1. Introduction

Failure to Coordinate Actions During Major Incidents refers to the inability of an organization, financial institution, regulatory authority, or service provider to effectively organize, communicate, supervise, and execute necessary responses when a significant operational disruption, cyberattack, financial crisis, technological failure, or emergency occurs.

In banking and financial services, major incidents may include:

Cybersecurity breaches and ransomware attacks.

Failure of core banking systems.

Large-scale payment processing disruptions.

Unauthorized transactions affecting numerous customers.

Data breaches involving confidential financial information.

Failure of ATM networks or digital banking applications.

Liquidity crises and major operational failures.

Disruptions involving outsourced technology providers.

Fraud affecting multiple accounts or payment systems.

Failure of disaster recovery and business continuity arrangements.

During these incidents, financial institutions must establish effective communication, assign responsibilities, coordinate technical and operational teams, protect customers, and restore essential services.

Failure to perform these responsibilities may result in regulatory penalties, contractual liability, negligence claims, financial losses, reputational damage, and supervisory enforcement action.

The precise legal consequences depend on the jurisdiction, applicable regulations, contractual obligations, and facts of the incident.

2. Meaning and Nature of Coordination Failure

Incident coordination means managing the activities of different departments, decision-makers, service providers, and relevant authorities through a structured response mechanism.

For example, consider a bank experiencing a major cybersecurity incident that compromises its online payment infrastructure.

An effective response may require coordination among:

Information technology and cybersecurity departments.

Risk management and compliance teams.

Senior management and the board.

Payment processing and settlement teams.

Customer service departments.

Outsourced technology service providers.

Regulatory authorities and law enforcement, where applicable.

If these departments fail to communicate or act consistently, the disruption may continue unnecessarily, customer losses may increase, and legally required notifications may be delayed.

Example: A bank detects unauthorized access to its payment system. Its cybersecurity department identifies the problem, but the operations department continues processing affected transactions because no coordinated response procedure exists.

If reasonable coordination could have prevented additional losses, the institution may face allegations of negligence, breach of contractual duties, or regulatory non-compliance.

However, a coordination failure does not automatically establish civil liability. The claimant generally must demonstrate a legally recognized duty, breach, causation, and recoverable loss.

3. Legal and Regulatory Framework

The following analysis concentrates on banking, financial services, and technology incidents, with particular reference to India, the European Union, and relevant common-law decisions.

A. Duty of Care and Negligence

Organizations may owe duties to customers and other affected parties to exercise reasonable care in delivering services and managing foreseeable risks.

A failure to coordinate during a major incident may constitute negligence where:

A legal duty of care exists.

The organization fails to meet the applicable standard of reasonable care.

The failure causes or materially contributes to the relevant harm under the governing causation rules.

The claimant suffers legally recoverable damage.

A preventable delay in responding to a major payment-system malfunction, for example, may be relevant evidence of a failure to exercise reasonable care.

Nevertheless, liability cannot be established merely because an incident occurred. Courts distinguish unavoidable disruptions from failures involving unreasonable conduct.

B. Contractual Liability

Banks and service providers frequently enter into contracts containing provisions governing:

Service availability.

Incident response and escalation.

Business continuity.

Recovery time objectives.

Cybersecurity obligations.

Customer notifications.

Outsourcing arrangements.

Compensation and indemnification.

Failure to coordinate emergency response activities may amount to a contractual breach if it violates an express provision or an applicable implied obligation.

Possible remedies include damages, contractual service credits, termination rights, or other relief depending on the agreement and governing law.

C. Banking Regulatory Obligations

Banking regulators generally require regulated institutions to maintain appropriate governance arrangements, operational controls, risk management systems, and business continuity procedures.

These requirements may encompass:

Incident classification and escalation.

Clear management responsibility.

Response coordination.

Operational resilience testing.

Outsourcing risk management.

Regulatory reporting.

Customer protection.

A significant failure may result in supervisory findings, remediation directions, restrictions, or monetary penalties where authorized by law.

4. Important Case Laws

The following decisions illustrate legal principles relevant to organizational coordination, systems failures, operational risk, and responsibility for preventing foreseeable harm. Not every case concerns a major banking incident directly.

