In a landmark decision delivered on April 9, 2025, the High Court of Uganda’s Commercial Division partially ruled in favor of Abacus Parenteral Drugs Limited (APDL) in a high-stakes financial dispute against Stanbic Bank Uganda Limited over fraudulent online banking transactions totaling she 2.2 billion.
Presided over by Hon. Justice Cornelia Kakooza Sabiiti, the case (Civil Suit No. 0322 of 2022) stemmed from unauthorised debits made from APDL’s corporate account between 2015 and 2018.
The plaintiff alleged that the defendant bank negligently allowed a series of payments to be processed via its online banking platform without validating beneficiary names, which led to massive financial loss.
Abacus claimed the disputed funds were disbursed to fraudulent accounts disguised under fictitious vendor names, with the most significant transactions traced to two accounts held by one Hope Kabajjungu at Stanbic Bank branches in Mukono and Forest Mall.
Despite internal account discrepancies and mismatched payment descriptions, the bank executed the payments, prompting the lawsuit.
Stanbic Bank denied liability, arguing that Abacus had full control and responsibility over the online banking platform and that its system—designed as a straight-through process (STP)—did not require manual validation of beneficiary details by the bank.
The bank further alleged that APDL’s internal lapses, including assigning both initiator and authorizer roles to a single employee, Mr. Arthur Moses Buyemba, significantly contributed to the fraud.
In her ruling, Justice Sabiiti noted that while the bank was contractually obligated to reject incorrect or incomplete instructions, Abacus also failed to maintain proper internal controls.
The judge cited provisions in the online banking agreement obliging the bank to ensure payment accuracy, but also highlighted the plaintiff’s own negligence in consolidating sensitive payment roles and failing to detect fraudulent transfers for over three years.
After thorough scrutiny of evidence and submissions, the court concluded that only shs 1.69 billion out of the claimed shs 2.2 billion was proven to be erroneously paid. It then apportioned blame: 80% on Abacus for failing to prevent the fraud and 20% on Stanbic Bank for not having robust safeguards to catch internal discrepancies.
Consequently, the court ordered Stanbic Bank to refund shs 339,556,644 to Abacus—representing 20% of the proven losses—with 18% annual interest from the date of suit filing until full settlement. However, the judge declined to award general or exemplary damages, citing Abacus’s contributory negligence, and ordered both parties to bear their respective legal costs.
This ruling sends a strong message on shared responsibility in online banking operations. While financial institutions must maintain secure and proactive systems, corporate clients are equally obligated to enforce rigorous internal controls to protect against cyber fraud.
