USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 1 of 27
[PUBLISH] In the United States Court of Appeals For the Eleventh Circuit
____________________
No. 21-11763 ____________________
JESUS ALONSO ALVAREZ RODRIGUEZ, ALIXON LOURDES COLOMBO DE ALVAREZ, MARIANA ALVAREZ COLOMBO, INVERSIONES LA MARIANA C.A., ACCD, C.A., ALVAREZ & PARILLI DESPACHO DE ABOGADOS, Plaintiffs-Appellants, versus BRANCH BANKING & TRUST COMPANY, STARCHEM LLC, GUILLERMO GAMBOA,
Defendants-Appellees, USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 2 of 27
2 Opinion of the Court 21-11763
BANK OF AMERICA CORPORATION,
Defendant.
Appeal from the United States District Court for the Southern District of Florida D.C. Docket No. 1:19-cv-25191-KMM ____________________
Before JORDAN, ROSENBAUM, Circuit Judges, and SCHLESINGER,* District Judge. ROSENBAUM, Circuit Judge: Jesus Alvarez Rodriguez, Alixon Colombo, their daughters, and their companies (the “Appellants”) lost over $850,000 when an alleged BB&T employee and a co-conspirator impersonated them, changed their passwords, and transferred the money out of their BB&T bank accounts. The Appellants sued BB&T and the thieves asserting con- tract and tort claims as well as a Florida-law statutory demand for
* The Honorable Harvey E. Schlesinger, United States District Judge for the Middle District of Florida, sitting by designation. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 3 of 27
21-11763 Opinion of the Court 3
repayment. 1 The district court dismissed the tort claims as dupli- cative of the contract claim. At summary judgment, the district court found for BB&T on the contract claim because none of the duties the Appellants claimed were breached were part of the contract. As to the statu- tory demand for repayment, the district court concluded that the Appellants’ demand was time-barred because BB&T’s standard bank account contract limited the time to assert a demand from the statutory one-year period to just 30 days. In the alternative, the district court entered summary judgment for BB&T because it con- cluded the bank had and had followed commercially reasonable se- curity procedures. While this case was on appeal, BB&T produced discovery that, the Appellants say, could make a difference in this case. After a thorough review of the record and with the benefit of oral argu- ment, we vacate both (1) the district court’s order dismissing the Third Amended Complaint and (2) the district court’s order enter- ing summary judgment for BB&T on the remaining counts in the Fourth Amended Complaint. We decide as a matter of law that the Appellants’ claim for statutory repayment is not time-barred. And we remand for further proceedings consistent with this opin- ion.
1 Florida law generally requires banks to refund customers for fraudulent wire transfers unless the wire transfer is verified as the customer’s. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 4 of 27
4 Opinion of the Court 21-11763
I. FACTUAL BACKGROUND AND PROCEDURAL HISTORY Because we are reviewing the district court’s summary-judg- ment order, we present the evidentiary background in the light most favorable to the Appellants. St. Charles Foods, Inc. v. Amer- ica’s Favorite Chicken Co., 198 F.3d 815, 819 (11th Cir. 2020). The actual facts may or may not be as set forth in this opinion. A. The Plaintiffs The Appellants are Venezuelan citizens who live in Venezuela. Between 2012 and 2015, they opened personal and commercial bank accounts at a Florida branch of BB&T. The commercial bank accounts were governed by the Commercial Bank Services agree- ment (“CBSA”). The 2012 version 2 of the CBSA required the Ap- pellants to notify BB&T within 30 days of any unauthorized trans- action from the account. It also required that, if the Appellants did not receive a monthly bank statement, they would notify BB&T within 10 days of the regular statement date. In addition, Colombo executed, on behalf of Inversiones—a co-plaintiff and a company owned by the family—a document en- titled the 2013 Treasury Management Agreement (the “TMA”). The TMA incorporated the 2012 CBSA. The TMA required the
2 This is the version that was in effect at the time of the events at issue and which the district court analyzed (without objection on appeal) at summary judgment. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 5 of 27
21-11763 Opinion of the Court 5
Appellants to examine every bank statement and to notify BB&T of any unauthorized transfers within 30 days of the statement date. As a security measure to prevent unauthorized wire trans- fers, Inversiones and BB&T agreed to use the “CashManager Online” system. The CMOL system was a security protocol. It (1) required Inversiones to change its password every 30 days; (2) is- sued Inversiones a physical security token that created a one-time passcode to use to log in, as a type of dual-factor authentication; and (3) sent event notifications to alert Inversiones of “potentially suspicious” activity—like a password change. On July 11, 2016, a BB&T employee named Giancarlo Paredes changed the email account associated with the ten bank accounts from Colombo’s email to a new (fraudulent) email. Within a month, on