HSBC Bank UK Plc · DRN-6135793

The complaint Z is a limited company and holds an account with HSBC Bank UK Plc (HSBC). Z’s director made a payment from this account to buy an investment on behalf of Z which Z now believes to have been the subject of an Authorised Push Payment scam (APP Scam). At the relevant time, HSBC was a signatory of a voluntary scam reimbursement code, under which it had committed to reimburse most customers who made a payment as the result of an APP Scam. Z complains that HSBC will not reimburse the resultant loss. Z is being represented in its complaint. For ease, I will treat any submissions from Z and its representative as being one and the same and attribute them to Z throughout. What happened Z’s complaint concerns a Faster Payments transfer of £100,000 that it made from its HSBC account on 19 December 2019. This payment was intended for an investment purporting to provide loan funding to a property development project. The specific project Z was intending to invest in was the first of several which would be financed through a company I will refer to as ‘Company P’. Prior to investing, Z’s director had carried out research into the offer. Amongst other things, Company P provided Z with the following: • An investment memorandum document (the IM); • Professional valuation of the development scheme; • The offer of an in-person site tour. Initially, it seems that all proceeded as had been expected. The investment was to pay an initial ‘return on investment’ payment, which appears to have been due in the month following Z’s investment — an up-front payment of the interest due. I believe this would have equated to 15% of the capital sum, an amount of £15,000. The limited information available to me suggests this may have credited Z’s account on or around 13 January 2020. However, the following year, Company P did not return Z’s capital in line with the terms of the investment. It later transpired that Company P (and the associated project companies) had entered administration, and ultimately that recovery of Z’s funds through the administration process was unlikely. In November 2022, Z’s director contacted HSBC to report what had happened. At the relevant time, HSBC was a signatory of the Lending Standard Board’s Contingent Reimbursement Model Code (the “CRM Code”). This was a voluntary code requiring signatory firms to reimburse victims of APP Scams in all but a limited set of circumstances.

-- 1 of 11 --

HSBC looked into Z’s claim but declined to make reimbursement. In its final response dated 31 March 2023 it said it was still investigating and that the bank had no further updates for Z. It does not appear HSBC has subsequently changed its position. Z has since referred the complaint to this service. I issued my provisional findings on the merits of this complaint in my provisional decision, dated 5 December 2025. In my provisional findings I explained why I intended to uphold the complaint in part and offered both sides the opportunity to submit further evidence or arguments in response. An extract of that decision is set out below and forms part of this final decision. As a starting point in law, HSBC had a primary obligation to carry out the payment instructions it received from Z’s authorised signatories. That being said, fairly and reasonably, taking into account regulators’ rules and guidance, relevant codes of practice, and what I consider to have been good industry practice at the time these payments were made, I think HSBC ought to have been on the lookout for out-of- character and unusual transactions and other indications that its customer might be at risk of financial harm from fraud. I have not been provided by HSBC with a history of Z’s account. I cannot therefore assess whether this was or was not a typical payment for Z. However, I don’t think it would affect the outcome I intend to reach even if it was a significantly unusual payment for Z. I say this because in considering if HSBC needed to take additional steps here (by intervening prior to processing the payment instruction) I need to consider whether any possible failure to do so likely caused the subsequent loss. Based on the circumstances here, including the extent of the information Z’s director had been provided with prior to entering into the investment (and including the in- person site visit offered) I think that even had HSBC intervened at the time of the payment, proportionate enquiries by the bank would not have prevented the payment from being made. Neither the bank nor Z would have likely uncovered significantly higher than usual reasons for concern about fraud at that point. However, that is not the end of the story. Where an APP scam occurred as the result of a bank transfer, the CRM Code may provide additional protections. HSBC’s final response to Z said it was still investigating the matter. That stemmed from Z’s referral of an APP scam claim in November 2022. Under the terms of the CRM Code as they applied in November 2022, a firm was required to answer a claim within a maximum of 35 days (and that in exceptional circumstances). HSBC has deferred answering Z’s claim or confirming whether it considers Z’s claim falls within the scope of the CRM Code. I have therefore firstly considered whether the CRM Code should apply to Z’s payment. And I have considered if this is something which cannot yet be determined (on the balance of probabilities). The relevant part of the CRM Code defines an APP scam as being a transfer of funds to another person for what the customer “believed were legitimate purposes but which were in fact fraudulent.”

