Shah v HSBC: Court of Appeal rules that identity of employees making money laundering reports can be redacted when disclosing documents in litigation

This ruling is the latest development in the ongoing Shah v HSBC saga, proceedings brought by Mr Shah and his wife, two Zimbabwean-based customers of HSBC Private Bank (UK) Limited ("HSBC"), for losses allegedly caused as a result of delays whilst HSBC's requests for consent under the Proceeds of Crime Act 2002 ("POCA") were pending with the Serious Organised Crime Agency ("SOCA").

An earlier Court of Appeal judgment, in connection with HSBC's partially successful attempt to strike out the claim, resulted in the dismissal of a number of ways in which the Shahs had then put their case. The Court of Appeal ruled, however, that HSBC could be required to adduce evidence of its money laundering suspicions and prove these were genuine. The case has been proceeding since that time.

In Shah and another v HSBC Private Bank (UK) Limited [2011] EWCA Civ 1154, the Court considered an interim application regarding the disclosure of documents evidencing HSBC's suspicions of money laundering. The issue was whether HSBC could redact (blank out) the identity of individual employees.

Key points

• HSBC disclosed a set of documents relating to its suspicions, but redacted the names of all the individuals reporting or considering the suspicion, save for its nominated MLRO. At first instance, Coulson J had ruled that the names of the individuals were relevant and disclosable, but permitted limited anonymisation on the grounds of public interest immunity.
• The Court of Appeal upheld HSBC's appeal. The identity of the individuals was not disclosable under the Civil Procedure Rules, because it was not information which supported the Shahs case or adversely affected HSBC's case. The redactions were therefore permitted, irrespective of the public interest immunity position.
• This ruling will be welcomed by all those involved in money laundering reporting processes at banks and other regulated firms. It provides some additional comfort that staff can report their suspicions without undue concern that they may be identified in subsequent proceedings.
• The Court's ruling does, however, depend in part on the way in which Shahs' case was articulated, following their narrow victory in the earlier strike out application. The basis on which the genuineness of HSBC's suspicions was challenged was a very narrow one. In turn, the documents which could be said to support that challenge were limited. It is not impossible to envisage circumstances in which the identity of reporting employees would be relevant and disclosable, in which case public interest immunity issues would be relevant.

• The case also serves to re-emphasise the importance for firms of having appropriate systems in place to ensure that the suspicions which lead to reports being made to SOCA are appropriately evidenced.

Background

The proceedings generally

The Shahs are claiming over $300 million by way of damages from HSBC for losses allegedly suffered as a result of HSBC's delay in executing, between September 2006 and February 2007, four transactions involving transfers out of Mr Shah's account. HSBC's case is that it suspected the proposed transactions to involve 'criminal property' for the purposes of POCA, and it therefore sought consent from SOCA to make the requested transfers. (The scheme of Part VII of POCA is that a bank which would otherwise commit a money laundering offence by transferring criminal property, suspecting it to be such, will have a defence if it obtains SOCA's consent to the transfer.)

The delay in executing Mr Shah's instructions was alleged to have resulted in one of the intended recipients of the transfers notifying the Zimbabwean police that Mr Shah was suspected of money laundering. In turn, that was alleged to have led to the freezing and seizure in Zimbabwe of certain large investments of Mr Shah.

HSBC made an application for strike out or summary judgment on the claim, which was considered by the Court of Appeal in 2010. Although a number of ways in which the Shahs put their case were dismissed, nonetheless, the Court ruled that there was enough to go to trial: "any claim by a customer that a bank has not executed his instructions is, on the face of it a strong claim… there is… no reason why the bank should not be required to prove the fact of its suspicion in the ordinary way…". For more on this judgment, see here

The disclosure application

HSBC's internal money laundering reporting process involved three different teams/departments: Relationship Managers, who reported suspicions to Compliance, Compliance, who reported to the Money Laundering Reporting Office (MLR Office), and the MLR Office which, through the Nominated Officer, made Suspicious Activity Reports ("SARs") to SOCA.

HSBC wished to disclose only the identity of the Nominated Officer, and not the identity of any other individuals within the bank. It therefore gave disclosure of documents connected with its reporting process with the names of other staff redacted. The bank made an interim application seeking an order permitting the redactions.

In June 2011, Coulson J held that the names of the reporting staff were relevant and disclosable, but that, on the basis of public interest immunity, the employees' names could be disclosed on a semi-anonymised basis, giving each individual a letter identifying the department in which they worked, and a number, so that the Shahs could determine the spread of employees involved in the formulation of the suspicions. The case is reported here .

The Court of Appeal's decision in relation to the redactions

Both HSBC and the Shahs appeal against Coulson J's ruling. There were two key questions raised by the appeal:

• whether the bank's obligation to make standard disclosure required it to reveal the names of the bank employees who reported their suspicions to the MLR Office; and

• if so, whether the bank was entitled to maintain their anonymity on the grounds of public interest immunity ("PII").

