[ PUBLISH] 

## In the 

# United States Court of Appeals For the Eleventh Circuit

____________________
No. 21

- 11763

____________________
JESUS ALONSO ALVAREZ RODRIGUEZ, ALIXON LOURDES COLOMBO DE ALVAREZ, MARIANA ALVAREZ COLOMBO, INVERSIONES LA MARIANA C.A., ACCD, C.A., ALVAREZ & PARILLI DESPACHO DE ABOGADOS,
Plaintiffs

- Appellants,

versus BRANCH BANKING & TRUST COMPANY, STARCHEM LLC, GUILLERMO GAMBOA,

Defendants

- Appellees, USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 1 of 272 Opinion of the Court 21

- 11763
BANK OF AMERICA CORPORATION,

Defendant.

____________________ Appeal from the United States District Court for the Southern District of Florida D.C. Docket No. 1:19

- cv

- 25191

- KMM

____________________
Before J ORDAN , R OSENBAUM , Circuit Judges, and S CHLESINGER , * District Judge.
R OSENBAUM , Circuit Judge : Jesus Alvarez Rodriguez, Alixon Colombo
, their daughters
, and their companies ( the “Appellants”) lost over $ 850,000 when a n alleged BB&T employee and a co

- conspirator impersonat ed them, changed their password s , and transferred the money out of their BB&T bank accounts. The Appellants sued BB&T and the thieves asserting contract and tort claims as well as a Florida

- law statutory demand for

* The Honorable Harvey E. Schlesinger, United States District Judge for the Middle District of Florida, sitting by designation. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 2 of 2721

- 11763 Opinion of the Court 3

repayment. 1 The district court dismis sed the tort claims as duplicative of the contract claim

. At summary judgment, the district court found for BB&T on the contract claim because none of the duties the Appellants claimed were breached were part of the contract. As to the statutory demand for repayment, t he district court concluded that the Appellants’ demand w as time

- barred because BB&T’s standard bank account contract limited the time to assert a demand from the statutory one

- year per iod to just 30 days. In the alternative, the district court entered summary judgment for BB&T because it concluded the bank had and had follow ed commercially reasonable security procedures. While this case was on appeal, BB&T produced discovery that, th e Appellants say, could make a difference in this case. Aftera thorough review of the record and with the benefit of oral argument, we vacate both (1) the district court’s order dismissing the Third Amended Complaint and (2) the district court’s order en tering summary judgment for BB&T on the remaining counts in the Fourth Amended Complaint. We decide as a matter of law that the Appellants’ claim for statutory repayment is not time

- barred. And w e remand for further proceedings consistent with this opini on.

1 Florida law generally requires banks to refund customers for fraudulent wire transfers unless the wire transfer is verified as the customer’s. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 3 of 274 Opinion of the Court 21

- 11763

I. FACTUAL BACKGROUND AND PROCEDURAL HISTORY Because we are reviewing the district court’s summary

-judgment order, we present the evidentiary background in the light most favorable to the Appellants. St. Charles Foods, Inc. v. America’s Favorite Chicken Co. , 198 F.3d 815, 819 (11th Cir. 2020). The actual facts may or may not be as set forth in this opinion.

A. The Plaintiffs T he Appellants are Venezuelan citizens who live in Venezuela

. Between 2012 and 2015, they opened personal and commercial bank accounts at a Florida branch of BB&T. The commercial bankaccounts were governed by the Commercial Bank Services agreement (“CBSA”). The 201 2 version 2 of the CBSA required the Appellants to notify BB&T within 30 days of any unauthorized transaction from the account. It also required that , if the Appellants did not receive a monthly bank statement, they would notify BB&T within 10 days of the regular statement date.
In addition
, Colombo executed, on behalf of Inversiones

— a

co

- plaintiff and a company owned by the family

— a document entitled the 2013 Treasury Management Agreement ( the “TMA”). The TMA incorporated the 201 2 CBSA. The TMA required the

2 This is the version that was in effect at the time of the events at issue and which the district court analyzed (without objection on appeal) at summary judgment

. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 4 of 2721

- 11763 Opinion of the Court 5 Appellants to examine every bank statement and to notify BB&T of any unauthorized transfers within 30 days of the statement date. As a security measure t o prevent unauthorized wire transfers
, Inversiones and BB&T agreed to use the “CashManager Online” system. The CMOL system was a security protocol . It (1) required Inversiones to change its password every 30 days; (2) issued Inversiones a physical security token that created a one