August 10, an unknown person called BB&T and spoke with BB&T agent Juan Carlos Martinez. Martinez re- membered that the caller answered the two security questions— designed to ensure that the caller was the owner of the account— correctly but didn’t recall which questions he asked. The next day, an unknown person (maybe the same, maybe a different person) emailed BB&T from the fraudulent email account and asked to set up a CashManager Online token. Martinez responded with the necessary forms to complete. The next day, the same fraudulent email sent the completed forms back. Martinez forwarded the forms to another BB&T em- ployee, Luis Avina. Avina compared the signatures on the forms to a 2013 Inversiones corporate resolution on file: the signatures USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 6 of 27
6 Opinion of the Court 21-11763
matched. Avina then sent the forms to another BB&T employee who also confirmed that the signatures matched. Given the correct answers to the security questions and the matching signatures, BB&T sent a CashManager Online token to the Miami address listed on the form. Sometime during July and August 2016, the bank account password was changed, and Colombo could no longer access the bank accounts. Then, between August 2016 and November 2016, about $850,000 was transferred out of Inversiones’s bank account with BB&T to a company called “Starchem LLC.” Before BB&T exe- cuted the first wire transfer—for $100,000—BB&T called the phone number newly associated with the account, and the person who answered the phone identified herself as Colombo. So BB&T marked the transfer as non-fraudulent. In the meantime, locked out of their accounts, the Appel- lants called BB&T from Venezuela “many times” in August, Sep- tember, and October 2016. But reaching a person was a struggle. They couldn’t leave messages because, in Venezuela, they had to use an operator to call the United States and if BB&T didn’t pick up, the operator would just hang up. They also sent emails but “[it] was very difficult to get a reply to an email.” Finally, in early January 2017, when the Appellants were in Panama, they were able to call BB&T directly, and they left “infinite messages.” 3 By May
3 BB&T’s first record that the transactions were reported as fraudulent is dated May 17, 2017. As we have mentioned, though, at summary judgment, we USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 7 of 27
21-11763 Opinion of the Court 7
2017, the Appellants had regained access to their bank accounts and discovered the stolen money. B. Procedural History The Appellants sued BB&T4 for a variety of statutory, con- tract, and tort claims. As for the tort claims, the district court dis- missed them as duplicative of the breach-of-contract claim. In the operative pleading, the Fourth Amended Complaint, the Appellants asserted four claims against BB&T. As relevant here, the Appellants claimed that BB&T was required to refund them for the fraudulent wire transfers under Florida Statutes § 670.202. 5 The parties cross-moved for summary judgment. On the statutory repayment claim, BB&T argued that only Inversiones
view the evidence in the light most favorable to the non-moving party, here, the Appellants. See B&G Enters., Ltd. v. United States, 220 F.3d 1318, 1322 (11th Cir. 2000). 4 The Appellants also asserted claims against Starchem, LLC, and Starchem’s sole manager, Vincent Gamboa, but dismissed those claims without prejudice before the district court entered final judgment. The Appellants didn’t ad- vance any claims against Giancarlo Paredes, the man who allegedly changed the Appellants’ password. 5 The Fourth Amended Complaint had three other counts. First, the Appel- lants said that BB&T breached the CBSA and TMA. Second, they asserted that BB&T had violated Regulation J, 12 C.F.R. § 210.25—which governed wire transfers over the Fedwire Funds Service—by allowing the fraudulent wire transfers. And third, the Appellants sought a declaratory judgment that BB&T had breached the contract. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 8 of 27
8 Opinion of the Court 21-11763
could state a claim because only its account was impacted. But, BB&T said, Inversiones’s claims were time-barred because the 2013 TMA required Inversiones to notify BB&T about fraudulent transactions within 30 days of the statement date, and Inversiones had failed to do so. On the merits, BB&T argued that it had (1) established commercially reasonable procedures and (2) followed those procedures, so it was not liable for any unauthorized trans- actions. BB&T contended that only the security procedures listed in the CashManager Online documents could be a predicate for li- ability. The pre-wire transfer steps, BB&T said, like changing the email, sending the forms, and sending the CashManager Online to- ken were not part of the security procedures. BB&T claimed that the agreed-upon procedures were reasonable and that the Appel- lants hadn’t explained what the heightened procedures should have been. In support of its summary-judgment motion, BB&T in- cluded an expert report on the commercial reasonableness of its procedures. The Appellants responded that they all had standing to sue because the money had gone from the individual accounts to In- versiones’s account and then out to Starchem. As to timing, the Appellants said that the Florida Statutes provided a one-year time- period to notify a bank of an unauthorized wire transfer and further provided that the time-period could not be modified by agreement. On the merits, the Appellants contended that because they lived abroad and used the bank accounts only sparingly, BB&T should have designated those accounts as “higher risk” and applied stricter USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 9 of 27
