USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 1 of 27
[PUBLISH]
In the
United States Court of Appeals
For the Eleventh Circuit
____________________
No. 21-11763
____________________
JESUS ALONSO ALVAREZ RODRIGUEZ,
ALIXON LOURDES COLOMBO DE ALVAREZ,
MARIANA ALVAREZ COLOMBO,
INVERSIONES LA MARIANA C.A.,
ACCD, C.A.,
ALVAREZ & PARILLI DESPACHO DE ABOGADOS,
Plaintiffs-Appellants,
versus
BRANCH BANKING & TRUST COMPANY,
STARCHEM LLC,
GUILLERMO GAMBOA,
Defendants-Appellees,
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 2 of 27
2 Opinion of the Court 21-11763
BANK OF AMERICA CORPORATION,
Defendant.
____________________
Appeal from the United States District Court
for the Southern District of Florida
D.C. Docket No. 1:19-cv-25191-KMM
____________________
Before JORDAN, ROSENBAUM, Circuit Judges, and SCHLESINGER,*
District Judge.
ROSENBAUM, Circuit Judge:
Jesus Alvarez Rodriguez, Alixon Colombo, their daughters,
and their companies (the “Appellants”) lost over $850,000 when an
alleged BB&T employee and a co-conspirator impersonated them,
changed their passwords, and transferred the money out of their
BB&T bank accounts.
The Appellants sued BB&T and the thieves asserting con-
tract and tort claims as well as a Florida-law statutory demand for
* The Honorable Harvey E. Schlesinger, United States District Judge for the
Middle District of Florida, sitting by designation.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 3 of 27
21-11763 Opinion of the Court 3
repayment. 1 The district court dismissed the tort claims as dupli-
cative of the contract claim.
At summary judgment, the district court found for BB&T
on the contract claim because none of the duties the Appellants
claimed were breached were part of the contract. As to the statu-
tory demand for repayment, the district court concluded that the
Appellants’ demand was time-barred because BB&T’s standard
bank account contract limited the time to assert a demand from the
statutory one-year period to just 30 days. In the alternative, the
district court entered summary judgment for BB&T because it con-
cluded the bank had and had followed commercially reasonable se-
curity procedures.
While this case was on appeal, BB&T produced discovery
that, the Appellants say, could make a difference in this case. After
a thorough review of the record and with the benefit of oral argu-
ment, we vacate both (1) the district court’s order dismissing the
Third Amended Complaint and (2) the district court’s order enter-
ing summary judgment for BB&T on the remaining counts in the
Fourth Amended Complaint. We decide as a matter of law that
the Appellants’ claim for statutory repayment is not time-barred.
And we remand for further proceedings consistent with this opin-
ion.
1 Florida law generally requires banks to refund customers for fraudulent wire
transfers unless the wire transfer is verified as the customer’s.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 4 of 27
4 Opinion of the Court 21-11763
I. FACTUAL BACKGROUND AND PROCEDURAL
HISTORY
Because we are reviewing the district court’s summary-judg-
ment order, we present the evidentiary background in the light
most favorable to the Appellants. St. Charles Foods, Inc. v. Amer-
ica’s Favorite Chicken Co.,
198 F.3d 815, 819 (11th Cir. 2020). The
actual facts may or may not be as set forth in this opinion.
A. The Plaintiffs
The Appellants are Venezuelan citizens who live in Venezuela.
Between 2012 and 2015, they opened personal and commercial
bank accounts at a Florida branch of BB&T. The commercial bank
accounts were governed by the Commercial Bank Services agree-
ment (“CBSA”). The 2012 version 2 of the CBSA required the Ap-
pellants to notify BB&T within 30 days of any unauthorized trans-
action from the account. It also required that, if the Appellants did
not receive a monthly bank statement, they would notify BB&T
within 10 days of the regular statement date.
In addition, Colombo executed, on behalf of Inversiones—a
co-plaintiff and a company owned by the family—a document en-
titled the 2013 Treasury Management Agreement (the “TMA”).
The TMA incorporated the 2012 CBSA. The TMA required the
2 This is the version that was in effect at the time of the events at issue and
which the district court analyzed (without objection on appeal) at summary
judgment.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 5 of 27
21-11763 Opinion of the Court 5
Appellants to examine every bank statement and to notify BB&T
of any unauthorized transfers within 30 days of the statement date.
As a security measure to prevent unauthorized wire trans-
fers, Inversiones and BB&T agreed to use the “CashManager
Online” system. The CMOL system was a security protocol. It (1)
required Inversiones to change its password every 30 days; (2) is-
sued Inversiones a physical security token that created a one-time
passcode to use to log in, as a type of dual-factor authentication;
and (3) sent event notifications to alert Inversiones of “potentially
suspicious” activity—like a password change.
