Banc of Am. Merch. Servs., LLC v. Arby's Rest. Grp., Inc.

Banc of Am. Merch. Servs., LLC v. Arby’s Rest. Grp., Inc., 2021 NCBC 41.

STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE
SUPERIOR COURT DIVISION
MECKLENBURG COUNTY 20 CVS 426

BANC OF AMERICA MERCHANT
SERVICES, LLC,

Plaintiff and Counterclaim
Defendant,

v.
ORDER AND OPINION
ARBY’S RESTAURANT GROUP, ON CROSS-MOTIONS FOR
INC.,
SUMMARY JUDGMENT
Defendant, Counterclaim
Plaintiff, and Third-Party
Plaintiff,

v.

VISA, INC.; and MASTERCARD
INTERNATIONAL INC.,

Third-Party Defendants.

1. Arby’s Restaurant Group, Inc. operates a nationwide chain of fast-food

restaurants. In 2017, it reported a data security breach that exposed the payment

card data of many of its customers. Two payment card organizations—Visa, Inc. and

Mastercard International Inc.—separately reviewed the incident and concluded that

Arby’s had not complied with prevailing industry standards for data security. Arby’s

disputed this at the time and continues to dispute it now. Nevertheless, Visa and

Mastercard assessed nearly $20 million in penalties and fees. They did not impose

these assessments on Arby’s, which has no direct relationship with either card

organization. Instead, they imposed the assessments on Banc of America Merchant
Services, LLC (“BAMS”), the bank that sponsored Arby’s as a participating merchant

in the payment card networks. 1

2. This case is about who bears ultimate responsibility for the assessments.

After exhausting appeals before Visa and Mastercard, BAMS paid the assessments

and then asked Arby’s for reimbursement. Arby’s refused; BAMS sued. In short,

BAMS believes that it has a right to be indemnified for the assessments under its

contract with Arby’s and that Arby’s breached the contract when it refused to pay.

Arby’s denies that it has any duty to indemnify BAMS. It also contends that Visa

and Mastercard never should have imposed the assessments in the first place and

has asserted third-party claims against them.

3. Several motions are currently pending. Visa and Mastercard have each

moved to dismiss the third-party claims asserted by Arby’s. A separate opinion, also

issued today, addresses those motions.

4. Two other motions are the subject of this opinion. BAMS and Arby’s agreed

to defer discovery in favor of early summary-judgment practice as to their claims and

defenses against one another. BAMS seeks partial summary judgment; Arby’s

contends that it is entitled to summary judgment across the board. For the following

reasons, the Court DENIES both motions.

McGuireWoods LLP, by Jodie Herrmann Lawson, and Covington &
Burling LLP, by Alexander A. Berengaut, for Plaintiff/Counterclaim
Defendant Banc of America Merchant Services, LLC.

1 It would be more accurate to say that Visa and Mastercard imposed the fees on Bank of

America, N.A. (“BANA”), which is related to BAMS. The parties agree, though, that BANA
has assigned its claims in this case to BAMS. To avoid unnecessarily complicating the facts,
the Court refers to both, together, as BAMS throughout this opinion.
Smith, Anderson, Blount, Dorsett, Mitchell & Jernigan, L.L.P., by
Christopher G. Smith, and Orrick, Herrington & Sutcliffe LLP, by Seth
Harrington and Douglas H. Meal, for Defendant/Counterclaim
Plaintiff/Third-Party Plaintiff Arby’s Restaurant Group, Inc.

Bradley Arant Boult Cummings LLP, by C. Bailey King, Jr. and Bridget
V. Warren, and O’Melveny & Myers LLP, by Randall W. Edwards,
Megan Havstad, and Eric Ormsby, for Third-Party Defendant Visa Inc.

Cozen O’Connor, by Tracy L. Eggleston, and Golenbock Eiseman Assor
Bell & Peskoe LLP, by Martin S. Hyman and Matthew C. Daly, for Third-
Party Defendant Mastercard International, Inc. 2

Conrad, Judge.
I.
BACKGROUND

5. The Court does not make findings of fact when ruling on motions for

summary judgment. The following background, drawn from the evidence submitted

by the parties, is intended only to provide context for the Court’s analysis and ruling.

6. The issues presented require some understanding of the structure of

payment card networks. At the center, of course, are the card organizations. Visa

and Mastercard operate the networks that make debit and credit card transactions

possible. (See Joint Stip. Suppl. Facts ¶ 1, ECF No. 32 [“Stip.”].) But neither the

consumers who use credit and debit cards nor the merchants that accept them have

a direct relationship with Visa or Mastercard. Rather, consumers and merchants

participate in the networks through intermediaries. Consumers get payment cards

from “issuers” (financial institutions that issue the cards), and merchants affiliate

with “acquirers” (financial institutions that offer access to the networks). (See Stip.

2 After
these motions were filed, the Court granted Ms. Warren, Ms. Lawson, and Ms.
Havstad leave to withdraw as counsel. (ECF Nos. 93, 131, 136.)
¶¶ 3–5.) Acquirers and issuers in turn have contracts with Visa, Mastercard, or both.

(See Stip. ¶ 6.)

7. Acquirers and issuers play key roles, again as intermediaries, in processing

card transactions. When a consumer presents a card for payment at the point of sale,

the merchant transmits the card information to its acquirer. The acquirer then asks

the relevant card organization and issuer to authorize the transaction. Assuming

authorization is given, the consumer and the merchant complete the transaction, and

the issuer pays the merchant sometime later. (See Stip. ¶ 6.)

