Banker–Customer Relationship and Banking Law

Introduction and Context

Banking is not merely the acceptance of deposits and the granting of loans. It is a network of legally enforceable relationships involving banks, customers, agents, account holders, payment service providers, regulators, nominees, heirs, and third parties. The banker–customer relationship determines who may operate an account, when a bank may refuse a transaction, whether information may be disclosed, and how competing claims to money are resolved.

This chapter uses general common-law and statutory principles. Banking law differs across jurisdictions; therefore, students must consult the applicable banking, contract, negotiable-instruments, consumer-protection, succession, data-protection, and anti-money-laundering laws in their country. A bank’s internal policy cannot override mandatory law.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain the legal nature of the banker–customer relationship.
2. Distinguish the principal types of banking accounts and mandates.
3. Analyse the rights and duties of banks and customers.
4. Explain confidentiality, banker’s lien, set-off, appropriation, garnishment, agency, nomination, and succession.
5. Evaluate consumer rights and liability in electronic and conventional banking transactions.
6. Apply legal principles to practical banking disputes and recommend appropriate controls.

1. The Legal Nature of the Banker–Customer Relationship

1.1 Formation of the relationship

The relationship normally begins when a bank accepts a person or organisation as a customer and opens an account or provides a banking service. A customer need not maintain a large balance or use the account frequently. The essential feature is a regular banking relationship supported by an account, facility, or service.

The relationship is contractual. The account-opening form, terms and conditions, mandate, tariff, facility agreement, applicable legislation, regulatory directions, and established banking practice may all form part of the legal framework. Contractual terms must, however, comply with consumer-protection and other mandatory rules.

A bank must generally complete customer due diligence before establishing or continuing a relationship. This involves identifying and verifying the customer, understanding the purpose of the relationship, identifying beneficial owners where relevant, and monitoring transactions according to risk. Know-your-customer procedures are therefore both a regulatory requirement and a method of preventing impersonation and financial crime.

1.2 The debtor–creditor relationship

When a customer deposits money in an ordinary account, the bank usually becomes debtor and the customer creditor. The money is not held as a specific bag of notes for the customer. It becomes part of the bank’s funds, and the bank owes an equivalent amount subject to the account terms, lawful deductions, and applicable payment instructions.

The bank’s obligation is generally to repay on demand in a demand account or according to agreed terms in a fixed or notice account. The bank may use deposited funds in its banking business, but must honour valid withdrawal and payment instructions within the available balance and agreed limits.

The relationship changes where property is held in a special form, such as a safe-deposit arrangement, trust account, escrow, or custody service. In those circumstances, the bank may act as bailee, trustee, custodian, agent, or service provider rather than merely debtor.

1.3 Other legal relationships

A single banking relationship may contain several legal capacities:

Correct classification matters because duties differ. A bank acting as an agent may owe duties of obedience, care, accounting, and loyalty. A bank acting as debtor ordinarily has a duty to repay rather than a duty to preserve identified property.

1.4 When does a person become a customer?

A person who merely makes an isolated inquiry may not be a customer. A person who has an account or ongoing banking service normally is. Some legal duties, especially confidentiality and data-protection duties, may nevertheless arise before an account is opened because the bank has received personal or financial information.

2. Account Types, Capacity, and Mandates

2.1 Individual accounts

An individual account is operated by the named account holder. The bank must verify identity and authority and should not act on instructions from another person unless an effective mandate, power of attorney, court order, or other legal authority exists.

2.2 Joint accounts

Joint accounts are governed by the account mandate and applicable law. Common operating instructions include:

• “Either or survivor”: either holder may generally transact during the parties’ joint lifetimes, with survivorship consequences subject to succession law.
• “Both to sign”: all specified holders must authorise transactions.
• “Any one or more”: one or more holders may act according to the mandate.
• “Former or survivor”: the surviving holder may operate after the death of the other, subject to law and evidence of death.

A bank that follows a clear and valid mandate in good faith is commonly protected, but the mandate does not necessarily determine beneficial ownership between the account holders. A surviving account holder may receive operational control without automatically becoming the beneficial owner of every balance.

