FEDERAL COURT OF AUSTRALIA

Australian Securities and Investments Commission v Westpac Banking Corporation [2026] FCA 651

ORDERS

DEFINITIONS

In these declarations and orders, terms have the following meanings:

(a)    Agreed Contravention Period means 4 September 2017 to 8 May 2023.

(b)    Code means the National Credit Code, being Schedule 1 to the Credit Act, as in force during the Relevant Period and the Agreed Contravention Period.

(c)    Credit Act means the National Consumer Credit Protection Act 2009 (Cth) as in force during the Agreed Contravention Period and the Relevant Period.

(d)    Credit Licence means Australian Credit Licence.

(e)    Online Hardship Notice means a hardship notice submitted to Westpac by a customer (who had entered into a credit contract, within the meaning of s 4 of the Code, with Westpac or the Other Westpac Brands) by completing an online form via the public websites of Westpac and the Other Westpac Brands.

(f)    Other Westpac Brands mean St George, BankSA and Bank of Melbourne, which operated under Westpac’s Credit Licence and were trading brands of Westpac during the Relevant Period and the Agreed Contravention Period.

(g)    Relevant Period means 2 October 2015 to 7 June 2023.

(h)    Westpac means the respondent, Westpac Banking Corporation (ACN 007 457 141).

(i)    Westpac Customer Assist Team means the team at Westpac which actioned the Online Hardship Notices.

(j)    Written Decision Notice means a written notice in response to a customer’s Online Hardship Notice as required by s 72(4) of the Code.

THE COURT DECLARES THAT:

1.    From 2 October 2015, Westpac failed to give a Written Decision Notice in response to customers’ Online Hardship Notices, within the timeframe required by s 72(4) and (5) of the Code, or at all, and thereby contravened s 72(4) of the Code:

(a)    on each occasion 223 Online Hardship Notices were submitted by a customer during the Agreed Contravention Period; and

(b)    on each occasion 277 Online Hardship Notices were submitted by a customer during the Relevant Period (which includes the 223 Online Hardship Notices referred to in subparagraph (a)).

2.    During the Relevant Period, for each customer who submitted an Online Hardship Notice prior to 4 September 2017 and who did not receive a Written Decision on or after 13 March 2019, pursuant to s 175A(1) of the Credit Act Westpac:

(a)    was under a continuing obligation to respond to each Online Hardship Notice by giving a Written Decision Notice;

(b)    committed a separate contravention of s 72(4) of the Code each day it failed to give a Written Decision Notice in response to each Online Hardship Notice, within the timeframe required by s 72(4) and (5) of the Code; and

(c)    is deemed to have contravened section 72(4) of the Code on and after 13 March 2019 in relation to each relevant customer.

3.    In the period from 13 March 2019 to 7 June 2023, Westpac failed to do all things necessary to ensure that the credit activities authorised by the credit licence are engaged in efficiently, honestly and fairly, and thereby contravened s 47(1)(a) and (4) of the Credit Act, in that during that period Westpac:

(a)    did not maintain adequate systems, controls and processes which ensured that:

(i)    Online Hardship Notices submitted by customers were received by the Westpac Customer Assist team; and

(ii)    Written Decision Notices were given to customers within the timeframes prescribed by s 72(4) and (5) of the Code; and

(b)    did not conduct adequate risk reviews, investigations, monitoring and analysis of its Online Hardship Notice systems and processes to enable it to identify any issues with its systems or processes, or to otherwise ensure that its Online Hardship Notice systems and processes enabled compliance with s 72(4) and (5) of the Code.

THE COURT ORDERS THAT:

1.    Westpac pay to the Commonwealth of Australia a pecuniary penalty of $26 million, within 30 days of the date of these orders, in respect of Westpac’s contraventions of s 72(4) of the Code and s 47(1)(a) and (4) of the Credit Act as identified in declarations 1 to 3 above.

2.    Pursuant to s 182 of the Credit Act, within 14 days of the date of these orders, Westpac publish, at its own expense, a written adverse publicity notice (Written Publicity Notice) in terms set out in Annexure A to these orders, for a period of no less than 90 days, maintaining a copy of the Written Publicity Notice, in 10 point font or larger, in an immediately visible area of the following web addresses:

(a)    https://www.westpac.com.au/;

(b)    https://www.stgeorge.com.au/;

(c)    https://www.bankofmelbourne.com.au/; and

(d)    https://www.banksa.com.au/.

3.    Pursuant to s 177 of the Credit Act, Westpac, at its own cost:

(a)    within one month, implement system, operational and process changes that are adequate to ensure Online Hardship Notices are responded to within the time limits specified by s 72(4) and (5) of the Code; and

(b)    within one month of implementing the changes referred to in subparagraph (a):

(i)    appoint a suitably qualified independent expert agreed between Westpac and the Australian Securities and Investments Commission (ASIC) (or, failing agreement, determined by the Court); and

(ii)    instruct the expert to prepare and provide to ASIC a written report on the outcome of the implementation of the changes referred to in subparagraph (a), including as to whether and to what extent the changes have been fully and effectively implemented in accordance with these orders, and provide recommendations to Westpac to remedy any aspects of Westpac’s systems, operations and processes to ensure compliance with s 72(4) and (5) of the Code;

(c)    within six months after appointing the expert referred to in subparagraph (b):

(i)    provide to ASIC a copy of the report referred to in subparagraph (b) above; and

(ii)    state what steps Westpac has taken to give effect to the expert’s recommendations.

4.    Westpac pay ASIC’s costs of the proceeding, to be agreed or assessed.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

ANNEXURE A

Adverse Publicity Order

The Federal Court of Australia has ordered Westpac Banking Corporation to publish this written adverse publicity notice.

On 26 May 2026 Justice McEvoy of the Federal Court of Australia ordered Westpac Banking Corporation (Westpac) to pay a total pecuniary penalty of $26 million in connection with Westpac’s failure to receive, and respond to, customers’ online hardship notices within the timeframes required by law throughout the period of 2 October 2015 to 7 June 2023 (Relevant Period). Affected customers include Westpac customers and St George, BankSA and Bank of Melbourne customers, who operated under Westpac’s Australian credit licence.

Justice McEvoy imposed the $26 million pecuniary penalty after declaring that, by that conduct:

(a)    Westpac had failed to do all things necessary to ensure that the credit activities authorised by the credit licence were engaged in efficiently, honestly and fairly; and

(b)    Westpac had failed to comply with consumer credit law.

Westpac failed to give a written response to 277 customers’ online hardship notices during the Relevant Period.

Westpac made admissions of contravention in the proceeding. Westpac also cooperated with ASIC in the investigation and during the proceeding.

Prior and during the proceeding, Westpac conducted a remediation program in which it paid a total of $1,735,126.81 in remediation to impacted customers and apologised for its conduct. This remediation program was broader than the 277 customers that were subject to the proceeding.

Westpac has committed to funding and implementing new technology systems and processes for receiving and responding to online hardship notices.

Further information

The above conduct contravened the following consumer credit laws:

    Section 72(4) and (5) of the National Credit Code, being Schedule 1 to the National Consumer Credit Protection Act 2009 (Cth); and

    Section 47(1)(a) and (4) of the National Consumer Credit Protection Act 2009 (Cth).

For further information about the conduct, see the following:

    The court’s judgment on penalty [hyperlink];

    Australian Securities and Investments Commission media release [hyperlink]; and

    Statement of facts agreed between the parties to the proceeding which is Annexure A to the court’s judgment [hyperlink].

REASONS FOR JUDGMENT

MCEVOY J:

1    The applicant in this proceeding, the Australian Securities and Investments Commission (ASIC), alleges that Westpac Banking Corporation (Westpac) has contravened s 72(4) of the National Credit Code (Code) and s 47(1)(a) and (4) of the National Consumer Credit Protection Act 2009 (Cth) (Credit Act) by failing to respond to online financial hardship requests made by vulnerable customers who were unable to meet their repayment obligations under a credit contract. The reasons for these requests varied, but they included serious health issues, unemployment during the COVID-19 pandemic, and family violence.

2    ASIC alleges that at least between 4 September 2017 and 8 May 2023 (Agreed Contravention Period) Westpac did not, either within the period prescribed by s 72(5) of the Code or at all, respond to certain online hardship notices submitted by its retail customers. ASIC also alleges that in the period between 13 March 2019 and 7 June 2023 Westpac failed to do all things necessary to ensure that the credit activities authorised by its credit licence were engaged in efficiently, honestly and fairly. Westpac substantially admits the conduct alleged by ASIC, and admits that it has contravened s 72(4) of the Code during the Agreed Contravention Period and that it has contravened s 47(1)(a) and (4) of the Credit Act during the period 13 March 2019 to 7 June 2023. Westpac also accepts that its conduct was serious.

3    There is, however, a dispute between the parties as to two matters. The first is the form of the declarations which are to be made by the court in respect of Westpac’s contraventions. The issue relates principally to the number of online hardship notices that are properly to be the subject of the declaration of contravention of s 72(4) of the Code. This dispute falls to be resolved through a determination of the proper construction and effect of s 175A of the Credit Act. ASIC’s construction of s 175A of the Credit Act, and the additional notices in respect of which it seeks declarations of contravention, encompass a broader period of time than the Agreed Contravention Period. This period is from 2 October 2015 to 7 June 2023 (Relevant Period).

4    In addition to declarations of contravention, compliance orders and an adverse publicity order, ASIC seeks that Westpac be required to pay a pecuniary penalty for its contraventions in the amount of $30 million. This is comprised of $20 million for the contraventions of s 72(4) of the Code and $10 million for the contraventions of s 47 of the Credit Act. Westpac’s position as to penalty is that a total penalty in this amount would be excessive and inappropriate, and that a penalty in the order of $10 million would be more appropriate. This is the second dispute between the parties.

5    The parties have jointly prepared and filed a statement of agreed facts (SOAF) pursuant to s 191 of the Evidence Act 1995 (Cth) (Evidence Act). While the court is not required to accept the SOAF uncritically, in this case I accept it as credible and cogent, and proof of the facts it contains. The effect of the SOAF is that evidence to prove the facts that it contains is not necessary, and the court has before it a sufficient factual foundation to support the exercise of its power to make declarations and impose a penalty: Evidence Act s 191(2); Minister for the Environment, Heritage and the Arts v PGP Developments Pty Limited [2010] FCA 58; 183 FCR 10 at [35] (Stone J); Australian Securities and Investments Commission v Commonwealth Bank of Australia [2020] FCA 790 at [12] (Beach J) (ASIC v Commonwealth Bank of Australia).

6    In addition to the SOAF, in support of its position regarding liability and penalty ASIC relies upon:

(a)    the affidavit of Mr Andrew Fleming affirmed on 29 April 2024 (Fleming Affidavit);

(b)    the affidavit of Mr Michael Dorman affirmed on 17 July 2024;

(c)    written submissions on liability and penalty dated 19 March 2025;

(d)    written submissions in reply dated 6 May 2025; and

(e)    supplementary written submissions dated 29 August 2025.

7    In support of its position regarding liability and penalty Westpac relies upon:

(a)    the affidavit of Mr Alexander McNab Stewart affirmed on 24 June 2024 (Stewart Affidavit);

(b)    the affidavit of Ms Ananya Roy affirmed on 27 June 2024; (Roy Affidavit)

(c)    written submissions on liability and penalty dated 23 April 2025; and

(d)    supplementary written submissions dated 29 August 2025.

8    For the reasons that follow there will be declarations and orders substantially in the form sought by ASIC. Insofar as pecuniary penalty is concerned, I have determined that Westpac should be ordered to pay a total penalty of $26 million.

THE LEGISLATIVE SCHEME

9    Before turning to the underlying facts and contraventions themselves, it is useful to commence with an overview of the relevant legislative scheme under the Code and the Credit Act. The specific provisions relevant to Westpac’s conduct will be the subject of later consideration.

10    The Code is contained in Schedule 1 to the Credit Act. It provides a consumer protection framework for consumer credit and related transactions. The Code relevantly provides debtors with a right to seek that credit contracts be amended or varied on the basis of financial hardship: see Explanatory Memorandum, National Credit Protection Bill 2009 (Cth) at [8.2], [8.159]–[8.162].

11    Section 72 of the Code provides a procedural mechanism by which debtors may notify credit providers of financial hardship and seek to make changes to their credit contracts where such contracts are regulated by the Code. As Yates J accepted in Australian Securities and Investments Commission v Membo Finance Pty Ltd (No 2) [2023] FCA 126 at [29] (Membo Finance (No 2)), this section provides an important formal mechanism to protect consumers who may be vulnerable when experiencing financial hardship.

12    Pursuant to s 72(1) of the Code, a debtor who considers that they are unable to meet their obligations under a credit contract, may give notice to the credit provider of that inability. Such notice is generally referred to as a hardship notice.

13    After receiving a hardship notice, a credit provider must give written notice to the debtor that advises them of the outcome of their hardship notice in accordance with the content and timing requirements in s 72(4) and (5) of the Code (decision notice). A credit provider may request further information from the debtor with respect to their hardship notice under s 72(2) of the Code. Relevantly, s 89A of the Code provides that in certain circumstances where a hardship notice has been given by a debtor, a credit provider must not begin enforcement proceedings against that debtor unless the credit provider has given the debtor a written decision notice stating that the credit contract will not be changed, and 14 days has expired since such notice was given.

THE RELEVANT FACTS

14    As has been mentioned, the facts agreed by the parties for the purposes of this proceeding are set out in the SOAF, which is annexed to these reasons. I will not therefore describe the facts in any more detail than is necessary to resolve the outstanding liability issue and the question of appropriate penalty.

15    At all material times Westpac held an Australian credit licence which authorised it to engage in credit activities within the meaning of s 6 of the Credit Act and provide credit pursuant to credit contracts to which the Code applies. St George, BankSA and Bank of Melbourne (Other Westpac Brands) also operated under Westpac’s Australian credit licence and were, and continue to be, trading brands of Westpac. It is sometimes necessary to refer specifically to the Other Westpac Brands in these reasons, but a reference to Westpac should be taken to be a reference to the respondent entity that held the credit license under which its subsidiaries operated.

16    From 16 July 2015 to 28 February 2023 “financial hardship” was described in Westpac’s financial hardship policies (as well as those of the Other Westpac Brands) as occurring when a customer is “willing but unable to meet their existing financial obligations for a period of time”. Examples of situations which might cause financial hardship were listed in these policies, and included unemployment, reduced income, injury or illness (including carer responsibilities), death of a family member, natural disaster, over commitment or indebtedness and vulnerability. The types of financial assistance offered to customers were described at various times in these policies as including: loan extensions; short term reduced payments; short term moratorium; interest rate reduction; debt settlement; debt waiver; and any contractual rearrangement that Westpac considered appropriate.

