1. Executive Summary
In Australian Securities and Investments Commission v Westpac Banking Corporation [2026] FCA 651, McEvoy J imposed a $26 million pecuniary penalty on Westpac for failures in its systems and processes for receiving and responding to online financial hardship notices.
The conduct affected customers of Westpac and its St George, BankSA and Bank of Melbourne brands. Between 2 October 2015 and 7 June 2023, at least 1,013 online hardship applications submitted by 1,003 customers were not properly transferred, received or processed. Westpac failed to give a legally required written decision notice within time, or at all, in response to 277 hardship notices.
The Court declared that Westpac contravened:
- s 72(4) of the National Credit Code, by failing to provide written decisions on hardship notices within the prescribed timeframe or at all; and
- ss 47(1)(a) and 47(4) of the National Consumer Credit Protection Act 2009 (Cth), by failing to do all things necessary to ensure its licensed credit activities were engaged in efficiently, honestly and fairly.
Westpac’s failures arose from four system failures and three operational failures involving data transfers, configuration errors, invalid account-number handling, data formatting and inadequate processing controls. It also failed to conduct adequate monitoring, risk reviews and investigations capable of detecting whether customers’ hardship requests were reaching the responsible team.
McEvoy J described the conduct as grossly negligent. Customer complaints and internal incident reports had raised warning signs years before Westpac properly investigated the systemic problem in January 2022. The Court found it wholly unsatisfactory that senior management had remained unaware of the issue.
The consequences were particularly serious because the affected people were customers already experiencing financial distress. Some were subjected to premature enforcement action, adverse credit reporting or debt sales to third-party purchasers. The Court accepted that some harm was irreparable and life-changing.
In addition to the penalty, Westpac was ordered to:
- publish an adverse publicity notice for at least 90 days;
- implement adequate system, operational and process changes within one month;
- appoint an independent expert to assess implementation and report to ASIC; and
- pay ASIC’s costs.
The principal governance lesson is that financial hardship administration is a critical consumer-protection control. A lender must be able to demonstrate not only that it has hardship policies, but that every notice is captured, transferred, assessed, responded to and protected from enforcement action within the statutory timeframe.
2. Citation and Context
Case: Australian Securities and Investments Commission v Westpac Banking Corporation
Neutral citation: [2026] FCA 651
Court: Federal Court of Australia
Judge: McEvoy J
Date: 26 May 2026
File: VID 695 of 2023
Hearing date: 26 May 2025
Procedural posture: Agreed facts and substantial admissions, with disputes concerning the scope of declarations and appropriate penalty.
The relevant period extended from 2 October 2015 to 7 June 2023. The civil penalty period agreed by the parties was 4 September 2017 to 8 May 2023.
Westpac’s online hardship process applied across Westpac, St George, BankSA and Bank of Melbourne, all operating under Westpac’s Australian credit licence.
3. Statutory Framework
Hardship notices
Section 72 of the National Credit Code applies where a debtor gives a credit provider notice that they are or will be unable to meet their obligations under a credit contract.
The credit provider must consider whether to agree to change the credit contract and provide a written notice of its decision within the prescribed timeframe. Westpac’s own policies generally required a response within 21 days where no further information was required.
The written decision also protects the customer from premature enforcement. Westpac’s policies recognised that enforcement action should not occur until the customer had received the written decision and the applicable statutory period had elapsed.
Continuing contraventions
The Court held that, under s 175A of the Credit Act, Westpac remained under a continuing obligation to provide a written decision for relevant pre-4 September 2017 notices. It committed a separate contravention on each day after 13 March 2019 that the failure continued.
Efficiently, honestly and fairly
Section 47(1)(a) requires a credit licensee to do all things necessary to ensure that authorised credit activities are engaged in efficiently, honestly and fairly.
McEvoy J adopted the established view that the expression is a compendious standard involving competence, fairness, sound ethical judgement and reasonable performance. Dishonesty in the criminal sense is unnecessary, and the standard can be breached unintentionally. The obligation is forward-looking and requires systems capable of preventing operational lapses.