8. Here, BAMS is an acquirer for Visa and Mastercard and has a contract with

each. (See Stip. ¶¶ 7, 10.) Arby’s is one of BAMS’s affiliated merchants. The

merchant agreement between Arby’s and BAMS dates to 2009; it is separate and

distinct from BAMS’s contracts with Visa and Mastercard. (See Stip. ¶ 9.)

9. This case is about data security—specifically, the responsibilities of BAMS

(as acquirer) and Arby’s (as merchant) to safeguard payment card data and to pay for

losses resulting from a data breach. Visa and Mastercard publish extensive rules

related to data security—and many other things—and incorporate them into

contracts with acquirers, including BAMS. (See Stip. ¶ 10.) It is BAMS’s

responsibility to ensure that its merchants meet industry standards for data security,

formally called Payment Card Industry (“PCI”) Data Security Standards. (See Stip.

¶ 10.)

10. Each card organization also oversees programs designed to remedy losses

from a security breach. These include Visa’s Account Information Security (“AIS”)
and Global Compromised Account Recovery (“GCAR”) programs and Mastercard’s

Account Data Compromise (“ADC”) program. The details of each program are in the

record (swelling to over a hundred pages), but a summary will suffice. (See App. Exs.

D, E, G, K, O, ECF No. 33.1.)3 In short, if a merchant suffers a data security incident,

Visa and Mastercard may impose assessments on BAMS using various criteria.

BAMS has the right to appeal. Assuming the appeal is denied and payment is made,

Visa and Mastercard then distribute the funds to participating issuers, ostensibly to

compensate them for losses due to fraud and the need to issue replacement cards to

consumers. (See App. Ex. O at 1; App. Ex. Q at 12.) The AIS program also takes into

account reputational harm to Visa from the incident. (App. Ex. K at 11.) Neither

card organization takes a position on whether BAMS can or should seek

reimbursement from the merchant for assessments imposed through these programs.

(See App. Ex. D §§ 1.10.4.1, 1.12.3.1; App. Ex. E §§ 10.1, 10.2.1; see also App. Ex. H

at 1; App. Ex. P at 3.)

11. BAMS’s merchant agreement with Arby’s incorporates the card

organization rules issued by Visa and Mastercard. Arby’s must comply with those

rules and any applicable “existing and future” PCI Data Security Standards. (App.

Ex. A § 13(A) [“Merchant Agrmt.”]; see also Merchant Agrmt. §§ 1, 7(A)(xi).) Section

13, which deals with information security, also requires Arby’s to “engage a certified

forensic vendor acceptable to the Card Organizations” after any “suspected or

confirmed” data breach. (Merchant Agrmt. § 13(D).)

3 All citations to appendix exhibits (“App. Exs.”) are located at ECF No. 33.1.
12. Two other provisions of the merchant agreement are especially relevant.

Section 10(B) requires Arby’s (the “MERCHANT”) to pay certain fees imposed by Visa

and Mastercard (the “Card Organizations”) on BAMS (the “BANK”). The section

states in full as follows:

MERCHANT will pay to BANK all assessments, fines, penalties, fees, Card
issuer reimbursements and similar charges imposed by Card Organizations
on BANK (the ‘Card Organization Penalties’), directly related to
MERCHANT’s Card transactions or based on MERCHANT’s actions or
failure to act with respect to compliance with the Card Organization Rules or
Merchant’s breach of Section 13 (Information Security), except to the extent
that such amounts are due to BANK’s negligence or willful misconduct.

(Merchant Agrmt. § 10(B).) In addition, Section 21 requires Arby’s to indemnify

BAMS against “all losses” that “result from or arise out of any breach” of the

agreement. (Merchant Agrmt. § 21.)

13. In early 2017, BAMS disclosed a suspected data breach to Arby’s. (See Stip.

¶ 11.) Arby’s hired a forensic investigator. (See Stip. ¶ 12.) Not long after, Arby’s

publicly announced that an “intruder” had installed malware “on the point-of-sale

(POS) systems of certain restaurants” and, as a result, “may have been able to access

data from payment cards used” between October 2016 and January 2017. (App. Ex.

T at 1.) The stolen data “included the cardholder name and number” in some

instances. (App. Ex. T at 1.) In its final report, the investigator concluded that Arby’s

was not compliant with the PCI Data Security Standards. (See App. Ex. K at 1.)

14. Visa and Mastercard reviewed the incident and, ultimately, agreed with the

investigator’s conclusions. (See App. Ex. K at 1; App. Ex. O at 2.) Each card

organization then independently assessed fees against BAMS. Mastercard’s ADC
assessment approached $4.5 million. Visa’s GCAR and AIS assessments together

approached $16.5 million. (See Stip. ¶¶ 13, 17, 20.)

15. After notifying Arby’s of the assessments, BAMS submitted appeals asking

Visa and Mastercard to reduce or rescind them. During the appeal process, Arby’s

worked with BAMS to “prepare[ ] the appeal document[s]” and aimed to show that it

had complied with the PCI Data Security Standards. (App. Ex. K at 1 n.1; see also

App. Ex. I at 1; App. Ex. J at 1; App. Ex. L at 1–2; App. Ex. N at 1; App. Ex. Q at 15.)

Visa ultimately upheld its assessments, but Mastercard agreed to reduce the ADC

assessment. (See Stip. ¶¶ 14, 18, 21; App. Ex. L at 2; App. Ex. O at 1; App. Ex. S at

1.) The total bill, including appeal fees, exceeded $19 million. (See Stip. ¶ 23.)

