Arrêt n° 486 FS-B (publié au bulletin), ECLI:FR:CCASS:2025:CO00486 — rejet of the pourvoi against Cour d’appel de Paris (chambre commerciale internationale, pôle 5, ch. 16), 18 October 2022, RG n° 20/18229, itself an appeal from Tribunal judiciaire de Paris, 16 November 2020. Prepared 12 November 2026. Quotations from the arrêt are our translations.

On 1 October 2025, the commercial chamber of France’s Cour de cassation did the thing that almost every victim-protection argument in online investment fraud eventually runs into and almost never gets: it held the payment intermediary liable. Rejecting the appeal of Worldpay AP Ltd, an English-law payment service provider authorised by the FCA since 2009, the Court confirmed that Worldpay owed and breached a duty of vigilance when it processed a defrauded French retiree’s payments to a binary-options scheme, and that French law governed that duty even though the PSP was foreign. The decision is classified FS-B — published in the Bulletin — the Court’s own signal that it is meant to be followed, not confined to its facts.

The procedural history is itself the argument. At first instance the Tribunal judiciaire de Paris (16 November 2020) did exactly what the system reflexively does (what we learned also by our cases): it condemned the empty conduit, the unlicensed Dutch shell Seroph Holding BV and let the regulated, solvent processor walk, dismissing the victim’s claim against Worldpay outright. It took the Cour d’appel de Paris to overturn that, and the Cour de cassation to make it final. In other words, reaching the enabler was not the default; it was the result of two further rounds of litigation against the reflex to spare it.

For EFRI this is the master thesis in a law report. Online investment fraud is a payment problem before it is a policing problem: the operators persuade, but the money only moves because a licensed, solvent, findable intermediary processes it. Here the operator layer had done what it always does — Seroph, formerly branded “AlgoCharge”, is judgment-proof — and the victim’s recovery survived only because liability reached past it to the regulated PSP that had put its own French bank account at the fraud’s disposal. The enabler was co-defendant, and the enabler was the one left able to pay.

The French Cour de cassation endorsed the Court of Appeal’s application of an existing standard to these facts, it did not invent a new rule. And the victim recovered a reduced sum — contributory imprudence was set off at 50% against the PSP’s fault. What the decision does is make the intermediary route legally durable and cross-border, on terms EFRI has argued for years and set out in Restoring Trust in European Payment Rails: A Framework for a Shared Liability Reform (Sixt).

Background: the payment chain

The underlying fraud is the standard and well known binary-options model of the mid-2010s. It is, in today’s terms, authorised push payment (APP) fraud in an online investment scam: the victim was deceived into authorising and pushing every transfer himself. The claimant, a retiree domiciled in France (M. [F] [X] in the anonymised report), was solicited in France to “invest” through online Forex/binary-options sites — Finch Markets, BanQ of Broker, 50 Option and Triompheoption, several of them on the AMF blacklist from 2013. In 2014 he transferred, from his BNP Paribas account in France, to a transit account that Worldpay, itself a payment institution, not a bank, had opened at the French establishment of Royal Bank of Scotland (now NatWest Markets) and made available to Seroph Holding BV, a Dutch company with no authorisation to provide payment services, operating the infrastructure formerly branded AlgoCharge, under a Payment Processing Agreement dated 19 February 2009. (The arrêt locates that account “en France”, in the bank’s French establishment, at a redacted city; §2, §13, §18.) Worldpay’s submissions, reproduced at §15 of the arrêt, list the transfers as:

• €5,000 to Finch Markets (5 February 2014);
• €6,000 to 50 Option (7 March 2014);
• €50,000 to Finch Markets (21 March 2014);
• €11,000 and a further €11,000 to 50 Option (both 24 April 2014) — €83,000 in the listed transfers.

The money passed through Seroph to the operators; 50 Option is identified as the final recipient. The investor sued Worldpay and Seroph in 2017.

The three-instance history:

• First instance — Tribunal judiciaire de Paris, 16 November 2020. Condemned Seroph alone to pay €20,000 (financial loss) and €1,500 (moral prejudice), and dismissed the claim against Worldpay (débouté). The regulated processor was exonerated.
• Appeal — Cour d’appel de Paris (CCIP-CA, pôle 5, ch. 16), 18 October 2022, RG 20/18229. Overturned (infirmé) the exoneration: applied French law, held Worldpay and Seroph both liable for breach of their duty of vigilance, in solidum, apportioned 50% of the loss to the victim’s own imprudence, and ordered €36,000 in solidum with interest at the legal rate from pronouncement. The appellate judgment confirms at §74 that €36,000 is the amount after the 50% reduction of the €72,000 loss assessed by the court.
• Cassation — 1 October 2025, n° 22-23.136, FS-B. Worldpay raised five moyens; the Court rejected the pourvoi in full and ordered Worldpay to pay costs. Because Seroph is insolvent, Worldpay bears the compensation. (Notably, the first moyen — applicable law — was deliberated with input from the première chambre civile at a hearing on 11 February 2025, before the commercial chamber’s hearing of 1 July 2025: a marker of the point’s weight.)

