Earlier this year, the High Court considered a claim by a customer against his bank in relation to its failure to process transactions whilst requests for consent under the Proceeds of Crime Act 2002 (POCA) were pending with the Serious Organised Crime Agency (SOCA). The case is the latest in a series of 'bank-friendly' decisions which indicate that customers will have an uphill struggle in challenging a financial institution's decision to make a suspicious activity report (SAR) when it suspects money laundering and/or its inability to process a transaction once it has done so.

The case of Shah & Anr v HSBC Private Bank (UK) Limited [2009] EWHC 79 (QB) does, however, hold open the theoretical possibility of a customer suing a firm for failing to take reasonable care in making a SAR to SOCA. On the facts, there was no breach of duty by HSBC, but firms may be exposed if they fail to act expeditiously. In this briefing we consider the case and its implications. We understand that the Claimants are seeking leave to appeal the ruling to the Court of Appeal.

Business Impacts

  • The court confirmed the low threshold for 'suspicion' and the difficulty of challenging a firm's decision to make a money laundering SAR.
  • It was accepted, however, that a firm's duty of care to its customer may not be completely excluded by POCA. A claim by a customer may be made out if, for example, there is an unreasonable delay to make a disclosure, or to carry out a transaction after consent is granted.
  • A delay of two days between a payment instruction and a SAR was, in the circumstances, not an unreasonable delay.
  • The Court gave additional guidance, albeit in the context of the now-replaced s.333 offence, as to what disclosures might constitute 'tipping off'.  


The claim was brought by Mr and Mrs Shah, two Zimbabwean-based customers of HSBC. HSBC suspected funds in their account to be the proceeds of crime. On four occasions the bank sought SOCA's advance consent to requests for transfers out of the account. In the usual way, HSBC delayed making the payments pending consent from SOCA. The shortest period between the date of the transfer instruction and the payment being made was 5 days, and the longest was 13 days.

HSBC explained the delay to Mr Shah by saying that it was complying with its UK statutory obligations. Mr Shah passed this explanation on to one of the intended payees. This led to rumours spreading in Zimbabwe that Mr Shah was suspected of money laundering in the UK. Mr Shah's case was that the Zimbabwean authorities therefore became suspicious and froze, then seized, his investments, allegedly causing losses of over US$300million. The reason for the bank's suspicion is unknown, and for the purposes of the case it was assumed that the funds were not, in fact, the proceeds of crime.

The nature of the application

The case concerned an application by HSBC for parts of Mr Shah's claim to be struck out and for summary judgment. In essence, HSBC was arguing that there were no reasonable grounds for bringing a claim, and that Mr Shah's case had no real prospect of success. Mr Shah also sought permission to amend his pleadings to make further allegations.

Accordingly, this was not a full trial of the claim and the case is of limited authority as a precedent. There are, however, a number of interesting observations made by the judge, and the case is instructive in terms of how the courts are continuing to approach claims in this area. The points which are of most interest, and which are considered further below, are:

  • whether HSBC breached its duties to Mr Shah in failing to comply with his instructions;  
  • whether HSBC owed a duty of care in the way it made its SARs, and in particular whether it could be sued for not making a SAR quickly enough;  
  • whether HSBC was in breach of its duties of confidentiality in making a SAR in circumstances where the relevant funds were not, in fact, criminal property; and  
  • whether HSBC would have committed a tipping off offence by providing, on Mr Shah's request, additional information to him about the SARs that had been made.
  1. Failure to execute payment instructions

Shah v HSBC is the latest in a line of cases, including NJ2 Limited v Cater Alleni, Squirrell Ltd v National Westminster Bank plcii and K Limited v National Westminster Bank plciii, where customers whose transactions have been delayed or refused have sued banks for breach of the bank mandate.

Generally, customers have fared badly in bringing such actions. Significantly, the K Limited case adopted a low threshold test for suspicioniv and indicated that, where a bank held a relevant suspicion, and a transfer was therefore (in the absence of SOCA's consent) illegal, there could be no breach of contract if the bank refused to comply with the customer's instructions.

