An Australian federal court has ordered HSBC Bank Australia to pay a penalty of A$35 million, equivalent to US$24.5 million, after the bank admitted to failures in protecting customers from scams. The Australian Securities and Investments Commission said the bank had implemented scam controls on some payment systems but did not apply key controls on the IAT internal payment rail, where most customer losses occurred. HSBC admitted it failed to investigate scam reports quickly enough, taking an average of 144 days, and did not have adequate systems to help customers regain access to their banking after being scammed. Following an ASIC investigation, HSBC established a remediation program that has so far paid around $21.5 million in compensation, with further payments due before the end of July 2026, and has also recovered $6.5 million and returned those funds to customers.
HSBC Holdings PLCAustralian court orders HSBC to pay $24.5 million penalty for scam protection failures, with admitted compliance shortcomings.