Starling Bank Limited · DRN-6260702

The complaint E is a limited company and holds an account with Starling Bank Limited (Starling). One of E’s directors made a payment from this account to buy an investment on behalf of E. E now believes it was the subject of an Authorised Push Payment scam (APP Scam). At the relevant time, Starling was a signatory of a voluntary scam reimbursement code, under which it had committed to reimburse most customers who made a payment as the result of an APP Scam. E complains that Starling will not reimburse its loss. E is being represented in its complaint. For ease, I will treat any submissions from E and its representative as being one and the same and attribute them to E throughout. What happened E’s complaint concerns a Faster Payments transfer of £20,000 that it made from its Starling account on 12 December 2019. This payment was intended for an investment purporting to provide loan funding to a property development project. The specific project E was intending to invest in was the first of several which would be financed through a company I will refer to as ‘Company P’. Prior to investing, E’s director had carried out research into the offer. Amongst other things, Company P provided E with the following: • An investment memorandum document (the IM); • Professional valuation of the development scheme; • The offer of an in-person site tour. E’s director says they took up the offer of the site tour and visited the property to be developed. This site tour apparently was attended by around eight other prospective Company P investors. During the tour details of the proposed plans were discussed. All appeared as expected. Following E’s investment payment on 12 December 2019, the investment appeared to be proceeding as E had been led to expect. The investment was to pay an initial ‘return on investment’ payment, which appears to have been due in the month following E’s investment — an up-front payment of the interest due. I believe this would have equated to 11% of the capital sum, an amount of £2,200. This sum credited E’s account on 10 January 2020. However, the following year, Company P did not return E’s capital in line with the terms of the investment. Company P began providing E with a series of excuses for the delay and repeated promises the investment would soon be repaid. Subsequently though, Company P (and the associated project companies) entered administration, without any repayment being made. Ultimately, any substantive recovery of E’s investment through that administration process appears unlikely.

-- 1 of 11 --

E contacted Starling to report what had happened. At the relevant time, Starling was a signatory of the Lending Standard Board’s Contingent Reimbursement Model Code (the “CRM Code”). This was a voluntary code requiring signatory firms to reimburse victims of APP Scams in all but a limited set of circumstances. Starling looked into E’s claim but declined to make reimbursement. In its final response dated 20 December 2022, Starling said it could not evidence fraudulent activity in relation to E’s payment and so it considered this a private civil dispute. The CRM Code did not apply to private civil disputes, therefore the CRM Code did not apply to E’s payment. E referred the complaint to this service. I issued my provisional findings on the merits of this complaint in my provisional decision, dated 16 March 2026. In my provisional findings I explained why I intended to uphold the complaint in part and offered both sides the opportunity to submit further evidence or arguments in response. An extract of that decision is set out below and forms part of this final decision. As a starting point in law, Starling had a primary obligation to carry out the payment instructions it received from E’s authorised signatories. That being said, fairly and reasonably, taking into account regulators’ rules and guidance, relevant codes of practice, and what I consider to have been good industry practice at the time this payment was made, I think Starling ought to have been on the lookout for out-of- character and unusual transactions and other indications that its customer might be at risk of financial harm from fraud. It appears E’s account with Starling had been opened in August 2019, less than six months prior to the disputed payment in December 2019. So, the account history Starling had for E to compare this transaction against was relatively limited. Over that history, the payment to Company P represented the largest payment from the account over that period (by a factor of over four times) at the time it was made. Against that, however, I’d acknowledge that this was a relatively new business account set up by a limited company operating in a sector where a payment of that size might not have appeared at all unexpected. In any event, I don’t think it would affect the outcome I intend to reach even if I thought Starling ought to have identified it as a significantly out of character or unusual payment for E. I say this because in considering if Starling needed to take additional steps here (by intervening prior to processing the payment instruction) I need to consider whether any possible failure to do so likely caused the subsequent loss. Relevant factors in considering this point include the extent of the information E’s director had been provided with prior to entering into the investment, the professional and persuasive nature of that information, and the in-person site visit E’s director had attended. I think that even had Starling intervened at the time of the payment, reasonable and proportionate enquiries by the bank would not have prevented the payment from being made. I think that neither the bank nor E would have likely uncovered significantly higher than usual reasons for concern about fraud at that point. However, that is not the end of the story. Where an APP scam occurred as the result of a bank transfer, the CRM Code may provide additional protections.

