1. Executive summary
In Australian Securities and Investments Commission v National Australia Bank [2025] FCA 947, Neskovcin J imposed total pecuniary penalties of $15.5 million on National Australia Bank Limited and its wholly owned subsidiary, AFSH Nominees Pty Ltd, for failing to provide customers with written responses to financial hardship notices within the statutory timeframe required by s 72 of the National Credit Code. NAB was ordered to pay $13 million and AFSH $2.5 million.
Between November 2018 and October 2023:
- NAB failed to respond on time to 282 hardship notices;
- AFSH failed to respond on time to 63 hardship notices;
- for notices received on or after 13 March 2019, the failures continued as daily contraventions until a compliant response was given; and
- those continuing failures produced a further 353,910 contraventions for NAB and 61,297 for AFSH up to 10 February 2025.
The failures arose principally because NAB staff incorrectly used a function in the bank’s PowerCurve hardship-management system. That action removed customer accounts from the hardship workflow, preventing the required written response from being generated. The Court accepted that the contraventions were not deliberate, but regarded their number, duration and impact on financially vulnerable customers as serious.
The judgment is significant because it confirms that:
- hardship-response obligations are strict, operational and time-critical;
- an unintended systems or workflow failure can generate hundreds of thousands of continuing contraventions;
- failures affecting customers in financial difficulty are inherently serious even where quantified financial loss is not established;
- credit providers must monitor whether hardship cases exit automated workflows without a compliant outcome;
- prior consumer-protection contraventions involving ineffective systems may materially increase penalty exposure;
- remediation and cooperation reduce, but do not eliminate, the need for substantial deterrence; and
- adverse publicity orders may require both public website publication and direct communication with affected customers.
2. Citation and context
Case: Australian Securities and Investments Commission v National Australia Bank
Neutral citation: [2025] FCA 947
Court: Federal Court of Australia
Judge: Neskovcin J
Judgment date: 13 August 2025
Hearing date: 13 June 2025
Proceeding: VID 1253 of 2024
Registry: Victoria
Nature of decision: Agreed declarations, pecuniary penalties, adverse publicity and costs following admitted contraventions of the National Credit Code.
ASIC commenced the proceeding under ss 166 and 167 of the National Consumer Credit Protection Act 2009 (Cth). NAB and AFSH admitted the contraventions and jointly proposed the declarations, penalties and other relief. The Court independently considered the proposed orders and found them appropriate.
3. Statutory framework
Section 72 of the National Credit Code establishes a formal process for debtors experiencing, or expecting to experience, difficulty meeting their obligations under a credit contract.
Where a debtor gives a hardship notice, the credit provider must provide a written response within the timeframe prescribed by s 72(5). Depending on the circumstances, the response must either:
- state whether the credit provider agrees to change the credit contract; or
- explain why the credit provider does not agree and provide information about the debtor’s rights, including access to external dispute resolution.
The Court described the hardship-notice regime as an important formal consumer-protection mechanism for people experiencing financial difficulty: at [60].
For contraventions occurring after 13 March 2019, s 175A of the Credit Act operated so that a failure to comply continued as a separate contravention on each day until the required response was provided.
4. The respondents and the hardship process
NAB is a major Australian bank. AFSH is part of the NAB Group and provides credit products under the Advantedge brand. Both respondents held Australian credit licences. NAB managed the hardship process for both entities through its NAB Assist function.
Since approximately 2016, NAB Assist has used the PowerCurve system to manage hardship notices. Staff used activities within PowerCurve to approve, decline or otherwise process hardship applications.
The contraventions arose principally from staff incorrectly selecting a “reject hardship request” activity. Except in six NAB cases, the circumstances did not fall within the intended uses of that activity. Selecting it removed the customer’s account from the hardship workflow, resulting in no compliant written response being sent.
5. Identification of the problem
ASIC began examining credit providers’ hardship policies, procedures and data in approximately April 2023. In responding to ASIC’s requests, NAB identified instances in which hardship notices had not received a written response within the required period.
NAB submitted a breach report to ASIC on 11 October 2023. In October 2024, it provided data indicating that the relevant system function had been used incorrectly on 746 occasions between October 2016 and October 2023. That represented approximately 6% of the 12,600 rejected hardship notices reviewed by NAB.
Not all 746 instances formed part of the Court’s declarations. The proceeding concerned the 282 NAB and 63 AFSH hardship notices specified in the orders.
