HSBC UK Bank Plc · DRN-5814892

The complaint Mr C holds an account with HSBC UK Bank Plc trading as ‘first direct’ (HSBC). He made a payment from this account to buy an investment he now believes to have been the subject of an Authorised Push Payment scam (APP Scam). At the relevant time, HSBC was a signatory of a voluntary scam reimbursement code, under which it had committed to reimburse most customers who made a payment as the result of an APP Scam. Mr C complains that HSBC will not reimburse him. Mr C is being represented in his complaint. For ease, I will treat any submissions from Mr C and his representative as being one and the same and attribute them to Mr C throughout. What happened Mr C’s complaint relates to a CHAPS transfer of £350,000 that Mr C made from his HSBC current account on 20 November 2019. The intended investment was in the form of what is often referred to as a mini-bond.1 Mr C had selected this specific investment from a list of similar opportunities shown on a ‘business angel’ investment website. The payment Mr C made was intended to provide loan funding for a purportedly legitimate property development project. This would yield a return of 15%. The duration of the investment was to be approximately one year, with the capital being returned at the end of that term. The recipient of Mr C’s payment was a company I will refer to as “Company P”. 1 It may be helpful to give a brief overview of what I mean by the term mini-bond. Mini-bonds represent a loan made to what will often be a small or newly formed business. Businesses issuing mini-bonds won’t necessarily require authorisation by the FCA, although the FCA has rules regarding the promotion of mini-bonds to investors. Importantly, there is normally no protection against default by the mini-bond issuer. If the underlying business fails, or is otherwise unable to repay the loaned funds, the investor risks losing all of their capital. A small or newly formed business might be assumed to have a greater than average risk of financial difficulty or failure, all else being equal. For these reasons, mini-bonds are generally viewed as a higher risk investment — there is a non- trivial risk of losing the invested capital in a situation where the borrower defaults. Correspondingly, an investor might reasonably expect a higher rate of return in compensation for that risk of default. Of course, in the event an investor was deceived into investing into a mini-bond that was a sham or forgery, or where the underlying company was set up without any legitimate intent, the result for an investor could also be the loss of their invested capital. Superficially at least, the end result for the investor might appear similar to default on the debt by a legitimate company.

-- 1 of 51 --

Mr C explains he has prior investment experience. He had carried out appropriate due diligence before making the investment. Based on his research and queries, he was satisfied that the project he was lending to would be profitable. Amongst other things, Mr C says he: - was shown a full appraisal carried out by a quantity surveyor; - was invited to view the property development, either in person or on a live video stream; - was invited to meet the Chief Executive Officer (CEO) of one of the project sponsors; - was living near the development site, so was able to assess the project in the context of the local property market; and, - was provided by Company P with an Investment Memorandum (which I will refer to in what follows as “the IM”). In December 2019, the month after his payment, Mr C received a payment back from Company P totalling £52,500 — a sum representing the payment in advance of the 15% return. This early return on the investment was as Mr C expected. He’d been told this was part of Company P’s marketing approach. Subsequently, the development project was delayed. Mr C’s loan was not repaid at the one-year mark. Company P blamed the impact of the pandemic. The work was belatedly completed in 2021, and the majority of the developed properties were sold soon after. However, despite the sale of the developed properties, Mr C has been unable to recoup his investment capital. In November 2021, Company P entered administration. Various other projects linked to Company P also entered administration or liquidation at that time or shortly afterwards. A firm was appointed to act in the administration of Company P (I will refer to this initial administrator as ‘Administrator A’). Administrator A was later replaced by court order in March 2022, with the appointment of joint administrators (hereafter ‘Administrator B’). Administrator B indicates that the assets of Company P are unlikely to cover the repayment of unsecured creditors (such as Mr C). Mr C therefore faces a significant loss from what he’d had reason to believe would be a profitable investment. On 4 January 2022, HSBC wrote to Mr C stating that “as part of our normal security checks, we found a potential issue with a payment you authorised for £350,000 on 20-Nov-2019. Based on the information we have, you may have been the victim of an authorised push payment scam". HSBC hasn’t confirmed what prompted this step. I’m aware from my general familiarity with complaints of this kind that such communications are often prompted by reports of a scam received from other customers who’d paid the same payee. Mr C responded to HSBC the same day, requesting that the bank reimburse him for the payment. He said he had been the victim of an APP Scam.

-- 2 of 51 --

At the relevant time, HSBC was a signatory of the Lending Standard Board’s Contingent Reimbursement Model Code (the “CRM Code”). This was a voluntary code requiring signatory firms to reimburse victims of APP Scams in all but a limited set of circumstances. The terms of the CRM Code are available from the Lending Standards Board. After HSBC had reviewed Mr C’s claim for reimbursement, it wrote to him saying it didn’t think he had been the victim of an APP Scam. Rather, the bank said Mr C had a private civil dispute with Company P. The CRM Code did not apply to private civil disputes and so the CRM Code was not applicable to Mr C’s payment. HSBC said Mr C would need to raise the financial loss he’d incurred directly with Company P’s administrators. Referral to the Financial Ombudsman Service Mr C didn’t accept HSBC’s decision. He referred his complaint about HSBC to the Financial Ombudsman Service. He didn’t believe Company P had been operating legitimately. This was based in part on information shared with him by Administrators A and B. In summary, Mr C said: - Contrary to what had been stated in the IM, he strongly suspected neither project sponsor had made an equity investment in the project. That had the effect of removing £1m of capital which would otherwise have acted as a ‘buffer’ to protect investors from any loss on the development (up to that figure). This had been dishonest and exposed investors to much greater risk, a risk he wouldn’t have chosen to accept had he known. - Through the IM and elsewhere, investors had been led to believe no fees would be deducted from their invested funds, yet significant fees appear to have been paid to the project sponsors and as commission. This reduced any potential for the project to be profitable. - Company P had delayed filing accounts at Companies House. Mr C thought this had perhaps been done with the intent of delaying the reporting of the significant fees and commissions Company P appeared to have paid. - Funds were significantly over-raised relative to the amount needed to complete the project, suggesting the intention had been to raise excess funds from private investors for undisclosed purposes. - Company P was under the control of individuals whose involvement had been deliberately concealed. Further, Mr C said these individuals were associated with other schemes now acknowledged to be fraudulent. Their involvement had been hidden to avoid investors being aware of the links they had to previous fraudulent investment schemes. - The material in the IM (and stated through other communications) was deliberately misleading and meant investors could not make a fair assessment of the project or the risks of the investment. - Contrary to what had been promised to investors, other lenders were given precedence as creditors. - The initial administrator was complicit in the fraud and had been engaged by the

-- 3 of 51 --

director of Company P without consulting the investors. No attempt had been made to seek an alternative to administration. Our Investigator considered Mr C’s complaint and the evidence available at that point. The Investigator noted that Administrator B had written to Company P’s creditors in a letter dated 26 October 2022, stating: “The purpose of this letter is to provide information to the creditors of the Companies regarding the affairs of [Company P] and it’s associated investment schemes and substantiate the Joint Administrators’ and the Joint Liquidators’ view that the investment schemes operated by [Company P] were likely intended to defraud investors from the outset by virtue of the investments being mis-sold through the deliberate misrepresentation of aspects which had a material effect on the development projects.” 2 The Investigator contacted Administrator B. Based on the contents of Administrator B’s letter to Company P’s creditors, and having confirmed with Administrator B that they remained of their opinion that the investment scheme had been intended to defraud, she reached the view that this had been an APP Scam, and the CRM Code should apply to Mr C’s payment. She thought that under the terms of the CRM Code, HSBC should reimburse Mr C for his net loss (the payment he’d made less the returns he’d received). She said interest should be added to that sum at the rate of 8% simple per year. Mr C didn’t fully agree with the Investigator’s findings. He thought the initial returns he’d been paid shouldn’t be deducted from the redress he was due. He said the interest award should be at the rate he’d have received had he instead invested in a different property- based investment (rather than the proposed 8% simple interest per year). HSBC also didn’t agree. In summary, it said Administrator B was under a duty to the creditors and could not, in that situation, provide a wholly impartial view about the legitimacy of Company P. The bank was therefore concerned that it appeared the Investigator might have simply adopted the opinion of Administrator B, without having seen or critically analysed the underlying evidence. And HSBC itself had not had the opportunity to see any of the underlying evidence relied on by the Investigator in stating that Company P was operating fraudulently at the point Mr C made his payment (rather than perhaps at some later point in time). The bank also said that the allegations made against Company P were the subject of an ongoing investigation by a statutory body (the police). The outcome of that investigation should be awaited before reaching any decision about the application of the CRM Code. Administrator B subsequently entered into a confidentiality agreement with HSBC which allowed the documents they had provided to the Investigator to be shared with the bank. 2 Throughout this decision, I have provided direct quotations wherever I consider that helps to set out the information and evidence I have been provided with. Whenever quotes have been included, I have set them out verbatim as they were provided to me, albeit anonymised. I have not highlighted any grammatical or spelling errors (or indeed, corrected any duplicated words, which do occur particularly in the transcript evidence). This has been done with the aim of prioritising the accuracy of those quotes.