-- 2 of 11 --

The CRM Code Starling’s initial response to E was that this had not been an APP Scam, rather this was a private civil dispute with Company P. As a result, the bank argued the CRM Code did not apply to E’s payment, meaning no reimbursement was due. I’ll therefore consider whether this was the correct outcome to have reached in the circumstances, or whether the CRM Code should apply. That includes considering if this is something which cannot yet be determined on the balance of probabilities. The relevant part of the CRM Code defines an APP scam as being a transfer of funds to another person for what the customer “believed were legitimate purposes but which were in fact fraudulent.” This is contrasted with a private civil dispute which the CRM code says can include: “where a Customer has paid a legitimate supplier for goods, services, or digital content but has not received them, they are defective in some way, or the Customer is otherwise dissatisfied with the supplier.” Was Company P offering a legitimate investment or were its purposes in fact fraudulent? Company P’s Joint Administrators have indicated they believe Company P’s schemes were intended to defraud investors from the outset. However, for reasons of confidentiality the Joint Administrators are unable to provide the Financial Ombudsman Service with supporting evidence to establish whether this would meet the CRM code’s criteria of an APP scam rather than a private civil dispute. The police arrested the de jure director of Company P in 2022. Although the police have since said that they believe a crime was committed against investors, they have now closed their investigation into the matter without any charges being brought. No further information has been made available as to the nature of that alleged crime. However, the material obtained by the police was shared with the director’s trustees in bankruptcy, and they in turn have been able to share this information in so far as it concerns the activities of Company P and those involved in its operations. Given the number of complaints made concerning payments to Company P, an example complaint was decided to set out the key considerations and analysis of the new evidence we have obtained. A final decision on that example complaint was issued on 17 October 2025 (and has been published in redacted form on our website). That decision details the key elements of the new evidence with an analysis as it pertains to the claim of APP scam.1 I understand that last month (in relation to another customer’s complaint) Starling confirmed to one of our Investigators that it does not intend to reimburse APP scam claims concerning Company P. I do not intend to repeat the detailed analysis set out at length in the example decision here, given that Starling has already had the opportunity to consider the same when industry became aware of the decision issued on the example complaint (as well as 1 That decision is available here https://www.financial-ombudsman.org.uk/decision/DRN- 5814892.pdf.

-- 3 of 11 --

later when it was directly sent a copy of final decision and asked by one of our Investigators as to its position on other affected complaints, in February 2026). The same analysis of the investment scheme offered by Company P on the example complaint applies to the investment made by E. E’s investment was being made in the same development and at around the same time. That example decision detailed the reasons why I considered Company P’s scheme to be an APP scam covered by the CRM Code. I will recap, in summary, why I have reached that same finding in E’s complaint. Was Company P operating an APP scam? In short, the evidence I have seen leads me to find that the investment being offered by Company P was fraudulent in nature and Company P induced investment through dishonest deception. That included the following five key misrepresentations made to E (and to other investors): 1. The identity of the person controlling Company P. Company P represented in information given to investors (including the IM) that it was run by the de jure director, as its CEO. However, multiple emails, dating from the time that Company P was being set up and afterwards, indicate instead that the person with dominant control over the company was another individual who I’ll refer to as Person J. Person J headed an eight-member board and had control of the company. Person J’s involvement was hidden from investors. Emails in the new evidence indicate this was deliberate and because of Person J’s links to previous fraudulent and failed investments. The companies he’d previously been involved with are a group currently under investigation by the Serious Fraud Office, and a company through which a fraudulent US based investment scheme was promoted to investors. The latter company has been described in the Times as a “notorious Marbella-based boiler room2”. Person J has since pleaded guilty to his role in the US investment scheme (following his extradition from Spain to the US in late 2022). In that investment scheme, the identity of the CEO was misrepresented to investors (because the real CEO was associated with previous fraudulent investments in the UK). This fraudulent deception about the control of the company was necessary (otherwise no-one would have 2 ‘Boiler room’ typically refers to high-pressure sales teams selling investments, including (but not limited to) fraudulent schemes. Such ‘boiler rooms’ are typically based outside the UK. General consumer fraud prevention information relating to ‘boiler room’ scams is available here: Boiler room fraud | Action Fraud and on this page: Boiler room scams | FCA. The FCA’s website says “Share and bond scams are often run from 'boiler rooms' where fraudsters cold-call investors offering them worthless, overpriced or even non-existent shares or bonds. Boiler rooms use increasingly sophisticated tactics to approach investors, offering to buy or sell shares in a way that will bring a huge return. But victims are often left out of pocket — sometimes losing all of their savings or even their family home. Even experienced investors have been caught out, with the biggest individual loss recorded by the police being £6m”. In reported court transcripts from the trial of the US company’s founder, owner, and controlling mind, he was questioned about ‘boiler rooms’ he had been involved with. He was asked whether investors had generally received their projected returns — to which he replied that generally they did not. When asked what happened to investors’ money generally, he replied that generally they lost their money. This was the scheme for which Person J was extradited from Spain in 2022 and has led to his now serving a prison sentence in the US.