16. Once the appeals were over, BAMS paid in full and then sought

reimbursement from Arby’s under sections 10(B) and 21 of the merchant agreement.

Arby’s refused, prompting this lawsuit. BAMS contends that it has a contractual

right to be indemnified for the assessments imposed by Visa and Mastercard. It

asserts claims for breach of the merchant agreement and for declaratory judgment.

Arby’s argues in response that it has no duty to indemnify BAMS for the assessments

under section 10(B) and section 21.

17. At the request of the parties, the Court agreed to delay discovery and to

entertain early motions for summary judgment. (See Case Management Order at 4–

5, ECF No. 22.) BAMS has moved for partial summary judgment on its claim for

breach of section 10(B) of the merchant agreement. (See ECF No. 30.) Arby’s has

cross-moved for summary judgment on all claims asserted against it. (See ECF No.
34.) Although the onset of the COVID-19 pandemic delayed matters for a time, the

motions are now fully briefed and ripe for disposition.

II.
LEGAL STANDARD

18. Summary judgment is appropriate “if the pleadings, depositions, answers to

interrogatories, and admissions on file, together with the affidavits, if any, show that

there is no genuine issue as to any material fact and that any party is entitled to a

judgment as a matter of law.” N.C. R. Civ. P. 56(c). In deciding a motion for summary

judgment, the Court views the evidence in the light most favorable to the opposing

party, taking its evidence as true and drawing inferences in its favor. See, e.g., Furr

v. K-Mart Corp., 142 N.C. App. 325, 327 (2001).

19. The moving party “bears the initial burden of demonstrating the absence of

a genuine issue of material fact.” Liberty Mut. Ins. Co. v. Pennington, 356 N.C. 571,

579 (2002). If the moving party carries this burden, the opposing party “may not rest

upon the mere allegations or denials of his pleading,” N.C. R. Civ. P. 56(e), but must

instead “come forward with specific facts establishing the presence of a genuine

factual dispute for trial,” Liberty Mut. Ins. Co., 356 N.C. at 579. “An issue is ‘genuine’

if it can be proven by substantial evidence and a fact is ‘material’ if it would constitute

or irrevocably establish any material element of a claim or a defense.” Lowe v.

Bradford, 305 N.C. 366, 369 (1982) (quoting Bone Int’l, Inc. v. Brooks, 304 N.C. 371,

374–75 (1981)).

20. When a party requests offensive summary judgment on its own claims for

relief, “a greater burden must be met.” Brooks v. Mount Airy Rainbow Farms Ctr.,
Inc., 48 N.C. App. 726, 728 (1980). The moving party “must show that there are no

genuine issues of fact, that there are no gaps in his proof, that no inferences

inconsistent with his recovery arise from the evidence, and that there is no standard

that must be applied to the facts by the jury.” Parks Chevrolet, Inc. v. Watkins, 74

N.C. App. 719, 721 (1985). For that reason, it is “rarely . . . proper to enter summary

judgment in favor of the party having the burden of proof.” Blackwell v. Massey, 69

N.C. App. 240, 243 (1984).

III.
ANALYSIS

21. The issues presented center on section 10(B) and section 21 of the merchant

agreement. Each section requires Arby’s to indemnify BAMS for certain losses to

third parties. The parties dispute the scope of any right to indemnification and

whether Arby’s must indemnify BAMS for the assessments imposed by Visa and

Mastercard after the data security incident in 2017.

22. BAMS seeks partial summary judgment, limited to its claim for breach of

section 10(B). It contends that Arby’s is responsible for the assessments under the

plain language of that provision. In opposition, Arby’s maintains that BAMS has

misread section 10(B). In addition, in its own motion for summary judgment, Arby’s

offers several arguments based on principles of indemnification law and other

provisions of the merchant agreement. On these grounds, Arby’s contends that it is

entitled to summary judgment on all claims or, at a minimum, that BAMS’s motion

must be denied.
23. The Court begins with the parties’ competing interpretations of section

10(B). After that, the Court turns to each ground raised by Arby’s.

A. Section 10(B)

24. Section 10(B) states that Arby’s must pay “Card Organization Penalties”

that are (1) “directly related to [its] Card transactions” or (2) “based on [its] actions

or failure to act with respect to compliance with the Card Organization Rules or [its]

breach of Section 13 (Information Security).” (Merchant Agrmt. § 10(B).) BAMS

contends, and Arby’s disagrees, that the assessments imposed by Visa and

Mastercard satisfy both conditions. They base their arguments on conflicting

interpretations of the contract language.

25. The object of contract interpretation is to ascertain the parties’ intent at the

time the contract was made. See, e.g., Lane v. Scarborough, 284 N.C. 407, 409–10

(1973). To do so, courts look to the words used by the parties. When the parties have

defined a term, “that definition is to be used. If no definition is given, non-technical

words are to be given their meaning in ordinary speech, unless the context clearly

indicates another meaning was intended.” Singleton v. Haywood Elec. Membership

Corp., 357 N.C. 623, 629 (2003) (quoting Gaston Cnty. Dyeing Mach. Co. v. Northfield

Ins. Co., 351 N.C. 293, 299 (2000)). “Intent is derived not from a particular

contractual term but from the contract as a whole.” State v. Philip Morris USA Inc.,

359 N.C. 763, 773 (2005) (citation omitted).

26. “A contract that is plain and unambiguous on its face will be interpreted by

the court as a matter of law.” Schenkel & Shultz, Inc. v. Hermon F. Fox & Assocs.,
P.C., 362 N.C. 269, 273 (2008) (citation omitted). The interpretation of an ambiguous

contract depends on extrinsic evidence and is a question for the jury. See id. “An

ambiguity exists in a contract when either the meaning of words or the effect of

provisions is uncertain or capable of several reasonable interpretations.” Register v.