-- 4 of 51 --

However, after receiving and reviewing these supporting documents, HSBC said: - it didn’t find there was any material which definitively demonstrated Company P (and the associated investment) was set up to defraud investors; - in particular, much of the documentation provided was dated after Mr C had made his payment, and did not demonstrate that the scheme had been set up from the outset to defraud; - the documents were not clear in showing what was claimed — namely the intent to defraud from the outset of the investments made — and it was all open to interpretation as to the subjective intent of the authors; - even if Mr C’s allegations could be proved (which it maintained this evidence did not achieve) his allegations would still point to a private civil dispute and would not be sufficient to establish that an APP Scam had occurred; - HSBC considered that the outcome of the police investigation might inform the answer to Mr C’s complaint. It might be reasonable to await the outcome of that investigation before reaching a decision, a delay specifically permitted under the version of the CRM Code that had been introduced shortly after its initial response to Mr C’s complaint. Following these disagreements, a second Investigator undertook a review of Mr C’s complaint. 3 He took into consideration HSBC’s further comments and reviewed the information available. He reached a different view to that of the first Investigator. The second Investigator said the evidence available to him didn’t persuade him it was more likely than not that Company P had been fraudulent from the outset (and so at the point that Mr C had made his payment). He didn’t consider HSBC had been wrong to say that Mr C had a private civil dispute with Company P. The CRM Code said an APP scam required the payee’s purposes to have been “in fact fraudulent”, and the Investigator didn’t think the evidence established that Mr C’s payment met that definition. He didn’t think HSBC needed to reimburse Mr C under the CRM Code (or for any other reason). Mr C didn’t agree with this revised outcome. In brief summary, he said: - He believed HSBC and other banks had been allowed to lobby the Investigator and the Financial Ombudsman Service without his being given sight of the arguments being made or being provided an opportunity to respond. This was contrary to the principles of natural justice. - HSBC had previously refunded other investors in the same scheme (as had other banks). That position should be applied in respect of his complaint. To do otherwise would be inconsistent. 3 Where the original case-handler is unable to continue their work on any given complaint (for example, where that individual has left the organisation - as happened here) then it is the usual process of the Financial Ombudsman Service that a new investigator will be assigned to take over the case-handling responsibility for that complaint. A second investigator reviewing the evidence might well reach different findings, if there is new evidence or argument, or where the evidence is not conclusive, is complex or is finely balanced. That being said, either party to the complaint has the opportunity to escalate matters to an Ombudsman for fresh review and determination if they disagree with the Investigator’s findings. This is an integral part of our two-stage process, and what has happened in this case.

-- 5 of 51 --

- HSBC and other banks had changed their positions with the intent of denying the reimbursement that should otherwise be due to him and to other victims of Company P. - The commencement of police investigations into Company P had prompted HSBC and those other banks to change their arguments. - Strictly speaking, the ‘purpose’ of a payment could never be anything other than transferring money from one person to another. The Investigator had improperly expanded this meaning in his analysis, resulting in a contorted framing of the CRM Code’s wording. The Investigator accepted that information might later come to light which could change his view. But, he said based on what was available to him at that point he couldn’t justifiably conclude this had been an APP Scam. So, the CRM Code did not apply to Mr C’s payment. The Investigator had not been lobbied by HSBC or other banks, except in so far as he had seen HSBC’s response to the first Investigator’s opinion (that response has since been shared with Mr C). Mr C has subsequently made substantial further submissions, addressing both the specific scheme he’d invested in, and later projects undertaken by connected companies sharing a common director. In summary, Mr C said: - The Investigator and the Financial Ombudsman Service had incorrectly interpreted the application of the CRM Code, in particular the meaning of the phrase “purposes … which were … fraudulent”. - The views of the Investigator and Financial Ombudsman Service had incorrectly been allowed to prevail over those of the police, administrators, and liquidators. - The IM and sales methods used to promote the investment had similarities to another suspected fraudulent scheme. - The IM had misrepresented several factors, including: the persons managing the fund-raising and the property development; the amount of investment raised by the project funding company; the amount of “mezzanine funding” to be paid through the project funding company into the project development company; the security taken by the project funding company over funds lent to the project development company and others; the use of the monies in the development schemes; and, that there would be no commissions or other fees paid from investor funds. - Other representations made were false: the controlling minds (or shadow directors) of the project companies did not create any equity buffer in the project funding company — contrary to what had been represented to investors. Instead, the shadow directors had caused the schemes to pay commissions and other extraneous payments and caused the project funding companies to massively exceed the specified level of borrowing from loan note (mini-bond) holders. - The shadow directors had later subordinated the security of loan note holders. - The controlling minds of the companies involved had intended to engineer an exit to the fraud by initially appointing an administrator (Administrator A) whose conduct

-- 6 of 51 --

was now under investigation by the appropriate regulatory body. That administrator was someone with whom the controlling minds had a prior relationship. - This had been a deliberate fraud. The scope of the CRM Code ought to include this case. That would reflect the intentions behind the code’s creation. In relation to the police’s view of the matter, Mr C said he had met with the relevant force, receiving written confirmation that the police firmly held the view that a crime had been committed (although they were not pursuing the matter further). Both parties were then given sight of each other’s submissions. In response, Mr C made further points summarised as follows: - HSBC was wrong in its contention that the CRM Code does not apply in the circumstances of a sophisticated, but fraudulent, property investment scheme. - He questioned whether HSBC’s arguments were contradictory: in arguing that for the purpose of the application of the CRM Code this scheme was not fraudulent, while simultaneously arguing that for the purpose of one of the reimbursement exceptions to the CRM Code, a well-informed person could not reasonably have believed the scheme legitimate. - HSBC had suggested the evidence did not “definitively” demonstrate the alleged fraud, yet this was the incorrect test to apply. The Ombudsman was merely required to establish the facts based on the balance of probabilities. - Administrator B had now produced a second report (their supplementary report) which clearly demonstrated on the balance of probabilities that the controlling minds behind the schemes dishonestly intended to cause loss or expose investors to a risk of loss. - Both the first and second reports produced by Administrator B indicated that the intentions of the controlling minds had been fraudulent from beginning to end. - Administrator B had relied on sufficient and reliable contemporaneous evidence in collating those reports. - The Ombudsman should give full weight to Administrator B’s first and second reports which together clearly demonstrated that, on the facts, the payee’s purposes were more likely than not to be fraudulent. - The Ombudsman should also give full weight to the information obtained from the police. - He provided information relating to those individuals he considers were the controlling minds behind Company P — specifically that they have now been convicted of fraud-related offences connected to another investment scheme. - He said the CRM Code should apply and none of the exceptions to reimbursement under the CRM Code applied. HSBC had not provided credible evidence or argument to the contrary.

-- 7 of 51 --

HSBC also responded further, saying: - There remained no evidence to support a conclusion that Company P had intended to defraud Mr C at the time of his payment. Most of the material relied on was dated after the point that Mr C had made his payment, in some cases over a year afterwards. - The function of a joint administrator/liquidator is to realise the assets of a company with a view to maximising the returns to creditors (such as Mr C). It is not to determine whether a voluntary code signed up to by banks is engaged, or to argue the case it does. - It was clear Mr C was considering civil remedies, and HSBC remained of the view that this was a private civil dispute. - This had been a sophisticated property investment scheme where the property development had in fact existed. - Without contemporaneous supporting documentation it could not be concluded that Company P intended to defraud Mr C when he made his payment. The same held true for payments made by any other individual investor. - Administrator B’s first and second reports rely on events significantly post-dating Mr C’s payment, or otherwise unrelated to the relevant investment schemes. - Those reports comprehensively described misrepresentations which could form the basis for a civil claim against Company P or the directors. The CRM Code should not be contorted in an effort to make it fit such a case. - Mr C (and other investors) should focus their efforts on pursuing the other avenues available rather than looking to their banks to compensate them. In light of the disagreement between both sides to the dispute, I was asked to review everything afresh and reach a decision on the matter. Further information gathering efforts Correspondence (shared by Mr C) indicates that the police investigation into Company P’s de jure director has resulted in a decision to take no further action at present. While the police state their belief that a crime was committed, the nature of that crime is not specified, nor the point in time at which it is believed by the police to have occurred. It does not appear any charges were brought (or are planned to be brought) against Company P’s de jure director. We contacted the police force that was investigating this matter and Administrator B − in both instances asking if any information could be shared with us about their investigations, and if any conclusions had been reached that might be of aid in determining whether or not Mr C (and other investors) had been the subject of an APP Scam. Specifically, we asked the police about the status of their investigation and what evidence they could provide to the Financial Ombudsman Service. They responded that, despite considering a crime was committed, and despite believing that investors in Company P had been the victims of crime, the criminal investigation had been closed. The police had co- operated with the Serious Fraud Office, which was investigating a different investment

-- 8 of 51 --

scheme (not Company P but connected). The police had also complied with a High Court order to provide seized material to Administrator B. The police were unable to disclose anything to the Financial Ombudsman Service beyond this. We also made extensive enquiries of Administrator B. They indicated that they’d obtained a substantial quantity of documentary evidence from the police under the court order. They offered to share this information with the Financial Ombudsman Service on the basis of it not being shared by us with the parties to complaints, except in a summary version. Administrator B suggested they would agree the confidentiality of any information to be provided on a category-by-category basis, rather than per document. However, we have reviewed the court order which compelled the police to provide the documents they had seized to Administrator B, and it does not allow the further sharing of information in the way offered by Administrator B. We have concluded, having obtained privileged advice from Leading Counsel, that the Financial Ombudsman Service isn’t at liberty to receive these documents from Administrator B or process the personal data that they contain, and have refused the offer. Even if it had been possible to obtain and use the information in the way Administrator B proposed, the restriction they sought would require only a summary (or edited version) to be provided to the parties to this complaint. Given the complexities involved in the alleged fraud, I consider it would be necessary in the interests of fairness to allow both parties sight of the actual evidence in favour or against fraud and APP Scam. So, it would have been inappropriate to accept the documents on the restricted basis they were then being offered by Administrator B. This presented something of an impasse. However, another avenue was ultimately suggested by Administrator B. Company P’s de jure director had been made bankrupt and his trustees in bankruptcy (‘the Trustees’) had been independently allowed access to the same electronic files that Administrator B had obtained through the court order. The Trustees were in a position to share the information the director’s devices contained, and would do so without imposing the restrictions on the Financial Ombudsman Service that had been required by Administrator B. After contacting the Trustees, we have now been provided with a significant quantity of information from the files they hold. This includes information from the period leading up to the payment Mr C made to Company P, which was previously not available to me. I understand that the Trustees have omitted files of a purely personal nature recovered from the director’s devices and provided those relating to Company P where these might touch on the question of fraud. The Trustees have given their consent to the information being used and shared as necessary for the purposes of my review of this complaint, without restriction. Having had the opportunity to review the new material provided by the Trustees, I issued my provisional findings on the merits of Mr C’s complaint in my provisional decision dated 8 August 2025. In my provisional findings I explained why I intended to uphold Mr C’s complaint in part and offered both sides the opportunity to submit further evidence or arguments in response.