The Court of Appeal found for HSBC on the first point (i.e. that HSBC was not required to disclose the names of the individuals), and therefore did not need to decide the PII issues.

Standard disclosure

HSBC's standard disclosure obligation under the Civil Procedure Rules (CPR Part 31 r.31.6) was to give disclosure of documents on which it relied; or which adversely affected its case; or which adversely affected the Shahs' case; or which supported the Shahs' case; or which it was required to disclose by a Practice Direction.

The identity of the employees in question could only – potentially – have fallen within the categories of documents which supported the Shahs' case or adversely affected the bank's case.

Lewison LJ, giving the leading judgment, stressed the need to have regard to the test in the CPR in assessing the disclosability of the documents, rather than using related tests such as "relevance". He also emphasised that the CPR had replaced the previous Peruvian Guano test that documents "which may fairly lead [a party] to a train of inquiry" were required to be disclosed.

Given the need to assess whether the documents might support the Shahs' case, it was important to consider what that case was. The earlier strike out application had resulted in the dismissal of a number of ways in which the Shahs had then put their case (irrationality, negligent self-induced suspicion, mistake and automatic mechanically-induced suspicion). All that was left was that the bank was being put to proof of a genuine suspicion. This would not be a difficult hurdle for the bank to overcome; it is trite to say that the threshold for 'suspicion' is a low, subjective one. (A person must "think that there is a possibility, which is more than fanciful, that the relevant facts exist. A vague feeling of unease would not suffice. But the statute does not require the suspicion to be 'clear' or 'firmly grounded and targeted on specific facts' or based on 'reasonable grounds'" (R v Da Silva [2007]1 WLR 303)).

Ultimately, the Court held that the identification of individuals was, at best, something that might lead to a train of inquiry which might adversely affect the bank's case, i.e. the information was of a 'chain of enquiry' nature. Disclosure might have been appropriate under the Peruvian Guano test, but did not meet the more stringent requirements of CPR 31.6. The Shahs' attempt to obtain information about the identity of individual bank employees was described as a "fishing expedition".

Good faith

The Court also dealt shortly with a tantalising hint in Coulson J's first instance judgment that the claim that the bank did not have a genuine or good faith suspicion might be linked to the fact that a bank employee had, allegedly, asked to borrow $1.5m from Mr Shah, which loan was refused.

It appears from the Court of Appeal judgment that the employee in question had indicated on the same day that she did not need the loan after all; the transactions which were the subject of the money laundering reports took place several months later. In the circumstances, Lewison LJ stated that the suggestion that the employee in question had nursed a grudge and made a false report as a result was "fanciful". Similarly, the suggestion that the employee was trying to punish Mr Shah for not acceding to a request not to transfer certain funds to another bank was "entirely speculative" with "no evidence to support it" and "no positive allegation to that effect made in the pleadings". The Nominated Officer also gave evidence that the employee in question was not the source of the internal SARs.

As such, whilst the employee's actions were described by Pill LJ as "extraordinary", they provided no basis for concluding that the identity of the individuals making the SARs would adversely affect the bank's case.

Public interest immunity

Given the Court's conclusions in relation to CPR 31.6, it was not necessary to consider the public interest immunity position, and the Court declined to do so. At present, therefore, Coulson J's first instance judgment remains the principal authority on the application of this principle in the context of SAR reporting.

Comment

This judgment will be welcomed by banks and others within the money laundering 'regulated sector'.

The confidentiality of SARs and the identity of those who make them has been a perennial concern for reporting institutions. Disclosure of information about reporting staff members can in some cases give rise to genuine concerns about staff safety (e.g. in connection with suspicions relating to potentially dangerous criminals). Even where this is not the case, the possibility that the identity of individual employees might be disclosed could have a chilling effect on the effectiveness of the money laundering reporting regime. As Coulson J noted, in connection with his analysis of the PII position, if identities were to be disclosable then: "whilst the statutory duty to report may remain, it is easy to see how, in any borderline case, the bank employee who knows that he or she will not be given anonymity may err on the side of inaction".

Of course, it remains possible that in another case, on a different set of facts, disclosure of the identity of staff members might be relevant. This judgment does not provide any blanket protection for banks. The Shahs had particular difficulty because their claim appears, on its face, weak, and the suspicion threshold, which the bank will need to prove it surmounted in making its SARs, is low. In a case where there was, for example, some positive evidence of bad faith, the position might be different. The identity of staff members might then be information which would adversely affect the bank's case, and the bank would need to fall back on PII arguments in seeking to resist disclosure.

The case also serves to re-emphasise the importance for firms of having appropriate systems in place to ensure that the suspicions which lead to SARs being made to SOCA are appropriately evidenced. Having a documented 'audit trail' of the firm's suspicions may assist both in establishing the reasonableness and genuineness of the reported suspicion, and in minimising the risk of individuals, other than the Nominated Officer, being called to give evidence of it.