The Federal Court has ordered HSBC Australia to pay a A$35 million penalty after the bank admitted to serious and widespread failures in protecting its customers from scams, according to the Australian Securities and Investments Commission (ASIC).

Justice Bennett, who oversaw the hearing in Melbourne, ordered the bank to publish adverse publicity notices on its website, its mobile app, and in letters to affected customers.

The court found that while the bank had implemented scam controls on some payment systems, it failed to apply key protections to its internal payment rail where the majority of customer losses occurred.

“Today’s outcome is one of the first of its kind globally and the $35 million penalty ordered against HSBC is the strongest scam wake-up call yet to the banking industry,”

said Sarah Court, Chair, ASIC.

“Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help, not hinder,”

she said.

The bank admitted to breaching the ePayments Code by taking an average of 144 days to investigate scam reports.

It also failed to apply the code’s rules for determining liability for scam losses and lacked adequate systems to help customers regain access to their accounts, ASIC said.

Justice Bennett noted that the bank’s non-compliance worsened the stress and frustration experienced by impacted customers.

Following the regulatory investigation, the bank established a large-scale remediation programme.

The company has paid approximately A$21.5 million in compensation so far, with additional payments expected before the end of July 2026.

It has also recovered and returned A$6.5 million to customers.

The penalty aligns with ASIC’s ongoing enforcement priority targeting systemic compliance failures by large financial institutions that cause widespread consumer harm.

Featured image credit: Edited by Fintech News Australia, based on image by freepik via Magnific