Merrick Bank Corporation v. Savvis, Inc. et al

Filing 64

ORDER ; Request for Judicial Notice 30 50 are granted and denying 29 Motion for Judgment on pleadings. ***SEE ATTACHED PDF FOR FURTHER INFORMATION***. Signed by Judge Cindy K Jorgenson on 01/08/10.(LMF, )

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

WO

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF ARIZONA

MERRICK BANK CORP., Plaintiff, vs. SAVVIS, INC., SAVVIS COMMUNICATIONS CORP., Defendants.

) ) ) ) ) ) ) ) ) ) )

No. CIV 09-1088-PHX-CKJ ORDER

Pending before the Court is Defendants' Motion for Judgment on the Pleadings [Doc. # 29]. A response and reply have been filed. The parties presented oral argument to the Court on November 2, 2009.

Factual and Procedural Background1 The dispute presented in this case is based on a data security breach involving, among others, Merrick Bank Corporation ("Merrick"), Merrick's agent CardSystems Solutions, Inc. ("CardSystems"), Savvis, Inc., Savvis Communications Corporation (Savvis Defendants will be collectively referred to as "Savvis"), and Cumis Insurance Society, Inc. ("Cumis"). Specifically, for purposes of the Motion for Judgment on the Pleadings, 2:09-CV-1088

1

Unless otherwise stated, the facts are taken from the Complaint in CV 09-1088.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

involves claims by Merrick of negligence and negligent misrepresentation against Savvis.2 Merrick is an acquiring bank for approximately 125,000 merchants. An acquiring bank is a bank or bank-like entity that participates in the debit and credit card payment system within the Visa U.S.A., Inc. ("Visa") and MasterCard Worldwide ("MasterCard") associations and that (i) has established a contractual relationship with the merchant pursuant to which the merchant is enabled to accept cards as a means of payment and (ii) received payment for the goods or services from the cardholder's issuing bank which payment it forwards to the merchant. In or about January 2004, Merrick entered into an agreement with CardSystems, under which CardSystems would perform both Independent Sales Organization ("ISO") and Card Processor ("Processor") services for Merrick. In or about January 2004, Merrick did not permit CardSystems to act as either ISO or Processor until Merrick was satisfied that CardSystems was compliant with all Association rules and regulations related to Processors.3 In or about January 2004, Visa and MasterCard had in place rules relating to Card Transaction security with respect to which Processors were required to comply. Because CardSystems was not certified as Cardholder Information Security Program ("CISP") compliant in January 2004, Merrick did not permit CardSystems to process any Card Transactions until it obtained the certification.4

Related cases assigned to this Court are 4:07-CV-374 and 4:09-CV-180. 4:09-CV086 is assigned to the Hon. Frank R. Zapata. The Complaint refers to Visa and MasterCard collectively as the "Association." The Court will also do so. The Associations require acquirers like Merrick to agree to reimburse the Associations for all losses suffered by the Associations as a result of wrongdoing by registered Processors. Complaint, ¶ 11. Generally, ISOs are sales forces that solicit merchants to contract with acquiring banks with which the ISO is aligned, and provide maintenance and servicing to such merchants. Processors process, on behalf of the acquiring bank, the authorization and settlement functions. CISP is a program that Visa had in place; MasterCard had similar rules. Merrick was satisfied that a CISP compliant Processor would also be compliant with MasterCard's Card Transaction security regulations. -24 3

2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Savvis was retained by CardSystems for the express purpose of obtaining certification that its systems were CISP compliant. In June of 2004 Savvis issued a Report on Compliance ("ROC") to CardSystems and Visa which summarized its findings and conclusions with respect to CardSystems' CISP compliance. Savvis concluded that