On July 11, 2016, a BB&T employee named Giancarlo
Paredes changed the email account associated with the ten bank
accounts from Colombo’s email to a new (fraudulent) email.
Within a month, on August 10, an unknown person called BB&T
and spoke with BB&T agent Juan Carlos Martinez. Martinez re-
membered that the caller answered the two security questions—
designed to ensure that the caller was the owner of the account—
correctly but didn’t recall which questions he asked. The next day,
an unknown person (maybe the same, maybe a different person)
emailed BB&T from the fraudulent email account and asked to set
up a CashManager Online token. Martinez responded with the
necessary forms to complete.
The next day, the same fraudulent email sent the completed
forms back. Martinez forwarded the forms to another BB&T em-
ployee, Luis Avina. Avina compared the signatures on the forms
to a 2013 Inversiones corporate resolution on file: the signatures
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 6 of 27
6 Opinion of the Court 21-11763
matched. Avina then sent the forms to another BB&T employee
who also confirmed that the signatures matched. Given the correct
answers to the security questions and the matching signatures,
BB&T sent a CashManager Online token to the Miami address
listed on the form. Sometime during July and August 2016, the
bank account password was changed, and Colombo could no
longer access the bank accounts.
Then, between August 2016 and November 2016, about
$850,000 was transferred out of Inversiones’s bank account with
BB&T to a company called “Starchem LLC.” Before BB&T exe-
cuted the first wire transfer—for $100,000—BB&T called the
phone number newly associated with the account, and the person
who answered the phone identified herself as Colombo. So BB&T
marked the transfer as non-fraudulent.
In the meantime, locked out of their accounts, the Appel-
lants called BB&T from Venezuela “many times” in August, Sep-
tember, and October 2016. But reaching a person was a struggle.
They couldn’t leave messages because, in Venezuela, they had to
use an operator to call the United States and if BB&T didn’t pick
up, the operator would just hang up. They also sent emails but
“[it] was very difficult to get a reply to an email.” Finally, in early
January 2017, when the Appellants were in Panama, they were able
to call BB&T directly, and they left “infinite messages.” 3 By May
3 BB&T’s first record that the transactions were reported as fraudulent is dated
May 17, 2017. As we have mentioned, though, at summary judgment, we
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 7 of 27
21-11763 Opinion of the Court 7
2017, the Appellants had regained access to their bank accounts and
discovered the stolen money.
B. Procedural History
The Appellants sued BB&T4 for a variety of statutory, con-
tract, and tort claims. As for the tort claims, the district court dis-
missed them as duplicative of the breach-of-contract claim.
In the operative pleading, the Fourth Amended Complaint,
the Appellants asserted four claims against BB&T. As relevant
here, the Appellants claimed that BB&T was required to refund
them for the fraudulent wire transfers under Florida Statutes
§ 670.202. 5
The parties cross-moved for summary judgment. On the
statutory repayment claim, BB&T argued that only Inversiones
view the evidence in the light most favorable to the non-moving party, here,
the Appellants. See B&G Enters., Ltd. v. United States,
220 F.3d 1318, 1322
(11th Cir. 2000).
4 The Appellants also asserted claims against Starchem, LLC, and Starchem’s
sole manager, Vincent Gamboa, but dismissed those claims without prejudice
before the district court entered final judgment. The Appellants didn’t ad-
vance any claims against Giancarlo Paredes, the man who allegedly changed
the Appellants’ password.
5 The Fourth Amended Complaint had three other counts. First, the Appel-
lants said that BB&T breached the CBSA and TMA. Second, they asserted that
BB&T had violated Regulation J,
12 C.F.R. § 210.25—which governed wire
transfers over the Fedwire Funds Service—by allowing the fraudulent wire
transfers. And third, the Appellants sought a declaratory judgment that BB&T
had breached the contract.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 8 of 27
8 Opinion of the Court 21-11763
could state a claim because only its account was impacted. But,
BB&T said, Inversiones’s claims were time-barred because the
2013 TMA required Inversiones to notify BB&T about fraudulent
transactions within 30 days of the statement date, and Inversiones
had failed to do so. On the merits, BB&T argued that it had (1)
established commercially reasonable procedures and (2) followed
those procedures, so it was not liable for any unauthorized trans-
actions. BB&T contended that only the security procedures listed
in the CashManager Online documents could be a predicate for li-
ability. The pre-wire transfer steps, BB&T said, like changing the
email, sending the forms, and sending the CashManager Online to-
ken were not part of the security procedures. BB&T claimed that
the agreed-upon procedures were reasonable and that the Appel-
lants hadn’t explained what the heightened procedures should have
been. In support of its summary-judgment motion, BB&T in-
cluded an expert report on the commercial reasonableness of its
procedures.