- time passcode to use to log in
, as a type of dual

- factor authentication; and (3) sent event notifications to alert Inversiones of “ potentially

s uspic ious ” activity

— like a password change

. On July 11, 2016, a BB&T employee named Giancarlo Paredes changed the email account associated with the ten bank accounts from Colombo’s email to a new (fraudulent) email. Within a month, o n August 10, an unknown per son called BB&T and spoke with BB&T agent Juan Carlos Martinez. Martinez remembered that t he caller answered the two security questions

— designed to ensure that the caller was the owner of the account

— correctly but didn’t recall which questions he asked

. The next day, an unknown person (maybe the same, maybe a different person) emailed BB&T from the fraudulent email account and asked to set up a CashManager Online token. Martinez responded with the necessary forms to complete. The next day, the same fra udulent email sent the completedforms back. Martinez forwarded the forms to another BB&T employee, Luis Avina. Avina compared the signatures on the forms
to a 2013 Inversiones corporate resolution on file: the signatures USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 5 of 276 Opinion of the Court 21

- 11763

matched. Avina then sent the forms to another BB&T employee who also confirmed that the signatures match ed

. Given the correct answers to the security questions and the matching signatures, BB&T sent a CashManager Online token to the Miami address listed on the form

. So meti me during July and August 2016, the bank account password was changed
, and Colombo could no longer access the bank accounts. Then, b etween August 2016 and November 2016, about $850,000 was transferred out of Inversiones ’ s bank a ccount with BB&T to a compan y called “Starchem LLC.” Before BB&T executed the first wire transfer

— for $100,000

— BB&T called the phone number newly associated with the account
, and the person who answered the phone identified herself as Colombo . So BB&T marked the transfer as non

- fra udulent. In the meantime, l ocked out of their accounts, the Appellants called BB&T from Venezuela “ many times ” in August, September, and October 2016. But reaching a person was a struggle. They couldn’t leave messages because, in Venezuela, they had to use an operator to call the United States and if BB&T didn’t pick up, the operator would just hang up. They also sent emails but “[it] was very difficult to get a reply to an email.” Finally, i n early January 2017, when the Appellants were in Panama , they were able

to call BB&T directly , and they left “infinite messages.” 3 By May

3 BB&T’s first record that the transactions were reported as fraudulent is dated May 17, 2017. A s we have mentioned, though, at summary judgment, we USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 6 of 2721

- 11763 Opinion of the Court 7 2017, the Appellants had regained access to their bank accounts and discovered the stolen money

. B. Procedural History The Appellants sued BB&T 4 for a variety of statutory, contract, and tort claims. As for the tort claims, t he district court dismissed them as duplicative of the breach

- of

- contract claim

. In the operative pleading, the Fourth Amended Complaint, the Appell ants asserted four claims against BB&T. As relevant here, the Appellants claimed that BB&T was required to refund them for the fraudulent wire transfers under Florida Statutes § 670.202. 5 The parties cross

- moved for summary judgment. On the statutory repayment claim, BB&T argued that only Inversiones

view the eviden ce in the light most favorable to the non

- moving party, here, the Appellants. See B&G Enters., Ltd. v. United States , 220 F.3d 1318, 1322 (11th Cir. 2000).

4 The Appellants also asserted claims against Starchem, LLC
, and Starchem ’s sole manager, Vincent Gamboa, but dismissed th ose claims without prejudice before the district court entered final judgment

. The Appellants didn’t advance any claims against Giancarlo Paredes , the man who allegedly changed the Appellants’ password

. 5 T he Fourth Amended Compl aint had three other counts. First, the Appellants said that BB&T breached the CBSA and TMA. Second, they asserted that BB&T had violated Regulation J, 12 C.F.R. § 210.25

— which governed wire transfers ov e r the Fedwire Funds Service

— by allowing the fraudulent wire transfers. And third , the Appellants sought a declaratory judgment that BB&T had breached the contract. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 7 of 278 Opinion of the Court 21

- 11763 could state a claim because only its account was impacted. But, BB&T said, Inversiones ’ s claims were time

- barred because the 2013 TMA required Inversiones to notify BB&T about fraudulent transactions within 30 days of the statement date
, and Inversiones had failed to do so. On the merits, BB&T argued that it had (1) established commercially reasonable procedures and (2) followed those procedures
, so it was not liabl e for any unauthorized transactions

. BB&T contended that only the security procedures listed in the CashManager Online documents could be a predicate for liability. The pre

- wire transfer steps , BB&T said, like changing the email, sending the forms, and s ending the CashManager Online token were not part of the security procedures. BB&T claimed that the agreed

- upon procedures were reasonable and that the Appellants hadn’t explained what the heightened procedures should have been. In support of its summary