2.3 Minor and protected-person accounts

A minor’s capacity to contract and operate an account depends on local law. A guardian may have authority, but the bank must establish the scope of that authority. Similar care is required for persons lacking legal capacity, persons under guardianship, and customers affected by suspected financial abuse.

2.4 Business, partnership, and company accounts

A bank should verify incorporation or registration documents, constitutional documents, beneficial ownership, board or partner resolutions, and authorised signatories. A company is a separate legal person; a director or employee does not automatically have authority to withdraw company funds merely because of position.

2.5 Mandates and powers of attorney

A mandate is an instruction authorising another person to operate an account. It should identify the account, authorised person, permitted transactions, signing requirements, limits, duration, and revocation process. A power of attorney may be broader than a bank mandate, but the bank must determine whether it is valid, current, and applicable to the proposed transaction.

The bank should stop relying on an agent’s authority when it receives effective notice of revocation, death, incapacity, dissolution, or another event terminating authority. A bank may be liable if it knowingly acts after authority has ended.

3. Duties of the Bank and the Customer

3.1 Principal duties of the bank

A bank commonly has the following duties:

Duty to honour valid instructions. The bank should pay or process an instruction when it is properly authenticated, within authority, supported by sufficient funds or credit, and not prohibited by law. It may refuse where there is forgery, fraud, illegality, inadequate funds, a court restraint, frozen status, or material uncertainty about authority.

Duty of care and skill. The standard is generally that of a reasonably competent bank in the circumstances. This includes maintaining appropriate controls, processing payments accurately, protecting credentials, and responding to suspicious or disputed transactions.

Duty to account and provide information. The bank should maintain accurate records and provide statements, confirmations, interest information, charges, and relevant notices as required by law and contract.

Duty to follow the mandate. A bank must not substitute its own preferred signatory arrangement for the customer’s lawful instructions. Conversely, it should not execute instructions that clearly exceed authority.

Duty concerning payment instruments. Cheques, cards, direct debits, electronic transfers, and other instruments must be processed according to their governing law, scheme rules, mandate, and security procedures.

3.2 Duties of the customer

Customers must provide accurate information, comply with account terms, maintain sufficient funds where required, protect cards and credentials, promptly report loss or unauthorised use, review statements, and avoid using accounts for unlawful purposes.

A customer who knowingly shares a password, ignores obvious warnings, or delays reporting a fraudulent transaction may contribute to the loss. The legal effect depends on statutory allocation of liability, contractual terms, evidence, and the seriousness of the customer’s conduct. A bank cannot necessarily escape liability by relying on a broad exclusion clause, especially where negligence or mandatory consumer rights are involved.

3.3 Statements and reconciliation

Statements are important evidence but are not always conclusive. Customers should check dates, amounts, beneficiaries, fees, interest, and unusual entries. A bank should provide a reasonable process for raising errors and preserve logs, authentication data, communications, and investigation records.

4. Confidentiality and Disclosure of Information

4.1 The duty of confidentiality

Bank confidentiality protects information about the customer’s accounts, transactions, balances, financial condition, and relationship with the bank. The duty may arise from contract, banking practice, privacy law, fiduciary principles in special circumstances, and regulation.

Confidentiality is not absolute. Common lawful exceptions include:

1. Disclosure compelled by law, such as a court order, tax requirement, regulatory request, or anti-money-laundering report.
2. Disclosure justified by public duty, such as preventing serious crime or protecting public safety, where the law recognises the disclosure.
3. Disclosure in the bank’s legitimate interest, for example, pursuing a debt or defending legal proceedings, provided the disclosure is necessary and proportionate.
4. Disclosure with customer consent, including authorised sharing with a credit bureau or service provider.

Disclosure to a group company, technology provider, credit bureau, or correspondent bank must comply with applicable privacy, secrecy, outsourcing, and cross-border-transfer requirements. “Consent” should be informed and not treated as permission to disclose anything to anyone.

