Banking Law and Payment Systems

Introduction and context

Banking law governs the legal relationships, duties, liabilities and controls that arise when financial institutions accept deposits, provide credit, execute payments and hold customer information. Payment systems connect banks, payment institutions, merchants, businesses, governments and consumers. Their legal importance is especially clear when a payment is delayed, duplicated, unauthorized, reversed or intercepted by fraud.

This chapter uses general common-law and regulatory principles. Exact rules vary by jurisdiction; students must consult the relevant banking, payments, negotiable-instruments, data-protection, insolvency and consumer-credit legislation in the country concerned. The central professional skill is therefore not merely memorizing rules, but identifying the legal relationship, locating the applicable statutory framework and applying it to evidence and facts.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the banker–customer relationship and distinguish its principal legal features.
2. Analyze deposit accounts, mandates, confidentiality and duties of care.
3. Explain lending responsibilities, security, responsible credit assessment and default management.
4. Describe negotiable instruments and compare them with electronic payment instruments.
5. Distinguish payment authorization, authentication, clearing, settlement and finality.
6. Apply legal principles to unauthorized transactions, errors, fraud and payment disputes.
7. Evaluate open banking, operational resilience, outsourcing, artificial intelligence and customer protection.
8. Recommend legally sound and ethically responsible controls for banking operations.

1. The banker–customer relationship

A banker–customer relationship ordinarily begins when a bank agrees to open an account. It is primarily contractual, but it is also shaped by statute, regulation, tort or delict, equitable duties, fiduciary principles in limited circumstances, and general duties of good faith or fair dealing where recognized.

The relationship is often described as a debtor–creditor relationship. When a customer deposits money into an ordinary current or savings account, ownership of the deposited funds generally passes to the bank, which becomes debtor; the customer receives a contractual right to repayment or payment instructions according to the account terms. The bank is not normally a trustee of each deposited unit of currency. This differs from a trust account, segregated client-money account or custody arrangement, where the institution may hold assets for another person and owes distinct duties.

When the bank grants a loan, the positions reverse: the bank is creditor and the borrower is debtor. A single customer may therefore be debtor on a loan and creditor on a deposit account. Set-off may be possible, but only where legal requirements, contractual terms and fairness obligations are satisfied.

Bank as agent and service provider

A bank may act as an agent when collecting cheques, executing payment instructions, purchasing securities or performing another task on the customer’s behalf. It may also act as a custodian, adviser, payment-service provider or data processor. The legal consequences depend on the service actually supplied, not merely on the label used in a standard-form contract.

A bank’s implied duties commonly include:

• maintaining an accurate account;
• honoring a valid instruction when sufficient funds or credit are available;
• exercising reasonable care and skill in carrying out banking services;
• keeping customer information confidential;
• providing statements and transaction records;
• following a valid mandate and monitoring changes to authority; and
• complying with applicable anti-money-laundering, sanctions, prudential and consumer-protection rules.

These duties are not unlimited. A bank may refuse an instruction where it is unlawful, suspicious, outside the mandate, blocked by sanctions, affected by a court order, or unsupported by available funds. A bank must, however, communicate important restrictions and avoid misleading the customer.

2. Accounts, mandates and authority

Types of account

A current account is designed for frequent payments and withdrawals. A savings account generally emphasizes deposit-taking and interest, although the legal distinction varies. A fixed-term deposit restricts withdrawal for an agreed period. A joint account is held by two or more persons and operates according to the account mandate. A trust, escrow or client account may require segregation and restrictions on beneficial ownership.

The account-opening process is both contractual and regulatory. Banks normally verify identity, beneficial ownership, source of funds, tax status and risk indicators. Know-your-customer controls protect the financial system, but they must be applied lawfully, proportionately and without unlawful discrimination.

Mandates

A mandate is the customer’s authorization concerning who may operate an account and how instructions must be given. Examples include a sole-signature mandate, joint signatures, corporate resolutions, powers of attorney and delegated authority for employees.