6. Contraventions
| Respondent | Provision | Obligation | Conduct | Finding |
|---|---|---|---|---|
| NAB | National Credit Code, s 72(4) | Give a compliant written response to a hardship notice within the period prescribed by s 72(5) | Failed to respond on time to hardship notices between 16 November 2018 and 14 October 2023 | 282 initial contraventions |
| NAB | Credit Act, s 175A | Continuing contravention for each day non-compliance persists | Continued not to provide responses for 262 notices received on or after 13 March 2019 | 353,910 further contraventions to 10 February 2025 |
| AFSH | National Credit Code, s 72(4) | Give a compliant written response to a hardship notice within the period prescribed by s 72(5) | Failed to respond on time to hardship notices between 9 January 2019 and 20 September 2023 | 63 initial contraventions |
| AFSH | Credit Act, s 175A | Continuing contravention for each day non-compliance persists | Continued not to provide responses for 58 notices received on or after 13 March 2019 | 61,297 further contraventions to 10 February 2025 |
The Court’s declarations recorded both the initial failures and the statutory daily continuation of those failures.
7. Nature and seriousness of the conduct
The Court regarded the number of contraventions as high and indicative of the significant scope and seriousness of the conduct: at [61].
The affected customers had submitted notices indicating that they considered themselves unable, or likely to become unable, to meet their credit obligations. It was therefore reasonable to infer that they were experiencing financial difficulty when the failures occurred: at [62] and [64].
The lack of a written response meant affected customers were not informed:
- whether the proposed hardship change had been accepted;
- why assistance had been refused;
- what further information was required;
- what alternative options might be available; or
- that they could take the matter to the Australian Financial Complaints Authority.
The Court accepted that no specific customer loss had been ascertained. However, the absence of quantified loss did not remove the potential for significant distress, uncertainty and loss of access to dispute-resolution rights: at [64]–[65].
8. Deliberateness and systems failure
NAB and AFSH did not deliberately contravene the Code. The immediate cause was the incorrect use of an internal system function by NAB staff: at [66]–[67].
That absence of deliberateness was mitigating, but it did not avoid serious liability. The judgment demonstrates that a large financial institution remains responsible where:
- system design permits a case to leave a regulated workflow without a compliant outcome;
- staff misunderstand the effect of a system action;
- exception reporting does not identify incomplete cases;
- quality assurance does not detect missing response notices; or
- management information records an application as closed despite an unmet statutory step.
The central governance issue was not merely employee error. It was that the control environment allowed an incorrect action to suppress the statutory response without triggering a timely alert or correction.
9. Continuing contraventions
The operation of s 175A materially increased the contravention count and potential penalty exposure.
For hardship notices received on or after 13 March 2019, the failure did not end upon the statutory response period’s expiration. A new contravention arose on each subsequent day until a compliant response was sent.
This resulted in:
| Respondent | Relevant notices | Further daily contraventions |
|---|---|---|
| NAB | 262 | 353,910 |
| AFSH | 58 | 61,297 |
| Total | 320 | 415,207 |
Some responses remained outstanding for several years. The schedules to the orders include examples extending beyond 1,500 or 2,000 days.
The operational implication is that aged unresolved breaches must be treated as an expanding liability, not a static historical incident.
10. Prior contraventions and compliance history
The Court considered NAB’s previous consumer-protection contraventions relevant to specific deterrence.
Those matters included previous findings involving:
- charging fees without entitlement;
- failures in ongoing-service fee systems;
- unconscionable conduct; and
- inadequate systems for identifying whether services had been provided or fees could lawfully be charged.
The Court observed that “similar conduct” was not confined to contraventions of the same statutory provision. The relevant similarity was that both the earlier matters and the present case involved consumer-protection failures arising from ineffective systems.
This is important for regulated institutions. Repeated deficiencies in different products or legal obligations may be treated as part of a broader systems-governance history.
11. Penalty principles
The Court applied established civil penalty principles, including that deterrence is the primary purpose of a pecuniary penalty.
Relevant considerations included:
- the nature and extent of the conduct;
- the number and duration of contraventions;
- the circumstances in which they occurred;
- whether the conduct was deliberate;
- involvement of senior management;
- previous similar contraventions;
- financial capacity;
- cooperation and admissions;
- remediation; and
- the need to ensure the penalty was not treated as an acceptable cost of doing business.
The parties calculated very large theoretical maximum penalties, including maximum amounts ranging from $525 million to $825 million for relevant periods after March 2019. The Court treated those figures with caution but regarded the scale of the potential maximums and the large number of contraventions as confirming the seriousness of the conduct.
