Issue link: https://maltatoday.uberflip.com/i/1547510
12 maltatoday | SUNDAY • 8 NOVEMBER 2026 LAW The bank's duty to detect and prevent fraudulent transactions IAN BARBARA Mifsud & Mifsud Advocates THE Appeals Court, presided over by Judge Lawrence Mintoff, confirmed an award of €19,630 in compensation against Bank of Valletta because it failed to adequately monitor suspicious transactions. The suspicious transactions resulted in a customer losing a substantial part of his savings to an investment scam. The judgment, delivered on 21 October 2026 in Kevin Mi- callef Colombo vs Bank of Val- letta plc, concerned an appeal from a decision of the Arbiter for Financial Services dated 7 November 2025. The arbiter had found that, although the customer had contributed to his losses through negligent conduct, the bank had also failed to fulfil its obligation to monitor payment transactions and identify potentially fraud- ulent activity. The case arose following a fraudulent investment scheme promoted through a Facebook advertisement in November 2023, allegedly featuring the Prime Minister of Malta and a journalist encouraging peo- ple to invest an initial amount of €260. After clicking on the advertisement, the plaintiff was contacted by individuals promising financial returns. The fraudsters subsequently obtained access to his mobile phone through the AnyDesk application, allowing them to control the device and facili- tate various transactions. Between the 8 and 11 Novem- ber 2023, a series of transfers were made from the custom- er's Bank of Valletta accounts to various financial institutions and cryptocurrency platforms, including Revolut, Binance, Bifinity and KuCoin. The transactions resulted in losses amounting to approximately €67,412. The customer main- tained that the bank should have identified the unusual ac- tivity and intervened before his accounts were depleted. The bank argued that the transactions had been properly authenticated and authorised by the customer and that it had complied with its obligations under the Payment Services Directive 2 (PSD2), including the implementation of Strong Customer Authentication pro- cedures. It also highlighted that the customer had pro- vided confidential banking in- formation to third parties and given misleading explanations to bank employees about the purpose of the payments. The arbiter nevertheless found that the bank had failed to comply with its obliga- tion to monitor transactions. Such monitoring should not be limited to examining indi- vidual payments in isolation, but should also consider the customer's historical banking behaviour, the frequency and cumulative value of transac- tions and their recipients. The customer had transferred sub- stantial amounts within a few days, despite previously using his accounts mainly for savings and relatively small withdraw- als. The arbiter ordered the bank to pay €19,630 in com- pensation, taking into account the respective responsibilities of both parties. On appeal, the bank main- tained that it could not rea- sonably be expected to prevent transactions authorised by the customer, particularly where the funds were transferred to accounts held in his own name with other financial institu- tions. The court rejected this ar- gument, emphasising that the bank's monitoring obligations remained applicable notwith- standing the authentication and authorisation of the pay- ments. The court identified several warning signs which should have alerted the bank to pos- sible fraud. These included the increase in the customer's daily withdrawal limits and the sub- sequent transfers of substantial sums to cryptocurrency-re- lated platforms. It considered that the bank had accepted the customer's explanation that he wished to purchase certain items without properly exam- ining whether this was consist- ent with his previous banking activity. The repeated transac- tions and rapid depletion of his accounts were also inconsist- ent with his historical payment patterns. An important aspect of the judgment concerned Article 2 of Commission Delegated Reg- ulation (EU) 2018/389, which requires payment service pro- viders to establish transac- tion-monitoring mechanisms capable of detecting unau- thorised or fraudulent transac- tions. The court endorsed the interpretation that adequate monitoring must consider the frequency and cumulative val- ue of payments against the cus- tomer's usual behaviour, rather than assessing each transaction separately. The court also rejected the bank's argument that the regu- lation did not prescribe a pre- cise timeframe for monitoring. The court emphasised that monitoring must take place in real time, observing that sys- tems capable of identifying and blocking transactions should also detect repeated payments which are clearly anomalous. It remarked that, had the bank intervened after the first €5,000 transfer, the customer could have avoided the subsequent losses. The judgment also addressed the customer's own conduct. Although the court acknowl- edged that he had been negli- gent and had provided mislead- ing answers to bank employees, this did not absolve the bank of its independent monitoring obligations. It further noted that the bank could not produce recordings of its telephone conversations with the customer because its recording system had not been functioning. Such recordings could have provided useful ev- idence of the questions asked and the explanations given. The appeal was ultimately dismissed, save for the bank's argument concerning interest. Applying the principle in il- liquidis non fit mora, the court held that interest could not run from the date of the arbiter's decision because the compen- sation had not yet been liqui- dated. Interest was therefore ordered to run from the date of the appellate judgment. The arbiter's decision was otherwise confirmed, and the costs of the appeal were or- dered against Bank of Valletta.