-- 2 of 11 --

This is contrasted with a private civil dispute which the CRM code says can include: “where a Customer has paid a legitimate supplier for goods, services, or digital content but has not received them, they are defective in some way, or the Customer is otherwise dissatisfied with the supplier.” Was Company P offering a legitimate investment or were its purposes in fact fraudulent? Company P’s Joint Administrators have indicated they believe Company P’s schemes were intended to defraud investors from the outset. However, for reasons of confidentiality the Joint Administrators were unable to provide the Financial Ombudsman Service with supporting evidence to establish whether this would meet the CRM code’s criteria of an APP scam rather than a private civil dispute. The police arrested the de jure director of Company P in 2022. Although the police have since said that they believe a crime was committed against investors, they have now closed their investigation into the matter without any charges having been brought. No further information has been made available as to the nature of that alleged crime. However, the material obtained by the police was shared with the director’s trustees in bankruptcy, and they in turn have been able to share this information in so far as it concerns the activities of Company P and those involved in its operations. The electronic information obtained by the police as the result of a device review during their investigation was shared with the director’s trustees in bankruptcy, and they (“the Trustees”). The Trustees in turn have been able to share this information with the Financial Ombudsman Service in so far as it concerns the activities of Company P and those involved in its operations. That material was provided in a redacted form to HSBC together with a provisional decision issued on 8 August 2025 concerning another complaint involving Company P. The final decision on that other complaint was later published, setting out an analysis of that information.1 I do not intend to replicate that level of detail, given that HSBC has already had the opportunity to consider and respond to the same in that earlier decision. It suffices to say, in summary, that the evidence leads me to find that the investment being offered by Company P was fraudulent in nature and Company P induced investment through dishonest deception. That included the following five key misrepresentations made to Z (and to other investors): 1. The identity of the person controlling Company P. Company P represented in information given to investors (including the IM) that it was run by the de jure director, as its CEO. However, multiple emails, dating from the time that Company P was being set up and afterwards, indicate instead that the person with dominant control over the company was another individual who I’ll refer to as Person J. Person J headed an eight-member board and had control of the company. 1 That decision is available here https://www.financial-ombudsman.org.uk/decision/DRN- 5814892.pdf. Both Z’s representative and HSBC received a copy of that decision on the date it was issued – 17 October 2025.