21-11763 Opinion of the Court 9
anti-fraud controls. Like BB&T, the Appellants also included an expert report in support of their argument—only the Appellants’ expert opined that BB&T’s procedures weren’t commercially rea- sonable. And, the Appellants said, BB&T hadn’t complied with its own procedures because it failed to require in-person authentica- tion. BB&T moved to strike the Appellants’ expert witness report as a discovery sanction for not disclosing it. It later moved to ex- clude the expert from testifying at trial. The district court entered summary judgment for BB&T on all four counts. As to the Appellants’ statutory repayment claim, the district court concluded that the one-year period was modifia- ble and that the parties had modified it. On the merits, the district court decided as a matter of law that BB&T’s procedures were commercially reasonable and that BB&T had followed them in good faith. Therefore, the district court concluded, BB&T wasn’t liable to the Appellants to repay the wire transfers. The district court denied BB&T’s motion to strike the Appellants’ expert wit- ness as moot. The Appellants appealed. C. Post Judgment Motions BB&T moved in this court for an extension of time to file its responsive brief on appeal, explaining that it had found documents relevant to the case. In response, the Appellants moved for relief from the judgment under Rule 60, Fed. R. Civ. P., in the district USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 10 of 27
10 Opinion of the Court 21-11763
court and asked the district court to order production of the docu- ments. The district court denied the motion without prejudice in the event of a limited remand.
II. STANDARD OF REVIEW We review the grant or denial of summary judgment de novo. St. Charles Foods, Inc., 198 F.3d at 819. As we have noted, we must view all evidence and all factual inferences reasonably drawn from the evidence in the light most favorable to the non- moving party. Id.
III. ANALYSIS Ideally, we would resolve all the factual and legal issues in a single appeal to preserve “the historic federal policy against piece- meal appeals.” Sears, Roebuck & Co. v. Mackey, 351 U.S. 427, 438 (1956). But because the late-breaking discovery implicates factual issues related to the contractual, tort, and statutory repayment claims, we resolve only a single legal issue and then vacate and re- mand the rest of the case to the district court for discovery, replead- ing, and further litigation. The only issue that we decide is a question of pure law: whether the one-year period to make a demand for a refund of a fraudulent wire transfer under Florida Statutes § 670.202 may be modified by the parties. We hold that the parties may not modify that period by agreement. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 11 of 27
21-11763 Opinion of the Court 11
A. The Time to Demand Repayment in § 670.202 May Not Be Modified by Agreement Before we get to the actual arguments, we need to first lay out the statutory framework. Florida adopted portions of the Uni- form Commercial Code to “predict risk with certainty, to insure risk with certainty, to adjust operational and security procedures, and to price funds transfer services appropriately.” Corfan Banco Asuncion Paraguay v. Ocean Bank, 715 So. 2d 967, 970 (Fla. Dist. Ct. App. 1998) (citation omitted). In particular, in drafting Article 4A—which governs “funds transfers” and is at issue here—the drafters made “a deliberate decision . . . to write on a clean slate and to treat a funds transfer as a unique method of payment to be governed by unique rules that address the particular issues raised by this method of payment.” FLA. STAT. § 670.102 cmt. “[G]iven the very large amounts of money that are involved in funds trans- fers,” the drafters wrote, this was particularly important. Id. A “funds transfer” occurs when a bank customer instructs her bank—also known as a “receiving bank” because the bank re- ceives the instruction—to send money to a second person’s bank account. Id. § 670.104. The second bank is the “beneficiary’s bank,” and this direction is called a “payment order.” Id. §§ 670.103, 670.104. If the customer has more money in her bank ac- count than is being transferred, then “payment” occurs—and hap- pens immediately—when the receiving bank “debits” the money from the originator’s account and the beneficiary’s bank “credits” the money to the beneficiary’s account. Id. § 670.403(1)(c) (“If the USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 12 of 27
12 Opinion of the Court 21-11763