The Appellants responded that they all had standing to sue
because the money had gone from the individual accounts to In-
versiones’s account and then out to Starchem. As to timing, the
Appellants said that the Florida Statutes provided a one-year time-
period to notify a bank of an unauthorized wire transfer and further
provided that the time-period could not be modified by agreement.
On the merits, the Appellants contended that because they lived
abroad and used the bank accounts only sparingly, BB&T should
have designated those accounts as “higher risk” and applied stricter
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 9 of 27
21-11763 Opinion of the Court 9
anti-fraud controls. Like BB&T, the Appellants also included an
expert report in support of their argument—only the Appellants’
expert opined that BB&T’s procedures weren’t commercially rea-
sonable. And, the Appellants said, BB&T hadn’t complied with its
own procedures because it failed to require in-person authentica-
tion.
BB&T moved to strike the Appellants’ expert witness report
as a discovery sanction for not disclosing it. It later moved to ex-
clude the expert from testifying at trial.
The district court entered summary judgment for BB&T on
all four counts. As to the Appellants’ statutory repayment claim,
the district court concluded that the one-year period was modifia-
ble and that the parties had modified it. On the merits, the district
court decided as a matter of law that BB&T’s procedures were
commercially reasonable and that BB&T had followed them in
good faith. Therefore, the district court concluded, BB&T wasn’t
liable to the Appellants to repay the wire transfers. The district
court denied BB&T’s motion to strike the Appellants’ expert wit-
ness as moot.
The Appellants appealed.
C. Post Judgment Motions
BB&T moved in this court for an extension of time to file its
responsive brief on appeal, explaining that it had found documents
relevant to the case. In response, the Appellants moved for relief
from the judgment under Rule 60, Fed. R. Civ. P., in the district
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 10 of 27
10 Opinion of the Court 21-11763
court and asked the district court to order production of the docu-
ments. The district court denied the motion without prejudice in
the event of a limited remand.
II. STANDARD OF REVIEW
We review the grant or denial of summary judgment de
novo. St. Charles Foods, Inc., 198 F.3d at 819. As we have noted,
we must view all evidence and all factual inferences reasonably
drawn from the evidence in the light most favorable to the non-
moving party. Id.
III. ANALYSIS
Ideally, we would resolve all the factual and legal issues in a
single appeal to preserve “the historic federal policy against piece-
meal appeals.” Sears, Roebuck & Co. v. Mackey,
351 U.S. 427, 438
(1956). But because the late-breaking discovery implicates factual
issues related to the contractual, tort, and statutory repayment
claims, we resolve only a single legal issue and then vacate and re-
mand the rest of the case to the district court for discovery, replead-
ing, and further litigation.
The only issue that we decide is a question of pure law:
whether the one-year period to make a demand for a refund of a
fraudulent wire transfer under Florida Statutes § 670.202 may be
modified by the parties. We hold that the parties may not modify
that period by agreement.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 11 of 27
21-11763 Opinion of the Court 11
A. The Time to Demand Repayment in § 670.202 May Not Be
Modified by Agreement
Before we get to the actual arguments, we need to first lay
out the statutory framework. Florida adopted portions of the Uni-
form Commercial Code to “predict risk with certainty, to insure
risk with certainty, to adjust operational and security procedures,
and to price funds transfer services appropriately.” Corfan Banco
Asuncion Paraguay v. Ocean Bank,
715 So. 2d 967, 970 (Fla. Dist.
Ct. App. 1998) (citation omitted). In particular, in drafting Article
4A—which governs “funds transfers” and is at issue here—the
drafters made “a deliberate decision . . . to write on a clean slate
and to treat a funds transfer as a unique method of payment to be
governed by unique rules that address the particular issues raised
by this method of payment.” FLA. STAT. § 670.102 cmt. “[G]iven
the very large amounts of money that are involved in funds trans-
fers,” the drafters wrote, this was particularly important. Id.
A “funds transfer” occurs when a bank customer instructs
her bank—also known as a “receiving bank” because the bank re-
ceives the instruction—to send money to a second person’s bank
account. Id. § 670.104. The second bank is the “beneficiary’s
bank,” and this direction is called a “payment order.” Id. §§
670.103, 670.104. If the customer has more money in her bank ac-
count than is being transferred, then “payment” occurs—and hap-
pens immediately—when the receiving bank “debits” the money
from the originator’s account and the beneficiary’s bank “credits”
the money to the beneficiary’s account. Id. § 670.403(1)(c) (“If the
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 12 of 27
12 Opinion of the Court 21-11763
receiving bank debits an account of the sender with the receiving
bank, payment occurs when the debit is made to the extent the
debit is covered by a withdrawable credit balance in the account.”).
