HSBC Australia Admits Scam Failures, Agrees to Pay A$35 Million Penalty

Q: HSBC's profits grew to $658M. Is a $35M fine a real penalty or just the cost of doing business?

At about 5.3% of HSBC Australia’s 2025 pre-tax profit, the A$35 million fine looks meaningful but not crippling. On the numbers alone, it is easier to see it as a moderate sanction than an existential penalty. The bank reported A$658.3 million in profit before tax, while customers lost more than A$100 million to scams between 2021 and 2024. That means the penalty is only about a third of the customer losses tied to the misconduct alleged by ASIC, and it comes after HSBC admitted serious failings: weak internal transfer controls, slow fraud investigations averaging 144 days, and inadequate support for victims. HSBC will also pay A$3 million toward ASIC’s costs, but that does not materially change the picture. Context matters. In global banking, penalties for serious compliance failures often run far higher, sometimes into the hundreds of millions or billions. HSBC itself has previously faced much larger sanctions overseas. Against that backdrop, A$35 million sits in the middle range: large enough to sting, but small enough that a profitable bank can absorb it. Whether it is a “real penalty” depends on what follows. If the settlement is paired with stronger controls, faster fraud response, customer remediation and reputational damage, the total cost rises. If not, critics have a strong case that it risks being treated as a cost of doing business, especially in a market where scam victims in Australia are reimbursed at relatively low rates compared with the UK and US.

Q: A new anti-scam law was passed in 2025. Why are Australians still waiting for its protection to begin?

Australians are still waiting because the 2025 Scams Prevention Framework has been passed, but its protections have not yet been switched on in practice. The main holdup is implementation. The government still has to finalize the mandatory sector codes for banks, telcos and digital platforms that will spell out exactly what each must do to prevent, detect and disrupt scams. Those codes are being developed through consultation with industry and consumer groups, and key parts of the dispute-resolution system and liability rules also remain unfinished. That matters because the law’s real force depends on those details. Regulators and firms still need guidance on what counts as “reasonable steps,” how complaints will be handled, and who pays when multiple parties are involved. Without that, enforcement is limited and victims cannot yet rely on the new framework for routine protection or compensation. Consumer advocates say the delay is leaving a gap between the law on paper and protection in reality. That gap is visible in cases such as HSBC Australia, which admitted serious anti-scam failures and agreed to a A$35 million penalty even after customers lost more than A$100 million between 2021 and 2024. The case has reinforced criticism that existing safeguards remain too weak while the new regime is still being built. For now, Australians have a law, but not yet the fully operational system that would make banks and other sectors consistently accountable.

1 articles · Updated · Bloomberg · Jun 18

A$35 million is the penalty HSBC Australia agreed to pay after admitting failures in protecting customers from scams that cost victims tens of thousands of dollars.
ASIC said the bank lacked adequate controls over its internal transfer system and was slow to investigate fraud cases, exposing customers to preventable losses.
The case centers on HSBC Holdings Plc’s Australian unit, adding regulatory pressure on banks to tighten scam detection, payment controls and fraud-response processes.