receiving bank debits an account of the sender with the receiving bank, payment occurs when the debit is made to the extent the debit is covered by a withdrawable credit balance in the account.”). When a receiving bank—really, the paying bank—receives a payment order, it must determine whether the payment is “veri- fied.” Id. § 670.204(1). 6 The bank and the customer may agree beforehand to security procedures to verify the authenticity of pay- ment orders. Id. § 670.202(2). If (1) the bank and the customer agree on a security procedure, (2) the security procedure is “com- mercially reasonable,” and (3) the bank can prove it followed the security procedures in good faith, then payment order is “effective as the order of the customer, whether or not authorized.” Id. The term “commercially reasonable” is one we will return to later in our discussion. If a bank accepts a payment order that isn’t verified, then the bank “shall refund any payment” and “shall pay interest on the re- fundable amount.” Id. § 670.204(1). There is a penalty for failing to timely report a fraudulent transfer, though: the customer isn’t entitled to the interest if the customer failed to exercise ordinary care and to notify the bank of the fraudulent transfer within a rea- sonable time that cannot exceed 90 days. Id. Florida provides that
6 A payment order can also be “authorized.” Id. § 670.202(1). “Authorized” payment orders aren’t relevant to this case because the parties don’t dispute on appeal whether the fraudulent email sender was an authorized person on the account. We therefore do not discuss authorized payment orders further. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 13 of 27
21-11763 Opinion of the Court 13
a “[r]easonable time” may be fixed by agreement, but—crucially— “the obligation of a receiving bank to refund payment” may not be varied by agreement. Id. § 670.202(2). We realize this is a bit of a slog, but we have just two more provisions to wade through: First, Chapter 670 has a general rule that “the rights and obligations of a party to a funds transfer may be varied by agreement of the affected party.” Id. § 670.501(1). But importantly, that general rule does not apply to “670” sections when “otherwise provided in this chapter.” Id. And second, if a bank receives “payment from its customer with respect to a pay- ment order”—which happens immediately when the customer has more money in his or her account than the outgoing payment or- der—then “the customer is precluded from asserting that the bank is not entitled to retain the payment unless the customer notifies the bank of the customer's objection to the payment within one year after the notification was received by the customer.” Id. § 670.505 (emphasis added). The comment further explains the one-year rule. “This sec- tion is in the nature of a statute of repose . . . . A receiving bank that executes payment orders of a customer may have received payment from the customer by debiting the customer’s account with respect to a payment order that the customer was not re- quired to pay.” Id. cmt. “For example,” the comment explains, “the payment order may not have been authorized or verified pur- suant to Section 4A-202 . . . . In either case the receiving bank is obliged to refund the payment to the customer and this obligation USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 14 of 27
14 Opinion of the Court 21-11763
to refund payment cannot be varied by agreement.” Id. The one- year statute of repose also applies when “the funds transfer [wasn’t] completed . . . [or] if the receiving bank is not entitled to payment from the customer because the bank erroneously executed a pay- ment order [under Section 303] . . . or [when] the sender of a pay- ment order pays the order and was not obliged to pay all or part of the amount paid [under Section 402(4)].” Id. To recap, Section 670.501 provides that any section in Chap- ter 670 is modifiable by agreement “except as otherwise provided.” Id. § 670.501. Section 670.204 requires a bank to refund a payment order if it was not verified (unless the bank followed commercially reasonable security procedures in good faith), and this obligation may not be varied by agreement. Id. § 670.204(1). And Section 670.505 provides that a customer may not assert a claim for a re- fund for a fraudulent transfer after one year after the customer re- ceived notice of the transfer. Id. § 670.505. We now turn to the dispute here: is the one-year period in Section 670.505 modifiable by the parties? BB&T argues that it is modifiable and that the parties shortened it to 30 days. So because the Appellants didn’t notify BB&T of the fraudulent wire transfer within 30 days of the last statement in November 2017, BB&T as- serts, the Appellants’ claim for statutory repayment is time-barred. For their part, the Appellants respond that the period in Sec- tion 670.505 cannot be varied by agreement. So by their assess- ment, their notification to BB&T (either in January 2017 or May 2017) fell within a year of the last statement containing notice of USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 15 of 27
21-11763 Opinion of the Court 15