-- 9 of 51 --

An extract of that decision is set out below and forms part of this final decision. In deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant law and regulations, regulators’ rules, guidance and standards, codes of practice; and, where appropriate, what I consider to be good industry practice at the time. Where the evidence is incomplete or missing, I make my findings based on the balance of probabilities — in other words what I consider is most likely given the information available to me. In this case the evidence available to me and the arguments made by the parties to the complaint are substantial and detailed. I’m very aware that I’ve summarised this complaint and the relevant submissions briefly, in much less detail than has been provided, and in my own words. No discourtesy is intended by this. Instead, I’ve focussed on what I think is the heart of the matter here. As a consequence, if there’s something I’ve not mentioned, it isn’t because I’ve ignored it — I haven’t. I’m satisfied I don’t need to comment on every individual point or argument to be able to reach what I consider is a fair outcome. Our rules allow me to do this, reflecting the informal nature of our service as an alternative to the courts. And as such, the purpose of this provisional decision isn’t to address every single point raised. My role is to consider the evidence presented by the parties to this complaint, and reach what I think is an independent, fair and reasonable decision, based on what I find to be the facts of the case. Mr C and his representative have asked me to provide any statements submitted by experts that I have relied on, or any submissions from interested parties including UK Finance (a banking industry trade body). For the avoidance of doubt, I have not relied on expert submissions, and HSBC has not made specific representations to me about the interpretation of the scope of the CRM Code, other than those that have already been provided to Mr C as part of HSBC’s responses to the Investigators’ views. Neither has UK Finance made any such representations to me. As a starting point, I will explain what I can and what I cannot consider, as delimited by the rules that govern the operation of the Financial Ombudsman Service. The complaint brought against HSBC, and the ancillary considerations, fall within the scope of my jurisdiction to consider. However, the company in which Mr C was investing was not one regulated by the FCA. It is not one I have the power to consider a complaint against. Or, if Mr C had obtained regulated financial advice about his decision to invest, then a complaint about that advice might be one I could consider. But my understanding is that Mr C did not receive any such advice. I am limited to considering the role of HSBC in this matter. Mr C’s complaint about HSBC consists of two key elements: (i) HSBC ought to have identified that this payment carried a significant risk of financial harm through fraud or a scam and ought to have intervened prior to processing Mr C’s payment instruction. Had HSBC done so, the payment would have been prevented. (ii) HSBC incorrectly declined to reimburse Mr C’s subsequent APP Scam claim under the terms of the CRM Code. Any potential success under either element depends on whether Mr C was victim to a fraud. The first head of complaint additionally depends on it having been reasonably

-- 10 of 51 --

possible for either Mr C or HSBC to have identified this was likely prior to Mr C’s payment instruction being completed. Should HSBC have identified and intervened in Mr C’s payment, and would that have prevented it from being made? Mr C doesn’t dispute that he authorised the relevant CHAPS payment. The starting position under the relevant regulations4 is that Mr C is responsible for payments he’s authorised himself. That being said, fairly and reasonably, taking into account regulators’ rules and guidance, relevant codes of practice, and what I consider to have been good industry practice at the time these payments were made, I think HSBC ought to have been on the lookout for out-of-character and unusual transactions and other indications that its customer might be at risk of financial harm from fraud. The payment in question represented a relatively large sum for Mr C’s account and was being sent to a new payee (a recipient Mr C had never paid before). Of course, a legitimate payment could equally have been for a larger than usual sum and sent to a new payee — these factors need not necessarily mean a payment will result in loss to fraud or a scam. Indeed, HSBC has evidenced previous instances where Mr C had made payments of a similar size (and in some instances larger) from his account. That being said, HSBC’s records appear to show that it did take steps to establish the legitimacy of (or at least obtain further details about) most or all of those earlier payments prior to processing Mr C’s payment instructions. In any event, I consider it at least arguable that this payment instruction ought to have prompted HSBC to intervene prior to processing the payment because of its large size and that it was being made to a new payee. That isn’t enough in itself though for me to find that such an intervention by HSBC would have made a difference here (such as in preventing the payment from being made). I would need to find not only that the bank failed to intervene where it ought reasonably to have done so, but also — crucially — I’d need to find that but for this failure the subsequent loss would have been avoided. That latter element concerns causation. Fairly and reasonably, I could only expect any intervention by a bank in relation to a payment to be proportionate to the perceived risk presented by that payment. And I don’t consider that a proportionate intervention by a bank in relation to a payment will always have the result of preventing the payment. Nor should it. In many instances the initial concerns that prompted the intervention will appear upon enquiry to be unwarranted. And if I find it more likely than not that such a proportionate intervention by the bank wouldn’t have revealed the payment was likely to be part of a fraud or scam, then I couldn’t fairly hold the bank liable for not having prevented it from being made. In thinking about this, I’ve considered what a proportionate intervention by HSBC at the relevant time could reasonably have constituted. I’ve then considered what I believe the most likely result of such an intervention would have been. 4 The Payment Services Regulations 2017.

-- 11 of 51 --

The bank’s primary obligation was to carry out its customers’ instructions without delay. Unless there were reasons for the bank to suspect fraud and warn its customer accordingly, that obligation predominated, and it wasn’t to concern itself with the wisdom or risks of the customer’s payment decision (including the suitability of a proposed investment that its customer had already decided to invest in). What matters is what a proportionate intervention by HSBC — at the point Mr C instructed it to make his payment — could reasonably have been expected to uncover about the legitimacy of Company P and his investment in it. I cannot apply the benefit of hindsight to this finding. I need to consider the information HSBC might have uncovered in the course of a proportionate enquiry to Mr C about the payment at the time he gave that instruction. While Mr C now holds significant concerns about the operation of Company P and the legitimacy of the investment, and while those concerns are now shared by other investors, I must consider what HSBC could reasonably have established in the course of proportionate enquiry to him about his payment back in November 2019. The bank might have noted that the rate of return being offered by Company P was relatively high. That may often be a sign to prompt concerns about the legitimacy of what is being offered. However, here I don’t think it was so high as to be considered too good to be true — either by Mr C or by HSBC. In basic terms, the rate of return (the yield) on a loan or mini-bond will typically vary according to the perceived risks — in particular the default risk. Riskier investments need to offer a higher yield to compensate an investor for bearing the risk that the investment might fail. In other words, a higher than usual rate of return would be expected for a legitimate but risky investment. But that investment risk isn’t at all the same thing as the risk of fraud or scam that I’d expect HSBC to have been alert for. To reiterate, it was not HSBC’s role here to advise Mr C about the apparent level of investment risk or its suitability for his needs. And with this in mind, I don’t consider a rate of return such as that offered by Company P would necessarily show the investment was fraudulent. It might more commonly reflect a legitimate investment risk (as Mr C believed it did at the time, based on his own due diligence). It seems to me there was little else that would have prompted HSBC to have believed this was anything other than a potentially risky but legitimate investment at the time. Mr C had discussed the investment with more than one person involved in the project and been shown persuasive information about the investment. This all appeared to be legitimate. He knew the development site. There does not appear to have been information readily available to HSBC (or to Mr C) at that point which would have prompted either party to have believed this was an APP scam. In short, I don’t think either Mr C or HSBC could reasonably have identified that Company P was likely fraudulent at the time of Mr C’s payment instruction. As a result, I don’t find that any proportionate intervention by HSBC in respect of Mr C’s payment instruction prior to it being made would have resulted in Mr C withdrawing his payment instruction — or stopped that payment from being executed in accordance with Mr C’s wishes at the time. Nor do I find HSBC was at fault in having carried out the payment in line with his instructions. However, at the relevant time, HSBC was a signatory to the voluntary CRM Code which requires the reimbursement of payments made to APP Scams in all but a limited set of circumstances. I will turn now to consider whether HSBC reached a correct outcome