When a receiving bank—really, the paying bank—receives a
payment order, it must determine whether the payment is “veri-
fied.” Id. § 670.204(1). 6 The bank and the customer may agree
beforehand to security procedures to verify the authenticity of pay-
ment orders. Id. § 670.202(2). If (1) the bank and the customer
agree on a security procedure, (2) the security procedure is “com-
mercially reasonable,” and (3) the bank can prove it followed the
security procedures in good faith, then payment order is “effective
as the order of the customer, whether or not authorized.” Id. The
term “commercially reasonable” is one we will return to later in
our discussion.
If a bank accepts a payment order that isn’t verified, then the
bank “shall refund any payment” and “shall pay interest on the re-
fundable amount.” Id. § 670.204(1). There is a penalty for failing
to timely report a fraudulent transfer, though: the customer isn’t
entitled to the interest if the customer failed to exercise ordinary
care and to notify the bank of the fraudulent transfer within a rea-
sonable time that cannot exceed 90 days. Id. Florida provides that
6 A payment order can also be “authorized.” Id. § 670.202(1). “Authorized”
payment orders aren’t relevant to this case because the parties don’t dispute
on appeal whether the fraudulent email sender was an authorized person on
the account. We therefore do not discuss authorized payment orders further.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 13 of 27
21-11763 Opinion of the Court 13
a “[r]easonable time” may be fixed by agreement, but—crucially—
“the obligation of a receiving bank to refund payment” may not be
varied by agreement. Id. § 670.202(2).
We realize this is a bit of a slog, but we have just two more
provisions to wade through: First, Chapter 670 has a general rule
that “the rights and obligations of a party to a funds transfer may
be varied by agreement of the affected party.” Id. § 670.501(1). But
importantly, that general rule does not apply to “670” sections
when “otherwise provided in this chapter.” Id. And second, if a
bank receives “payment from its customer with respect to a pay-
ment order”—which happens immediately when the customer has
more money in his or her account than the outgoing payment or-
der—then “the customer is precluded from asserting that the bank
is not entitled to retain the payment unless the customer notifies
the bank of the customer's objection to the payment within one
year after the notification was received by the customer.” Id.
§ 670.505 (emphasis added).
The comment further explains the one-year rule. “This sec-
tion is in the nature of a statute of repose . . . . A receiving bank
that executes payment orders of a customer may have received
payment from the customer by debiting the customer’s account
with respect to a payment order that the customer was not re-
quired to pay.” Id. cmt. “For example,” the comment explains,
“the payment order may not have been authorized or verified pur-
suant to Section 4A-202 . . . . In either case the receiving bank is
obliged to refund the payment to the customer and this obligation
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 14 of 27
14 Opinion of the Court 21-11763
to refund payment cannot be varied by agreement.” Id. The one-
year statute of repose also applies when “the funds transfer [wasn’t]
completed . . . [or] if the receiving bank is not entitled to payment
from the customer because the bank erroneously executed a pay-
ment order [under Section 303] . . . or [when] the sender of a pay-
ment order pays the order and was not obliged to pay all or part of
the amount paid [under Section 402(4)].” Id.
To recap, Section 670.501 provides that any section in Chap-
ter 670 is modifiable by agreement “except as otherwise provided.”
Id. § 670.501. Section 670.204 requires a bank to refund a payment
order if it was not verified (unless the bank followed commercially
reasonable security procedures in good faith), and this obligation
may not be varied by agreement. Id. § 670.204(1). And Section
670.505 provides that a customer may not assert a claim for a re-
fund for a fraudulent transfer after one year after the customer re-
ceived notice of the transfer. Id. § 670.505.
We now turn to the dispute here: is the one-year period in
Section 670.505 modifiable by the parties? BB&T argues that it is
modifiable and that the parties shortened it to 30 days. So because
the Appellants didn’t notify BB&T of the fraudulent wire transfer
within 30 days of the last statement in November 2017, BB&T as-
serts, the Appellants’ claim for statutory repayment is time-barred.
For their part, the Appellants respond that the period in Sec-
tion 670.505 cannot be varied by agreement. So by their assess-
ment, their notification to BB&T (either in January 2017 or May
2017) fell within a year of the last statement containing notice of
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 15 of 27
21-11763 Opinion of the Court 15
the fraudulent transfer in November 2017 and was therefore
timely. We agree with the Appellants.