CardSystems had implemented sufficient security solutions and operated in a manner consistent with industry best practices and the intent of CISP, and recommended that Visa recognize CardSystems as in "Full Compliance" with CISP. CardSystems was officially listed as CISP compliant by Visa. Upon learning of the conclusions of the ROC, Merrick allowed CardSystems to act as its Processor. Additionally, in reliance on the ROC, in July 2004, Merrick executed and completed the ISO Acquisition Agreement. In May 2005, CardSystems notified Merrick that its computer systems had been breached by hackers. A forensic investigation was conducted; the forensic report indicated that, on numerous occasions over the course of the past several months, hackers were able to export credit card account numbers and other personally identifiable cardholder data from CardSystems's computer systems. The report estimated that as many as 40 million individual Card account numbers may have been compromised as a result of the security breach. The report also indicated that, at the time that Savvis issued its ROC confirming CardSystem's CISP compliant status, CardSystems had been improperly and continuously storing unencrypted Card Transaction data on its servers for over five years. CardSystems's inadequate firewalls, improper data retention and failure to encrypt data were all obvious failures to comply with CISP. Merrick filed an action in the Eastern District of Missouri against Savvis alleging claims of negligence and negligent misrepresentation. On or about May 21, 2009, the case was transferred to the United States District Court for the District of Arizona and assigned cause number 2:09-CV-1088. On June 5, 2009, Savvis filed a Motion for Judgment on the Pleadings. A response -3-

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

and reply have been filed. Savvis has also filed a Request for Judicial Notice ("RJN") of a variety of documents filed in other court proceedings (exhibits 1-4), one document that was referenced to and relied upon in the Complaint (exhibit 5 ­ filed under seal), and a statement publically available made by the Chairman of Merrick Bank Corp., before the House Committee on Financial Services, Subcommittee on Oversight and Investigations (exhibit 6). A Supplemental Request for Judicial Notice ("Supp. RJN") has also been filed requesting judicial notice be taken of the ROCs (exhibits 1 and 2 ­ filed under seal) and an order filed in bankruptcy court (exhibit 3). No opposition to these requests have been filed; the requests will be granted.

Motion for Judgment on the Pleadings Fed.R.Civ.P. 12(c) provides that, "[a]fter the pleadings are closed ­ but early enough not to delay trial ­ a party may move for judgment on the pleadings." Dismissal through a motion for judgment on the pleadings is appropriate "`only if it is clear that no relief could be granted under any set of facts that could be proven consistent with the allegations.'" McGlinchy v. Shell Chemical Co., 845 F.2d 802, 810 (9th Cir. 1988), quoting Hishon v. King & Spalding, 467 U.S. 69, 73 (1984). When the moving party is entitled to judgment as a matter of law when, even if all of the material facts in the pleading under attack are true, judgment on the pleadings is appropriate. Hal Roach Studios, Inc. v. Richard Feiner & Co., Inc., 896 F.2d 1542, 1550 (9th Cir. 1989). "All allegations of fact of the opposing party are accepted as true." Austad v. United States, 386 F.2d 147, 149 (1967). Furthermore, all inferences reasonably drawn from the alleged facts must be construed in favor of the responding party. General Conference Corp. of Seventh-Day Adventists v. Seventh Day Adventist Congregational Church, 887 F.2d 228, 230 (9th Cir. 1989). However, conclusory allegations are insufficient to defeat a motion for judgment on the pleadings. McGlinchy, 845 F.2d at 810. A motion for judgment on the pleadings is subject to the same standard as a -4-

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Fed.R.Civ.P. 12(b)(6) motion to dismiss. Dworkin v. Hustler Magazine, Inc., 867 F.2d 1188 (9th Cir. 1989). The United States Supreme Court has found that, in order to survive a motion to dismiss for failure to state a claim, a plaintiff must allege "enough facts to state a claim to relief that is plausible on its facts." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 1974, 167 L.Ed.2d 929 (2007).5 While a complaint need not plead "detailed factual allegations," the factual allegations it does include "must be enough to raise a right to relief above the speculative level." Id. at 1964-65. Indeed, Fed.R.Civ.P. 8(a)(2) requires a showing that a plaintiff is entitled to relief "rather than a blanket assertion" of entitlement to relief. Id. at 1965 n. 3; see also Ashcroft v. Iqbal, -- S.Ct. --, 129 S.Ct. 1937, 1951, 173 L.Ed.2d 868 (2009) (conclusory nature of allegations disentitled them to a presumption of truth). The complaint "must contain something more . . . than . . . a statement of facts that merely creates a suspicion [of] a legally cognizable right to action." Id. at 1965. Thus, a motion to dismiss pursuant to Fed.R.Civ.P. 12(b)(6) (or a motion for judgment on the pleadings) should be granted when a plaintiff fails to "nudge [his] claims across the line from conceivable to plausible." Id. at 1974. However, the Supreme Court has cited Twombly for the traditional proposition that "[s]pecific facts are not necessary [for a pleading that satisfies Rule 8(a)(2)]; the statement need only `give the defendant fair notice of what the . . . claim is and the grounds upon which it rests." Erickson v. Pardue, 551 U.S. 89, 127 S.Ct. 2197, 2200, 167 L.Ed.2d 929 (2007). This Court must take as true all allegations of material fact and construe them in the light most favorable to the nonmoving party. See Cervantes v. United States, 330 F.3d 1186, 1187 (9th Cir. 2003). Additionally, the Court may consider any matter set forth in the complaint which is subject to judicial notice. Outdoor Media Group, Inc. v. City of