-- 12 of 51 --

under the terms of the CRM Code. The CRM Code The CRM Code, at OP1(2), states that one overarching objective of the code is: “to increase the proportion of Customers protected from the impact of APP scams, both through reimbursement and the reduction of APP scams”. While the CRM Code can provide additional customer protections, it does not apply to all payments. HSBC has committed to follow the requirements of the CRM Code where it applies, but I cannot require HSBC to go beyond what the code dictates, for example by applying a higher standard than HSBC voluntarily agreed to as a signatory to this code. In broad terms, the CRM Code requires the victims of APP scams to be reimbursed in all but limited circumstances. In the present case, the dispute around whether Mr C’s payment was made as the result of an APP scam, and not a private civil dispute, will determine whether the CRM Code applies. Therefore, the issue I need to decide is whether Mr C has been the victim of an APP scam, such that it was unfair for HSBC to decline to reimburse the losses he incurred as a result of his payment to Company P. At Section R1, the CRM Code says: “Subject to R2, when a Customer has been the victim of an APP scam Firms should reimburse the Customer.” 5 For the purposes of this complaint, it is the definition of an APP Scam in the CRM Code which is applicable. Section DS1(2)(a) defines an APP Scam as: “APP Scam Authorised Push Payment scam, that is, a transfer of funds executed across Faster Payments, CHAPS or an internal book transfer, authorised by a Customer in accordance with regulation 67 of the PSRs, where: (i) The Customer intended to transfer funds to another person, but was instead deceived into transferring the funds to a different person; or (ii) The Customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent.” DS2(2) of the CRM Code says: “This Code does not apply to: […] (b) private civil disputes, such as where a Customer has paid a legitimate supplier for goods, services, or digital content but has not received them, they are defective in some way, or the Customer is otherwise dissatisfied with the supplier;” 5 R2 lists exceptions to reimbursement which relate to the customer’s actions in making the payment. I will return to R2 later in this decision.

-- 13 of 51 --

The relevant payment was a transfer of funds executed through a CHAPS transfer. Mr C authorised the payment in accordance with the relevant section of the Payment Services Regulations 2017. For the APP Scam definition to be met, either sub- paragraph (i) or (ii) of the definition must also be true (but not necessarily both). There has been no allegation that Mr C was deceived into sending funds to a different person than he intended to pay (as might occur, for instance in an email interception scam). His payment was made to Company P, and that was the payee he had intended. Therefore DS1(2)(a)(i) isn’t applicable. Turning to DS1(2)(a)(ii) requires me to consider the purposes of the payment. The CRM Code is defined in relation to a payment transaction (the transfer) and contrasts the purposes of that payment from the perspectives of the payer and the payee. The relevant point in time is the time of the payment. For DS1(2)(a)(ii) to apply, the payer must have believed they were transferring money for legitimate purposes, when the payee’s purposes for obtaining the payment were in fact fraudulent. The CRM Code contrasts this against ‘private civil disputes’ which can include scenarios where a customer has paid a legitimate supplier, even when they did not receive what they paid for or where they have some other cause of dissatisfaction. I conclude that if the dispute about the payment is one that could properly be pursued in court only by way of a civil claim, no crime being involved, the matter would be a ‘private civil dispute’ and not an ‘APP scam’, as defined. Bearing that in mind, I consider that the difference in purposes inherent in DS1(2)(a)(ii) can only arise through deliberate and dishonest deception on behalf of the payee, which must have related to the purposes of the payment. So, for this to be an APP Scam to which the CRM Code can apply, I must find that the following is true on the balance of probabilities, given the evidence made available to me: 1. Mr C must have believed that the purposes for which he made his payment were legitimate; and, 2. Company P’s purposes for procuring Mr C’s payment were in fact fraudulent. I will go on to consider each point in turn, but firstly I will address the nature of HSBC’s later responses to Mr C’s claim against the CRM Code. Is HSBC entitled to delay the outcome of Mr C’s claim under the CRM Code? HSBC initially contended that Mr C’s claim concerned a private civil matter between him and Company P, so fell outside the CRM Code in accordance with section DS2(2)(b). It therefore declined to reimburse him. In April 2022, the CRM Code was amended to include an additional term, R3(1)(c), stating: “If a case is subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision.” HSBC says it remains of the view that the matter is a private civil dispute, and so excluded by the CRM Code, but also wishes to rely on clause R3(1)(c) as a reason to

-- 14 of 51 --

delay in reaching a decision on Mr C’s case. Mr C argues HSBC cannot apply this provision. I have considered whether HSBC proposes a proper application of the CRM Code. I think there are two fundamental obstacles to HSBC’s wish to apply R3(1)(c). Firstly, Mr C’s claim and HSBC’s response to that claim pre-date the introduction of R3(1)(c) to the wording of the CRM Code. As a starting point under the CRM Code as it stood at the relevant time, HSBC had to give an answer to Mr C’s claim, and it could not choose to delay in doing so. Secondly, the effect of the clause is to permit (in some circumstances) a firm to delay reaching a decision about whether it is required to reimburse under the CRM Code. Here, HSBC has already reached a decision on that point. It did so when it declined to reimburse Mr C’s claim. HSBC did so even though it said the CRM Code did not apply to Mr C’s payment. That decision required HSBC to assess the applicability of the CRM Code to his payment by considering the circumstances of his claim against the provisions of the CRM Code, including those quoted above. That was HSBC’s reason for not reimbursing, and that was the decision it gave Mr C about whether it would reimburse him under the terms of the CRM Code. Once HSBC had reached that decision, the clause would have had no possible application. As a result, I would consider HSBC could not have relied on the relevant clause even if it had been part of the CRM Code at the time HSBC considered Mr C’s claim (which of course, it was not). In any event (and even were I to have found differently on either of these two points) it does not appear that there is now any active police investigation. And I am unaware of ongoing investigation into Company P by any other statutory body. For these reasons, I do not find HSBC can apply this provision to delay the resolution of Mr C’s claim. Mr C’s purposes in making this payment Returning to the wording of DS1(2)(a)(ii), it requires firstly that I establish what Mr C understood to be the purposes of his payment — and specifically, at the time Mr C gave HSBC the payment instruction. In Mr C’s initial complaint to HSBC he indicated he made the payment for what he: “believed was a legitimate purpose, but which may in fact have been fraudulent”. He goes on to say: “The circumstances of the APP Fraud relate to the financing of a purportedly legitimate property development project [...] I believed that I was transferring funds […] for that purpose”. Mr C has latterly sought to relate the purpose of his payment to simply making a transfer of money to another person. Alternately, he says his purpose was the making of an investment — with the point of any investment being to make a return on that investment.

-- 15 of 51 --

I don’t disagree that Mr C would only have rationally invested in something he believed at least had some prospect of proving financially beneficial. And I of course agree that in making this payment he intended to transfer funds to another person. But I find these characterisations of his purposes to be too narrow. Mr C was not investing in an anonymous project or something entirely abstract, and the transfer was being made to a specific investment scheme. Mr C had chosen this investment from a much broader selection of options. In making the payment he did, Mr C knew what the investment was purported to entail, and I consider that the very nature of what he expected the investment to entail was inextricably linked to the returns he hoped to achieve. His own enquiries prior to entering the investment reflect that motivation. Applying the balance of probabilities to the evidence available to me, I find it most likely that Mr C made his payment with the purpose of property development financing (as had been explained to him in the IM), and with the further purpose of receiving back the interest and principal payable to him by the mini-bond. These seem to me to have been entirely legitimate purposes. In short, I am satisfied that Mr C transferred his money for what he believed were legitimate purposes. Assessing if the payee’s purposes were fraudulent The CRM Code doesn’t provide a definition of “fraudulent” purposes. I consider, as such, these words ought to get their natural meaning in the context in which they are being used. Having thought carefully about that, I’m satisfied that DS1(2)(a)(ii) will apply where a customer was dishonestly deceived as to the purposes for which their payment was being obtained. Section DS2(2) implies that a dispute which could only be pursued in the civil courts as a private claim isn’t an APP Scam. To take the matter beyond a mere private civil dispute between the parties, there must have been a crime committed against the payer in fraudulently obtaining their payment for purposes other than the legitimate purpose for which the payer believed the payment was being made. I consider that the distinguishing feature of an APP Scam, as opposed to a private civil dispute, is that the payment was procured for reasons arising from criminality — and requiring criminal intent — rather than under circumstances which could only give rise to a civil dispute between the parties to the payment. That doesn’t mean that a person claiming reimbursement under the Code needs to meet the criminal standard of proof (“beyond reasonable doubt”). Indeed, the Code’s publisher, the Lending Standards Board has provided guidance that the criminal test (or criminal conviction) is unnecessary to reach a reimbursement decision, and that where it is more likely than not that a customer has fallen victim to an APP scam a reimbursement decision should be made. And it’s worth observing here that the relevant version of the CRM Code at R4(1), R4(2), R4(3) and R4(4) refers to the right of the customer to make a DISP complaint and that they have the ability to raise a case with the Financial Ombudsman Service should they wish to or need to. In line with the general approach of our service when deciding complaints that are referred to us, I only need to be persuaded on the balance of probabilities, the same standard of proof that is required in civil cases.