-- 4 of 11 --

invested). It appears the same applied to Company P and the investment schemes it offered. In short then, I find this was a dishonest deception which was intended to (and did) lead private investors to invest where they otherwise would not have done so. 2. The existence of a £1m equity buffer to protect private investors. The IM (as received by E’s director prior to E’s investment) stated that £1m of equity capital had been put in place by Company P and the developer. This would mean the company and developer were in a position of first loss were the project to fall short of the projected returns — offering protection for private investors. The Joint Administrators say they’ve found no evidence of that equity being introduced. I have seen messages sent by the de jure director in which he essentially admits that the equity didn’t exist and that he (and Person J) knew this was a falsehood from the outset. It appears intended to provide false reassurance to investors. In summary, I find the promised equity most likely wasn’t put in place, and that this was a knowing and deliberate misrepresentation by Company P designed to induce private investors such as E to invest where otherwise they may have decided not to proceed. 3. The misrepresentation of Company P’s costs, specifically its need to pay substantial commissions on investment funds raised. The IM said no arrangement fees were associated with the investment. It listed a ‘Total Development Cost’ of £10m. That total development cost figure did include something labelled ‘Finance Costs’ (a figure matching what appears to be the true cost of the senior lender finance as later shown in management accounts). But the figures don’t include the cost of capital raised from investors such as E. Those costs were ‘commission payments’ and other fees to be paid to connected parties. Company P’s management accounts show around 12% commission was being paid on the amount raised from private investors. These also show a significant sum being paid as a fee to the director of the developer company. In email discussions between those running Company P prior to the IM being issued, they acknowledge that “we will not get away with £600K in fees being brought above the profit line into the deal.” and “If [these numbers are] presented to investors […] the deal does not work”. Further fees are discussed by those controlling Company P, in the region of £650,000 per board member (for eight board members, that would equate to over £5m). These appear to have been paid via a company based in Marbella (operating in the same office as Person J’s company) and then routed to companies owned by the various board members of Company P. 4. A significant over-raise of funds. The IM gave a figure of £1.2m for the amount to be raised from private investors. In reality, a multiple of that amount was raised (and needed to be) for the redevelopment work to be completed. This was a necessary corollary of the additional costs resulting from the commission/fee payments, and the missing equity. The cost of capital attached to all funds Company P raised from private investors was paid out upfront. For this development much of this cost was paid out before the site

