Introduction
The relationship between a banker and its customer has long been founded on trust, with the duty of confidentiality being a central pillar. This duty assures customers that their financial affairs will be kept private, fostering confidence in the banking system. In Zambia, as in other common law jurisdictions, this principle has been a cornerstone of banking practice. However, the global and domestic regulatory landscape has shifted dramatically in recent decades. The rise of international financial crime, terrorism financing, and tax evasion has prompted governments to enact stringent laws that compel banks to disclose customer information. This has created a significant tension between the traditional duty of confidentiality and the modern demands of regulatory compliance.
This essay will discuss this tension under Zambian law. It will argue that while the duty of confidentiality is still recognised by statute and common law, its practical application has been substantially eroded by a series of legislative and regulatory requirements. Specifically, the obligations related to Anti-Money Laundering (AML), Counter-Financing of Terrorism (CFT), Know Your Customer (KYC), and Suspicious Transaction Reporting (STR) have created such wide-ranging exceptions that the duty of confidentiality, though not abolished, now operates in a much-diminished capacity.
The Traditional Duty of Confidentiality
The banker's duty of confidentiality is an implied term in the contract between the bank and its customer. The foundational principles were established in the English case of Tournier v National Provincial and Union Bank of England [1924] 1 KB 461. This case established that a bank has a qualified duty not to disclose information concerning its customer's affairs without their consent. The Zambian High Court affirmed the relevance of these principles in SITET v Mandona (1981) ZR 209 (HC), which confirmed that the banker-customer relationship imposes a duty of secrecy.
The duty as outlined in Tournier is not absolute. Lord Justice Bankes identified four main exceptions where disclosure is permissible:
- Where disclosure is under compulsion of law;
- Where there is a duty to the public to disclose;
- Where the interests of the bank require disclosure; and
- Where the disclosure is made by the express or implied consent of the customer.
Historically, the most significant of these was the 'compulsion by law' exception, which was typically invoked in response to a court order or a specific statutory demand. However, the scope of this exception has expanded dramatically, forming the basis for the modern erosion of the confidentiality rule. In Zambia, the duty and its exceptions are now codified in the Banking and Financial Services Act No. 7 of 2017 (BFSA). Section 101(1) of the BFSA states that a financial service provider, its directors, and employees shall "maintain the confidentiality of information relating to the affairs of a customer". However, Section 101(2) immediately qualifies this by providing a list of circumstances where disclosure is permitted, including where it is required under the BFSA itself or "any other law". It is this gateway that has allowed other statutes to make significant inroads into the principle of confidentiality.
Statutory Erosion of the Confidentiality Duty
The 'compulsion of law' exception has been transformed from a narrow gateway into a wide-open avenue for disclosure by a raft of modern legislation aimed at combating financial crime. These statutes have shifted the role of banks from passive keepers of secrets to active participants in financial surveillance.
Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) Obligations
The primary legal instruments driving this change in Zambia are the Financial Intelligence Centre Act No. 46 of 2010 (FIC Act) and the Anti-Terrorism and Non-Proliferation Act No. 6 of 2018. These acts impose a comprehensive framework of duties on 'reporting entities', which prominently include banks. The objective of this framework is to detect, deter, and disrupt money laundering and the financing of terrorism.
The FIC Act, in particular, places a direct obligation on banks to collect and report customer information, overriding the duty of confidentiality. These obligations are not triggered by a specific court order but are ongoing and proactive requirements. The Act creates a legal compulsion that fits squarely within the exception articulated in Tournier and codified in Section 101(2) of the BFSA, but the nature of the compulsion is far more intrusive than was historically envisaged.
Know Your Customer (KYC) Requirements
A fundamental component of the AML/CFT framework is the requirement for banks to conduct Customer Due Diligence (CDD), commonly known as Know Your Customer (KYC). Part III of the FIC Act mandates that reporting entities must identify and verify the identity of their customers before establishing a business relationship or conducting a transaction. This includes obtaining information on the purpose and intended nature of the business relationship.