White, 358 N.C. 691, 695 (2004) (citations omitted).

27. “Directly related to . . . Card transactions.” It goes without saying that

the phrase “related to” is broad. BAMS defines the phrase to mean “to stand in some

relation; to have bearing or concern; to pertain; refer; to bring into association with

or connection with.” (BAMS Br. in Supp. 13, ECF No. 31 (quoting Morales v. Trans

World Airlines, Inc., 504 U.S. 374, 383 (1992)).) Arby’s prefers “connected to,

influenced by, or caused by something.” (Arby’s Opp’n 11, ECF No. 102

(quoting Related, Cambridge Dictionary, https://dictionary.cambridge.org/dictionary

/english/related (last visited June 27, 2021)).) These are different ways of saying the

same thing, and neither party has suggested that choosing one formulation over the

other makes a difference.

28. The parties instead wrestle over the word “directly” and what it means for

two things to be “directly related to” one another. BAMS interprets “directly” to mean

“in unmistakable terms.” (BAMS Br. in Supp. 13 (emphasis omitted) (quoting State

v. Jones, 267 N.C. App. 615, 624 (2019)).) Arby’s interprets it to mean “without

anything else being involved or in between.” (Arby’s Opp’n 11 (quoting Directly,

Cambridge Dictionary, https://dictionary.cambridge.org/dictionary/english/directly

(last visited June 27, 2021)).)
29. Arby’s is correct. In ordinary usage, the word “directly” suggests closeness,

immediacy, or adjacency between two things. A direct flight, for example, begins in

one city and ends in another with no stops in between. In a baseball doubleheader,

the second game follows directly after the first. Events (or things or places or actions)

are directly related when nothing intervenes or comes between them. See Directly,

Cambridge Dictionary, https://dictionary.cambridge.org/dictionary/english/directly

(last visited June 27, 2021) (“without anything else being involved or in between”);

see also Direct, Merriam-Webster Dictionary, https://www.merriam-

webster.com/dictionary/direct (last visited June 27, 2021) (defining “direct” as

“proceeding from one point to another in time or space without deviation or

interruption,” “stemming immediately from a source,” and “marked by absence of an

intervening agency, instrumentality, or influence”).

30. The interpretation urged by BAMS, on the other hand, is not reasonable. It

is based on a definition of “directly” taken from two Court of Appeals decisions,

neither of which is relevant, much less controlling. See Jones, 267 N.C. App. at 624–

26; State v. Powell, 253 N.C. App. 590, 599–605 (2017). The context in those cases—

construction of a statute governing warrantless searches of probationers—was

radically different. And the definition adopted by the Court of Appeals came from a

dictionary published in 1966, which isn’t remotely contemporaneous with the

merchant agreement. See Jones, 267 N.C. App. at 624–25; Powell, 253 N.C. App. at

600. It therefore has little interpretive value. See, e.g., Nat’l Union Fire Ins. Co. v.

Beelman Truck Co., 203 F. Supp. 3d 312, 319 (S.D.N.Y. 2016) (“[C]ourts interpreting
language by consulting dictionaries look for those contemporaneous to the writing at

issue.”).

31. Thus, the contract language is unambiguous. In the context of section 10(B),

card organization penalties are “directly related to” underlying card transactions if

nothing intervenes or comes between them.

32. BAMS worries that this interpretation will render the contract language

superfluous because no card organization penalties would ever directly relate to card

transactions. (See BAMS Reply Br. 6–7, ECF No. 111.) As Arby’s observes, however,

the card organizations impose many types of fines and fees. Some arise simply

because a transaction has occurred. (See Arby’s Opp’n 14 n.11; see also App. Ex. B.)

It stands to reason that fees of that sort are directly related to underlying card

transactions. Although the language is narrower than BAMS would like, it is not

superfluous.

33. Whether the assessments at issue are directly related to card transactions

is a genuine issue of material fact. BAMS argues that the forensic investigator

reviewed card transaction data 4 after the incident and that this data was the “key

variable” used by Visa and Mastercard when calculating and imposing their

assessments. (BAMS Br. in Supp. 15 (emphasis omitted).) But Arby’s has offered

4 It is noteworthy that BAMS focuses on card transaction data. A reasonable observer might
wonder whether an assessment derived from card transaction data is directly related to the
underlying transactions themselves—and whether the answer depends on the type of data
involved. Because BAMS is seeking offensive summary judgment, it had the burden to show
that there are no gaps in its proof or inferences inconsistent with its recovery. See Parks
Chevrolet, 74 N.C. App. at 721. At no point in its briefs does BAMS tie its understanding of
the phrase “Card transactions” to its evidence of associated data. It has not carried its
burden, even under its own interpretation of the agreement.
evidence that the assessments resulted from a complex web of events: the malicious

installation of malware by a criminal intruder, alleged violations of industry data

security standards by Arby’s, remedial actions by issuers to address fraudulent

charges, and discretionary decisions of the card organizations to impose penalties.