The Shahs sought to challenge the application of K Limited in two principal ways. Firstly, they pointed out that if it the funds in the account turned out not to be criminal property, then it would not have been illegal for the bank carry out the instruction. Accordingly, it was argued that the customer's contractual rights could not have been suspended by illegality. Hamblen J dealt with this issue in short order, pointing out that a bank is most unlikely to be in a position to know whether or not funds are criminal property. The bank must make a report and seek consent when it has a relevant suspicion, and "in circumstances where a banker is effectively compelled to make an authorised disclosure under POCA he cannot be in breach of contract in so doing…". Analytically, the judge achieved the 'right' result (that the bank was not in breach of contract, even assuming that the property in the account was 'clean') by implying a term to this effect in the bank mandate, as an obvious and/or necessarily implied restriction of the bank's duties to its customer.

Secondly, the Shahs challenged the K Limited suspicion test by arguing that any suspicion must be "rational" and should not be "self-induced" or "mechanical". The judge rejected this as an "unwarranted gloss" on POCA and K Limited, explaining that: "To be a suspicion rather than a mere feeling of unease it must be thought to be based on possible facts, but the sufficiency of those possible facts as a grounding for the suspicion is irrelevant, unless good faith is in issue".

Clearly this is helpful to financial institutions who are sued by their customers; it reinforces the message that the court will not 'go behind' any evidence tendered that the bank was, subjectively, suspicious. The use of a low suspicion threshold does, however, emphasise the importance of institutions continuing to ensure staff are adequately trained so that red flags are picked up and the risk of prosecution for failure to report money laundering suspicions is minimised.

As to 'mechanical' suspicion, the Judge accepted that if a suspicion was generated automatically by a computer programme and was never held by a human then it "may well" be correct that it would not be a relevant suspicion for the purposes of POCA. It is therefore important that – as is usually the case – the output of automated monitoring systems is subject to proper review before being reported to SOCA.

  1. Do banks owe a duty of care in the way they make reports?

The Claimants also argued that HSBC had a implied contractual duty to take reasonable case in making SARs, and in particular to make a SAR "as soon as it was practicable to do so". Some aspects of the Claimants' arguments were rejected. Importantly, however:

  • Hamblen J accepted that a bank's duty of care to its customer may not be completely excluded by POCA. A claim by Mr Shah might therefore have been made out if, for example, there was unreasonable delay to make a disclosure, or to carry out a transaction after consent was granted.

This is a point which has not been addressed in detail in previous cases. It is significant in emphasising the importance of firms having adequate and effective resourcing in their AML/compliance teams. Failure to do so, if it leads to unreasonable delays in dealing with SARs/transactions, gives rise to a risk of a civil claim by the customer even in circumstances where it was appropriate that the matter be reported to SOCA. Adequate resourcing is, of course, also important from a compliance/systems and controls perspective. Indeed, the FSA commented in its Financial Risk Outlook 2009 that "At a time when banks may be under pressure to cut costs, they need to guard against the risk that risk management and control functions could suffer. This applies not just to management of financial risks, but also to …managing risks of fraud and financial crime".  

  • The judge found, on the facts, that a delay of two days between a payment instruction and an external SAR was not unreasonable. He accepted that a review of the matter at staff, Compliance and MLRO level (in accordance with HSBC's internal procedures) "will never be instantaneous, nor should it be".  
  • An argument by the Claimants that HSBC should have sought advance consent to future transfers failed as "it is difficult to see how one can seek and obtain consent to a transaction until the details of the transaction in question are known".

This is helpful, given the difficulty in persuading SOCA to give general consent to the operation of an account (either on the basis that doing so is an "arrangement" (contrary to s.328) and or alternatively that the bank is in possession of or using the funds (contrary to s.329), and therefore the legitimate subject of a consent request). What the case did not consider was whether HSBC could have applied for an increased threshold amount under s.339A(3)(b) in order to allow transactions to continue without the need for individual consents (unless new grounds for suspicion emerged). In this case, it is unlikely that would have assisted, as the transfers were very large. Banks should, however, consider this option given its availability.  

