Public Bank Bhd V National Feedlot Corp Sdn Bhd & Ors And  Another Appeal  [2025] 4 MLJ 850

Federal Court (Putrajaya) 

Banking — Secrecy — Bank customer

1. The Respondents, comprising National Feedlot Corporation Sdn Bhd (NFC) and several related individuals and companies, maintained banking relationships with the Appellant, Public Bank Berhad (PBB). In March 2012, a politician, Rafizi Ramli, held a press conference where he publicly disclosed the Respondents’ confidential banking information that he had obtained from unknown sources. Among the materials shown was a confidential management assessment document (Annexure E) detailing the loan application of the fifth Respondent for the purchase of eight condominium units at KL Eco City. Although the loan was initially approved by PBB in May 2011, it was later withdrawn in January 2012, and no loan was ever disbursed contrary to Rafizi’s public allegations.
2. Following the disclosure, the Respondents filed a civil suit against Public Bank in the High Court, claiming that the bank had breached its statutory duty of secrecy under subsection 97(1) of the Banking and Financial Institutions Act 1989 (BAFIA), as well as its implied contractual duty of confidentiality. The Respondents sought RM560 million in total damages, comprising RM60 million in general damages, RM250 million in aggravated damages, and RM250 million in exemplary damages.
3. PBB denied liability, contending that the unauthorised disclosure was carried out by two “rogue” employees, namely Cheam Chen Hooi and Johari bin Mohamad, who had accessed and printed the confidential documents from the bank’s restricted system without authority. The bank argued that these employees had acted outside the scope of their employment, and thus, the bank itself should not be held responsible.
4. The High Court dismissed the Respondents’ claim in 2019, holding that PBB was not liable, as the misconduct was committed by individual employees without the bank’s knowledge.
5. The Respondents appealed, and in August 2023, the Court of Appeal reversed the High Court’s decision, ruling that PBB had breached its implied contractual duty of confidentiality to its customers. However, as the Respondents failed to prove actual loss, the Court of Appeal awarded only RM10,000 in nominal damages.
6. Dissatisfied, PBB appealed to the Federal Court, relying heavily on the English common law case Tournier v National Provincial and Union Bank of England [1924] 1 KB 461, arguing that the duty of confidentiality is a qualified duty, and that the bank should not be held liable for the unauthorised acts of employees beyond their authority. The Respondents countered that BAFIA, as a statutory law, governed all matters of banking secrecy in Malaysia and rendered Tournier irrelevant.

1. Whether a bank can avoid liability for breach of banking secrecy under subsection 97(1) by claiming that the disclosure was made by its employees acting outside their authority?

(1)  Whether a bank can avoid liability for breach of banking secrecy under subsection 97(1) by claiming that the disclosure was made by its employees acting outside their authority?

(a) The Federal Court answered this question in the negative, holding that Public Bank Berhad was liable for the disclosure of confidential customer information, even though the act was committed by its employees without authorisation.

(b) The Federal Court held that subsection 97(1) of BAFIA imposes a statutory duty of secrecy on banks, covering all officers, agents, and any person with access to customer records. This duty is strict and comprehensive — the bank cannot escape liability by attributing blame to employees.

(c)   The Court stated –

“It makes no sense that a bank whose duty of secrecy is regulated by statute should be absolved of liability where the breach of that duty is committed by those under its employment, supervision and care.” (para [24])

(d) The Court further held that none of the statutory exceptions under subsections 97(2) and 99(1) of BAFIA applied, and that no such defence was pleaded by the bank. Consequently, the breach was without justification (paras [26]–[27]).

(e)  The Federal Court also clarified that the duty of secrecy in Malaysia is governed entirely by statute, not by the common law principle from Tournier v National Provincial and Union Bank of England [1924] 1 KB 461. Applying Tournier was improper because, under subsection 3(1) of the Civil Law Act 1956, the common law of England only applies in the absence of written Malaysian law. As Malaysia already has statutory provisions regulating banking secrecy, Tournier is irrelevant and inapplicable.

(f)   The Federal Court stated –

“Since there is written law in Malaysia on the bank’s duty of secrecy after the coming into force of the Civil Law Act on 7 April 1956, Tournier has no relevance in determining whether Public Bank is liable.” (para [35])

(g) The Court emphasized that allowing a “rogue employee” defence would defeat the purpose of subsection 97(1) and render the law meaningless, as banks must take responsibility for their employees’ actions performed within their employment structure.

1. The Federal Court unanimously dismissed Public Bank’s appeal, affirming that the bank was liable for breach of statutory duty under subsection 97(1) BAFIA. The Court ruled that common law exceptions under Tournier were irrelevant due to the existence of statutory provisions in Malaysia.

1. The duty of banking secrecy in Malaysia is statutory under BAFIA, not based on common law.
2. Banks are strictly liable for breaches of confidentiality committed by their employees.
3. Common law cases like Tournier no longer apply where written law exists under subsection 3(1) of the Civil Law Act 1956.
4. The scope and exceptions to banking secrecy are found only in subsections 97(2) and 99(1) BAFIA.
5. This case strengthens customer protection by affirming that banks cannot avoid responsibility through internal misconduct defences.