Federal Court of Australia

Australian Securities and Investments Commission v Ferratum Australia Pty Ltd (in liq) (No 2) [2024] FCA 701

ORDERS

THE COURT NOTES THAT:

1.    The Court made declarations of contravention on 9 October 2023 pursuant to s 166 of the National Consumer Credit Protection Act 2009 (Cth) (NCCP Act). References in these orders to declarations are to the corresponding declarations made on 9 October 2023.

THE COURT ORDERS THAT:

2.    Pursuant to s 167(2) of the NCCP Act, the respondent pay to the Commonwealth:

(a)    a pecuniary penalty of $4 million in respect of the contraventions the subject of declaration 1;

(b)    a pecuniary penalty of $3 million in respect of the contraventions the subject of declaration 2;

(c)    a pecuniary penalty of $2 million in respect of the contraventions the subject of declaration 3;

(d)    a pecuniary penalty of $2 million in respect of the contraventions the subject of declaration 4;

(e)    a pecuniary penalty of $1 million in respect of the contraventions the subject of declaration 5; and

(f)    a pecuniary penalty of $4 million in respect of the contraventions the subject of declaration 6.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

KENNETT J:

Introduction

1    In Australian Securities and Investments Commission v Ferratum Australia Pty Ltd (in liq) [2023] FCA 1043 (the liability reasons) I concluded that the respondent (Ferratum) had contravened the National Consumer Credit Protection Act 2009 (Cth) (the Act) and the National Credit Code (the Code) in the ways contended for by the applicant (ASIC). These reasons, which deal with penalties, use the same abbreviations as the liability reasons and assume familiarity with those reasons.

2    Following delivery of the liability reasons, on 9 October 2023 I made declarations that Ferratum had contravened specified provisions of the Act and the Code and timetabling orders for a hearing on penalty. The declarations made on 9 October 2023 established contraventions by Ferratum of:

(a)    section 24(1A)(b) of the Code on at least 40 occasions between 13 March 2019 and 14 July 2019;

(b)    section 24(1A)(a) of the Code on 10,860 occasions between 13 March 2019 and 30 September 2019;

(c)    section 24(1A)(b) of the Code, by charging three different fees on a total of 596 occasions between 13 March 2019 and 30 September 2019;

(d)    section 24(1A)(a) of the Code on 33,815 occasions between 1 October 2019 and 11 August 2021;

(e)    section 24(1A)(b) of the Code on 204 occasions between 1 October 2019 and 11 August 2021;

(f)    section 47(1)(a) of the Act, by failing to engage in credit activities efficiently, honestly and fairly between 13 March 2019 and 14 July 2020; and

(g)    section 47(1)(d) of the Act, by each of the contraventions referred to at (a) to (e).

Relevant provisions and penalties sought

3    Section 24(1A) of the Code provides a civil penalty for its breach and s 47(4) of the Act provides a civil penalty for a contravention of s 47(1)(a). Each of these provisions is therefore a “civil penalty provision” as defined in s 5 of the Act. Section 167(2) of the Act empowers the Court to order a person to pay a pecuniary penalty in relation to a contravention of a civil penalty provision if a declaration has been made that the person has contravened the provision.

4    Pursuant to ss 167A and 167B(2) of the Act, the maximum pecuniary penalty that can be imposed for a contravention by a body corporate is the greatest of:

(a)    the penalty specified in the relevant provision multiplied by 10;

(b)    the benefit derived and detriment avoided by the contravention (if it can be determined) multiplied by three; and

(c)    10% of the corporation’s annual turnover or 2.5 million penalty units, whichever is less.

5    ASIC’s submissions on penalty proceeded on the basis that the applicable maximum for each contravention was 50,000 penalty units (based on the penalties specified in s 24(1A) and s 47(4)). That is to say, it was not submitted that s 167B(2) permitted higher penalties than these to be imposed. I therefore proceed on the basis that the maximum penalty for each breach is 50,000 penalty units.