A bank that pays in accordance with an apparently valid mandate may obtain legal protection, particularly where it acts in good faith and without negligence. Protection may be lost if the bank knows of forgery, death, incapacity, revocation, insolvency, unauthorized changes or suspicious circumstances. A corporate bank must distinguish the authority of an employee from the authority of the company itself.

Revocation is effective when communicated in a legally adequate manner, subject to the account contract and applicable law. Banks should maintain reliable records of mandates, use dual controls for high-risk changes and verify unusual instructions through an independent channel.

Statements and records

Statements are important evidence but may not be conclusive in every legal system. Customers should review them promptly and report errors. Banks should preserve transaction logs, authentication records, consent records, communications and audit trails for the period required by law. Electronic records may be admissible if their integrity and provenance can be demonstrated.

3. Confidentiality, privacy and disclosure

The traditional duty of banking confidentiality protects information about the customer’s affairs obtained through the banking relationship. It is broader than secrecy about account balances: it may cover identity, transactions, financial condition, business relationships and credit information.

Confidentiality is commonly subject to exceptions where:

1. disclosure is compelled by law or court order;
2. disclosure is justified by a public duty, such as reporting specified financial crime;
3. disclosure is necessary to protect the bank’s legitimate interests, for example in litigation or debt recovery; or
4. the customer consents to disclosure.

Modern privacy legislation adds requirements concerning lawful basis, purpose limitation, data minimization, accuracy, retention, security, access rights and breach notification. A bank must distinguish a lawful regulatory disclosure from an unnecessary disclosure to a commercial affiliate. Consent should not be treated as a cure for every excessive or unfair data practice.

Confidentiality also creates practical tensions. A bank may need to report suspicious activity without informing the customer where anti-tipping-off rules apply. It may share data with a cloud provider or fraud-monitoring service, but it remains responsible for selecting, monitoring and contracting with service providers appropriately.

4. Lending duties and the credit relationship

Lending is governed by the loan agreement, credit legislation, security law, insolvency law, prudential rules and general principles of responsible conduct. The bank must establish the amount, interest, fees, repayment schedule, events of default, representations, covenants, security and enforcement rights with sufficient clarity.

Credit assessment

A prudent lender assesses identity, capacity, affordability, repayment sources, collateral, concentration risk and potential fraud. A useful conceptual model is the “five Cs”: character, capacity, capital, collateral and conditions. It is a risk framework, not a legal formula and not a substitute for statutory affordability requirements.

A bank is generally not a guarantor of the borrower’s success. Nevertheless, liability may arise from misleading statements, negligent advice, failure to follow agreed procedures, unfair terms, unlawful discrimination, irresponsible lending or abuse of a vulnerable customer’s circumstances. Consumer-credit regulation may require an affordability assessment, standardized disclosures, cooling-off rights, restrictions on charges and fair treatment during arrears.

Security and enforcement

Security reduces expected loss but does not eliminate credit risk. Common forms include mortgages, charges, pledges, liens, guarantees and assignments. Validity and priority commonly depend on formalities, registration, notice, control and the identity of the asset owner. A guarantee should be documented carefully because guarantees are often construed strictly and may require independent advice where a surety is vulnerable.

On default, a lender should follow contractual notice provisions, statutory time limits, court requirements and proportionality standards. Enforcement must not involve harassment, misleading representations or unlawful seizure. Restructuring, payment plans and forbearance may be commercially sensible and may be required by consumer-protection rules, but a concession should not be represented as a permanent waiver unless intended.

5. Negotiable instruments

Negotiable instruments are written or electronic instruments that embody a payment obligation and may be transferred under rules designed to support commercial certainty. The classic instruments are bills of exchange, cheques and promissory notes, although electronic systems increasingly perform similar economic functions.

A bill of exchange is an unconditional order by one person, the drawer, directing another, the drawee, to pay a specified sum to a named person or bearer, on demand or at a determinable future time. A cheque is generally a bill drawn on a bank and payable on demand. A promissory note is an unconditional promise by the maker to pay.

