Financial Institutions and Banking

Federal Court: Financial Institution Liable for ACH Fraud Losses

In a recent case — Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union — the U.S. District Court for the Eastern District of Virginia held a credit union liable for more than $500,000 in fraudulent ACH payments deposited into a member’s account and quickly withdrawn. The payments were the result of a business email compromise scam. There was little or no evidence that the credit union had actual knowledge of the scam. But the court found that such knowledge was imputed to the credit union based on real-time alerts from its anti-money laundering system and various red flags indicating that the account was being used for fraudulent purposes.

Compromised email scam

The plaintiff in Studco was a manufacturer of commercial metal building products. A supplier informed the plaintiff that it would be sending a change in banking instructions. However, a third party, which had gained access to the plaintiff’s email system, prevented the plaintiff from receiving the legitimate email from the supplier with the new banking instructions. Instead, the third party sent the plaintiff a spoofed email, purportedly from the supplier, instructing it to direct future payments to a personal account at the defendant credit union. Neither the plaintiff nor its supplier had accounts at the credit union.

Over the next few weeks, the plaintiff made four ACH deposits — totaling $558,869 — that named its supplier as beneficiary but listed the account number for the personal account created by the scammers. The individual owner of that account quickly dispersed all the funds. Although the credit union declined to make attempted international wire transfers from the account — based on Office of Foreign Assets Control alerts — it didn’t otherwise stop activity into or out of the account.

The credit union’s computer system automatically generates warnings for ACH transactions when, as in this case, the identified payee doesn’t exactly match the name of the receiving account holder. However, the system generates “hundreds to thousands” of these warnings per day, the majority of which aren’t significant, so the credit union’s personnel doesn’t actively monitor them.

Court decision

The court said, under the Uniform Commercial Code (UCC) as adopted by Virginia, the plaintiff had the right to recover the fraudulent ACH deposits received by the credit union if it showed that the credit union “‘[knew] that the name and [account] number’ of the incoming ACHs from [the plaintiff] ‘identif[ied] different persons.’” According to the UCC, “know” means “actual knowledge,” defined as follows:

Actual knowledge of information received by the organization is effective for a particular transaction from the time it is brought to the attention of the individual conducting that transaction and, in any event, from the time it would have been brought to the individual’s attention if the organization had exercised due diligence. [Emphasis added]

The UCC further provides that an organization exercises due diligence if it “maintains reasonable routines for communicating significant information to the person conducting the transaction and there is reasonable compliance with the routines.”

In Studco, the court held that the credit union would have discovered the mismatch between the intended payee and the recipient if it had exercised due diligence. Evidence at trial showed that the credit union failed to do so. Among other things:

  • The credit union allowed the recipient to open the account even though it triggered an “ID verification warning,” stating that the system was unable to verify the address provided.
  • The credit union failed to establish a reasonable routine for monitoring suspicious activity alerts. It wasn’t reasonable to ignore those alerts because of their sheer volume. The credit union could have implemented a system to “escalate pertinent alerts of high-value transactions.”
  • It was unreasonable for the credit union to allow the deposits into the personal account, which was a new account that had a small starting balance followed by multiple high-value transactions.

The court essentially applied a “knew or should have known” standard that’s a departure from the “actual knowledge” standard used by many courts. (See “What other courts have said” on page X.) As the court explained, the credit union couldn’t “ignore their own systems to prevent fraud in order to claim that they did not have actual knowledge of said fraud.”

Stay tuned

It remains to be seen whether the Studco case is an aberration, or whether it heralds a shift in how courts view financial institutions’ responsibility to monitor ACH transactions for potential fraud. The credit union has appealed the decision to the Fourth U.S. Circuit Court of Appeals.

Sidebar: What other courts have said

Before Studco (see main article), most courts have focused on a bank’s state of knowledge at the time an ACH payment is credited to the recipient’s account. They point to language in the Uniform Commercial Code regarding misdescription of the beneficiary: “If the beneficiary’s bank does not know that the name and number refer to different persons, it may rely on the number as the proper identification of the beneficiary of the order. The beneficiary’s bank need not determine whether the name and number refer to the same person.” As the comments to this provision explain, “It is possible for the beneficiary’s bank to determine whether the name and number refer to the same person, but if a duty to make that determination is imposed on the beneficiary’s bank the benefits of automated payment are lost.”

In Shapiro v. Wells Fargo Bank, a case with similar facts to Studco, the 11th U.S. Circuit Court of Appeals found that it wasn’t unreasonable for Wells Fargo to allow its automated payment system to ignore a potential name mismatch and rely on the number as the proper identification.

© 2024


Mandatory Capitalization of R&E Expenses — Will The New Rules Impact Your Business?

Businesses that invest in research and development, particularly those in the technology industry, should be aware of a major change to the tax treatment of research and experimental (R&E) expenses. Under the 2017 Tax Cuts and Jobs Act (TCJA), R&E expenditures incurred or paid for tax years beginning after December 31, 2021, will no longer be immediately deductible for tax purposes. Instead, businesses are now required to capitalize and amortize R&E expenditures over a period of five years for research conducted within the U.S. or 15 years for research conducted in a foreign jurisdiction. The new mandatory capitalization rules also apply to software development costs, regardless of whether the software is developed for sale or license to customers or for internal use.

