CBA and AUSTRAC: how 53,750 breaches led to a record penalty

Seven hundred million dollars. That was the number Commonwealth Bank of Australia agreed to pay in June 2018 to settle civil proceedings brought by AUSTRAC, the Australian Transaction Reports and Analysis Centre. It was, at the time, the largest civil penalty in Australian corporate history. It remains one of the largest anywhere in the world for anti-money-laundering failures. The CBA and AUSTRAC case is still the reference point for how a bank's compliance failures get measured.

Record-breaking settlements don't happen by accident. They accumulate. And the CBA matter accumulated over years, across thousands of transactions, through a set of failures that AUSTRAC's originating statement of claim described in meticulous and uncomfortable detail.

CBA and AUSTRAC: what was actually alleged

AUSTRAC filed its civil proceedings against CBA in the Federal Court in August 2017. The statement of claim ran to more than 100 pages. At its core, AUSTRAC alleged that CBA had contravened the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), the AML/CTF Act, on a staggering scale.

The central technology involved was CBA's Intelligent Deposit Machines, or IDMs. These are the ATM-style machines that accept cash deposits and credit them to an account almost instantly, without requiring a teller. CBA had rolled out IDMs from around 2012. The machines were convenient. They were also, AUSTRAC alleged, exploited extensively for cash structuring and money laundering, including by criminal syndicates.

Structuring, for readers new to the term, means breaking a large amount of cash into smaller deposits so that no single deposit crosses a reporting threshold. A machine that takes cash without a human looking at the customer makes that tactic easier, which is exactly why a product like this needs its own risk assessment before it goes live.

The figure that stuck was 53,750. That was the number of contraventions AUSTRAC alleged in its statement of claim, later revised upward as the matter developed. Each contravention represented a failure to report a threshold transaction (a cash deposit of $10,000 or more) as required under the AML/CTF Act. CBA, according to AUSTRAC's pleadings, failed to submit threshold transaction reports for roughly $625 million worth of cash transactions through its IDMs between November 2012 and September 2015. The failure was attributed, at least in part, to a single coding error introduced when the IDM reporting system was updated. CBA acknowledged as much publicly. But AUSTRAC's claim went considerably further than a software bug.

The conduct beyond the coding error

AUSTRAC also alleged that CBA failed to carry out adequate risk assessments on its IDM product before and after launch, failed to act on suspicious matter reports in a timely way, and, most seriously, failed to monitor and respond to ongoing warnings about how the machines were being used.

It helps to keep two reporting duties apart. A threshold transaction report is mechanical: cash at or above the set amount triggers a report, whatever the circumstances. A suspicious matter report is a judgement call, triggered when staff or systems form a suspicion that a transaction relates to crime. The first duty can be automated and audited. The second depends on people and systems actually noticing patterns and acting on them. AUSTRAC's case, as pleaded, said CBA fell short on both.

The statement of claim described specific customers whose accounts had been used to funnel large sums through IDMs. Some of those customers were subsequently charged or convicted in criminal proceedings for drug offences and money laundering. AUSTRAC alleged CBA continued to process their transactions despite accumulating indicators of suspicious conduct.

There were also alleged failures to keep correspondent banking due diligence up to date, and failures in CBA's ongoing customer due diligence obligations. Taken together, AUSTRAC's pleadings painted a picture not of an isolated technical glitch, but of a compliance function that had fallen badly behind the risks its own products were generating.

CBA disputed aspects of the claim but, as the Federal Court proceedings advanced, both parties moved toward settlement.

The $700 million settlement

In June 2018, CBA and AUSTRAC filed a statement of agreed facts and a joint submission on penalty in the Federal Court. The agreed facts ran to around 100 pages and acknowledged 53,750 contraventions of the AML/CTF Act. The parties jointly submitted that a penalty of $700 million was appropriate. Justice David Yates of the Federal Court approved that penalty in the same month, accepting the joint submission.

That sequence is how most large civil penalty cases in Australia finish. The regulator and the company negotiate a set of agreed facts and a proposed figure, and the court then decides whether the figure is appropriate. A judge is not obliged to rubber-stamp the number, but courts have long accepted that agreed penalties save public resources and encourage admissions, provided the figure fits the seriousness of the conduct. You can read more about how the court works on the Federal Court of Australia website.

At the time, the maximum civil penalty per contravention under the AML/CTF Act was $18 million. The theoretical maximum exposure across 53,750 contraventions was, on that basis, an almost notional number. The $700 million figure was negotiated; it reflected, among other factors, CBA's cooperation with AUSTRAC, the steps it had taken to remediate its systems, and the sheer practical limits of any single penalty.

CBA's then-chief executive Matt Comyn, who had taken over from Ian Narev earlier that year, described the settlement as an important step in restoring trust. The bank acknowledged the seriousness of the failures. CBA also agreed, as part of the settlement, to engage an external compliance auditor and to report to AUSTRAC on its remediation progress.

