Custodians and exchanges

Read the PDF edition (2 pages)

Concurrent duties and the limits of the terms

A custodian owes its customer contractual duties under the custody agreement. It also owes a concurrent duty in tort to take reasonable care of the assets, since the relationship is one of assumption of responsibility and reliance.¹ The tort claim is useful to the customer in three ways. It may be governed by Singapore law and heard in Singapore even where the contract selects foreign law and arbitration, if the tort was committed in Singapore. It may escape a limitation of liability clause that by its terms covers only contractual claims. And it may lie against a Singapore operating company that performs the custody while the contract is with an offshore shell. The custodian's defence is that the contract defines the scope of the duty and that the exclusion clauses apply to tort as well. Whether they do is a matter of construction. The Unfair Contract Terms Act 1977 applies to exclusions of negligence liability however the claim is framed.²

The standard of care after a hack

The standard is that of a reasonably competent custodian of digital assets. What that means in 2026 is informed by the MAS Technology Risk Management Guidelines, which require licensed financial institutions to maintain cyber hygiene, segregate hot and cold storage, implement multi-party controls over keys, and conduct penetration testing and incident response planning.³ The Guidelines do not create a private cause of action, but a court will treat them as evidence of the standard a reasonable custodian meets. A custodian that kept 40 per cent of customer assets in a single hot wallet secured by one key held by one employee has fallen below that standard, whatever its terms say. A custodian that lost assets to a novel exploit of a widely used wallet library, despite following the Guidelines, has probably not.

Causation and loss follow. The customer must show that the breach caused the loss, which in a hack case usually requires expert evidence on how the attacker gained access. Loss is measured by the value of the assets at the date of judgment, on the same reasoning as applies to equitable compensation, though a defendant will argue for the date of loss.⁴ Contributory negligence is available where the customer's own conduct contributed, for instance by reusing a compromised password or approving a malicious transaction. The court then apportions under the Contributory Negligence and Personal Injuries Act 1953.⁵

Authorised push payment fraud

A different question arises where the customer herself instructs the platform to transfer assets to a fraudster. Under English law a bank that executes a customer's genuine instruction owes no duty to protect the customer from her own decision, as the UK Supreme Court confirmed in Philipp v Barclays.⁶ The Quincecare duty, which requires a bank to refrain from executing an instruction given by an agent where it has reasonable grounds to believe the agent is defrauding the customer, has been recognised in Singapore.⁷ A Singapore exchange that processes a retail customer's withdrawal to an address flagged by its own analytics as a known scam address occupies an intermediate position. The MAS business-conduct rules require risk warnings and, for some licensees, transaction monitoring. A court applying Spandeck may find sufficient proximity for a duty to warn where the platform had actual knowledge that the destination was a scam. No Singapore decision has yet gone that far.

Notes

1. Henderson v Merrett Syndicates Ltd [1995] 2 AC 145 (HL), accepted in Singapore as establishing concurrent liability in contract and tort, for example in Go Dante Yap v Bank Austria Creditanstalt AG [2011] SGCA 39 at [20]–[36]. ↩
2. Unfair Contract Terms Act 1977, ss 1(1) and 2 (negligence includes breach of a contractual duty of care and of the common-law duty). ↩
3. MAS, Technology Risk Management Guidelines (January 2021), in particular the sections on cyber security operations and system security. Part K, Chapter II and Part L, Chapter VII describe their regulatory application. ↩
4. The date of assessment for damages in negligence is ordinarily the date of breach, with departures where justice requires. See Dodd Properties (Kent) Ltd v Canterbury City Council [1980] 1 WLR 433 (CA), applied in Singapore. ↩
5. Contributory Negligence and Personal Injuries Act 1953, s 3. ↩
6. Philipp v Barclays Bank UK plc [2023] UKSC 25 at [97]–[100], confining the Quincecare duty to cases where the instruction comes from an agent and the bank has reasonable grounds to suspect fraud. ↩
7. Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, recognised in Singapore in Major Shipping & Trading Inc v Standard Chartered Bank (Singapore) Ltd [2018] SGHC 4. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.