A July 2023 Supreme Court ruling (Philipp v Barclays) narrowed the classic Quincecare duty, but a May 2025 High Court judgment against FCA-regulated Moorwand Ltd shows that APP fraud can still trigger Quincecare-style liability where a payment institution’s own onboarding and monitoring failures put it “on inquiry.” Expect tougher civil suits, regulatory heat, and capital-flight risk for fintechs that keep “flexible” KYC in high-risk verticals.
5 Key Points
- What the duty is: Quincecare requires a bank/PSP to halt payments instructed by an agent of the customer when red-flag facts suggest fraud. mayerbrown.com
- Supreme Court clarification: When a customer directly authorises a payment (typical APP fraud), the victim’s own bank is no longer liable—but the Court reaffirmed that the duty survives where agency red flags exist.
- Onboarding matters: The High Court in Hamblin v Moorwand [2025] EWHC 817 held Moorwand liable because its lax KYC let a scam company open an e-wallet; the fraudster’s director acted as the account’s “agent,” re-activating Quincecare.
- Regulatory overlay: FCA expectations on AML/CTF mean PSPs must treat suspicious onboarding and transaction patterns as triggers to freeze funds—failure now invites both civil claims and Section 166 reviews.
- Market signal: Investors are repricing U.K. e-money licences; compliance lapses can wipe out cash buffers via litigation reserves and remediation costs.
Short Narrative
In 2023, the UK Supreme Court re-examined Quincecare in Philipp v Barclays. It ruled that a bank must execute a clear instruction from its customer—even if that customer is being duped—so the duty did not stretch to ordinary authorised push payments. The Court did, however, underline that if an agent sends the instruction and obvious fraud indicators exist, the bank must step on the brakes.
Fast-forward to 2025: victims of a crypto-themed APP scam sued Moorwand, the receiving PSP. Because Moorwand had waved through a shell company after minimal checks, the High Court found it “on inquiry” and ordered it to restore £160 k to the account, giving victims a recovery path.
Read our Moorwand reports here.
Extended Analysis – Legal & Market Fallout
- Scope creep for PSPs: The precedent pushes Quincecare beyond traditional clearing banks to e-money and wallet providers. Any firm offering settlement accounts now faces a dual test—regulatory AML plus civil-law Quincecare when agents act suspiciously.
- Derivative-action playbook: The Hamblin claim succeeded via a derivative action on behalf of the defrauded corporate account, sidestepping Philipp limits. Expect copy-cat claims whenever a scam vehicle is insolvent.
- Onboarding risk lens: Courts are effectively saying “bad KYC = you were on notice.” Historical ties to binary options and grey-market gambling (Moorwand, Clearhaus, etc.) will be mined by litigants to prove constructive knowledge.
- Insurance squeeze: Professional-indemnity carriers are already hiking premiums for EMI/PSP clients exposed to high-velocity APP corridors.
- Regulatory arbitrage is shrinking: With the FCA, Danish FSA, and BaFin increasingly sharing intel, firms that once bounced between jurisdictions (e.g., Moorwand’s network) now face coordinated enforcement.
Read our Clearhaus reports here.
Investment Implications
Exposure | Downside Risk | Opportunity |
---|---|---|
Listed fintechs with EMI licences | Higher litigation reserves, share-price volatility | Early adopters of AI-driven KYC could command premium valuations |
Private PSPs in gaming/crypto niches | Licence revocation, capital-raising difficulties | M&A buyers can demand steep discounts |
Insurtech underwriting PSP risk | Claims inflation | New products for Quincecare-gap coverage |
Recommendation / Warning
If you run or back a U.K. PSP, treat onboarding like a live bomb.
Deploy robust KYB, monitor directors’ histories, and document red-flag escalations. One sloppy file can trigger Quincecare liability even after Philipp. For investors, haircut valuations of EMI-heavy portfolios by at least 10–15 % until post-Hamblin controls are independently validated.