12. Financial capacity and deterrence
NAB’s size and financial resources were material. The total proposed penalty of $15.5 million represented approximately 0.22% of NAB’s net profit for the 2024 financial year: at [77].
The Court considered that a significant penalty was necessary so that NAB and similarly sized credit providers would not regard non-compliance as an acceptable cost of business. It also emphasised general deterrence because s 72 applies broadly to banks and other credit providers.
The agreed allocation reflected both the proportion of affected notices and NAB’s central role in administering the hardship process:
- NAB: $13 million;
- AFSH: $2.5 million.
Approximately 82% of the hardship notices concerned NAB customers, and NAB handled the hardship process for both respondents.
13. Corrective measures and remediation
NAB and AFSH implemented corrective controls in September and October 2023, before ASIC commenced the proceeding. NAB subsequently conducted internal audit testing and concluded that the controls were effective: at [79].
The respondents also:
- provided affected customers with responses;
- conducted a remediation program;
- made remediation payments in appropriate cases;
- corrected repayment-history information for some customers;
- investigated the misuse of the system function;
- cooperated with ASIC;
- admitted the contraventions; and
- agreed to the proposed relief.
The judgment does not provide a complete quantified account of all remediation payments or customer outcomes. Those matters should not be inferred beyond the agreed facts and the adverse publicity notice.
14. Penalties imposed
| Respondent | Contraventions | Penalty |
|---|---|---|
| National Australia Bank Limited | Initial and continuing s 72(4) contraventions | $13 million |
| AFSH Nominees Pty Ltd | Initial and continuing s 72(4) contraventions | $2.5 million |
| Total | $15.5 million |
The Court found the jointly proposed penalty just and appropriate having regard to the seriousness of the conduct, the respondents’ financial capacity, remediation and the requirements of specific and general deterrence: at [86]–[87].
15. Adverse publicity order
NAB and AFSH were ordered to publish a written adverse publicity notice:
- on NAB’s main website;
- on NAB’s news website;
- on the Advantedge website;
- as a landing-page tile headed “Adverse publicity order”;
- for at least 90 days; and
- by direct email or post to each affected customer.
The Court explained that adverse publicity orders serve punitive and protective purposes. They alert customers and the public to contravening conduct and help dispel incomplete or incorrect impressions: at [89]–[92].
Direct notification was particularly appropriate because it increased the likelihood that affected hardship customers would become aware of the contraventions.
16. Orders and remedies
| Order or remedy | Legal basis | Amount or scope |
|---|---|---|
| Declarations | s 166(2), Credit Act | Failures to respond to 282 NAB and 63 AFSH hardship notices, including continuing daily contraventions |
| Pecuniary penalty — NAB | s 167(2), Credit Act | $13 million |
| Pecuniary penalty — AFSH | s 167(2), Credit Act | $2.5 million |
| Adverse publicity | s 182(1), Credit Act | Website publication for at least 90 days and direct communication to affected customers |
| Costs | s 43, Federal Court of Australia Act 1976 (Cth) | Respondents to pay ASIC’s costs as agreed or assessed |
17. Broader significance for credit providers
The decision establishes a substantial penalty benchmark for failures to comply with hardship-response obligations.
It confirms that hardship management must be designed as an end-to-end regulated process. A credit provider should be able to demonstrate that:
- every hardship notice is identified and recorded;
- statutory deadlines are calculated accurately;
- no matter can be closed without an approved outcome;
- written notices are generated and successfully sent;
- exceptions are reported promptly;
- aged cases are escalated;
- records demonstrate compliance; and
- responsible managers receive reliable information about overdue responses.
The decision also highlights the disproportionate risk created by continuing contravention provisions. A small number of unresolved matters can accumulate into hundreds of thousands of statutory breaches where failures persist for years.
18. Relevance for boards and responsible managers
Boards and responsible managers should treat hardship administration as a core customer-outcomes and operational-risk function.
Relevant governance questions include:
- Can the organisation reconcile all hardship notices received against written responses sent?
- Can a staff member remove a case from a regulated workflow without an independent check?
- Are response notices tested for successful generation and delivery?
- Does management reporting distinguish closed cases from lawfully completed cases?
- Are unresolved matters automatically escalated before the statutory deadline?
- Are daily continuing contraventions quantified and reported?
- Are credit-reporting consequences identified and corrected?