6    The amount of a penalty unit is fixed by s 4AA of the Crimes Act 1914 (Cth) (the Crimes Act). Between 13 March 2019 and 30 June 2020 a penalty unit was $210. From 1 July 2020 until the end of the periods relevant here, a penalty unit was $222. However, where a contravention occurred during both of these periods, ASIC accepts that it is the lower amount that should apply (consistently with s 4F of the Crimes Act). Additionally, where a large number of contraventions of a single provision have been identified, ASIC’s submissions treat these as a single course of conduct and apply the lower penalty amount.

7    The following table, reproduced from ASIC’s submissions, shows the theoretical maximum penalty for each group of contraventions and the penalty sought by ASIC.

8    Liquidators were appointed to Ferratum on 4 April 2023 after it resolved to be wound up. On 1 May 2023 I granted leave under s 500(2) of the Corporations Act 2001 (Cth) for this proceeding to continue against Ferratum, on the condition that no pecuniary penalty be enforced without further leave of the Court. That leave is not being sought, at least at this stage.

Issues in the determination of appropriate penalties

9    Section 167(3) of the Act provides as follows.

Determining pecuniary penalty

(3)     In determining the pecuniary penalty, the court must take into account all relevant matters, including:

(a)     the nature and extent of the contravention; and

(b)     the nature and extent of any loss or damage suffered because of the contravention; and

(c)     the circumstances in which the contravention took place; and

(d)     whether the person has previously been found by a court (including a court in a foreign country) to have engaged in similar conduct.

10    The list of factors in s 167(3)(a) to (d) is not exhaustive. The primary requirement (contained in the chapeau of the subsection) is that “all relevant matters” must be taken into account. In Australian Securities and Investments Commission v Westpac Banking Corporation (No 3) [2018] FCA 1701; 131 ACSR 585 at [49] (Westpac No 3), Beach J identified (also non-exhaustively) the following relevant factors, building on a shorter list set out by French J in Trade Practices Commission v CSR Ltd [1991] ATPR 41-076 at 52,152–52,153 (CSR).

(a)     the extent to which the contravention was the result of deliberate or reckless conduct by the corporation, as opposed to negligence or carelessness;

(b)     the number of contraventions, the length of the period over which the contraventions occurred, and whether the contraventions comprised isolated conduct or were systematic;

(c)     the seniority of officers responsible for the contravention;

(d)     the capacity of the defendant to pay, but only in the sense that whilst the size of a corporation does not of itself justify a higher penalty than might otherwise be imposed, it may be relevant in determining the size of the pecuniary penalty that would operate as an effective specific deterrent;

(e)     the existence within the corporation of compliance systems, including provisions for and evidence of education and internal enforcement of such systems;

(f)     remedial and disciplinary steps taken after the contravention and directed to putting in place a compliance system or improving existing systems and disciplining officers responsible for the contravention;

(g)     whether the directors of the corporation were aware of the relevant facts and, if not, what processes were in place at the time or put in place after the contravention to ensure their awareness of such facts in the future;

(h)     any change in the composition of the board or senior managers since the contravention;

(i)     the degree of the corporation’s cooperation with the regulator, including any admission of an actual or attempted contravention;

(j)     the impact or consequences of the contravention on the market or innocent third parties;

(k)     the extent of any profit or benefit derived as a result of the contravention; and

(l)     whether the corporation has been found to have engaged in similar conduct in the past.

11    This, however, is not a rigid checklist. The task of the Court is to determine what is an “appropriate” penalty in the circumstances of the case: Australian Building and Construction Commissioner v Pattinson [2022] HCA 13; 274 CLR 450 at [19] (Kiefel CJ, Gageler, Keane, Gordon, Steward and Gleeson JJ).

12    Deterrence looms large in the identification of an appropriate penalty. In Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2013] HCA 54; 250 CLR 640 at [66] (TPG) French CJ, Crennan, Bell and Keane JJ endorsed a statement that a penalty for contravening a civil penalty provision in a regulatory statute:

must be fixed with a view to ensuring that the penalty is not such as to be regarded by [the] offender or others as an acceptable cost of doing business… [T]hose engaged in trade and commerce must be deterred from the cynical calculation involved in weighing up the risk of penalty against the profits to be made from contravention.