(See Arby’s Opp’n 15.) A reasonable jury could conclude that there were intervening

actions or events between the underlying card transactions and the assessments such

that the relationship between the two is not direct.

34. “Based on” Compliance “with the Card Organization Rules.” The

second half of section 10(B) requires Arby’s to pay assessments that are “based on”

its “actions or failure to act with respect to compliance with the Card Organization

Rules” or its “breach of Section 13” of the merchant agreement. (Merchant Agrmt.

§ 10(B).) BAMS calls this a “strict liability” provision. Its position is that Arby’s must

pay the assessments at issue because Visa and Mastercard found that Arby’s did not

comply with their rules and related industry standards. This is so, BAMS contends,

whether the findings of noncompliance were correct or not. (See BAMS Br. in Supp.

16–19.)

35. Arby’s rejects that interpretation and argues that its obligation to reimburse

BAMS, if any, extends only to assessments that are based on actual noncompliance.

This means that BAMS must show that the findings of noncompliance by Visa and

Mastercard were correct. Arby’s contends that BAMS has not done so and that the

findings were erroneous. (See Arby’s Opp’n 19–21.)
36. The contract language is not as broad as BAMS suggests. The assessments

that Arby’s agreed to pay are those based on its “actions or failure to act” or based on

its “breach of Section 13.” Read most naturally, this language means that the

obligation to pay an assessment depends on what Arby’s did or didn’t do. It would be

awkward and unreasonable to read the language to mean that Arby’s is responsible

for assessments erroneously based on actions that never happened or a nonexistent

breach of the merchant agreement. Yet that is what BAMS advocates. Under

BAMS’s interpretation, Arby’s would be responsible even if it fully complied with all

card organization rules, industry standards, and the merchant agreement. That

result would be inconsistent with the contract language and contrary to the

reasonable expectation of the parties.

37. BAMS contends that the merchant agreement as a whole supports its

position. (See BAMS Br. in Supp. 20–22.) Not so. For example, BAMS points to

section 19(A), which requires Arby’s to fund a reserve account if it “is likely to be

subject to Card Organization Penalties as defined in Section 10 (B).” (Merchant

Agrmt. § 19(A).) But section 19(A) does not say which penalties Arby’s is responsible

for paying.

38. Likewise, section 13(C) is no help. Under that provision, if Arby’s engages

a third-party provider, the provider must register with the card organizations and

comply with industry data security standards. Failure to comply might result in fines

or assessments by the card organizations. If the provider doesn’t pay, then Arby’s

must. (See Merchant Agrmt. § 13(C); see also App. Ex. B § 2.) This may mean that
Arby’s bears responsibility for noncompliance by its providers. It does not suggest

that Arby’s must pay assessments erroneously made by the card organizations

despite full compliance with their rules and the merchant agreement.

39. The same is true for section 10(A), which addresses “Card Organization

Charges” listed in Schedules A and B to the agreement. Among other things, Arby’s

must pay BAMS “all [c]hargebacks determined to be valid under Card Organization

Rules.” (Merchant Agrmt. § 10(A).) BAMS argues that the “ ‘validity’ requirement

in Section 10(A)” means that the parties “did not intend to impose a similar limitation

on Arby’s payment obligations under Section 10(B).” (BAMS Br. in Supp. 19.) That

ignores the surrounding context. The so-called validity requirement distinguishes

chargebacks from other “Card Organization Charges” in section 10(A): Arby’s is

responsible for “all authorizations” and “all Transaction Records submitted for

processing,” but its responsibility as to chargebacks is limited to those “determined

to be valid.” (Merchant Agrmt. § 10(A).) Simply put, the use of the word “valid” in

section 10(A) has no bearing at all on section 10(B), nor does it speak to what it means

for an assessment to be “based on” a failure to comply or a breach of contract by

Arby’s.

40. In short, nothing in section 10(B) makes Arby’s responsible for assessments

based on a perceived but unsubstantiated failure to comply with card organization

rules. Accordingly, the Court concludes that section 10(B) is unambiguous and adopts

the interpretation proposed by Arby’s. And because section 10(B) is unambiguous,

the Court need not and does not consider BAMS’s extrinsic evidence concerning
“customary industry practice,” (BAMS Br. in Supp. 23). See, e.g., Ludlam v. Miller,

225 N.C. App. 350, 365 (2013).

41. As to whether Arby’s complied with the card organization rules or breached

section 13, the facts are in dispute. BAMS has not argued or shown otherwise.

Consequently, there are genuine issues of material fact concerning whether the

assessments were “based on” a failure to comply with card organization rules or a

breach of section 13 of the merchant agreement.

B. Defenses by Arby’s

42. Arby’s asserts three defenses that it contends require entry of summary

judgment in its favor or, at a minimum, denial of BAMS’s motion. The Court

addresses each in turn.

43. Voluntary Payment. Arby’s contends that it had no duty to indemnify

BAMS because BAMS had no duty to pay the assessments by Visa and Mastercard

in the first place. According to Arby’s, the assessments were unlawful contractual

penalties, which BAMS could have and should have refused to pay. Maintaining that

it had no duty to indemnify BAMS for voluntary payments to third parties, Arby’s

seeks summary judgment as to the claims for breach of section 10(B) and section 21.

(See Arby’s Br. in Supp. 16–26, ECF No. 35.)

44. BAMS responds that it was required to pay the assessments because they

were the product of valid and enforceable liquidated damages provisions in its

contracts with Visa and Mastercard. Even if not required to pay the assessments,

BAMS insists that it did so in good faith, reasonably believing that it owed them.
Either way, BAMS contends, it was not a volunteer and has a right to be indemnified.

