Australian financial regulator ASIC is seeking an A$35 million penalty against HSBC Bank Australia after the bank admitted serious failures in protecting customers from scams, ASIC said on Thursday. The matter was listed for hearing in the Federal Court on 18 June 2026.
ASIC is also seeking declarations of contraventions, adverse publicity orders and costs. HSBC has implemented a compensation plan, the regulator said.
Losses and delays
ASIC’s case covers about A$23 million in customer losses from roughly 950 reports of unauthorised transactions between January 2020 and August 2024. Almost A$16 million of those losses occurred in just six months, from October 2023 to March 2024.
The regulator alleges HSBC took an average of 145 days to investigate scam reports and 95 days to restore full account access. One customer waited 542 days. The ePayments Code requires investigations to be completed within 45 days absent exceptional circumstances.
ASIC contends the conduct breached the obligation to provide financial services “efficiently, honestly and fairly” under s 912A(1)(a) of the Corporations Act and s 47(1)(a) of the National Consumer Credit Protection Act.
ASIC first filed the case in December 2024, alleging HSBC’s failings were “widespread and systemic.” The bank was aware of gaps in its fraud controls from at least January 2023, ASIC alleged at the time.