-- 16 of 51 --

In short, the requirement to reimburse under the CRM Code requires a customer to have been the victim of an APP Scam, and whether an APP Scam occurred can be determined on the balance of probabilities. In Mr C’s case, I would need to find persuasive evidence to convince me it is more likely than not that the purposes for which Mr C’s payment was procured by the payee were, in fact, fraudulent. The above being said, and with DS2(2) in mind, it seems to me that a later failure in some way of the payer’s ‘purposes’ for the transaction — for example, the subsequent failure of an investment to pay the due returns — would not in itself engage DS1(2)(a)(ii). Even were that later failure to have resulted from fraud, for there to be ‘fraudulent purposes’ (as opposed to legitimate purposes) at the time of the payment, the fraud must bear on the purposes for which the payment was procured, and fraudulent intent must have been present at the time that payment was made. So, there may be situations where a fraud occurred, but which fall outside the definition of APP Scam under the CRM Code. This might be so either because the fraud had no bearing on the purposes of the payment or because the fraud only began after the payment had been made. And of course, I don’t have the power to conduct a police-style criminal investigation into Company P. My determination of this complaint can’t convict anyone of a criminal offence — that is the role of the criminal courts. I have to decide only whether it is fair and reasonable for HSBC not to have upheld Mr C’s claim for reimbursement of his losses, applying the balance of probabilities. Were there fraudulent misrepresentations made in respect of the investments offered in Company P? Some of the arguments advanced by Mr C to demonstrate his allegations of fraud relate to steps taken by Company P after Mr C had invested. In this category, for example, I would include the later subordination of private investors’ security and the appointment of the initial administrator. It is not impossible that these later actions reflect earlier fraudulent intentions and that such intentions were present at the time he made his payment. But more relevant will be events and evidence from prior to Mr C’s payment. I consider that later events or evidence are only helpful if, and in so far as, they might help illuminate the intentions behind what happened earlier. Of particular importance when considering events at the time of Mr C’s payment, I have taken into consideration Mr C’s allegation that Company P made several key misrepresentations. Had these misrepresentations not occurred he says he would not have invested. He believes these misrepresentations were fraudulent. I understand these allegations, in large part but not solely, refer to what was represented in the Investment Memorandum document (the ‘IM’). Mr C has provided a copy of this IM document, given to him by Company P prior to his investment. On page three of the IM, one of Company P’s two de jure directors makes some opening remarks. He begins by describing Company P’s “latest development offering” 6 . 6 Company P had not started or completed any other developments prior to this one. Arguably, the word ‘latest’, in itself, appears intended to suggest otherwise.

-- 17 of 51 --

This was the development project Mr C was considering investing in. In what follows, I will refer to this development project as Development RP. Besides what was stated in the IM, Mr C has referred to what he says he saw on Company P’s website at the time, and the records provided to Companies House by Company P.7 In considering these alleged misrepresentations, I will group them (for clarity) under five headings. Namely, Company P represented to investors: 1. That it was managed by persons other than those who really controlled it (‘who controlled Company P’). 2. That investors had the protection of an equity buffer (‘the equity buffer’). 3. A false picture of Company P’s costs, specifically Company P’s need to pay significant commissions and/or fees (‘commissions and fees’). 4. A significant understatement of the private investor funds that Company P intended to raise (‘the over-raise’). 5. A false impression of the feasibility of Company P being profitable, or of the private creditors being repaid (‘profitability’). I will firstly address what was stated by Company P in relation to these aspects of the investment, before addressing whether these were misrepresentations. I will consider if the evidence I have been provided with shows that some or all of the above representations were false and known to be such by Company P at the time they were made. Given the circumstances of this alleged scam, it seems to me that a key element will be to establish which individual’s (or individuals’) knowledge and intentions can be correctly identified as those of Company P — and what that knowledge and intent was at the time Mr C made his payment. 1) Who controlled Company P — and was this misrepresented? The Companies House entry for Company P records two company directors at the relevant time, whom I’ll refer to as the ‘de jure directors’. Their appointment dates overlap. The initial de jure director’s appointment spanned from the incorporation of Company P on 18 April 2019 to their resignation on 31 December 2019. At the date of incorporation, that individual is also recorded as being the sole shareholder. The second de jure director was appointed on 11 July 2019. From this date the Companies House records show that this individual was listed as the sole person with significant control over Company P and became the sole shareholder. Where I need to refer to this person individually, I will refer to them as ‘de jure Director P’. De jure Director P was the individual appearing in the IM, with the job title of “CEO”. 7 I recognise that Mr C has referred to yet further sources besides the IM, Companies House and Company P’s website. However, in what follows, I will focus on these three. For the avoidance of doubt, there is nothing I have found in those other sources which might lead me to any different conclusions.

-- 18 of 51 --

I understand that at the time of Mr C’s payment, he was able to view Company P’s website (which has since been taken down). Mr C has provided a screenshot of a webpage titled “Meet The Team”. This shows a photo of de jure Director P, above his name and the title “CEO — [Company P]”. In this screenshot, six other individuals appear in a list below the CEO, with smaller photos, and roles ranging from administration to client services, and a “Managing Director GCC Region”. All of this evidence (the IM, the records on Companies House and the website screenshot) is consistent in representing de jure Director P as the Chief Executive Officer of Company P. Aside from the initial de jure director (who relinquished her shareholding and ceased to be recorded as a person with significant control in July 2019 — several months prior to Mr C’s investment) no other persons are identified in the material as having significant control over Company P. However, the evidence I have now been provided by the Trustees persuades me that the true picture is quite different. That evidence includes email discussions concerning the setting up of Company P (at that point under a different limited company name). Specifically, in an email dated 28 August 2019, one individual (who is not either of the two de jure directors) discusses the structure of control for Company P. I’ll refer to the writer of this email as Person J. Person J’s email lists seven individuals who will form a “board of directors”, plus an eighth whose “input would of course as agreed be taken on board and highly valued […] The 8 of us make a seriously strong team”. The existence of such a board of directors is commented on in other email correspondence I have been provided with. Throughout the email exchanges in 2019 and subsequently8 , Person J plays what appears to be a controlling role in key aspects of Company P. 9 These emails show Person J’s role in the authorisation of payments, directing the structuring of the promotional website, specifying how the investments offered through Company P should work, and other key decisions. That included directing what was to be communicated to investors about Company P’s investment offering.10 8 At least until Person J’s arrest (and extradition) on 30 November 2022 for his role in an earlier fraudulent investment scheme. I will return to this later. 9 This happens to the extent that in one email exchange in August 2019, de jure Director P states “I put up my hand to be liable for the company cause I trust you all to make the right decisions to protect me” to which another of the board members reassures him “your not a patsy”. 10 For example, Person J emailed de jure Director P on 11 June 2019 giving feedback on draft content for Company P’s website: “I believe the capital stack graphic on here is wrong. It should demonstrate the security levels alongside each segment. The senior is 'Maximum Security’, as the senior debt has 1st charge, likewise we should place the Mezz (which is actually 'Junior Debt' as is correctly labelled there) due to the secondary charge as also 'Maximum Security' and then the Equity is the developers 'skin in the game' which should be labelled as 'High Risk' to demonstrate the developer has the most to lose. The idea is to demonstrate the low risk/high security position for [Company P’s] investors! The point is we take out the word 'risk' for investors and demonstrate they have the 'Maximum Security' and the developer has the 'High Risk' position. Works in favour of our pitch to punters.” De jure Director P responds: “1) Capital Stack I am confused with this one, the idea originally was to show where our clients would be in the stack. Trying also to put them in the 'Equity' box of course, being equity capital, so not sure how that would fit with what you've said there. If you can knock up on a piece of paper for me mate so I can see what you are thinking. 2) I can work on the other slices no

-- 19 of 51 --

Indeed, in another email dated 28 August 2019, Person J states: “Lets remember, I have driven this for years […] I pushed for [the board members11 ] to be shareholders/partners”. In short, I believe Person J played a role akin to that of a director of Company P — and to the extent I think he was most likely the controlling will and mind of Company P. As Person J was the individual in control of all the aspects of Company P with which I’m concerned, his knowledge and intentions were those of the company. That is because, ultimately, it was his actions that were those of Company P and he was its directing mind and will.12 And, when any of its directors dealing with Company P’s affairs had knowledge that was relevant, that knowledge would also belong to the company. 13 Therefore, representations that were permitted to be made on behalf of Company P which were false and which Person J knew to be false would be a misrepresentation by Company P. Did Company P misrepresent who it was controlled by? As I have covered above, I consider that Person J had dominant control over Company P (not the two de jure Directors, or the covert board). Despite this, the control of Company P is not represented as such in the information provided to private investors. Nor was this reflected in any publicly available information at the time. Person J is not listed as a director of Company P, nor as a person with significant control over Company P on the Companies House records. Person J does not ever appear to have been mentioned in investor information such as the IM or emails (or indeed any publicly available information at the time Mr C invested). Instead, the IM portrayed de jure Director P as the Chief Executive Officer of Company P. The IM made no reference to Person J, to the board, or to anyone else as having significant control over Company P. And aside from de jure Director P, none of those listed by Person J as comprising the board of Company P (including Person J themselves) are named on the website screenshot purporting to show ‘the team’. Based on what I have been able to establish, the same applies to other documentation and correspondence issued by Company P to investors at the time. problem”. This suggests to me that de jure Director P is merely implementing the approach directed by Person J with de jure Director P’s role being more one of implementing Person J’s direction in the website design. 11 De jure Director P and all of the others forming ‘the board’ with the exception of one person. I will return to that other individual in what follows and I will subsequently refer to them as ‘Person D’. 12 Halsbury’s Laws, Volume 4, paragraphs 314-5. 13 Jafari-Fini v Skillglass [2007] EWCA Civ 261 at [98], applying MAN Nutzfahrzeuge v Freightliner [2005] EWHC 2347 (Comm).

