Finastra v. CRDB Bank is a claim in the Commercial Court of the High Court of England and Wales by the banking software vendor Finastra International Limited against its customer, The CRDB Bank plc of Tanzania. Finastra alleged that CRDB breached its licence for the FusionBanking Essence core banking system by letting its network of banking agents, known as Wakalas, reach the system through a single access point, in breach of a prohibition on “multiplexing” in the definition of a concurrent user licence. Finastra put its loss at about USD 23 million. The only published judgment, of 7 March 2025, refused Finastra’s late application to extend the claim to a second system ahead of a trial listed for April 2025.[1]
Background
By an agreement signed on 21 November 2017, Finastra licensed banking software to CRDB, including FusionBanking Essence (FBE), CRDB’s core banking system for customer account information and financial transactions. The agreement provided for 2,000 concurrent users of FBE.[1] The definition of a concurrent user licence stated:[1]
A “Concurrent User” licence permits any representative (e.g. employee, consultant, contractor) of the Client or an Affiliate up to the cumulative stated number of Concurrent Users to simultaneously access the specified Software at any one time. Access to the Software means that the user is logged on to the Software, regardless of whether the Software is actually processing any data. The use of technology to allow multiple end users to share a single access point to the Software is prohibited.
Wakalas operate in areas of Tanzania without ATMs or bank branches. Each has a handheld point-of-sale (POS) terminal running an application called FahariHuduma (the FH App). In 2023 there were 34,627 Wakalas. Until it was decommissioned in June 2024, a Wakala’s POS terminal connected over a mobile network to CRDB’s Transaction Management System (TMS), which in turn interfaced with FBE.[1]
The dispute
Finastra issued its claim in March 2023, alleging that CRDB had granted indirect access to FBE to the Wakalas and that TMS was a “single point of access” for all of them, breaching the multiplexing prohibition. CRDB served its defence in May 2023.[1] In correspondence, CRDB explained that the “TMS” interface user in FBE was used to establish single sign-on for the TMS profile, that transactions in FBE are initiated through channels such as ATMs, internet banking and interfaced applications, and that Wakala transactions were posted under the channel identifier “TMS”.[1]
Finastra’s particulars of claim stated that FBE is licensed on a concurrent user basis, that it can license any number of concurrent users down to one, that CRDB needed the required number of concurrent user licences for each module, and that additional concurrent user licences are charged as an increase in the annual fee for the year of purchase and each remaining year of the term. On that basis it claimed an additional annual fee of USD 23,065,912.30.[1]
The judge identified the issues for trial as contractual interpretation, alleged estoppel and rectification and, if relevant, how many concurrent user licences CRDB would have needed had it not used the single TMS user and password, on the assumption that the same number of CRDB representatives would have accessed the software. He noted that this required an assessment of how much concurrent usage in fact took place, which was “not a straightforward matter”, with the experts having to make assumptions and extrapolations from the available data.[1]
The New Agency Banking System
From May 2022 CRDB piloted a “New Agency Banking System” (NABS), supplied by a third party, which Wakalas could use through a smartphone app or an app on the POS terminal. CRDB’s draft schedule of technical facts of February 2024 explained that NABS did not use TMS but posted transactions to an enterprise service bus interfaced with FBE through the FBE API. From June 2024 NABS replaced TMS for the Wakalas, and CRDB stated that around 8,000 Wakalas had been entitled to use NABS since May 2022.[1]
In January 2025 Finastra applied to amend its claim to allege that NABS was also a single access point breaching the multiplexing prohibition. Relying on its expert’s report, it proposed to replace its loss figure with a range of USD 23,280,000 to USD 46,697,000, “depending on the assumption made regarding timeout duration”. It estimated the additional effect of NABS at about USD 4.9 million.[1]
Decision or outcome
Mr Justice Henshaw refused permission to amend. The amendment would require the parties to revisit disclosure, probably witness evidence and expert evidence, within six weeks of trial and after trial bundles were due; Finastra’s timetable was highly optimistic and made no provision for further expert meetings or reports on NABS. CRDB’s solicitors had pointed out that, unlike TMS, which CRDB built, NABS was developed by a third party whose cooperation would be needed. The judge concluded that the trial would inevitably have to be adjourned, and that even if it could be kept, the amendment would put “wholly unfair pressure” on CRDB, its lawyers and its expert.[1]
No good reason had been given for the lateness. The court found that CRDB’s February 2024 draft schedule had made clear, objectively, that NABS was already in use by Wakalas alongside TMS and had an indirect link with FBE, and that later correspondence, CRDB’s pleadings and its September 2024 disclosure of NABS logs had repeatedly put Finastra on notice. Finastra’s argument that it had not appreciated the relevance of NABS was rejected. Adjourning the trial would prejudice the interests of justice, CRDB and other court users.[1]
The judgment does not decide whether CRDB breached the licence. The trial was listed for five days from 7 April 2025.[1] No trial judgment was found on Find Case Law, and no public record of a settlement was found in the sources reviewed for this article.
Significance for software licensing and SAM practice
The case is a reported example, outside the SAP context, of a vendor bringing an indirect access claim against a customer in the English courts. Unlike SAP UK v. Diageo, which concerned named users, the licence here was counted in concurrent users and contained an express ban on sharing a single access point.[1]
- Interface users. A core system accessed by many external users through one technical user, here a single sign-on interface user for a transaction management system, is the pattern such clauses target. CRDB’s position on what counted as access, and its estoppel and rectification arguments, were left for trial.[1]
- Measuring concurrency. Even with a concurrent-user metric, the claim’s value depended on reconstructing how many representatives would have been logged on at once, and the proposed range roughly doubled depending on the session timeout assumed.[1]
- Architecture changes. Moving to a new integration layer, here an API through an enterprise service bus, did not stop the vendor from arguing that the new route was also a single access point.[1]
Lessons learned
- A concurrent-user definition that prohibits sharing a single access point can be the basis of an indirect-access claim. Finastra relied on the final sentence of the definition to claim for tens of thousands of agents reaching FBE through TMS.[1]
- Quantifying such a claim depends on reconstructing historic concurrency from logs. The judge described it as not straightforward, and the vendor’s own estimate varied with the timeout assumption.[1]
- Replacing the integration layer does not end the question. Finastra sought to extend its claim to NABS, which connected to FBE through an API.[1]
- Define the systems in dispute early. The court refused the late amendment because Finastra had been on notice of NABS for about a year.[1]