“Today’s outcome is one of the first of its kind globally and the $35 million penalty ordered against HSBC is the strongest scam wake-up call yet to the banking industry,” said ASIC chair Sarah Court (pictured right).
“Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help – not hinder.”
Bennett found HSBC’s contraventions to be serious and determined the agreed penalty fell within an appropriate range. She also found the bank had implemented scam controls on some payment systems but failed to apply key controls to its IAT (internal) payment rail — the channel through which the majority of customer losses occurred.
HSBC admitted to breaches of the ePayments Code, including taking an average of 144 days to investigate customer scam reports and failing to apply the Code’s rules for determining whether customers or the bank should bear scam-related losses.
The bank also admitted it lacked adequate systems to help customers regain access to their accounts after being scammed. Bennett found these failures to be widespread and systemic.