Case Law 1: Donoghue v Stevenson [1932] AC 562

Court: House of Lords, United Kingdom

Facts:

The claimant alleged that a bottle of ginger beer contained a decomposed snail, resulting in illness. She brought a negligence claim against the manufacturer despite lacking a direct contractual relationship with it.

Legal Issue:

Whether a manufacturer could owe a duty of care to a consumer who had no direct contract with the manufacturer.

Judgment:

The House of Lords recognized that a manufacturer could owe a duty of care to the ultimate consumer in circumstances where negligent conduct could foreseeably cause injury.

Legal Principle:

The decision established a foundational approach to duties of care in negligence law.

Relevance to Major Incident Coordination:

The case provides a general foundation for considering whether an institution owes a duty of reasonable care to persons foreseeably affected by its activities.

For example, a financial institution's failure to implement reasonable safeguards or coordinate a response to an identified operational threat may raise duty-of-care questions.

However, the decision does not itself impose a universal duty on every bank to prevent all losses arising from major incidents. Whether a duty exists must be determined under the applicable legal framework.

Case Law 2: Caparo Industries plc v Dickman [1990] 2 AC 605

Court: House of Lords, United Kingdom

Facts:

Caparo Industries acquired shares in a company and subsequently alleged that it had relied on negligently prepared audited financial statements.

The dispute concerned whether the auditors owed a duty of care to investors using those statements for investment decisions.

Judgment:

The House of Lords rejected the asserted duty in the circumstances of the case.

The judgment discussed foreseeability, proximity, and whether imposing a duty would be fair, just, and reasonable.

Legal Principle:

Foreseeability of loss alone does not establish a duty of care.

Application to Incident Coordination:

Where customers, counterparties, or investors allege losses caused by poor incident coordination, a court must first determine whether the defendant owed them a relevant legal duty.

For instance, an outsourced software provider's failure to inform a bank about a critical incident does not automatically create a direct negligence claim for every customer affected by the disruption.

Contractual relationships, statutory duties, proximity, and the governing jurisdiction remain important.

Case Law 3: Lloyds Bank plc v Independent Insurance Co Ltd [2000] QB 110

Court: Court of Appeal, England and Wales

Facts:

The dispute concerned liability relating to fraudulent banking transactions and the legal responsibilities of banks in processing payment instructions.

Legal Significance:

The case forms part of the English banking-law authorities addressing payment instructions and the circumstances in which a bank may incur liability in connection with unauthorized or fraudulent transactions.

Application to Major Incidents:

Payment-system emergencies often require communication between banks, operational teams, and relevant counterparties.

Poor coordination may contribute to failures to identify suspicious instructions, investigate disputed transactions, or respond to known risks.

The case should not, however, be treated as establishing a general obligation to maintain a particular incident-command structure.

Case Law 4: Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363

Court: High Court of England and Wales

Facts:

A bank processed payment instructions given by an authorized company representative in circumstances that raised questions about possible fraud against the company.

Judgment:

The court recognized that a bank could breach its duty when executing an agent's instructions if it had reasonable grounds to believe that the agent was attempting to defraud the customer.

Legal Principle:

A bank's obligation to execute payment instructions may be qualified where the circumstances put it on inquiry regarding a possible fraud by the customer's agent.

Relevance to Coordination Failure:

Suppose a bank's fraud monitoring team identifies a suspected internal fraud scheme, but its payment operations team continues executing suspicious instructions because the warning is not communicated.

Such facts may raise questions about whether the bank acted with reasonable care when processing the instructions.

Important qualification: The modern scope of the Quincecare principle was clarified by the UK Supreme Court in Philipp v Barclays Bank UK PLC [2023] UKSC 25. Where a customer personally authorizes a payment, the bank generally must execute the instruction; the Quincecare principle does not create a general duty to second-guess an authorized customer's decision.

Case Law 5: Philipp v Barclays Bank UK PLC [2023] UKSC 25

Court: UK Supreme Court

Facts:

The claimant was deceived by fraudsters into instructing her bank to transfer substantial funds.

