Opinion ID: 812762
Heading Depth: 4
Heading Rank: 1

Heading: The Agreed-Upon Security Procedure

Text: Chavez contends that the district court misinterpreted the FTA and the security procedure identified therein. He asserts that § 5 of the FTA “expressly provides that the sole agreed security procedure is set forth in Annex 1 and shall remain exclusively so unless and until amended by a writing signed by the bank and made a part of the contract.” Chavez argues that no such writing exists, and as a result the security procedure is limited to the annex option selected by Chavez, i.e., a written payment order signed and delivered by an authorized representative. The bank responds that Chavez misconstrues the FTA by ignoring § 5(iii), which provides in part, “At its option, the Bank may use, in addition to the Security Procedure selected by the Client, any other means to verify any Payment Order or related instruction.” The bank contends that this language allows it to add additional procedures—which it actually used—and which, when coupled with the security procedure set forth in the annex, combine to provide for a security procedure that satisfies §§ 201 & 202. In other words, the bank asserts that the 11 Case: 11-15804 Date Filed: 11/27/2012 Page: 12 of 26 agreed-upon security procedure included both the procedure in the annex and the “other means” referenced in § 5(iii). The district court accepted the bank’s position, citing Filho v. Interaudi Bank, No. 03 Civ. 4795(SAS), 2008 WL 1752693, at  (S.D.N.Y. Apr. 16, 2008), and held that the agreed-upon security procedure was (1) the procedure in the annex and (2) certain procedures (but not all) the bank, at its option, used when it processed a payment order. Section 201 defines a security procedure as a “procedure established by agreement of a customer and a receiving bank for the purpose of: (1) Verifying that a payment order or communication amending or canceling a payment order is that of the customer; or (2) Detecting error in the transmission or the content of the payment order or communication.” Thus, the security procedure must be one established by agreement of the parties. To determine what Chavez and the bank agreed to, we turn to the FTA and the annex. Section 5(i) of the FTA provides, “The parties shall comply with the security procedure selected on Annex 1 to the Agreement (the ‘Security Procedure’).” Thus, the FTA makes the phrase “Security Procedure” a defined term, and through Chavez’s selection of option one on the annex, limits its meaning to a written payment order delivered and signed by an authorized representative. The remainder of § 5 refers solely to “the Security Procedure,” which further shows 12 Case: 11-15804 Date Filed: 11/27/2012 Page: 13 of 26 that the parties consistently used the limited term in its defined sense. In addition, § 5(ii) states that “the use of the Security Procedure in the manner set forth in this Agreement shall be the sole security procedure required with respect to any Order.” (Emphasis added.) This unambiguous language shows that the parties agreed upon only the security procedure selected by Chavez in the annex. The district court’s holding that the parties agreed in § 5(iii) that the bank could use other procedures, in addition to the one selected by Chavez, to satisfy § 201 was error. Section 5(iii) provides that the bank “may use . . . any other means to verify any Payment Order or related instruction.” (Emphasis added.) Relying on Filho, 2008 WL 1752693, at , the district court interpreted § 5(iii) as broadening the parties’ agreed-upon security procedure to include an identification verification before execution of payment orders. However, the language of § 5 does not support the district court’s holding. As discussed above, §§ 5(i) & (ii) of the FTA explicitly limit the agreedupon security procedure to the procedure selected by Chavez. Section 5(iii) does not change that. It provides that the bank “may use, in addition to the Security Procedure selected by the Client, any other means” to verify payment orders. This language does not show that the “any other means” is a security procedure. In fact, it shows just the opposite, as § 5(iii) intentionally sets “any other means” apart from the defined “Security Procedure.” In addition, the bank—which drafted the 13 Case: 11-15804 Date Filed: 11/27/2012 Page: 14 of 26 FTA and therefore will have any ambiguities construed against it—defined “the Security Procedure” in § 5(i) and chose not to include within that definition the language in § 5(iii). Consequently, “any other means” is not synonymous with “additional security procedures agreed upon by the parties,” as the district court held. Filho, upon which the district court relied, is inapposite. There, the plaintiffs signed an agreement that explicitly provided that their bank would “select security procedures for accepting instructions that are commercially reasonable,” 2008 WL 1752693, at , and the court understandably held that in so doing the plaintiffs had agreed that they would be bound by whatever commercially reasonable security procedure the bank selected. The court