The timing and the Royal Commission

The AUSTRAC matter broke publicly in August 2017. Within weeks, the political pressure for a royal commission into misconduct in the financial services sector had become irresistible, and the Turnbull government announced the Hayne Royal Commission in November 2017. It would be too neat to say AUSTRAC caused the Royal Commission, because the pressure had been building for two years, but the CBA proceedings stripped away any remaining argument that the sector's problems were isolated or self-correcting.

The Hayne Royal Commission went on to expose a wider pattern of misconduct across the industry, some of which had little to do with AML/CTF compliance. But the AUSTRAC proceedings established something specific and important: that Australia's largest bank had, over several years, failed to maintain the basic transaction monitoring infrastructure that the AML/CTF Act requires.

The two processes are different in kind. A royal commission investigates and recommends; it cannot impose a penalty. A Federal Court civil penalty proceeding, by contrast, produces a binding order and a public record of what was admitted. The CBA case gave the public the second of those things at the very moment the first was getting under way.

The James Hardie case offers an instructive contrast in how corporations respond to existential legal and reputational threats. The James Hardie asbestos saga involved deliberate structuring to limit compensation liability; CBA's failures, at their administrative core, began with a coding error. But in both cases, the subsequent conduct, meaning what institutions did once problems became visible, became as much of the story as the original breach. For another example of what the Federal Court does once it makes findings against a company, see this cartel case and the court's findings.

What the settlement meant for compliance across the sector

The $700 million penalty sent a message that was impossible to misread. AUSTRAC followed the CBA matter with enforcement action against Tabcorp (a $45 million penalty in 2017, then the record) and, several years later, with proceedings against Westpac that resulted in an even larger $1.3 billion settlement in 2020.

Across the financial services sector, boards and executive teams revisited their AML/CTF programmes in a way they hadn't since the Act commenced. The regulator's public guidance, and its pattern of enforcement, made clear that the threshold transaction reporting obligation wasn't a technicality. It was load-bearing infrastructure in the national financial intelligence framework.

The CBA settlement also accelerated a shift in how boards treated their AML/CTF compliance functions. For years, in too many institutions, AML/CTF had been treated as a back-office cost centre, staffed adequately but not generously, and not prominent in board-level risk reporting. After 2018, that framing became harder to sustain.

A common mistake in any compliance programme is to test whether a report was sent rather than whether the right transactions were captured in the first place. A reporting system can run flawlessly and still miss every transaction it was never configured to see. Change management matters for the same reason: when a system is updated, the reporting logic needs to be checked again, not assumed to carry over.

Honestly, I think this outcome was more significant for Australian corporate governance than the headline number suggests. The $700 million mattered, of course. But what mattered more was the agreed facts document: a detailed, court-filed acknowledgment that a Big Four bank had failed, repeatedly and over years, to meet its basic statutory obligations on financial crime. That document doesn't expire. Regulators cite it. Courts consider it. Compliance officers use it to brief boards.

The AML/CTF Act and its obligations

For context: the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 obliges reporting entities, which include banks, gambling operators, remittance businesses and others, to identify and verify customers, monitor transactions for suspicious activity, submit threshold transaction reports for cash transactions of $10,000 or more, and maintain and implement an AML/CTF programme. AUSTRAC administers and enforces the Act. The regulatory framework was itself modelled on Financial Action Task Force (FATF) recommendations, and Australia is periodically assessed against those standards by FATF's mutual evaluation process. There is a useful overview of the body and its standards in the Wikipedia article on the Financial Action Task Force.

The Act is built around the idea that a business should know who its customers are and what they normally do. Customer due diligence is the starting point; transaction monitoring is how the business notices when behaviour departs from that baseline; and reporting is how the intelligence reaches the regulator. If one link breaks, the others carry less weight.

The CBA case exposed a gap between the obligations on paper and the compliance infrastructure in practice. It also exposed the speed with which new financial products, like IDMs, could create compliance risks that existing monitoring systems weren't calibrated to catch.

Where things stand now

Commonwealth Bank has, in the years since the settlement, rebuilt its financial crime compliance function substantially. External auditors reported to AUSTRAC as required under the settlement terms. The bank has spoken publicly, in subsequent annual reports and parliamentary appearances, about the investment it has made in transaction monitoring systems and financial crime staffing.

The broader AML/CTF framework has itself moved on. Amendments to the Act have been in progress for some years, aimed at extending AML/CTF obligations to lawyers, accountants, real estate agents and other "tranche two" entities. It is a reform that has been delayed longer than anyone expected, but which would significantly expand AUSTRAC's regulatory footprint if enacted.

The CBA matter sits in the public record now: Federal Court file, agreed facts, $700 million penalty. It is part of how Australia's financial crime compliance landscape is taught, argued about and shaped. For better or worse, and mostly for better, I'd argue, it is the benchmark.

For more on the broader corporate misconduct environment that surrounds this case, see our Scandals & Reckonings archive.