While bank supervision is becoming increasingly weighty, personal liabilities and obligations of bank directors have shown signs of easing. This shift towards corporate liability may be expected to increase innovation and risk taking. But, at the same time, it is tempered by the growing spectre of risks relating to class actions, frauds and scams.

Director liability and responsibilities – comparatively reduced focus

Directors and senior managers will welcome the proposed repeal of their personal duty to exercise due diligence to ensure the creditor complies with its duties and obligations under the Credit Contracts and Consumer Finance Act (CCCFA). Breaches of the duty, as the law stands, can result in potentially material personal liability which cannot be indemnified or insured.

That duty of directors and senior managers has been expressly identified in the CCCFA Bill as one of the features “that are unnecessary because of, or do not fit as well with, the new regulatory approach”. The existing Financial Markets Conduct Act (FMCA) regime for personal ‘accessory’ liability will apply instead.

By contrast, no plans to change director liability under the upcoming Deposit Takers Act (DTA) regime have been announced. That DTA director liability however remains a significant improvement over the current position for banks under the Banking (Prudential Supervision) Act 1989, and well below the high water mark of the CCCFA.

Notably (as amended late in the legislative process) compared to the CCCFA, the DTA:

allows use of indemnities and insurance for a breach of the due diligence requirements; and
permits a director or NZ chief executive to rely on information and professional/expert advice from other directors, or employees or professional advisers or experts in certain circumstances, as a defence to a breach.

The complexity and breadth of bank obligations under the DTA and associated standards mean that directors will still have their work cut out for them. While the DTA mandates that [the Reserve Bank of New Zealand (RBNZ)] produce due diligence guidance, no timeline has been given (and the DTA itself sets no timing requirement).

As of August 2024, RBNZ in its Non-Core Standards policy proposals said that it was:

…trying to design requirements placed on deposit takers’ boards so that directors can be focused on more strategic issues and oversight of management rather than the operational detail of complying with our regulations… We are trying to avoid imposing specific obligations on boards that could detract from focus on their primary roles of strategy and oversight.

Eight months later in its May 2025 Summary of Submissions on Deposit Taker Core Standards, RBNZ merely stated that director due diligence guidance would be made available “in due course”.

The clock is ticking for deposit takers to implement due diligence processes addressing their upcoming obligations under the DTA. However, without RBNZ’s guidance – or even a final set of obligations for the due diligence process to be built around – deposit takers may feel that they are still sitting on their hands.

Class action risks

Class actions continue to pose a real risk for banks, particularly in relation to data breaches, consumer lending, fraud/scams and climate change.

The most high-profile development on bank-specific class actions has been the proposed retrospective application of changes to the CCCFA regarding loss of borrowing costs for disclosure errors (under s 99(1A)). The proposed changes would provide the Court with the express discretion to reduce or extinguish the effect of s 99(1A) where it is just and equitable to do so.

Class action risk has been slightly heightened from recent years as a result of recent Court decisions confirming the availability of opt-out class actions and making of common fund orders at the start of proceedings. Those decisions incentivise litigation funders by providing a larger potential claimant pool and providing greater certainty of a return.

At the same time, we have already seen some overseas based funders look to expand their involvement in New Zealand. New law firms focusing on plaintiff-side class action work have also formed in recent years. It is clear that funders and firms (in some cases Australian firms) are already looking to overseas class-action examples to progress similar actions in New Zealand (both within the financial sector and outside of it). We expect that trend will continue.

Increased expectations for fraud and scam management

In recent years, banks have been under fire in public in relation to the proliferation of fraud and scams. It ought to provide some comfort that senior Courts in the UK have taken an orthodox approach in assessing the scope of banks’ liability.

The most high profile example is the UK Supreme Court’s confirmation in Philipp v Barclays¹ that a bank is not under a duty to decline to carry out a customer’s instructions to transfer funds, if it has reasonable grounds to believe that the customer is being defrauded. The duty arises only in circumstances where the bank is “put on inquiry” that a payment instruction it has received from an agent may not be a valid instruction from the customer.

More recently, in March this year, the English High Court confirmed that a bank does not owe a duty of retrieval to a third party (i.e. not a customer of the bank).² In other words, a bank has no duty to take steps to recover payments it received not knowing they were fraudulent, which it subsequently transferred on instruction of its own customer.

We are not aware of either case having been considered by the New Zealand courts to date but expect they will be persuasive.

The expanded consumer protection requirements and compensation regime relating to fraud and scams will go live under the revised Code of Banking Practice on 30 November 2025. We anticipate more focus in this area as those changes are bedded in.