4. Westpac’s Hardship Process
Customers could submit online hardship notices through the websites of Westpac and its other banking brands.
The intended process was:
- the customer completed an online form;
- the form entered the “OneClick” system;
- the data transferred through other automated systems;
- the notice reached the Customer Assist team; and
- the team assessed the request and issued a written decision.
The process failed at multiple points. Some notices were never transferred to the Customer Assist team, while others were not processed properly or at all.
Westpac admitted four principal system failures:
- network and batching errors affecting transfers from OneClick to a central drive;
- configuration errors affecting further transfer into another processing system;
- failure to process forms containing invalid account numbers; and
- data-formatting problems that prevented applications from loading into collection systems.
The Court’s declarations also addressed operational failures and inadequate higher-level risk monitoring, investigation and assurance.
5. Contraventions
| Legislation | Provision | Obligation | Conduct | Finding |
|---|---|---|---|---|
| National Credit Code | s 72(4) | Give a written decision responding to a hardship notice within the applicable timeframe | Westpac failed to respond within time, or at all, to 277 online hardship notices | Established |
| National Consumer Credit Protection Act 2009 | s 175A | Continuing obligations and daily contraventions | Relevant unremedied failures continued after 13 March 2019 | Established |
| National Consumer Credit Protection Act 2009 | ss 47(1)(a), 47(4) | Ensure licensed credit activities are engaged in efficiently, honestly and fairly | Inadequate hardship systems, controls, monitoring, investigation and risk review | Established |
The declarations recorded 223 notices within the agreed civil penalty period and 277 notices across the broader relevant period.
The Court distinguished the failure to provide individual written decisions from the separate system-level failures under s 47. The former concerned customer-specific omissions; the latter concerned inadequate systems, processes and governance.
6. Gross Negligence and Missed Warning Signs
The Court accepted that Westpac did not deliberately set out to breach the law and that senior management was not aware of the problem until February 2022.
That did not materially excuse the conduct.
Westpac employees had known of issues affecting online hardship applications since at least December 2018. Customers had complained that they had not received decisions, and incident reports had been raised. Despite those warning signs, Westpac did not conduct an adequate investigation into whether the problems were systemic.
McEvoy J found that Westpac could and should have investigated whether every online hardship application was being received as intended. Its failure to do so over several years demonstrated gross negligence and serious management deficiency.
The judgment reinforces that a low volume of complaints does not establish that an issue is immaterial. Sixteen customer complaints were sufficient to warrant investigation, particularly for a major bank operating a system affecting financially vulnerable customers.
7. Customer Harm
The hardship provisions protect people who are unable to meet their repayment obligations. Westpac’s failures deprived affected customers of the opportunity to have their hardship circumstances considered before collection or enforcement processes continued.
The consequences included:
- ongoing interest, fees and charges;
- accumulation of additional debt;
- stress and inconvenience;
- adverse information recorded on credit files;
- debts sold to third-party purchasers; and
- active debt-recovery action despite unresolved hardship requests.
The Court accepted that some customers suffered irreparable and life-changing harm. The failures were especially egregious because the customers had affirmatively sought assistance through the channel Westpac had provided for that purpose.
8. Pecuniary Penalty
ASIC sought a $30 million penalty, comprising:
- $20 million for the s 72 contraventions; and
- $10 million for the s 47 contraventions.
Westpac submitted that approximately $10 million was appropriate. The Court rejected both positions and imposed $26 million.
Aggravating considerations
The Court relied on:
- the prolonged period of the failures;
- the number of affected hardship notices;
- the vulnerability of affected customers;
- gross negligence;
- the serious and sometimes irreversible customer consequences;
- missed opportunities to detect and correct the failures;
- Westpac’s size and substantial financial resources;
- its position as a major bank; and
- its history of other systems failures in financial services.
Mitigating considerations
The Court also considered that:
- Westpac did not profit from the contraventions;
- it cooperated with ASIC;
- it admitted substantial parts of ASIC’s case;
- it expressed contrition;
- it improved and began simplifying relevant systems;
- it investigated promptly once the principal failure was formally identified in 2022; and
- it completed a broad remediation program.
