HSBC's (HKG:0005) Australian unit admitted to serious failures in protecting customers from scams that cost some victims tens of thousands of dollars, prompting Australia's corporate regulator to seek a AU$35 million penalty against the lender.
The Australian Securities and Investments Commission (ASIC) said on Thursday that it and HSBC will jointly seek the Federal Court's approval of the proposed penalty, with the bank admitting to multiple compliance failures related to scam-related losses and delays in handling customer complaints.
The proposed resolution follows civil penalty proceedings launched by ASIC in December 2024, in which the regulator alleged that HSBC's failures were widespread and systemic, leaving customers vulnerable to unauthorized transactions and impersonation scams.
HSBC admitted that it failed to maintain adequate controls over its internal transfer system between May 2023 and May 2024, exposing customers to a greater risk of unauthorized payments.
The lender also acknowledged that it had been aware since May 2021 of the growing threat posed by impersonation scams, in which fraudsters impersonated HSBC representatives.
Between January 2020 and August 2024, HSBC received more than 1,000 reports of unauthorized transactions totaling AU$34.6 million.
Reports of unauthorized transactions surged about 380% in 2023 and 2024, largely driven by such scams, ASIC said.
HSBC further admitted it breached its financial services license obligations through major delays in investigating cases, taking an average of 144 days to finalize reports.
The bank also had inadequate systems to help customers regain access to accounts that were locked after scam reports.
"HSBC's alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money," ASIC Chair Sarah Court said.
Following ASIC's investigation, HSBC established a large-scale remediation program and has so far paid about AU$21.5 million in compensation to affected customers.
The bank has also recovered AU$6.5 million and returned the funds to customers.
Among the affected customers were a New South Wales dental technician who lost AU$47,000, a part-time architectural assistant who lost AU$50,000 in life savings, a Victorian couple who lost AU$48,000 that had been transferred from their home loan, and a Victorian father who lost AU$50,000.
ASIC alleged in its 2024 lawsuit that some customers lost more than AU$90,000 and that HSBC took an average of 95 days to restore access to affected accounts, with one customer waiting 542 days.
"Individual customers lost tens of thousands of dollars which, for some, were their life savings, causing them real stress and uncertainty," Court said.
The proposed settlement remains subject to approval by the Federal Court.
