Loop Financial Inc. v. Royal Bank of Canada

COURT FILE NO.: CV-24-00713073-00CL

DATE: 20241029

SUPERIOR COURT OF JUSTICE – ONTARIO

COMMERCIAL LIST

RE: LOOP FINANCIAL INC., Applicant

AND:

ROYAL BANK OF CANADA

BEFORE: Penny J.

COUNSEL: Gabriel Latner, for the Applicant

Catherine Francis, for the Respondent

HEARD: September 23, 2029

ENDORSEMENT OF JUSTICE PENNY (Released October 29, 2024):

[1] Loop Financial Inc. brings this application for judgment against the Royal Bank of Canada in the amount of $90,000. The allegation is that RBC was negligent, and breached a duty of care owed to Loop, when the bank failed to notify Loop that $90,000 had been fraudulently taken from the account of an RBC customer and deposited into a Loop account with Windsor Family Credit Union. The alleged fraudster then transferred the funds from its Loop account to other accounts at the Toronto-Dominion Bank, from which a series of untraceable cash withdrawals were made from various automated teller machines. RBC was, on behalf of its customer, able to reverse the fraudulent transfer from its customer’s account following the protocols laid down in the Payments Canada Rules. By then, it was too late for Loop to freeze its account because the funds had already been transferred to, and withdrawn from, TD Bank. Loop was left without further recourse and suffered a $90,000 loss.

[2] Although RBC agreed to proceed by way of application rather than by way of an action, given the relatively small amount involved, RBC did not concede that the evidentiary record was sufficient to make any finding of liability against RBC.

[3] There are essentially two issues. First, as a matter of law, did RBC owe a duty of care to Loop in these circumstances? Second, if RBC did owe a duty of care, has Loop established that RBC fell below a reasonable standard of conduct for a Canadian deposit-taking financial institution?

[4] For reasons I will explain below, I conclude that RBC did not owe a duty of care in these circumstances. Further, even if it did, Loop has not proven on a balance of probabilities that RBC fell below a reasonable standard of conduct. Accordingly, the application is dismissed.

Background

[5] Loop is a financial technology company offering financial products and services to clients and businesses. Loop is principally in the e-transfer business. Clients send money to Loop which is credited to their account. Funds in the Loop account can then be “spent” through payment products or withdrawn and transferred to another bank account. This service includes prepaid payment cards provided by Windsor Family Credit Union. The client “loads” their prepaid payment card by transferring funds to Loop’s operating account at the credit union.

[6] Loop clients have the option of loading their accounts by preauthorized debit (PAD). To set up PADs, the client must enter into a PAD authorizing agreement. Loop requires customers to provide information about the bank account the payment will be originating from and to prove they control that account.

[7] In this case, in September 2023, an unidentified fraudster purported to be the principal of 9347-0219 Quebec Inc. (9347). 9347 created an account with Loop and funded it through a PAD authorization agreement. 9347 provided a void cheque for an RBC account. The RBC account, although a valid account, was not the account of 9347. Rather, the fraudster behind 9347 was able to hack into the account of an innocent RBC accountholder and to “show” Loop, through Loop’s verification procedures, that 9347 “controlled” the RBC account. 9347 then transferred $90,000 out of the RBC customer’s account to Loop’s account with the credit union and, as outlined above, the fraudster was ultimately able to transfer the funds to accounts at TD Bank from which parties unknown made a series of ATM cash withdrawals in November 2023 which cannot be traced.

[8] In December 2023, $90,000 was debited from Loop’s account with the credit union as a result of an RBC reimbursement claim on behalf of its customer initiated under the Payments Canada Rules. PAD payments are overseen by Payments Canada. According to Rule H1, a payor (RBC’s customer) disputing a PAD can have the money returned by making a declaration to their own bank. When a reimbursement claim is submitted, the payor’s bank, in this case RBC, notifies the payee’s bank, in this case the credit union. If the reimbursement claim is accepted, the payee’s bank debits the payee’s account for the full amount of the transfer, thus reversing the transaction. Under the Payments Canada Rules, the payee’s bank, but not the payee itself, is given advance notice and an opportunity to dispute the reimbursement claim.

Analysis

Duty of Care

[9] This is a claim for pure economic loss. I make this point at the outset because counsel for Loop repeatedly sought to illustrate his points during oral argument by reference to personal injury analogies. The law is different with respect to pure economic loss arising out of the allegedly negligent performance of a service in at least two material respects, as will be discussed below.