- Are affected vulnerable customers prioritised in remediation?
The case demonstrates that aggregate workflow statistics may conceal serious customer-level failures. An overall error rate of approximately 6% within rejected hardship cases was sufficient to produce extensive contraventions over several years.
19. Recommended controls
| Audience | Control type | Legal rationale | Risk indicator | Practical control |
|---|---|---|---|---|
| Board risk committee | Governance | Hardship notices engage mandatory consumer protections | Large or growing hardship volumes | Receive regular reporting on timeliness, exceptions and remediation |
| Credit operations | Preventative | s 72 requires a written response within a statutory period | Manual workflow actions | Restrict closure functions and require reason-coded approvals |
| Technology | Preventative | System actions must not suppress statutory outputs | Case removed from workflow | Build mandatory notice-generation gates |
| Compliance | Detective | Continuing contraventions accumulate daily | Overdue or closed-without-response cases | Run daily reconciliation and exception reporting |
| Quality assurance | Detective | Staff error may have systemic consequences | Repeated use of unusual activity codes | Conduct targeted sampling and root-cause analysis |
| Training | Preventative | Staff must understand legal consequences of system actions | Incorrect rejection or withdrawal coding | Deliver role-specific hardship and system training |
| Responsible managers | Governance | Compliance requires end-to-end oversight | Management does not understand frontline workflow | Conduct periodic process walkthroughs |
| Customer remediation | Corrective | Failures may affect vulnerable customers and credit reporting | Long-outstanding hardship notices | Prioritise responses, payments and data correction |
| Breach reporting | Corrective | Systemic or significant failures may be reportable | Repeated missed statutory deadlines | Escalate promptly under a documented assessment framework |
| Internal audit | Detective | New controls require independent assurance | Management relies on self-certification | Test completeness, effectiveness and sustainability |
20. Recommended next steps
Credit providers should:
- reconcile hardship notices received against response notices issued;
- identify every workflow status capable of removing a case before statutory completion;
- review historic closed, rejected and withdrawn hardship cases;
- quantify any continuing contraventions by day;
- test whether customers received legally compliant notices;
- assess repayment-history and credit-reporting consequences;
- prioritise remediation for customers experiencing ongoing vulnerability;
- introduce automated deadline and exception reporting;
- require board or executive oversight of material hardship-control failures; and
- commission independent assurance over the complete hardship process.
21. Referenced cases
Australian Building and Construction Commissioner v Pattinson (2022) 274 CLR 450; [2022] HCA 13 — deterrence as the primary purpose of civil penalties.
Commonwealth v Director, Fair Work Building Industry Inspectorate (2015) 258 CLR 482; [2015] HCA 46 — judicial assessment of agreed civil penalties.
Australian Securities and Investments Commission v Membo Finance Pty Ltd (No 2) [2023] FCA 126 — hardship notices as an important consumer-protection mechanism — cited at [60].
Australian Securities and Investments Commission v National Australia Bank Limited (No 2) [2023] FCA 1118 — prior consumer-protection contraventions arising from ineffective systems — discussed at [71]–[73].
Australian Securities and Investments Commission v Aware Financial Services Australia Ltd [2022] FCA 146 — protective and punitive purposes of adverse publicity orders — cited at [90].
22. Broader impact
The judgment reinforces that hardship obligations are core consumer-protection duties requiring reliable, end-to-end operational controls. Credit providers cannot treat missed responses as isolated staff errors where system design, workflow permissions or exception reporting allow hardship cases to close without a compliant written outcome. Boards and responsible managers should require customer-level reconciliation between hardship notices received and responses actually issued.
The decision also demonstrates the compounding risk of continuing contraventions. A relatively limited number of unresolved hardship matters generated more than 415,000 additional daily contraventions, substantially increasing penalty exposure. Institutions should therefore treat aged statutory breaches as expanding liabilities requiring immediate escalation, remediation and assessment of associated credit-reporting or dispute-resolution impacts.
More broadly, the $15.5 million penalty confirms that serious sanctions may follow even where misconduct was not deliberate and specific financial loss cannot be quantified. Failures affecting customers in financial difficulty are inherently serious because they create uncertainty, delay access to assistance, and may prevent customers from understanding their review and external dispute resolution rights. Prior systems-based consumer protection failures may also aggravate penalties across different products and legislative obligations.
This analysis is suitable for internal legal and compliance review, but final positions should be confirmed against the complete judgment, current legislation and any subsequent appellate or regulatory developments.