HSBC is a licensed bank subject to enforcement action for failures in protecting retail customers using payment services and deposit accounts under the ePayments Code, which directly implicates Retail Banking obligations.
Low confidence — REQUIRES HUMAN REVIEW. This enforcement action concerns payment system scam protections and customer account access, not investment services, so Investment Services does not apply.
Specialism
An explicit $35 million monetary fine was imposed by the Federal Court on HSBC for identified regulatory breaches related to scam protection failures under the ePayments Code.
Mandatory inheritance: Financial Penalty is a child of Enforcement, so Enforcement must be raised as the secondary tag.
2026-06-18 16:17:05·kgurnani@vixio.com
Meta Id
3250836
Content ID
3259318
GUID
5bfdfb58c935478243e87508d9dec44b
Fair, strong and efficient financial system for all Australians.
Pipeline Progress
🔄 Pipeline Journey
⏱
14s
total
✓
Queued16:16:51
+1s
✓
Metadata16:16:52
+1s
✓
S3 Content16:16:53
+1s
✓
Extracted16:16:54
+6s
✓
LLM Gen16:17:00
+5s
✓
Stored16:17:05
TITLE: Australian Securities and Investments Commission Orders HSBC to Pay $35 Million Penalty for Scam Protection Failures
BODY:
On June 26, 2026, the Federal Court ordered HSBC Bank Australia Limited (HSBC) to pay a $35 million penalty after the bank admitted to serious failures in protecting customers from scams. Justice Bennett found HSBC's contraventions to be serious and ordered the bank to publish adverse publicity on its website, app, and in letters to impacted customers.
HSBC admitted to widespread and systemic failures under the ePayments Code, which the Australian Securities and Investments Commission (ASIC) administers. The bank failed to implement adequate scam controls on its internal payment rail, where the majority of customer losses occurred. HSBC took an average of 144 days to investigate customer scam reports, exceeding ePayments Code timelines, and did not properly apply rules determining whether customers or the bank should bear scam losses. Additionally, HSBC lacked adequate systems to help customers restore their banking access following scams. Justice Bennett found that customers experienced stress and frustration due to these failures, which were compounded by non-compliance with ePayments Code timelines.
ASIC Chair Sarah Court said the outcome represents "one of the first of its kind globally" and sends "the strongest scam wake-up call yet to the banking industry." The case reinforces banks' core responsibility to protect customers from scams and demonstrates ASIC's enforcement priority targeting systemic compliance failures by large financial institutions resulting in widespread consumer harm.
Following ASIC's investigation, HSBC established a large-scale remediation program that has paid approximately $21.5 million in compensation to date, with further payments expected before July 31, 2026. HSBC has also recovered and returned $6.5 million to customers. The remediation program assesses affected customers and compensates those not liable for losses under the ePayments Code, including compensation for lost earnings resulting from delays in accessing funds.
26-127MR Federal Court orders $35 million penalty against HSBC for scam protection failures | ASIC Newsroom Print Share Twitter Facebook LinkedIn Email The Federal Court has ordered HSBC Bank Australia Limited (HSBC) to pay a $35 million penalty after the bank admitted to serious failures in protecting customers from scams. Following a hearing earlier today in Melbourne, her Honour Justice Bennett ordered HSBC to pay a $35 million penalty and to publish adverse publicity orders on its website, its app and in letters to impacted customers. The case is one of the first of its kind globally and reinforces the core responsibility of banks to protect their customers from scams. ASIC Chair Sarah Court said, ‘Today’s outcome is one of the first of its kind globally and the $35 million penalty ordered against HSBC is the strongest scam wake-up call yet to the banking industry. ‘Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help – not hinder.’ In her reasons, her Honour Justice Bennett considered HSBC’s contraventions to be serious, and that the agreed penalty is within the range of what is appropriate. Her Honour also found that HSBC had implemented scam controls on some of its payment systems but did not implement the key controls on the IAT (internal) payment rail, where the majority of customer losses occurred. HSBC admitted to failures in relation to the ePayments Code because it took too long to investigate customer scam reports – 144 days on average – and it did not apply rules in the Code for determining when customers or the bank should bear the losses from scams. HSBC also admitted that it did not have adequate systems in place to help customers get back into their banking after they had been scammed. Her Honour held that HSBC’s failures in respect of the ePayments code were widespread and systemic. HSBC has admitted some impacted customers found the process of dealing with HSBC stressful and frustrating and her Honour held that those feelings were worsened by the failure to comply with the timeline set out in the ePayments code. Following ASIC’s investigation, HSBC has established a large-scale remediation program that, to date, has paid around $21.5 million in compensation, with further payments to come before the end of July 2026. HSBC has also recovered $6.5 million and returned those funds to customers. ASIC has an enduring enforcement priority targeted at systemic compliance failures by large financial institutions which result in widespread consumer harm. Background ASIC issued a media release on 18 June 2026 outlining HSBC’s admissions, the Statements of Agreed Facts and Admissions, and the penalty sought ( 26-126MR ). The matter was heard in the Federal Court today. ASIC commenced civil penalty proceedings against HSBC Bank Australia Limited on 13 December 2024. ASIC’s proceedings concern payments which are ‘unauthorised transactions’ as defined in the ePayments Code, which is administered by ASIC. Further information related to ASIC’s role administrating the ePayments Code is available. HSBC has established a remediation program to assess affected customers and compensate those who were not liable for losses under the ePayments Code, including for lost earnings as a result of delays in accessing funds. Further information for affected customers is available from HSBC: https://www.hsbc.com.au/help/important-notices/