Australia's HSBC unit has acknowledged significant failures in its defences against scams and is facing a proposed penalty of A$35 million - equivalent to $24.59 million - that ASIC and the bank will ask the Federal Court to approve, the country's corporate regulator said on Thursday.
The Australian Securities and Investments Commission said its inquiry found HSBC did not keep adequate controls over its internal transfer systems from May 2023 to May 2024, a lapse that left customers exposed to an elevated risk of unauthorised transactions. ASIC also said the bank had been aware, as early as May 2021, of a mounting threat from impersonation scams in which fraudsters posed as HSBC representatives.
In setting out the findings, the regulator said HSBC breached obligations attached to its financial services licence by failing to put in place sufficient measures to prevent scams. ASIC's review also identified that the bank took an average of 144 days to investigate customer reports of scam activity and that its systems were insufficient to assist customers in regaining access to accounts that had been locked following scam incidents.
"This is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks," ASIC Chair Sarah Court said.
HSBC and ASIC will jointly apply to the Federal Court for approval of the proposed settlement. That court will decide whether the A$35 million penalty and any accompanying orders are suitable in the circumstances.
An HSBC spokesperson provided a response by email, saying: "(We) have reached an agreement to resolve the proceedings with ASIC, which recognises our customer redress program and the significant enhancements made to our fraud and scam prevention, detection and response." The bank has therefore acknowledged the agreement while pointing to remedial measures and a redress program.
The proposed settlement is subject to Federal Court approval, which will determine the appropriateness of the penalty and other potential orders. The regulator included the currency conversion rate that $1 equals 1.4235 Australian dollars in its release.
Further details about the Federal Court timetable for approving the settlement or any related remedial obligations were not provided in the regulator's summary. The matter remains pending judicial consideration, and the bank's acknowledgement of the agreement does not itself finalise the proposed penalty.