 
Second, in discharging its burden of proof in a negligence claim against banks, the claimant  should produce evidence to show the standard of a reasonably competent banker or at least the standard expected by the Central Bank of Malaysia or internally by the banks.
 
Third, banks must not ignore a notice of fraudulent transaction received through the SWIFT system, regardless of the fact that the banks may have no relationship with the party which sent the notice. Banks are expected to investigate the validity of such notice, and take immediate protective steps which may include freezing the account pending the outcome of investigations.
 
Case Note by Claudia Cheah (Partner) and Tan Pheng Chew (Associate) of the Dispute Resolution Practice of Skrine