meta_id 3250836

On June 18, 2026, the Federal Court ordered HSBC Bank Australia Limited (HSBC) to pay a A$35 million penalty after the bank admitted to serious failures in protecting customers from scams. Justice Bennett found HSBC's contraventions to be serious and ordered the bank to publish adverse publicity on its website, app, and in letters to impacted customers. HSBC admitted to widespread and systemic failures under the ePayments Code , administered by the Australian Securities and Investments Commission (ASIC). The bank failed to implement adequate scam controls on its internal payment rail, where the majority of customer losses occurred. HSBC took an average of 144 days to investigate customer scam reports, exceeding ePayments Code timelines, and did not properly apply rules determining whether customers or the bank should bear scam losses. Additionally, HSBC lacked adequate systems to help customers restore their banking access following scams. Justice Bennett found that customers experienced stress and frustration due to these failures, which were compounded by non-compliance with ePayments Code timelines. ASIC Chair Sarah Court said the outcome represents "one of the first of its kind globally" and sends "the strongest scam wake-up call yet to the banking industry." The case reinforces banks' core responsibility to protect customers from scams and demonstrates ASIC's enforcement priority targeting systemic compliance failures by large financial institutions resulting in widespread consumer harm. Following ASIC's investigation, HSBC established a large-scale remediation program that has paid approximately A$21.5 million in compensation to date, with further payments expected before July 31, 2026. HSBC has also recovered and returned $6.5 million to customers. The remediation program assesses affected customers and compensates those not liable for losses under the ePayments Code, including compensation for lost earnings resulting from delays in accessing funds.