13    To similar effect, see Australian Securities and Investments Commission v Australia and New Zealand Banking Group Limited [2023] FCA 1150 at [96]-[97] (Beach J). His Honour noted that the extent to which deterrence is achieved may depend on the contravener’s size and financial position; and that, in this connection, it is relevant to take into account any broader corporate structure of which the contravener is a part. This point is more obviously relevant to specific deterrence, which is of limited significance if, as in this case, the contravener’s business has shut down. However, specific deterrence of the persons who controlled the contravenor may well be a relevant factor. Relativity between the size of the contravener’s business and the amount of the penalty is also not irrelevant to the general deterrence that is contemplated by the statement in TPG extracted above.

14    Before turning to the circumstances of the present case it is useful to say something concerning the concept of a course of conduct, which (as noted above) features in ASIC’s submissions as to the appropriate penalties to be imposed here in respect of large numbers of very similar contraventions. In Australian Securities and Investments Commission v Westpac Banking Corporation (The Consumer Credit Insurance Case) [2022] FCA 359; 158 ACSR 647 at [80] Katzmann J summed up the effect of earlier cases as follows.

It is neither appropriate nor permissible to treat multiple contraventions as one contravention for the purpose of determining the statutory limit. But in an appropriate case a single penalty may be imposed for multiple contraventions where that course is agreed or accepted by the parties as appropriate. One such case is where there is an interrelationship between the legal and factual elements of a number of contraventions, it is necessary to take care to ensure that the contravener is not penalised twice for what amounts to the same wrongdoing. This principle, originally developed in the context of the sentencing discretion, is commonly known as the “course of conduct” or “one transaction” principle. The principle requires that in such a case consideration should be given to whether the contraventions arise out of the same course of conduct or the one transaction in order to determine whether it is appropriate that a “concurrent” or single penalty should be imposed for multiple contraventions. Even if the course of conduct principle is applicable, however, a judge is not obliged to apply the principle if the resulting penalty does not reflect the seriousness of the contraventions. It may also be appropriate for the Court to fix a single penalty where the precise number of contraventions cannot be ascertained; where the number is so large that the fixing of separate penalties is not feasible; or where there is such a large number of relatively minor related contraventions such that the contraventions “are most sensibly considered compendiously”.

(Citations omitted.)

This case

15    With these principles in mind, five broad considerations call for attention in the present case.

16    First, the declarations record very large numbers of individual contraventions of provisions of the Code. Each of these involved a small amount of money. However, each also involved an individual consumer; and, in view of the nature of Ferratum’s business, the great majority of those customers can be taken to have been persons of very limited means who were vulnerable to exploitation. The amounts involved could well have been significant for some customers. The evidence revealed that the large numbers of individual contraventions of the Code were attributable to a failure by Ferratum to implement and maintain adequate systems for calculating the amounts payable by customers. The failure persisted over a period of years despite the attention of ASIC and promises to do better. These circumstances led to a significant failure by Ferratum to meet the standard required of it by s 47(1)(a) of the Act: to conduct its business efficiently, honestly and fairly.

17    It is appropriate, as ASIC’s submissions proposed, to take the individual contraventions of s 24(1A)(a) and (b) of the Code in each of the identified periods as a single course of conduct. The individual contraventions, though not necessarily factually linked to each other, were similar and flowed from the same failure to maintain proper systems. In addition, the large numbers of small scale contraventions make it infeasible to deal with each one individually. As noted above, however, it is not appropriate or permissible to treat each course of conduct as a single contravention: weight must be given to the persistence of behaviour over significant periods and the large numbers of individuals affected. Indeed, while each individual contravention of the Code can be attributed to negligence or carelessness, when viewed as a course of conduct they appear systematic and deliberate (or at least reckless) (cf Westpac No 3 at [49(a)-(b)]) because they are a function of Ferratum having, over a long period, failed to deal with obvious and persistent deficiencies in its system. These points suggest that the penalty for each category (or course of conduct) should be substantial.