Important concepts include:

• signature and formal validity: required elements must be present under the governing law;
• delivery: the instrument must be issued or transferred in the legally relevant manner;
• endorsement: a signature or transfer instruction may negotiate the instrument;
• holder: the person in possession with the relevant legal entitlement;
• holder in due course: in jurisdictions recognizing the concept, a qualifying holder may obtain stronger rights than a prior party;
• dishonour: refusal to accept or pay when due; and
• crossing and restrictive instructions: mechanisms that limit payment or specify collection conditions.

A bank’s payment of a cheque may be protected where it acts in accordance with the instrument, mandate and statutory requirements. Forgery, alteration, negligence, late presentation and breach of crossing rules can allocate loss between the bank and customer. Electronic truncation and image-based clearing reduce physical handling but do not remove the need for authenticity, integrity and dispute procedures.

6. Electronic payments and the payment chain

Electronic payments include card transactions, credit transfers, direct debits, mobile-money transfers, instant payments, digital wallets and online payment gateways. The legal analysis should separate five events:

1. Instruction: the payer communicates an intended payment.
2. Authentication: the provider verifies evidence linked to the payer, such as a password, device, biometric or one-time code.
3. Authorization: the provider accepts the transaction under the account mandate and applicable controls.
4. Clearing: institutions exchange, validate and calculate obligations.
5. Settlement: final transfer of funds or settlement balances between participants.

Authentication does not prove that the genuine customer intended the payment. A customer may have been deceived into approving a fraudulent transaction. Conversely, a payment may be unauthorized even though a criminal used valid credentials. Liability depends on the payment contract, statute, negligence, gross negligence, fraud, authentication rules and the facts of the incident.

Push and pull payments

In a push payment, the payer instructs the bank to send funds, as in a credit transfer. In a pull payment, the payee initiates collection under a mandate, as in many direct-debit arrangements. A push-payment scam may involve an authorized instruction induced by deception; a direct-debit dispute may concern an absent, revoked or exceeded mandate.

Errors and unauthorized transactions

A sound dispute investigation asks:

• Was there a valid mandate?
• Was the instruction authenticated and recorded reliably?
• Was the transaction technically altered or intercepted?
• Did the customer act fraudulently or with unreasonable carelessness?
• Were warnings clear and timely?
• Did the bank’s monitoring identify unusual behavior?
• What statutory reimbursement, notification and complaint rules apply?

The bank should preserve evidence, suspend further loss where possible, communicate transparently and avoid automatically blaming the customer. Complaints should be handled independently from the staff member whose decision is challenged.

7. Payment finality, clearing and settlement risk

Payment finality is the point at which a transfer becomes irrevocable and unconditional under the applicable rules. It is not necessarily the moment a customer sees a credit in an online account. A payment may be provisional, reversible for fraud, subject to a return process or dependent on settlement between participating institutions.

A payment system’s rules should identify when obligations are accepted, when netting occurs, when settlement is final and what happens if a participant fails. Statutory protections for designated systems are important because insolvency law might otherwise unwind transactions and create systemic uncertainty.

Gross and net settlement

In real-time gross settlement, each qualifying payment is settled individually, usually in central-bank or settlement-bank funds. In net settlement, obligations are offset and only net amounts are settled at designated times. Netting reduces liquidity needs but concentrates settlement risk around the net settlement point.

For two participants, if participant A owes B 80 units and B owes A 50 units, the net obligation is 30 units from A to B. Netting does not erase the underlying legal claims unless the system rules make the netting legally effective. A student should distinguish operational netting from legally enforceable close-out netting.

8. Open banking and data-enabled finance

Open banking allows regulated access to payment-account data or payment initiation through secure interfaces, usually with customer permission. It seeks to increase competition, portability and innovation. Its legal foundations include explicit consent or another lawful basis, strong customer authentication, secure access, liability allocation and data-protection rights.