17    The policies recognised also that customers may experience “extreme hardship” as a result of circumstances including “severe or terminal illness, disablement, long term unemployment [and] long-term loss of contract or supplier”. They provided that customers experiencing incurable or permanent financial hardship “may be candidates for long-term or permanent collection arrangements”. Such arrangements included long term payment plans, partial write-offs and the allowance of time for customers to sell their property (after 1 July 2019).

18    During the Relevant Period, the policies stated that Westpac would respond to a hardship notice submitted by a customer in respect of which no further information was required within 21 days of the date that the notice was received. The policies set out the procedure by which further information could be requested if necessary. Pursuant to the policies, once a hardship notice had been assessed, as was required under the Code, Westpac was to provide the customer with a written decision notice and provide reasons.

19    The policies provided that in circumstances where Westpac had or had cause to issue a default notice to a customer under s 88 of the Code, Westpac would not take enforcement action unless it had given a written decision notice to a customer and a period of 14 days had elapsed. This aspect of the policies essentially mirrored s 89A of the Code.

20    Westpac’s financial hardship policies incorporated, in their appendices, commitments under the Australian Banking Association’s Banking Code of Practice (Banking Code of Practice) as they applied from time to time. Westpac (and the Other Westpac Brands) have been signatories to the Banking Code of Practice since 1 February 2014. The Banking Code of Practice is a voluntary set of commitments which includes commitments to customers experiencing financial difficulty. ASIC submits, and I accept, that each relevant credit contract in this proceeding incorporated the terms of the Banking Code of Practice. Westpac did not contend that the position was otherwise.

21    From 2 October 2015, customers who entered into a credit contract within the meaning of s 4 of the Code with Westpac or the Other Westpac Brands could give a hardship notice by completing an online form via the public websites of Westpac and the Other Westpac Brands. It will be apparent that these online hardship notices were, relevantly, the means by which Westpac’s customers notified Westpac that they were unable to meet their obligations under a credit contract. Westpac’s systems were intended to work such that after submission, the online hardship notice would be processed by a certain automated system known as the “OneClick” system, then transferred to other automated systems and then to Westpac’s “Customer Assist” team, which was the team responsible for determining the customer’s request. The system(s) to which an online hardship notice was transferred depended on the credit product(s) to which the hardship notice related. The details of the relevant Westpac systems and processes are set out in Part C of the SOAF.

22    Also from 2 October 2015, at least 1,013 online hardship applications submitted by 1,003 customers were either not sent to Westpac’s Customer Assist team for processing, or were not processed properly, or at all, by Westpac. Westpac did not give a written decision notice in response to 277 of these online hardship notices submitted by affected customers within the statutory timeframe prescribed by s 72(5) of the Code, or at all. The parties agree that 223 online hardship notices fall within the Agreed Contravention Period. Westpac’s failures in this regard are set out in Parts D and E of the SOAF.

23    It is to be noted that the references in Part D of the SOAF to 1,014 online hardship notices submitted by 1,004 customers and to Westpac not having given a written decision notice in response to 288 online hardship notices in total, are incorrect. The parties agree, due to circumstances that are unnecessary to describe here but which are explained in the Roy Affidavit, that this aspect of the SOAF was incorrect. They agree that the correct number of online hardship applications submitted, the number of customers, and the number that were not responded to, are those that have been set out above. It is also apparent that the reference to Westpac not having given a written decision notice in response to 224 online hardship notices at paragraph [14] of the SOAF is a typographical error.

24    During the Agreed Contravention Period Westpac accepts that its systems and processes for online hardship notices were deficient in several material respects. These include system failures, IT errors, and operational or processing deficiencies. Indeed Westpac accepts that its “OneClick” system which was supposed to process and transfer online hardship notices to other systems, as well as its other systems processes and operations for online hardship notices, were defective. The details of the deficiencies and failures in the systems are set out in Part E of the SOAF.

25    In its written submissions ASIC summarises Westpac’s contraventions as arising from the following four system failures and three operational failures:

(a)    network connectivity failures and a batching process error affecting the transfer of online hardship applications from Westpac’s OneClick system database to a central drive called the “J Drive” (System Failure A);

(b)    a file transfer batch configuration error affecting the transfer of online hardship applications from the J Drive to the “App105” system (System Failure B);

(c)    a technical error permitting customers to submit an online hardship application without a valid Westpac account number which applications were not transferred further (System Failure C);

(d)    data formatting issues in the online application form which prevented some forms from loading in collections systems for action to be taken (System Failure D);

(e)    human error in that missing applications appearing in a reconciliation report were not raised with the correct teams for action to be taken (Operational Failure A);

(f)    human error in that those responsible for sending missing applications forming part of System Failure A did not send those applications through (Operational Failure B); and

(g)    various other human errors resulting in action not being taken in relation to hardship applications (Operational Failure C).

26    ASIC submits that although each System and Operational Failure has different underlying causes, each failure and delay in rectification stemmed from what it describes as Westpac’s “complex, aging and inadequate IT platforms, systems and processes” and Westpac’s “chronic underfunding to improve them.”

27    Westpac identified System Failure A on 31 January 2022. The circumstances in which the System Failure was identified are set out in the SOAF and it is unnecessary to repeat them, save to note that the identification was due to a customer having called Westpac to request information regarding their online hardship application. Westpac identified the other System and Operational Failures at certain times between 31 January 2022 and 7 June 2023.

28    Between 12 September 2017 and 31 January 2022, Westpac had received 16 customer complaints regarding online hardship notices that had not been responded to, and had itself identified “missing” online hardship notices during that time.

29    As is set out in Part F of the SOAF, a number of internal IT “tickets” and other internal incident reports were raised within Westpac, including in its risk and compliance management system, identifying that online hardship notices were “missing” or had not been received by the Customer Assist team. The issues and failures with the automated systems were, however, not substantially investigated until the investigation that led to the identification of System Failure A in January 2022.

30    The consequences of Westpac’s failures, the remediation that has been provided, and the action Westpac has otherwise taken to address the system failures will be addressed further below. These matters are described more fully in the SOAF. It is relevant to note, however, that during the Relevant Period Westpac took action in relation to certain customers’ debt despite them having submitted an online hardship notice. That action included the recording of adverse credit information and default on some affected customer’s credit files, and referring certain customers to third-party debt collectors who then pursued the debts.

31    Westpac reported the deficiencies in its systems in relation to System Failure A to ASIC on 3 March 2022. It also subsequently reported the deficiencies in relation to the other System and Operational Failures to ASIC, and provided several breach report updates. These are set out in detail at paragraphs [27], [38], [48], [57], [66], [73], [79] and Annexures B to H to the SOAF.

32    As has been mentioned, Westpac accepts that the contravening conduct was serious. Westpac also acknowledges that the time taken to identify the issues with its online hardship process and the customers affected as a consequence is “disappointing”. Those affected, particularly those the subject of adverse credit reporting and debt recovery action, may have used stronger language.

THE CONTRAVENTIONS

33    Despite Westpac having substantially admitted the contraventions, it is necessary to consider the contraventions which have been alleged. It is convenient first to consider Westpac’s contraventions of s 72 of the Code, including the total number of hardship notices relevant to those contraventions by reference to s 175A the Credit Act, before turning to Westpac’s contraventions of s 47 of that Act.

Westpac’s contraventions of s 72 of the Code

The terms of s 72 of the Code

34    Section 72 of the Code is in the following terms:

72      Changes on grounds of hardship

Hardship notice

(1)     If a debtor considers that he or she is or will be unable to meet his or her obligations under a credit contract, the debtor may give the credit provider notice (a hardship notice), orally or in writing, of the debtor’s inability to meet the obligations.

Note:     If the debtor gives the credit provider a hardship notice, there may be requirements (beyond those in section 88) that the credit provider must comply with before beginning enforcement proceedings—see section 89A.

Further information

(2)     Within 21 days after the day of receiving the debtor’s hardship notice, the credit provider may give the debtor notice, orally or in writing, requiring the debtor to give the credit provider specified information within 21 days of the date of the notice stated in the notice. The information specified must be relevant to deciding: 

(a)     whether the debtor is or will be unable to meet the debtor’s obligations under the contract; or

(b)     how to change the contract if the debtor is or will be unable to meet those obligations.

(3)     The debtor must comply with the requirement.

Note:     The credit provider need not agree to change the credit contract, especially if the credit provider:

(a)     does not believe there is a reasonable cause (such as family violence, illness or unemployment) for the debtor’s inability to meet his or her obligations; or

(b)     reasonably believes the debtor would not be able to meet his or her obligations under the contract even if it were changed.

Notice of decision on changing credit contract

(4)     The credit provider must, before the end of the period identified under subsection (5), give the debtor a notice:

(a)     that is in the form (if any) prescribed by the regulations and records the fact that the credit provider and the debtor have agreed to change the credit contract; or

(b)     that is in the form (if any) prescribed by the regulations and states:

(i)     the credit provider and the debtor have not agreed to change the credit contract; and

(ii)     the reasons why they have not agreed; and

(iii)     the name and contact details of the AFCA scheme; and

(iv)     the debtor’s rights under that scheme.

Civil penalty: 5,000 penalty units.

(4A)     Subsection (4) does not apply if the credit provider and the debtor agree to a change to the credit contract that defers or otherwise reduces the obligations of the debtor under that contract for a period not exceeding 90 days.

(5)     The credit provider must give the notice before the end of the period identified using the table.

Regulations may prescribe shorter periods for credit contracts

(6)     The regulations may provide for subsections (2), (3), (4) and (5) to have effect in relation to credit contracts prescribed by the regulations as if a particular reference in subsection (2) or (5) to a number of days were a reference to a lesser number of days prescribed by the regulations.

35    The current version of s 72(4) of the Code came into effect on 1 March 2013 and applies to credit contracts entered into after that date. Save for an increase in penalty units, the amendments that were made during the Agreed Contravention Period were minor and are unnecessary to describe in these reasons.

36    As ASIC submits, there are four elements required to establish a contravention of s 72(4) of the Code as follows:

(1)    the contract was a credit contract within the meaning of s 4 of the Code;

(2)    a hardship notice has been given pursuant to s 72(1) of the Code;

(3)    the credit contract to which the hardship notice related was entered into on or after 1 March 2013; and

(4)    the credit provider did not provide to the debtor a decision notice within the relevant statutory timeframe set out in s 72(5) of the Code.

37    The National Consumer Credit Protection Regulations 2010 (Cth) (Regulations) do not prescribe the form that a hardship notice provided by a debtor to a creditor pursuant to s 72(4) of the Code should take. However, the case law indicates that such a notice must be in writing: Membo Finance (No 2) at [32]. Further, as ASIC notes, the Code does not prescribe the changes that may be made to a credit contract as a result of a creditor determining that a debtor is suffering hardship in the relevant sense, however s 73 of the Code does require that the particulars of any change be provided to a debtor in writing no later than 30 days after there has been agreement to the change or changes.

The admitted contraventions

38    Westpac admits that during the Agreed Contravention Period it failed to respond to 223 online hardship notices which were submitted by customers of Westpac and the Other Westpac Brands within the period prescribed in s 72(5) of the Code, or at all. With respect to each of these occasions it accepts that the four elements of s 72(4) (as set out in paragraph 36) are established. It therefore admits that it has contravened s 72(4) with respect to these 223 hardship notices.

39    Having regard to the SOAF and the evidence tendered by the parties, in particular the information and documents contained in the Fleming Affidavit, as well as the admissions made by Westpac, I am satisfied that Westpac contravened s 72 on at least 223 occasions as alleged by ASIC.

Westpac’s further contraventions of s 72 of the Code

40    As has been mentioned, Westpac does not admit to the totality of the contraventions of s 72 of the Code alleged by ASIC. That is to say that ASIC alleges that Westpac has contravened s 72 of the Code with respect to an additional 54 online hardship notices the subject of ASIC’s proposed declaration, and Westpac denies this. As has also been mentioned, the difference in the number of hardship notices alleged by ASIC and agreed to by Westpac results from the parties having taken differing positions as to the proper construction and effect of s 175A of the Credit Act. Westpac’s position in essence is that ASIC is unable to seek declarations with respect to the additional 54 online hardship notices because they were provided to Westpac prior to the Agreed Contravention Period and are therefore outside the limitation period for this proceeding.

41    In these circumstances, the main liability issue for the court to determine is the effect of s 175A of the Credit Act and, in consequence, whether a declaration of a contravention of s 72(4) of the Code should be made in respect of the 223 affected notice customers (as Westpac contends) or the 277 affected notice customers (as ASIC contends).

The effect of s 175A of the Credit Act

42    Section 175A of the Credit Act is in the following terms:

(1)    If an act or thing is required under a civil penalty provision to be done:

(a)    within a particular period; or

(b)    before a particular time;

then the obligation to do that act or thing continues until the act or thing is done (even if the period has expired or the time has passed).

(2)    A person who contravenes a civil penalty provision that requires an act or thing to be done:

(a)    within a particular period; or

(b)    before a particular time;

commits a separate contravention of that provision in respect of each day during which the contravention occurs (including the day the relevant pecuniary penalty order is made or any later day).

43    Section 175A of the Credit Act was introduced as part of the Treasury Laws Amendment (Strengthening Corporate and Financial Sector Penalties) Act 2019 (Cth) (Strengthening Penalties Act) and commenced on 13 March 2019. That Act introduced almost identical continuing contravention provisions in s 1317QA of the Corporations Act 2001 (Cth) (Corporations Act), s 12GBCM of the Australian Securities and Investments Commission Act 2001 (Cth) (ASIC Act), and s 75R of the Insurance Contracts Act 1984 (Cth).

44    Schedule 3, Pt 4 of the Strengthening Penalties Act sets out the transitional provisions for s 175A of the Credit Act, which relevantly states:

Subject to this Part, the amendments made by Schedule 3 to the [Strengthening Penalties Act] apply in relation to the contravention of a civil penalty provision if the conduct constituting the contravention of the provision occurs wholly on or after the commencement day.

See also National Consumer Credit Protection (Transitional and Consequential Provisions) Act 2009 (Cth) Sch 8, Pt 2, item 3 (Transitional Provisions Act).

45    The Explanatory Memorandum to the Strengthening Penalties Act at [1.113] explains the operation of s 175A as follows:

Contravening a civil penalty provision does not relieve the person of their obligations under the provision. If an act or thing is required to be done, the obligations continue until the act or thing is done. This means that if the act or thing is not done, the civil penalty provision is initially contravened, and a separate contravention is then committed each day until the act or thing is done.

46    Section 175A of the Credit Act does not operate retrospectively. The Revised Explanatory Memorandum to the Strengthening Penalties Act provides at [1.248]:

The amendments made by this Bill in relation to a contravention of a civil penalty provision apply to contraventions that occur wholly on or after the commencement day of this Bill.