- judgment motion, BB&T included an expert report on the commercial reasonableness of its procedures. The Appellants responded that they all had standing to suebecause the money had gone from the individual accounts to Inversiones’ s account and then out to Starchem. As to timing, the Appellants said that the Florida Statutes provided a one

- year time

period to notify a bank of an unauthorized wire transfer and further provided that the time

- period could not be modified by agreement. On the merits, t he Appellants contended that because they lived abroad and used the bank accounts only sparingly, BB&T should have designated those accounts as “higher risk” and applied stricter USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 8 of 2721

- 11763 Opinion of the Court 9

anti

- fraud controls. Like BB&T, the Appellants also i ncluded an expert report i n support of their argument

— only the Appellants’ expert opined that BB&T’s procedures weren’t commercially reasonable. And, the Appellants said, BB&T hadn’t compl ied with its own procedures because it failed to require in

- person authentication

. BB&T mov ed to strike the Appellants’ ex per t witness reportas a discovery sanction for not disclosing it. It later moved to exclude the expert from testifying at trial. The district court entered summary judgment for BB&T on all four counts. As to the Appellan ts’ statutory repayment claim, the district court concluded that the one

- year period was modifiable and that the parties had modified it. On the merits, the district court decided as a matter of law that BB&T’s procedures were commercially reasonable and that BB&T had followed them in good faith. Therefore, the district court concluded, BB&T wasn’t liable to the Appellants to repay the wire transfers. The districtcourt denied BB&T’s motion to strike the Appellants’ expert witness as moot. The Appellants appealed.
C. Post Judgment Motions BB&T moved in this court for an extension of time to file its responsive brief on appeal , explaining that it had found documents relevant to the case

. In response, t he Appellants moved for relief from the judgment under R u le 60 , Fed. R. Civ. P., in the district USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 9 of 2710 Opinion of the Court 21

- 11763

court and asked the district court to order production of the documents. The district court denied the motion without prejudice in the event of a limited remand.

II. STANDARD OF REVIEW We review the grant or denial of summary judgment de

novo. St. Charles Foods, Inc. , 198 F.3d at 819. As we have noted,

we must view all evidence and all factual inferences reasonablydrawn from the evidence in the light most favorable to the nonmoving party. I d

.
III. ANALYSIS Ideally, we would resolve all the factual and legal issues in a single appeal to preserve “the historic federal policy against piecemeal appeals.” Sears, Roebuck & Co. v. Mackey , 351 U.S. 427, 438 (1956). But because the late

- breaking discove ry imp licates factual issues related to the contractual, tort, and statutory repayment claims , we resolve only a single legal issue and then vacate and remand the rest of the case to the district court for discovery, repleading, and further litigation.
Th e only issue that we decide is a question of pure law: whether the one

- year period to make a demand for a refund of a fraudulent wire transfer under Florida Statutes § 670.202 may be modified by the parties. We hold that the parties may not modify that p eriod by agreement. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 10 of 2721

- 11763 Opinion of the Court 11

A. The Time to Demand Repayment in § 670.202 May Not Be Modified b

y Agreement Before we get to the actual arguments, we need to first layout the statutory framework. Florida adopted portions of the Uniform Commercial Code to “predict risk with certainty, to insure risk with certainty, to adjust operational and security procedures, and to price funds transfer services appropriate ly.” Corfan Banco Asuncion Paraguay v. Ocean Bank , 715 So. 2d 967, 970 (Fla. Dist. Ct. App. 1998) (citation omitted)

. In particular, in drafting Article 4A

— which governs “ f unds t ransfers” and is at issue here

— the drafters made “ a deliberate decision

. . . to write on a clean slate and to treat a funds transfer as a unique method of payment to be governed by unique rules that address the particular issues raised by this method of payment. ” F LA

. S TAT

. § 670.102 cmt. “[G] iven the very large amounts of mone y that are involved in funds transfers ,” the drafters wrote, t his was particularly important

. Id.
A “funds transfer” occurs when a bank customer instruct s her bank

— also known as a “receiving bank” because the bank receive s the instruction

— to send money to a second person’s bank

account. Id. § 670.104. The second bank is the “beneficiary’s bank
, ” and t his direction is called a “payment order.” Id. § §
670.103 , 670.104 . If the customer has more money in her bank account than is being transferred , then “payment” occurs

— and happens immediately

— when the receiving bank “debits” the money from the originator’s account and the beneficiary ’s bank “credits” the money to the beneficiary’s accoun t. Id. § 670 .403(1)(c) (“ If the USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 11 of 2712 Opinion of the Court 21