-- 3 of 11 --

Person J’s involvement was hidden from investors. Emails in the new evidence indicate this was deliberate and because of Person J’s links to previous fraudulent and failed investments. The companies he’d previously been involved with are a group currently under investigation by the Serious Fraud Office, and a company through which a fraudulent US based investment scheme was promoted to investors. The latter company has been described in the Times as a “notorious Marbella-based boiler room2”. Person J has since pleaded guilty to his role in the US investment scheme (following his extradition from Spain to the US in late 2022). In that investment scheme, the identity of the CEO was misrepresented to investors (because the real CEO was associated with previous fraudulent investments in the UK). This fraudulent deception about the control of the company was necessary (otherwise no-one would have invested). It appears the same applied to Company P and the investment schemes it offered. In short then, I find this was a dishonest deception which was intended to (and did) lead private investors to invest where they otherwise would not have done so. 2. The existence of a £1m equity buffer to protect private investors. The IM (as received by Z’s director prior to Z’s investment) stated that £1m of equity capital had been put in place by Company P and the developer. This would mean the company and developer were in a position of first loss were the project to fall short of the projected returns — offering protection for private investors. The Joint Administrators say they’ve found no evidence of that equity being introduced. I have seen messages sent by the de jure director in which he essentially admits that the equity didn’t exist and that he (and Person J) knew this was a falsehood from the outset. It appears intended to provide false reassurance to investors. In summary, I find the promised equity most likely wasn’t put in place, and that this was a knowing and deliberate misrepresentation by Company P designed to induce private investors such as Z to invest where otherwise they may have decided not to proceed. 3. The misrepresentation of Company P’s costs, specifically its need to pay substantial commissions on investment funds raised. The IM said no arrangement fees were associated with the investment. It listed a ‘Total Development Cost’ of £10m. That total development cost figure did include something labelled ‘Finance Costs’ (a figure matching what appears to be the true cost of the senior lender finance as later shown in management accounts). But the figures don’t 2 ‘Boiler room’ typically refers to high-pressure sales teams selling investments, including (but not limited to) fraudulent schemes. Such ‘boiler rooms’ are typically based outside the UK. General consumer fraud prevention information relating to ‘boiler room’ scams is available here: Boiler room fraud | Action Fraud and on this page: Boiler room scams | FCA. The FCA’s website says “Share and bond scams are often run from 'boiler rooms' where fraudsters cold-call investors offering them worthless, overpriced or even non-existent shares or bonds. Boiler rooms use increasingly sophisticated tactics to approach investors, offering to buy or sell shares in a way that will bring a huge return. But victims are often left out of pocket — sometimes losing all of their savings or even their family home. Even experienced investors have been caught out, with the biggest individual loss recorded by the police being £6m”. In reported court transcripts from the trial of the US company’s founder, owner, and controlling mind, he was questioned about ‘boiler rooms’ he had been involved with. He was asked whether investors had generally received their projected returns — to which he replied that generally they did not. When asked what happened to investors’ money generally, he replied that generally they lost their money. This was the scheme for which Person J was extradited from Spain in 2022 and has led to his now serving a prison sentence in the US.

-- 4 of 11 --

include the cost of capital raised from investors such as Z. Those costs were ‘commission payments’ and other fees to be paid to connected parties. Company P’s management accounts show around 12% commission was being paid on the amount raised from private investors. These also show a significant sum being paid as a fee to the director of the developer company. In email discussions between those running Company P prior to the IM being issued, they acknowledge that “we will not get away with £600K in fees being brought above the profit line into the deal.” and “If [these numbers are] presented to investors […] the deal does not work”. Further fees are discussed by those controlling Company P, in the region of £650,000 per board member (for eight board members, that would equate to over £5m). These appear to have been paid via a company based in Marbella (operating in the same office as Person J’s company) and then routed to companies owned by the various board members of Company P. 4. A significant over-raise of funds. The IM gave a figure of £1.2m for the amount to be raised from private investors. In reality, a multiple of that amount was raised (and needed to be) for the redevelopment work to be completed. This was a necessary corollary of the additional costs resulting from the commission/fee payments, and the missing equity. The cost of capital attached to all funds Company P raised from private investors was paid out upfront. For this development much of this cost was paid out before the site had been purchased or the work started. This accounted for an average of 25% of the sum raised. That meant an even larger sum needed to be raised to cover the necessary cashflow (given this all happened before any money was made from the underlying business). As a consequence, the eventual total raised from private investors for the first development appears to have reached a total of around £7.5m (compared to the £1.2m figure given in the IM). Given the additional costs were known to Company P in advance (evidenced by comments in the new evidence) it seems almost certain that the need to raise significantly more than was stated in the IM was apparent to Company P from before the point the IM was issued on Company P’s behalf. This was most likely a fraudulent misrepresentation. 5. The likelihood of investors being repaid by Company P. The IM gives a finished value of the project of just under £12m (a figure referred to as the GDV). Allowing for the ‘Total Development Cost’ figure of £10m given in the IM, this GDV results in a stated target development profit of approximately £2m. The IM figures show a raise of around £1.2m from private investors, with approximately £7m from senior debt. But with £7m drawn down from senior debt, and an actual raise of £7.5m from private investors, it is obvious that the GDV of just £12m (even without allowing for any costs) could never be sufficient for Company P to repay its lenders. The total costs, including the additional hidden costs of commissions and fees to connected parties, were always going to be significantly higher than the GDV of the project — it could never have been profitable.