the fraudulent transfer in November 2017 and was therefore timely. We agree with the Appellants. As always with statutory interpretation, we start with the text. 7 GTC Inc. v. Edgar, 967 So. 2d 781, 785 (Fla. 2007). When it comes to Florida’s adoption of the UCC, Florida courts have ex- plained that the commentary is persuasive, but not controlling, au- thority. United Auto. Ins. Co. v. Rivero Diagnostic Ctr., 327 So. 3d 376, 380 n.2 (Fla. Dist. Ct. App. 2021); See, e.g., Corfan Banco Asun- cion Paraguay, 715 So. 2d at 970 (noting that “[a]lthough the com- mentary to the UCC is not controlling authority, we are persuaded by the expressed intent of the drafters” (internal citations omitted); Allen v. Coates, 661 So. 2d 879, 882 (Fla. Dist. Ct. App. 1995) (“[W]e are guided by the official comments of the Uniform Commercial Code adopted in Florida.”). Finally, under Florida law, “[w]here possible, courts must give full effect to all statutory provisions and construe related statutory provisions in harmony with one
7 As a federal court sitting in diversity jurisdiction, we apply Florida’s substan- tive law. McMahan v. Toto, 256 F.3d 1120, 1131–32 (11th Cir. 2001) (citing Erie R.R. Co. v. Tompkins, 304 U.S. 64 (1938)). The parties haven’t identi- fied—and we haven’t found—any Florida Supreme Court or intermediate ap- pellate court decisions on this point. So we apply the relevant principles of Florida law as the Florida Supreme Court has explained them. SA Palm Beach, LLC v. Certain Underwriters at Lloyd’s London, 32 F.4th 1347, 1357 (11th Cir. 2022) (“We therefore consider whatever might lend us insight, including rele- vant state precedents, analogous decisions, considered dicta, scholarly works, and any other reliable data tending convincingly to show how the Florida Su- preme Court would decide the issue at hand.”) (citations omitted & alterations adopted). USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 16 of 27
16 Opinion of the Court 21-11763
another.” Forsythe v. Longboat Key Beach Erosion Control Dist., 604 So. 2d 452, 455 (Fla. 1992). The Appellants have the better reading here for three rea- sons. First, BB&T’s reading ignores the text of Section 670.204. That section makes an important distinction between (1) a fraudu- lent transfer and (2) the interest that fraudulent transfer would have accumulated had it not been fraudulently transferred. Under that section, if a customer fails to notify a bank of a fraudulent transfer within “a reasonable time,” the sole penalty is that the customer loses the interest on the refunded payment. Id. § 670.204(1). As the commentary explains, “the bank is not entitled to any recovery from the customer based on negligence for failure to in- form the bank. Loss of interest is in the nature of a penalty on the customer designed to provide an incentive for the customer to po- lice its account.” Id. § 670.203 cmt. In other words, Florida made a policy choice about who should bear the risk of a fraudulent transfer: the bank or the account holder. It chose the bank. In- deed, the commentary expressly says so: “There is no intention to impose a duty on the customer that might result in shifting loss from the unauthorized order to the customer.” Id. § 670.203 cmt. That makes sense because banks control the security of their deposits, and they are in the best position to safeguard them. So when banks bear the risk, that motivates them to create and en- force better security for the deposits. But BB&T asks us to allow parties to shift the loss of an unauthorized order to the customer USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 17 of 27
21-11763 Opinion of the Court 17
during the statutorily determined period. The statute does not sup- port such a reading. After all, if the one-year statutory notice period could be var- ied, then banks could insist that customers sign contracts that make the time to demand a refund of a fraudulent payment a day (or even less). That would impair the account holder’s right to a re- fund and defeat Florida’s intent that banks—not account holders— bear the risk of a fraudulent transfer for the first year following the transfer. And there’s no limiting principle in the text for how short banks could make the statutory refund period. Nor was BB&T able to identify one at oral argument. So if banks could modify the one- year period, there’s no principled way to draw the line as to how short of a refund period is too short. There’s also another problem: Section 670.204 imposes a 90- day notification period for an account holder to obtain, in addition to her refund, interest on the fraudulent transfer. To be sure, Flor- ida expressly authorized the shortening of that period from 90 days to a “reasonable” period. But that just proves the point. In other words, even though § 670.204(2) authorizes modifi- cation to a “[r]easonable period” of the 90-day period during which the customer is entitled to receive interest as well as a refund, it prohibits any changes to the bank’s obligation “to refund payment as stated in subsection (1).” Fla. Stat. § 670.204(2). And Florida did not authorize modification to a “reasonable” period for the one- year period to which the 90-day period is directly related. So if BB&T were right, then the parties could modify the 90-day period USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 18 of 27