As always with statutory interpretation, we start with the
text. 7 GTC Inc. v. Edgar,
967 So. 2d 781, 785 (Fla. 2007). When it
comes to Florida’s adoption of the UCC, Florida courts have ex-
plained that the commentary is persuasive, but not controlling, au-
thority. United Auto. Ins. Co. v. Rivero Diagnostic Ctr.,
327 So. 3d
376, 380 n.2 (Fla. Dist. Ct. App. 2021); See, e.g., Corfan Banco Asun-
cion Paraguay,
715 So. 2d at 970 (noting that “[a]lthough the com-
mentary to the UCC is not controlling authority, we are persuaded
by the expressed intent of the drafters” (internal citations omitted);
Allen v. Coates,
661 So. 2d 879, 882 (Fla. Dist. Ct. App. 1995) (“[W]e
are guided by the official comments of the Uniform Commercial
Code adopted in Florida.”). Finally, under Florida law, “[w]here
possible, courts must give full effect to all statutory provisions and
construe related statutory provisions in harmony with one
7 As a federal court sitting in diversity jurisdiction, we apply Florida’s substan-
tive law. McMahan v. Toto,
256 F.3d 1120, 1131–32 (11th Cir. 2001) (citing
Erie R.R. Co. v. Tompkins,
304 U.S. 64 (1938)). The parties haven’t identi-
fied—and we haven’t found—any Florida Supreme Court or intermediate ap-
pellate court decisions on this point. So we apply the relevant principles of
Florida law as the Florida Supreme Court has explained them. SA Palm Beach,
LLC v. Certain Underwriters at Lloyd’s London,
32 F.4th 1347, 1357 (11th Cir.
2022) (“We therefore consider whatever might lend us insight, including rele-
vant state precedents, analogous decisions, considered dicta, scholarly works,
and any other reliable data tending convincingly to show how the Florida Su-
preme Court would decide the issue at hand.”) (citations omitted & alterations
adopted).
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 16 of 27
16 Opinion of the Court 21-11763
another.” Forsythe v. Longboat Key Beach Erosion Control Dist.,
604 So. 2d 452, 455 (Fla. 1992).
The Appellants have the better reading here for three rea-
sons. First, BB&T’s reading ignores the text of Section 670.204.
That section makes an important distinction between (1) a fraudu-
lent transfer and (2) the interest that fraudulent transfer would have
accumulated had it not been fraudulently transferred. Under that
section, if a customer fails to notify a bank of a fraudulent transfer
within “a reasonable time,” the sole penalty is that the customer
loses the interest on the refunded payment.
Id. § 670.204(1).
As the commentary explains, “the bank is not entitled to any
recovery from the customer based on negligence for failure to in-
form the bank. Loss of interest is in the nature of a penalty on the
customer designed to provide an incentive for the customer to po-
lice its account.” Id. § 670.203 cmt. In other words, Florida made
a policy choice about who should bear the risk of a fraudulent
transfer: the bank or the account holder. It chose the bank. In-
deed, the commentary expressly says so: “There is no intention to
impose a duty on the customer that might result in shifting loss
from the unauthorized order to the customer.” Id. § 670.203 cmt.
That makes sense because banks control the security of their
deposits, and they are in the best position to safeguard them. So
when banks bear the risk, that motivates them to create and en-
force better security for the deposits. But BB&T asks us to allow
parties to shift the loss of an unauthorized order to the customer
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 17 of 27
21-11763 Opinion of the Court 17
during the statutorily determined period. The statute does not sup-
port such a reading.
After all, if the one-year statutory notice period could be var-
ied, then banks could insist that customers sign contracts that make
the time to demand a refund of a fraudulent payment a day (or
even less). That would impair the account holder’s right to a re-
fund and defeat Florida’s intent that banks—not account holders—
bear the risk of a fraudulent transfer for the first year following the
transfer. And there’s no limiting principle in the text for how short
banks could make the statutory refund period. Nor was BB&T able
to identify one at oral argument. So if banks could modify the one-
year period, there’s no principled way to draw the line as to how
short of a refund period is too short.
There’s also another problem: Section 670.204 imposes a 90-
day notification period for an account holder to obtain, in addition
to her refund, interest on the fraudulent transfer. To be sure, Flor-
ida expressly authorized the shortening of that period from 90 days
to a “reasonable” period. But that just proves the point.
In other words, even though § 670.204(2) authorizes modifi-
cation to a “[r]easonable period” of the 90-day period during which
the customer is entitled to receive interest as well as a refund, it
prohibits any changes to the bank’s obligation “to refund payment
as stated in subsection (1).”