reasoned that as long as the selected procedure was commercially reasonable, the plaintiffs could not complain about what the bank selected. What was important was that the agreement, signed by the plaintiffs, explicitly granted to the bank the right to select the security procedure. Section 5(iii) does not do this. Its language that the bank may use “any other means to verify any Payment Order” does not constitute an agreement by Chavez that the bank had the power, at its sole discretion, to select any security procedure as long as the procedure was commercially reasonable. It appears that the bank drafted § 5(iii) to enable but not require it to use other means when processing 14 Case: 11-15804 Date Filed: 11/27/2012 Page: 15 of 26 payment orders, and Chavez could not be heard to complain if the bank failed to employ those additional security procedures—because the parties never agreed that the bank would use such additional security procedures. 1 As a result, in § 5(ii)(c) the parties agreed that only “the Security Procedure [from the annex] is a method of providing security against unauthorized Orders that is commercially reasonable.” Conspicuously absent from this provision is incorporation of the “any other means” provided for in § 5(iii). The procedure for adding or changing “the Security Procedure” further supports the conclusion that Chavez did not agree in § 5(iii) that the bank could choose whatever security procedures it wanted. Section 5(ii) provides that “unless and until any additional or different procedures are specified in a writing that is signed by [the bank] and made a part of” the FTA, the only required security procedure was the one Chavez selected. It is undisputed that there was no writing modifying the security procedure he selected. 1 As Filho suggests, the bank could edit the FTA to permit it to use commercially reasonable security procedures without providing additional detail about what those procedures are; then it would be free to choose whatever procedures it wanted to verify payment orders, of course mindful that “a bank that chooses unreasonable procedures does so at its own peril.” Filho, 2008 WL 1756293, at . See also Patco Constr. Co. v. People’s United Bank, No. 2:09cv-503-DBH, 2011 WL 2174507, at  (D. Me. May 27, 2011) (addressing commercial reasonableness first and not addressing customer’s argument that it did not agree to security procedures bank used because customer failed to respond to bank’s argument that it had in fact agreed “expressly and/or implicitly, to the full panoply of security measures implemented by the Bank.”), rev’d on other grounds, Patco Constr. Co. v. People’s United Bank, 684 F.3d 197 (1st Cir. 2012). 15 Case: 11-15804 Date Filed: 11/27/2012 Page: 16 of 26 The bank contends that § 5(ii) applies only to changes to the annex, not to the additional security procedures it could add through § 5(iii). However, even assuming that § 5(iii) actually allows the bank to add additional security procedures, § 5(ii) does not contain any language that supports the limitation the bank proposes. Quite plainly, § 5(ii) provides that it applies to additional and different procedures, and there is nothing therein to suggest that this language excludes the procedures in § 5(iii). In fact, there is nothing in the FTA that exempts § 5(iii) from the amendment process; consequently, if we were to accept the bank’s contention that Chavez agreed that the bank could add additional security procedures through § 5(iii) without having to comply with § 5(ii), we would have to negate the amendment process entirely. This is contrary to the basic rules of contract construction. The official comment to § 201 also shows that the parties did not agree in § 5(iii) that the bank could at its sole discretion use additional security procedures. The comment explains that the “definition of security procedure limits the term to a procedure ‘established by agreement of a customer and a receiving bank.’ The term does not apply to procedures that the receiving bank may follow unilaterally in processing payment orders.” Section 5(iii)’s language that the bank may use “any other means to verify any Payment Order” is akin to the procedures a bank follows in processing payment orders, not procedures established by agreement, as 16 Case: 11-15804 Date Filed: 11/27/2012 Page: 17 of 26 required by § 201. And, adopting this interpretation gives effect to both the amendment process in § 5(ii) and the language in § 5(iii). In sum, the parties did not agree in § 5(iii) that the bank could add additional procedures at its discretion; consequently, the only agreed-upon security procedure is the one Chavez selected in the annex. The district court erroneously concluded that the security procedure agreed to by the parties included the procedure selected by Chavez in the annex and the other procedures the bank purportedly added through § 5(iii). However, this conclusion does not end our analysis of whether the bank has satisfied the first element of § 202(2). We must next determine whether the agreed-upon procedure satisfies the definition of “security procedure” in § 201.