-- 20 of 51 --

To summarise then, the IM represented de jure Director P as being the individual in control of Company P and this was mirrored in the records Company P lodged with Companies House and (I find most likely) had displayed on its website. But this did not reflect the true picture. With the above in mind, I’m persuaded that the evidence demonstrates on the balance of probabilities that Company P did misrepresent who controlled it. Why did Company P misrepresent who controlled it? This begs the question: given this must have been known to be a misrepresentation by Company P at the time, why was it made? Why was de jure Director P represented as having control of Company P, when I have found that Person J exerted dominant control? Based on the correspondence I have seen between those involved, this appears to have been the result of Person J’s prior involvement with two other companies. In short, this misrepresentation appears to have been necessary as a means of hiding from investors that Company P was actually controlled by a man whose previous business activities had proved disastrous for investors (in connection with some of those previous activities, Person J has since pleaded guilty to criminal fraud charges and is now serving a prison term). In what follows, I will summarise the evidence leading me to this conclusion. Person J and the others forming the de facto board of Company P were all connected to (and appear to have fulfilled roles at) two companies principally operating out of Marbella in Spain. I will refer to those two companies as Group U and Company SC. These two companies appear to have operated principally to sell investments to retail investors. Person J shared control over Group U and Company SC with another individual. In what follows I will refer to this other individual as Person D (and where appropriate, refer to both together as ‘Persons J & D’). Person D was also a member of the Company P board. The prior history of Group U Based on what I have been able to establish, the first constituent company of Group U appears to have been created in 2014. In November 2022, Persons J & D were extradited from Spain to the USA, on criminal charges. These charges were connected to a large-scale, fraudulent investment scheme operated by another company (which I’ll refer to as Company B). Company B had operated from around 2015, until it eventually collapsed in 2017. Group U (under the control of Persons J & D) had sold investments in Company B’s fraudulent scheme.14 14 In a 2024 Times newspaper article, Group U is described as “a notorious Marbella-based boiler room”. ‘Boiler room’ typically refers to high-pressure sales teams selling investments, including (but not limited to) fraudulent schemes. Such ‘boiler rooms’ are typically based outside the UK. General consumer fraud prevention information relating to ‘boiler room’ scams is available here: Boiler room fraud | Action Fraud and on this page: Boiler room scams | FCA. The FCA’s website says “Share and bond scams are often run from 'boiler rooms' where fraudsters cold-call investors offering them worthless, overpriced or even non-existent shares or bonds. Boiler rooms use increasingly

-- 21 of 51 --

The Securities and Exchange Commission (SEC) states that commissions in excess of $2m were paid from Company B to an account controlled in whole (or in part) by Persons J & D. This had been “in exchange for soliciting victims to invest at least approximately $7.5 million in this scheme”. It appears that the commissions paid were approximately 30% of the private investors’ funds Group U procured for Company B. In a press release from 2024, the SEC states: “[Persons J & D] pled guilty to engaging in a conspiracy to defraud victims by making material misrepresentations about the management and operations of a company called [Company B]” “[Persons J & D] partnered with notorious fraudster [name] and used their agent network in Spain to launch a massive Ponzi15 scheme that lured hundreds of unsuspecting investors from around the world, all in exchange for massive commissions.” [Group U] “was a Spanish corporation, with offices in London, U.K., and Marbella, Spain, which served as a master agent for the [Company B] during the Relevant Period. Prior to that, [Group U] functioned as a real estate firm. [Persons J & D] were the principals and owners of [Group U]”. The SEC further stated that Persons J & D had, through Group U, “recruited agents to sell workspace leases in [Company B] and knowingly provided them with fraudulent offering documents and other information.” Persons J & D both pleaded guilty to “wire fraud conspiracy” and were later sentenced, each receiving a seven-year prison term. In part, the fraud related to knowing misrepresentation of the person controlling Company B. A wholly fictitious individual was purported to be the director of Company B. Persons J & D had known the true identity of the person in control of Company B, and so had known that the fake director was just that, a fake. Persons J & D had also known that the fake director was a ruse intended to prevent private investors from identifying the true controlling mind of Company B’s fraudulent investment scheme. sophisticated tactics to approach investors, offering to buy or sell shares in a way that will bring a huge return. But victims are often left out of pocket — sometimes losing all of their savings or even their family home. Even experienced investors have been caught out, with the biggest individual loss recorded by the police being £6m”. In reported court transcripts from the trial of Company B’s founder, owner, and controlling mind, he was questioned about ‘boiler rooms’ he had been involved with. He was asked whether investors had generally received their projected returns — to which he replied that generally they did not. When asked what happened to investors’ money generally, he replied that generally they lost their money. 15 The Practical Law website neatly defines a Ponzi scheme as “A fraudulent investment that is not supported by a legitimate underlying business venture where capital from newly attracted investors is redistributed to pay profits to existing investors. Ponzi schemes usually promise high returns on a principal investment with minimal risk. Initial investors are often paid inflated returns to attract new investors so the earlier investors can get paid. When the new investment flow runs out, the scheme falls apart.”

-- 22 of 51 --

The ruse had been employed because the true controlling mind of Company B had been subject to FCA sanctions in respect of other fraudulent investment schemes. Simply put, the reason for that misrepresentation was that if potential investors had become aware of who actually controlled Company B, they would not have invested.16 In the reported court transcripts of the testimony given by the person who was Company B’s controlling mind, he was questioned about the source of the money used to pay investors any returns they’d received. He explained this had been from new money coming in, from new investors, and so not from profits earned by Company B’s business. He admitted Company B was a Ponzi scheme. To summarise, Person J (and Person D) partnered in an investment that was a Ponzi scheme and where the identity of the person controlling the company was fraudulently misrepresented because that person had previously been convicted in the UK following his involvement in earlier fraudulent investment schemes. As a result of this, Group U had earned commissions of over $2m.17 As I will cover in subsequent sections, this has similarities to the set up and operation of Company P (in other words, the scheme Mr C invested in). The history of Company SC Company SC was set up in July 2016. It appears to have been operated from the same building as Group U (in Marbella, Spain). In an email dated 2 April 2020, Company SC is described as “the broker company headed up by [Persons J & D] and partnered by [five others on Company P’s board].” At the time it was created, and until just prior to the launch of Company P, Company SC operated under the name “[‘S’] Capital Invest SL”. 16 A press release from the US Attorney’s Office of the Southern District of New York dated 28 July 2020 states: “In order to conceal his role at [Company B] because of the negative publicity on the internet related to past investment schemes and government sanctions in the United Kingdom, [the controlling mind of Company B] adopted [an alias … which was] an entirely fictitious person, created to mask [his] control of Company B”. In a press release in 2024, the US Attorney’s office states he had been “disqualified as a director of any UK company for eight years and was later sued by the Financial Conduct Authority […] for operating investment schemes through misrepresentations that lost investors substantially all of their money”. 17 In a 2024 Times newspaper article, Group U is described as “a notorious Marbella-based boiler room”. ‘Boiler room’ typically refers to high-pressure sales teams selling investments, including (but not limited to) fraudulent schemes. The FCA’s website says “Share and bond scams are often run from 'boiler rooms' where fraudsters cold-call investors offering them worthless, overpriced or even non-existent shares or bonds. Boiler rooms use increasingly sophisticated tactics to approach investors, offering to buy or sell shares in a way that will bring a huge return. But victims are often left out of pocket — sometimes losing all of their savings or even their family home. Even experienced investors have been caught out, with the biggest individual loss recorded by the police being £6m”. Such ‘boiler rooms’ are typically based outside the UK. General consumer fraud prevention information relating to ‘boiler room’ scams is available here: Boiler room fraud | Action Fraud and on this page: Boiler room scams | FCA. Court transcripts from the trial of Company B’s founder, owner, and controlling mind, report he was questioned about “boiler rooms” he had been involved with. He was asked whether investors had generally received their projected returns — to which he replied that generally they did not. When asked what happened to investors’ money generally, he replied that generally they lost their money.

-- 23 of 51 --

At that point Company SC’s main area of operation appears to have been the sale of investments in a group of companies I will refer to as Group ‘S’. Company SC appears mainly to have targeted private investors. The focus on selling Group S investments is likely reflected in the name of the company. Group S and Company SC share the first word of their names in common (which I have abbreviated to ‘S’). I do not think this was coincidental. Group S was a property development group operating in the UK from around 2015 to its eventual collapse from 2020 onwards. By the time Company P was being created, email correspondence between Company P’s board indicates they knew it was likely to collapse.18 When Group S did collapse, the mainly private investors appear to have lost a significant sum.19 Group S is therefore an investment scheme that — at the very least — failed with significant consequences for investors. It is currently the subject of an open investigation by the Serious Fraud Office (as publicly stated on the SFO’s website). At the time of writing, no information has been released about what that investigation has found. Either way (whether it was legitimate but failed, or wholly fraudulent) any identifiable connections to that investment would likely have proved unattractive to a prospective investor in Company P. Connections between Company SC and Company P Documents provided by the Trustees from the device review indicate that the accounting and banking arrangements for Company P, Company SC and Group U were being handled together on the same system (and likely by the same people). That suggests at least some connection between the three entities. As noted above, Person J (along with Person D) ‘headed up’ Company SC and Group U. Person J also had dominant control over Company P (as I have previously found). Further, and of particular relevance here, large quantities of Company P investors’ money, 20 which had been paid to Company P to fund development works, flowed to a Spanish bank account held by Company SC. Email correspondence suggests this flow of funds represented the payment of (sales) commissions and regular “consultancy fees” (monies paid to companies owned or connected to the Company P board members). These links between Company SC and Company P are also suggested in email discussions around the introduction of an eighth board member to Company P. Person J suggests bringing this eighth person into Company P to carry out an 18 In an email dated 28 August 2019, Person J comments “Remember if [Group S] goes the way of Theresa May then [the eighth board member mentioned later — a prominent Group S investor] will be the one out of pocket and can use that as a story of what to look out for in an investment”. In messages discussing comments by Person J about how much the person running Group S had achieved, de jure Director P replied: “Yea what a great developer, whole thing was a house of cards even before covid [...] anyone can run a ponzi”. 19 Group S’s losses are widely reported, including on the Serious Fraud Office website, as being up to a total figure that exceeds £100m. 20 Administrator B says payments made from Company P (and the companies comprising the associated investments) to Company SC were in excess of £1.8m.