The holding in Twombly explicitly abrogates the well established holding in Conley v. Gibson, 355 U.S. 41, 45-46, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957), that "a complaint should not be dismissed for failure to state a claim unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief." -5-

5

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Beaumont, 506 F.3d 896, 899 (9th Cir. 2007). The Court may take judicial notice of "matters of public record" outside the pleadings without converting a motion for judgment on the pleadings into a motion for summary judgment. Fed. R. Evid. 201; see also Lexicon Inc. v. Milberg Weiss Bershad Hynes & Lerach, 102 F.3d 1524, 1537 (9th Cir.1996), rev'd on other grounds, 523 U.S. 26, 118 S.Ct. 956, 140 L.Ed.2d 62 (1998) (holding that a district court may consider matters of public record, including court records that have a direct relation to the matters at issue, without converting a motion to dismiss into a motion for summary judgment); Mann v. GTCR Golder Rauner, L.L.C., 351 B.R. 714 (D. Ariz. 2006) (same). The Court also may consider a document referred to in the complaint without converting the motion into a motion for summary judgment if its authenticity is not questioned. Branch v. Tunnell, 14 F.3d 449, 453 (9th Cir.1994), overruled on other grounds, Galbraith v. County of Santa Clara, 307 F.3d 1119 (9th Cir. 2002). In general, a complaint is construed favorably to the pleader. See Scheuer v. Rhodes, 416 U.S. 232, 236, 94 S.Ct. 1683, 40 L.Ed.2d 90 (1974), overruled on other grounds, 457 U.S. 800. Nonetheless, the Court does not accept as true unreasonable inferences or conclusory legal allegations cast in the form of factual allegations. Western Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981). Judgment on the pleadings is also appropriate when the allegations demonstrate that a defendant has an affirmative defense, such as statute of limitations, to a cause of action. U.S. for Use of E.e. Black Limited v. Price-McNemanr Const. Co., 320 F.2d 663, 666 n.1 (9th Cir. 1963); Conerly v. Westinghouse Elec. Corp., 623 F.2d 117 (9th Cir. 1980).

Statute of Limitations ­ Choice of Law Savvis asserts that Merrick's claims should be dismissed as a matter of law because they are barred by Arizona's two-year statute of limitations. Where a case has been transferred, the choice of law rule of the transferor venue applies. Van Dusen v. Barrack, 376 U.S. 612, 645-39 (1964); International Business Machines Corp. v. Bajorek, 191 F.3d 1033 (9th Cir. 1999). Savvis argues that the transferor venue, Missouri, applies the -6-

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

framework set forth in Kennedy v. Dixon, 439 S.W.2d 173 (Mo. 1969) (en banc) for tort claims. The Kennedy framework follows the Restatement's "most significant relationship test." Restatement (Second) of Conflict of Laws § 145 (1971). Although Merrick agrees that a most significant relationship test is used for questions of substantive law, Reis v. Peabody Coal Co., 997 S.W.2d 49, 58 (Mo.App. 1999), Merrick asserts that Missouri considers statute of limitations issues procedural and, therefore, governed by Missouri law. Wright v. Campbell, 277 S.W.3d 771, 773 (Mo.App. 2009). Missouri's borrowing statute states that "[w]henever a cause of action has been fully barred by the laws of the state, territory or country in which it originated, said bar shall be a complete defense to any action thereon, brought in any of the courts of this state." § 516.190 R.S.Mo. The Eighth Circuit has stated that "[t]he operative term in the borrowing statute is where the action `originates.' A cause of action originates under Missouri law at the place where plaintiff's alleged damages stemming from the pleaded cause of action are sustained and capable of ascertainment." Rajala v Donnelly Meiners Jordan Kline, P.C., 193 F.3d 925, 928 (8th Cir. 1999). In Rajala, the plaintiff asserted causes of action against an accounting firm whose allegedly negligent evaluation of a potential acquisition proved incorrect. The Eighth Circuit determined that the cause of action originated where the plaintiff was located and "felt the cash flow crunch allegedly caused by [defendants] acts and omissions." Id. The Eighth Circuit explained that, under Missouri's borrowing statute, "for cases involving a purely economic injury, as opposed to a physical accident with economic consequences, a cause of action originates where the plaintiff is financially damaged, which for a corporation is often its place of business." Great Plains Trust Co. v. Union Pacific R. Co., 492 F.3d 986, 992 (8th Cir. 2007). Merrick asserts that the damages claimed in this case are purely economic and relate to misrepresentations made by Savvis when it issued the ROC certifying CardSystems as CISP compliant and that those damages were only capable of ascertainment at the place where they were suffered by Merrick, which is its place of business in Utah. Merrick asserts -7-