The principal risks are consent fatigue, screen scraping, malicious third-party providers, inaccurate data, discriminatory credit scoring and unclear responsibility when several firms contribute to a transaction. Consent must be informed, specific and revocable where the law requires. A provider should not use transaction data for unrelated marketing merely because access was granted for account aggregation.

Open banking also changes the allocation of operational risk. Banks, application-programming-interface providers, fintech firms, cloud suppliers and identity providers may each control part of the customer journey. Contracts should allocate incident notification, evidence preservation, service levels, audit rights, subcontracting controls and customer redress.

9. Operational resilience and governance

Operational resilience is the ability to prevent, adapt to, respond to and recover from disruption while maintaining important business services. Relevant threats include cyberattack, cloud outage, telecommunications failure, insider abuse, software defects, data corruption, third-party collapse and physical disaster.

A resilience program should identify important business services, map dependencies, set impact tolerances, test severe-but-plausible scenarios, maintain recovery arrangements and report weaknesses to senior management. Business continuity is not only an information-technology issue: legal, communications, treasury, customer-service and compliance teams must be involved.

Banks should apply governance controls to automated decision systems. Artificial intelligence may assist fraud detection, credit assessment and customer support, but models can produce false positives, discriminatory outcomes, opaque explanations and privacy risks. Human review, model validation, data-quality controls, explainability appropriate to the decision, monitoring for drift and an effective appeal process are essential. Automation does not transfer legal responsibility away from the bank.

10. Customer protection and ethical practice

Customer protection includes clear information, fair terms, security, accessibility, complaint handling, privacy, reimbursement rules and special support for vulnerable customers. A customer may be vulnerable because of age, disability, language, financial distress, illness, bereavement, domestic abuse or limited digital access.

Good practice includes:

• presenting fees and exchange rates clearly;
• using plain language for important terms;
• providing secure alternatives for customers unable to use digital channels;
• designing warnings that interrupt high-risk payments without overwhelming users;
• avoiding dark patterns that pressure customers into consent;
• monitoring financial-exclusion effects of automated closures; and
• providing timely, reasoned complaint outcomes and access to external dispute resolution.

Ethical banking requires more than technical compliance. A bank may lawfully collect data yet use it in a manner customers reasonably regard as unfair. It may enforce a contractual right yet do so disproportionately. Professional judgment should consider legality, transparency, customer welfare, systemic stability and reputational consequences.

Applied case: the diverted supplier payment

The following is an illustrative case, not a report of a particular real dispute.

Background

Rivermark Foods, a medium-sized importer, held a business account with Northbridge Bank. Its finance manager received an apparently genuine email from a supplier requesting that future invoices be paid to a new account. The manager logged into the bank’s portal, created a new beneficiary and approved a transfer of 48,000 currency units using a password and one-time code. The bank’s monitoring system flagged the transaction because it was unusually large and the beneficiary was new, but an automated rule allowed it to proceed after a generic warning.

Two hours later the supplier stated that its email account had been compromised. Rivermark notified the bank and requested recall. The receiving institution had already credited the funds to an account from which most of the money had been withdrawn.

Problem

The bank argued that the payment was authenticated and therefore authorized. Rivermark argued that the payment resulted from impersonation and that the bank had failed to respond appropriately to a high-risk transaction.

Analysis

The key issue is not authentication alone. The investigation must examine the account mandate, the bank’s payment terms, the warning design, the manager’s conduct, the bank’s monitoring rules, applicable reimbursement legislation and any negligence or professional-duty principles. The manager did approve the payment, but approval induced by deception may be treated differently from a payment made with no customer authorization. The bank’s possession of a fraud alert is relevant, but an alert does not automatically establish legal liability.

The bank should preserve login data, device information, warning text, call records, beneficiary-creation evidence, internal alerts and recall communications. It should determine whether the customer received an intelligible warning and whether a callback or delay was required under internal policy or law. Rivermark should provide the compromised email evidence, staff training records and its own verification procedures.

