HSBC’s Australian unit has been ordered to pay A$35 million ($24.6 million) after admitting to serious failures in protecting customers from scams, in what regulators described as a landmark case for the banking industry.

Australia’s Federal Court ruled that HSBC failed to maintain adequate controls over its internal transfer systems between May 2023 and May 2024, exposing customers to a heightened risk of unauthorized transactions. The bank was also aware as early as 2021 of a growing wave of impersonation scams in which fraudsters posed as HSBC representatives.

The Australian Securities and Investments Commission (ASIC) said HSBC breached its financial services obligations by failing to adequately prevent scams and by taking an average of 144 days to investigate customer complaints. Regulators also found shortcomings in the bank’s processes for restoring access to accounts that had been locked following scam incidents.

“Today’s outcome is one of the first of its kind globally,” ASIC Chair Sarah Court said, adding that the penalty serves as the “strongest scam wake-up call yet to the banking industry.”

HSBC said it had reached an agreement with ASIC that recognizes its customer compensation program and the “significant enhancements” it has made to its fraud prevention, detection, and response systems.

The case stems from longstanding allegations that HSBC failed to adequately protect customers from scam-related losses. ASIC previously alleged that about 950 reports of unauthorized transactions resulted in roughly A$23 million in customer losses between 2020 and 2024.

Separately, HSBC has faced major regulatory penalties in the past. In 2012, HSBC Holdings and HSBC Bank USA agreed to pay a record $1.92 billion to US authorities after admitting to anti-money laundering and sanctions violations. The bank acknowledged that it had allowed hundreds of millions of dollars in transactions linked to drug-trafficking organizations, including Mexico’s Sinaloa Cartel and Colombia’s Norte del Valle Cartel.

HSBC also admitted to violating US sanctions by processing transactions involving countries such as Iran, Sudan, and Cuba. The $1.92-billion settlement included a $1.256-billion forfeiture and additional civil penalties and was, at the time, the largest banking penalty in history.