47    At the time of the hearing in this proceeding, there had been no judicial consideration of s 175A of the Credit Act and limited judicial consideration of the transitional provisions. Section 175A of the Credit Act has subsequently been considered in Australian Securities and Investments Commission v National Australia Bank [2025] FCA 947 (Neskovcin J) (ASIC v NAB) and Australian Securities and Investments Commission v Australia and New Zealand Banking Group Limited (Retail Cases Omnibus) [2025] FCA 1593 (Beach J) (ASIC v ANZ (Retail Omnibus)). In both cases, their Honours found that s 175A of the Credit Act provides that a credit provider’s obligation to give a notice under s 72(4) of the Code continues until that act is done, and that a credit provider who contravenes s 72(4) of the Code commits a separate contravention of that provision in respect of each day during which the contravention occurs (including the day the relevant pecuniary penalty order is made or any later day): ASIC v NAB at [26]; ASIC v ANZ (Retail Omnibus) at [63]. In both these cases, however, the declarations of contravention related only to conduct that had occurred after 13 March 2019. It remains that there has been no judicial consideration of the application of s 175A of the Credit Act to s 72(4) of the Code that is of assistance in circumstances where ASIC seeks declarations with respect to conduct that occurred in part prior to 13 March 2019.

48    Westpac contends that the judicial consideration of the transitional provisions does not offer any adequate guidance as to the effect of s 175A on s 72(4) of the Code in the present context. By contrast, ASIC submits that a number of these cases are informative as to the effect of s 175A. First ASIC draws attention to Australian Securities and Investments Commission v AustralianSuper Pty Ltd [2025] FCA 102; 172 ACSR 615 (ASIC v AustralianSuper), in which AustralianSuper had admitted that in the period 1 July 2013 to 19 June 2022 it failed to establish rules as required by s 108A of the Superannuation Industry Act 1993 (Cth). In that case ASIC had sought civil penalties under s 912A(1)(a) and (5A) of the Corporations Act for failures that occurred between 13 March 2019 to 20 June 2022. Justice Hespe observed (at [164]) that:

It is only conduct occurring wholly on or after the commencement date which results in the contravention of s 912A(5A) and which attracts the civil penalty provision. However, the fact that contravening conduct commenced occurring prior to the commencement date and continued after the commencement date does not prevent a determination of a contravention in respect of the conduct that occurred after the commencement date. Such an outcome is consistent with the approach adopted in Australian Securities and Investments Commissioner v Westpac Banking Corporation [2022] FCA 515 at [409]–[412] (Beach J) and in Australian Securities and Investments Commission v Macquarie Bank Limited [2024] FCA 416 at [69] (Wigney J).

49    ASIC also referred the court to the treatment of analogous substantive provisions, namely s 1317QA of the Corporations Act. This section was discussed briefly in Australian Securities and Investments Commission v Statewide Superannuation Pty Ltd [2021] FCA 1650 (Statewide Superannuation) and Australian Securities and Investments Commission v Noumi Ltd (No 3) [2024] FCA 862 (Noumi). In Statewide Superannuation at [88]–[89], Besanko J held that in the context of the defendant failing to lodge a written breach report with ASIC within the statutory timeframe under the Corporations Act there was a separate contravention on each day that the defendant failed to lodge the report. In Noumi at [49]–[50], Jackman J held that by operation of s 1317QA of the Corporations Act separate and continuing contraventions of s 674(2) of the Corporations Act occurred on each trading day in the relevant periods. However, the issue of whether contraventions occurred “wholly” after 13 March 2019 did not arise in either proceeding.

50    Turning then to the parties’ submissions on this issue, ASIC contends that s 175A of the Credit Act enlivens penalties for contraventions that would otherwise be barred by the limitation in s 167 of that Act. Its position is that where a contravention of s 72 of the Code (being the obligation to give a decision notice under s 72(4) by the prescribed timeframes) occurred prior to six years before these proceedings were commenced (being prior to 4 September 2017) but continued on or after 13 March 2019, s 175A of the Credit Act allows ASIC to seek penalties in respect that contravention.

51    Westpac submits, however, that the usual limitation period of six years ought to apply in this proceeding, precluding both the making of a declaration or the imposition of a pecuniary penalty on Westpac in relation to contraventions that occurred prior to 4 September 2017. Westpac contends that ASIC’s submission that s 175A of the Credit Act has the effect of permitting it to allege contraventions outside the limitation period should not be accepted.

52    Westpac submits that to apply s 175A of the Credit Act to s 72(4) of the Code it is necessary to determine whether each constituent element of a contravention occurred wholly on or after 13 March 2019. It submits that for the purpose of that analysis the elements of a contravention of s 72(4) of the Code are:

(a)    that the debtor gave the hardship notice (s 72(1) of the Code); and

(b)    that the credit provider failed to give notice of their determination of the hardship notice within the prescribed time (ss 72(2), (4) and (5) of the Code).

53    Westpac illustrates its submission by way of an example in which a customer provided an online hardship notice to Westpac on 5 July 2016. Westpac was required to respond to that notice on 27 July 2016. Thus, in Westpac’s submission, the contravention was complete on 28 July 2016 (the day after compliance was required). Other than by operation of s 175A, the contravention did not continue despite the written decision not being given by that date, or at all. Westpac contends that the words “occur wholly on or after” in the transitional provisions expressly limit the operation of s 175A of the Credit Act such that each contravention of s 72(4) that occurred prior to 13 March 2019 was completed and concluded on the day the credit provider failed to comply with its obligations to provide a determination of the hardship notice. Westpac submits that ASIC’s interpretation of s 175A of the Credit Act finds no support in the drafting of the section, is contrary to the express language of the transitional provisions, and is inconsistent with ss 166 and 167 of the Credit Act.

54    Nonetheless, for the following reasons, and having regard to the explanatory memoranda and the authorities set out above, I prefer ASIC’s submissions as to the effect of s 175A of the Credit Act. I accept, as ASIC submits, that the transitional provisions which have been referred to apply to s 175A of the Credit Act and not s 72 of the Code. The focus of the enquiry is whether the relevant conduct constitutes a contravention of s 175A of the Credit Act, and whether that conduct occurred wholly on or after 13 March 2019. The conduct to which s 175A of the Credit Act applies is a continuing obligation to do an act or thing. Here that is the giving of a decision notice by the timeframes prescribed by the Code, until that act or thing has been performed: ASIC v NAB at [26]; ASIC v ANZ (Retail Omnibus) at [63].

55    I accept, as ASIC submits, that Westpac’s continuing failure to give a decision notice under s 72(4) within the prescribed timeframe was the “conduct constituting the contravention”. For the 54 affected customers in question, that conduct occurred each day wholly on or after 13 March 2019 until Westpac issued the affected customer a decision notice: Credit Act s 175A(2); Statewide Superannuation at [88]–[89]; Noumi at [49]–[50], [69]. As ASIC submits, it does not matter if the customer submitted a hardship notice prior to 13 March 2019, or if Westpac failed to give a decision notice prior to 13 March 2019; the contravening conduct is the continuing failure to give a decision notice. It also does not matter that the initial contravention of s 72(4) of the Code occurred prior to 4 September 2017, provided that Westpac continued to contravene its obligation to give a decision notice on and after 13 March 2019. It is not open to Westpac to avoid liability for its failure to provide written decision notices under s 72(4) of the Code simply and only because the obligation to do so first arose prior to 13 March 2019.

56    It is on this basis that the total number of online hardship notices and total affected customers the subject of declaration one will be 223 and 277, respectively. It is appropriate also that the period referred to is the Relevant Period, that is 2 October 2015 to 7 June 2023.

57    Nevertheless, even if I am not correct in the above analysis, and Westpac’s position as to the effect of 175A of the Credit Act is to be preferred, the number of affected customers in the declaration (an additional 54, out of 277) does not materially affect my determination of the appropriate penalty to be imposed. The parties appear to accept that this is so.

58    With this in mind I note that Westpac makes a number of further detailed submissions on the subject of whether s 72(4) of the Code was a continuing contravention prior to the enactment of s 175A of the Credit Act. I accept ASIC’s submission, however, that it is unnecessary to engage with those submissions or to determine that question in circumstances where I have accepted ASIC’s position as to the effect of s 175A of the Credit Act. This is particularly so in circumstances where, even if my analysis as to s 175A of the Credit Act were to be regarded as incorrect, and Westpac’s submissions with respect to the contraventions not being “continuing” were to be accepted, that would have no material impact on the appropriate pecuniary penalty I have decided to impose.

Westpac’s contraventions of s 47 of the Credit Act

59    ASIC alleges that Westpac has contravened s 47 of the Credit Act during the Agreed Contravention Period. Westpac admits that this is so.

60    Section 47(1)(a) of the Credit Act is in the following terms:

General conduct obligations of licensees

General conduct obligations

(1)     A licensee must:

(a)     do all things necessary to ensure that the credit activities authorised by the licence are engaged in efficiently, honestly and fairly; and

61    Section 47 of the Credit Act is a civil penalty provision where the contravening conduct occurred wholly on or after 13 March 2019: Transitional Provisions Act Sch 8, Pt 2, item 3.

62    ASIC draws attention to the principles applicable to determining contravention set out by Foster J in Australian Securities and Investments Commission v Camelot Derivatives Pty Ltd (in liq) [2012] FCA 414; 88 ACSR 206 at [69] (in the context of s 912A(1)(a) of the Corporations Act) as follows:

(a)     The words “efficiently, honestly and fairly” must be read as a compendious indication meaning a person who goes about their duties efficiently having regard to the dictates of honesty and fairness, honestly having regard to the dictates of efficiency and fairness, and fairly having regard to the dictates of efficiency and honesty.

(b)     The words “efficiently, honestly and fairly” connote a requirement of competence in providing advice and in complying with relevant statutory obligations. They also connote an element not just of even handedness in dealing with clients but a less readily defined concept of sound ethical values and judgment in matters relevant to a client’s affairs.

(c)     The word “efficient” refers to a person who performs his [or her] duties efficiently, meaning the person is adequate in performance, produces the desired effect, is capable, competent and adequate. Inefficiency may be established by demonstrating the performance of a licencee’s functions falls short of the reasonable standard of performance that the public is entitled to expect.

(d)     It is not necessary to establish dishonesty in the criminal sense. The word “honestly” may comprehend conduct which is not criminal but which is morally wrong in the commercial sense.

(e)     The word “honestly” when used in conjunction with the word “fairly” tends to give the flavour of a person who not only is not dishonest, but also a person who is ethically sound.

(Citations omitted)

See also Australian Securities and Investments Commission v Westpac Banking Corporation (No 2) [2018] FCA 751; 266 FCR 147 at [2347]–[2348] (Beach J) (ASIC v Westpac (No 2)); Australian Securities and Investments Commission v AGM Markets Pty Ltd (in liq) (No 3) [2020] FCA 208; 275 FCR 57 at [505]–[510] (Beach J); Story v National Companies and Securities Commission (1988) 13 NSWLR 661 (Young J).

63    ASIC submits that the following additional principles are also relevant in the present case:

(a)    A contravention of the “efficiently, honestly and fairly” standard does not require a contravention or breach of a separately existing legal duty or obligation, whether statutory, fiduciary, common law or otherwise. The statutory standard itself is the source of the obligation: ASIC v Westpac (No 2) at [2350].

(b)    Breach of another provision may itself be sufficient to constitute a violation of general obligations: see, for example, Australian Securities and Investments Commission v Westpac Banking Corporation (Omnibus) [2022] FCA 515; 407 ALR 1 at [71]–[73] (Beach J) (ASIC v Westpac (Omnibus)).

(c)    The word “ensure” imports a forward-looking element into the obligation. It is necessary not only to act efficiently, honestly and fairly from day to day, but to take steps to guard against lapses from that standard by employees or representatives: Australian Securities and Investments Commission v Commonwealth Bank of Australia [2022] FCA 1422 at [146] (Downes J), citing Australian Securities and Investments Commission v AMP Financial Planning Pty Ltd (No 2) [2020] FCA 69; 377 ALR 55 at [105] (Lee J) (ASIC v AMP Financial Planning Pty Ltd (No 2)).

(d)    The standard may be unintentionally breached. Contravention is generally a matter of objective analysis: Australian Securities and Investments Commission v National Australia Bank Ltd [2022] FCA 1324; 164 ACSR 358 at [352] (Derrington J); Australian Securities and Investments Commission v Ferratum Australia Pty Limited (in liq) [2023] FCA 1043; 169 ACSR 553 at [49] (Kennett J) (ASIC v Ferratum).

(e)    Some conduct is appropriate to assess through a public expectation lens: for example, fees charged for no service, or providing financial advice without consideration of the client’s best interests: Australian Securities and Investments Commission v RI Advice Group Pty Ltd [2022] FCA 496; 160 ACSR 204 at [49] (Rofe J), referring to Australian Securities and Investments Commission v MLC Nominees Pty Ltd [2020] FCA 1306; 147 ACSR 266 (Yates J) and Australian Securities and Investments Commission v Westpac Securities Administration Ltd [2019] FCAFC 187; 272 FCR 170 (Allsop CJ, Jagot and O'Bryan JJ).

(f)    Where the contravening conduct occurred prior to 1 March 2019 and continued after that date, that does not prevent a determination of a contravention in respect of conduct that occurred on or after 1 March 2019: ASIC v AustralianSuper at [164] (Hespe J) citing ASIC v Westpac (Omnibus) at [409]–[412] and Australian Securities and Investments Commission v Macquarie Bank Limited [2024] FCA 416 at [69] (Wigney J).

(g)    Dishonesty in the criminal sense is not required: Australian Securities and Investments Commission v Lanterne Fund Services Pty Ltd [2024] FCA 353 at [93] (McEvoy J).

64    ASIC submits that while the authorities to which reference has been made have largely considered the meaning of the phrase “efficiently, honestly and fairly” in the context of s 912A(1)(a) of the Corporations Act, the principles essayed in these cases are equally applicable to s 47(1)(a) of the Credit Act: see Australian Securities and Investments Commission v Darranda Pty Ltd (Liability) [2024] FCA 1015 at [240] (Hespe J) citing Membo Finance (No 2) at [37]. I accept that this is so.

65    ASIC alleges, and Westpac admits, that in the period from 13 March 2019 to 7 June 2023 Westpac failed to do all things necessary to ensure that the credit activities authorised by its credit licence were engaged in efficiently, honestly and fairly, and that Westpac thereby contravened s 47(1)(a) and (4) of the Credit Act by failing to:

(a)    maintain adequate systems, controls and processes which ensured that:

(i)    online hardship notices given by customers were received by the Customer Assist team; and

(ii)    written decision notices were given to customers within the timeframes prescribed by s 72(4)and (5) of the Code; and

(b)    conduct adequate risk reviews, investigations, monitoring and analysis of its online hardship notice systems and processes to enable it to identify any issues with its systems or processes, or to otherwise ensure that its online hardship notice systems and processes enabled compliance with s 72(4) and (5) of the Code.

