We believe that your bank can require or encourage your customers to use your Positive Pay services in your account agreements, and you may choose to implement this change going forward for new customers only or for existing customers as well by amending their account agreements.

Under the Illinois Uniform Commercial Code (UCC), your bank generally is liable to your customers for paying fraudulent checks that are not properly payable. However, your bank may agree with your customers to vary the terms of the UCC in your deposit account agreements, provided that your agreements do not disclaim your bank’s “responsibility for its lack of good faith or failure to exercise ordinary care or limit the measure of damages for the lack or failure.” Also, your account agreements may determine “the standards by which the bank’s responsibility is to be measured if those standards are not manifestly unreasonable.”

While we are not aware of any Illinois case law on this point, at least two out-of-state courts have examined the validity of provisions in account agreements that disclaim a bank’s liability for fraudulent checks. In a Minnesota case, the court concluded that a bank’s deposit agreement could require a customer to disclaim liability for fraudulent checks when Positive Pay was offered to and declined by its customer. However, in a similar case before a federal appellate court, the court concluded that an account agreement improperly disclaimed the bank’s duties to act in good faith and exercise ordinary care. In that case, the account agreement absolved the bank of liability for any fraudulent transactions when the customer declined to enroll in nondescript anti-fraud products designed to discover or prevent the type of fraud at issue.

Consequently, we believe that your deposit account agreements may impose some requirements on your customers, such using Positive Pay. We recommend consulting with bank counsel to craft such provisions, particularly given the UCC’s limitations on deposit account agreements and because we do not know how far Illinois courts will go to enforce such agreements.

In the resources below, we have included publicly-available deposit account agreements that shift liability to business customers in connection with their failure to implement certain fraud prevention services, including Positive Pay. One of the deposit account agreements specifies several required fraud prevention services and describes “additional security measures” for check writing (such as “make sure all numbers begin at the far left of the line”) and other payment methods. 

If your bank makes exceptions from its Positive Pay requirements for particular customers, we recommend documenting your business reasons for those exceptions to ensure that they do not result in a disparate impact on a protected class of customers. While the Equal Credit Opportunity Act appears to apply only to lending products, the CFPB’s Supervision and Examination Manual suggests that fair lending standards could be applied to deposit accounts — meaning that making exceptions to your deposit account requirements on a prohibited basis could be considered a discriminatory unfair, deceptive, or abusive act or practice (UDAAP). We believe that following the fair lending protocols of documenting the business necessity for making such exceptions could help to mitigate the risks of a UDAAP finding.

For resources related to our guidance, please see:

• Illinois UCC, 810 ILCS 5/4-401(a) (“An item is properly payable if it is authorized by the customer and is in accordance with any agreement between the customer and bank.”)
   
• Illinois UCC, 810 ILCS 5/4-103(a) (“The effect of the provisions of this Article may be varied by agreement, but the parties to the agreement cannot disclaim a bank’s responsibility for its lack of good faith or failure to exercise ordinary care or limit the measure of damages for the lack or failure. However, the parties may determine by agreement the standards by which the bank’s responsibility is to be measured if those standards are not manifestly unreasonable.”)
   
• Cincinnati Ins. Co. v. Wachovia Bank, N.A., 2010 U.S. Dist. LEXIS 70670 at *9 (D. Minn. 2010) (“§ 12 of the deposit agreement concludes with a conditional release of Wachovia's liability:
   
• You agree that if you fail to implement any of these products or services, or you fail to follow these and other precautions reasonable for your particular circumstances, you will be precluded from asserting any claims against [Wachovia] for paying any unauthorized, altered, counterfeit or other fraudulent item that such product, service, or precaution was designed to detect or deter, and we will not be required to re-credit your account or otherwise have any liability for paying such items.”)
   
• Cincinnati Ins. Co. v. Wachovia Bank, N.A., 2010 U.S. Dist. LEXIS 70670 at *20 (D. Minn. 2010) (“Wachovia acted reasonably in requiring Schultz Foods either to implement Positive Pay or to assume responsibility for fraud-related losses that could have been prevented by Positive Pay. . . . Under these circumstances, the Court holds that the relevant provisions of the deposit agreement are not ‘manifestly unreasonable’ for purposes of § 4-103(a) and are ‘reasonable under the circumstances’ for purposes of § 4-103(d).”)
   
• Majestic Bldg. Maint., Inc. v. Huntington Bancshares, Inc., 864 F.3d 455, 456–57, 463 (6th Cir. 2017) (“The section of the Agreement at issue in this case states:

[W]e have available certain products designed to discover or prevent unauthorized transactions, including unauthorized checks and ACH debits, forgeries, and alterations (all such activities referred to as ‘fraud’). While no such product is foolproof, we believe that the products we offer will reduce the risk of loss to you from fraud. You agree that if your account is eligible for those products and you choose not to avail yourself of them, then we will have no liability for any transaction that occurs on your account that those products were designed to discover or prevent, nor will we have any duty to re-credit your account for any such losses.