Fla. Stat. § 670.204(2). And Florida did
not authorize modification to a “reasonable” period for the one-
year period to which the 90-day period is directly related. So if
BB&T were right, then the parties could modify the 90-day period
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 18 of 27
18 Opinion of the Court 21-11763
to a “reasonable” shorter period, and they could also modify the
one-year period to be “[un]reasonabl[y]” short, because there is no
textual requirement that the one-year period be “reasonable.” In
fact, that one-year period could be modified to be the same as or
even shorter than the “reasonable” refund notice period—because,
on their faces and unlike for the 90-day period, the statutes do not
limit the changes to the one-year period to “reasonable” ones. That
would certainly “impair” the right to refund payment, in violation
of § 670.204(2)’s prohibition on doing so. Such a result would also
make no sense, given the 90-day/one-year-period structure for
both putting the risk of fraudulent transfers on the bank and
providing incentives in the form of interest on the fraudulently
transferred amount to account holders to timely report fraudulent
transfers. For that structure to work, the statutory notice period
for receiving a refund must be (at least) longer than the notice pe-
riod for also getting interest. And it must be meaningfully longer.
We are not the first ones to reach this conclusion. The New
York Court of Appeals and the Second Circuit also determined that
the one-year refund period cannot be modified when it was inter-
preting New York law (which is identical to Florida’s). As the New
York Court of Appeals recognized, “[p]ermitting banks to vary the
notice period by agreement would reduce the effectiveness of the
statute’s one-year period of repose as an incentive for banks to cre-
ate and follow security procedures.” Regatos v. North Fork Bank,
838 N.E.2d 629, 633 (N.Y. 2005). “To vary the period of repose
would, in effect, impair the customer’s section 4–A–204 (1) right to
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 19 of 27
21-11763 Opinion of the Court 19
a refund, a modification that section 4–A–204 (2) forbids.”
Id. See
also Regatos v. North Fork Bank,
431 F.3d 394, 395 (2d Cir. 2005).
The second reason the Appellants have the better argument
stems from the fact that Section 204 is narrower than Section 505.
In Florida, a specific provision generally controls over a broader
one. McGregor v. Fowler White Burnett, P.A.,
332 So. 3d 481, 491
(Fla. Dist. Ct. App. 2021). Section 204 concerns only unauthorized
or unverified wire transfers and a bank’s duty to refund. FLA. STAT.
§ 670.204. Section 505, on the other hand, provides a statute of re-
pose for objecting to all debits to a customer’s account. Id.
§ 670.505 cmt. It applies to unauthorized or unverified transfers,
see id. § 670.202, to uncompleted funds transfers, and to errone-
ously executed payment orders, see id. § 670.303. It also applies
where the sender of a payment order pays the order but “was not
obliged to pay all or part of the amount paid.” Id. § 670.402(d).
Because Section 204 is narrower than Section 505, where Section
204 and 505 conflict, Section 204 controls. McGregor, 332 So. 3d at
491. And here, that conflict counsels against allowing the parties
to modify the time to demand a refund.
Third, the commentary to Section 505 describes it as like a
“statute of repose.” FLA. STAT. § 670.505 cmt. Statutes of repose,
unlike statutes of limitations, can be referred to as “jurisdictional”
and are not subject to waiver or tolling. See Nat’l Auto Serv. Ctrs.,
Inc. v. F/R 550, LLC,
192 So. 2d 498, 513 (Fla. Dist. Ct. App. 2016)
(explaining that statutes of repose “erect an absolute bar to the as-
sertion of the extinguished cause of action that is analogous to a
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 20 of 27
20 Opinion of the Court 21-11763
jurisdictional statute of nonclaim”); see also John R. Sand & Gravel
Co. v. United States,
552 U.S. 130, 133–34 (2008). Given that (1)
Section 505 is like a statute of repose, see FLA. STAT. § 670.505 cmt.,
and therefore jurisdictional and that (2) we do not allow parties to
create subject matter jurisdiction by agreement, it would make lit-
tle sense to allow parties to modify Section 505 by agreement. See
Morrison v. Allstate Indem. Co.,
228 F.3d 1255, 1261 (11th Cir.
2000) (“[Subject matter jurisdiction] cannot be created by the con-
sent of the parties.”).
BB&T makes two arguments against this conclusion—both
unpersuasive. First, BB&T argues that the Florida intermediate ap-
pellate case Cheese & Grill Restaurant, Inc. v. Wachovia Bank,
N.A.,
970 So. 2d 372 (Fla. Dist. Ct. App. 2007), shows that Florida
courts have permitted variation by agreement of analogous notice
periods. We don’t find Cheese & Grill persuasive in this context.
In Cheese & Grill, the Third DCA affirmed summary judg-
ment for a bank that had paid fraudulent checks because, under the
banking contract, the restaurant had a duty to report bad checks
within thirty days.