-- 5 of 11 --

had been purchased or the work started. This accounted for an average of 25% of the sum raised. That meant an even larger sum needed to be raised to cover the necessary cashflow (given this all happened before any money was made from the underlying business). As a consequence, the eventual total raised from private investors for the first development appears to have reached a total of around £7.5m (compared to the £1.2m figure given in the IM). Given the additional costs were known to Company P in advance (evidenced by comments in the new evidence) it seems almost certain that the need to raise significantly more than was stated in the IM was apparent to Company P from before the point the IM was issued on Company P’s behalf. This was most likely a fraudulent misrepresentation. 5. The likelihood of investors being repaid by Company P. The IM gives a finished value of the project of just under £12m (a figure referred to as the GDV). Allowing for the ‘Total Development Cost’ figure of £10m given in the IM, this GDV results in a stated target development profit of approximately £2m. The IM figures show a raise of around £1.2m from private investors, with approximately £7m from senior debt. But with £7m drawn down from senior debt, and an actual raise of £7.5m from private investors, it is obvious that the GDV of just £12m (even without allowing for any costs) could never be sufficient for Company P to repay its lenders. The total costs, including the additional hidden costs of commissions and fees to connected parties, were always going to be significantly higher than the GDV of the project — it could never have been profitable. This was misrepresented to investors in the IM. As those controlling Company P noted in internal emails prior to the IM, giving investors the true picture would have made it apparent that the ‘deal did not work’. The emails between those on Company P’s board indicate that a significant over-raise from private investors was always their plan. A higher raise of funds from private investors meant higher commissions and fees that would be removed (via a Spanish company run by the same people). In short, the only possible outcome of the way Company P was set up was that it would fail and enter administration. The board appear to have planned for this from the outset and, leading up to the administration, were able to remove most of the value of the residual assets by acquiring new priority debt (for which they appear to have received commission income). Summary of the various misrepresentations and the intent behind them To summarise then, Company P made several key misrepresentations which were false and known to be false at the time Company P permitted them to be made. Company P misrepresented who controlled it in order to hide from investors that it was actually controlled by a man whose previous business activities had proved disastrous for investors (in connection with some of those previous activities, Person J has since pleaded guilty to criminal fraud charges and is now serving a prison term). In relation to the investments offered by Company P, the true financial details (in particular the money that Company P planned to extract as commissions and director

-- 6 of 11 --

remunerations) were withheld from investors because no-one would have invested knowing it could never return a profit let alone be able to repay their original capital. Is this a Private Civil Dispute? In assessing the fair answer to this case, I have given very careful consideration to the arguments and evidence available which might support the alternative to this having been an APP scam covered by the CRM Code. In other words, that which might support a finding that this was a failed investment in a legitimate entity and at most a private civil dispute. The property site that was proposed to be developed was in fact developed, and then successfully sold. This is not typical for a criminal scam. If the aim was simply to steal investors’ money, anything that acted counter to that aim might be seen as pointing to an alternative explanation. Paying for the site and paying for the developer to actually develop the property might fall into that category. Other similar arguments for the legitimacy of the investment might point to the repayment of the earliest investors, or the payment of upfront returns on the investment (the early ‘interest’ payment on investors’ loans). Both actions would have seemingly reduced the financial gains available to a scammer. But I am not convinced that these arguments demonstrate this was not an APP scam or that the scam was not planned from the outset. The type of scam commonly referred to as a ‘Ponzi scheme’ is one that is well known. In such a scheme, money from investors is used to repay earlier investors, or used to pay returns that are not justified by profits earned on the underlying investment. Looking at the evidence here, I find that the explanation of this having been designed to keep the scam convincing and running for longer (and hence to produce a greater cumulative ‘profit’ for the scammers) is the most persuasive. That accords with the unusual upfront returns that were paid. In addition, it strikes me that, by disguising the outward appearance of the underlying fraudulent scheme, this mechanism may well benefit those responsible by making their later prosecution a far less straightforward matter than would be the case for a simple theft. The comments of those behind Company P support the finding that this was most likely set up as a deliberate Ponzi scheme. In many cases these comments reflect an aim of rolling over the investments of investors into follow-on investments — either in the same ongoing development or in later schemes. By maintaining an appearance that the projects were progressing as expected and securing agreement to reinvest, this could mean there would be no need to repay those investors’ capital at the maturity of their investment — it could remain (nominally at least) in an investment with Company P, delaying the inevitable collapse of the scheme, and allowing the scheme to continue to attract new investors (as indeed appears to have happened). As summarised above, the evidence persuades me that the investment scheme offered by Company P was, from the outset, created with the intent of deceiving investors about the financial structure and control of the property development. This was designed by those covertly in charge of Company P in such a way as was (and as must have been known to Company P from the very beginning) likely to leave the retail investors unprotected against its inevitable collapse into insolvency. The scheme was misrepresented in order to induce E (and others) to invest. I accept that in reviewing these and other comments of those involved in Company P, I cannot know what the precise intent of the authors was. Nor can I have certainty about