[10] It is well settled that the Anns test (Anns v. Merton London Borough Council, [1977] UKHL 4, [1978] AC 728), as modified by the Supreme Court of Canada in Cooper v. Hobart, 2001 SCC 79 and Deloitte & Touche v. Livent Inc. (Receiver of), 2017 SCC 63, is the framework for determining whether a duty of care is owed in any particular circumstance. Under the first stage of the Anns test, the court considers the relationship between the parties to determine whether the relationship is sufficiently close and direct, such that it would be fair and just to impose a prima facie duty of care. A prima facie duty of care is established by relying on an analogous relationship in which the law already recognizes a duty, or by independently showing proximity and reasonable foreseeability. Even then, under the second stage of the Anns test, the court considers if there are residual policy considerations that negate the duty.

[11] In cases of pure economic loss arising from negligent performance of a service, two factors are determinative in the proximity analysis: the defendant’s undertaking and the plaintiff’s reliance. Where the defendant undertakes to provide a representation or service in circumstances that invite the plaintiff’s reasonable reliance, the defendant becomes obligated to take reasonable care. And, the plaintiff has a right to rely on the defendant’s undertaking to do so: Livent, para. 30.

[12] Rights, like duties, are, however, not limitless. Any reliance on the part of the plaintiff which falls outside of the scope of the defendant’s undertaking of responsibility — that is, of the purpose for which the representation was made or the service was undertaken — necessarily falls outside the scope of the proximate relationship and, therefore, of the defendant’s duty of care. This principle properly limits liability on the basis that the defendant cannot be liable for a risk of injury against which he did not undertake to protect. By assessing all relevant factors arising from the relationship between the parties, the proximity analysis not only determines the existence of a relationship of proximity, but also delineates the scope of the rights and duties which flow from that relationship. In short, it furnishes not only a “principled basis upon which to draw the line between those to whom the duty is owed and those to whom it is not”, but also a principled delineation of the scope of such duty, based upon the purpose for which the defendant undertakes responsibility: Livent, para. 31

[13] Loop argues that a body of law has emerged over the last two decades recognizing that, where a bank has actual knowledge of a fraud involving an account with the bank, the bank owes a duty to third parties to warn them of the fraud. Accordingly, Loop argues that this claim is not subject to the full application of the Anns test.

[14] I cannot agree with this argument. Loop relies on Semac Industries Ltd. v. 1131426 Ontario Ltd. for the proposition that “once a bank knows that its accounts are being used fraudulently, it owes a duty to the victims of that fraud”. Semac was a Rule 20 case. In Semac, Cameron J. declined to dismiss a claim on the basis that a bank could potentially be liable where it has knowledge of a fraud. Subsequent cases have repeatedly and consistently concluded that, absent actual knowledge of a fraud committed by a customer of the bank, there is no duty of care owed by banks to third party victims of fraud: Dynasty Furniture Manufacturing Ltd. v. Toronto Dominion Bank, 2010 ONSC 436 at para. 51; aff’d 2010 ONCA 514. The Court of Appeal upheld the decision of Wilton-Siegel J. The Court of Appeal noted that:

we were not referred to any trial or appellate decision in Canada holding that a bank has those duties to a non-customer. Thus, the impugned claims do not fall within a category of cases that has been recognized by the courts.

Moreover, we do not consider this to be a case where this court should recognize a new duty of care under the Anns/Kamloops principles. We agree generally with the motion judge’s analysis of those principles. Based on that analysis, we are of the view that the facts, as pleaded in this case, are not sufficient to warrant recognizing a new duty of care by a bank to a non-customer.

See also: (a) the decision of Dunphy J. in 1169822 Ontario Limited v. The Toronto Dominion Bank, 2018 ONSC 1631 at paras. 212 to 217 and 264. Dunphy J. held that the common law does not impose a duty of care on a bank “to prevent harm to a stranger by a dishonest customer of the bank where the bank has no more than constructive knowledge of the fraud in question”; and (b) McDonald v. Toronto-Dominion Bank, 2022 ONCA at para. 73, where the Court of Appeal agreed with the trial judge that the required proximity between a bank and a non-customer had not been proved. Loop was unable to cite any case in which the duty it argues for has actually been found to exist, i.e., where liability has been established.

[15] The first stage of the Anns test focuses on the relationship between the parties and whether it is close or proximate enough to give rise to a prima facie duty of care.

[16] Because this is a case of pure economic loss, as noted above two factors must be considered: first, the nature of RBC’s undertaking; and, second, the nature of Loop’s reliance. Here, RBC only undertook a duty to its own client, not to third parties. In respect of PADs, RBC undertook only to process PADs in accordance with the Payments Canada Rules, Rule H1. There is no suggestion that any fraud was committed by RBC’s customer. There is nothing to suggest that RBC undertook to warn Loop of a fraud which, on the facts established here, had already occurred. There is no evidence that RBC could or should have detected the hacking of the RBC customer’s account at the time it took place or before any funds were fraudulently removed from the customer’s RBC account.