She alleged that the bank should have intervened because the payments displayed indications of fraud.

Judgment:

The Supreme Court held that where the customer herself gives a valid payment instruction, the bank's ordinary duty is to carry it out.

The Quincecare duty does not generally apply to instructions personally authorized by the customer.

The Court nevertheless allowed consideration of a distinct issue concerning the bank's response to a later request to recall payments.

Relevance:

The judgment is important for defining the limits of a bank's responsibilities during suspected fraud incidents.

A failure to coordinate transaction recalls, alerts, or investigations may raise different legal questions from an alleged failure to reject an authorized payment.

Therefore, duties must be analyzed separately according to the stage of the incident and the applicable legal obligations.

Case Law 6: Various Claimants v WM Morrison Supermarkets plc [2020] UKSC 12

Court: UK Supreme Court

Facts:

An employee maliciously disclosed personal data relating to a large number of other employees.

Affected individuals brought claims against the employer, including on the basis of vicarious liability.

Judgment:

The Supreme Court held that the employer was not vicariously liable for the employee's wrongful disclosure in the circumstances.

The employee was pursuing a personal vendetta rather than acting in the ordinary course of his employment.

Legal Principle:

An employer is not automatically liable for every wrongful act committed by an employee merely because employment provided the opportunity to commit it.

Relevance to Major Incidents:

Large data breaches can create complex questions concerning employee misconduct, internal supervision, security controls, and incident response.

A failure to coordinate incident-response activities may give rise to distinct allegations concerning an organization's own conduct.

However, the occurrence of a breach does not automatically establish employer liability.

Case Law 7: Wm Morrison Supermarkets PLC v Various Claimants – Distinguished from Direct Organizational Negligence

A significant distinction arises between:

Vicarious liability: Responsibility for another person's wrongdoing because of a legally recognized relationship.

Direct liability: Responsibility for the organization's own negligent conduct or breach of statutory duty.

If a major data incident arises from an employee's malicious actions, the organization may successfully defend a vicarious liability claim.

Nevertheless, separately proven failures in data security, notification, or incident coordination may need to be evaluated under the applicable statutory and negligence frameworks.

The Morrison judgment does not give organizations blanket immunity from claims involving cybersecurity failures.

Case Law 8: Vidal-Hall v Google Inc [2015] EWCA Civ 311

Court: Court of Appeal, England and Wales

Facts:

The claimants alleged misuse of private information through online tracking activities.

The dispute concerned, among other matters, whether compensation for distress could be claimed under data protection legislation without proof of financial loss.

Judgment:

The Court of Appeal held that compensation for distress was not necessarily dependent on proof of pecuniary loss under the relevant provisions of the Data Protection Act 1998.

Legal Principle:

Certain data protection violations may support compensation for non-financial harm, subject to the requirements of the applicable law.

Application to Incident Coordination:

Where organizations mishandle a data incident, affected individuals may raise claims involving misuse of personal information or breaches of data protection duties.

However, compensation is not automatic simply because a data breach or response failure occurred. The claimant must establish the relevant requirements of the cause of action.

The decision concerns the former UK statutory framework and should not be treated as a complete statement of current UK GDPR compensation law.

Case Law 9: National Westminster Bank plc v Spectrum Plus Ltd [2005] UKHL 41

Court: House of Lords, United Kingdom

Facts:

The dispute concerned whether a charge over book debts constituted a fixed charge or a floating charge.

Judgment:

The House of Lords emphasized the substantive rights and control created by the arrangement rather than relying solely on the label used in the documentation.

Relevance to Incident Coordination:

This case offers a broader lesson about the legal significance of actual control.

An organization may describe its procedures as centrally controlled, but legal analysis may examine the powers and operational arrangements actually established.

Nevertheless, Spectrum Plus is a secured-transactions decision, not a direct authority establishing liability for incident-response coordination failures.

5. Indian Legal Framework and Important Case Laws

A. Reserve Bank of India Regulatory Requirements

Indian banks and relevant regulated entities may be subject to RBI directions concerning information technology governance, cybersecurity, outsourcing, digital payments, operational risk, and customer protection.

