The statement of claim
6 The essence of the applicants' claim is that CBA wrongly failed to disclose information to the market, in breach of its continuous disclosure obligations and given other representations it had made; that the applicants and group members acquired their CBA shares in a market which had not been given the information which CBA should have disclosed; and that when the market was properly informed, the price of CBA shares fell, causing loss and damage to the applicants and group members.
7 In its proposed form, para 24 reads:
24. From a date presently unknown to the Applicants but no later than at least May 2012, until at least 3 August 2017, CBA's systems for assessing, monitoring and managing ML/TF Risk and reporting transactions which could be affected by ML/TF Risk in relation to IDMs, and generally, were deficient (Risks Systems Deficiency Information).
Particulars
i) The systems for assessing, monitoring and managing ML/TF Risk were deficient by reason of the matters the subject of each and any combination of the following, for the periods referred to in the following:
(A) the TTR Information - for a period presently unknown to the Applicants but at least from November 2012 to September 2015;
(B) the SMR Information - for a period presently unknown to the Applicants but at least from October 2012 to September 2015;
(C) the Absence of Risk Assessment Information - from May 2012 to July 2015; and
(D) the Account Monitoring Failure Information - from at least 20 October 2012 to a date presently unknown to the Applicants.
ii) Further or alternatively, the systems for assessing, monitoring and managing ML/TF Risk were deficient by reason of:
(A) the 'systems error' or 'computer coding error' referred to in the particulars to paragraph 20 above, which affected transactions on hundreds of thousands of accounts (Affected Accounts) from at least 20 October 2012 but was not identified until 16 June 2014. This error arose in the process of merging data from two systems, with the result that the 'account type description' field (which indicated whether the account was a personal or commercial account) was not populated with CBA's Financial Crime Platform and so account-level automated transaction monitoring rules did not operate as intended in respect of the Affected Accounts. The Applicants refer to inter alia the Agreed Facts in AUSTRAC Proceeding, paragraph 51;
(B) further or alternatively, the 'systems error' referred to in paragraph 16(a)(v) and 16(b)(v) above, which caused tens of thousands of TTRs not to be given to AUSTRAC on time from around November 2012 but was not identified until brought to CBA's attention by AUSTRAC in the second half of 2015. This systems error was the result of CBA's TTR process not being updated and configured to automatically search for a transaction code used to identify deposits involving cash made through IDMs for the purposes of TTR reporting to AUSTRAC. The Applicants refer to inter alia the Agreed Facts in AUSTRAC Proceeding, paragraphs 43 to 44;
(C) further or alternatively, the failure of (alternatively, lack of) backup or failsafe systems that would have permitted the systems errors in (A) and/or (B) to have been detected and remedied earlier than they were.
iii) Further or alternatively, the systems for reporting suspected money laundering and terrorism financing to authorities were also deficient in that:
(A) CBA adopted a policy of not giving SMRs to AUSTRAC pursuant to s 41 of the AML/CTF Act if a report had been given for the customer in question within the previous three months. Such a policy meant that where a SMR was given for the customer, then no further SMR would be given for that customer for the following three month period regardless of the transactions undertaken by that customer during that period. CBA ought to have submitted SMRs on each occasion when further suspicious transactions were identified regardless of whether a report had been given for the customer in question within the previous three months. The Applicants refer to inter alia the Agreed Facts in AUSTRAC Proceeding, paragraph 55(a);
(B) CBA's systems for generating and reviewing transaction monitoring alerts and reviewing concerns raised by CBA employees about suspicious transactions were insufficient to mitigate or manage CBA's ML/TF Risk in accordance with the AML/CTF Act and AML/CTF Rules, since:
a. insufficient automated transaction monitoring alerts were generated in a period where there were transactions which were unusually large, complex, had an unusual pattern, or had no apparent economic or visible lawful purpose;
b. a review of the customer or account, where an alert had been generated, did not occur quickly enough once that alert had been triggered;
c. insufficient consideration was given to whether CBA should have terminated the customer relationship having regard to ML/TF Risk posed by the customer;
d. CBA did not otherwise take enhanced customer due diligence measures appropriate to mitigate or manage its ML/TF Risk in the circumstances in accordance with the AML/CTF Rules.