[17] It is not quite right to say, as Loop says repeatedly, that RBC had “actual knowledge” of a fraud. While RBC initially detected anomalous activity in the customer’s account, it did not actually know there was a fraud. When RBC contacted the customer by telephone, he said that he did not have any PADs and had not made or authorized a PAD transfer to Loop’s account at the credit union. While RBC had no basis to suspect fraud on the part of its own customer, RBC took steps to freeze the customer’s account against further suspicious transfers until it could meet with the customer and be satisfied as to his bona fides. Final assessments about what happened, and what should be done about it, had to await an in-person interview with the customer. Because the customer was out of the country, this could not be arranged until his return, on December 18, 2023. This was weeks after the funds had already been transferred out of Loop’s credit union account and into and out of the TD Bank accounts.[1]

[18] There is also no evidence that Loop reasonably relied on RBC to warn it about possible fraudulent activity. It is important to remember that the fraudulent activity in this case involved not only the hacking of a customer’s account at RBC but also Loop’s verification processes when 9347 first opened a PAD account with Loop. Loop had its own fraud prevention procedures which the perpetrator, in this case, managed to evade.

[19] Even more importantly, Loop’s account agreement with the credit union specifically contemplated the provisional nature of entries posted to Loop’s account until the transaction had been honoured, irrevocably collected by the credit union “and the time for return under the CPA Rules has expired”. The agreement went on to provide that: “The credit to the Account represented by a Pre-authorized Debit that is charged back or tainted by fraud may be reversed from the Account, notwithstanding any provisional posting [emphasis added].” Loop made a decision to release the funds to its client, notwithstanding the risk of reversal of the deposit. Loop’s client, not RBC’s customer, was the fraudster. Although a transaction can be reversed for up to 90 days, Loop permitted its client to transfer the funds out of the Loop account to accounts with TB Bank only six days after the PAD was processed (in other words, long before Loop could be sure the transfer from the RBC account to its account would not be challenged or reversed).

[20] For these reasons, I conclude that RBC did not owe a duty to Loop in the circumstances of this case.

[21] Even if there were grounds to find that RBC owed a duty of care, the second stage of the Anns test is also not satisfied.

[22] This is not a case, such as that described in Jastram Properties Ltd. v HSBC Bank Canada, 2021 BCSC 2204, where RBC had come “perilously close to incurring liability as a participant in the fraud” so that imposing a duty of care would tend to serve a deterrent role. As noted above, the fraud was perpetrated by Loop’s client, not by RBC’s customer. On its face, RBC had no more capacity to prevent the fraud than Loop did.

[23] Under the Payments Canada Rules, the processing of PADs by processing members like RBC under Rule H1 is automated and uses only transit and account numbers. There is no evidence in the record that RBC knew that Loop was the payee who received the proceeds of this PAD, let alone that RBC knew or had reason to know that an undisclosed third party had received the funds. To give effect to the duty that Loop seeks to impose would have required RBC to conduct an investigation as well as involve and seek cooperation from the credit union. Imposing a duty of care on members of Payments Canada to act on every potentially unauthorized transaction and to warn counterparties directly – despite such counterparties being other financial institutions’ clients – is unwieldy and untenable. In 2021, for example, Payments Canada systems cleared and settled over $135 trillion, more than $539 billion every day. The PAD business alone is measured in hundreds of millions of dollars.

[24] It is only hindsight which now allows Loop to suggest that knowledge of an unauthorized PAD constitutes actual knowledge of a fraud. Loop’s logic, however, makes an even greater leap, requiring RBC to assume that the payee is the victim of fraud, as opposed to being the perpetrator (since, as noted above, RBC does not have visibility into the payees at another financial institution). What Loop is essentially arguing is that knowledge of an anomalous transaction in a customer’s account imposes on RBC the obligation to investigate that anomalous transaction for the benefit of third parties who might be harmed if the transaction, in fact, turns out to have been the product of a fraud. This raises the spectre of indeterminate liability to an indeterminate class, which has consistently been rejected in cases of negligent liability for pure economic loss. As Martin J. said in Ramias v. Johnson, 2009 ABQB 386, at para. 42 [the proposed duty of care] fails at both stages of the Anns inquiry, because it raises the spectre of indeterminate liability to an indeterminate class, with a standard of conduct that cannot be articulated with sufficient, or any precision. The volume of transactions conducted daily by financial institutions is immense. To create tort duties to non-customers in relation to unknown underlying fraudulent transactions would impose a disproportionate and unwieldy burden.