4.2 Confidentiality and anti-money-laundering duties

A bank may be prohibited from telling a customer that a suspicious transaction report has been filed. This creates a tension between transparency and crime prevention. Staff should explain ordinary delays or restrictions where legally permitted, but must not make a prohibited disclosure.

4.3 Data protection and cybersecurity

Modern confidentiality includes secure collection, storage, access, use, retention, and destruction of data. Access should follow a need-to-know principle, with strong authentication, segregation of duties, encryption where appropriate, monitoring, and incident-response procedures. Artificial-intelligence tools used for fraud detection or credit assessment should be governed for accuracy, explainability, bias, privacy, and human oversight.

5. Banker’s Lien, Set-Off, and Appropriation

5.1 Banker’s general lien

A lien is a right to retain property until a debt is paid. A banker’s general lien, where recognised, may allow the bank to retain securities or documents deposited in the ordinary course of banking for a general balance due from the customer. It generally does not apply to property held for a special purpose, property held as trustee or agent for another, or items entrusted for a specific transaction inconsistent with a general lien.

A lien is primarily a right of retention. A separate power of sale may require statute, contract, or another legal basis. Banks must also consider notice, enforcement procedures, insolvency law, and proportionality.

5.2 Set-off

Set-off allows mutual debts between the same parties to be netted. The typical requirements are:

• the bank and customer are mutually debtor and creditor;
• the debts are legally enforceable;
• the debts are sufficiently due or otherwise eligible for set-off;
• the accounts are held in the same legal capacity; and
• no contract, statute, insolvency rule, trust, or court order prevents set-off.

A personal account and a trustee account usually cannot be freely combined because the capacities differ. Set-off may also be restricted where funds are held for a specific purpose or belong beneficially to a third party.

5.3 Appropriation of payments

Appropriation determines which debt a payment satisfies when a debtor owes several debts. The customer may usually specify the debt at or before payment, subject to contract and law. If the customer does not do so, the bank may be able to appropriate the payment, or legal rules may determine the result.

Appropriation and set-off are related but distinct. Appropriation allocates a payment to a particular debt; set-off extinguishes mutual debts by operation of agreement or law.

6. Garnishment and Court-Ordered Restrictions

A garnishment or third-party debt order is a legal process directed to a person who owes money to the judgment debtor. A bank may be ordered to freeze and pay funds in an account to satisfy a judgment. The bank must comply with the order’s scope, timing, exemptions, and procedural requirements.

The bank should identify the correct customer, preserve the frozen amount, avoid unauthorised payment, and notify relevant parties when required. It should not treat a garnishment as authority to seize unrelated accounts or funds held in a different capacity. Joint accounts, trust funds, exempt benefits, and funds belonging to another person may require special treatment.

A garnishment can conflict with a bank’s set-off rights. Priority is jurisdiction-specific and may depend on whether the bank’s right arose before service of the order, whether the debt was due, and what insolvency or enforcement law provides. Banks must obtain legal guidance rather than rely on informal practice.

7. Agency and Collection Services

A bank often acts as the customer’s agent when collecting cheques, bills, dividends, or electronic payments. The bank must follow instructions, exercise reasonable care, account for proceeds, and act within authority. It may use sub-agents or correspondent banks, subject to law and agreed terms.

Collection is distinct from purchase or discount. In collection, the bank normally credits the customer subject to realization and may reverse a provisional credit if the instrument is dishonoured. In a purchase or discount arrangement, the bank may acquire an interest in the instrument and bear different risks.

A bank may also act as agent for a payer when executing a payment. The customer’s instruction, payment system rules, authentication, cut-off times, sanctions screening, and error-handling procedures determine whether execution is proper.

8. Nomination, Death, and Succession

A nomination mechanism allows an account holder to designate a person to receive or claim funds after death, subject to local law. Its legal effect varies considerably. In some systems it gives the nominee authority to receive payment as a trustee or representative for the estate; in others it may confer a stronger beneficial entitlement. A nominee is not automatically the heir merely because the bank pays that person.