(See BAMS Opp’n 16–26, ECF No. 103.)

45. These competing positions raise a threshold question about the appropriate

standard to apply. Must BAMS prove that it was actually liable to Visa and

Mastercard, as Arby’s contends? Or is BAMS correct that it must prove only that it

paid the assessments in the good-faith belief that it was liable?

46. North Carolina follows the traditional common-law rule that indemnity

“does not cover losses for which the indemnitee is not liable to a third person, and

which he improperly pays.” N.W. Mut. Ins. Co. v. Hylton, 7 N.C. App. 244, 250 (1970)

(citation and quotation marks omitted); see also City of Wilmington v. N.C. Nat. Gas

Corp., 117 N.C. App. 244, 250 (1994). This follows from the fundamental nature of

indemnity, which “is to make good and save another harmless from loss on some

obligation which he has incurred or is about to incur to a third party.” New

Amsterdam Cas. Co. v. Waller, 233 N.C. 536, 537 (1951). As a result, the party

seeking indemnity usually must plead and prove that it was liable to the injured third

party. See id. at 537–38; see also One Beacon Ins. Co. v. United Mech. Corp., 207 N.C.

App. 483, 489–90 (2010).

47. But there are significant exceptions to this rule. If, for example, the

indemnity claim is based on an express contract, the terms of the contract control and

may depart from common-law rules. See, e.g., Old Republic Sur. Co. v. Reliable Hous.,

Inc., 2002 N.C. App. LEXIS 2524, at *5–8 (N.C. Ct. App. Dec. 3, 2002) (unpublished)
(“Strict indemnity provisions . . . are quite common and have been upheld repeatedly

in North Carolina and a variety of other jurisdictions.”).

48. In addition, in most jurisdictions, “[w]hen an indemnitor has notice of the

claim against it, the general rule is that the indemnitor will be bound by any

reasonable good faith settlement the indemnitee might thereafter make.” Fidelity

Nat’l Title Ins. Co. of N.Y. v. First N.Y. Title & Abstract Ltd., 269 A.D.2d 560, 561

(N.Y. App. Div. 2000) (citation and quotation marks omitted). The indemnitee need

not show actual liability; it is enough to show potential liability. See id. at 561–62. 5

49. This approach furthers the public policy favoring settlements in civil

litigation. As courts around the country have observed, requiring an indemnitee to

show actual liability in every case would “remove most of the incentive to settle.”

Valloric v. Dravo Corp., 178 W. Va. 14, 19 (1987). The indemnitee would face an

unpalatable choice: litigate the underlying claim to final judgment “and then enforce

the judgment against the indemnitor,” or settle the claim and begin the deeply

uncomfortable task of trying to prove liability against itself. Id. To encourage

settlement, the burden on the indemnitee “must not be too great.” Morrissette v.

Sears, Roebuck & Co., 114 N.H. 384, 388 (1974).

5 See also, e.g., Chevron Oronite Co., L.L.C. v. Jacobs Field Servs. N. Am., Inc., 951 F.3d 219,

226 (5th Cir. 2020); CSX Transp., Inc. v. Crislip Motor Lodge, Inc., 1997 U.S. App. LEXIS
16796, at *7–8 (4th Cir. July 8, 1997) (unpublished); GAB Bus. Servs., Inc. v. Syndicate 627,
809 F.2d 755, 760 (11th Cir. 1987); Atl. Richfield Co. v. Interstate Oil Transp. Co., 784 F.2d
106, 112 (2d Cir. 1986); Mo. Pac. R.R. Co. v. Ark. Oak Flooring Co., 434 F.2d 575, 580 (8th
Cir. 1970); MT Builders, L.L.C. v. Fisher Roofing Inc., 219 Ariz. 297, 308–09 (Ariz. Ct. App.
2008); Grand Trunk W. R.R., Inc. v. Auto Warehousing Co., 262 Mich. App. 345, 354–55
(2004); Stone Bldg. Co. v. Star Elec. Contractors, 796 So. 2d 1076, 1090 (Ala. 2000).
50. If the indemnitee fails to give reasonable notice, however, it is not entitled

to this relaxed, potential-liability standard. Courts have resisted the notion that the

“unilateral acts” of the indemnitee can “bind the indemnitor without notice and an

opportunity to be heard.” GAB Bus. Servs., 809 F.2d at 760 (citing Jennings v. United

States, 374 F.2d 983, 986 (4th Cir. 1967)). Without reasonable notice of the

underlying claim, the indemnitor cannot protect its interests by taking over the

defense, participating in settlement negotiations, or reviewing and approving the

settlement. When the indemnitor has been kept in the dark, fairness demands that

the indemnitee prove its actual liability for the underlying claim.

51. North Carolina courts follow similar principles. Consider, for example, the

decision in Kirkpatrick & Associates, Inc. v. Wickes Corp., 53 N.C. App. 306 (1981).

There, the indemnitor received notice of the underlying claim and was invited to

assume the defense. When the indemnitor refused to do so, the indemnitee was

“entitled to make a good faith settlement” of the underlying claim because “the law

encourages settlements.” Id. at 311. The Court of Appeals rejected the argument

that the settlement was “merely voluntary.” Id. at 310–11. Without requiring proof

of actual liability, the Court presumed that the settlement was “fair and reasonable”

and put the burden on the indemnitor to show “a lack of good faith.” Id. at 311.