Id. This case isn’t controlling or even persua-
sive because, as BB&T conceded at oral argument, there are im-
portant differences between funds transfers (regulated in Chapter
670) and checks (regulated in Chapter 674). Oral Arg. at 35:14. In-
deed, in passing Chapter 670, the commentators pointed out that
Florida made “a deliberate decision” to write on a clean slate from
its regulation of other instruments because of “the very large
amounts of money that are involved in funds transfers.” FLA. STAT.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 21 of 27
21-11763 Opinion of the Court 21
§ 670.102 cmt. Given the legislature’s “deliberate decision” to “use
precise and detailed rules” for funds transfers, we won’t apply a
case involving bad checks here, where six-figure wire transfers are
at issue. Id.
Second, BB&T says that Section 505—the one-year period—
doesn’t have any language prohibiting variation by agreement.
BB&T’s argument goes like this: Section 501 provides that every
provision in Chapter 670 can be varied unless “[e]xcept as other-
wise provided.” Id. § 670.501(1). Section 505 has no such limita-
tion. Id. § 670.505. Other provisions, BB&T points out, do. See,
e.g., FLA. STAT. §§ 670.202(6), 670.305(6), 670.402(6), 670.403(3).
Thus, BB&T concludes, we should interpret Section 505 as not
containing a limitation against modification. [Id.] This argument
sounds a bit like the negative-implication canon. Cf. A. Scalia and
B. Garner, READING LAW: THE INTERPRETATION OF LEGAL TEXTS
107 (2012) (“The expression of one thing implies the exclusion of
others.”). It isn’t quite the negative-implication canon because we
aren’t considering what is and isn’t expressed in Section 505; rather,
we are comparing the expression of a prohibition against modifica-
tion in some parts of Chapter 670 with its absence in Section 505.
BB&T makes a fair argument, but ultimately, we find it un-
persuasive for two reasons. First, as we discussed earlier, see supra
at 17 and 18, Section 670.204 limits modifications to the 90-day pe-
riod to receive interest to “reasonable” periods. FLA. STAT.
§ 670.204(2). But if we applied the negative implication canon to
this statute, it would mean that the one-year period to assert a
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 22 of 27
22 Opinion of the Court 21-11763
claim for a refund could be modified to be unreasonably short—
even shorter than the interest period—because there is, after all, no
use of the word “reasonable” in Sections 670.501 and 670.505. Id.
§§ 670.501; 670.505. As we’ve explained, that can’t be right.
Second, even Justice Scalia and Bryan Garner, after all, rec-
ognized that “[n]o canon of interpretation is absolute” and “[e]ach
may be overcome by the strength of differing principles that point
in other directions.” Scalia and Garner, READING LAW at 59. See
also id. at 107 (“Virtually all the authorities who discuss the nega-
tive-implication canon emphasize that it must be applied with great
caution, since its application depends so much on context.”). A
principle pointing in a different direction is “the presumption
against ineffectiveness.” Id. at 63. The presumption against inef-
fectiveness provides that “a textually permissible interpretation
that furthers rather than obstructs the document’s purpose should
be favored.” Id. at 63. Here, BB&T’s interpretation—that the one-
year time-period isn’t an unmodifiable obligation referenced in Sec-
tion 670.204—would allow banks to eviscerate the protection Sec-
tion 670.204 creates. See Regatos v. North Fork Bank, 838 N.E.2d
at 633 (“To vary the period of repose would, in effect, impair the
customer’s section 4–A–204 (1) right to a refund[.]”). The Appel-
lants’ alternate interpretation—the one-year period is an unmodifi-
able obligation referenced in Section 670.204—is reasonable and
furthers the text’s purpose, so we adopt it. See FLA. STAT. § 670.204
cmt. (“There is no intention to impose a duty on the customer that
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 23 of 27
21-11763 Opinion of the Court 23
might result in shifting loss from the unauthorized order to the cus-
tomer.”).
As the New York Court of Appeals recognized, Article 4A
was intended “to promote the finality of banking operations and to
give the bank relief from unknown liabilities of potentially infinite
duration.” Regatos, 838 N.E. 2d at 403. We will not alter “the stat-
ute’s fine-tuned balance between the customer and the bank as to
who should bear the burden of unauthorized transfers.” Id.
B. Commercially Reasonable Security Procedures
Given our conclusion that the one-year period in Section 505
isn’t modifiable by agreement—and there is no dispute that the Ap-
pellants gave notice within one year—we would ordinarily next
turn to whether BB&T’s security procedures were “commercially
reasonable” as defined in Section 670.202. But here, we will wait
for further proceedings rather than decide the question.