-- 24 of 51 --

‘ambassador role’. He notes that this would be “simply a pass across of a cost that was already there” because the person was previously being paid to fulfil the same role for Company SC.21 Yet while the internal records show what appear to be very close connections, email records from 2019 suggest Company P was taking steps to avoid visible links between Company P and Company SC or Group S — likely motivated by the anticipated collapse of Group S and Company SC’s role in selling investments in Group S to private investors. Company SC was renamed in late 2019. Unlike its previous name the new name bore no obvious connection to the name of Group S (again I do not think that was coincidental — this seems to me to have been a deliberate attempt to put distance between Company SC and Group S, and hence between the newly formed Company P and the anticipated failure of Group S). An email in August 2019 comments (in response to Person J’s email referenced above) on concerns about the visibility of the proposed eighth board member’s connections to Group S as being: “a direct breadcrumb22 ? We’ve gone out with mailers with his face on, his face and testimonial is on the SC homepage. I guess we could pitch it saying he was just another investor”. A further reply comments that getting this person on board: “in a way protects our partnership with all things [Group S] and that in turn, means we can keep putting £20k plus per month from [Company SC]”.23 In early email exchanges around the time of the inception of Company P, there are multiple references to “breadcrumbs” in connection with Group S. In context, I read these references as relating to the desire to avoid (in so far as possible) any obvious trail that might allow investors to link Company P to Group S. 21 In context, that person’s ‘ambassador role’ appears to refer to acting as a figure promoting the sale of investments (initially into Group S, with the proposal now being that he would now do the same for Company P). The cost of paying that person to promote Group S in this way was apparently being borne by Company SC. In a later email to this person dated 30 August 2019, Person J says “you have been attached to many marketing messages as [Group S’s] investor ambassador […] I feel that [the person in control of Group S] would have you as a priority to ensure that your investments are all settled correctly, above and beyond any other investor”. At the very least, that suggests favourable treatment for this person (and by inference, in anticipation of the failure of Group S). 22 The word “breadcrumb” is used repeatedly in the email exchanges between the board. In context it consistently appears to refer to a trail leading from something to Company P. The context of these discussions concerns the risk posed by ‘breadcrumbs’ — in that an investor could identify a link to something the board would rather they were not aware of (here the link to Group S). 23 This email continues: “Within the next 6-12 months I see us having another 2/3 revenue streams where we can take same/similar type "consultancy fees" and therefore we are looking at 60k per month in our pockets. My "dream" to earn 100k per month is achievable”. The reference to the income of the board being paid as ‘consultancy fees’ is something I have mentioned in the previous section, such fees being routed from investor money paid into Company P to Company SC in Spain and then distributed to companies controlled by those comprising Company P’s de facto board. I will return to this later.

-- 25 of 51 --

In an email dated 28 August 2019, Person J said about the proposed eighth member of Company P’s board: “I believe he can be a nominee and face of the business alongside [de jure Director P]. [de jure Director P] CEO, [the eighth person] non-executive Chairman or MD, or whatever we think will work. This would mean ZERO breadcrumbs to the Marksie's24 and Merchants of the world and a forced rebrand (which [the eighth person] does not know about yet) presents a great opportunity to correct the issues we had by incorporating with [Company P’s de jure directors]. Hansel and Gretel come to mind.” [My emphasis added] In a later email the same discussion continues, remarking that the proposed eighth board member: “holds nothing for the likes for Marksie to go on apart from that he [the proposed member] invested heavily in [Group S]” I’m persuaded this evidence, taken together, shows a clear intention to hide from investors any visible links between Company P and Company SC, and to hide the link to the failed investment Company SC was at that point partnered with — Group S. While, as things stand (and pending the findings of the Serious Fraud Office) Group S may well have been a legitimate but failed investment, nevertheless these email exchanges indicate to me a willingness on the part of Company P to deliberately mislead investors. By misrepresenting the control of Company P, the key role of Person J in selling a failed investment in Group S (and one that is now suspected to have been a fraud) was hidden from investors such as Mr C. Summary — the control misrepresentation The IM represented de jure Director P as the person controlling Company P. That accords with the records filed at Companies House. But as I’ve set out above, that didn’t reflect the true situation. I find that the IM contained a misrepresentation on this point. The email sent by Person J setting out the de facto board structure was sent to all of the board members of Company P (three months prior to Mr C being given the IM). Therefore, at least as early as this, Person J (and the board of Company P) knew that control of the company was not as Company P permitted to be represented in the IM that was given to Mr C. I consider it most likely this misrepresentation was deliberately made in order to prevent investors from identifying who actually ran Company P (because of the links I have highlighted to previous investment fraud, ‘boiler room’ operations, and collapsed investment schemes — all of which had resulted in considerable financial harm to investors). 24 This word is used at least twice in the email correspondence from this time. It appears to me to relate to the noun ‘Mark’. ‘Mark’ being a slang term — which in the most common usage refers to the target of a con or a scam. The usage in this correspondence is of course not defined by the authors, but I am persuaded by the context of its usage by Company P that this does refer to at the very least the targets of the sales efforts — the private investors into Company P. In other words, the discussion being had is around how to avoid there being a trail of ‘breadcrumbs’ leading the potential investor in Company P to find the links to Company SC and Group U (because that would have led such a potential investor to decide against investing in Company P given the failed and/or fraudulent nature of the prior schemes these entities had been engaged in selling).

-- 26 of 51 --

2) The ‘equity buffer’ The IM begins with a section titled “Message from the CEO”. Under “The Capital Raise” de jure Director P states: “we have an equity stake ourselves of £1million” (the ‘equity buffer’). On page 18 under the heading “A Brexit Proof Investment” it states: “Let’s start with the key fact. [Development RP 25 ] is securitised by the senior lender, who are putting up £7.7Million. Next there’s the money we have put into the project ourselves £1Million — We’ve known Brexit has been coming for years, so do you really think we’d have put down this amount if we thought the project was on rocky ground?” [My emphasis added]. On page nine, headed “The Opportunity” the brochure contains a table titled “Investor Returns”. This shows three “Annual Return” rates, which range from 11% to 15% dependent upon “Investment Level”, the highest associated with investments of over £100,000. An adjacent graphic shows slices of a bar chart which appear to correspond to the funding of the opportunity. These bars are labelled: “Senior Debt: £7,748,000”, “Client funds to raise Junior/Mezzanine: £1,196,517”, and “Equity: £1,000,000”. The IM therefore is consistent in representing that there is an equity buffer of £1,000,000. The phrases “the money we have put into the project ourselves” and “we have an equity stake ourselves” both represent that this buffer has already been put into place — prior to the publication of the IM and so prior to Mr C’s investment. In an email sent in June 2019, referring to Company P’s website, Person J stated: “the Equity is the developers 'skin in the game' which should be labelled as 'High Risk' to demonstrate the developer has the most to lose. The idea is to demonstrate the low risk/high security position for [Company P’s] investors! The point is we take out the word 'risk' for investors and demonstrate they have the 'Maximum Security' and the developer has the 'High Risk' position. Works in favour of our pitch to punters. […] due to the buffer on equity in a doomsday scenario of an administrator conducting a fire sale, then the investors buys into their ‘Maximum Security’ position.” This quote makes the intention clear. The equity buffer (which was supposedly contributed equally by Company P and the developer) had been included with the intention of providing reassurance to investors about the security of their investment. But this supposed equity buffer does not appear to have been put in place — either at the time of Mr C’s investment or subsequently. De jure Director P states, in messages dated 22 December 2021 referring to an upcoming meeting with the administrators: “from talking to the guys it’s going to be a pretty bad one. Lots of the questions he’s asking I can’t even justify an answer for, so many layers and details and stuff that shouldn’t have been done. […] Like ‘why did you keep raising after it was complete’, ‘you said [Company P] put in 500k of their own money too, where is that’ etc […] we 25 Development RP being the development Mr C believed he was investing in.