- 11763 receiving bank debits an account of the sender with the receiving bank, payment occurs when the debit is made to the extent the debit is covered by a withdrawable credit balance in the account. ”). When a receiving bank

— real ly, the paying bank

— receives a payment order, it must determine whether the payment is “verified

. ” Id. § 670.204(1). 6 The bank and the customer may agreebeforehand to security procedures to verify the authenticity of payment orders. Id. § 670.202(2). If (1) the bank and the customer agree on a security procedure
, (2) the security procedure is “commercially reasonable
, ” and (3) the bank can prove it followed the security procedures in good faith, then payment order is “effective as the order of the cus tomer, whether or not authorized.” Id. The

term “commercially reasonable” is one we w ill return to later in our discussion

. If a bank accepts a payment order that isn’t verified , then the bank “shall refund any payment” and “shall pay interest on the refundable amount.” Id. § 670.204(1). There is a penalty for failing to timely report a fraudulent transfer
, though: the customer isn’t entitled to the interest if the customer failed to exercise ordinary care and to notify the bank of the fraudulent transfer within a reasonable time that cannot exceed 90 days. Id. Florida provide s that

6 A payment order can also be “authorized.” Id. § 670.202(1). “Authorized” payment orders aren’t relevant to this cas e because the parties don’t dispute on appeal whether the fraudulent email sender was an authorized person on the account. W e therefore do not discuss authorized payment orders further. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 12 of 2721

- 11763 Opinion of the Court 13

a “[r]easonable time” may be fixed by agreement
, but

— crucially

— “the obligat ion of a receiving bank to refund payment” may not be varied by agreement

. Id. § 670.202(2). We realize this is a bit of a slog, but we have j ust t wo more provisions to wade through : First, Chapter 670 has a general rule that “ the rights and obligation s of a party to a funds transfer may be varied by agreement of the affected party.” Id. § 670.501(1). But importantly, that general rule does not apply to “670” sections when “otherwise provided in this chapter.” Id. And second , if a bank receives “pay ment from its customer with respect to a payment order”

— which happens immediately whe n the customer hasmore money in his or her account than the outgoing payment order

— then “ the customer is precluded from asserting that the bank is not entitled to retain the payment unless the customer notifies the bank of the customer's objection to the payment within one year after the notification was received by the customer. ” Id. § 670.505 (emphasis added)

. The comment further explains the one

- year rule

. “ This section is in the nature of a statute of repose . . .

. A receiving bank that executes payment orders of a customer may have received payment from the customer by debiting the customer ’ s account with respect to a payment order that the customer was n ot required to pay. ” Id. cmt. “ For example, ” the comment explains,

“ the payment order may not have been authorized or verified pursuant to Section 4A

- 202

. . . . In either case the receiving bank is obliged to refund the payment to the customer and this obligation USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 13 of 2714 Opinion of the Court 21

- 11763 to refund payment cannot be varied by agreement. ” Id. The one

year statute of repose also applies whe n “the funds transfer [wasn’t] completed . . . [or] if the receiving bank is not entitled to payment from the customer because the bank erron eously executed a payment order [under Section 303] . . . or [whe n ] the sender of a payment order pays the order and was not obliged to pay all or part of the amount paid [under Section 402(4)].” Id. To recap , Section 670. 501 provides that any section in Chapter 670 is modifiable by agreement “except as otherwise provided.” Id. § 670.501. Section 670. 204 requires a bank to refund a payment order if it was not verified (unless the bank followed commercially reasonable security procedures in good faith)
, and this obligation may not be varied by agreement. Id. § 670.204(1). And Section
670. 505 provides that a customer may not assert a claim for a refund for a fraudulent transfer after one year after the customer received notice of the transfer. Id. § 670 .50 5

. We now turn to the dispute here : is the one

- year period in Section 670. 505 modifiable by the parties? BB&T argues that it is modifiable and that the parties shortened it to 30 days . So because the Appellants didn’t notify BB&T of the fraudulent wire transfer within 30 days of the last statement in November 2017, BB&T asserts, the Appellants’ claim for statutory repayment is time

- barred. For their part, t he Appellants respond that the period in Section 670. 5 05 cannot be varied by agreement . So by their assessment, their notification to BB&T (either in January 2017 or May 2017) fell within a year of the last statement containing notice of USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 14 of 2721