18 Opinion of the Court 21-11763
to a “reasonable” shorter period, and they could also modify the one-year period to be “[un]reasonabl[y]” short, because there is no textual requirement that the one-year period be “reasonable.” In fact, that one-year period could be modified to be the same as or even shorter than the “reasonable” refund notice period—because, on their faces and unlike for the 90-day period, the statutes do not limit the changes to the one-year period to “reasonable” ones. That would certainly “impair” the right to refund payment, in violation of § 670.204(2)’s prohibition on doing so. Such a result would also make no sense, given the 90-day/one-year-period structure for both putting the risk of fraudulent transfers on the bank and providing incentives in the form of interest on the fraudulently transferred amount to account holders to timely report fraudulent transfers. For that structure to work, the statutory notice period for receiving a refund must be (at least) longer than the notice pe- riod for also getting interest. And it must be meaningfully longer. We are not the first ones to reach this conclusion. The New York Court of Appeals and the Second Circuit also determined that the one-year refund period cannot be modified when it was inter- preting New York law (which is identical to Florida’s). As the New York Court of Appeals recognized, “[p]ermitting banks to vary the notice period by agreement would reduce the effectiveness of the statute’s one-year period of repose as an incentive for banks to cre- ate and follow security procedures.” Regatos v. North Fork Bank, 838 N.E.2d 629, 633 (N.Y. 2005). “To vary the period of repose would, in effect, impair the customer’s section 4–A–204 (1) right to USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 19 of 27
21-11763 Opinion of the Court 19
a refund, a modification that section 4–A–204 (2) forbids.” Id. See also Regatos v. North Fork Bank, 431 F.3d 394, 395 (2d Cir. 2005). The second reason the Appellants have the better argument stems from the fact that Section 204 is narrower than Section 505. In Florida, a specific provision generally controls over a broader one. McGregor v. Fowler White Burnett, P.A., 332 So. 3d 481, 491 (Fla. Dist. Ct. App. 2021). Section 204 concerns only unauthorized or unverified wire transfers and a bank’s duty to refund. FLA. STAT. § 670.204. Section 505, on the other hand, provides a statute of re- pose for objecting to all debits to a customer’s account. Id. § 670.505 cmt. It applies to unauthorized or unverified transfers, see id. § 670.202, to uncompleted funds transfers, and to errone- ously executed payment orders, see id. § 670.303. It also applies where the sender of a payment order pays the order but “was not obliged to pay all or part of the amount paid.” Id. § 670.402(d). Because Section 204 is narrower than Section 505, where Section 204 and 505 conflict, Section 204 controls. McGregor, 332 So. 3d at 491. And here, that conflict counsels against allowing the parties to modify the time to demand a refund. Third, the commentary to Section 505 describes it as like a “statute of repose.” FLA. STAT. § 670.505 cmt. Statutes of repose, unlike statutes of limitations, can be referred to as “jurisdictional” and are not subject to waiver or tolling. See Nat’l Auto Serv. Ctrs., Inc. v. F/R 550, LLC, 192 So. 2d 498, 513 (Fla. Dist. Ct. App. 2016) (explaining that statutes of repose “erect an absolute bar to the as- sertion of the extinguished cause of action that is analogous to a USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 20 of 27
20 Opinion of the Court 21-11763
jurisdictional statute of nonclaim”); see also John R. Sand & Gravel Co. v. United States, 552 U.S. 130, 133–34 (2008). Given that (1) Section 505 is like a statute of repose, see FLA. STAT. § 670.505 cmt., and therefore jurisdictional and that (2) we do not allow parties to create subject matter jurisdiction by agreement, it would make lit- tle sense to allow parties to modify Section 505 by agreement. See Morrison v. Allstate Indem. Co., 228 F.3d 1255, 1261 (11th Cir. 2000) (“[Subject matter jurisdiction] cannot be created by the con- sent of the parties.”). BB&T makes two arguments against this conclusion—both unpersuasive. First, BB&T argues that the Florida intermediate ap- pellate case Cheese & Grill Restaurant, Inc. v. Wachovia Bank, N.A., 970 So. 2d 372 (Fla. Dist. Ct. App. 2007), shows that Florida courts have permitted variation by agreement of analogous notice periods. We don’t find Cheese & Grill persuasive in this context. In Cheese & Grill, the Third DCA affirmed summary judg- ment for a bank that had paid fraudulent checks because, under the banking contract, the restaurant had a duty to report bad checks within thirty days. Id. This case isn’t controlling or even persua- sive because, as BB&T conceded at oral argument, there are im- portant differences between funds transfers (regulated in Chapter 670) and checks (regulated in Chapter 674). Oral Arg. at 35:14. In- deed, in passing Chapter 670, the commentators pointed out that Florida made “a deliberate decision” to write on a clean slate from its regulation of other instruments because of “the very large amounts of money that are involved in funds transfers.” FLA. STAT. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 21 of 27