* * * * *

Plaintiff’s contention is quite simple: the provision at issue improperly disclaims Defendant’s duties to act in good faith and exercise ordinary care. We find that Plaintiff states a plausible claim that the provision unreasonably disclaims all liability under the circumstances of this case.”)

U.S. Bank, Your Deposit Account Agreement, page 19 (“We offer certain products and services, such as ‘positive pay,’ and account blocks and filters that are designed to detect or deter fraud. Failure to use such services could substantially increase the likelihood of fraud. If you fail to implement any of these products or services, or if you fail to follow these or other precautions reasonable for your type of account or circumstances, you agree that you will be precluded from asserting any claims against us for paying any unauthorized, altered, counterfeit or other fraudulent item that such product, service or precaution was designed to detect or deter, and we will not be required to re-credit your account or otherwise have any liability for paying such items.”)

Wells Fargo, Deposit Account Agreement, page 26 (“Protect your checks from unauthorized use and theft by securing your supply of checks at all times (for example, never leave checks in an unlocked vehicle, or out in a visible location unattended), using tamper resistant checks, destroying checks you don’t intend to use, and not signing blank checks. Check-related fraud is common. If you fail to take any of these preventive measures, we are not responsible for any losses that you may incur.”)

UnionBank, Business Accounts & Services Disclosure and Agreement (“In addition, we make available to you certain products and services designed to detect and/or deter fraud. While no product or service can provide complete protection from all potential sources of risk or fraud, we believe that using available fraud protection products in conjunction with appropriate internal controls within your operation can reduce the likelihood of fraud on your account. Such products include, without limitation:

• Positive Pay Services (Positive Pay(ee), Basic PositivePay(ee), Reverse Positive Pay, and Basic Reverse PositivePay) – Provides early fraud detection and prevention when issuing checks on an account, and allows you to block payment of unauthorized checks.
   
• ACH Block – The ACH Block service allows you to restrict the posting of all ACH transactions, debits, credits, or both. We will return, unprocessed, all ACH Transactions, debits, credits, or both, presented against your account.
   
• Electronic Payment Authorization (EPA) ACH Positive Pay – The EPA service allows you to filter the posting of ACH Transactions to your account. We will return, unprocessed, ACH Transactions presented against your account that do not match the parameters you provided. You will be responsible for adding EPA/ACH Positive pay filters through the ACH Exchange online system.
   
• Universal Payment Identification Code or UPIC – Is an account feature that is a permanent and secure account identifier that you can freely distribute to encourage the receipt of electronic payments to your account. The UPIC number should only be used for incoming electronic credits of ACH entries.
   
• Information Reporting – Enables review of all transactions posted to your account daily.
   
• View Image – Allows you to view images of paid checks.

You agree that if you fail to implement any of these products or services, or you fail to follow these and other precautions reasonable for your particular circumstance, you will be precluded from asserting any claims against us for paying any unauthorized, altered, counterfeit, or other fraudulent Item that such product, service, or precaution was designed to deter or detect, and we will not be liable for paying such Items.

Additional security measures include:

Checks

• • Write checks in dark ink and fill in all lines completely. Make sure all numbers begin at the far left of the line. Do not keep blank checks with bank statements and paid checks.
     
  • Do not give anyone a pre-signed check (a check signed by the maker but with the amount and/or payee designation blank)or allow someone else to sign your name on a check.
     
  • Only use checks ordered through Union Bank.
     
  • Do not include your driver’s license, tax identification, or Social Security number on a check unless you believe it is necessary and you are directly providing the check to a trusted person.”)
     
• CFPB Supervision and Examination Manual: UDAAPs, page 10 (March 2022) (“A discriminatory act or practice is not shielded from the possibility of being unfair, deceptive or abusive even when fair lending laws do not apply to the conduct. For example, not allowing African-American consumers to open deposit accounts, or subjecting African-American consumers to different requirements to open deposit accounts, may be an unfair practice even in those instances when ECOA does not apply to this type of transaction.”)
   
• FFIEC, Interagency Fair Lending Examination Procedures, page iv (“When an Agency finds that a lender’s policy or practice has a disparate impact, the next step is to seek to determine whether the policy or practice is justified by ‘business necessity.’ The justification must be manifest and may not be hypothetical or speculative. Factors that may be relevant to the justification could include cost and profitability. Even if a policy or practice that has a disparate impact on a prohibited basis can be justified by business necessity, it still may be found to be in violation if an alternative policy or practice could serve the same purpose with less discriminatory effect.”)