66    On the subject of whether Westpac’s activities were engaged in efficiently, ASIC makes a number of submissions which it is unnecessary to describe in detail. In substance, however, ASIC contends that Westpac’s online hardship systems, processes and operations were inefficient in eight respects which it says had a cumulative and compounding effect. Those eight matters may be summarised as follows:

(a)    First, ASIC submits that from 1 October 2015 to 6 June 2023, Westpac had a complex, multi-system environment with aging technology which created an unacceptable risk (of which Westpac was aware) that online hardship notices would not be received and processed, including timely requests for customer information, within the timeframes prescribed by s 72(4) and (5) of the Code.

(b)    Secondly, ASIC submits that Westpac had a heavy reliance on manual workarounds to its aging and complex IT systems which made its online hardship notices process vulnerable to human error and process deficiencies as evidenced by what has been termed Operational Failure A and Operational Failure C.

(c)    Thirdly, ASIC submits that the manual interim control that Westpac put in place to rectify System Failure A caused what has been termed Operational Failure B in that it resulted in a number of online hardship notices not being received until 15 days after they were originally submitted by the customer. This, ASIC submits, was inefficient having regard to the timeframes stipulated by s 72(5) of the Code and Westpac’s financial hardship policies, which required Westpac to provide a written decision notice within 21 days of receiving the online hardship notice.

(d)    Fourthly, ASIC submits that prior to the identification of System Failure A in 2022 Westpac adopted a siloed approach to fixing the root cause of this failure, evidenced by several internal incident and service tickets raised in 2018, 2020 and 2021 in respect of missing hardship notices and a 2023 audit report.

(e)    Fifthly, ASIC submits that Westpac could have, but did not, undertake an end-to-end review of the processes from a systems and processes perspective prior to April 2023.

(f)    Sixthly, ASIC submits that Westpac’s sustained underinvestment in what ASIC considers to be outdated and failing IT systems caused Westpac to remain technologically complex in comparison to its peers.

(g)    Seventhly, ASIC notes that Westpac admits that on at least 61 occasions it declined an affected customer’s hardship notice on the basis that the customer had not provided sufficient information to assess their request, in circumstances where the customer’s online hardship notice, as affected by the system failures and/or operational failures, had provided sufficient information. ASIC submits that five of these occasions relate to the admitted contraventions of s 72(4) of the Code.

(h)    Eighthly, ASIC submits that despite receiving 13 customer complaints between 13 March 2019 and 31 January 2022 (when System Failure A was formally identified) about ignored online hardship notices, including customers who complained twice, Westpac did not take any steps to determine whether there was a systemic issue. ASIC submits that this demonstrates that Westpac’s risk management processes were inadequate and ineffective at this time.

67    Further, ASIC submits that Westpac’s online hardship systems, processes and operations were unfair in two respects:

(a)    First, ASIC contends that Westpac’s online hardship systems, processes and operations impacted a class of customers experiencing a personal or financial crisis of varying severity and there was also a level of randomness as to whether a customer’s hardship application would be impacted by any of the system and operational failures.

(b)    Secondly, ASIC submits that because of the deficiencies in Westpac’s online hardship systems, processes and operations, Westpac issued default letters, recorded a default on a customer’s credit file, commenced enforcement proceedings and, or alternatively, referred a customer to third party debt collection despite those customers having previously applied for hardship relief.

68    ASIC submits that Westpac exacerbated affected customers’ personal and financial stress, and exposed those customers to further financial harm. ASIC notes that Westpac received several customer complaints in relation to default letters and notices as early as July 2018. In respect of enforcement proceedings, ASIC submits that Westpac risked contravening, or did in fact contravene, s 89A of the Code, and did not comply with the terms of its financial hardship policies in force between 16 July 2015 to 28 February 2023.

69    Finally, as to the matter of whether Westpac’s online hardship systems, processes and operations were honest, ASIC submits that Westpac was (or should have been) aware of the deficiencies in its systems, processes and operations, and its potential to affect customers experiencing financial hardship, and yet it persisted with those systems, processes and operations which exclusively impacted customers who were experiencing financial hardship. ASIC does not otherwise contend that Westpac’s conduct displayed actual dishonesty.

70    For substantially the reasons that ASIC submits, I accept that Westpac’s conduct fell well short of the reasonable standard of a credit licence holder which the public is entitled to expect, especially given Westpac’s size and resources and the commitments it has made under the Banking Code of Practice. In particular, I accept that Westpac failed to ensure that its credit activities were engaged in efficiently, honestly and fairly because Westpac:

(a)    did not prioritise the funding and investment to upgrade and simplify its complex legacy IT systems until 2024, despite being on notice that online hardship notices were not being properly sent or received, including in circumstances where it had received multiple complaints on the subject; and

(b)    delayed undertaking an end-to-end review of the processes from a systems and processes perspective until April 2023, and in this way did not take sufficient steps to guard against the risk that it would not give a written decision in response to an online hardship notice within the statutory timeframe prescribed by s 72(5) of the Code, or at all.

71    I am satisfied also that, as Westpac accepts, Westpac has contravened s 47(1)(a) by failing to:

(a)    maintain adequate systems, controls and processes which ensured that online hardship notices given by customers were received by the Customer Assist team and written decision notices were given to customers within the timeframes prescribed by s 72(4) and (5) of the Code and to ensure as far as practicable that the contravening conduct did not occur; and

(b)    conduct adequate risk reviews, investigations, monitoring and analysis of its online hardship notice systems and processes to enable it to identify any issues with its systems or processes, or otherwise to ensure that its online hardship notice systems and processes enabled compliance with s 72(4) and (5) of the Code.

DECLARATIONS

72    ASIC seeks declarations pursuant to s 21 of the Federal Court of Australia Act 1976 (Cth) (FCA Act) and s 166(2) of the Credit Act in respect of Westpac’s contravening conduct.

73    The court has a wide discretionary power to make declarations pursuant to s 21 of the FCA Act: ASIC v Commonwealth Bank of Australia at [152]; Australian Securities and Investments Commission v Financial Circle [2018] FCA 1644; 131 ACSR 484 at [155] (O’Callaghan J); Australian Securities and Investments Commission v Mercer Financial Advice (Australia) Pty Ltd [2023] FCA 1453 at [49] (McEvoy J) (ASIC v Mercer).

74    In Forster v Jododex Australia Pty Ltd [1972] HCA 61; 127 CLR 421, Gibbs J set out (at 437–438) the three requirements that should be satisfied before the discretion is exercised in favour of making a declaration as follows:

(a)    the question must be a real and not a hypothetical or theoretical one;

(b)    the applicant must have a real interest in raising it; and

(c)    there must be a proper contradictor.

75    The language of s 166(2) of the Credit Act is mandatory. It requires the court to make a declaration of contravention if it is satisfied that a person has contravened a civil penalty provision of the Credit Act: see Australian Securities and Investments Commission v Australia and New Zealand Banking Group Limited [2023] FCA 256 at [41]–[46] (O’Bryan J).

76    The parties largely agree as to form of the declarations. As has been explained, there is a dispute in respect of the total number of online hardship notices specified in the declaration of a contravention of s 72 of the Code, and therefore about the period within which it is to be specified that Westpac’s contraventions of both s 72 of the Code and s 47 of the Credit Act occurred. For the reasons I have outlined, I accept ASIC’s submission that there was a total of 277 affected notice customers between the period of 2 October 2015 and 7 June 2023.

77    I have determined that the contraventions that are the subject of the proposed declarations are established by the facts set out in the SOAF and the admissions made by Westpac. I am satisfied, therefore, that declarations of contravention must be made: s 166(2) of the Credit Act. I accept also that there is utility in making declarations in the form proposed by ASIC and substantially agreed by Westpac. Their terms identify the contravening conduct with specificity and record the court’s disapproval of it. There will therefore be declarations substantially in the terms that ASIC proposes.

PECUNIARY PENALTY

Relevant principles

78    Sub-sections 167(1) and (2) of the Credit Act give the court power to order a pecuniary penalty in respect of a contravention of a civil penalty provision where a declaration of contravention pursuant to s 166 has been made.

79    The discretion to be applied in setting a pecuniary penalty must be guided by the relevant statutory provisions. Nevertheless, the legal principles that govern the assessment of the quantum of a pecuniary penalty that should be imposed for civil contraventions are well established. These principles may be summarised as follows.

80    First, the power to impose a penalty must be exercised judicially; that is, fairly and reasonably: Australian Building and Construction Commissioner v Pattinson [2022] HCA 13; 274 CLR 450 at [40] (Kiefel CJ, Gageler, Keane, Gordon, Steward and Gleeson JJ) (Pattinson).

81    Secondly, the primary or sole purpose of civil penalties is deterrence, both specific and general: Pattinson at [9]–[10], [15]–[18]; Commonwealth of Australia v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; 258 CLR 482 at [55] (French CJ, Kiefel, Bell, Nettle and Gordon JJ) (Agreed Penalties Case), referring to Trade Practices Commission v CSR Ltd [1990] FCA 762; [1991] ATPR 41-076 at 52,152 (French J) (CSR). See also Australian Securities and Investments Commission v Adler [2002] NSWSC 483; 42 ACSR 80 at [125]–[126] (Santow J). As I observed in ASIC v Mercer at [64], specific deterrence is concerned with deterring repetition of the contravening conduct by the contravener and general deterrence is concerned with deterring others who might be tempted to engage in similar contraventions: see Pattinson at [9], [15], [42], [47]–[48]. Penalties will be imposed to promote the public interest in compliance, and should be no greater than necessary to achieve the objectives of deterrence: Agreed Penalties Case at [55], referring to CSR at 52,152; Pattinson at [10], [40]. It is trite to observe that the object of pecuniary penalties does not include retribution, denunciation or rehabilitation: Pattinson at [15]–[16].

82    Thirdly, while the civil penalty should not be so high that it is oppressive, it should not be so low as to be regarded by the contravener as “an acceptable cost of doing business”: ASIC v Mercer at [65], citing Pattinson at [17], [40]–[41]; Australian Building and Construction Commission v Construction, Forestry, Mining and Energy Union [2018] HCA 3; 262 CLR 157 at [116] (Keane, Nettle and Gordon JJ); Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2013] HCA 54; 250 CLR 640 at [66] (French CJ, Crennan, Bell and Keane JJ); Singtel Optus Pty Ltd v Australian Competition and Consumer Commission [2012] FCAFC 20; 287 ALR 249 at [62]–[63] (Keane CJ, Finn and Gilmour JJ) (Singtel Optus); NW Frozen Foods Pty Ltd v Australian Competition and Consumer Commission [1996] FCA 1134; 71 FCR 285 at 293 (Burchett and Kiefel JJ) (NW Frozen Foods); Australian Securities and Investments Commission v Westpac Banking Corporation [2019] FCA 2147 at [255] (Wigney J) (ASIC v Westpac Banking). The penalty must be “proportionate” and “appropriate” in the sense that it strikes a reasonable balance between oppressive severity and deterrence in the circumstances of the case: Pattinson at [40]–[41], [46].

83    Fourthly, the court should have regard to the prescribed maximum penalty, however it should not simply start with the maximum penalty and proceed by making proportional deductions from that amount: Markarian v The Queen [2005] HCA 25; 228 CLR 357 at [31] (Gleeson CJ, Gummow, Hayne and Callinan JJ). The maximum penalty, while important, is “but one yardstick” to be applied: Australian Securities and Investments Commission v AMP Financial Planning Proprietary Limited [2022] FCA 1115; 164 ACSR 64 at [107] (Moshinsky J) (ASIC v AMP); Australian Competition and Consumer Commission v Reckitt Benckiser (Australia) Pty Ltd [2016] FCAFC 181; 340 ALR 25 at [155]–[156] (Jagot, Yates and Bromwich JJ) (Reckitt). As the plurality emphasised in Pattinson at [49], the maximum penalty is not reserved for the “worst” category of contravening conduct. Rather, what is required is that there be “some reasonable relationship between the theoretical maximum and the final penalty imposed”: Pattinson at [10], citing Reckitt at [156]. This relationship will be established where the penalty does not exceed what is reasonably necessary to deter future contraventions of a like kind by the contravenor, and by others: Pattinson at [10]; ASIC v Mercer at [68].

84    Fifthly, s 167(3) of the Credit Act requires that, in determining the pecuniary penalty, the court must take into account all relevant matters, including:

(a)    the nature and extent of the contravention; and

(b)    the nature and extent of any loss or damage suffered because of the contravention; and

(c)    the circumstances in which the contravention took place; and

(d)    whether the person has previously been found by a court (including a court in a foreign country) to have engaged in similar conduct.

85    Sixthly, additional factors may be taken into account as relevant considerations, keeping in mind the objective of the pecuniary penalty provisions. In Australian Securities and Investments Commission v Westpac Banking Corporation (No 3) [2018] FCA 1701; 131 ACSR 585 at [49] (ASIC v Westpac (No 3)), Beach J formulated the factors to be taken into account in the following terms:

(a)    the extent to which the contravention was the result of deliberate or reckless conduct by the corporation, as opposed to negligence or carelessness;

(b)    the number of contraventions, the length of the period over which the contraventions occurred, and whether the contraventions comprised isolated conduct or were systematic;

(c)    the seniority of the officers responsible for the contravention;

(d)    the capacity of the defendant to pay, but only in the sense that whilst the size of a corporation does not of itself justify a higher penalty than might otherwise be imposed, it may be relevant in determining the size of the pecuniary penalty that would operate as an effective specific deterrent;

(e)    the existence within the corporation of compliance systems, including provisions for and evidence of education and internal enforcement of such systems;

(f)    remedial and disciplinary steps taken after the contravention and directed to putting in place a compliance system or improving existing systems and disciplining officers responsible for the contravention;

(g)    whether the directors of the corporation were aware of the relevant facts and, if not, what processes were in place at the time or put in place after the contravention to ensure their awareness of such facts in the future;

(h)    any change in the composition of the board or senior managers since the contravention;

(i)    the degree of the corporation’s co-operation with the regulator, including any admission of an actual or attempted contravention;

(j)    the impact or consequences of the contravention on the market or innocent third parties;

(k)    the extent of any profit or benefit derived as a result of the contravention; and

(l)    whether the corporation has been found to have engaged in similar conduct in the past.

86    These factors are not to be applied as a “rigid checklist”. As ASIC submits, the court should weigh all relevant matters before it to fix an appropriate penalty with regard to the circumstances in which the contraventions have occurred: Pattinson at [19]; Australian Ophthalmic Supplies Pty Ltd v McAlary-Smith [2008] FCAFC 8; 165 FCR 560 at [91] (Buchanan J).

87    Seventhly, the criminal law principles of course of conduct, parity and totality will inform the court’s determination of a penalty: Pattinson at [45]; ASIC v Mercer at [69]–[70], [80].

88    The course of conduct principle requires the court to consider whether multiple contravening acts arise out of the same course of conduct or the one transaction in determining whether it is appropriate that a “concurrent” or “single penalty” should be imposed for the contraventions: Australian Securities and Investments Commission v Westpac Securities Administration Limited [2021] FCA 1008; 156 ACSR 614 at [25] (O’Bryan J) (ASIC v Westpac Securities), citing Australian Competition and Consumer Commission v Yazaki Corporation [2018] FCAFC 73; 262 FCR 243 at [234] (Allsop CJ, Middleton and Robertson JJ) (ACCC v Yazaki).