-- 5 of 11 --

This was misrepresented to investors in the IM. As those controlling Company P noted in internal emails prior to the IM, giving investors the true picture would have made it apparent that the ‘deal did not work’. The emails between those on Company P’s board indicate that a significant over-raise from private investors was always their plan. A higher raise of funds from private investors meant higher commissions and fees that would be removed (via a Spanish company run by the same people). In short, the only possible outcome of the way Company P was set up was that it would fail and enter administration. The board appear to have planned for this from the outset and, leading up to the administration, were able to remove most of the value of the residual assets by acquiring new priority debt (for which they appear to have received commission income). Summary of the various misrepresentations and the intent behind them To summarise then, Company P made several key misrepresentations which were false and known to be false at the time Company P permitted them to be made. Company P misrepresented who controlled it in order to hide from investors that it was actually controlled by a man whose previous business activities had proved disastrous for investors (in connection with some of those previous activities, Person J has since pleaded guilty to criminal fraud charges and is now serving a prison term). In relation to the investments offered by Company P, the true financial details (in particular the money that Company P planned to extract as commissions and director remunerations) were withheld from investors because no-one would have invested knowing it could never return a profit let alone be able to repay their original capital. Is this a Private Civil Dispute? In assessing the fair answer to this case, I have given very careful consideration to the arguments and evidence available which might support the alternative to this having been an APP scam covered by the CRM Code. In other words, that which might support a finding that this was a failed investment in a legitimate entity and at most a private civil dispute. The property site that was proposed to be developed was in fact developed, and then successfully sold. This is not typical for a criminal scam. If the aim was simply to steal investors’ money, anything that acted counter to that aim might be seen as pointing to an alternative explanation. Paying for the site and paying for the developer to actually develop the property might fall into that category. Other similar arguments for the legitimacy of the investment might point to the repayment of the earliest investors, or the payment of upfront returns on the investment (the early ‘interest’ payment on investors’ loans). Both actions would have seemingly reduced the financial gains available to a scammer. But I am not convinced that these arguments demonstrate this was not an APP scam or that the scam was not planned from the outset. The type of scam commonly referred to as a ‘Ponzi scheme’ is one that is well known. In such a scheme, money from investors is used to repay earlier investors, or used to pay returns that are not justified by profits earned on the underlying investment.