The Applicants refer to inter alia the Agreed Facts in the AUSTRAC Proceeding, paragraphs 58 and 64(e);
(C) where CBA decided to terminate a customer's account for suspected money laundering or terrorism financing, CBA did not terminate the account immediately but gave the customer 30 days' notice and permitted ongoing transactions, including cash deposits and international transfers, on the account in the meantime. That enabled the customer to undertake further transactions which could be associated with suspected money laundering and terrorism financing during the notice period. CBA ought to have terminated the account or restricted transactions on the account immediately;
(D) CBA's systems for mitigating and managing the risk that its services (including IDMs) might involve or facilitate money laundering or financing of terrorism pursuant to s 36 of the AML/CTF Act were inadequate, in that in circumstances where CBA had identified a risk that a particular account was being used for money laundering or terrorism financing, CBA's system did not ensure that CBA took timely steps to verify the identity of the customer, verify whether the customer had a legitimate reason for depositing cash amounts or transferring such deposits out of the CBA, restrict transactions on the account, or terminate the account. Where CBA had identified such a risk, CBA's system ought to have done each of these things.
iv) Further or alternatively, on 69 occasions, CBA did not submit SMRs, within the required time frame, in relation to instances of suspicious account activity indicative of possible money laundering, dealing in proceeds of crime or otherwise understood to be relevant to a criminal investigation, in circumstances where CBA had received requests from law enforcement for account details in the context of a criminal investigation. In 50 of these cases, CBA did not submit SMRs to AUSTRAC within the time frame stipulated in s 41(2)(a) although it subsequently did so. In the remaining 19 cases, CBA did not submit SMRs to AUSTRAC at all. This was due to a misapprehension about the proper treatment of information received from law enforcement: Agreed Facts in AUSTRAC Proceeding, paragraph 55(b). CBA ought to have appreciated that it still needed to submit SMRs, within the required timeframe, in circumstances where it had received requests from law enforcement for account details in the context of a criminal investigation, and had systems in place which provided for that to occur.
v) Further or alternatively, on 29 occasions, CBA did not submit SMRs, within the required time frame, in relation to suspicions that account holders were not the people they claimed to be, in circumstances where 29 accounts were opened by two individuals within a criminal syndicate using false identification, and where CBA had received information from law enforcement to this effect with the customers being listed across two email notifications to CBA from the Australian Federal Police. This was due to a misapprehension that information of this nature derived from law enforcement did not need to be reported to AUSTRAC: Agreed Facts in AUSTRAC Proceeding, paragraph 55(c). CBA ought to have appreciated that it still needed to submit SMRs, within the required timeframe, in circumstances described above, and had systems in place which provided for that to occur.
vi) Further or alternatively, according to the Australian Prudential Regulation Authority report 'Prudential Inquiry into the Commonwealth Bank of Australia' dated April 2018, the systems for assessing, monitoring and managing ML/TF Risk were deficient by reason of at least the following matters:
(A) CBA's ML/TF Risk systems were the subject of 'red' audit reports in 2013, 2015 and September 2016, which identified weaknesses in ML/TF Risk management and processes, and some such issues arose repeatedly: pp 15 - 16;
(B) The later reports identified that ML/TF Risks management and process issues identified in earlier reports had not been remediated or addressed, and where they had been, had been reopened due to inadequacies in remediation. Successive remediation programs were slow to address underlying failings in the ML/TF Risk control framework. These remediation failures arose due to lack of ownership in CBA of ML/TF Risk management processes and inadequate implementation of action plans: pp 15 - 16, 23;
(C) An internal audit report in December 2014 showed that five ML/TF Risk control weaknesses had been identified as requiring remediation, and four of those issues had been closed without fully addressing the risk: p 41;
(D) There was a lack of accountability by heads of business units for the ML/TF Risk generated by the products and services they offered: p 60.
vii) The Applicants also refer to and rely upon CBA's Concise Response in AUSTRAC Proceeding, in particular paragraphs 13 to 18 and 26 to 30.
viii) Further particulars may be provided following discovery and other interlocutory procedures.
8 In para 24:
(a) the expression ML/TF Risk means the risk that a reporting entity, such as CBA, may reasonably face that the provision by it of designated services might (whether inadvertently or otherwise) involve or facilitate money laundering or the financing of terrorism, for the purpose of the entity's anti-money laundering and counter terrorism financing program required to be adopted and maintained under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act) and the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth);
(b) the acronym IDMs means intelligent deposit machines; and
(c) the word "generally" qualifies CBA's "systems", not their alleged "deficiencies".