Section 670.202 provides that a bank has a safe harbor from
refunding fraudulent wire transfers if the bank and the customer
agreed upon “commercially reasonable” security procedures and
the bank followed those procedures in good faith. FLA. STAT.
§ 670.202(2). A security procedure is “established by agreement of
a customer and a receiving bank” and does not include a bank’s
unilaterally adopted internal processes. Id. § 670.201 & cmt.
Whether a security procedure is “commercially reasonable” is “a
question of law” to be determined by considering all the following:
(1) the circumstances of the customer known to the bank (includ-
ing the size, type, and frequency of payment orders); (2) alternate
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 24 of 27
24 Opinion of the Court 21-11763
security procedures offered to the customer; and (3) security pro-
cedures in general use by customers and receiving banks similarly
situated. Id.
The commentary explains that “[a] security procedure is not
commercially unreasonable simply because another procedure
might have been better or because the judge deciding the question
would have opted for a more stringent procedure.” Id. § 670.203
cmt. “Rather it is whether the procedure is reasonable for the par-
ticular customer and the particular bank, which is a lower stand-
ard.” Id. The commentary continues, “On the other hand, a secu-
rity procedure that fails to meet prevailing standards of good bank-
ing practice applicable to the particular bank should not be held to
be commercially reasonable.” Id.
For three reasons, we vacate the district court’s conclusion
that BB&T’s procedures were commercially reasonable and re-
mand the case for the district court to determine whether the pro-
cedures were commercially reasonable and if so, whether there is
a genuine issue of material fact that those procedures were fol-
lowed.
First, BB&T has produced additional discovery. We aren’t
sure whether these new documents will alter the district court’s
conclusion about commercial reasonableness. But the district
court should have the first opportunity to rule on the importance
of the documents. See Fla. v. Cohen,
887 F.2d 1451, 1455 (11th Cir.
1989) (“[A] remand to the district court for further proceedings is
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 25 of 27
21-11763 Opinion of the Court 25
necessary because new evidence has been developed that may shift
the district court’s assessment of the issue.”).
Second, we aren’t sure what the parameters of the security
procedures at issue in this case are. The district court held that the
security procedure at issue was the use of the token authentication
system. But it did not discuss (and exclude or include) other
measures Appellants say could be part of the security procedures:
event notification, required password changes (both mentioned in
the 2013 TMA) as well as security questions, signature authentica-
tion, and payment limits. On remand, the district court should ex-
plain which procedures are part of what the parties agreed to and
which are excluded as the bank’s unilateral internal operations.
And third, both sides submitted expert witness reports. In
concluding that the security procedures were commercially rea-
sonable, the district court cited to and relied on BB&T’s expert re-
port. But it did not mention the Appellants’ expert report. This
could be because the district court wasn’t considering the report.
But while BB&T moved to exclude the Appellants’ expert witness
as a sanction for non-disclosure, the district court denied the mo-
tion as moot. On remand, the district court should explain whether
it will consider the Appellants’ expert witness. In addition, the dis-
trict court should apply the factors laid out by statute to the Appel-
lants in this case—that is, whether the procedures were reasonable
as applied to the Appellants—not whether the security procedures
are commercially reasonable in the abstract. FLA. STAT. § 670.201
& cmt. (explaining that whether a security procedure is
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 26 of 27
26 Opinion of the Court 21-11763
commercially reasonable turns on the circumstances of the cus-
tomer as known to the bank).
So while we could decide whether the security procedures
were commercially reasonable because it is a question of law, we
think it prudent for the district court to do so based on the com-
plete record.
IV. CONCLUSION
In sum, we hold that the district court erred in concluding
that the parties could modify the one-year period to assert a claim
for repayment under Section 670.204. As a result, the court erro-
neously concluded that the Appellants had failed to give timely no-
tice. We REVERSE the district court on this point. 8
And, because BB&T produced new discovery, we VACATE
the district court’s orders (1) dismissing the tort claims in the Third
Amended Complaint and (2) entering summary judgment against
the Appellants on their contractual, statutory, and declaratory
judgment claims for relief. Given BB&T’s late production of dis-
covery, on remand, the district court should allow the Appellants
to take new discovery based on the recently produced discovery
and, if necessary, to replead their claims.
8 We do not decide whether any of the Appellants other than Inversiones had
standing to assert a claim for repayment because the new discovery may im-
plicate the district court’s decision on this point and because, as long as Inver-
siones has standing, we have jurisdiction.
USCA11 Case: 21-11763 Date Filed: 08/26/2022 Page: 27 of 27
21-11763 Opinion of the Court 27
REVERSED IN PART, VACATED IN PART, AND
REMANDED WITH INSTRUCTIONS.9
9 All pending motions are DENIED AS MOOT.