On receiving reliable notice of death, the bank should restrict operation according to law and the account mandate, verify death and identity, preserve records, and request probate, letters of administration, a succession certificate, court order, or other approved evidence where required. Payment to a properly verified personal representative generally discharges the bank, but payment to an unauthorised person may expose it to liability.

Joint-account survivorship clauses must be read with succession law. Operational survivorship may permit the surviving holder to access funds, while beneficial ownership may remain contested among heirs. Banks should avoid deciding complex inheritance disputes unless legislation clearly assigns that function.

9. Consumer Rights and Liability in Banking Transactions

9.1 Consumer rights

Banking consumers commonly have rights to:

• clear information about prices, interest, risks, and terms;
• fair and non-misleading marketing;
• privacy and secure handling of personal data;
• accessible complaint and redress mechanisms;
• protection against unauthorised transactions as provided by law;
• fair treatment and, where applicable, responsible lending;
• accessible services and reasonable accommodation for vulnerable customers;
• timely notice of material changes.

Consumer law may control unfair terms, excessive charges, unilateral variation clauses, debt collection conduct, and dispute-resolution procedures.

9.2 Unauthorised transactions

Liability for an unauthorised card or electronic transaction usually turns on several questions: Was the transaction authenticated? Did the customer authorise it? Did the customer act fraudulently or with gross negligence? How quickly was the bank notified? Did the bank’s systems detect or prevent the transaction? What statutory reimbursement rule applies?

Authentication is evidence, not always conclusive proof of authorisation. A transaction made using a correct password may still result from phishing, malware, coercion, or a compromised device. A fair investigation considers the entire evidence, including device information, behavioural patterns, alerts, communication records, and the customer’s conduct.

9.3 Negligence and causation

A claimant generally must establish a duty, breach, causation, and legally recognised loss, subject to the relevant cause of action. A bank may be liable for paying a forged instrument if it failed to exercise required care. A customer may bear part of the loss if the customer’s serious carelessness materially contributed. The precise allocation is governed by statute, contract, payment-system rules, and case law.

9.4 Complaints and redress

A sound complaint system should acknowledge the complaint, preserve evidence, investigate independently, communicate a reasoned decision, correct errors promptly, and explain escalation to an ombudsman, regulator, tribunal, or court. Complaint data should be analysed for recurring control failures rather than treated only as individual disputes.

10. Applied Case: The Compromised Business Account

Illustrative case.

Background

A small company maintains an account requiring two authorised signatures for payments above a specified threshold. An employee receives a convincing email appearing to come from a director and uploads credentials to a false banking webpage. Criminals then initiate three electronic transfers. The bank’s system flags the first transfer but releases it after an automated risk score falls below the intervention threshold. The employee informs the bank two days later.

Problem

The company demands reimbursement. The bank argues that valid credentials and multi-factor authentication were used and that the company failed to report the compromise immediately.

Analysis

The bank must examine the account mandate, the agreed authentication process, transaction patterns, alerts, approval rules, and applicable electronic-payment law. If two signatures were legally required, one compromised employee credential may not satisfy the mandate. If the bank’s controls detected unusual beneficiaries or amounts but failed to apply appropriate review, the bank may have breached its duty of care.

The company’s delay and failure to train staff may be relevant, but the bank cannot automatically treat credential use as proof of authority. The bank should determine whether the transfers were authorised, whether the customer acted fraudulently or negligently, and whether mandatory reimbursement rules apply.

Approach and solution

The bank should immediately freeze remaining funds, contact receiving institutions, preserve logs, investigate the alert, notify authorities where required, and provide a written decision. The company should reset credentials, review access rights, train staff, and strengthen dual approval. A fair settlement may allocate loss according to proven causation and statutory rules rather than applying an automatic “customer responsibility” clause.

Learning points

1. Authentication and authorisation are related but distinct.
2. A mandate requiring dual control must be technically enforced.
3. Prompt reporting reduces loss but does not necessarily decide liability.
4. Fraud controls should combine automated scoring with human review for high-risk events.
5. Complaint evidence and system logs are essential to a defensible decision.