-- 27 of 51 --

didn’t actually put that money in […] That was a [Person J] special. Equity didn’t go in just said it did”. [My emphasis added]. The other person replies: “that’s the dodgy part that you let happen then”, to which de jure Director P says: “Indeed, should have stopped it but didn’t”. These comments by de jure Director P indicate that he accepts the equity buffer was not put in place. They also indicate that this was not what had been said by Company P at the time. His reference to ‘should have stopped it’ seems to me consistent with that equity buffer not being intended, despite what Company P had represented to investors. The “dodgy part that you let happen” seems to me to therefore refer to his not stopping the misrepresentation 26 (irrespective of whether this was something de jure Director P had the power to have stopped). His comment that this was a “[Person J] special” tends to suggest that this may not have been the first time such a misrepresentation had been made by Person J. There is also evidence of later attempts to cover up that dishonesty. The Trustees have provided the transcript of a voicemail recorded on de jure Director P’s mobile phone: “legally, whatever you say now can be used against you. So if we blag it now, we know it's blagged. So I wouldn't respond at this point. I think we need to, uh I'm gonna start switching off parts of the [Company P] website like the history. Things like that remove those from the website, um and you know, just not not enough to affect the existing deals. But, um, you know, definitely need to definitely need to pull that back and, um, remove as much as we can from there If those deals are done and you sent the stuff, I also would recommend and ask if we can remove all the items from there as well. Because, of course, all the items are mentioned equity and [expletive] like that.” [My emphasis added]. In the commentary provided to creditors (including Mr C and shared with HSBC) by the Joint Administrators27 , the administrators state that they have found no evidence to suggest the equity buffer was ever introduced by Company P or by the developer (in respect of the scheme Mr C invested in, or in any of the other schemes). Applying the balance of probabilities, the evidence I have seen persuades me that no equity buffer was introduced by Company P, and that this was contrary to what had been stated in the IM (and likely also on Company P’s website). Not making that investment of Company P’s (or its directors’) own capital meant private investors were running a higher risk of financial loss than was being represented in the IM. 26 In other words it refers to this part of de jure Director P’s email: “just said it did”. 27 Administrator B’s report dated October 2022 is subject to a confidentiality clause, which prevents its use for purposes other than those of the creditors in relation to their attempts to obtain reimbursement under the CRM Code. I understand that Mr C has a copy of that report, as does HSBC. I provide only an edited summary here. The second such report by Administrator B (the supplementary report) does not contain anything substantially different in relation to the points addressed here.

-- 28 of 51 --

What was stated in the IM was therefore false. De jure Director P’s comments indicate that he knew this was false at the time. They also indicate that this was prompted by Person J, who by implication also knew it to be a falsehood. As I’ve set out earlier, I consider Person J’s knowledge can be imputed to Company P, and therefore Company P knew the statements made about an equity buffer were false at the time Company P permitted them to be made. Mr C states that had he known no such equity buffer existed he would not have chosen to invest. I see no reason to doubt that this misrepresentation would have had a material effect on the prospect the investment offered to Mr C. The absence of any equity buffer would have meant no margin of protection for private investors. And its absence would also have removed what would I think would otherwise reasonably have been perceived by private investors as a sign of confidence in the prospects of the project by those introducing the equity capital (that being something referred to in the IM itself). 3) Misrepresentation of the commissions and fees payable by Company P The IM provides a figure for the Total Development Cost, comprising “Finance Costs” of £781,946, and “Marketing and Sales Costs” of £234,559. The finance cost figure given in the IM appears to correspond to the total cost of the senior finance. This figure is within 2% of the figure stated under ‘Finance Costs’ in Company P’s management accounts produced in January 2020. These accounts list the components of ‘Finance Costs’ as being debt interest, legal fees, associated surveyors’ fees, etc. 28 What is stated in the IM appears therefore to have been an accurate forecast of the costs of obtaining the senior finance. But crucially, these ‘Finance Costs’ do not include the cost of the capital obtained from private investors (such as Mr C). These internal accounts separately show that 25% of the funds received from private investors was paid out almost immediately. This portion comprised the upfront payment of interest to private investors (which appears to have averaged 13.8% of the invested amount) and the payment of ‘sales commissions’ (routed to Company SC in Spain) which accounted for 11.2% of private investors’ funds. The upfront payment of interest was something Mr C was aware of prior to his investment. There does not appear to have been any misrepresentation on this element. However, the ‘sales commissions’ that had been paid by this point were far in excess of what could possibly have been included in the headline figures stated on the IM. In the IM, the combined sales and marketing costs were quoted as a total of £234,559. This figure broadly matches what appears on the accounts under a section headed “Marketing” — the components of which are listed as being: “Sales Agent Costs” of £178,783; “Sales Legal Costs” of £35,757; and, “Marketing” posted as £20,000. In total, 28 Notably, these same management accounts show a figure of £0 attributed to the cost of equity finance — unsurprising given the apparent absence of equity capital .

-- 29 of 51 --

this section of the accounts amounts to £234,539 (a sum almost exactly equating to the figure quoted on the IM of £234,559 as being the combined marketing and sales costs.29 This element of the accounts does not include “Sales Commissions” — an item listed separately in the accounts as a £321,015 cost (under the heading ‘Cost of Capital’). The total cost of ‘sales and marketing’ therefore appears to have been more than double the figure stated on the IM. The additional sales cost was especially significant given the proportion it represented of the total private investor fund raise figure stated in the IM (i.e. £1,196,517). It seems reasonable to say that more than doubling this cost element would therefore have a significant impact on the potential profitability of the project (which I will address in more detail later). All things being equal, I’m persuaded this would have had a material effect on Mr C’s decision to invest. The ‘sales commission’ paid for the capital raised from private investors appears (at least in significant part) to have been transferred to Company SC in Spain, then from there distributed to companies owned by the members of the board of Company P. One of the directors, in discussing income from the project in August 2019, states: “Within the next 6-12 months I see us having another 2/3 revenue streams where we can take same/similar type ‘consultancy fees’ and therefore we are looking at 60k per month in our pockets” The reference to ‘consultancy fees’ is given quote marks in the director’s email. In context of this and other messages I think the use of these quote marks acknowledges that these are being described as ‘consultancy fees’ but are in reality something else (and most likely, directors’ remuneration). This also suggests that the intention to charge ‘sales commissions’ to fund these ‘consultancy fees’ was present from at least August 2019, and therefore some months prior to Mr C’s investment in November 2019. In the same section on the accounts detailing the ‘Cost of Capital’, a fee of £310,000 is shown. Adjacent are initials which correspond to those of the director of the developer company. This therefore appears to be a fee being paid direct to the director of the developer company (and apparently not to the developer company — those costs are listed elsewhere). The fee paid to the director of the developer, and the additional ‘sales commissions’ paid out via Company SC, equate to a total additional sum for fees and commissions of £631,015 (by January 2020). A June 2019 email discussion between the members of Company P’s board and the developer includes the comments: “If that spreadsheet is presented to investors with £600K of raise and PM fees the deal does not work. […] definitely the more sophisticated clients will want to go into to 29 While there is limited evidence on this point, the internal accounts suggest that the sales and marketing costs shown in the IM are in fact those related to the ultimate sale of the developed units, and do not incorporate any sales or marketing costs associated with the capital raise from private investors.

-- 30 of 51 --

depth and want questions like the above [timing of the raise] answered.” [my emphasis added] The response to which was: “I thought as much which is why we will not get away with £600K in fees being bought above the profit line into the deal.” This discussion indicates a deliberate decision to conceal these fee and commission payments from investors. All taken into account, I find the statements made about fee and commission costs stated in the IM were false. The email correspondence between Company P’s board members indicates this falsehood was recognised at the time and deliberate. In short, these statements were known by Company P to be false, at the time Company P permitted the statements to be made on its behalf. In their previous commentary on the matter30 , Administrator B reached similar findings. They explain that Company P’s accounts show a significant portion of the funds raised (from private investors) were apparently paid away as ‘commission’ to Company SC (the company based in Spain). They believe this contradicts the statement in the FAQs section of the IM that: “There are no exchange or arrangement fees associated with this investment”. To conclude, the IM contained a significant understatement of the fees and commissions that would be paid by Company P. This was something that would have affected Mr C’s decision to invest (given the inevitable impact on Company P’s profitability). Had the misrepresentation not been made I consider it more likely than not he’d have chosen not to invest. As stated in Company P’s email correspondence “If […] presented to investors […] the deal does not work”. 4) Over-raise of funds The IM, on page 17, shows the Total Development Cost for the project Mr C believed his investment would be funding. This cost is shown split into four components: • the Total Purchase Price — £4,027,500 • Development Fees — £4,900,512 • Marketing and Sales Costs — £234,559 • Finance Costs — £781,946. In total, this amounts to just under £10m. That figure correlates with the internal management accounts produced in January 2020 (by the original de jure director). Those accounts show a similar total for the costs of acquiring the site, the costs payable to the developer company 31 and the costs associated with the senior loan. 30 The confidential reports referred to earlier — which are included here only in the form of an edited and summarised form. Both the initial and supplementary report contain comments consistent with the summarised version I provide here. 31 But not including the £310,000 fee mentioned in the previous section, which it appears was paid directly to the director of the developer company and was not included as a component of the development costs. This fee appears listed in the development appraisal as an addition to the cost of capital. That cost is shown as 13.8% to ‘sales commissions’, 11.2% for upfront investor returns and a 10% “Fee on Required Raise” which appears to be paid to the director of the developer company. That equates to a total cost of capital of 35%. The same fee payable to that director is shown in the accounts projected as being paid annually in ‘re-raise calculations’.

-- 31 of 51 --

The figures stated in the IM in relation to these costs appear therefore to have matched what was later recorded by Company P. To fund part of the overall £10m cost, Company P obtained and drew down a senior lender loan facility of just over £7m. Given no equity capital was being introduced by Company P (see above section) this left a capital requirement of around £3m which needed to be covered. Company P raised this additional sum (net of the costs of such capital) through selling the investment to private investors (client investor funds). The IM stated (in the same graphic referenced in the previous section) that £1,196,517 was to be raised in client investor funds (in what follows I will round this to £1.2m). Raising this sum was insufficient to fund the £3m needed to cover the essential costs of completing the development. However, as detailed above, the concealed payments for ‘sales commission’ and the payment to the developer’s director would account for a significant portion of the money raised through this route. Furthermore, the upfront returns paid to investors (being paid prior to any profits being earned on the project) also had to be deducted from th