-- 6 of 11 --

Looking at the evidence here, I find that the explanation of this having been designed to keep the scam convincing and running for longer (and hence to produce a greater cumulative ‘profit’ for the scammers) is the most persuasive. That accords with the unusual upfront returns that were paid. In addition, it strikes me that, by disguising the outward appearance of the underlying fraudulent scheme, this mechanism may well benefit those responsible by making their later prosecution a far less straightforward matter than would be the case for a simple theft. The comments of those behind Company P support the finding that this was most likely set up as a deliberate Ponzi scheme. In many cases these comments reflect an aim of rolling over the investments of investors into follow-on investments — either in the same ongoing development or in later schemes. By maintaining an appearance that the projects were progressing as expected and securing agreement to reinvest, this could mean there would be no need to repay those investors’ capital at the maturity of their investment — it could remain (nominally at least) in an investment with Company P, delaying the inevitable collapse of the scheme, and allowing the scheme to continue to attract new investors (as indeed appears to have happened). As summarised above, the evidence persuades me that the investment scheme offered by Company P was, from the outset, created with the intent of deceiving investors about the control and the financial structure of the property development. This was designed by those covertly in charge of Company P in such a way as was (and as must have been known to Company P from the very beginning) likely to leave the retail investors unprotected against its inevitable collapse into insolvency. The scheme was misrepresented in order to induce Z (and others) to invest. I accept that in reviewing these and other comments of those involved in Company P, I cannot know what the precise intent of the authors was. Nor can I have certainty about my interpretation of those comments. But I am required to reach what I consider to be a fair and reasonable outcome in all the circumstances, given the evidence available to me and applying the balance of probabilities where there is doubt about an issue of fact. I am satisfied that there is sufficient for me to reach a fair and reasonable finding here. The wider context within which individual comments sit, including the comments of those involved in Company P, provides a clearer route to interpreting individual comments and renders the meaning less subjective. Reviewing the evidence and individual comments together has allowed me, applying the balance of probabilities (but conscious that I should not find anyone to have been dishonest unless there is cogent evidence to support such a finding) to reach what I consider to be a sufficiently reliable interpretation to make a finding on the intentions of those behind the investment scheme. And the outcome I propose to reach is one I consider to be consistent with that interpretation. I have also taken into account that the police state they are no longer pursuing their investigation or bringing criminal charges against the de jure director of Company P. I don’t consider this changes matters. A criminal prosecution may not be pursued for various different reasons which have no bearing on whether or not something was an APP Scam as defined by the CRM Code. The police consider that investors were the victims of a crime here, and have said nothing to suggest the contrary. That accords with my findings (made on the balance of probabilities). And I have found that the de jure director was not the controlling mind of Company P, that being instead Person J — already serving a prison term in the USA for investment fraud. Should Z now be reimbursed by HSBC under the terms of the CRM Code?

-- 7 of 11 --

In summary, while I’ve carefully assessed the alternative explanations or scenarios, applying the balance of probabilities I consider this was an APP scam, and that Z’s payment is covered by the CRM Code. The CRM Code requires reimbursement of the victims of APP scams in all but a limited set of circumstances. I have considered whether any of the exceptions to full reimbursement under the CRM Code could now fairly be relied on by HSBC. The exceptions I consider could be of possible relevance in this case are (in summary) that: 1) the customer ignored an Effective Warning; 2) the customer made the payment without a reasonable basis for believing that they were paying for genuine services from a legitimate business; 3) where the customer is a micro-enterprise it did not follow its own internal procedures for approval of payments, and those procedures would have been effective in preventing the APP scam; or 4) the customer was grossly negligent. In relation to the first of these, I have seen nothing to suggest that HSBC provided Z with an Effective Warning (as defined in the CRM Code). So I don’t think HSBC can rely on this exception. And I do not consider that HSBC has established that Z (or Z’s director) made the payment without holding a reasonable basis for believing the various points listed in the CRM Code at R2(1)c. Z’s payments were made to the person Z was expecting to pay (Company P). I’m satisfied that Z’s director had carried out reasonable checks into the purported investment opportunity prior to making each payment. And I am satisfied that Z’s director and Z held a reasonable basis for believing that this payment was being made for a genuine investment with a legitimate business. This was a scheme that those behind Company P had expended considerable effort on making appear legitimate, and I don’t think Z (or indeed HSBC) could reasonably have uncovered its fraudulent nature at the time of the payment. HSBC has shown nothing to evidence that Z failed to follow its own internal processes or that a failure on Z’s part to do so was material in the success of the APP scam. Turning to the fourth exception I consider that would require HSBC to establish that Z had shown a very significant degree of carelessness — beyond that of ordinary negligence. HSBC has not done so, and I have seen nothing that I think could establish a finding of gross negligence on Z’s (or Z’s director’s) part. In short, I do not find HSBC could rely on these (or any other) exceptions to full reimbursement under the CRM Code. As a result, I am currently of the opinion that HSBC should fairly and reasonably reimburse Z for the amount it has lost, under the terms of the CRM Code. Putting matters right Z’s payment amounted to a total sum of £100,000. It seems Z received an early return of money by Company P (the early interest payment of £15,000) which would have had the effect of reducing the financial loss incurred. I think it would be fair for HSBC to offset that return (and any other payments Z has received in connection to Company P) against the reimbursable loss.