- 11763 Opinion of the Court 15

the fraudulent transfer in November 2017 and was therefore timely. We agree with the Appellants. As always with statutory interpretation, we start with the

text. 7 GTC Inc. v. Edgar , 967 So. 2d 781, 785 (Fla. 2007) . When it comes to Florida’s adoption of the UCC, Florida courts have explained that th e commentary is persuasive, but not controlling, authority. United Auto. Ins. Co. v. Rivero Diagnostic Ctr. , 327 So. 3d 376, 380 n.2 (Fla. Dist. Ct. App. 2021) ; See, e.g. , Corfan Banco Asuncion Paraguay , 715 So. 2d at 970 ( noting that “[a]lthough the comm entary to the UCC is not controlling authority, we are persuaded by the expressed intent of the drafters” (internal citations omitted); Allen v. Coates , 661 So. 2d 879, 882 (Fla. Dist. Ct. App. 1995) (“[W]e are guided by the official comments of the Unifor m Commercial Code adopted in Florida.”) . Finally, under Florida law, “[w]here possible, courts must give full effect to all statutory provisions and construe related statutory provisions in harmony with one

7 As a federal court sitting in diversity jurisdiction, we apply Flor ida’s substantive law. McMahan v. Toto , 256 F.3d 1120, 1131

– 32 (11th Cir. 2001) (citing Erie R.R. Co. v. Tompkins , 304 U.S. 64 (1938)). T he parties have n’t identified

— and we haven’t found

— any Florida Supreme Court or intermediate appel late court decision s on this point. So we apply the relevant princip le s of Florida law as the Florida Supreme Court has explained them. SA Palm Beach, LLC v. Certain Underwriter s at Lloyd’s London , 32 F.4th 1347, 1357 (11th Cir. 2022) (“W e therefore consider whatever might lend us insight, including relevant state precedents, analogous decisions, considered dicta, scholarly works,and any other reliable data tending convincingly to show how the Florida Supreme Court would decide the issue at hand.” ) (citations omitted & alt erations adopted). USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 15 of 2716 Opinion of the Court 21

- 11763

another.” Forsythe v. Longboat Key Beach Erosion Control Dist.
, 604 So. 2d 452, 455 (Fla. 1992)

. The Appellants have the better reading here for three reasons. First, BB&T’s reading ignores the text of Section 670.204

. That section makes an important distinction between (1) a fraudulent transfe r and (2) the interest that fraudulent transfer would have accumulated had it not been fraudulently transferred. Under that section, if a customer fails to notify a bank of a fraudulent transfer within “a reasonable time,” the sole penalty is that the cus tomer loses the interest on the refunded payment. Id. § 670.204(1). As the commentary explains
, “the bank is not entitled to anyrecovery from the customer based on negligence for failure to inform the bank. Loss of interest is in the nature of a penal ty on thecustomer designed to provide an incentive for the customer to police its account. ” Id. § 670.203 cmt. In other words, Florida made a policy choice about who should bear the risk of a fraudulent transfer: the bank or the account holder. It cho se the bank. Indeed, the commentary expressly says so: “ There is no intention to impose a duty on the customer that might result in shifting loss from the unauthorized order to the customer .” Id. § 670.203 cmt.
T hat makes sense because banks control the security of their deposits, and they are in the best position to safeguard them. Sowhen banks bear the risk, that motivates them to create and enforce better security for the deposits. But BB&T asks us to allow parties to shift the loss of an unauthori zed order to the customer USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 16 of 2721

- 11763 Opinion of the Court 17 during the statutorily determined period

. The statute does not support such a reading. After all, if the one

- year statutory notice period could be varied, then banks could insist that customers sign contracts that ma ke the time t o demand a refund of a fraudulent payment a day (or even less)

. That would impair the account holder’s right to a refund and defeat Florida’s intent that banks

— not account holders

— bear the risk of a fraudulent transfer for the first year following the transfer . And there’s no limiting principle in the text for how short banks could make the statutory refund period. Nor was BB &T able to identify one at oral argument. So if banks could modify the one

year period, there’s no principled way to draw the line as to how short of a refund period is too short. There’s also another problem: Section 670.204 imposes a 90

- day notificatio n period for an account holder to obtain, in additionto her refund, interest on the fraudulent transfer. To be sure, Florida expressly authorized the shortening of that period from 90 days to a “reasonable” period. But that just proves the point.

