Santander UK PLC v CCP Graduate School Limited [2025] EWHC 667 (KB) – no retrieval duty against receiving bank

Mrs Justice Eady handed down her judgment in the High Court on 25 March 2025, allowing Santander’s appeal against the first instance decision of Master Brown, which had refused Santander’s application for strike out and/or summary judgment, on the basis that it was at least arguable that Santander, whose customer defrauded the Claimant, might owe a duty to retrieve the Claimant’s funds upon being notified of the fraud.

CCP was the victim of an APP fraud. In September and October 2016, they transferred over £400,000 from their account to one held by a suspected fraudster with Santander.

Summary of key findings

• There is no basis for finding that a receiving firm has a ‘retrieval duty’ – i.e. a duty on a receiving firm to attempt to recover misappropriated funds on behalf of a third party victim, upon being notified by that victim or their bank of a fraud practised by the receiving firm’s own customer. The court recognised that it would be operationally unworkable. The law is clear that a receiving bank does not owe a duty to third parties.
• A victim’s own bank is likely to owe some form of ‘retrieval duty’ given the right circumstances – this reflects that such a duty would lie in contract, rather than tort. Such a duty would be no more than “a further facet of the bank's contractual obligation to properly ascertain and comply with its customer's instruction”, as expressed in Philipp v Barclays.

Appeal Decision

• Eady J decided:
• Santander did not owe a duty of care to a third party, such as CCP. Its only legal duty was owed to its own customer. Santander had no control over its own customer and instead was obliged to comply with their instructions. There was no basis to distinguish the Privy Council’s decision in RBSI.
• A retrieval duty would be contractual. There was no basis for a freestanding tortious duty against a receiving bank.
• This would not be an incremental development of the law. A party generally needs to have assumed responsibility towards a third party and will not as standard owe a duty of care. CCP’s claim was considered to be fanciful, and not arguable.
• Although indemnities were generally given between banks, this was a voluntary practice and not a basis to found a duty. Eady J stated at paragraph 46 that “The existence of such a scheme does not, however, provide a proper basis for the implication of a duty of care in these circumstances; the fact that banks are willing to take steps to try to assist victims of fraud does not mean that the courts should find they have a legal obligation to do so”.

Observations and analysis

• This is a sensible decision, which recognises that a retrieval duty against a receiving firm is clearly unworkable. Eady J articulated this difficulty well at paragraph 47 of the judgment (our emphasis applied):
  “As presently pleaded, the duty for which CCP contends would require that, upon a fraud alert being raised by a stranger in relation to an account held by one of its customers, a bank must contact all other banks into which monies from the account have been transferred, and (contrary to the instructions of its customer) either seek an immediate recall of those sums or otherwise not allow further movements of those monies. That, it seems to me, would put a bank in the impossible position of having to make a speedy adjudication upon an allegation of fraud made against one of its customers by a third party. Even if it were possible to overcome that difficulty, it is hard to see how such an obligation would work given the number of transactions likely to be involved and the speed at which such transactions are required to be made; it would, as observed in RBSI at [80], place an unacceptable burden on banks going outside their contractual obligations with their customers”
• The indemnity process, whilst generally effective in a domestic context, often runs into problems when payments leave the UK, as foreign banks often refuse to provide an indemnity.
• While not part of the appeal decision, a retrieval duty claim against a paying bank is also likely to be difficult to prove because:
  • It can only begin to apply when a customer cancels their instructions to pay – Before that time, the bank would have no authority, still less an obligation, to retrieve funds on behalf of its customer (see Philipp, paragraph 117).
  • It is unclear how quickly a paying bank would need to act to avoid breaching the duty – This will be dependent on the facts. A bank is likely to be allowed a reasonable period. In CCP, the majority of their funds had been dissipated before the fraud report. Whereas in Philipp, Lord Legatt considered that the paying bank could have taken steps to recall the payments much earlier than it in fact did.
  • It is unclear what level of evidence would be required to engage the duty – a mere report of fraud (which would need to come from the customer, or at least be endorsed by them if it came from a third party) is unlikely to be sufficient to create an obligation to recover funds. That report may be unfounded. It would need to be at least somewhat substantiated following an investigation by the bank.
  • A claim would be based on a loss of chance – this means that even if the duty was engaged and breached, if no funds were in fact available for repatriation at the time of the fraud report, the claim is likely to fail.