52. The Court of Appeals reached a similar result in Bridgestone/Firestone, Inc.

v. Ogden Plant Maintenance Co. of North Carolina, 144 N.C. App. 503 (2001). That

case involved an underlying claim for wrongful death. Two defendants in the

wrongful-death suit settled before trial. The third defendant settled during trial and
then sued its former codefendants for contractual indemnification. The dispute over

indemnification turned on whether this latter settlement was a voluntary payment.

The Court of Appeals concluded that it was not because the indemnitee “was faced

with the prospect of costly and protracted litigation as the only remaining defendant

in” the underlying wrongful-death action. Id. at 509. This was true even without an

“admission, finding or adjudication of negligence on the part of [the indemnitee] in

the underlying action.” Id.

53. These binding appellate decisions are consistent with the standards applied

in most jurisdictions. In sum, when an indemnitee seeks to be indemnified after a

settlement with a third party, its burden depends on the notice given to the

indemnitor. An indemnitor that receives adequate notice of the underlying

third-party claim and an opportunity to be heard is bound by a reasonable, good-faith

settlement of that claim so long as the indemnitee can show potential liability. If the

indemnitor receives no notice or inadequate notice, the indemnitee may prevail only

if it can show actual liability.

54. Arby’s did not argue or attempt to show that it lacked notice of the

assessments or that it was deprived of an opportunity to be heard. Indeed, the

evidence tends to show that it received both. BAMS notified Arby’s of the

assessments shortly after they were made. (See Stip. ¶¶ 13, 14, 17, 18, 20, 21; App.

Exs. W, Z.) In addition, Arby’s actively participated in the appeals process, working

with BAMS to urge Visa and Mastercard to reduce or rescind the assessments. (See

App. Ex. I at 1; App. Ex. J at 1; App. Ex. K at 1 n.1; App. Ex. L at 1–2.)
55. To be sure, it does not appear that BAMS formally tendered the defense to

Arby’s at any point. Evidence of a formal tender would enhance the case for applying

a potential-liability standard, but it isn’t necessarily required. Compare Kirkpatrick

& Assocs., 53 N.C. App. at 311 (indemnitee tendered defense), with Bridgestone, 144

N.C. App. at 509 (no evidence that indemnitee tendered defense); see also, e.g.,

Chevron Oronite, 951 F.3d at 226 (“A formal tender isn’t required . . . .”); GAB Bus.

Servs., 809 F.2d at 760 (same). Moreover, some evidence suggests that Arby’s

received substantially similar protections. For example, through the appeal process,

Arby’s and BAMS together convinced Mastercard to reduce its assessment by nearly

$2 million. (App. Ex. O at 1.) And it was only after the card organizations denied the

remaining appeals that BAMS acquiesced and paid the assessments. (See Stip. ¶¶ 15,

19, 22.)

56. Summary judgment is therefore not appropriate. Arby’s has not shown that

BAMS must prove its actual liability for the assessments by Visa and Mastercard.

Rather, viewed in a light most favorable to BAMS, the evidence tends to show that

Arby’s had notice of the assessments and an opportunity to be heard, meaning that

BAMS need only show its potential liability. Ample evidence suggests that BAMS

was at least potentially liable for the assessments under its contracts with Visa and

Mastercard. This is so whether or not the assessments are in fact unlawful penalties,

which the Court need not decide for present purposes.

57. In its reply brief, Arby’s contends that it cannot be bound by BAMS’s

good-faith settlement with the card organizations because the payment of the
assessments was neither in good faith nor a settlement. (See Arby’s Reply Br. 12,

ECF No. 113.) The Court disagrees. Intent is a classic question of fact, typically

unsuited to summary judgment. See, e.g., Feibus & Co. v. Godley Constr. Co., 301

N.C. 294, 306 (1980). The undisputed facts do not show that BAMS acted in bad faith.

And settlements of legal claims take many forms. Arby’s has not cited any case

suggesting that tender and acceptance of payment in satisfaction of a claim is not

considered a settlement for purposes of the case law discussed above.

58. The Court therefore concludes that Arby’s is not entitled to summary

judgment on this ground. The Court further denies as moot its motion to file a

supplemental brief on issues related to the enforceability of the assessments as

liquidated damages. (See ECF No. 119.)

59. Limitation on Consequential Damages. Next, Arby’s points to the

merchant agreement’s limitation on liability “for any indirect, incidental or

consequential damages.” (Merchant Agrmt. § 21 (all caps omitted).) According to

Arby’s, the assessments are consequential damages, and its failure to pay them was

therefore not a breach of section 10(B). 6 (See Arby’s Br. in Supp. 10–14.)

60. In an action for breach of contract, “the damages recoverable are such as

naturally flow from the breach, and such special or consequential damages as are

reasonably presumed to have been within the contemplation of the parties at the time

they made the contract, as the probable result of a breach of it.” Story v. Stokes, 178

N.C. 409, 413 (1919). “Consequential or special damages for breach of contract are

6 Arby’s acknowledges that the limitation on recovery of consequential damages does not

apply to section 21.
those claimed to result as a secondary consequence of the defendant’s

non-performance. They are distinguished from general damages, which are based on

the value of the performance itself, not on the value of some consequence that

performance may produce.” Pleasant Valley Promenade v. Lechmere, Inc., 120 N.C.