In o ther words, even t hough § 670. 20 4(2) authorizes modification to a “[r]easonable period” of the 90

- day period during which the customer is entitled to receive interest as well as a refund, it prohibits any changes to the bank’s obligation “to refund payment as stated in subsection (1).” Fla. Stat. § 670.204(2). And Florida did not authorize modification to a “reasonable” period for the one

year period to which the 90

- day period is directly related. So if BB&T were right, then the parties could modify the 90

- day period USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 17 of 2718 Opinion of the Court 21

- 11763 to a “reasonable” shorter period, and they could also modify the

one

- year period to be “ [ un ] reasonabl [ y ] ” short, because there is no textual requirement that the one

- year period be “reasonabl e .” In fact, that one

- year period could be modifie d to be the same as or even shorter than the “reasonable” refund notice period

— because, on their faces and unlike for the 90

- day period, the statutes do not limit the changes to the one

- year period to “reasonable” ones. That would certainly “ impair ” the r ight to refund payment, in violation of § 670.204(2)’s prohibition on doing so

. Such a result would also make no sense, given the 90

- day/one

- year

- period structure for both putting the risk of fraudulent transfers on the bank and providing incentives in th e form of interest on the fraudulently transferred amount to account holders to timely report fraudulent transfers. For that structure to work, the statutory notice period for receiving a refund must be (at least) longer than the notice period for also ge tting interest. And it must be meaningfully longer.
We are not the first ones to reach this conclusion. The New York Court of Appeals and the Second Circuit also determined that the one

- year refund period cannot be modified when it was interpreting New Y ork law (which is identical to Florida’s). As the New York Court of Appeals recognized, “[p]ermitting banks to vary the notice period by agreement would reduce the effectiveness of the statute’s one

- year period of repose as an incentive for banks to creat e and follow security procedures.” Regatos v. North Fork Bank
, 838 N.E.2d 629, 633 (N.Y. 2005)

. “To vary the period of repose would, in effect, impair the customer’s section 4

– A

– 204 (1) right to USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 18 of 2721

- 11763 Opinion of the Court 19
a refund, a modification that section 4

– A

– 204 (2) forbids.” Id

. See also Regatos v. North Fork Bank , 431 F.3d 394, 395 (2d Cir. 2005). The second reason the Appellants have the better argument stems from the fact that Section 204 is narrower than Secti on 50 5

. In Florida, a specific provision generally controls over a broader

one. McGregor v. Fowler White Burnett, P.A. , 332 So. 3d 481, 491 (Fla. Dist. Ct. App. 2021). Section 204 concerns only unauthorized or unverified wire transfers and a bank’s duty to refund. F LA

. S TAT

. § 670.204. Section 505 , on the other hand, provides a statute of repose for objecting to all debits to a customer’s account. Id. § 670.505 cmt. It applies to unauthorized or unverified transfers, see id. § 670.202, to uncompleted funds transfers, and to erroneously executed payment orders, see id. § 670.303. It also applies where the sender of a payment order pays the order but “was not obliged to pay all or part of the amount paid.” Id. § 670.402(d). Because Section 204 is nar rower than Section 505, where Section 204 and 505 conflict, Section 204 controls. McGregor , 332 So. 3d at 491

. And here, that conflict counsels against allowing the parties to modify the time to demand a refund. Third, the commentary to Section 505 descr ibes it as like a “statute of repose .” F LA

. S TAT

. § 670.505 cmt. Statutes of repose, unlike statutes of limitations, can be referred to as “jurisdictional” and are not subject to waiver or tolling. See Nat’l Auto Serv. Ctrs., Inc. v. F/R 550, LLC
, 192 So. 2d 498, 513 (Fla. Dist. Ct. App. 2016) (explaining that statutes of repose “ erect an absolute bar to the assertion of the extinguished cause of action that is analogous to a USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 19 of 2720 Opinion of the Court 21

- 11763
jurisdictional statute of nonclaim ” ); see also John R. Sand & Gravel Co. v. United States , 552 U.S. 130, 133

– 34 (2008). Given that (1) Section 505 is like a statute of repose
, see F LA

. S TAT

. § 670.505 cmt., and therefore jurisdictional and that (2) we do not allow parties to create subject matter jurisdiction by agreement, it would make little sense to allow parties to modify Section 505 by agreement. See Morrison v. Allstate Indem. Co. , 228 F.3d 1255, 1261 (11th Cir.2000) (“[Subject matter jurisdiction] cannot be created by the consent of the parties.”). BB&T makes two argum ents against this conclusion

— both unpersuasive. First, BB&T argues that the Florida intermediate appellate case Cheese & Grill Restaurant, Inc. v. Wachovia Bank, N.A. , 970 So. 2d 372 (Fla. Dist. Ct. App. 2007)
, shows that Florida courts have permitted var iation by agreement of analogous notice periods. We don’t find Cheese & Grill persuasive in this context