21-11763 Opinion of the Court 21
§ 670.102 cmt. Given the legislature’s “deliberate decision” to “use precise and detailed rules” for funds transfers, we won’t apply a case involving bad checks here, where six-figure wire transfers are at issue. Id. Second, BB&T says that Section 505—the one-year period— doesn’t have any language prohibiting variation by agreement. BB&T’s argument goes like this: Section 501 provides that every provision in Chapter 670 can be varied unless “[e]xcept as other- wise provided.” Id. § 670.501(1). Section 505 has no such limita- tion. Id. § 670.505. Other provisions, BB&T points out, do. See, e.g., FLA. STAT. §§ 670.202(6), 670.305(6), 670.402(6), 670.403(3). Thus, BB&T concludes, we should interpret Section 505 as not containing a limitation against modification. [Id.] This argument sounds a bit like the negative-implication canon. Cf. A. Scalia and B. Garner, READING LAW: THE INTERPRETATION OF LEGAL TEXTS 107 (2012) (“The expression of one thing implies the exclusion of others.”). It isn’t quite the negative-implication canon because we aren’t considering what is and isn’t expressed in Section 505; rather, we are comparing the expression of a prohibition against modifica- tion in some parts of Chapter 670 with its absence in Section 505. BB&T makes a fair argument, but ultimately, we find it un- persuasive for two reasons. First, as we discussed earlier, see supra at 17 and 18, Section 670.204 limits modifications to the 90-day pe- riod to receive interest to “reasonable” periods. FLA. STAT. § 670.204(2). But if we applied the negative implication canon to this statute, it would mean that the one-year period to assert a USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 22 of 27
22 Opinion of the Court 21-11763
claim for a refund could be modified to be unreasonably short— even shorter than the interest period—because there is, after all, no use of the word “reasonable” in Sections 670.501 and 670.505. Id. §§ 670.501; 670.505. As we’ve explained, that can’t be right. Second, even Justice Scalia and Bryan Garner, after all, rec- ognized that “[n]o canon of interpretation is absolute” and “[e]ach may be overcome by the strength of differing principles that point in other directions.” Scalia and Garner, READING LAW at 59. See also id. at 107 (“Virtually all the authorities who discuss the nega- tive-implication canon emphasize that it must be applied with great caution, since its application depends so much on context.”). A principle pointing in a different direction is “the presumption against ineffectiveness.” Id. at 63. The presumption against inef- fectiveness provides that “a textually permissible interpretation that furthers rather than obstructs the document’s purpose should be favored.” Id. at 63. Here, BB&T’s interpretation—that the one- year time-period isn’t an unmodifiable obligation referenced in Sec- tion 670.204—would allow banks to eviscerate the protection Sec- tion 670.204 creates. See Regatos v. North Fork Bank, 838 N.E.2d at 633 (“To vary the period of repose would, in effect, impair the customer’s section 4–A–204 (1) right to a refund[.]”). The Appel- lants’ alternate interpretation—the one-year period is an unmodifi- able obligation referenced in Section 670.204—is reasonable and furthers the text’s purpose, so we adopt it. See FLA. STAT. § 670.204 cmt. (“There is no intention to impose a duty on the customer that USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 23 of 27
21-11763 Opinion of the Court 23
might result in shifting loss from the unauthorized order to the cus- tomer.”). As the New York Court of Appeals recognized, Article 4A was intended “to promote the finality of banking operations and to give the bank relief from unknown liabilities of potentially infinite duration.” Regatos, 838 N.E. 2d at 403. We will not alter “the stat- ute’s fine-tuned balance between the customer and the bank as to who should bear the burden of unauthorized transfers.” Id. B. Commercially Reasonable Security Procedures Given our conclusion that the one-year period in Section 505 isn’t modifiable by agreement—and there is no dispute that the Ap- pellants gave notice within one year—we would ordinarily next turn to whether BB&T’s security procedures were “commercially reasonable” as defined in Section 670.202. But here, we will wait for further proceedings rather than decide the question. Section 670.202 provides that a bank has a safe harbor from refunding fraudulent wire transfers if the bank and the customer agreed upon “commercially reasonable” security procedures and the bank followed those procedures in good faith. FLA. STAT. § 670.202(2). A security procedure is “established by agreement of a customer and a receiving bank” and does not include a bank’s unilaterally adopted internal processes. Id. § 670.201 & cmt. Whether a security procedure is “commercially reasonable” is “a question of law” to be determined by considering all the following: (1) the circumstances of the customer known to the bank (includ- ing the size, type, and frequency of payment orders); (2) alternate USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 24 of 27