Relevant frameworks include:

1. Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023

These directions establish governance and control requirements for covered regulated entities, including responsibilities relating to IT risk, incident management, and business continuity.

Their applicability depends on the type of regulated entity and the provisions governing that entity.

2. RBI Cyber Security Framework in Banks, 2016

The framework addresses cybersecurity preparedness, monitoring, detection, response, and reporting.

It emphasizes board-level attention and organizational arrangements for managing cyber risk.

3. RBI Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial Services by Banks, 2006

These guidelines establish important principles concerning outsourcing arrangements, accountability, monitoring, and risk management.

A bank's use of an external service provider does not automatically eliminate its responsibility for regulatory compliance.

Case Law 10: Punjab National Bank v K.B. Shetty (1991) 2 SCC 207

Court: Supreme Court of India

Facts and Legal Issue:

The dispute concerned alleged banking negligence associated with forged payment instruments and the responsibilities of a bank in handling customer transactions.

Legal Significance:

The decision is relevant to the responsibilities of banks in responding to unauthorized or improperly processed transactions.

Application:

Where a payment incident involves operational irregularities, the conduct of bank personnel and compliance with applicable banking duties may become central to determining liability.

The case is not a direct authority on modern cybersecurity incident coordination, and its application depends on the specific legal and factual issues.

Case Law 11: Canara Bank v Canara Sales Corporation (1987) 2 SCC 666

Court: Supreme Court of India

Facts:

The dispute involved unauthorized withdrawals from a customer's account using forged cheques.

The customer sought recovery of amounts debited by the bank.

Judgment:

The Supreme Court held that a forged cheque does not constitute a valid mandate from the customer.

The bank generally cannot debit the customer's account on the basis of a forged signature.

Legal Principle:

Banks must act according to valid customer mandates and may be responsible for losses caused by honoring forged instructions.

Relevance to Major Incident Coordination:

If a bank discovers multiple forged payment instructions, coordination between branch operations, fraud monitoring, and relevant internal teams may be necessary to prevent further unauthorized payments.

Failure to communicate fraud warnings or suspend affected processes can be relevant to a dispute over unauthorized debits.

However, the decision principally concerns forged mandates rather than a general legal duty to coordinate major incidents.

Case Law 12: Indian Medical Association v V.P. Shantha (1995) 6 SCC 651

Court: Supreme Court of India

Facts:

The Supreme Court considered whether medical services fell within the scope of consumer protection legislation.

Judgment:

The Court held that certain medical services qualified as services under the Consumer Protection Act, 1986, subject to specified exceptions.

Legal Principle:

Qualifying service providers may face consumer liability for deficient services.

Relevance:

Although not a banking incident case, the decision illustrates the broader operation of consumer-service accountability.

Banking and financial services may independently fall within the applicable definition of service under consumer protection legislation.

Where poor incident coordination results in a legally established deficiency in service, affected consumers may seek appropriate remedies.

Case Law 13: Lucknow Development Authority v M.K. Gupta (1994) 1 SCC 243

Court: Supreme Court of India

Facts:

The dispute involved deficient services and administrative failures by a development authority.

Judgment:

The Supreme Court interpreted consumer protection legislation broadly and recognized that qualifying failures in public-authority services could attract consumer remedies.

Legal Principle:

A service provider may face liability for legally recognized deficiencies in the performance of its services.

Relevance to Banking Incidents:

When a financial institution fails to respond appropriately to a major operational disruption, affected customers may allege deficiency in service.

A finding of liability will depend on the relevant statutory duties, the nature of the failure, the evidence, and the losses or other legally compensable harm established.

6. European Union and Spanish Regulatory Framework

For European financial institutions, the Digital Operational Resilience Act provides an especially relevant framework.

A. Digital Operational Resilience Act (DORA)

Regulation (EU) 2022/2554

DORA has applied since 17 January 2025.

It establishes requirements addressing information and communication technology risks across covered financial entities.

Its provisions are directly relevant to failures in coordinating major ICT-related incidents.