89    In applying the parity principle, while predictability of outcomes (for comparable contraventions) is capable of assisting in the assessment of general deterrence, it can be conceptually problematic to calibrate an appropriate penalty by looking at penalties in other cases: ASIC v Commonwealth Bank of Australia at [77].

90    The totality principle operates as a final consideration of the total aggregate penalty to be imposed on a wrongdoer to ensure that it is just and proportionate to the conduct, having regard to the circumstances of the case: Chief Executive Officer of the Australian Transaction Reports and Analysis Centre v Westpac Banking Corporation [2020] FCA 1538; 148 ACSR 247 at [69] (Beach J) (AUSTRAC v Westpac) citing Australian Competition and Consumer Commission v Australian Safeway Stores Pty Ltd [1997] FCA 450; 145 ALR 36 at [53] (Goldberg J).

Maximum penalty

91    In considering the quantum of the pecuniary penalty to be imposed on Westpac, I have had regard to the maximum penalty prescribed by the legislation.

92    The Strengthening Penalties Act introduced the following amendments relevant to determining the maximum penalty (from 13 March 2019):

(a)    the maximum number of penalty units for a contravention of s 72(4) of the Code increased from 2,000 penalty units to 5,000 penalty units;

(b)    s 47(1)(a) of the Credit Act became a civil penalty provision with a penalty of 5,000 penalty units;

(c)    s 175A of the Credit Act was introduced; and

(d)    the maximum pecuniary penalty for a body corporate became the greatest of the penalty specified for the civil penalty provision, multiplied by 10, or the alternative calculations specified in s 167B(2) of the Credit Act.

93    The parties agree that the value of a penalty unit fixed by s 4AA of the Crimes Act 1914 (Cth) during the Agreed Contravention Period was:

(a)    $210 between 1 July 2017 and 30 June 2020;

(b)    $222 between 1 July 2020 to 31 December 2022;

(c)    $275 between 1 January 2023 and 30 June 2023.

94    Without setting out the detailed calculations, ASIC submits that the total theoretical maximum penalty for Westpac’s contraventions of s 72(4) of the Code is $3,299 trillion, and for the contraventions of s 47 of the Credit Act it is between $21 million and $27.5 million. Westpac substantially accepts that the maximum penalties are in the order of such large amounts, disputing them only to the extent that the total number of s 72 contraventions is disputed.

95    I accept that taking into account the theoretical maximum penalty enables a proper consideration of the egregiousness of the contravening conduct: Australian Securities and Investments Commission v AGM Markets Pty Ltd (In Liq) (No 4) [2020] FCA 1499; 148 ACSR 511 at [38]–[40] (Beach J) (ASIC v AGM (No 4)); Australian Competition and Consumer Commission v Get Qualified Australia Pty Ltd (in liq) (No 3) [2017] FCA 1018 at [32] (Beach J). However, it is well recognised that where the theoretical maximum penalty is in the realm of billions or trillions of dollars, as is the case here, it offers no meaningful guide to the assessment of the appropriate penalty range. In the circumstances, this is best assessed by reference to other factors: see Reckitt at [157]–[158]; Australian Securities and Investments Commission v LGSS Pty Ltd (No 3) [2025] FCA 205; 173 ACSR 641 at [86] (O’Callaghan J).

The appropriate pecuniary penalty

96    As has been mentioned, ASIC’s proposed pecuniary penalty of $30 million is comprised of $20 million for Westpac’s contraventions of s 72(4) of the Code, and $10 million for Westpac’s contraventions of s 47 of the Credit Act. As has also been mentioned, on Westpac’s rather more tolerant view of what has occurred, a pecuniary penalty of $10 million is more appropriate.

97    It is well accepted that the process of having regard to the various relevant factors in deriving a penalty figure is one of intuitive synthesis: Australian Competition and Consumer Commission v Murray Goulburn Co-Operative Co Ltd [2018] FCA 1964 at [36] (Beach J); ASIC v AGM (No 4) at [47] (Beach J); ASIC v Mercer at [127]. The process requires a consideration of all factors taken together by reference to the civil penalty provisions contravened, in their statutory context. What follows should be understood in this context.

The nature and extent of the contraventions

98    In this case, the Relevant Period is relatively lengthy. Even in circumstances where Westpac agrees to having engaged in the relevant conduct during the Agreed Contravention Period, that conduct was extensive, enduring and serious.

99    The contravening conduct persisted for a long period, including throughout the COVID-19 pandemic when there was a heightened, and one might say critical, need for financial assistance for many of Westpac’s customers. In this regard ASIC draws the court’s attention to the fact that further system errors disclosing continued failures to comply with s 72 of the Code were reported in November 2024, almost three years after the issues that are the subject of this proceeding were first identified.

100    Westpac accepts that its conduct was serious. It submits, however, that the number of customers impacted by the contravening conduct was “extremely small” when compared to the total number of online hardship notices that were received by Westpac in the Agreed Contravention Period. By reference to the Stewart Affidavit, Westpac highlights that between 2 October 2015 and 31 May 2023 (encompassing almost the entirety of the Relevant Period) it received approximately 88,975 online hardship notices, but only contravened s 72(4) of the Code with respect to 223, or at a maximum 277, affected customers.

101    While I accept that the number of affected online hardship notices is proportionately small, I do not accept that this substantially mitigates against the seriousness of Westpac’s conduct. The harm caused to the customers who were affected was significant. Further, as ASIC points out and Westpac accepts, there were in fact at least 1,013 online hardship notices affected when the broader period commencing in 2015 is considered. In any event, the fact that the proportion of online hardship notices affected is relatively small is at least to some extent attributable to chance. It is not because of any positive act of Westpac. As Westpac itself acknowledges, the errors in question were “random”. Given the nature of the conduct, the systems failures involved, and the fact that Westpac had received complaints but failed to investigate the issues with the system, the number of affected customers could well have been higher.

102    It is also relevant to note, as ASIC submits and as is apparent from the evidence, that Westpac’s contravening conduct was only discovered when a customer called Westpac to enquire as to the status of their online hardship notice, which triggered an investigation. Westpac does not dispute that this is so. ASIC submits and I accept that but for these circumstances, the contravening conduct may well have continued.

103    In these circumstances I accept that Westpac’s conduct was both very serious and extensive. The contraventions, by definition, exclusively impacted vulnerable customers of Westpac who were experiencing personal or financial hardship. They deprived hundreds of those customers from having their hardship applications considered in a timely manner, and in a way which may have varied the terms of their credit and repayment obligations. In some cases, these vulnerable customers were not only deprived of possible assistance, but were the subject of unjustified and premature enforcement action. The resulting harm is self-evident and highly significant. While it will be necessary to return to the harm that was caused to particular customers, it is important to note here, as ASIC submits and Westpac acknowledges, that some of the harm caused to vulnerable customers was irreparable.

The circumstances of the contraventions

104    I accept, at one level, that the contraventions were brought about by systems and operational failures which did not directly involve the senior management of Westpac, and of which they were not aware until February 2022. I accept also, at one level, that the contravening conduct was not deliberate on the part of Westpac. In this regard I accept Westpac’s submission that the contraventions may therefore be distinguished from those involving conduct that occurred at the level of senior management. As ASIC submits, however, there are a number of other circumstances which must be noted and which bear upon the penalty that is to be imposed.

105    While ASIC did not suggest that Westpac’s conduct was intentional, senior counsel for ASIC characterised Westpac’s delay in investigating the system and process failures, as well as its under-resourcing at a technology level, as “grossly negligent”. In particular, ASIC submits that there were serious deficiencies in Westpac’s complaints handling and risk management systems. As has been mentioned, there were numerous complaints made by Westpac’s customers regarding the lack of decision notice being given in response to their online hardship applications and numerous incident reports had been lodged without any adequate investigation by Westpac into the cause of the issues, or whether it was systemic. The contraventions continued in these circumstances.

106    As outlined in Part F of the SOAF, the evidence is that a number of Westpac’s employees were aware of issues relating to the online hardship systems from at least December 2018, including that many online hardship notices were not being received by the Customer Assist team. That is, three years prior to the identification and investigation of these very issues in January 2022. While I accept Westpac’s submission that once System Failure A was formally identified in January 2022 it conducted a prompt investigation, this does not excuse the length of time it took Westpac to identify the Systems and Operational Failures in the first place. The same can be said of Westpac’s submission that the Systems and Operational Failures were difficult to detect.

107    In these circumstances, while I accept that Westpac’s conduct was not intentional in the sense that it set out deliberately to engage in the contravening conduct or was reckless, I accept ASIC’s submission that Westpac’s conduct was grossly negligent. The agreed facts and the evidence demonstrate that it was, or ought to have been, clear to Westpac that the systems and processes employed by it in relation to online hardship notices were not fit for purpose. This is especially so in circumstances where Westpac had received customer complaints and incident reports had been raised. At any time from the commencement of the relevant systems failures in October 2015 until January 2022, Westpac could have and should have conducted a thorough investigation of its systems and processes to satisfy itself that each and every hardship application was being received in the way intended. Westpac did not do this. The fact that senior management was not aware of the problem until after System Failure A was escalated is wholly unsatisfactory.

108    To the extent that Westpac draws attention to the relatively small number of complaints it received with respect to online hardship notices during the Agreed Contravention Period when compared with the much larger total number of complaints it would receive in a single year, I do not accept that this assists Westpac in any substantial way. As ASIC submits, 16 customer complaints is not an insignificant number: see ASIC v AMP at [55], [57], [130]. These 16 complaints came from real people who must have considered that they were experiencing real hardship. But in any event, given Westpac’s size and resources, Westpac should have been able to identify and investigate the broader Systems and Operational Failures much earlier than it did. The fact that Westpac did not do this reflects a serious management deficiency.

109    In its written submissions ASIC initially asked the court to infer that Westpac had unintentionally profited from the contravening conduct by reason of any interest (including default interest) that had accrued on affected customers’ accounts. In response, Westpac submitted that this was not the case and that any such interest (including default interest), fees, and the time value of that money was refunded to affected customers as part of its remediation program. Paragraph [120(b)] of the SOAF states that as at 13 December 2023 Westpac had paid $1,439,526.11 to impacted customers for refunds of fees, interest and time value of money, in addition to $295,600.70 paid in remediation for additional non-financial loss. Having regard to Westpac’s response, ASIC withdrew its submission that Westpac had profited from the contraventions.

110    At the hearing, senior counsel for ASIC appeared to accept that the fact that Westpac cannot be said to have profited from the contraventions must result in at least some minor deduction in the penalty amount to be paid by Westpac in circumstances where the $30 million penalty that ASIC sought was based in part based on the notion that it had. However, somewhat counter-intuitively, he also submitted that it remains open to the court to find that a $30 million penalty amount is nonetheless appropriate having regard to the other factors to be considered as part of the exercise of intuitive synthesis.

111    I accept that the extent of any profit or benefit derived as a result of the contraventions, or the lack of any such profit or benefit as demonstrated by Westpac, remains one of several relevant considerations to be taken into account in the assessment of pecuniary penalty. In circumstances where ASIC’s figure of $30 million was apparently based in part on an assumption that Westpac had profited from the contravening conduct, it must follow that absent that assumption a lesser penalty figure would be more appropriate. However, it remains the case that any reduction in penalty is to be considered in light of all of the circumstances and the factors to be considered with respect to the contraventions, and as part of the consideration of the total penalty amount to be imposed having regard to these matters.

The size and resources of Westpac and the industry in which it operates

112    ASIC submits that Westpac’s size and resources, as well as the industry in which it operates, are important factors when considering an appropriate pecuniary penalty in this proceeding. Westpac accepts this.

113    Westpac is a publicly listed company and one of Australia’s four major banks. It is accepted that Westpac’s revenue and net profit after tax throughout the Agreed Contravention Period was as follows:

114    Further, having regard the evidence of Westpac’s reported financial results, ASIC submits that a total penalty of $30 million would represent only 0.4% of Westpac’s net income for the 2023-2024 financial year.

115    Westpac maintains that a penalty in the amount of $10 million is still a substantial penalty, is unlikely to be seen as an “acceptable cost of doing business”, and is capable of deterring others from engaging in similar contravening conduct. It refers in this regard to Australian Competition and Consumer Commission v Optus Mobile Pty Limited [2019] FCA 106 at [82] (Murphy J), although of course that penalty was imposed in a different context.

116    Obviously the contravenor’s size and financial resources do not alone justify a higher penalty than might otherwise be imposed: see Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd [2015] FCA 330; 327 ALR 540 at [92] (Allsop CJ); ASIC v Mercer at [74]. However, it is well accepted that the size and financial resources of a contravenor may be particularly relevant in determining the size of the pecuniary penalty that would operate as an effective deterrent: ASIC v Westpac Banking at [260]. As Goldberg J observed in Australian Competition and Consumer Commission v Leahy Petroleum Pty Ltd (No 3) [2005] FCA 265; 215 ALR 301 at [39], the sum required to achieve deterrence will be larger where the court is setting a penalty for a company with vast resources.

117    I accept that Westpac’s size and significant financial resources are highly relevant factors in this case, and that it is necessary that the penalty imposed be substantial enough to achieve effective specific deterrence having regard to these factors.

118    I also accept that the industry in which Westpac operates is a relevant factor when considering the matter of deterrence and determining a pecuniary penalty amount. As ASIC submits, Westpac has acknowledged that by its conduct it also failed to meet its obligations under cl 164 and that has it breached, or is likely to have breached, cll 164 and 177 of the Banking Code of Practice. Breach of the Banking Code of Practice is something that should be taken seriously by the court: Australian Securities and Investments Commission v Australia and New Zealand Banking Group Ltd (No 3) [2020] FCA 1421 at [13] (Allsop CJ) (ASIC v ANZ (No 3)); Australian Securities and Investments Commission v Commonwealth Bank of Australia [2021] FCA 423 at [33] (Lee J) (ASIC v CBA).

119    In ASIC v ANZ (No 3), Allsop CJ made the following observation in the context of the banking industry (at [74]) which are apposite here:

The deterrent nature of the penal response is the central, if not the sole, purpose of an object of the penalty. A number of matters need to be stated about that here. The banking industry is large and involves consumer choices. There should be, and is, by the agreed penalty, a strong deterrent as to conduct which risks the rights of consumers and customers, by reference to any approach which risks their interests against the interests of the Bank. The considerations of the contract of adhesion and its administration, to which I have referred, are central in this regard. Put in economic terms, the market efficiency upon which consumer confidence rests, relies on reliability, good faith, fairness and honesty of conduct. It should be made clear to all businesses – here, banks, but all businesses – that the consumer should be dealt with in a way that accords with the Australian business conscience for which Parliament has legislated, and here, banks should be, as the submissions make clear, left in no doubt of the need for proper and strong compliance programs, sufficient to detect and address conduct of the present kind.

