HSBC’s Australian unit has admitted to serious failures in protecting customers from scams and could face a proposed A$35 million ($24.59 million) penalty following an investigation by Australia’s corporate regulator.
The Australian Securities and Investments Commission (ASIC) said on Thursday that it and HSBC will jointly seek approval from the Federal Court for the proposed penalty. The settlement remains subject to the court’s review, which will determine whether the penalty and related orders are appropriate.
ASIC said its investigation found that HSBC Australia failed to maintain adequate controls over internal transfer systems between May 2023 and May 2024. The regulator said these weaknesses exposed customers to an increased risk of unauthorized transactions.
The investigation also found that HSBC had been aware since at least May 2021 of growing risks from impersonation scams, in which fraudsters posed as HSBC representatives to deceive customers.
ASIC said the bank breached its financial services licence obligations by failing to adequately prevent scam-related harm and by taking an average of 144 days to investigate customer reports of suspected scams.
The regulator also identified weaknesses in HSBC’s systems for assisting customers who lost access to their accounts after scam incidents. According to ASIC, the bank did not have sufficient processes to help affected customers restore account access.
ASIC Chair Sarah Court said the case represented one of the first of its kind globally and emphasized the responsibility of financial institutions to protect customers from scams.
“This is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks,” Court said.
HSBC said it had reached an agreement with ASIC to resolve the proceedings and highlighted measures it has taken to address concerns raised by the regulator.
An HSBC spokesperson said the agreement recognized the bank’s customer compensation program and improvements made to its fraud and scam prevention, detection and response systems.
The proposed settlement follows increasing regulatory scrutiny of financial institutions over their ability to prevent fraud and protect customers from increasingly sophisticated scam operations. ASIC’s action against HSBC Australia focuses on the bank’s internal controls, investigation processes and customer support measures during the period under review.
The Federal Court will now consider whether to approve the proposed A$35 million penalty and the other terms of the settlement between ASIC and HSBC.