The duty of vigilance: apparent anomalies

The spine of the decision is the PSP’s devoir de vigilance, bounded on the other side by the devoir de non-immixtion, the principle that an intermediary is not a general investigator of its clients’ affairs. The Court did not impose a roving inquiry; the duty is to detect apparent anomalies accessible to the PSP from what is already in front of it. On these facts the anomalies were cumulative and, the Court held (§16–§20 of the arrêt), impossible to ignore:

• Seroph held itself out as a regulated payment-services provider without ever justifying the required authorisation — indeed a May 2013 publication, under its former name AlgoCharge, had advertised its services to “courtiers offshore et non régulés”;
• Seroph had not met the customer-due-diligence (KYC) obligations its own contract with Worldpay imposed;
• two beneficiary companies were on the AMF blacklist from 2013, and the transfer orders themselves named the final beneficiary (50 Option) and the Seroph reference;
• the flows ran through Worldpay’s own account in France, placed at Seroph’s disposal.

A regulated payment institution confronted with that constellation cannot, the Court held, stay passive. Doing nothing is the fault. This is the legal engine of EFRI’s signature thesis, “the enabler is the defendant”: not strict liability for processing a payment that later turns out badly, but fault liability for ignoring apparent anomalies the intermediary was positioned to see.

Worldpay’s defence was not frivolous: it invoked the non-immixtion principle (no general duty of vigilance), denied any apparent anomaly, and stressed that the claimant ordered the transfers himself. The non-immixtion limit is real, and the Court respected it — which is precisely why the decision turns on specific, accessible red flags rather than a duty to audit every merchant.

Applicable law and cross-border loss

For cross-border victim redress this is the more important half of the ruling, and it is the point the Court treated as weightiest. Worldpay is English; the question was whether French law could reach it. The Court anchored the answer in the Rome II Regulation (EC) No 864/2007, Article 4(1) (with its recital 7) — the law of the country where the damage occurs — and, for purely financial loss, localised that damage in France by reference to the CJEU’s jurisdiction case law read coherently with Brussels I, Article 5(3): Universal Music (C-12/15, 16 June 2016) and Löber (C-304/17, 12 September 2018).

The connecting factor the Court treated as decisive was where the victim’s loss materialised: directly on his French BNP Paribas account, from which he was induced to push the funds (§14). The surrounding factors pointed the same way, a victim domiciled in France, solicited in France, issuing the transfer orders from France, into the transit account Worldpay had opened at the French establishment of Royal Bank of Scotland. That the other actors were otherwise foreign — an English payment institution (Worldpay), a Scottish-origin bank (RBS, now NatWest Markets), a Dutch conduit (Seroph) — did not displace French law. The result is worth stating with precision, because it is the transferable holding: both the forum (the Paris courts, up to the Cour de cassation) and the applicable law were French, fixed by where the damage occurred, not by the nationality of the processor or of its bank. For a boiler-room economy built on routing victims’ money through intermediaries domiciled anywhere convenient, this is the load-bearing point: the victim’s location, not the processor’s letterhead, fixes both the governing law and the forum.

Two features of the reasoning deserve a closer look. The Court applied Article 4(1) alone; the escape clause of Article 4(3) is not mentioned. And it located the damage at the investor’s own account — the financial loss “was directly suffered on the investor’s bank account opened in France”, following a solicitation that had taken place there (§14) — although it had recorded, one paragraph earlier, that the funds “disappeared” on the account held by the payment service provider (§13). Worldpay’s argument that the funds had merely transited through its account was not adopted. Because Worldpay’s collection account was itself held at a French branch, the Court had no occasion to decide the case in which the provider’s collection account sits in another Member State; that constellation remains open. What the decision does settle is the method: under Article 4(1) the place where the provider took its decisions plays no role, and the victim’s account is the default anchor for the place of damage.

APP fraud and the duty of vigilance

The victim was deceived into authorising and pushing each transfer himself — in today’s terminology, authorised push payment (APP) fraud.

Because every payment was authorised, the statutory protections that refund unauthorised transactions were never in play — there was nothing unauthorised to refund. This is the exact gap into which APP-fraud victims fall across Europe, and it is why a statutory refund claim was a dead end here. Nor could the victim build a claim on the intermediary’s anti-money-laundering obligations: the Court confirmed that an investor cannot found a claim on the AML/LCB-FT duties of Articles L. 561-5 ff. of the Code monétaire et financier, which protect the system, not the individual victim.

What remained was the general civil duty of vigilance — a délictual claim (former Code civil Art. 1382, now 1240) that the money moved only because a regulated intermediary ignored apparent anomalies it was positioned to see. The significance of the ruling is precisely that this route delivers where the APP-fraud victim otherwise has nowhere to go: it reaches the intermediary on the authorised payment that the refund regimes leave unprotected.

The practical lesson for building these cases is exact: in APP-fraud matters the intermediary route runs through the duty of vigilance. It cannot be hung on an unauthorised-transaction refund right (there was no unauthorised transaction) or on the AML statute (not a victim’s cause of action) — plead it either way and a defendant will have the claim struck.