120    As I observed in ASIC v Mercer (at [149]), the obligations of reliability, good faith, fairness and honesty of conduct, which Allsop CJ identified in ASIC v ANZ (No 3), are of fundamental importance, and they underpin the functioning of the Australian economy. It is important not to lose sight of them.

Harm

121    Returning to the harm that has been caused by Westpac’s contraventions, it cannot be emphasised too highly that the persons affected by the relevant conduct were a vulnerable group of customers experiencing financial hardship. Westpac accepts this. ASIC submits, and it is not seriously contested, that the spectrum of customers impacted in this case included:

(a)    customers experiencing extreme cases of hardship such as family violence, natural disasters, homelessness, death of a family member, long-term unemployment, mental illness, or serious illness like cancer, major surgery and even being comatose (including carer responsibilities of dependents experiencing those conditions);

(b)    customers who were unemployed but expected to regain employment, customers who were recently divorced or separated with an anticipated settlement, or customers who were temporarily financially overcommitted; and

(c)    customers requesting a short-term moratorium on their repayments, or financial hardship due to a lack of rental income from their investment property.

122    As has been mentioned, in some cases vulnerable customers were not only deprived of possible assistance, but were the subject of unjustified and premature enforcement action. The resulting harm to these customers is self-evident and highly significant.

123    Westpac admits that 10 of the affected notice customers became bankrupt or entered a debt agreement (within the meaning of Pt IX of the Bankruptcy Act 1966 (Cth)) after submitting their online hardship notice. Westpac has also identified that 21 of the affected customers were experiencing “extreme vulnerability” at the time they lodged an online hardship notice. As ASIC submits, in this sense Westpac’s conduct placed these customers experiencing extreme financial hardship at risk of significant financial harm.

124    Westpac admits that with respect to at least 22 affected customers, it recorded adverse repayment information on their credit files, and with respect to an unknown number of customers it recorded default information on their files. Such adverse credit ratings being reported would have necessarily, at least for a time, impacted the ability of an affected customer to obtain credit on favourable terms, or at all: see ASIC v Westpac (Omnibus) at [385].

125    Further, on at least 21 occasions Westpac sold an affected customer’s account to a third-party debt purchaser. ASIC submits, and I accept, that this is significant in the court’s consideration of Westpac’s contraventions. I accept that the affected customers would likely have faced contact from debt collectors at a time when they were already experiencing financial hardship, and after they had requested that Westpac agree to make changes to their credit contract due to such hardship. This would undoubtedly have exacerbated affected customers’ financial and personal stress, and it occurred despite Westpac’s obligations under s 89A of the Code not to commence enforcement action in respect of these customers and Westpac’s commitment pursuant to cl 184 of the Banking Code of Practice not to refer such customers to third-party debt purchasers when actively considering their financial situation.

126    ASIC submits, and I accept, that a result of Westpac’s conduct affected customers were denied the opportunity to have their hardship notices determined at a time when they were most vulnerable and when they were most at risk of experiencing further financial hardship. In this sense customers were deprived of possible assistance that they were entitled to seek. I also accept that as a result of Westpac’s conduct each affected customer is likely to have experienced stress, inconvenience and the risk of further financial harm, including accrued interest, fees and charges, and the accumulation of additional debt. These are matters of enormous significance, and they should not be considered only in the abstract. I am prepared to accept that in many cases they will have been irreparable and life changing.

127    Westpac maintains that its remediation for financial and non-financial loss significantly reduces the impact on, and harm suffered by, the affected customers, and that this is a matter which warrants a significant reduction in the penalty that might otherwise have been thought to be necessary to achieve specific deterrence. Westpac’s remediation is set out in [117] to [120] of the SOAF. Westpac submits also that while it appreciates that its conduct “could” undermine the purpose of the legislative scheme with respect to hardship notices, the court should not accept that all affected customers have suffered material loss or damage.

128    Although I accept that Westpac has remediated affected customers fully, at least to the extent that this has been possible, I do not accept that this significantly alters the court’s consideration of the harm that has undoubtedly been caused by Westpac’s conduct. This is especially so in circumstances where, as is recorded at paragraph [121] of the SOAF, there is also tangible loss that has not been, or cannot be, financially remediated by Westpac. This includes circumstances where it is not possible to remove default listings that have already been expunged by law or listings on the National Personal Insolvency Index with retrospective effect. This is highly significant in the proper consideration of an appropriate penalty amount.

129    To the extent that Westpac submits that it is relevant that customers may have received some other form of hardship payment or assistance from the bank, including by reference to additional policies and procedures that Westpac put in place due to the COVID-19 pandemic alongside existing hardship policies and procedures, I do not accept that this has the significance that Westpac contends. As ASIC submits, there is no evidence that any customers the subject of the declarations to be made in this proceeding received any such assistance. Further, Westpac accepts that some customers became bankrupt or entered a debt agreement, that adverse information was entered on to customers’ credit files, and that all affected customers were remediated. It would have been open to Westpac to lead evidence that customers in fact received other forms of hardship payment or assistance.

130    Ultimately, I do not accept that Westpac’s remediation payments warrant a significant reduction in the penalty to be imposed. Nor do I accept that the possibility that some of the relevant customers may have received other assistance sounds in Westpac’s favour. Westpac’s submission that harm was not suffered by customers in the way ASIC alleges cannot be maintained.

Past contraventions

131    ASIC submits that Westpac’s past contravening conduct is an important consideration for the court in determining a pecuniary penalty for the purposes of deterrence in this matter. As O’Bryan J observed in ASIC v Westpac Securities (at [86]), a history of non-compliance with similar legal obligations across a corporate group may justify the imposition of a higher penalty for the purpose of achieving deterrence. Whether a contravenor can be said to have engaged in similar conduct in the past is something that must involve a relatively broad and impressionistic inquiry: see generally ASIC v ANZ (Retail Omnibus) at [86].

132    Westpac emphasises that it has not previously been found by a court to have contravened civil penalty provisions under s 72(4) of the Code, s 47(1)(a) of the Credit Act, or the Credit Act or Code more broadly. Westpac does accept, however, that it has been found to have contravened civil penalty provisions of the Corporations Act, including s 912A(1), and the ASIC Act, with respect to the state of its systems and processes to ensure compliance with the law. Nonetheless, Westpac submits that these contraventions were a result of historical or legacy technology systems and processes, and that they occurred at times largely overlapping with this proceeding. Westpac submits that they are therefore of limited relevance in determining penalty in the present context.

133    However, ASIC draws attention to the fact that this proceeding is the sixth occasion in recent years where Westpac and its subsidiaries have failed to ensure that their provision of financial services has been engaged in efficiently, honestly and fairly: see ASIC v Westpac (Omnibus) at [161], [270], [470], [513]–[517]; Australian Securities and Investments Commission v Westpac Banking Corporation (Penalty Hearing) [2024] FCA 52 at [21] (Lee J).

134    It is also the case, ASIC submits, that Westpac’s conduct which was the subject of the relevant recent proceedings had a degree of similarity to the present proceeding. Each of the ASIC v Westpac (Omnibus) proceedings concerned contraventions caused by deficient systems and failures with respect to financial products affecting retail customers. Four of those proceedings had lengthy contravention periods, comparable to the Agreed Contravention Period and the Relevant Period. In these proceedings Beach J found that Westpac had not provided sufficient funding or resources to implement satisfactory systems and processes, and that the relevant contraventions had occurred due to system and processing errors and inadequacies including inadequate risk management frameworks, deficient and inadequate systems and system and process “failures” and “errors”: see at [165], [186], [271], [324], [391], [450]–[453], [536].

135    Also relevantly, in one of the proceedings the subject of ASIC v Westpac (Omnibus), Westpac was found to have sold the debt of impacted credit customers to third party debt purchasers. Recovery action was also taken against impacted customers, adverse credit ratings were filed, and some customers became bankrupt. Justice Beach observed (at [386]–[387]):

Undoubtedly, the customers impacted by Westpac’s conduct were likely to be customers who could least afford to be overcharged with interest and who faced financial hardship.

Clearly, the extent and consequences of Westpac’s contraventions were serious to say the least.

136    Further, in AUSTRAC v Westpac, Beach J held (at [170]) that “the AML/CTF compliance and risk management functions were not adequately resourced” and “there were weaknesses in Westpac’s data management and technology systems in relation to AML/CTF compliance.” An agreed penalty of $1.3 billion was imposed for those contraventions. Also, in Australian Securities and Investments Commission v BT Funds Management Ltd [2021] FCA 844, Wheelahan J found (at [10]) that the contravening conduct by two wholly owned subsidiaries of Westpac was “attributed to two system errors and inadequate review and control mechanisms”.

137    While not systems error cases, ASIC also draws attention to Westpac having been found to have contravened the Corporations Act and the ASIC Act with respect to the sale of consumer credit insurance, the provision of personal advice in breach of its financial services license, and due to having engaged in unconscionable conduct with respect to the marketing of certain financial products: Australian Securities and Investments Commission v Westpac Banking Corporation (The Consumer Credit Insurance Case) [2022] FCA 359; 158 ACSR 647 (Katzmann J); ASIC v Westpac Securities; ASIC v Westpac (No 3).

138    Westpac submits that these prior contraventions are of limited relevance to the penalty to be ordered in the present circumstances, but I do not accept this submission. As ASIC submits, Westpac having been found to have contravened civil penalty provisions on these occasions demonstrates that it has consistently had in place inadequate systems and processes to meet its financial services obligations under various statutes as well as risk management systems to identify and correct such systemic issues. Westpac’s persistent failure to invest adequately in appropriate technology systems and platforms has exacerbated these inadequacies. This is highlighted both by previous cases involving Westpac, and by Westpac’s ongoing systems failures which are the subject of the present proceeding, including some which were reported as late as November 2024. Notwithstanding the fact that Westpac has more recently reformed its systems and invested in its technology infrastructure, Westpac’s prior conduct is both relevant and significant in my determination of the appropriate penalty to be ordered, particularly to address the objectives of specific and general deterrence.

Culture of compliance

139    Westpac submits that it has a culture of compliance, and that this is relevant to the court’s consideration of penalty. It submits, in particular, that it has a “culture of continuous improvement and a focus on compliance” having regard to four matters. First, Westpac submits that the evidence demonstrates that during the Relevant Period it had in place a “three lines of defence model”, and also risk management procedures to mitigate risk and manage compliance throughout the bank.

140    Secondly, Westpac submits that it had in place policies, processes, procedures and controls relating to financial hardship directed at both the process of transferring the online hardship notices through the online hardship process and responding to hardship notices within the prescribed timeframes, and the appropriate handling of the customers’ hardship notices by the Customer Assist team.

141    Thirdly, Westpac submits that it is relevant that in June 2024 ASIC provided Westpac with feedback from ASIC’s review of the approach of lenders to supporting customers experiencing financial hardship which noted “overall Westpac compared favourably to most other lenders who were subject of our review”.

142    Fourthly, Westpac notes that it has now decommissioned the systems that caused the Systems and Operational Failures.

143    I do not accept that these submissions as to Westpac’s culture of compliance bear substantially on the question of penalty. As ASIC submits, the existence or otherwise of a compliance culture is evidenced by a corporation’s actions, including through the identification and investigation of widespread or systemic issues. As Moshinsky J observed in ASIC v AMP (at [136]):

In relation to “corporate culture”, I consider that the failure to investigate whether or not there was a systemic issue, despite many complaints, over a lengthy period of time, reflects very poorly on the defendants (in particular, AMP Life). It is surprising and concerning that repeated complaints that the PSF had been wrongly debited from the superannuation accounts of members who had ceased employment with their employer-sponsor did not lead anyone within the defendants (in particular, within AMP Life) to question whether there was a systemic issue. While it is not suggested that senior management were involved in the contraventions, in my opinion it reflects very poorly on the organisational culture that this type of questioning did not occur.

144    ASIC is correct to submit that here Westpac has admitted that it has failed adequately to identify and investigate the issues that occurred even after it had received multiple complaints on the subject. Whatever models and procedures Westpac did employ during the Relevant Period were obviously ineffective. Further, whatever be the case about whether the contraventions the subject of this proceeding were accounted for by ASIC when it gave feedback to Westpac in 2024, that feedback relates to conduct which is not the subject of this proceeding. In any event, comparison of compliance between Westpac and other lenders is of little consequence for present purposes.

Co-operation and contrition

145    Westpac submits that it is entitled to a reduction in penalty when regard is had to the “substantial extent” to which it has co-operated with ASIC. It submits also that a significant ameliorating factor is the “substantial contrition” and acceptance of responsibility it has shown for the admitted contraventions.

146    It is well established that a contravener who has indicated wrongdoing, expressed regret, and indicated a willingness to facilitate the course of justice may be entitled to a reduction in penalty on that basis: Mornington Inn Pty Ltd v Jordan [2008] FCAFC 70; 168 FCR 383 at [76] (Stone and Buchanan JJ); Fair Work Ombudsman v Blakely [2023] FCA 1121 at [62] (Thomas J). From a public policy perspective, it is important to encourage such co-operation in the assessment of penalty: Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union [2017] FCAFC 113; 254 FCR 68 at [163] (Dowsett, Greenwood and Wigney JJ); Construction, Forestry, Maritime, Mining and Energy Union v Fair Work Ombudsman [2023] FCA 72; 322 IR 233 at [70] (Rangiah J). See also Australian Securities and Investments Commission v iSignthis Limited (Penalty) [2025] FCA 917 at [23]–[25] (McEvoy J).

147    Westpac refers to various ways in which it has co-operated with ASIC, including the disclosure of the identified online hardship notice issues, through its lodgement of breach reports relating to such issues, its co-operation with ASIC’s enquiries and requests for information, and its participation in voluntary meetings with ASIC. Also relevant, Westpac contends, is the fact that it made appropriate admissions in this proceeding, and that it agreed with ASIC in preparing the SOAF, as well as partially agreed to the proposed orders, including ASIC’s adverse publicity order and the compliance order. For its part ASIC does not contest that Westpac has co-operated with it, and in particular that Westpac participated in ASIC’s investigation and has admitted the contraventions and agreed to the facts which comprise the SOAF.

148    With respect to contrition, Westpac submits that the penalty necessary to achieve general deterrence may be moderated to account for a contravenor’s genuine remorse for its contravening conduct. This is particularly so, it submits, when regard is had to the reduced risk of future contraventions. Westpac maintains, referring to ASIC v Commonwealth Bank of Australia at [147], that its substantial contrition and accepted responsibility are manifested by its words and actions.

149    In this regard Westpac points to its remediation of affected customers, both as evidence of its contrition and that it has attempted to redress as far as money can the consequences of its contraventions. Westpac also highlights that it has:

(a)    publicly acknowledged that the time taken to identify the issues with its online hardship process, and that customers were impacted as a result, is disappointing;

(b)    publicly apologised at an early stage of these proceedings and conveyed a written apology to all affected customers; and

(c)    admitted liability in respect of the contraventions of s 72 of the Code at the commencement of these proceedings.