-- 8 of 11 --

If there were any other sums received from the disputed payment than the £15,000 sum that appears to have been paid out as an early return on the investment, then Z should detail any such amounts received in response to this provisional decision in order that HSBC can accurately calculate the net amount of Z’s loss. Given the complexity of this investment scheme, and the considerable challenges and time expended before evidence could be obtained to show this had indeed been an APP scam, I don’t consider HSBC could reasonably have reached that finding sooner than the date that information was shared with the bank – that being 8 August 2025. With that in mind I intend to award interest calculated from that date. I think a fair reflection of the cost to Z of being deprived of these funds for that period would be for HSBC to add interest at the rate of 8% simple per year. That rate is one I consider provides a reasonable reflection of Z being deprived of that money for the relevant period. Other routes to recover funds and the possibility of double-recovery In its most recent report on Companies House, the Joint Administrators indicate that they anticipate being able to distribute only a small amount of funds relative to the amounts owed to unsecured creditors such as Z. Given what they indicate in this report, it appears unlikely to me that the conclusion of Company P’s insolvency process will result in any substantive repayment of the monies owed to unsecured creditors. It appears possible however, that even if proportionately small, some monies may be returned to Z through that route. It also seems not inconceivable that some funds might also be recovered to Z through other routes, such as through a prosecuting authority later recovering assets for investor-victims. It would not be fair or equitable for me to put Z in a position of double recovery. In saying that, I don’t consider this possibility prevents HSBC from reimbursing Z under the CRM Code now. However, I consider it is fair and reasonable that HSBC can choose, if it wishes, to obtain an undertaking from Z to entitle it to any money recoverable elsewhere from Z’s investment in Company P. In other words, HSBC may require Z to enter into an undertaking to assign to the bank the rights to any monies Z might elsewhere be entitled to recover in respect of its investment of £100,000 into Company P. If HSBC asks Z to provide such an undertaking, payment of the reimbursement I intend to award may be dependent upon provision of that undertaking. HSBC may wish to treat Z’s formal acceptance of the terms of my final decision as being sufficient for this purpose. Alternately, HSBC would need to meet any costs in drawing up an undertaking of this type. If HSBC elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to Z for its consideration and agreement I invited both sides to provide any further arguments or information by 19 December 2025, after which point, I said I intended to issue my final decision on the matter. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable

-- 9 of 11 --

in the circumstances of this complaint. In deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant law and regulations, regulators’ rules, guidance and standards, codes of practice; and, where appropriate, what I consider to be good industry practice at the time. Where the evidence is incomplete or missing, I make my findings based on the balance of probabilities — in other words what I consider is most likely given the information available to me. Responses to my provisional decision HSBC and Z were both sent my provisional decision on the same date, 5 December 2025. Z responded on 12 December 2025. Z accepted the settlement proposed. However, while accepting what had been proposed, Z said it thought it might have been fairer: • to award compensatory interest from an earlier date than I had recommended; and, • for the proposed assignment to take effect only after Z had received, in aggregate, full payment of its claim against Company P, including contractual interest. HSBC responded initially to request an extended deadline of 9 January 2026. It then responded further to say that it had raised a general query through one of my colleagues and was awaiting a response to this. I am aware that this query was answered on 29 January 2026. HSBC has not made any further submissions since that date. I consider HSBC has now had an adequate time to respond if it had further evidence or arguments to raise in relation to this complaint. I am conscious of the time this matter has already taken, and I do not propose to delay matters further by allowing any further time (which in any event, HSBC has not requested). I am now in the position to issue my final decision on this complaint. While Z accepted the settlement I proposed in the provisional decision, I have given careful consideration to the further comments it made in its response. In relation to Z’s first point, however, I don’t consider I could reasonably find HSBC at fault for believing this to be a private civil dispute at any point prior to HSBC’s receipt of the new information. This fraud was heavily disguised by those responsible, and in very brief summary I consider that there was a lot about this scheme which, on the face of things, would have looked very much akin to a genuine but failed investment scheme. Substantive evidence to the contrary only became available to HSBC at the point it received the new information on 8 August 2025. I consider it fair and reasonable in all the circumstances that HSBC should calculate interest on the amount to be refunded from that date, rather than any earlier point. And in relation to the second point raised, I do not agree it would be fairer outcome if I were to say the assignment should not take effect until a possible later claim made by Z for amounts in the administration. If Z accepts this decision, it will receive at least £85,000 from HSBC, reimbursing the net loss incurred through the £100,000 Z paid Company P. I don’t consider it would be fair for HSBC to have to wait until Z perhaps received and retained further sums in respect of the investment before becoming entitled to the benefit of any payouts it may receive, whether from the administration or any other source. Z has claimed reimbursement for this payment from HSBC under the CRM Code on the basis that it was tricked into transferring the money; and my decision is to uphold Z’s complaint. I don’t think it would be just that Z could accept this decision but defer from

-- 10 of 11 --

repaying HSBC until it has received any additional sums it may claim in the administration. Once HSBC has reimbursed Z the sum of £85,000, it will be the party out of pocket in the most immediate sense. Z may or may not have a claim to additional expected returns from the loan and interest, but that seems to me of much less consequence. So, HSBC, by reimbursing Z, will be the party I regard as most deserving of any recoveries from the administration or elsewhere and, looking at what is fair and reasonable in this situation, I consider HSBC should stand first in line for any such recoveries. In short, while I have taken into account Z’s comments in its response to the provisional decision, I consider the fair and reasonable outcome in all of the circumstances remains the one I set out there. Putting things right I’ve carefully considered the responses I received to my provisional decision. But these have not changed the outcome I consider fairly resolves this complaint or altered my reasoning. For the reasons set out in my provisional decision and above, I find it fair and reasonable in all the circumstances that Z ought to have been fully refunded for its net loss from its payment under the CRM Code. I therefore direct HSBC UK Bank Plc to pay Z within 28 days of receiving notification of Z’s acceptance of my final decision: • the net amount lost through Z’s payment to this scam, that being the sum of £85,000; plus, • interest on that amount at the simple rate of 8% per year (less any tax properly deductible) to be calculated from 8 August 2025 until the date of settlement.3 I consider it is fair and reasonable that HSBC can choose, if it wishes, to obtain an undertaking from Z to entitle it to any money recoverable elsewhere from the investment in Company P. In other words, HSBC may require Z to enter into an undertaking to assign to the bank the rights to any monies it might elsewhere be entitled to recover in respect of Z’s payment of £100,000 to Company P. If HSBC asks Z to provide such an undertaking, payment of the reimbursement I am awarding may be dependent upon provision of that undertaking. HSBC may wish to treat Z’s formal acceptance of the terms of my final decision as being sufficient for this purpose. Alternately, HSBC would need to meet any costs in drawing up an undertaking of this type. If HSBC elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to Z for its consideration and agreement. My final decision For the reasons given above, I uphold this complaint in part and require HSBC UK Bank Plc to put matters right as I have detailed above. Under the rules of the Financial Ombudsman Service, I’m required to ask Z to accept or reject my decision before 6 March 2026. Stephen Dickie Ombudsman 3 If HSBC considers that it’s required by HM Revenue & Customs to deduct income tax from that interest, it should tell Z how much it’s taken off. It should also give Z a tax deduction certificate if it requests one, so it may reclaim the tax from HM Revenue & Customs if appropriate.

-- 11 of 11 --