-- 7 of 11 --

my interpretation of those comments. But I am required to reach what I consider to be a fair and reasonable outcome in all the circumstances, given the evidence available to me and applying the balance of probabilities where there is doubt about an issue of fact. I am satisfied that there is sufficient for me to reach a fair and reasonable finding here. The wider context within which individual comments sit, including the comments of those involved in Company P, provides a clearer route to interpreting individual comments and renders the meaning less subjective. Reviewing the evidence and individual comments together has allowed me, applying the balance of probabilities (but conscious that I should not find anyone to have been dishonest unless there is cogent evidence to support such a finding) to reach what I consider to be a sufficiently reliable interpretation to make a finding on the intentions of those behind the investment scheme. And the outcome I propose to reach is one I consider to be consistent with that interpretation. I have also taken into account that the police state they are no longer pursuing their investigation or bringing criminal charges against the de jure director of Company P. I don’t consider this changes matters. A criminal prosecution may not be pursued for various different reasons which have no bearing on whether or not something was an APP Scam as defined by the CRM Code. The police consider that investors were the victims of a crime here, and have said nothing to suggest the contrary. That accords with my findings (made on the balance of probabilities). And I have found that the de jure director was not the controlling mind of Company P, that being instead Person J — already serving a prison term in the USA for investment fraud. Should E now be reimbursed by Starling under the terms of the CRM Code? In summary, while I’ve carefully assessed the alternative explanations or scenarios, applying the balance of probabilities I consider this was an APP scam, and that E’s payment is covered by the CRM Code. The CRM Code requires reimbursement of the victims of APP scams in all but a limited set of circumstances. I have considered whether any of the exceptions to full reimbursement under the CRM Code could now fairly be relied on by Starling. The exceptions I consider could be of possible relevance in this case are that 1) The Customer ignored an Effective Warning; 2) The Customer made the payment without a reasonable basis for believing that they were paying for genuine services from a legitimate business; 3) Where the Customer is a Micro-enterprise it did not follow its own internal procedures for approval of payments, and those procedures would have been effective in preventing the APP scam. 4) The Customer was grossly negligent. In relation to the first of these, I have seen nothing to suggest that Starling provided E with an Effective Warning (as defined in the CRM Code). So, I don’t think Starling can rely on this exception. And I do not consider that Starling has established that E (or E’s director) made the payment without holding a reasonable basis for believing the various points listed in the CRM Code at R2(1)c. E’s payment was made to the person E was expecting to pay (Company P). I’m satisfied that E’s director had carried out reasonable checks into the purported investment opportunity prior to making the payment and so held a reasonable basis for believing that E was making the payment for a genuine investment with a

-- 8 of 11 --

legitimate business. This was a scheme that those behind Company P had expended considerable effort on making appear legitimate, and I don’t think E (or indeed Starling) could reasonably have uncovered its fraudulent nature at the time of the payment. Starling has shown nothing to evidence that E failed to follow its own internal processes or that a failure on E’s part to do so was material in the success of the APP scam. Turning to the fourth exception I consider that would require Starling to establish that E had shown a very significant degree of carelessness — beyond that of ordinary negligence. Starling has not done so, and I have seen nothing that I think could establish a finding of gross negligence on E’s (or E’s director’s) part. In short, I do not find Starling could rely on these (or any other) exceptions to full reimbursement under the CRM Code. As a result, I am currently of the opinion that Starling should fairly and reasonably reimburse E for the amount it has lost, under the terms of the CRM Code. Putting matters right E’s payment amounted to a total sum of £20,000. It seems E received an early return of money by Company P (the early interest payment of £2,200) which would have had the effect of reducing the financial loss incurred. I think it would be fair for Starling to offset that return against the reimbursable loss. If there were any other sums received by E in relation to the payment it made to Company P (besides the £2,200 sum that appears to have been paid out as an early return on the investment) then E should detail any such amounts he received in response to this provisional decision in order that Starling can accurately calculate the net amount of E’s loss. Assuming however the only such returns or recovered funds are the £2,200 sum received by E in January 2020, then the net loss to be reimbursed would be £17,800. Given the complexity of this investment scheme, and the considerable challenges and time expended before evidence could be obtained to show this had indeed been an APP scam, I don’t consider Starling could reasonably have reached that finding sooner than the decision issued on the example complaint — and the corresponding awareness by industry that this had most likely been an APP scam. The final decision on that example complaint was issued on Friday 17 October 2025. With the above in mind, I intend to award interest calculated from that date. I think a fair reflection of the cost to E of being deprived of these funds for that period would be for Starling to add interest at the rate of 8% simple per year. That rate is one I consider provides a reasonable reflection of E being deprived of that money for the relevant period. Other routes to recover funds and the possibility of double-recovery In its most recent report on Companies House, the Joint Administrators indicate that they anticipate being able to distribute only a small proportion of funds owed to unsecured creditors such as E. Given what they indicate in this report, it appears unlikely to me that the conclusion of Company P’s insolvency process will result in substantive repayment of the monies