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

that Savvis mistakenly emphasizes the fact that the subject of the audit, CardSystems, was located in Arizona, ignoring that Merrick's claims focus on Savvis's assessment, which almost exclusively took place outside Arizona. Therefore, Merrick asserts that, under Missouri's borrowing statute, the cause of action originated in Utah, and is not barred because Utah's statute of limitations for negligence and negligent misrepresentation claims is either three or four years. See Utah Code Ann. § 78-12-25; § 78-12-26.11. Merrick asserts that, even if Merrick's claims accrued as of July 2005, Merrick's claims are timely under either a three or four year statute of limitations since Merrick filed suit in May 2008. Savvis argues, however, that the Eighth Circuit has explicitly rejected the argument that an action originated for purposes of the borrowing statue where a corporate plaintiff ultimately felt the economic effects of its injuries. Building Erection Services, Inc. v. JLG, Inc., 376 F.3d 800, 804 (9th Cir. 2004). In Building Erection Services, the court

distinguished Rajala on the basis that Rajala concerned a purely economic injury to a corporation. 376 F.3d at 804 ("we do not find Rajala very helpful in resolving an accrual issue where a corporation suffers physical damage to corporate property in one state, but feels the secondary economic effects of the injury in its home state"). Savvis distinguishes Rajala on the basis that the court did not determine that its holding was based solely or primarily on where the plaintiff had its principal place of business and that the court rejected plaintiff's argument that the action originated in Missouri because that is where plaintiff learned the extent and specifics of the alleged wrongs. Savvis distinguishes Great Plains on the basis that the facts are not similar to this case. Although the parties dispute where the damages are capable of ascertainment, these cases make clear that, where a case involves a purely economic injury, the cause of action originates where the plaintiff is financially damaged. In this case, a purely economic injury to Merrick is alleged. The Building Erection Services court discussed that, in Rajala, the court did not focus solely on the cash-flow crunch felt by plaintiff at its corporate headquarters, but also on the place where conduct -8-

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

occurred as a result of the alleged negligent advice. In this case, the alleged negligence took place where the assessment occurred and the subsequent security breach occurred in Arizona. However, because no physical injury was involved, Building Erection Services only provides limited guidance. Rather, the Eighth Circuit's clear statement that, "for cases involving a purely economic injury, as opposed to a physical accident with economic consequences, a cause of action originates where the plaintiff is financially damaged, which for a corporation is often its place of business[,]" Great Plains Trust Co., 492 F.3d at 993, leads to a conclusion that Missouri's borrowing statute requires utilizing Utah's statute of limitations. Moreover, in opposing the transfer of the action initiated in California, Savvis asserted: Much of the evidence establishing that SAVVIS was neither involved in, nor responsible for, the events underlying this dispute is likewise located in the Eastern District of Missouri.3 . . . In contrast, there are no allegations or indications that any evidence exists in, or any misconduct on the part of SAVVIS took place in, Arizona.
3

Moreover, insofar as [Cumis] alleges (wrongly) that SAVVIS engaged in any wrongful conduct, such as fraud, by definition that conduct (had it occurred) would have occurred within the Eastern District of Missouri, where [] SAVVIS is located.