. In Cheese & Grill, the Third DCA affirmed summary judgment for a bank that had paid fraudulent checks because, under the banking contract, the restau rant had a duty to report bad checks within thirty days. Id. This case isn’t controlling or even persuasive because, as BB&T conceded at oral argument, there are important difference s between funds transfers (regulated in Chapter670) and checks (regulated in Chapter 674). Oral Arg. at 35:14. Indeed, in passing Chapter 67 0 , the commentators pointed out that Florida made “a deliberate decision” to write on a clean slate from its regul ation of other instruments because of “the very large amounts of money that are involved in funds transfers.” F LA

. S TAT

. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 20 of 2721

- 11763 Opinion of the Court 21 § 67 0 .102 cmt. Given the legislature’s “deliberate decision” to “use precise and detailed rules” for funds transfers, we won’t apply a case involving bad checks here , wh ere six

- figure wire transfers are at issue

. Id. Second, BB&T says that Section 505

— the one

- year period

— doesn’t have any language prohibiting variation by agreement. BB&T’s argument goes like this: Section 501 provid es that every provision in Chapter 67 0 can be varied unless “[e]xcept as otherwise provided.” Id. § 670.501(1). Section 505 has no such limitation. Id. § 670. 505. Other provisions, BB&T points out, do. See, e.g. , F LA

. S TAT . §§ 670.202(6), 670 .305(6), 670. 402(6), 670. 403(3)

. Thus, BB&T concludes, we should interpret Section 505 as not containing a limitation against modification

. [ Id. ] This argument sounds a bit like the n egative

- i mplication c anon. Cf. A. Scalia and B. Garner, R EADING L AW : T HE I NTERPRETATION OF L EGAL T EXTS 107 (2012) ( “The expression of one thing implies the exclusion of others.”). It isn’t quite the negative

- implication canon because we aren’t considering what is and isn’t express ed i n Section 505; rather
, we are comparing the expression of a prohibition against modification in some parts of Chapter 670 with its absence in Section 505. BB&T makes a fair argument
, but ultimately, we find it unpersuasive for two reasons

. First, as we di scussed earlier, see supra
at 17 and 18 , Section 670. 204 limits modifications to the 90

- day period to receive interest to “reasonable” periods. F LA

. S TAT

. § 670.204(2). But if we applied the negative implication canon to this statute, it would mean that the one

- year period to assert a USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 21 of 2722 Opinion of the Court 21

- 11763 claim for a refund could be modified to be unreasonably short

— even shorter than the interest period

— because there is, after all, no use of the word “reasonable” in Sections 670. 501 and 670. 505. Id. §§ 670. 501; 670. 505. As we’ve explained, t hat can’t be right. Second, e ven Justice Scalia and Bryan Garner, after all, recognized that “[n]o canon of interpretation is absolute” and “[e]ach may be overcome by the strength of differing principles that point in other directions.” Scalia and Garner, R EADING L AW at 59. See also id. at 107 (“Virtually all the authorities who discuss the negative

- implication canon emphasize that it must be applied with great caution, since its application depends so much on context.”). A principle po inting in a different direction is “ the presumption against ineffectiveness

. ” Id. at 63. The presumption against ineffectiveness provides that “a textually permissible interpretation that furthers rather than obstructs the document’s purpose should be fa vored.” Id. at 63. Here, BB&T’s interpretation

— that the one

year time

- period is n’t a n unmodifiable obligation reference d in Section 670. 204

—would allow banks to eviscerate the protection Section 670. 204 creates. See Regatos v. North Fork Bank , 838 N.E.2 d

at 633 (“ To vary the period of repose would, in effect, impair the customer’s section 4

– A

– 204 (1) right to a refund [.]”). T he Appellant s ’ alternate interpretation

— the one

- year period is an unmodifiable obligation referenced in Section 670. 204

— is reasonable and furthers the text’s purpose, so we adopt it

. See F LA

. S TAT

. § 670.204
cmt

. (“ There is no intention to impose a duty on the customer that USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 22 of 2721

- 11763 Opinion of the Court 23 might result in shifting loss from the unau thorized order to the customer. ”). As the New York Court of Appeals recognized, Article 4A was intended “to promote the finality of banking operations and to give the bank relief from unknown liabilities of potentially infinite duration.” Regatos , 838 N.E. 2d at 403. We will not alter “th e statute’s fine

- tuned balance between the customer and the bank as to who should bear the burden of unauthorized transfers.” Id.