-- 9 of 11 --

owed to unsecured creditors such as E. It appears possible however, that even if proportionately small, some monies may be returned to E through that route. It also seems not inconceivable that some funds might also be recovered to E through other routes, such as through a prosecuting authority later recovering assets for investor-victims. It would not be fair or equitable for me to put E in a position of double recovery. In saying that, I don’t consider this possibility prevents Starling from reimbursing E under the CRM Code now. However, I consider it is fair and reasonable that Starling can choose, if it wishes, to obtain an undertaking from E to entitle it to any money recoverable elsewhere from E’s investment in Company P. In other words, Starling may require E to enter into an undertaking to assign to the bank the rights to any monies E might elsewhere be entitled to recover in respect of its investment of £20,000 into Company P. If Starling asks E to provide such an undertaking, payment of the reimbursement I intend to award may be dependent upon provision of that undertaking. Starling may wish to treat E’s formal acceptance of the terms of my final decision as being sufficient for this purpose. Alternately, Starling would need to meet any costs in drawing up an undertaking of this type. If Starling elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to E for its consideration and agreement. I invited both sides to provide any further arguments or information by 27 March 2026, after which point, I said I intended to issue my final decision on the matter. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant law and regulations, regulators’ rules, guidance and standards, codes of practice; and, where appropriate, what I consider to be good industry practice at the time. Where the evidence is incomplete or missing, I make my findings based on the balance of probabilities — in other words what I consider is most likely given the information available to me. Responses to my provisional decision Starling and E were both sent my provisional decision on the same date, 16 March 2026. Starling acknowledged receipt but did not respond apart from this, nor did it ask me for additional time to do so. E has not responded or requested additional time to do so. As neither side has provided any new information or evidence, or disagreed with my provisional decision, I see no reason to depart from my provisional findings. I consider the fair and reasonable outcome remains the outcome that I reached in those provisional findings and for the same reasons.

-- 10 of 11 --

Putting things right For the reasons set out in my provisional decision, as set out above, I find it fair and reasonable in all the circumstances that E ought to have been fully refunded for its net loss from this payment under the CRM Code. I therefore direct Starling Bank Limited to pay E within 28 days of receiving notification of its acceptance of my final decision: • the net amount lost through E’s payment to this scam, that being the sum of £17,800; plus, • interest on that amount at the simple rate of 8% per year (less any tax properly deductible) to be calculated from 17 October 2025 until the date of settlement. I consider it is fair and reasonable that Starling can choose, if it wishes, to obtain an undertaking from E to entitle it to any money recoverable elsewhere from the investment in Company P. In other words, Starling may require E to enter into an undertaking to assign to the bank the rights to any monies it might elsewhere be entitled to recover in respect of its payment of £20,000 to Company P. If Starling asks E to provide such an undertaking, payment of the reimbursement I am awarding may be dependent upon provision of that undertaking. Starling may wish to treat E’s formal acceptance of the terms of my final decision as being sufficient for this purpose. Alternately, Starling would need to meet any costs in drawing up an undertaking of this type. If Starling elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to E for its consideration and agreement. My final decision For the reasons given above, I uphold this complaint in part and require Starling Bank Limited to put matters right as I have detailed above. Under the rules of the Financial Ombudsman Service, I’m required to ask E to accept or reject my decision before 27 April 2026. Stephen Dickie Ombudsman

-- 11 of 11 --