Tax Implications of Mandatory Capitalization Rules

Under the new mandatory capitalization rules, amortization of R&E expenditures begins from the midpoint of the taxable year in which the expenses are paid or incurred, resulting in a negative year 1 tax and cash flow impact when compared to the previous rules that allowed an immediate deduction.

For example, assume a calendar-year taxpayer incurs $50 million of U.S. R&E expenditures in 2022. Prior to the TCJA amendment, the taxpayer would have immediately deducted all $50 million on its 2022 tax return. Under the new rules, however, the taxpayer will be entitled to deduct amortization expense of $5,000,000 in 2022, calculated by dividing $50 million by five years, and then applying the midpoint convention. The example’s $45 million decrease in year 1 deductions emphasizes the magnitude of the new rules for companies that invest heavily in technology and/or software development.

The new rules present additional considerations for businesses that invest in R&E, which are discussed below.

Cost/Benefit of Offshoring R&E Activities

As noted above, R&E expenditures incurred for activities performed overseas are subject to an amortization period of 15 years, as opposed to a five-year amortization period for R&E activities carried out in the U.S. Given the prevalence of outsourcing R&E and software development activities to foreign jurisdictions, taxpayers that currently incur these costs outside the U.S. are likely to experience an even more significant impact from the new rules than their counterparts that conduct R&E activities domestically. Businesses should carefully consider the tax impacts of the longer 15-year recovery period when weighing the cost savings from shifting R&E activities overseas. Further complexities may arise if the entity that is incurring the foreign R&E expenditures is a foreign corporation owned by a U.S. taxpayer, as the new mandatory capitalization rules may also increase the U.S. taxpayer’s Global Intangible Low-taxed Income (GILTI) inclusion.

Identifying and Documenting R&E Expenditures

Unless repealed or delayed by Congress (see below), the new mandatory amortization rules apply for tax years beginning after December 31, 2021. Taxpayers with R&E activities should begin assessing what actions are necessary to identify qualifying expenditures and to ensure compliance with the new rules. Some taxpayers may be able to leverage from existing financial reporting systems or tracking procedures to identify R&E; for instance, companies may already be identifying certain types of research costs for financial reporting under ASC 730 or calculating qualifying research expenditures for purposes of the research tax credit. Companies that are not currently identifying R&E costs for other purposes may have to undertake a more robust analysis, including performing interviews with operations and financial accounting personnel and developing reasonable allocation methodologies to the extent that a particular expense (e.g., rent) relates to both R&E and non-R&E activities.

Importantly, all taxpayers with R&E expenditures, regardless of industry or size, should gather and retain contemporaneous documentation necessary for the identification and calculation of costs amortized on their tax return. This documentation can play a critical role in sustaining a more favorable tax treatment upon examination by the IRS as well as demonstrating compliance with the tax law during a future M&A due diligence process.

Impact on Financial Reporting under ASC 740

Taxpayers also need to consider the impact of the mandatory capitalization rules on their tax provisions. In general, the addback of R&E expenditures in situations where the amounts are deducted currently for financial reporting purposes will create a new deferred tax asset. Although the book/tax disparity in the treatment of R&E expenditures is viewed as a temporary difference (the R&E amounts will eventually be deducted for tax purposes), the ancillary effects of the new rules could have other tax impacts, such as on the calculation of GILTI inclusions and Foreign-Derived Intangible Income (FDII) deductions, which ordinarily give rise to permanent differences that increase or decrease a company’s effective tax rate. The U.S. valuation allowance assessment for deferred tax assets could also be impacted due to an increase in taxable income. Further, changes to both GILTI and FDII amounts should be considered in valuation allowance assessments, as such amounts are factors in forecasts of future profitability.


The new mandatory capitalization rules for R&E expenditures and resulting increase in taxable income will likely impact the computation of quarterly estimated tax payments and extension payments owed for the 2022 tax year. Even taxpayers with net operating loss carryforwards should be aware of the tax implications of the new rules, as they may find themselves utilizing more net operating losses (NOLs) than expected in 2022 and future years, or ending up in a taxable position if the deferral of the R&E expenditures is material (or if NOLs are limited under Section 382 or the TCJA). In such instances, companies may find it prudent to examine other tax planning opportunities, such as performing an R&D tax credit study or assessing their eligibility for the FDII deduction, which may help lower their overall tax liability.

Will the new rules be delayed?

The version of the Build Back Better Act that was passed by the U.S. House of Representatives in November 2021 would have delayed the effective date of the TCJA’s mandatory capitalization rules for R&E expenditures until tax years beginning after December 31, 2025. While this specific provision of the House bill enjoyed broad bipartisan support, the BBBA bill did not make it out of the Senate, and recent comments by some members of the Senate have indicated that the BBB bill is unlikely to become law in its latest form. Accordingly, as of the date of this publication, the original effective date contained in the TCJA (i.e., taxable years beginning after December 31, 2021) for the mandatory capitalization of R&E expenditures remains in place.

How We Can Help

The changes to the tax treatment of R&E expenditures can be complex. While taxpayers and tax practitioners alike remain hopeful that Congress will agree on a bill that allows for uninterrupted immediate deductibility of these expenditures, at least for now, companies must start considering the implications of the new rules as currently enacted.

Stay informed with R & E  and business information by registering for our newsletter.