High Court on appeal rejects novel 'retrieval duty' on a recipient bank

Posted: 03/04/2025

On 25 March 2025 the High Court handed down its judgment in the seminal case of Santander UK PLC v CCP Graduate School Ltd [2025] EWHC 667 (KB), which considered whether there is a tortious duty of retrieval on a recipient bank in relation to funds transferred as a result of fraud, when the victim of fraud is not a customer of that bank.  

The High Court (through Mrs Justice Eady) has now rejected the assertion that a bank owes a duty to third parties with whom it has no contractual relationship to take proactive steps to remedy harm already done, by seeking to recall payments already made on the proper and valid instruction of its customers. 

This is the first appellate decision since the UKSC, in Philipp v Barclays Bank UK plc [2023] UKC 25, [2024] AC 346, held (at paragraphs [118]-[119]) that it was arguable that a bank owed a retrieval duty to take prompt steps to recover stolen funds. 

In the landmark case of Philipp, the Supreme Court upheld the fundamental duty of banks to execute a customer's payment instructions promptly, ruling that the so-called Quincecare duty (which is 'simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions' (97)) does not extend to situations where the customer themselves, rather than their agent, has authorised the payment, even if the customer is a victim of fraud. 

The court held that a bank's primary duty is to carry out its customer's instructions promptly and accurately, unless doing so would be unlawful, and since Mrs Philipp had authorised the payments, Barclays was obliged to carry them out. 

While dismissing Mrs Philipp's primary claim, however, the Supreme Court refused summary judgment in relation to her alternative loss of chance claim regarding Barclays' alleged breach of duty, after the fraud had been discovered, in not taking adequate steps to recover the money which had been transferred to the United Arab Emirates. 

Background to the claim

CCP Graduate School Ltd fell victim to an APP fraud between 13 September and 12 October 2016, in that it was duped by fraudsters to authorise payments totalling £415,909.67 from its account with NatWest into an account at Santander held in the name of PGW Consultants Limited. The payments were processed without reference to the account name of the recipient, in accordance with standard practice at that time (CCP's instructions identified the account holder as 'PGW Limited'). 

On 18 October 2022, CCP brought claims against both NatWest (the paying bank) and Santander (the receiving bank), alleging the following:

1. NatWest breached its Quincecare duty; and
2. Santander owed CCP a duty to take reasonable care to prevent Santander accounts from being used as instruments of fraud, and had breached that duty by allowing the funds received into the account from the NatWest account to be transferred out. 

The important point here is that CCP was not Santander's customer and, as such, the existence of the alleged duty was inconsistent with the Privy Council's decision in RBS v JP SPC 4 [2023] AC 461. Further, the claim for a breach of this duty was, in the main, limitation barred (at least up to and including payments made on 17 October 2016). 

Both NatWest and Santander applied for the claims against them to be struck out, and for reverse summary judgment. 

The Supreme Court handed down its judgment in Philipp v Barclays in 2023, clarifying the scope of the Quincecare duty. Following this, CCP cross-applied for permission to amend its claims in response to both banks' applications, to allege breaches of a 'retrieval duty', pursuant to the door left open by the UKSC judgment in Philipp v Barclays. 

First instance – 2024 

At first instance, CCP's claims against NatWest were struck out. Permission to amend the claim against NatWest was refused, on the basis that it was a new claim brought outside the relevant limitation period. The only reason the retrieval duty claim by CCP did not proceed against NatWest, the issuing bank, is therefore because it was time barred. 

Considering CCP's amendment application against Santander, the court similarly held that the same analysis in relation to limitation applied, resulting in its dismissal. 

The court also struck out CCP's claim against Santander in so far as it was premised on the Quincecare duty but, in reliance upon [118]-[119] of Philipp v Barclays, it held that as the retrieval duty claim was (albeit defectively) already pleaded against Santander, it was at least arguable that Santander owed CCP such a duty. 

The master considered that 'there might at least be some basis for arguing' that if the retrieval duty is effective, it is because the victim's bank can promptly provide an indemnity to the first generation bank (the first recipient bank) against any liability arising from the first generation bank freezing the funds. He further held that the indemnity could, in turn, then be passed on to second and subsequent generation banks until the funds are located and frozen. 

Appeal – 2025

Santander successfully appealed the outcome of the claim, with Mrs Justice Eady holding that 'CCP's case in this regard was bad in law and could have no real prospect of success' and striking out the claim in its entirety. 

The basis for this decision was that the court considered that a receiving bank 'in these circumstances cannot be taken to have assumed any responsibility to the third-party victim of the fraud'. A key point flagged by the court was that the fact that 'a fraudster held an account with Santander did not give the bank any control over that customer' (distinguishing HXA v Surrey CC [2024] 1 WLR 335 and rejecting CCP's reliance on it).  

Consequently, Mrs Justice Eady found that there was no basis for considering that Santander's status as the fraudster's bank 'in some way gave rise to an obligation to protect those who might be harmed by its customer's actions'. 

It followed that there was no foundation for a 'freestanding duty upon a bank to take positive steps to unwind harm already caused to a third party…by attempting to reverse payment orders…properly made on the instructions of its own customer', given the court held that such a duty would 'plainly be in conflict with the observation made by Lord Leggatt at [117]' [in Philipp v Barclays]. 

An interesting further comment by the court, however, was that 'the identification in Philipp of an arguable duty of retrieval, owed by a bank to its own customer and arising out of the contractual relationship between them…allow[s] that this might be a further facet of the bank's contractual relationship to properly ascertain and comply with its customer's instruction'. The converse point, of course, was that this would provide no basis for the incremental development of an equivalent duty owed to a party with whom the bank has no contractual relationship, given there is no proximity and no 'special level of control' held by a third-party bank. 

As outlined above, the basis for the retrieval duty is paragraphs [115] to [120] (primarily [117] – [118]) in Philipp v Barclays, as it envisages that there may be circumstances in which banks have a duty to take reasonable steps to retrieve funds once they are on notice that payments have been instructed by customers who are victims of APP fraud. In that case, the UKSC referred to the fact that, while it was correct to regard as 'untenable any suggestion that the Bank should have taken steps to try to recall the payments before [the date on which the customer had countermanded her instructions]' [117], it was also arguable that when Mrs Phillipp reported that she had been induced to make the payments by fraud 'the Bank's staff should have sought her instructions on this point – which would surely have been given – as it was clear that Mrs Phillipp would now wish any available steps to be taken to recover the money' [118]. 

The UKSC's comments regarding the potential duty did not specify whether it could theoretically apply to issuing banks, receiving banks, or both. 

The CCP appeal was brought by Santander on the basis that the retrieval duty should not apply to first and second generation banks, ie receiving banks. 

The principal arguments raised by Santander at the appeal hearing were as follows:

• the potential retrieval duty should only apply to customer banks, ie issuing banks;
• imposing a retrieval duty upon first and second generation banks would potentially put them in conflict with their duties to execute customers' instructions;
• a retrieval duty cannot be owed to a non-customer; and
• such a duty would be unworkable for first and second generation banks even if indemnities were offered by customer banks. 

Therefore, while this appellate decision clarifies the obligations owed by banks to third parties who fall victim to the increasingly prevalent problem of APP fraud, it does not alter the current position in respect of the retrieval duty's potential application to customer banks (which remains untested).  

Return to news headlines