18     Secondly, one of the relevant factors proposed by French J in CSR (reflected in several of the factors listed by Beach J in Westpac No 3) was whether the contravener has a corporate culture conducive to compliance with the statute, as evidenced by educational programs and disciplinary or other corrective measures. Ferratum’s shortcomings in this regard are a significant aggravating feature of the case.

19    Ferratum’s operations were the subject of external compliance reports by Dr O’Shea in December 2016 and August 2017, which made recommendations relating to matters such as calculation of monthly payments and the lawfulness (or at least appropriateness) of some of the fees Ferratum was charging. Ferratum’s responses were generally slow and often inadequate. On the question of monthly charges it said in February 2017 that it was in the process of building a system that could automatically calculate fees. This was never done. Fees that Dr O’Shea had highlighted as potentially unlawful continued to be charged.

20    In large part, these problems appear to have persisted because Ferratum’s parent company (Multitude SE), which is based in Finland, paid little or no attention to Australian regulatory requirements and chose not to allocate adequate resources to compliance in this country. For example, Ferratum’s response to Dr O’Shea’s report said that it was unlikely to rebuild its accounting system “specifically for the Australian market” because its parent company put a greater value on uniform reporting and accounting across the 24 countries in which it operated. On another occasion, when Australian staff raised issues concerning manual calculations and sought the development of a “tool” that would calculate fees and charges correctly, the response they received was that “there are no resources available to implement this”.

21    The indifference of Ferratum’s parent company to local regulatory requirements appears not to be limited to Australia. A subsidiary of Multitude SE was held in Commerce Commission v Ferratum New Zealand Limited [2020] NZHC 1607 to have breached “lender responsibility principles” under New Zealand law in several respects.

22    Thirdly, and relatedly, both French J in CSR and Beach J in Westpac No 3 (at [49(i)]) instanced the degree of cooperation with the authorities as a relevant factor. In this connection Ferratum has been found wanting in three respects.

(a)    In response to Dr O’Shea’s reports, Ferratum said in 2017 that it would build a system to calculate fees automatically. However, there is no indication that this had been attempted before Ferratum went into liquidation. Ferratum also asserted incorrectly to ASIC in July 2020 that the practice of overcharging borrowers had been rectified in 2018.

(b)    Between June 2020 and October 2021 Ferratum was issued by ASIC with a total of 11 statutory notices requiring it to provide information or produce documents. One of these was complied with by the due date. Others received partial responses on or slightly after the due date, with further material provided up to a month later. Nothing at all was produced in response to notices issued on 20 September and 29 October 2021.

(c)    Ferratum received advice from senior counsel in August 2022 to the effect that it might have no realistic prospect of defending some or all of ASIC’s claims unless deficiencies in its processes were addressed. It received further advice in December 2022 to the effect that its position had in some respects deteriorated since the earlier advice. Yet it continued to defend the proceeding until it went into liquidation on 4 April 2023.

23    Fourthly, as to deterrence, specific deterrence of Ferratum is not an issue given that it is in liquidation and no longer trading. However, it is appropriate that the orders made should seek to deter Multitude SE against taking a similar approach to doing business in Australia in future in the event that it seeks to re-enter the market (eg, by establishing a new Australian subsidiary). The orders should also seek to send an appropriate message to other providers of SACCs in Australia and to other foreign entities participating in, or considering entering, that market through subsidiaries.

24    For both of these reasons, it is appropriate to take into account the extent to which Multitude SE was exercising control over Ferratum during the periods in which contraventions were occurring and was on notice of those contraventions. It is also appropriate to take into account the place of Ferratum within the corporate group and the size and profitability of that group.

