Santander secures landmark APP fraud victory: Appellate Court rejects novel “retrieval duty” on a recipient bank

Alexia Knight, instructed by Alex Unger and Kristina Anglin of Addleshaw Goddard LLP and acting on behalf of Santander UK Plc (“Santander”), has achieved an important industry victory on appeal in Santander UK PLC v CCP Graduate School Ltd [2025] EWHC 667 (KB).

In the first appellate decision since the Supreme Court in Philipp v Barclays Bank UK plc [2023] UKSC 25, [2024] AC 346 (“Philipp”) held (in particular at [118]-[119]), that it was arguable that a bank owed a retrieval duty to take prompt steps to recover stolen funds, Eady J has rejected allegations that a bank owes a duty to third parties with whom it has no contractual relationship to take proactive steps to remedy harm already done, by seeking to recall payments already made on the proper and valid instruction of its customers.

The Claim

Between 13 September and 12 October 2016, CCP Graduate School Ltd (“CCP”) fell victim to an APP fraud. Duped by fraudsters, CCP was induced to authorise payments totalling £415,909.67 from its account with National Westminster Bank Plc (“NatWest”) into an account at Santander, which was held in the name of PGW Consultants Limited (“the Account”).  Consistent with the fraudsters’ directions, CCP’s instructions identified the account holder as “PGW Limited”. The payments were processed without reference to the account name of the recipient, in accordance with standard practice at the time.

On 18 October 2022, CCP brought claims against both NatWest and Santander. CCP alleged that Santander owed CCP a duty to take reasonable care to prevent Santander accounts from being used as instruments of fraud, and had breached that duty by allowing the funds received into the account from the NatWest account to be transferred out. CCP was not, of course, Santander’s customer and, as such, the existence of the alleged duty was inconsistent with the Privy Council’s decision in Royal Bank of Scotland International Ltd v JP SPC 4 [2023] AC 461 (“RBSI”). In addition, a claim for breach of such duty was, in the main, limitation barred (at least up to and including payments made on 17 October 2016).

Both banks applied for the claims against them to be struck out, and for reverse summary judgment. CCP cross-applied for permission to amend its claims, to allege breaches of a “retrieval duty”, pursuant to the door left open by the judgment of the Supreme Court in Philipp.

First Instance

At first instance, (judgment at CCP Graduate School Ltd v National Westminster Bank Plc [2024] EWHC 581 (KB)), the claims against NatWest were struck out. Permission to amend the claim against NatWest was refused, as it was a new claim brought outside the relevant limitation period.

Master Brown also struck out CCP’s claim against Santander in so far as it was premised on the Quincecare or Philipp duty. However, in reliance upon [118]-[119] of Philipp, the Master held that as against Santander the retrieval duty claim was (albeit defectively) already pleaded and that it was at least arguable that Santander owed CCP such a duty. The Master considered that “there might at least be some basis for arguing” that if the retrieval duty is effective, it is because the victim’s bank can promptly provide an indemnity to the first generation bank (the first recipient bank) against any liability arising from the first generation bank freezing the funds. He further held that that indemnity could then in turn be passed on to second and subsequent generation banks until the funds are located and frozen.

Decision on Appeal

Santander successfully appealed, with Eady J holding that “CCP’s case in this regard was bad in law and could have no real prospect of success” and striking out the entirety of the claim.

Eady J held that “that a receiving bank in these circumstances cannot be taken to have assumed any responsibility to the third-party victim of the fraud was made clear in RBSI”. In particular, that “a fraudster held an account with Santander did not give the bank any control over that customer” (distinguishing HXA v Surrey CC [2024] 1 WLR 335 and rejecting CCP’s reliance upon it); indeed, Eady J properly held that Santander’s obligation was to comply with its customer’s instructions. There was no basis for finding that Santander’s status as the fraudster’s bank in “some way gave rise to an obligation to protect those who might be harmed by its customer’s actions.”

It followed that there was no foundation for a “freestanding duty upon a bank to take positive steps to unwind harm already caused to a third party…by attempting to reverse payment orders…properly made on the instructions of its own customer”. Eady J held that such a duty would “plainly be in conflict with the observation made by Lord Leggatt at [117] [of Philipp]”.

Further, “[t]he identification in Philipp of an arguable duty of retrieval, owed by a bank to its own customer and arising out of the contractual relationship between them, does not alter that position.  Acknowledging the potential existence of such a duty does no more than allow that this might be a further facet of the bank’s contractual obligation to properly ascertain and comply with its customer’s instruction; it provides no basis the incremental development of an equivalent duty owed to a party with whom the bank had no contractual relationship.  To imply such a duty would, in my judgement, cross the line between the proper role of the courts and that of the legislator and regulator (Larsson v Revolut Ltd [2024] EWHC 1287 (Ch) [52]).” There is, quite simply, no proximity and no “special level of control” held by a bank over the movement of the money in the account, or over that money once it had left the account.

Also of significance for the banking industry is the finding, in respect of the system of indemnities, that “the fact that banks are willing to take steps to try to assist victims of fraud does not mean that the courts should find they have a legal obligation to do so.” Eady J recognised the practical (and indeed the impossible) position of a bank were such a duty to exist, requiring it to make a hasty adjudication upon an allegation of fraud against its customer, against the backdrop of the speed at which transactions are required to be effected. It would place an “unacceptable burden on banks going outside their contractual obligations with their customers”.

The decision clarifies the obligations owed by banks to third parties who fall victim to the increasingly prevalent problem of APP fraud.

Read the judgment in full here.