9 With regard to particular (i):
(a) the expression TTR Information is defined and described in para 16 of the statement of claim (in general terms, it is information concerning the fact that CBA failed to give certain threshold transaction reports (TTRs) on time to the Australian Transaction Reports and Analysis Centre (AUSTRAC) in relation to certain transactions processed through its IDMs);
(b) the expression SMR Information is defined and described in para 22 of the statement of claim (in general terms, it is information concerning the fact that CBA failed to give certain suspicious matter reports (SMRs) to AUSTRAC, or gave late or incomplete SMRs);
(c) the expression Absence of Risk Information is defined and described in para 18 of the statement of claim (in general terms, it is information concerning the fact that, prior to the roll-out of its IDMs in May 2012 and up to July 2015, CBA failed to carry out an assessment of ML/TF Risk in relation to the provision of designated services through its IDMs); and
(d) the expression Account Monitoring Failure Information is defined and described in para 20 of the statement of claim (in general terms, it is information concerning the fact that by June 2014, CBA had failed to conduct account level monitoring with respect to certain customer accounts for a significant period of time).
Thus, an understanding of particular (i) requires the reader to have regard to the definitions and descriptions in other paragraphs of the statement of claim.
10 I also observe that the particulars refer to other sources of information which are incorporated into the particulars, namely the Statement of Agreed Facts and Admissions filed in proceeding NSD1305/2017 (Chief Executive Officer of the Australian Transaction Reports and Analysis Centre v Commonwealth Bank of Australia Limited) (see particulars (ii) to (v) which describe the statement as the Agreed Facts - although I hasten to add that they are not facts that are agreed in this proceeding) and the report of the Australian Prudential Regulatory Authority entitled Prudential Inquiry into the Commonwealth Bank of Australia, which is dated April 2018 (see particular (vi)) (the APRA Report).
11 Paragraph 25 of the statement of claim pleads that by no later than at least 16 June 2014, or alternatively 24 September 2015, CBA was aware (within the meaning of ASX Listing Rule 19.12) of the Risks Systems Deficiency Information pleaded in para 24.
12 Paragraph 26 of the statement of claim introduces the expression Potential Penalty Information. In general terms, this refers to the fact that, by no later than at least 16 June 2014 or 24 September 2015, CBA was exposed to the risk of enforcement action by AUSTRAC in respect of non-compliance with the AML/CTF Act, which could result in CBA being ordered to pay a substantial civil penalty. That risk has now crystallised and resulted in the payment of such a penalty: Chief Executive Officer of the Australian Transaction Reports and Analysis Centre v Commonwealth Bank of Australia Limited [2018] FCA 930. The allegation in para 26 is particularised by reference to, inter alia, the Risks Systems Deficiency Information as an aspect of CBA's non-compliance with the AML/CTF Act.
13 The allegation concerning the Risk Systems Deficiency Information pleaded in para 24 is repeated and relied on in other paragraphs of the statement of claim. See the allegations that:
(a) a reasonable person would expect the Risks Systems Deficiency Information to have a material effect on the price or value of CBA shares within the meaning of ASX Listing Rule 3.1 and s 674(2)(c)(ii) of the Corporations Act 2001 (Cth) (the Corporations Act): para 44 of the statement of claim;
(b) CBA was obliged by ASX Listing Rule 3.1 and s 674(2) of the Corporations Act to immediately notify the ASX of the Risks Systems Deficiency Information on and from the time it became aware of it: para 45 of the statement of claim;
(c) CBA did not notify the ASX of the Risks Systems Deficiency Information at any time during the Claim Period: para 46 of the statement of claim;
(d) CBA thereby contravened ASX Listing Rule 3.1 and s 674(2) of the Corporations Act: para 47 of the statement of claim; and
(e) the failure to disclose the information caused loss to the applicants and group members: Part G of the statement of claim.
14 CBA submits, and I accept, that, in a "non-disclosure case", such as the present, it is critically important that the pleading identify with appropriate precision the information which allegedly ought to have been disclosed. It is the starting point for determining whether, in light of its nature and character, each element was information that a reasonable person would expect to have a material effect on the price or value of CBA shares, such that CBA came under an obligation to disclose that information to the market: see also the Zonia reasons at [24].