Important areas include:

Legal significance:

Under DORA, covered financial entities must establish appropriate procedures for detecting, managing, recording, classifying, and responding to ICT incidents.

Article 17 is particularly important because it concerns the development and implementation of an incident-management process.

Article 14 addresses crisis communication, including arrangements relevant to significant disruptions.

A financial institution that lacks clear escalation responsibilities, fails to coordinate response measures, or does not maintain the required communication arrangements may face regulatory scrutiny.

Whether enforcement action is available, and which authority may take it, depends on the entity and applicable EU and national enforcement provisions.

B. Spanish Banking Law

In Spain, relevant legislation includes:

Law 10/2014 of 26 June, concerning the regulation, supervision, and solvency of credit institutions.

Royal Decree 84/2015, developing aspects of Law 10/2014.

Organic Law 3/2018, on personal data protection and the guarantee of digital rights.

The EU General Data Protection Regulation (GDPR).

DORA, for entities within its scope.

Financial institutions must consider the interaction of prudential governance, operational resilience, cybersecurity, consumer protection, and personal data requirements.

Example:

A Spanish bank experiences a ransomware incident affecting payment systems and customer records.

If the bank fails to coordinate its IT department, crisis management team, data protection function, and relevant external providers, the incident may raise questions under DORA and, where personal data is involved, the GDPR.

GDPR Articles 33 and 34 establish personal data breach notification obligations in specified circumstances.

These obligations are distinct from DORA's major ICT-related incident reporting framework.

7. Legal Consequences of Failure to Coordinate Major Incidents

A. Regulatory Penalties

Where coordination failures breach applicable regulatory requirements, supervisory authorities may impose sanctions or require corrective measures.

Potential outcomes include:

Administrative fines where legally authorized.

Remediation directions.

Enhanced supervisory monitoring.

Restrictions on certain activities.

Governance and control improvement requirements.

The precise powers and penalties vary by regulator and jurisdiction.

B. Civil Liability

Affected customers or contractual counterparties may pursue claims where the legal requirements are established.

Possible causes of action include negligence, breach of contract, breach of statutory duty where actionable, and deficiency in service.

Example:

A bank detects a serious payment processing malfunction, but its incident response teams fail to communicate the issue to relevant operational units.

Transactions continue to be incorrectly processed, and affected customers incur avoidable charges.

Depending on applicable law, customers may seek reversal of unauthorized or erroneous debits, reimbursement of charges, damages, or other remedies.

C. Contractual Liability

Poor coordination may violate obligations contained in service-level agreements or outsourcing contracts.

For instance, a payment service provider may be contractually required to notify a bank of critical incidents within a specified period.

Failure to satisfy that obligation could lead to contractual remedies.

D. Data Protection Liability

Where coordination failures concern a personal data breach, organizations may also face data protection investigations and potential sanctions.

Relevant issues include:

Whether appropriate security measures were maintained.

Whether the breach was correctly assessed.

Whether notification requirements applied.

Whether notification occurred within the required period.

Whether affected individuals were properly informed where legally required.

E. Management Accountability

Major incidents may expose weaknesses in governance and oversight.

Depending on the applicable regime, failures by senior management or responsible officers may lead to supervisory consequences.

Individual liability is not automatic and must have a specific legal basis.

8. Common Causes of Incident Coordination Failure

9. Requirements for Establishing Legal Liability

A coordination failure does not automatically result in compensation.

The following matters are usually relevant in determining civil liability:

1. Existence of a legal duty

The claimant must identify a contractual, statutory, tortious, or other legally enforceable obligation.

2. Breach of that duty

Evidence must establish that the institution failed to comply with the applicable standard or requirement.

3. Causation

The claimant must establish the required causal connection between the failure and the alleged harm.

4. Legally recoverable loss

The claimed loss must be recoverable under the relevant legal framework.

5. Available defenses and limitations

These may include contractual limitations, statutory defenses, applicable causation principles, and other jurisdiction-specific considerations.

For regulatory enforcement, the elements may differ. A regulator may act on a breach of mandatory governance or incident-management requirements without proving that an individual customer suffered compensable loss.