150    I accept, as Westpac submits, that an apology can be evidence of contrition, and that remediation can be relevant to the assessment of the appropriate penalty in a proceeding in some circumstances: Australian Competition and Consumer Commission v Dell Australia Pty Ltd (No 2) [2023] FCA 983 at [17] (Jackman J); Australian Securities and Investments Commission v National Australia Bank Ltd [2021] FCA 1013 at [99] (Davies J).

151    I accept also that Westpac has co-operated with ASIC and that it has apologised for its conduct, that it has accepted liability, and that it has undertaken remediation. All of these matters are evidence of its contrition. Westpac should therefore be given the benefit of some reduction in penalty for co-operation and contrition.

152    I do not accept, however, substantially for the reasons ASIC advances, that such reduction should be significant or that these factors make it appropriate in the circumstances for only a “modest” or moderate penalty to be ordered. First, as ASIC submits, it has taken into account Westpac’s co-operative conduct and contrition when proposing the penalty that it seeks in this proceeding. That is to say that ASIC’s proposed penalty of $30 million already accounts for Westpac’s extensive co-operation during the investigation, including its admissions of contravention, its apologies, and its remediation of affected customers.

153    Secondly, Westpac’s submissions about the significance of its remediation program must be tempered by the fact that there is subsisting harm that cannot be financially remediated, and also by the fact that in the context of ss 47 and 48 of the Credit Act Westpac had a statutory obligation to remediate the affected customers. As ASIC notes, those provisions require operators of a credit license to have adequate compensation arrangements to compensate customers for loss or damage suffered due to contraventions of the Credit Act: see ASIC v Westpac (Omnibus) at [123]; ASIC v Westpac Banking at [285]. ASIC notes also in this regard that Westpac’s co-operation in this proceeding is as much a reflection of obligations imposed on it as it is of a culture of compliance.

154    It is also relevant to observe that despite Westpac’s co-operation, and the evidence of contrition to which it draws attention, there are aspects of its submissions that might be said to attempt to minimise the severity and seriousness of the contraventions. This is evident, for example, in Westpac’s attempt to cavil with ASIC’s submissions on the basis that the number of affected customers was “extremely small”, that “it is unrealistic to expect … that an organisation such as Westpac could have identified some broader issue from 16 complaints”, that it is relevant that the systemic nature of the issues was difficult to identify, and that customers may have received hardship assistance from Westpac despite their online hardship notices not being received. Westpac also appears to maintain only that its conduct “could” undermine the purpose of the legislative regime that it has contravened. It must be said that some of these submissions have a certain tin-eared quality to them. In this regard, I am inclined to the view that Westpac continues to demonstrate a not altogether sufficient appreciation for the severity and impact of its conduct. While I do not criticise Westpac for making submissions in support of a lesser penalty, those submissions at times have not struck a tone of genuine contrition.

155    Further, as ASIC submits, any analysis of Westpac’s co-operation, its contrition, and indeed its culture of compliance, must be viewed in the context that the contraventions the subject of this proceeding occurred and were not addressed over a lengthy period of time during which Westpac was at some level on notice of the relevant problems and failures. Westpac’s post-contravention conduct cannot in this regard outweigh the failures that have occurred, and any inference which can be drawn as to Westpac’s compliance culture is necessarily limited: see ASIC v AMP at [136].

Investment in technology and risk of the conduct recurring

156    ASIC submits that Westpac’s systems failures were caused by ageing technology systems which were neither appropriate nor fit for purpose, and that there has been sustained underinvestment in these systems. ASIC draws the court’s attention to several reviews and audit reports that identify a limited investment by Westpac in its hardship and collections technology. These include certain reports referred to at paragraphs [110] to [115] of the SOAF.

157    ASIC emphasises once again that Westpac failed adequately to identify and investigate whether there was a systemic issue with its online hardship notice systems, processes and operations until 31 January 2022, despite complaints and incident reports being raised prior to this time. The failure to investigate whether there was a systemic issue over a period of several years reflects poorly on Westpac, including on its culture of compliance. It is not conduct that can be countenanced, particularly by a major bank.

158    Westpac submits that ASIC’s contention that Westpac has underinvested in technology should not be given material weight on the subject of penalty. It contends that this submission is a generalised criticism of Westpac’s business practices as a whole, and not specific to the hardship systems and processes which are the subject of this proceeding, and that there is no suggestion that Westpac’s conduct involved a cynical calculation in weighing up the cost of compliance against the risk of penalty of the kind identified in Singtel Optus at [62]–[63]. Westpac notes also that in May 2023 it approved funding for a technology transformation program to uplift and transform the technology used in its online hardship systems and process, including to consolidate them into a single end-to-end system. Westpac submits that as at the date of the proceeding, it had invested approximately $15 million in this regard. Westpac emphasises that it has decommissioned the legacy systems that led to the Systems and Operational Failures. I accept that all this is so.

159    Westpac further submits that ASIC seeks to justify a higher pecuniary penalty in this proceeding by relying on conduct which occurred prior to 13 March 2019, as well as investigation and technology issues outside the online hardship notices process. Westpac contends that submissions made by ASIC on these subjects ought to be given little weight because the court’s task is to “decide the appropriate penalty in respect of the contravening conduct” only: Reckitt at [37]; see also ASIC v AMP Financial Planning Pty Ltd (No 2) at [162] and relatedly, R v De Simoni [1981] HCA 31; 147 CLR 383 at 392 (Gibbs CJ).

160    It is correct that only conduct occurring after 13 March 2019 attracts the civil penalty provision. This must be kept front of mind, and I accept what Westpac says in this respect. However, ASIC submits that the court may rely on conduct prior to this period in order to provide relevant context and so that the court may consider the cause of the contravening conduct and the steps and time taken to identify the systemic issues: see, for example, ASIC v Westpac (Omnibus) at [409]–[412]; ASIC v AMP at [47]–[54]; Australian Securities and Investments Commission v AMP Superannuation Limited [2023] FCA 488; 168 ACSR 206 at [144] (Hespe J) (ASIC v AMP Superannuation Limited). I accept that this is also the position.

161    ASIC submits that there is no need to limit the court’s consideration of investigation and technology issues outside the online hardship notices process. ASIC contends that Westpac’s systems failures are intertwined with, and caused by, ageing technology systems which were not appropriate or fit for purpose and that these matters are directly relevant to the court’s consideration of deterrence and penalty. I accept ASIC’s submissions in this respect also.

162    Having regard to what has occurred, I also consider it relevant that the parties have agreed to certain compliance program orders being made in these proceedings to provide assurance that the new technology systems and processes instituted by Westpac for dealing with online hardship notices ensure compliance with s 72(4) of the Code. Westpac submits that contraventions of s 72(4) of the Code are significantly less likely to reoccur because of this program, and that this mitigates the need for specific deterrence. Without overlooking what has occurred, I accept that these measures make future contraventions in this dimension less likely.

Parity

163    Despite the well-known limitations of the parity principle in the context of civil penalty proceedings, both Westpac and ASIC submit that like authorities may offer some guidance to the court as to the appropriate penalty.

164    ASIC refers the court to a number of cases involving large financial institutions which it submits may assist in the court’s application of the parity and totality principles. These include:

(a)    the ASIC v Westpac (Omnibus) proceedings, where the court imposed penalties totalling $113 million across Westpac and its subsidiaries, including in one proceeding ordering an agreed penalty of $40 million against Westpac and related entities for contraventions involving the charging of thousands of deceased customers for financial advice services (with the penalty period restricted to four years): see at [293]–[331];

(b)    ASIC v AMP, where the court imposed a total penalty of $14.5 million against all respondents for contravening s 12DI(3) of the ASIC Act as well as making declarations that all respondents had breached their obligations under s 912A(1)(a) of the Corporations Act in circumstances where AMP had deducted plan service fees from 1,452 members’ superannuation accounts after they had ceased employment with their employment-sponsors and no longer had access to general advice services;

(c)    ASIC v AMP Superannuation Limited, where the court imposed a total penalty of $24 million on AMP Life Limited and AMP Financial Planning Pty Limited for contraventions of ss 12CB and 12DI(3) of the ASIC Act in respect of fees wrongly deducted from deceased members’ accounts; and

(d)    ASIC v CBA, where the court imposed a pecuniary penalty of $7 million in respect of contraventions of s 12DB(1)(g) of the ASIC Act for conduct related to a coding defect that resulted in the bank overcharging interest during a 3.25 year period, affecting 1,510 customers.

165    ASIC accepts that these cases can be distinguished from the present proceeding. ASIC submits that in the majority of the analogous proceedings the relevant period pre-dated the Strengthening Penalties Act reforms, which obviously constrained the court’s assessment on penalty. ASIC notes that the analogous cases did not concern separate and continuing contraventions (which it submits is the effect of s 175A on this proceeding) and any prior similar conduct was not considered a material aggravating factor. Further, ASIC submits, the non-monetary harm caused to affected customers in the present case is graver than in the analogous cases and, save for the ASIC v AMP proceeding, the remediated financial harm was higher than in the present case.

166    Westpac submits that the majority of the decisions ASIC refers to involve a significantly lower penalty than that proposed by ASIC. It refers in this regard to ASIC v AMP Superannuation Limited at [136]–[169]; ASIC v Westpac (Omnibus) at [162]–[173], [176]–[194], [355]–[399], [441]–[471], [534]–[560]; Australian Securities and Investments Commission v National Australia Bank Limited [2020] FCA 1494 at [123]–[162] (Lee J) (ASIC v National Australia Bank Limited); ASIC v AMP at [119]–[151]; ASIC v CBA at [23]–[41]; Membo Finance (No 2) at [80]–[113].

167    Westpac also draws the court’s attention to a number of other recent cases against financial institutions or involving contraventions of s 47 of the Credit Act and s 72(4) of the Code, or like provisions under the Corporations Act or the ASIC Act, where penalties in amounts of between $5 million and $12 million have been imposed: see Australian Securities and Investments Commission v MLC Limited [2023] FCA 539; 168 ACSR 122 (Moshinsky J) (ASIC v MLC Limited); Australian Securities and Investments Commission v OnePath Custodians Pty Ltd [2023] FCA 1485 (Stewart J) (ASIC v OnePath); Australian Securities and Investments Commission v RACQ Insurance Limited [2023] FCA 1503 (Downes J) (ASIC v RACQ Insurance); ASIC v Mercer; Australian Securities and Investments Commission v Australia and New Zealand Banking Group Limited [2023] FCA 1150; 169 ACSR 649 (Beach J) (ASIC v ANZ). Westpac draws attention also to Australian Securities and Investments Commission v Ferratum Australia Pty Ltd (in liq) (No 2) [2024] FCA 701 at [9]–[28] (Kennett J) (ASIC v Ferratum (No 2)) where a penalty of $16 million was imposed. While Westpac accepts that each of these cases is fact specific, it submits that they may provide guidance to the court on the appropriate penalty to be imposed in this proceeding.

168    Westpac submits also that the objective seriousness of its conduct in this proceeding falls well short of other cases concerning the provision of credit and financial services and in which penalties lower than that now sought by ASIC were ordered. It refers again in particular to: ASIC v OnePath, ASIC v MLC Limited, ASIC v RACQ Insurance, ASIC v Mercer, ASIC v ANZ and ASIC v Ferratum (No 2)). Westpac submits that the number of contraventions and impacted customers in the present case are distinguishable from cases involving thousands or even hundreds of thousands of customers. It refers in this regard to ASIC v Ferratum (No 2), ASIC v OnePath, ASIC v CBA, and ASIC v RACQ Insurance.

169    In addition, ASIC and Westpac each provided written supplementary submissions on the subject of parity following the court’s decision in ASIC v NAB. That proceeding concerned admitted contraventions of s 72(4) of the Code by the National Australia Bank (NAB) and its subsidiary AFSH Nominees Pty Ltd (ASFH). NAB was found to have contravened s 72(4) of the Code on 282 occasions, and AFSH was found to have contravened s 72(4) of the Code on 63 occasions. On the basis of agreed facts and joint submissions on liability and relief, Neskovcin J considered that the agreed pecuniary penalty of $13 million for NAB and $2.5 million for AFSH was just and appropriate: ASIC v NAB at [1]–[4].

170    Westpac submits that the court should take account of the agreed penalty in ASIC v NAB in the present case. It submits that in light of ASIC v NAB the court cannot impose the penalty amount sought by ASIC. In this regard, Westpac submits that there are material common elements between the two proceedings, including that in each case:

(a)    the banks admitted that they had contravened s 72(4) of the Code because they failed to provide a written response to hardship notices given by customers within the statutory timeframe prescribed by s 72(5) of the Code;

(b)    the contravening conduct was neither deliberate nor reckless;

(c)    senior management was not involved;

(d)    the contravening conduct occurred over several years;

(e)    the banks had rectified the causes of the contraventions;

(f)    the banks had implemented customer remediation programs and demonstrated contrition by the time of judgment;

(g)    the banks had co-operated with ASIC during its investigations and the proceedings; and

(h)    while there had been no previous contravention of the Code, both banks have been found to have contravened relevant consumer protection provisions.

171    ASIC accepts that there are factual similarities between ASIC v NAB and this proceeding. However, to the extent that ASIC v NAB might be said to provide some broad guidance, ASIC submits that there are a number of important distinctions that support a significantly higher penalty being appropriate in the present case. These are as follows.

(a)    First, in addition to the s 72(4) Code contraventions, ASIC points to the fact that this proceeding concerns Westpac’s admitted contraventions of s 47(1)(a) and (4) of the Credit Act resulting from Westpac’s online hardship systems, processes, and operations not being efficient, honest, or fair, at two different levels. Such contraventions, ASIC correctly notes, did not form part of ASIC v NAB. In the present proceeding, ASIC submits that the court ought to impose a separate pecuniary penalty of $10 million for the s 47 contraventions, reflecting the position that Westpac’s failure was systemic, and more serious, compared to NAB’s contravention.

(b)    Secondly, ASIC submits that in the present proceeding there are additional serious and aggravating factors, including that Westpac’s contravening conduct occurred in circumstances where, prior to its discovery and identification in January 2022, numerous internal incident reports had been lodged, and customer complaints made, about ignored online hardship applications. ASIC also submits that Westpac’s failure to investigate a possible systemic issue despite these complaints and internal reports reflects very poorly on Westpac’s culture and that the customer harm in this proceeding is more serious than that in ASIC v NAB where the parties agreed that there was “no ascertained loss suffered by customers as a result of the contraventions”: ASIC v NAB at [64].

(c)    Thirdly, ASIC submits that the cause of the contravening conduct is materially different in this proceeding because ASIC v NAB concerned human error, not defective online hardship and risk assessment systems. ASIC submits that these systems-related contraventions, caused by the apparent failure by Westpac to invest in appropriate technology, require a significantly higher penalty for deterrence purposes.