Regan Decl., Ex. A, Savvis' Response to OSC Re Transferring Venue [Doc. # 48], p. 2. Additionally, Merrick points out that its claims are based on Savvis's assessment, which took place almost exclusively outside of Arizona (Merrick's brief indicates that Cable & Wireless spent a total of three days in Arizona in 2003; during argument Merrick asserted that discovery had revealed that Cable & Wireless had only spent one day in Arizona. Additionally, as for Savvis's continued engagement in 2004, there was no physical presence in Arizona). However, Savvis points out that Merrick's own forensic investigator also conducted a three-day, on-site investigation of Cardsystems in Arizona. Although Savvis asserts that Missouri's borrowing statute is designed to discourage forum shopping, Patch v. Playboy Enterprises, Inc., 652 F.2d 754, 756 (8th Cir. 1981), Merrick asserts it properly filed this action in Missouri where Savvis has its principal place of business and is the location Savvis has acknowledged is the most appropriate forum to -9-

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

bring suit against Savvis for claims relating to the CardSystems audit. In light of the statements made by Savvis in opposition to the transfer of CV 07-374 from California to Arizona and the fact that Savvis is located in Missouri, it is difficult for the Court to conclude that Merrick engaged in impermissible forum shopping by filing suit in Missouri. Moreover, a pure economic injury is alleged, "as opposed to a physical accident with economic consequences[.]" Great Plains Trust Co., 492 F.3d at 993. Merrick suffered and ascertained the financial damages in Utah. The Court finds that Utah's statute of limitations applies. See Utah Code Ann. § 78-12-25; § 78-12-26.11. Therefore, even if Savvis is correct that Merrick's claims accrued as of July 2005, Merrick's claims are timely under either a three or four year statute of limitations since Merrick filed suit in May 2008.

Negligence and Negligent Misrepresentation ­ Duty Arizona courts follow the law of negligent misrepresentation set forth in § 552(2) of the Restatement (Second) of Torts, which narrowly limits the liability of professional suppliers of information. Kuehn v. Stanley, 208 Ariz. 124, 127-28, 91 P.3d 346, 349-50 (App. 2004). Under the Restatement, liability for negligent misrepresentation is limited to losses suffered: "(a) by the person or one of a limited group of persons for whose benefit and guidance [the defendant] intends to supply the information or knows that the recipient intends to supply it; and (b) through reliance upon it in a transaction that [the defendant] intends the information to influence or knows that the recipient so intends or in a substantially similar transaction." Restatement § 552(2). Under § 552(2), a party can only be liable for negligent

misrepresentation to the extent that "the maker of the representation intends it to reach and influence either a particular person or persons, known to him, or a group or class of persons, distinct from the much larger class who might reasonably be expected sooner or later to have access to the information and forseeably to take some action in reliance upon it." § 552(2), comment h; Standard Chartered PLC v. Price Waterhouse, 190 Ariz. 6, 29, 945 P.2d 317, - 10 -

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

340 (App. 1996). Savvis asserts that this requirement is fatal to Merrick's claims for negligence and negligent misrepresentation. See e.g., Kuehn, 91 P.3d at 350 (granting summary judgment where, although it was foreseeable that plaintiffs would gain access to and rely on the defendant's real estate appraisal, such information was not provided "for the guidance of" the plaintiffs); Hoffman v. Greenberg, 159 Ariz. 377, 379-80, 767 P.2d 725, 727-28 (App. 1988) (affirming directed verdict where although the defendant appraiser "may have been aware that investors make wide use of appraisals and that others rely on them," he was not told of the intended use of the appraisal in a transaction with the plaintiff). Savvis asserts that Merrick does not and cannot allege that Savvis made any representation of fact directly to Merrick intending to influence its behavior "distinct from the much larger class" of acquiring banks potentially entering into business transactions related to the Visa and MasterCard systems. Savvis references Merrick's allegations that Savvis made false representations concerning CardSystems's compliance with Visa's CISP requirements and that Savvis "knew, or reasonably should have known" that CardSystems would supply its findings to "acquiring banks like Merrick, with which CardSystems sought to establish a processing relationship." Complaint, ¶¶ 45­46. Savvis also points to Merrick's allegations that Savvis knew or intended that the Report would be provided by Visa to "acquirers needing the services of a Processor" or to acquiring banks "then considering a direct contractual relationship with CardSystems." Complaint,¶ 37 and ¶ 35. Savvis asserts that Arizona law does not extend liability for negligent misrepresentation to such an expansive group. See e.g., Standard Chartered, 945 P.2d at 340; Kuehn, 91 P.3d at 351. Merrick asserts, however, that it has alleged: (a) processors, such as CardSystems, needed the sponsorship of an acquiring bank, such as Merrick, in order to have access to the Visa and MasterCard interchange systems and process Card Transactions, (Compl. ¶¶ 10-11); (b) the sponsoring acquiring bank was responsible to the Associations for ensuring its processors, such as CardSystems, were in compliance with CISP, and was liable to the Associations for any losses resulting from a processor's failure to comply with Association regulations, including CISP, (Compl. ¶¶ 11, 14); (c) Merrick had agreed to sponsor - 11 -