App. 650, 671 (1995) (emphasis omitted) (quoting 3 Dan B. Dobbs, Dobbs Law of

Remedies § 12.2(3) (1993)); see also Crescent Univ. City Venture, LLC v. AP Atl., Inc.,

2019 NCBC LEXIS 46, at *45–48 (N.C. Super. Ct. Aug. 8, 2019).

61. Arby’s does not contend that BAMS is seeking to recover consequential

damages from a breach of section 10(B). As Arby’s acknowledges, “amounts owed

under Section 10(B) result in direct damages when Arby’s refuses to pay them . . . .”

(Arby’s Reply Br. 4.) This is consistent with decisions holding that “a claim for

contractual indemnity is a claim for direct damages, not consequential damages.”

KaiserKane, Inc. v. N. Am. Roofing Servs., 2017 U.S. Dist. LEXIS 5740, at *11

(W.D.N.C. Jan. 13, 2017); see also Arrow Elecs., Inc. v. E.ON AG, 2006 U.S. Dist.

LEXIS 107343, at *41 (C.D. Cal. Aug. 7, 2006) (describing “indemnity funds sought

by” party as “general damages”).

62. Even so, Arby’s contends that the limitation on consequential damages is a

complete defense to the claim for breach of section 10(B). Its theory is that “the

Assessments are consequential damages from [its] alleged breach of” other provisions

in the merchant agreement dealing with data security and compliance with card

organization rules. (Arby’s Br. in Supp. 13.) On that basis, Arby’s contends that the

limitation on consequential damages relieves it of responsibility for the assessments
even if they otherwise fall within the language of section 10(B). (See Arby’s Reply Br.

3, 4–5 (describing issue as “whether amounts that represent consequential damages

can even be owed by Arby’s under Section 10(B)”).)

63. This argument misapprehends the language and structure of the merchant

agreement. Recall that section 10(B) requires Arby’s to reimburse BAMS for card

organization penalties that are “directly related to . . . Card transactions.” Penalties

fitting that description need not involve a breach of another provision in the

agreement, and it would be nonsensical to characterize them as consequential

damages. They are simply amounts that Arby’s has promised to pay.

64. Recall also that section 10(B) requires Arby’s to pay penalties “based on” its

failure to comply with card organization rules or its “breach of Section 13

(Information Security).” Perhaps the assessments at issue could be viewed as

consequential damages from a breach of section 13, including its requirement to

comply with PCI Data Security Standards. (See Merchant Agrmt. § 13(A).) Even if

that were true, though, it would not be grounds for summary judgment because the

merchant agreement exempts “a breach of a party’s obligations in Section 13” from

the limitation on consequential damages. (Merchant Agrmt. § 23.) Arby’s overlooks

this language.

65. The upshot is that the assessments either cannot be viewed as consequential

damages (because they do not stem from a breach of the agreement) or are the kind

of consequential damages that BAMS may recover (because the agreement expressly
says so). 7 As a result, the limitation on consequential damages does not apply and

does not entitle Arby’s to summary judgment as to the claim for breach of section

10(B).

66. Section 21’s Notice Requirement. Finally, Arby’s relies on the notice

requirement in section 21 of the merchant agreement. According to section 21, the

right to be indemnified is “subject to the condition that [BAMS] must notify [Arby’s]

as soon as practicable after” its general counsel “has actual knowledge of claims

triggering” the duty to indemnify. (Merchant Agrmt. § 21.) Arby’s contends that

BAMS did not give the required notice, thus extinguishing any duty to indemnify.

(See Arby’s Br. in Supp. 14–16.) On that basis, Arby’s moves for summary judgment

as to the claim for breach of section 21.

67. This dispute has more to do with the content of the notice than the timing.

BAMS gave notice of the assessments by Visa and Mastercard shortly after they were

made and asserted that Arby’s was responsible for payment. (See, e.g., App. Exs. W,

Z.) According to Arby’s, that wasn’t enough; it contends that BAMS was required to

state expressly that the assessments triggered a duty to indemnify under section 21.

(See Arby’s Reply Br. 6–7.) But the merchant agreement requires only that BAMS

“must notify” Arby’s within a certain time. It does not state that the notice must refer

7 In this respect, the merchant agreement is significantly different from the contracts at issue

in cases cited by Arby’s. See, e.g., Spec’s Fam. Partners, Ltd. v. First Data Merch. Servs. LLC,
777 Fed. App’x 785, 788–89 (6th Cir. 2019) (unpublished) (concluding that merchant was not
required to indemnify acquirer due to limitation on consequential damages that had no
exemption for breach of contractual data security obligations).
to section 21 or use the word indemnification. 8 The Court cannot say, as a matter of

law, that BAMS failed to give adequate notice under section 21. Summary judgment

is therefore not appropriate.

68. BAMS offers alternative arguments to show that Arby’s had a duty to

indemnify even if the notice was deficient. (See BAMS Opp’n 15–16.) The Court need

not and does not address these arguments.

IV.
CONCLUSION

69. For these reasons, the Court DENIES the cross-motions for summary

judgment. The Court also DENIES as moot the motion of Arby’s for leave to file a

supplemental brief.

SO ORDERED, this the 30th day of June, 2021.

/s/ Adam M. Conrad
Adam M. Conrad
Special Superior Court Judge
for Complex Business Cases

8 This contrasts with the provision governing notices of a dispute, which does require
identification of the specific provision that was allegedly breached. (See Merchant Agrmt.
§ 25 (“Each party will notify the other party hereto in writing of any dispute, describing in
detail the Agreement provision(s) at issue, the exact nature of the alleged breach and the
dollar amount of the perceived injury, if any.”).)