  • Any arguable inconsistency by HSBC in seeking consent to four large transactions but permitting other, smaller ones, "unless [it] goes to the issue of good faith, …is irrelevant".

The message appears to be that customers are likely to have little scope to complain about which transactions a bank chooses to report; but that, where a SAR is made, the bank may be under a duty to deal with it promptly/efficiently.

  1. Breach of confidentiality

Section 338(4) of POCA protects firms making SARs from breach of confidentiality claims, setting out that "an authorised disclosure is not to be taken to breach any restriction on the disclosure of information". Section 338(1) provides that a disclosure is "authorised" if it is a disclosure that property is criminal property, is made to an appropriate officer, and the relevant conditions set out in s.338 (eg. that the report is made before the 'prohibited act', or as soon as practicable thereafter) are fulfilled. The Claimants argued that, because the funds in the account were not, in fact, the proceeds of crime, the bank would not have been committing a 'prohibited act' by making the transfers without consent. They argued that the SARs were not therefore not 'authorised disclosures' within the scope of s.338, and were not covered by the s.338(4) protection.

The judge held that there could be "no doubt" that the disclosures were made under s.338, noting that "that is how POCA works". He recognised that, at the time of making a SAR, the bank could not know whether or not criminal property was involved. Accordingly, this was the only workable way to interpret the legislation. Indeed, the judge went so far as to state that a disclosure which does not fulfil the conditions of s.338 of POCA, or which is made otherwise than in the prescribed form and mannerv, can still benefit from the confidentiality protection in s.338(4). In practice, of course, s.338 should be adhered to, both to avoid committing an offence and to ensure that the confidentiality position is protected.

  1. Tipping off and failing to provide information

The Claimants also alleged that HSBC failed to comply with a request by Mr Shah for (a) information about why the transactions had been delayed, and (b) details of the authority to whom the SAR was made, the SAR reference numbers, date of SAR, and date of consent. HSBC relied on the fact that such disclosures might constitute tipping off under s.333 of POCA.

The judge agreed that there was "little doubt" that disclosure of the reason why HSBC had failed to effect the transactions would be likely to prejudice an investigation. Disclosure of information such as the date of the SAR and its reference number was said to be "less obviously prohibited, but it is still disclosing the possibility of an investigation". The judge therefore concluded that disclosure of the information would have involved at the very least a "serious risk" of a tipping off offence. It was accepted that the bank could not be in breach of duty in failing to provide information if it would have been a criminal offence to do so.

Section 333 has, of course, now been replaced by the new s.333A tipping off offence for firms in the regulated sector. Under s.333A, it is only an offence to disclose that a report has been made or that an investigation is being contemplated or carried out. However, the judge's comments remain relevant both in suggesting:

  • that a range of disclosures (other than simply stating that an investigation is underway) may be taken to be "disclosing the possibility of an investigation"; and  
  • that whilst a wide range of comments may be taken as potentially prejudicing an investigation, the 'compliance with statutory obligations formula' is acceptable. The reason for this is unclear. In practice, HSBC's explanation resulted in individuals in Zimbabwe correctly assuming that there was a money laundering investigation. Why is there a "serious risk" that providing SOCA reference numbers will prejudice an investigation, when providing information which suggests – on any common sense view – that a SAR has been made, does not?

It may be that in reaching his conclusions on these points the judge was concerned to reach a result that would be workable for banks, and/or was influenced by the evidence of the Metropolitan Police that they had asked HSBC not to disclose the information. In any event, both points suggest that, notwithstanding the introduction of s.333A, a prudent approach to tipping off is still necessary.


Customers continue to seek ways to recover losses they sustain as a result of money laundering reporting. To date there have been claims against both reporting institutions and SOCAvi. In respect of the former, the courts have taken the view that the losses a customer may suffer as a result of the way the reporting regime works represent a price Parliament has deemed worth paying in the fight against crime. However, Shah highlights that a residual duty to the customer remains, and that banks should take care to deal with suspicions promptly – as indeed HSBC did in this case.