10. Preventive Measures and Compliance Requirements

Financial institutions can reduce incident coordination failures through an integrated operational resilience framework.

A. Establish a Major Incident Management Policy

The organization should define:

What constitutes a major incident.

Incident classification procedures.

Escalation thresholds.

Responsible decision-makers.

Communication channels.

Recovery priorities.

Documentation requirements.

B. Create an Incident Response Team

A designated response structure should include representatives of cybersecurity, IT operations, legal, compliance, risk management, and relevant business functions.

C. Implement Clear Escalation Procedures

Critical incidents should be promptly escalated to responsible management and applicable external authorities.

D. Maintain Business Continuity and Disaster Recovery Plans

Financial institutions should establish and test continuity arrangements appropriate to the importance of their services.

E. Coordinate with Third-Party Providers

Outsourcing contracts should specify reporting responsibilities, incident cooperation, recovery obligations, and access to relevant information.

F. Maintain Accurate Records

Institutions should retain appropriate evidence of incident identification, decisions, communications, remedial actions, and recovery measures.

G. Conduct Post-Incident Reviews

After a major incident, institutions should examine whether:

Response actions were timely.

Responsibilities were clearly assigned.

Communication mechanisms operated effectively.

Technical recovery procedures were adequate.

Regulatory notification duties were satisfied.

Corrective actions were implemented.

These reviews can support continuous improvement and demonstrate accountability.

11. Practical Legal Illustration

Hypothetical scenario: Major Payment System Failure

A financial institution experiences an unexpected payment processing disruption.

Its technology department identifies a critical defect, but the incident management team fails to notify payment operations.

Meanwhile, the customer support department continues assuring customers that payment processing is functioning normally.

The disruption causes duplicate payment attempts, incorrectly recorded balances, and delayed settlements.

Potential legal issues:

Whether the institution breached a duty to provide services with reasonable care.

Whether its internal incident management arrangements satisfied applicable regulatory requirements.

Whether customers suffered recoverable losses attributable to the failures.

Whether the institution complied with mandatory incident reporting obligations.

Whether outsourcing providers fulfilled their contractual responsibilities.

Whether senior management maintained appropriate governance arrangements.

Possible outcome:

If the evidence establishes a relevant breach and the necessary elements of civil liability, affected customers may obtain appropriate remedies.

Separately, a regulator may investigate deficiencies in incident management or operational resilience.

The outcome would depend on the particular jurisdiction, contractual arrangements, regulatory requirements, and evidence.

12. Conclusion

Failure to Coordinate Actions During Major Incidents is an important issue in banking law, financial regulation, cybersecurity compliance, and operational risk management.

It occurs when organizations fail to manage the interaction between responsible teams, external service providers, decision-makers, and regulatory authorities during significant disruptions.

Such failures can increase financial losses, prolong service interruptions, weaken customer protection, and expose institutions to contractual, civil, or regulatory consequences.

The most relevant principles emerge from several areas of law:

Donoghue v Stevenson and Caparo Industries v Dickman illustrate foundational principles concerning duties of care.

Barclays Bank v Quincecare and Philipp v Barclays Bank address the boundaries of banking duties in potentially fraudulent payment situations.

Canara Bank v Canara Sales Corporation explains the legal significance of unauthorized payment instructions under Indian banking law.

Various Claimants v WM Morrison Supermarkets plc addresses limits on employer vicarious liability for malicious employee conduct.

DORA Regulation (EU) 2022/2554 provides a particularly direct regulatory framework for coordinating responses to major ICT-related incidents in covered European financial institutions.

Ultimately, legal responsibility depends not simply on the occurrence of a major incident, but on whether the institution complied with its applicable duties before, during, and after the disruption.

An effective incident management framework must therefore combine clear accountability, timely communication, coordinated response measures, adequate documentation, and legally compliant recovery procedures.

Research note: The cases above include direct banking authorities and broader analogous decisions. They should not all be treated as precedents specifically concerning major-incident coordination. This explanation is based on established legal principles; current amendments and case-law developments have not been independently verified through live legal databases.