11. Governance, Technology, and Professional Practice

Banking law is implemented through governance. Boards and senior management should approve clear account-opening, mandate, confidentiality, fraud, outsourcing, complaints, succession, and enforcement policies. The three-lines model is useful: operational staff own risks, control functions challenge and monitor, and internal audit provides independent assurance.

Technology creates both protection and risk. Biometrics, behavioural analytics, open-banking interfaces, mobile wallets, instant payments, cloud services, and AI can improve access and fraud detection. They can also create identity theft, algorithmic bias, outages, unauthorised data sharing, and rapid irreversible losses. Banks should apply privacy by design, least-privilege access, strong authentication, transaction limits, confirmation of payee where available, real-time monitoring, resilience testing, and human escalation.

Best practice requires that legal, compliance, cybersecurity, operations, and customer-service teams work together. A technically successful transaction is not necessarily a legally authorised transaction. The central professional question is always: who had authority, what duty applied, what evidence exists, and what remedy does the law provide?

Challenges and Limitations

Banking disputes are difficult because several legal regimes may overlap. Contract terms may conflict with consumer legislation; confidentiality may conflict with law-enforcement demands; set-off may conflict with trust ownership; nomination may conflict with succession claims; and rapid payments may leave little time for intervention. Legal outcomes also vary between jurisdictions.

Students should therefore avoid absolute statements such as “the bank always owns deposited money” or “the nominee always inherits.” The correct analysis identifies the account type, capacity, mandate, applicable statute, evidence, and procedural requirements.

Chapter Summary

The banker–customer relationship is primarily contractual but may also involve debtor–creditor, agency, bailment, trust, custody, and secured-creditor relationships. An ordinary deposit generally makes the bank a debtor and the customer a creditor, while special services create different duties. Account mandates determine who may operate an account, but operational authority does not always settle beneficial ownership.

Banks must honour valid instructions, maintain accurate records, protect confidentiality, exercise reasonable care, and comply with regulatory and consumer-protection duties. Customers must provide accurate information, protect credentials, follow account terms, and report irregularities promptly. Confidentiality has important legal exceptions, including compelled disclosure, public duty, legitimate banking interests, and consent.

Banker’s lien is principally a right of retention; set-off combines mutual debts; appropriation allocates a payment to a debt; and garnishment gives effect to a court or enforcement order. Agency principles govern collection and payment services. Nomination and survivorship must be distinguished from beneficial succession. In electronic banking, authentication is evidence of a transaction but does not invariably prove authorisation. Fair liability analysis considers mandate, negligence, causation, statutory protection, and the conduct of both parties.

Key Terms

Banker–customer relationship: The legally regulated relationship arising from banking services.

Customer mandate: An instruction specifying who may operate an account and how.

Debtor–creditor relationship: The usual relationship in which the bank owes repayment of an ordinary deposit.

Agency: A relationship in which the bank acts on behalf of a customer or another principal.

Bailment: Possession of property transferred for a purpose, with an obligation concerning its return or care.

Beneficial ownership: The person entitled to enjoy the economic benefit of property.

Confidentiality: The duty to protect customer information from unauthorised disclosure.

Know your customer: Procedures for identifying customers, beneficial owners, and transaction purposes.

Banker’s lien: A right, where recognised, to retain qualifying property for a general balance due.

Set-off: The netting of mutual debts between parties.

Appropriation: Allocation of a payment to one of several debts.

Garnishment: A legal process attaching money owed by a third party to a judgment debtor.

Nominee: A person designated to receive or claim assets after an account holder’s death, subject to law.

Succession: Legal transmission of property after death.

Authentication: Verification of credentials or identity used to initiate a transaction.

Authorisation: Legal permission for a transaction to be carried out.

Unauthorised transaction: A transaction made without the customer’s valid permission.

Consumer redress: Remedies and procedures for correcting harm suffered by a consumer.