[25] It is also important context to understand that the law already provides a framework and process for dealing with unauthorized PAD transactions, i.e., Rule H1 of the Payments Canada Rules. Under Rule H1, Appendix I, clause 7, Loop assumed liability for its involvement in processing PAD’s. Clause 7 provides:

In each Payee Letter of Undertaking, the Payee [Loop Financial] shall indemnify and agree to hold harmless its Sponsoring Member and each applicable Processing Member [i.e. Royal Bank] from and against any and all losses, costs, fees, damages, expenses, liabilities, claims, suits and demands whatsoever that its Sponsoring Member or any such Processing Member may suffer, incur or be under or that might be made or brought against it in respect of the drawing or issuing of any PAD, except where such loss, costs, fees, damages, expenses, liabilities, claims, suits or demands resulted from erroneous information provided or an error committed by its Sponsoring Member or any Processing Member.

These provisions are also incorporated by reference into Loop’s operating agreement with the credit union.

[26] The mere existence of the Payment Canada Rules, and Rule H1 in particular, is not a legal bar to a finding that a duty might be owed. The Rules are, however, relevant to the policy considerations which must be analyzed in the second part of the Anns test. The introduction of a new duty of care at common law would tend to undermine the purpose and efficacy of the existing regulatory regime for the processing of PADs and the role of Parliament and the Canadian Payments Association in that process.

[27] For all these reasons, I find that RBC did not owe a duty of care to Loop in the circumstances of this case.

Breach of Reasonable Standard

[28] Even if I had concluded otherwise, it would still be necessary to consider whether RBC breached any duty found to be owed.

[29] Loop led no evidence on the standard of care. Loop submits that such evidence is unnecessary, citing several cases in which banks have been found liable for breach of a reasonable standard without expert testimony.

[30] I accept that in some simple cases, where a bank has made a patently obvious error, no expert evidence would be required. However, this is not a simple, patently obvious case.

[31] Here, the issue involves the vexed question of bank liability to third party, non-customers. No case has yet found a bank liable in such circumstances. It is clear from even a cursory look at the volume, size, variety and complexity of transactions under the Payments Canada Rules, that the allocation of risk is a critical issue. This is highlighted, in this case, by Rule H1 in particular. Without the benefit of independent, expert investigation and analysis about bank practices for fraud detection and prevention in the context of inter-bank transfers regarding PADs and other instruments, as well as the Payments Canada Rules, it is impossible for the court to assess whether what RBC did, or did not do, fell below an acceptable standard.

[32] This problem is exacerbated by the fact that Loop itself had systems to detect and prevent fraud, yet it was Loop’s customer, 9347, not the customer of RBC, who managed to evade detection, open a fraudulent account and thus perpetrate the fraud. It is impossible to assess the role of RBC in failing to detect or prevent this fraud on a scale of reasonableness without equally assessing the role of Loop.

[33] Even if I had found RBC owed a duty of care, therefore, I could not find, on this record, that RBC’s conduct fell below an acceptable standard. For this reason as well, the application is dismissed.

CONCLUSION

[34] For the reasons set out above, RBC owed no duty of care to Loop. RBC’s conduct, in any event, did not fall below a reasonable standard of care. The application is dismissed.

COSTS

[35] The parties submitted cost summaries. If successful, Loop would have sought $13,000 in partial indemnity costs. RBC sought $31,000.

[36] The amount in issue on the application was relatively modest at $90,000. At the same time, the issue was an important one in principle, especially for RBC, which has well over 17 million customers.

[37] Having regard to the factors set out in Rule 57, including the principles of proportionality and what the losing party would reasonably expect to pay, I fix partial indemnity costs at $20,000 (inclusive of fees, disbursements and all applicable taxes) payable by Loop to RBC.

Penny J.

Date: 2024-10-29

[1] In its initial written material, Loop sought to attack RBC’s delay in meeting with its customer and filing the reimbursement claim under the Rules. Loop also sought make something of the fact that Loop was itself a customer of RBC. In oral argument, both these arguments were withdrawn. That seems to me both appropriate and justified. RBC’s protocol to conclude matters surrounding a suspect transaction and for the processing of a reimbursement claim prudently required an in-person meeting. The customer was out of the country at the time. The timeframe for filing a reimbursement claim is, in any event, set by the Payments Canada Rules, not by RBC. And, although Loop was a customer of RBC, that banking relationship was not in connection with Loop’s e-transfer or PAD business, in respect of which RBC had no involvement. As noted earlier, in any event RBC has over 17 million customers. Loop rightly recognized that both these arguments were essentially irrelevant to the central question at issue in the circumstances of this case.