Westpac paid approximately $1.735 million in remediation and apologised to affected customers. The remediation program extended beyond the 277 notices addressed by the proceeding and included compensation for financial and, where possible, non-financial loss.
9. Orders and Remedies
| Order or remedy | Legal basis | Scope |
|---|---|---|
| Declarations | Credit Act and National Credit Code | Failures concerning 277 hardship notices and inadequate systems |
| Pecuniary penalty | Credit Act | $26 million |
| Adverse publicity | s 182, Credit Act | Notice on four banking-brand websites for at least 90 days |
| System remediation | s 177, Credit Act | Adequate system, operational and process changes within one month |
| Independent expert | s 177, Credit Act | Assessment of implementation and recommendations to ASIC |
| Costs | Court discretion | Westpac to pay ASIC’s costs, agreed or assessed |
The independent expert must review whether Westpac has fully and effectively implemented the required changes and identify any further action needed to achieve compliance. Westpac must give the expert’s report to ASIC and explain the action taken in response.
10. Governance and Compliance Significance
Hardship requests require end-to-end traceability
A customer submitting a hardship notice should generate a verifiable record at every stage:
- submission;
- receipt;
- system transfer;
- work allocation;
- assessment;
- written decision;
- customer delivery; and
- enforcement hold.
A successful web submission screen is not proof that the request reached the responsible decision-maker.
Customer complaints are control signals
Complaints concerning missing responses should trigger more than individual case correction. They should prompt investigation into:
- failed interfaces;
- unprocessed queues;
- batch-transfer errors;
- rejected data;
- work items without owners; and
- discrepancies between submitted forms and completed decisions.
Legacy technology does not reduce legal responsibility
Complexity and difficulty detecting system errors did not excuse Westpac. Large institutions are expected to allocate resources proportionate to the scale, vulnerability and legal significance of the customer process.
Hardship and enforcement systems must be integrated
A hardship notice should automatically suspend enforcement or collections activity until the statutory process has been completed. Separate systems create a serious risk that one part of the institution will pursue a customer while another has failed to process the hardship request.
11. Risk Management and Compliance Recommendations
| Audience | Control type | Risk indicator | Practical control |
|---|---|---|---|
| Board risk committee | Governance | Overdue or missing hardship decisions | Monthly reporting on submission-to-decision completeness |
| Credit operations | Preventative | Forms pass through several interfaces | End-to-end acknowledgement and reconciliation |
| Technology | Detective | Failed batches or rejected files | Automated exception alerts and daily queue reconciliation |
| Collections | Preventative | Enforcement proceeds while hardship request is unresolved | Automatic enforcement hold triggered at submission |
| Compliance | Detective | Repeated complaints about missing responses | Mandatory systemic-issue assessment |
| Risk function | Governance | Incidents repeatedly closed as isolated errors | Aggregate incident and complaint trend analysis |
| Internal audit | Detective | Reliance on policy and system design | Transaction tracing from web form to written decision |
| Data governance | Preventative | Invalid or incomplete account identifiers | Validation with a manual exception workflow |
| Remediation | Corrective | Customer debt increased during unprocessed hardship request | Restore position, correct credit files and assess non-financial loss |
12. Recommended Next Steps
Credit providers should:
- reconcile every hardship submission against a written decision or documented open case;
- create automated alerts where a submission does not reach the hardship team promptly;
- suspend enforcement activity immediately upon receipt of a hardship notice;
- test all system interfaces and batch transfers supporting hardship processing;
- investigate complaint clusters for systemic causes;
- report aged and unallocated hardship matters to senior management;
- audit whether required written reasons and external dispute resolution information are provided;
- review affected customers for fees, interest, credit reporting and enforcement harm;
- document accountability across technology, operations, collections, risk and compliance; and
- independently validate remediation before closing systemic issues.
This analysis is suitable for internal legal and compliance review, but implementation decisions should be confirmed against the complete judgment, agreed facts, current hardship requirements and applicable Banking Code obligations.