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

CardSystems as a processor, (Compl. ¶ 12); and (d) Merrick would not allow CardSystems to process any Card Transactions until it was certified as CISP compliant, (Compl. ¶ 13, 16). Response, pp. 13-14. Savvis also points out that this Court has already held on the same basis that Savvis owed no duty to Cumis or its insured credit unions with respect to the issuance of the ROC. See RJN Ex. 3 at 18-19 [Doc. # 30] (holding § 552(2) "mandates dismissal of the negligence claims" because "no representations were made to Cumis or its insureds distinct from the larger class of all participants in the VISA and MasterCard systems"). Savvis argues that, like Cumis's insureds, Merrick was simply one of many acquiring banks in the business. Just as Savvis did not owe a duty to all issuing banks in the payment system such as Cumis's insureds, Savvis did not owe a duty to all acquiring banks in the Visa and MasterCard systems that could have potentially entered into a business relationship with CardSystems. Kuehn, 91 P.3d at 351; see also First Nat'l Bank of Commerce v. Monco Agency Inc., 911 F.2d 1053, 1058 (5th Cir. 1990) (holding that all "potential lenders" could not constitute a "limited group" of informational recipients of an audit report under the § 552 of the Restatement). Unlike the claims that were dismissed in the Cumis action, where Cumis and its insureds were not distinct from the larger class of all participants in the VISA and MasterCard systems, Merrick asserts that it is one of a small group of acquiring banks that in fact agreed to guarantee to the Associations the performance of CardSystems and was the only bank that authorized CardSystems interchange access to the Associations. Contrary to Savvis's assertion that Merrick was one of the countless acquiring banks that could have conceivably sponsored CardSystems, Merrick asserts that it was one of the handful of acquiring banks that had agreed to sponsor CardSystems prior to the completion of the audit and that Merrick expressly required CISP certification before agreeing to sponsor

- 12 -

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

CardSystems.6 Merrick asserts that the Complaint details that it was a limited group to which Savvis intended to supply the information or knows that CardSystems and Visa intended to supply the information. Additionally, Merrick asserts that the Complaint clearly alleges that Savvis provided the ROC to Visa knowing and intending that VISA would provide the ROC and its Full Compliance recommendation to banks, like Merrick, who were then considering a direct contractual relationship with CardSystems. Merrick also points out that the Complaint alleges that Savvis intended that the ROC would directly influence decisions made by Merrick and similarly situated banks with regard to CardSystems and the ability of CardSystems to safely participate in the Association networks. Merrick asserts that it is not required to plead that Savvis knew that Merrick specifically was the intended recipient of its CISP certification. Rather Merrick asserts that it has adequately pled that it was a member of the defined group that Savvis knew was the intended recipient of the ROC. See Standard Chartered, 945 P.2d at 342-43 ("It is enough that the maker know that the recipient intended to supply the information for the benefit of a limited group or class of persons and that the plaintiff be a member of that limited group or class."). Merrick asserts that its Complaint also alleges that its reliance must also concern a transaction that Savvis intended to influence: "In preparing the ROC and delivering the ROC to VISA, Savvis intended that the ROC would directly influence decisions made by Merrick and banks in a like position to Merrick with regard to CardSystems and the ability of CardSystems to safely participate in the Association networks." Complaint, ¶ 37. Merrick asserts that its factual allegations regarding the intended purpose of the CISP certification, that it was a defined group of acquiring banks, including Merrick, that provided access to the

In its briefs, Merrick asserts that it was one of less than ten of the acquiring banks that had agreed to sponsor CardSystems prior to the completion of the audit. Merrick asserts that the exact number and the fact that Merrick expressly required CISP certification will be established during discovery. During argument, Merrick clarified that seven banks sought to establish the processing relationship with card system. - 13 -

