Australian Securities & Investments Commission seeks AUD 35 million court penalty over HSBC scam control failures

The Australian Securities & Investments Commission announced that it and HSBC Bank Australia Limited will ask the Federal Court to approve a proposed resolution of ASIC’s civil penalty case, under which HSBC has admitted serious failures in protecting customers from scams and unauthorised transactions. ASIC is seeking a penalty of AUD 35 million, subject to court approval. HSBC has also set up a large-scale remediation program, paid about AUD 21.5 million in compensation so far and recovered a further AUD 6.5 million for customers. The case covers the period from January 2020 to August 2024, during which HSBC received more than 1,000 reports of unauthorised transactions with a total value of AUD 34.6 million. HSBC admitted that, between May 2023 and May 2024, it lacked adequate controls over its internal transfer system, despite being aware from May 2021 of growing impersonation scam risks involving fraudsters posing as HSBC representatives. Reports of unauthorised transactions rose by about 380% in 2023 and 2024, largely because of impersonation scams. HSBC also admitted breaching its financial services licence obligations through major delays in investigations, which took an average of 144 days to complete, and through inadequate systems for helping customers regain access to accounts locked after scam reports. The proposed resolution remains subject to the Federal Court’s decision on whether the agreed orders, including the penalty, are appropriate and whether any other orders should be made. HSBC’s remediation program will continue to assess affected customers and compensate those who were not liable for losses under the ePayments Code, including for lost earnings caused by delays in accessing funds.