24 Opinion of the Court 21-11763
security procedures offered to the customer; and (3) security pro- cedures in general use by customers and receiving banks similarly situated. Id. The commentary explains that “[a] security procedure is not commercially unreasonable simply because another procedure might have been better or because the judge deciding the question would have opted for a more stringent procedure.” Id. § 670.203 cmt. “Rather it is whether the procedure is reasonable for the par- ticular customer and the particular bank, which is a lower stand- ard.” Id. The commentary continues, “On the other hand, a secu- rity procedure that fails to meet prevailing standards of good bank- ing practice applicable to the particular bank should not be held to be commercially reasonable.” Id. For three reasons, we vacate the district court’s conclusion that BB&T’s procedures were commercially reasonable and re- mand the case for the district court to determine whether the pro- cedures were commercially reasonable and if so, whether there is a genuine issue of material fact that those procedures were fol- lowed. First, BB&T has produced additional discovery. We aren’t sure whether these new documents will alter the district court’s conclusion about commercial reasonableness. But the district court should have the first opportunity to rule on the importance of the documents. See Fla. v. Cohen, 887 F.2d 1451, 1455 (11th Cir. 1989) (“[A] remand to the district court for further proceedings is USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 25 of 27
21-11763 Opinion of the Court 25
necessary because new evidence has been developed that may shift the district court’s assessment of the issue.”). Second, we aren’t sure what the parameters of the security procedures at issue in this case are. The district court held that the security procedure at issue was the use of the token authentication system. But it did not discuss (and exclude or include) other measures Appellants say could be part of the security procedures: event notification, required password changes (both mentioned in the 2013 TMA) as well as security questions, signature authentica- tion, and payment limits. On remand, the district court should ex- plain which procedures are part of what the parties agreed to and which are excluded as the bank’s unilateral internal operations. And third, both sides submitted expert witness reports. In concluding that the security procedures were commercially rea- sonable, the district court cited to and relied on BB&T’s expert re- port. But it did not mention the Appellants’ expert report. This could be because the district court wasn’t considering the report. But while BB&T moved to exclude the Appellants’ expert witness as a sanction for non-disclosure, the district court denied the mo- tion as moot. On remand, the district court should explain whether it will consider the Appellants’ expert witness. In addition, the dis- trict court should apply the factors laid out by statute to the Appel- lants in this case—that is, whether the procedures were reasonable as applied to the Appellants—not whether the security procedures are commercially reasonable in the abstract. FLA. STAT. § 670.201 & cmt. (explaining that whether a security procedure is USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 26 of 27
26 Opinion of the Court 21-11763
commercially reasonable turns on the circumstances of the cus- tomer as known to the bank). So while we could decide whether the security procedures were commercially reasonable because it is a question of law, we think it prudent for the district court to do so based on the com- plete record.
IV. CONCLUSION In sum, we hold that the district court erred in concluding that the parties could modify the one-year period to assert a claim for repayment under Section 670.204. As a result, the court erro- neously concluded that the Appellants had failed to give timely no- tice. We REVERSE the district court on this point. 8 And, because BB&T produced new discovery, we VACATE the district court’s orders (1) dismissing the tort claims in the Third Amended Complaint and (2) entering summary judgment against the Appellants on their contractual, statutory, and declaratory judgment claims for relief. Given BB&T’s late production of dis- covery, on remand, the district court should allow the Appellants to take new discovery based on the recently produced discovery and, if necessary, to replead their claims.
8 We do not decide whether any of the Appellants other than Inversiones had standing to assert a claim for repayment because the new discovery may im- plicate the district court’s decision on this point and because, as long as Inver- siones has standing, we have jurisdiction. USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 27 of 27
21-11763 Opinion of the Court 27
REVERSED IN PART, VACATED IN PART, AND REMANDED WITH INSTRUCTIONS.9
9 All pending motions are DENIED AS MOOT.