Approach and outcome

Northbridge temporarily restricted further payments, contacted the receiving bank, reported the suspected fraud and appointed an independent complaints reviewer. It concluded that the customer had authorized the instruction but that its control design had inadequately addressed a high-value new beneficiary despite a material risk alert. The parties reached a partial settlement, subject to the applicable dispute process; the bank also redesigned its controls to require an out-of-band callback for comparable transactions.

Learning points

1. Strong authentication is evidence, not an automatic answer to authorization.
2. Fraud controls must be risk-sensitive and operationally effective.
3. Liability analysis depends on contract, legislation, negligence and customer conduct together.
4. Evidence preservation is essential to a fair investigation.
5. Customer protection and fraud prevention should be designed together rather than treated as competing objectives.

Challenges and limitations

Banking law faces several structural difficulties. Rules may be fragmented across banking, payments, privacy, consumer-credit and insolvency legislation. Cross-border transactions create conflicts of law and uncertain redress. Instant payments reduce the time available for fraud detection and recall. Outsourcing can obscure responsibility. Digital exclusion means that a channel designed for efficiency may disadvantage customers who need human assistance. Finally, legal standards often develop after technology has already changed the risk environment.

Professionals should therefore use layered controls: clear contracts, lawful data governance, strong authentication, transaction monitoring, segregation of duties, resilience testing, staff training, independent complaints processes and regular legal review. No single control is sufficient.

Chapter Summary

Banking law combines contractual, statutory, regulatory and general legal principles. The banker–customer relationship may involve debtor–creditor, agency, custody and service-provider roles. Account mandates determine authority, while confidentiality and privacy rules govern the handling and disclosure of customer information. Lending requires clear documentation, responsible assessment, lawful security and proportionate enforcement.

Negotiable instruments support commercial payment through formal rules concerning issuance, transfer, endorsement and dishonour. Electronic payments require analysis of instruction, authentication, authorization, clearing and settlement. Payment finality depends on system rules and law, not simply on an account display. Open banking expands competition but creates consent, data, liability and third-party risks. Operational resilience requires mapping dependencies, testing disruption and maintaining important services. Effective customer protection combines legal compliance with fairness, accessibility, transparent communication, secure design and meaningful redress.

Key Terms

Banker–customer relationship: The legal relationship arising when a financial institution provides banking services to a customer.

Mandate: Authority specifying who may operate an account and how instructions must be given.

Debtor–creditor relationship: The ordinary legal relationship in which a bank owes repayment of deposited funds, or a borrower owes repayment of a loan.

Confidentiality: The duty to protect information obtained through the banking relationship, subject to recognized exceptions.

Know your customer: Procedures for identifying customers, beneficial owners, purpose and risk.

Beneficial owner: The natural person who ultimately owns or controls an account or arrangement.

Negotiable instrument: A transferable instrument embodying a payment right under governing law.

Cheque: A bill of exchange generally drawn on a bank and payable on demand.

Promissory note: An unconditional promise to pay a specified sum.

Authentication: Verification of evidence associated with a person, device or credential.

Authorization: Acceptance of a payment instruction under the mandate and applicable controls.

Clearing: Exchange, validation and calculation of payment obligations.

Settlement: Completion of the transfer of funds or settlement balances.

Payment finality: The legally defined point at which a payment becomes irrevocable and unconditional.

Open banking: Regulated access to payment-account data or payment initiation through secure interfaces.

Operational resilience: Ability to continue important services through disruption and recover effectively.

Strong customer authentication: Authentication using qualifying independent elements, commonly knowledge, possession or inherence.

Responsible lending: Lending conducted with appropriate assessment, disclosure, fairness and compliance with credit rules.

Set-off: Applying mutual debts against each other to determine a net amount payable.

Dark pattern: A user-interface design that manipulates or pressures a person into a choice.

Review Questions

5 Short Answer Questions

1. Why is an ordinary deposit account commonly described as creating a debtor–creditor relationship?
2. State four recognized exceptions to banking confidentiality.
3. Distinguish authentication from authorization in an electronic payment.
4. What is the difference between clearing and settlement?
5. Identify three risks associated with open banking.