(d)    Fourthly, ASIC submits that the Systems and Operational Failures in this proceeding are broader and more complex than those considered in ASIC v NAB, which concerned a single type of failure. ASIC also draws the court’s attention to the fact that NAB and ASFH had implemented various controls prior to the commencement of that proceeding which had been audited, unlike the circumstances of the present proceeding: ASIC v NAB at [79].

(e)    Fifthly, ASIC submits that the duration of the contravening period in this proceeding is longer, being seven years as compared to the almost five-year contravening period in ASIC v NAB: ASIC v NAB at [3].

(f)    Sixthly, ASIC submits that the prior contravening conduct in ASIC v NAB was less analogous to the prior contravening conduct in this proceeding.

(g)    Lastly, ASIC submits that contrary to the present case the fact that penalty and liability were agreed at the earliest opportunity in ASIC v NAB entitled NAB to a larger discount on penalty because it freed up the regulator’s resources to deal with its other enforcement activities. ASIC submits that where an agreed penalty is imposed in another case particular caution must be exercised in treating that penalty as providing a comparable benchmark. This is because the parties have considerable scope to agree upon the facts, the consequences, and the appropriate remedy, and that there are important public policy reasons to accept the views of the regulator and the parties in reaching an agreed penalty, especially given that there is a permissible range of penalties within which no particular figure is more appropriate than another: Agreed Penalties Case at [46], [57] (French CJ, Kiefel, Bell, Nettle and Gordon JJ) and [109] (Keane J); Volkswagen Aktiengesellschaft v Australian Competition and Consumer Commission [2021] FCAFC 49; 284 FCR 24 at [127]–[128] (Wigney, Beach and O'Bryan JJ).

172    Obviously there is an important public policy involved in promoting predictability of outcome in civil penalty proceedings: Agreed Penalties Case at [46]. However, even though similar contraventions should incur similar penalties, a penalty in one case cannot dictate the penalty in a later case: Singtel Optus at [60]; Flight Centre Limited v Australian Competition and Consumer Commission (No 2) [2018] FCAFC 53; 260 FCR 68 at [69] (Allsop CJ, Davies and Wigney JJ); NW Frozen Foods at 295–296 (Burchett and Kiefel JJ, Carr J agreeing).

173    Ultimately, as I observed in ASIC v Mercer at [69], each case must turn on its own facts, and the court is not generally assisted by a comparison of penalties imposed in other cases. It is for this reason that Westpac’s rather detailed submissions about other penalties ordered in respect of conduct in financial services cases are of little real assistance. This is especially so when seeking to compare a proceeding where there is no agreed penalty to one where there has been an agreed penalty, which is most likely the result of compromise and pragmatism on the part of the regulator. In any event, I accept ASIC’s characterisation of the differences between the circumstances in ASIC v NAB and the present case. In my assessment, for substantially the reasons I have outlined, Westpac’s conduct is more serious and extensive, it caused harm, some of which is irreparable, and it warrants deterrence at a higher level. I accept ASIC’s submission that even allowing for the similarities between the two cases, the important differences favour a significantly higher pecuniary penalty in this case.

Course of conduct and totality principles

174    Westpac’s position is that it is entitled to a reduction in the total pecuniary penalty due to the application of the course of conduct principle. Westpac submits that its contraventions of s 47 of the Credit Act are substantively and qualitatively the same conduct and therefore should be treated as a single contravention. Westpac contends that to treat its contraventions of s 47 as any more than one contravention is inconsistent with treatment of like contraventions in similar cases where, it submits, attempts by ASIC to divide contraventions into various sub-categories has been rejected: referring to Membo Finance (No 2) at [112]; ASIC v Ferratum (No 2) at [7]; ASIC v National Australia Bank Limited at [112].

175    Westpac submits further that there is “substantial, if not complete” overlap between the contraventions of the general obligation to perform licensed work efficiently, honestly and fairly under s 47(1)(a) of the Credit Act and the contraventions of s 72 of the Code, such that the penalty should take this into account to avoid the double punishment rule under s 175 of the Credit Act: Membo Finance (No 2) at [112]; ASIC v Ferratum (No 2) at [30].

176    ASIC disputes Westpac’s characterisation of the contravening conduct, and submits that the admitted contraventions of s 47(1)(a) and (4) of the Credit Act amount to two separate contraventions because they address two distinct levels of systems and processes. These concern, separately:

(a)    the actual online hardship systems, controls and processes which administered Westpac’s response to customer hardship requests; and

(b)    a separate and distinct tier of systems and processes being Westpac’s risk review, monitoring and risk management processes.

177    ASIC submits that Membo Finance (No 2), ASIC v Ferratum, and ASIC v National Australia Bank Limited, properly understood, do not undermine what it suggests is the distinct and separate nature of the contraventions of s 47 of the Credit Act.

178    ASIC submits further that the conduct amounting to each contravention pursuant to s 47 of the Credit Act is separate from the conduct which amounts to a contravention of s 72 of the Code. It maintains that the four System Failures and three Operational Failures could, at a high level of abstraction, be construed as being seven courses of conduct. However, ASIC accepts that such an approach would distract attention from the conduct amounting to each contravention under s 47(1)(a) of the Credit Act and s 72(4) of the Code.

179    ASIC’s position ultimately is that application of the course of conduct principle is of little assistance in this proceeding, and that the preferable approach is to have regard to the nature, extent and circumstances of the contravening conduct, then to apply the totality principle to ensure that the total aggregate penalty is just and proportionate and that there is no double punishment: see ASIC v AMP at [122]; ASIC v AMP Superannuation Limited at [142]; ASIC v Mercer at [137]–[138]. For the reasons that follow, I accept ASIC’s submission that this is the preferable approach.

180    Section 175 of the Credit Act provides that if a person is ordered to pay a pecuniary penalty under a civil penalty provision in relation to particular conduct, the person is not liable to be ordered to pay a pecuniary penalty under some other provision of a law of the Commonwealth in relation to that conduct.

181    In Australian Securities and Investments Commission v Commonwealth Bank of Australia [2020] FCA 1543, Murphy J relevantly observed at [67]:

The “particular conduct” to which s 175 refers is the constituent acts or omissions that a wrongdoer has committed – that is what the wrongdoer actually did. It refers to the constituent physical acts or omissions and does not include “any necessary elements of character or circumstance that, when added to those acts or omissions, constitute the particular contravention”. So much is made clear in CFMMEU v ABCC at [17] – [26].

182    ASIC submits, and I accept, that s 72 of the Code and s 47(1)(a) of the Credit Act concern different conduct. Westpac admits that it failed to give a written decision notice at least on 223 occasions thereby contravening s 72 of the Code. Westpac has separately contravened s 47(1)(a) of the Credit Act as it has not engaged in conduct efficiently, honestly and fairly because of inadequacies in its systems and processes.

183    It follows, as ASIC submits, that s 175 does not apply in the circumstances of this case. The court may order declaratory relief and impose civil penalties in respect of each of the s 72 contraventions and the s 47 contraventions.

184    Where there are numerous contraventions arising from separate acts, the starting point is that each contravention should ordinarily attract the imposition of a separate penalty: see ACCC v Yazaki at [227]. To avoid double punishment, however, it is also appropriate to consider whether the contravening conduct should be considered as a single “course of conduct” due to the interrelationship between the legal and factual elements of multiple contraventions: Construction, Forestry, Mining and Energy Union v Cahill [2010] FCAFC 39; 269 ALR 1 at [39], [41]–[42] (Middleton and Gordon JJ).

185    As ASIC submits, in cases such as this, which involve a very large number of contraventions, the courts have been reluctant to make precise findings about numbers of contraventions, or to rely on the maximum aggregate penalty by reference to that number: see ASIC v AMP at [122]; ASIC v AMP Superannuation Limited at [142]; ASIC v Mercer at [138].

186    In all the circumstances I do not consider that Westpac is entitled to a reduction in the total pecuniary penalty due to the application of the course of conduct principle. As Moshinsky J observed in ASIC v AMP at [122], and as ASIC submits, the preferred approach is to have regard to the nature and extent, and the circumstances, of the contravening conduct, including its common features, rather than determining whether the conduct constitutes a single “course of conduct”. It is for this reason that Westpac should not have any reduction in penalty on the basis that it engaged in a single course of conduct. Westpac’s conduct involved failures to provide written decision notices in response to hardship notices within the statutory timeframes or at all, and related but separate failures to implement, maintain and monitor the relevant systems, investigate the failures in those systems, and maintain adequate risk management procedures.

187    Nevertheless, I have given careful consideration to the totality principle in determining the appropriate penalty to be imposed against Westpac to ensure that it is just and proportionate to the contravening conduct, considered as a whole.

Conclusion as to the appropriate pecuniary penalty

188    As will be apparent from the above consideration, I accept that Westpac’s contraventions in this case were very serious. They were more serious than those which were the subject of the court’s attention in ASIC v NAB. They impacted many vulnerable customers and continued over an extended period. It may in fact be said that the circumstances faced by the affected customers means that their financial vulnerability cannot be overstated. As is apparent from the Banking Code of Practice, they were the very customers that the hardship provisions of the legislative scheme are designed to protect. Westpac’s conduct significantly undermined the legislative scheme.

189    While the contraventions were not suggested to be deliberate and arose instead from inadequate systems and operational failures, I have accepted that they were grossly negligent. ASIC submits, and I accept, that Westpac’s delay in identifying and correcting these known issues warrants a significant pecuniary penalty for deterrence purposes. This is an aspect of matters which makes Westpac’s conduct particularly serious. The penalty arrived at must be sufficiently high to deter Westpac repeating the contravening conduct, and to deter other large credit providers who may be at risk of engaging in similar conduct. This is especially so in the context of Westpac’s previous contraventions of civil penalty provisions with respect to similar systems failures and errors in the context of the provision of financial services.

190    A particularly serious aspect of Westpac’s contraventions is that they caused a number of customers to have adverse credit information recorded on their credit files, and debts to be sold to third-party debt purchasers who then engaged actively in conduct to pursue those debts. These circumstances add an additional layer of harm, and significance, to Westpac’s conduct. In my assessment the fact that the affected customers were not only denied assistance by Westpac when that assistance was legitimately sought, but that further irreparable harm was caused, makes the contraventions particularly egregious.

191    I am satisfied also that there are several other circumstances that justify a significant penalty. Westpac’s size, the level of its profits and its market position are relevant to a consideration of what may be considered as an acceptable cost of doing business.

192    I accept, however, that there are some mitigating factors which must result in a somewhat lower penalty than is sought by ASIC. I have accepted that Westpac has taken steps to invest in and improve its systems and processes for online hardship notices, including decommissioning the legacy systems involved in the systems and operational failures in question. I also consider that, despite ASIC having had regard to Westpac’s contrition and co-operation in reaching the penalty amount that it considers appropriate, Westpac is entitled to at least some further reduction on that basis. I have also noted that Westpac has completed a comprehensive remediation of affected customers, and that remediation has included compensation to the extent possible for non-financial loss, and that despite the number of Westpac’s contraventions, and the length of the Relevant Period, Westpac investigated and promptly took steps to address the Systems and Operational Failures when they were identified in 2022.

193    It is also a factor in my determination of the appropriate penalty to be ordered that ASIC has accepted that Westpac has not profited from the contraventions inadvertently or otherwise, and that ASIC has withdrawn its submission to this effect. I have accepted that the penalty sought by ASIC must necessarily be reduced in order to reflect this.

194    In weighing all these matters, and endeavouring to balance the need for specific and general deterrence with the importance of ensuring that the amount of the pecuniary penalty is not so high as to be oppressive, I have concluded that a pecuniary penalty of $30 million as proposed by ASIC would be somewhat more than would be required to achieve the necessary deterrent effect in this case, and may therefore be said to be inappropriate. However, a pecuniary penalty of $10 million as proposed by Westpac would be little more than derisory in the circumstances and therefore wholly inappropriate.

195    Having regard to all of the circumstances I have determined that a pecuniary penalty of $26 million is appropriate and proportionate. I have reached this conclusion primarily due to the serious and extensive nature of Westpac’s conduct as one of the four major banks; the gross negligence which that conduct demonstrated; the significant harm that has been caused, some of it irreparable; Westpac’s ongoing history of systems failures; and the fact that there were opportunities to avoid the continuing nature of the contraventions when the problem first surfaced which were not taken. In Westpac’s favour I have had regard to the fact that Westpac did not profit from the contraventions and has remediated customers to the extent possible; that cooperation and contrition which it has demonstrated; and the fact that Westpac has taken steps to avoid conduct of this kind happening again. Bearing in mind the principle of totality I consider that pecuniary penalty of $26 million would be just and proportionate to the contravening conduct considered as a whole.

ANCILLARY ORDERS

196    ASIC has sought and Westpac has agreed that the orders to be made include an adverse publicity order that requires Westpac to publish a written adverse publicity notice on its website and the websites of the Other Westpac Brands.

197    Pursuant to s 182 of the Credit Act, the court may make adverse publicity orders against a person who has contravened a civil penalty provision of the Act. An “adverse publicity order” is defined in s 182(2) of that Act. The purpose of such a notice is both punitive and protective, in the sense of dispelling incorrect or false impressions and/or alerting consumers to the fact of contravening conduct: Australian Securities and Investments Commission v Commonwealth Bank of Australia (No 2) [2021] FCA 966 at [7]–[17] (Lee J).

198    The parties have agreed to the terms of this order and the method of publication. I am satisfied that in the circumstances the proposed adverse publicity order is appropriate to alert the broader public and customers of Westpac and of the Other Westpac Brands to the fact of the contravening conduct.

199    ASIC also seeks, and Westpac consents, to certain orders regarding the implementation of a compliance program.

200    Section 177 of the Credit Act provides the court with a power to grant an injunction on such terms it considers appropriate where it is satisfied that a person has engaged or is proposing to engage in conduct that constitutes or would constitute a contravention of the Act.

201    As ASIC submits, the compliance orders have a sufficient connection to Westpac’s contravening conduct and are sufficiently clear, unambiguous and capable of compliance. Further, in circumstances where Westpac has announced that it will commence a technological simplification update, I accept that the orders are necessary and will ensure the appointment of an independent expert to report to ASIC on the changes to Westpac’s systems, operations and processes and their compliance with s 72(4) and (5) of the Code, as well as to make recommendations to bring those systems, process and operations into a state of compliance.

202    Given that the compliance program orders sought by ASIC are agreed to by Westpac, and they appear to be suitable, I consider it is appropriate that the orders be made in the terms proposed.

COSTS

203    The parties have agreed that Westpac should pay ASIC’s costs of and incidental to this proceeding, to be agreed or assessed. There will therefore be a costs order in the terms proposed.

Associate:

Dated:    26 May 2026

ANNEXURES

Annexure A – Statement of Agreed Facts