Beneficial owner: The natural person who ultimately owns or controls an entity or arrangement.

Dual control: A requirement that two authorised persons approve specified actions.

Review Questions

Short Answer Questions

1. Why is an ordinary deposit usually described as creating a debtor–creditor relationship?
2. What is the difference between a mandate and beneficial ownership?
3. State two recognised exceptions to banking confidentiality.
4. Distinguish banker’s lien from set-off.
5. Why is authentication not conclusive proof of authorisation?

Long Answer Questions

1. Explain the principal legal relationships that may arise between a bank and its customer.
2. Discuss the rights and duties of banks and customers in electronic payment transactions.
3. Explain the requirements and limitations of exercising set-off and banker’s lien.
4. Analyse the legal issues arising when an account holder dies and a nominee claims the balance.
5. Discuss how consumer-protection law and data-protection law influence modern banking practice.

Analytical / Application Questions

1. A bank receives an instruction signed by one director, although the company mandate requires two directors. The bank pays the amount to a long-standing supplier. Analyse the bank’s possible liability and the evidence that should be examined.
2. A customer’s account contains funds held by the customer as trustee for a client. The customer owes the bank money personally. Can the bank automatically set off the trust funds? Explain.
3. A customer reports a mobile-wallet transfer forty-eight hours after being deceived by a phishing message. Develop a fair investigation and liability framework for the bank.

Multiple Choice Questions with Answers

Question 1

In an ordinary deposit account, the bank is generally the customer’s:

A. Trustee of identified banknotes

B. Debtor

C. Agent for every transaction

D. Beneficiary

Correct Answer: B. Debtor

Question 2

Which document primarily determines who may operate a business account?

A. The customer’s advertising material

B. The bank’s annual report

C. The account mandate and authority documents

D. A supplier’s invoice

Correct Answer: C. The account mandate and authority documents

Question 3

Which is a recognised exception to banking confidentiality?

A. Curiosity of another customer

B. Disclosure compelled by law

C. Disclosure to all employees of the bank

D. Publication in promotional material without consent

Correct Answer: B. Disclosure compelled by law

Question 4

The principal function of a banker’s lien is generally to:

A. Transfer ownership of every customer asset

B. Retain qualifying property until a debt is paid

C. Cancel a customer’s succession rights

D. Guarantee every cheque

Correct Answer: B. Retain qualifying property until a debt is paid

Question 5

Set-off normally requires that the debts be:

A. Owed by unrelated parties

B. Mutual between the same parties and legally eligible

C. Entirely future and uncertain

D. Held in different legal capacities

Correct Answer: B. Mutual between the same parties and legally eligible

Question 6

Appropriation of payment refers to:

A. Allocating a payment to a particular debt

B. Freezing an account by court order

C. Verifying a customer’s identity

D. Disclosing a suspicious transaction report

Correct Answer: A. Allocating a payment to a particular debt

Question 7

A garnishment order is generally directed to a bank because the bank:

A. Owns the judgment debtor’s entire estate

B. May owe money to the judgment debtor

C. Must provide legal advice to the judgment debtor

D. Automatically becomes the judgment debtor

Correct Answer: B. May owe money to the judgment debtor

Question 8

Which statement best distinguishes authentication from authorisation?

A. They are always legally identical

B. Authentication verifies credentials; authorisation concerns legal permission

C. Authorisation only concerns passwords

D. Authentication can occur only in branch banking

Correct Answer: B. Authentication verifies credentials; authorisation concerns legal permission

Question 9

A nominee’s legal entitlement to account funds after death:

A. Is identical in every jurisdiction

B. Always overrides succession law

C. Depends on applicable law and the legal effect of nomination

D. Never has any legal significance

Correct Answer: C. Depends on applicable law and the legal effect of nomination

Question 10

Which control best supports a company mandate requiring two approvals?

A. Allowing one employee to bypass approval for convenience

B. Technical dual control enforced before release

C. Using only a customer’s postal address

D. Disabling transaction records

Correct Answer: B. Technical dual control enforced before release