6

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Associations, and that it was a necessarily intended recipient of CardSystems's CISP certification, refute Savvis' spin on the facts for purposes of a motion for summary judgment. In its Reply, Savvis asserts that the the ROC itself, which Merrick references in its Complaint, makes clear that Savvis only intended it to be used by CardSystems for submission to Visa ­ every page of the ROC was stamped "CONFIDENTIAL," "Prepared for CardSystems," and "Not for redistribution." Supp. RJN Ex. 2. Savvis asserts that, under such circumstances, Arizona courts have held that defendants could not have intended such statements to influence outside third parties. See, e.g., Hoffman, 767 P.2d at 727-28 (noting defendant's appraisal report indicated it was for internal use only). However, Savvis does not discuss how the alleged agency relationship between Merrick and CardSystems affects this analysis. Moreover, in determining whether "it is clear that no relief could be granted under any set of facts that could be proven consistent with the allegations[,]" McGlinchy, 845 F.2d at 810, the Court should consider that discovery may lead to evidence regarding the normal practice in the business. However, Savvis also asserts that Merrick has simultaneously advanced two wholly inconsistent factual arguments: On the one hand, Merrick alleges that it was "one of the handful...of acquiring banks that in fact agreed to sponsor CardSystems prior to the completion of the audit," and "in fact agreed to guarantee to the Associations the performance of CardSystems." (Opp. at 14 (emphasis added); Complt ¶ 12). Yet, on the other hand, Merrick alleges that at the time that SAVVIS resubmitted the ROC, Merrick was only "then considering a direct contractual relationship with CardSystems." (Opp. at 14 (emphasis added); Complt. ¶¶ 35, 37). Reply, p. 10. Savvis argues that, if Merrick was one of several banks that had already agreed to sponsor CardSystems prior to the completion of the CISP assessment, it could not possibly have been induced to enter into those agreements by statements made by Savvis and Savvis could not possibly have intended to influence agreements that had already been executed when it resubmitted the ROC. See Kuehn, 91 P.3d at 350-351 (noting appraisal not provided "for the guidance of" plaintiff where plaintiff was already contractually bound to purchase the property before receiving appraisal). However, if Merrick was only considering entering - 14 -

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

into a contractual relationship with CardSystems prior to the completion of the CISP assessment, then Savvis asserts that, like Cumis, Merrick was simply a member of a larger class of parties in the four-party payment system who might reasonably be expected sooner or later to have access to the information. See, e.g., Hoffman, 767 P.2d at 727-28 (finding no duty where appraiser "may have been aware that investors make wide use of appraisals and that others rely on them," but was not told of intended use of appraisal in a transaction with plaintiff). Savvis asserts that, because Merrick does not contest that any acquiring bank could at any time become a sponsor of CardSystems, the group of which Merrick claims to be a member (i.e., acquiring banks "considering" a contractual relationship with CardSystems) was far from "limited," but rather encompassed an ever changing and potentially expanding number of recipients. A reasonable reading of the Complaint reveals allegations that Merrick was a member of a limited group of banks, distinct from the much larger class who might reasonably be expected sooner or later to have access to the information and to forseeably take some action in reliance upon the information. See § 552(2), comment h; Standard Chartered, 190 Ariz. at 29. Merrick alleged that, in or about January 2004, it did not permit CardSystems to act as either ISO or Processor until Merrick was satisfied that CardSystems was compliant with all Association rules and regulations related to Processors. Because CardSystems was not certified as CISP compliant in January 2004, Merrick did not permit CardSystems to process any Card Transactions until it obtained the certification. In other words, Merrick was in a contingent-like agreement, which when satisfied (CISP compliance), permitted further contractual actions. The Court also finds that the Complaint alleges that Savvis intended that the ROC would directly influence decisions made by Merrick and similarly situated banks with regard to CardSystems and the ability of CardSystems to safely participate in the Association networks. See Standard Chartered, 945 P.2d at 342-43 ("It is enough that the maker know that the recipient intended to supply the information for the benefit of a limited group or class of persons and that the plaintiff be a member of that limited group or class."). - 15 -

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Moreover, the Court finds Merrick has adequately alleged its reliance concerns a transaction that Savvis intended to influence ­ Merrick has adequately alleged that it was a necessarily intended recipient of CardSystems's CISP certification. Accordingly, IT IS ORDERED: 1. 2. Savvis's Request for Judicial Notice [Doc. #s 30 and 50] are GRANTED. Savvis's Motion for Judgment on the Pleadings [Doc. # 29] is DENIED.

DATED this 8th day of January, 2010.

- 16 -