5 Long Answer Questions

1. Explain the legal significance of an account mandate and discuss the circumstances in which a bank may be liable for acting on an invalid instruction.
2. Analyze the relationship between banking confidentiality, privacy legislation and mandatory financial-crime reporting.
3. Discuss the principal duties and risks involved in responsible bank lending and enforcement of security.
4. Compare negotiable instruments with electronic payment systems, including the allocation of risk when fraud occurs.
5. Explain how operational-resilience governance can protect both individual customers and the wider financial system.

3 Analytical / Application Questions

1. A customer approves an instant payment after receiving a convincing fake message from a supposed bank employee. Identify the facts and legal questions that should be investigated before allocating loss.
2. A bank shares detailed transaction data with a fintech partner for targeted advertising after obtaining broad consent in lengthy online terms. Evaluate the arrangement using confidentiality, privacy, consent and customer-protection principles.
3. A payment system uses net settlement and one participant becomes insolvent before the scheduled settlement time. Explain the legal and operational issues that determine whether other participants remain protected and payments remain final.

Multiple Choice Questions with Answers

Question 1

In an ordinary deposit account, the bank is generally the:

A. Trustee of each deposited banknote

B. Debtor to the customer

C. Customer’s agent for every transaction

D. Beneficial owner of the customer’s personal assets

Correct Answer: B. Debtor to the customer

Question 2

Which event primarily concerns verification of a credential, device or biometric?

A. Settlement

B. Clearing

C. Authentication

D. Netting

Correct Answer: C. Authentication

Question 3

Which is a recognized exception to banking confidentiality?

A. Any disclosure requested by a competitor

B. Disclosure compelled by law

C. Disclosure for employee curiosity

D. Disclosure whenever data is commercially valuable

Correct Answer: B. Disclosure compelled by law

Question 4

A cheque is generally characterized as:

A. A bill of exchange drawn on a bank and payable on demand

B. A secured loan agreement

C. A bank’s promise to insure a deposit

D. A court judgment for debt

Correct Answer: A. A bill of exchange drawn on a bank and payable on demand

Question 5

Payment finality refers most directly to:

A. The moment a customer opens an account

B. The point at which a payment becomes legally irrevocable and unconditional under applicable rules

C. The time a bank sends a marketing message

D. The date on which a loan is advertised

Correct Answer: B. The point at which a payment becomes legally irrevocable and unconditional under applicable rules

Question 6

Which activity is most closely associated with clearing?

A. Exchanging and calculating payment obligations

B. Recovering collateral after default

C. Identifying a beneficial owner only

D. Drafting a guarantee

Correct Answer: A. Exchanging and calculating payment obligations

Question 7

A major open-banking risk is:

A. Elimination of all data-protection duties

B. Consent fatigue and unclear third-party liability

C. Automatic prevention of every payment scam

D. Removal of the need for customer authentication

Correct Answer: B. Consent fatigue and unclear third-party liability

Question 8

Which practice best supports operational resilience?

A. Relying on one undocumented supplier

B. Avoiding disruption testing to reduce cost

C. Mapping dependencies and testing severe-but-plausible scenarios

D. Treating resilience as solely an IT concern

Correct Answer: C. Mapping dependencies and testing severe-but-plausible scenarios

Question 9

A bank’s possession of a fraud alert in a payment case means that:

A. Liability is automatically established

B. The customer is automatically liable

C. The alert is relevant evidence requiring analysis with other facts

D. Authentication did not occur

Correct Answer: C. The alert is relevant evidence requiring analysis with other facts

Question 10

In responsible lending, affordability assessment primarily concerns the borrower’s:

A. Ability to repay without inappropriate financial strain

B. Right to avoid all contractual interest

C. Ability to transfer negotiable instruments

D. Choice of payment-system settlement method

Correct Answer: A. Ability to repay without inappropriate financial strain