B. Commercial ly Reasonable Security Procedures Given our conclusion that the one

- year period in Section 505 isn’t modifiable b y agreement

— and there is no dispute that the Appellants gave notice within one year

— we would ordinarily next turn to whether BB&T’s security procedures were “commercially reasonable” as defined in Section 670. 202. But here, we will wait for further procee dings rather than decide the question

. Section 670. 202 provides that a bank has a safe harbor from refunding fraudulent wire transfers if the bank and the customer agreed upon “commercially reasonable” security procedures and the bank followed those proced ures in good faith. F LA

. S TAT

. § 670.202(2). A security procedure is “established by agreement of a customer and a receiving bank” and does not include a bank’s unilaterally adopted internal processes. Id . § 670.201 & cmt. Whether a security procedure is “commercially reasonable” is “a question of law” to be determined by considering all the following :(1) the circumstances of the customer known to the bank (including the size, type, and frequency of payment orders); (2) alternate USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 23 of 2724 Opinion of the Court 21

- 11763security procedures offered to the customer; and (3) security proced ures in general use by customers and receiving banks similarly situated. Id. The commentary explains that “[a] security procedure is not commercially unreasonable simply because another procedure might have been better or because the judge deciding the question would have opted for a more stringent procedure. ” Id. § 670.203 cmt. “ Rather it is whether the procedure is reasonable for the particular customer and the particular bank, which is a lower standard. ” Id. The comment ary continues , “ O n the other hand, a security procedure that fails to meet prevailing standards of good banking practice applicable to the particular bank should not be held to be commercially reasonable.” Id. For three reasons, we vacate the district court’s conclusion that BB&T’s procedures were commercially reasonable and remand the case for the district court to determine whether the procedures were commercially reasonable and if so, whether there isa genuine issue of material fact that those procedures were followed. First, BB& T has produced additional discovery. We aren’t sure whether these new documents will alter the district court’ s conclusion about commercial reasonableness. But t he district court should have the first opportunity to rule on the importance of the document s. See Fla. v. Cohen , 887 F.2d 1451, 1455 (11th Cir. 1989) (“[A] remand to the district court for further proceedings is USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 24 of 2721

- 11763 Opinion of the Court 25 necessary because new evidence has been developed that may shift the district court ’ s assessment of the issue. ”).
Second , we aren’t su re what the parameters of the security procedures at issue in this case are. The district court held that the security procedure at issue was the use of the token authentication system. But it did not discuss (and exclude or include) other measures Appellants say could be part of the security procedures: event notification, required password changes (both mentioned in the 2013 TMA) as well as security questions, signature authentication, and payment limits. On remand, the district court should explain which procedures are part of what the parties agreed to and which are exc luded as the bank’s unilateral internal operations.
And third , b oth sides submitted expert witness reports. Inconcluding that the security procedures were commercially reasonable, the district court cited to and relied on BB&T’s expert report. But i t di d not mention the Appellants’ expert report

. This could be because the district court wasn’t considering the report. But while BB&T moved to exclude the Appellants’ expert witness as a sanction for non

- disclosure, the district court denied the motion as moot. On remand, the district court should explain whetherit will consider the Appellants’ expert witness. In addition, the district court should apply the factors laid out by statute to the Appellants in this case

— that is, w hether the procedures were r easonable as applied to th e Appellants

— not whether the security procedures are commercially reasonable in the abstract

. F LA

. S TAT . § 670.201 & cmt

. (explaining that whether a security procedure is USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 25 of 2726 Opinion of the Court 21

- 11763 commercially reasonable turns on the circumstances of the customer as known to the bank).
So while we could decide whether the security procedures

were commercially reasonable because it is a question of law, we think it prudent for the district court to do so based on the complete record.

IV. CONCLUSION In sum, we hold that the district court erred in concluding that the parties could modify the one

- year period to assert a claim for repayment under Section 670. 204. As a result, the court erroneously conclude d that the Appellants had failed to give timely notice. We REVERSE the district court on this point. 8
And , because BB&T produced new discovery, we VACATE the district court’s orders (1) dismissing the tort claims in the Third Amended Complaint and (2) e ntering summary judgment against the Appellants on their contractual, statutory, and declaratory judgment claims for relief. Given BB&T’s late production of discovery, o n remand, the district court should allow the Appellants to take new discovery based o n the recently produced discovery and, if necessary, to replead their claims.

8 We do not decide whether any of the Appellants other than Inversiones had standing to assert a claim for repayment because the new discovery may implicate the district court’s decision on this point and because, as long as Inversiones has standing, we have jurisdiction

. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 26 of 2721

- 11763 Opinion of the Court 27

REVERSED IN PART , VACATED IN PART, AND REMANDED WITH INSTRUCTIONS. 9

9 All pending motions are DENIED AS MOOT

. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 27 of 27