25    As to the first of these points, I have noted earlier that Ferratum’s management and accounting systems were to a significant extent dictated by the corporate group to which it belonged. In addition, a number of responses by Ferratum to communications from ASIC and affidavits deposed by its solicitors and officers (as well as by employees of Multitude SE or other entities in the group) made it clear that Ferratum itself was a small operation and many matters needed to be referred to, or had decisions imposed by, staff of Multitude SE or its other subsidiaries in Europe. Matters referred to staff in Europe included instructions in relation to responses to notices from ASIC and the conduct of this proceeding. I am satisfied that Ferratum’s parent company exercised a significant degree of control over both the implementation of the systems that led to contraventions occurring and Ferratum’s responses to the actions taken by ASIC to investigate and remedy those contraventions. In considering what level of penalty is appropriate for the purposes of deterrence, the case should be approached on the footing that the contravener is the corporate group to which Ferratum belonged.

26    Ferratum’s financial statements for 2017 to 2019 showed it earning revenues between around $9.7m and $12.5m each year. It reported losses in each year, but it is difficult to know what to make of this because it was controlled by Multitude SE and had large related party loans. An affidavit affirmed by Mr John Warton of ASIC analysed data obtained from providers of small and medium sized credit contracts in Australia (the detail of which is subject to confidentiality orders) and showed that, by reference to total credit provided, Ferratum ranked between 10th and 17th out of around 200 providers in the 2017-18 to 2021-22 financial years. It was thus a significant business in the market in which it operated.

27    Consolidated financial reports are available for Multitude SE for the years ending 31 December 2017 to 31 December 2022. Multitude SE earned revenue of between €212.366m and €293.104m in each of those years. It made a loss of €2.562m in 2021 but otherwise made profits of between €485,000 and €23.648m in each year. Its net assets at the end of 2022 were €181.960m. It is a large and (usually) profitable multinational organisation.

28    Fifthly, in a case where there are multiple contraventions, the “totality” principle (referred to, eg, in Australian Securities and Investments Commission v Westpac Banking Corporation [2019] FCA 2147 at [270]–[272], [308] (Wigney J)) calls for attention to whether the total of the penalties imposed for those contraventions is in proportion to the contravening conduct considered as a whole.

Disposition

29    Taking these factors into account, the penalties proposed by ASIC for the various breaches of s 24(1A) of the Code are in my view clearly not excessive and should be imposed. The proposed penalty for each course of conduct is substantial but does not approach the maximum provided by the legislation for a single contravention. Ferratum’s contraventions of the Code, while they individually concerned very small amounts of money, were persistent and systemic (continuing in the face of regulatory attention) and affected potentially vulnerable consumers. The need for deterrence justifies penalties at these levels.

30    Ferratum’s contravention of s 47(1)(a), taking these features of its behaviour into account, was serious. However, in recognition of the substantial overlap between the conduct constituting that contravention and the contraventions of the Code, the penalty should be reduced somewhat. I will therefore fix the penalty for contravention of s 47(1)(a) at $4 million.

31    Ferratum will therefore be ordered to pay the following pecuniary penalties pursuant to s 167(2) of the Act.

(a)    Contraventions of s 24(1A)(b) of the Code between 13 March 2019 and 14 July 2020 (incorrect early payouts): $4 million;

(b)    Contraventions of s 24(1A)(a) of the Code between 13 March 2019 and 30 September 2019 (contracts including prohibited fees): $3 million;

(c)    Contraventions of s 24(1A)(b) of the Code between 13 March 2019 and 30 September 2019 (requiring payment of prohibited fees): $2 million;

(d)    Contraventions of s 24(1A)(a) of the Code between 1 October 2019 and 11 August 2021 (contracts including prohibited fees): $2 million;

(e)    Contraventions of s 24(1A)(b) of the Code between 1 October 2019 and 11 August 2021 (requiring payment of prohibited fees): $1 million; and

(f)    Contravention of s 47(1)(a) of the Act between 13 March 2019 and 14 July 2020: $4 million.

Associate:

Dated:    28 June 2024