Financial institutions briefing: new risks for banks making suspicious activity reports
Monday, February 1, 2010
On 4 February 2010 the Court of Appeal handed down judgment in Shah v HSBC Bank Plc, paving the way for disgruntled customers to challenge banks who refuse to process transactions pending the response to a suspicious activity report ("SAR") made to the Serious and Organised Crime Agency ("SOCA").
Previous court decisions on this issue have been for the most part "bank friendly". But this latest decision will force banks to review their reporting systems and processes and to ensure they capture sufficient data about the basis of their suspicions.
Background
HSBC had refused to process a number of high value transactions on Mr Shah's account, and submitted consent requests to SOCA in accordance with the Proceeds of Crime Act ("POCA"). Mr Shah claimed damages arising out of the bank's refusal to comply with his instructions and for breaches of duty in failing to provide him with reasons for this. The Bank relied on their statutory obligations under POCA as a defence to the claim. They pointed out that they could be committing offences under POCA if they failed to report their suspicions or if they disclosed to Mr Shah that they had made SARs.
In the original hearing, the High Court dismissed Mr Shah's claim. Mr Shah had argued that in assessing whether or not the bank had a legitimate suspicion under POCA, the bank had to show that it had acted rationally and that "a negligently self-induced and mistaken suspicion" was not enough. The judge rejected these arguments and stated that the test of suspicion under POCA was a subjective one. He said it was irrelevant whether there were reasonable grounds for the suspicion, provided that it was genuinely held. It was enough that the relevant individuals "must think that there is a possibility, which is more than fanciful, that the relevant facts exist". The judge also concluded that the bank was quite right to refuse to provide any information about the SARs, since to do so would have run the risk of a tipping off offence under POCA. Accordingly Mr Shah's claims were dismissed at the original hearing.
Court of Appeal
In its decision last week the Court of Appeal upheld the finding that the test for a bank's suspicion was a subjective test. It confirmed that Mr Shah's claim could not succeed based on allegations of irrationality or negligently self-induced suspicion.
However, the Court decided that the claim should not have been dismissed at the original hearing (which was a summary judgment application rather than a full trial). Mr Shah was entitled to require the bank to prove at trial that it had the relevant suspicion. Importantly, the Court of Appeal held that in such circumstances, the bank would be subject to the usual rules regarding disclosure and witnesses. Consequently, the bank would have to supply any relevant documentation to Mr Shah. This would include documents evidencing or giving rise to their suspicion and communications with SOCA. Further, bank employees involved in the making of the SARs could be required to give evidence at Court and would be cross-examined.
During the initial 7 and 31 day periods that apply to consent requests under POCA, it remains the case that banks cannot be required to give any information about the reason for transactions not being processed. But the Court of Appeal pointed out that there is no reason for the same considerations to apply once those periods have passed. It described "the more leisurely process of an action for damages…well after the time within which authorisation had to be allowed or a restraint order applied for" and concluded that the bank would have to prove its case at trial by providing an explanation as to the basis for the SARs.
The underlying litigation will therefore now continue and banks will await the outcome of the final hearing with interest.
Implications for financial institutions
Importantly, the test regarding suspicion has not been altered by this decision. It remains a subjective test and the hurdle for banks to clear in demonstrating they were entitled to make a SAR or authorised disclosure is a low one.
However if a customer seeks to challenge their bank in circumstances where a SAR has been made, it is now clear that the background to and circumstances of the SAR can be the subject of detailed judicial scrutiny. MLROs and those working in SAR teams will potentially be called as witnesses to justify their actions, potentially several years after the decision in question.
Banks will therefore want to be satisfied that their records around SARs and consent requests are comprehensive and that document retention policies are aligned with the risk of customer challenges. The thought processes behind all SARs and consent requests should be carefully documented.
It will be interesting to see whether Mr Shah is successful in the underlying case for damages. The Court may also take the opportunity to provide guidance as to when customers should be provided with what information regarding SARs after the initial 7 day and 31 day periods have passed. Such guidance would doubtless be welcomed by all who practice in this area.