The 50% reduction and the compensation awarded

The apportionment deserves emphasis precisely because advocacy coverage glides over it. The courts weighed the investor’s own imprudence, chasing implausible returns despite warnings against the intermediary’s fault, and set it at 50%, maintained through cassation, producing a €36,000 in solidum award after reducing the €72,000 loss assessed by the Court of Appeal by half (§74). The €83,000 sum above is the arithmetic total of the transfers listed in Worldpay’s submissions reproduced in the cassation judgment; it is not the compensation base adopted by the appellate court. A victim-redress strategy sold as “sue the PSP and be made whole” oversells the instrument. The accurate claim is narrower and still powerful: a solvent, identifiable defendant for a substantial share of the loss, where the operators have vanished.

Our assessment

On EFRI’s master thesis, the intermediary is the pressure point, the ruling is as close to a judicial endorsement as the current law offers, and its cross-border reach via Rome II Article 4(1) is what makes it matter beyond France: the processor’s domicile is not a shield when the victim’s loss lands at home.

For victims this is the more useful outcome. A victim who paid from a German or Austrian account to a foreign acquirer can sue either at home or at the acquirer’s seat and, in either forum, under his own law, including its limitation rules (Rome II, Article 15(h)). Collective proceedings that bundle claimants from several countries face a separate question under Article 4(3), which this decision does not touch.

The procedural history carries its own lesson, and it is not a comfortable one. The first judge did the intuitive, wrong thing; condemned the empty Dutch shell and exonerated the regulated, solvent processor. That is the reflex EFRI exists to correct: treat the PSP as a neutral pipe and chase the vanished operator. Reaching the enabler required overturning that instinct twice, over roughly eleven years from solicitation to final judgment. A right that depends on a determined claimant out-litigating the system’s default setting is a fragile basis for redress.

Worldpay is a case in which a supreme court held that negligent inattention to an unlicensed merchant and to blacklisted beneficiaries suffices for liability. Whoever accepts that cannot treat as a neutral service provider an acquirer that itself filed suspicious-transaction reports on its merchant, itself suspended processing, itself lifted the suspension and then re-priced the risk instead of ending the relationship. The legal threshold under the German rules on accessory liability is higher — intent, not fault — but the facts that meet it are of a different order. And under those rules the accessory answers for the whole loss caused by the offence it knowingly furthered, not for the slice it processed.

The limits must therefore be stated plainly:

• It is French, and it is a rejet. It confirms an existing standard; it is not an EU-wide rule. Its persuasive value elsewhere is real but must be argued — and the strongest bridge is the Rome II / CJEU-jurisdiction reasoning, which is pan-European.
• It is fact-intensive. Liability followed from specific accessible anomalies — an unproven licence, a provider that had openly courted unregulated brokers, named blacklisted beneficiaries, the PSP’s own account as conduit. Absent comparable red flags, the non-immixtion principle still protects the PSP. This is a duty to notice, not a guarantee.
• It is an APP-fraud route, and a narrow one. The claim works only because these were authorised push payments pursued through the general duty of vigilance — the statutory refund regimes (built for unauthorised transactions) and the AML statute (L. 561-5 ff.) both leave the APP-fraud victim unprotected, as the Court confirmed. Plead it through either of those and the claim fails.
• Recovery was partial and depended on a solvent intermediary still standing. The victim was made 50% whole only because Worldpay remained; Seroph was already a shell. Where every intermediary in the chain is judgment-proof, the route delivers nothing.

The strategic reading for EFRI is twofold. As litigation, this is a usable template — authorised-payment vigilance liability, French-law jurisdiction over a foreign PSP via place of damage — and EFRI should say so while flagging the exclusivity trap, the pleading doors, and the 50%/eleven-year reality rather than promising more than the law gives. As policy, it is an argument for reform, not a substitute for it. A redress system in which the regulated enabler is spared at first instance, reached only on appeal, for half the loss, a decade later, and only while it stays solvent, is not a system, it is the absence of one, partially cured by a stubborn claimant and a good lawyer. The PSD/PSR file is where the gap belongs closed at the front end: intermediary vigilance made a prevention duty with enforceable liability, before the conduit becomes an empty shell, which is precisely EFRI’s redress by design case.

Eleven years, two reversals of the instinct to spare the processor, for half the money against the one defendant still solvent. That it succeeded at all is the good news. That it took that is the case for building redress by design.

Judgments and primary sources

• Cour de cassation, 1 October 2025, n° 22-23.136, ECLI:FR:CCASS:2025:CO00486 — official full text; see §§12–14 on applicable law and §§16–20 on vigilance.
• Cour d’appel de Paris, 18 October 2022, RG 20/18229 — full judgment (PDF) — see §74 and the operative provisions on the €36,000 award.
• CJEU, Universal Music, C-12/15, 16 June 2016, ECLI:EU:C:2016:449.
• CJEU, Löber, C-304/17, 12 September 2018, ECLI:EU:C:2018:701.