These KYC requirements represent an initial erosion of confidentiality. The very act of demanding and recording detailed personal and business information as a precondition for service moves the bank-customer relationship away from one of pure commercial privacy. Banks are legally required not just to serve the customer, but to scrutinise them on behalf of the state. The Bank of Zambia (BoZ), as the primary regulator, issues directives and guidelines that further specify these CDD obligations, ensuring that banks collect a standardised and comprehensive set of data on all their clients (Bank of Zambia, 2018).
Suspicious Transaction Reporting (STR) Obligations
The most significant erosion of the duty of confidentiality stems from the obligation to file Suspicious Transaction Reports (STRs). Section 19 of the FIC Act requires a reporting entity, such as a bank, to report any transaction to the Financial Intelligence Centre (FIC) if it "has reasonable grounds to suspect" that the transaction is related to money laundering, terrorist financing, or any other serious offence.
This duty is profound in its impact on confidentiality for several reasons. Firstly, the reporting is made without the customer’s knowledge or consent. Indeed, Section 21 of the FIC Act creates a "tipping off" offence, making it a crime for a bank employee to inform a customer that a report has been made about them. This secrecy ensures that investigations are not compromised, but it completely subverts the customer's expectation of transparency and confidentiality in their dealings with the bank. Secondly, the threshold for reporting is "reasonable grounds to suspect," which is a relatively low bar, compelling banks to report a wide range of activities that might later prove to be perfectly legitimate. The FIC's annual trends reports show thousands of such reports being filed by banks each year, demonstrating the scale of this information flow from the banking sector to the state (Financial Intelligence Centre, 2021).
Broader Regulatory Disclosure Requirements
Beyond the AML/CFT framework, other statutes grant state bodies the power to access bank information. The Bank of Zambia Act (Cap 360) grants the BoZ extensive supervisory powers to inspect the books and records of financial service providers to ensure financial stability and compliance. While this is for regulatory purposes, it involves access to customer-specific information.
Similarly, the Zambia Revenue Authority Act (Cap 321) gives the Commissioner-General powers to request information from any person, including a bank, for the purposes of tax assessment and collection. Section 13 of the Act, for instance, allows the ZRA to require a bank to furnish returns of interest paid to its customers. This power, used to combat tax evasion, provides another legally mandated reason for banks to breach their duty of confidentiality.
Conclusion: A Duty Redefined
The duty of confidentiality was indeed a cornerstone of the banker-customer relationship in Zambia. However, it is clear that its foundations have been significantly shaken by the weight of modern regulatory obligations. While the principle is still enshrined in Section 101 of the Banking and Financial Services Act, the exceptions, particularly the 'compulsion by law' exception, have expanded to such a degree that they now arguably dominate the rule.
The erosion is not absolute; banks still have a duty of confidentiality regarding a customer's general financial standing or ordinary commercial activities that do not trigger any legal reporting requirements. However, the proactive and mandatory nature of AML/CFT laws, KYC requirements, and STR obligations has fundamentally altered the bank's role. Banks are no longer just custodians of their customers' money and secrets; they are now mandated gatekeepers and a crucial source of intelligence for the state in the fight against financial crime. The balance between customer privacy and public interest has decisively shifted in favour of the latter. Therefore, it is accurate to conclude that the duty of confidentiality in Zambian banking law, while not extinct, has been severely eroded and redefined for the modern era.
References
Bank of Zambia (2018) Anti-Money Laundering and Countering the Financing of Terrorism Directives. Lusaka: Bank of Zambia.
Financial Intelligence Centre (2021) 2020 Money Laundering and Terrorist Financing Trends Report. Lusaka: Financial Intelligence Centre.
SITET v Mandona (1981) ZR 209 (HC).
Tournier v National Provincial and Union Bank of England [1924] 1 KB 461.
Statutes of Zambia
Anti-Terrorism and Non-Proliferation Act, No. 6 of 2018.
Bank of Zambia Act, Chapter 360 of the Laws of Zambia.
Banking and Financial Services Act, No. 7 of 2017.
Financial Intelligence Centre Act, No. 46 of 2010.
Zambia Revenue Authority Act, Chapter 321 of the Laws of Zambia.
