Chief Executive Officer of the Australian Transaction Reports and Analysis Centre v Commonwealth Bank of Australia Limited

YATES J: 1 The Chief Executive Officer of the Australian Transaction Reports and Analysis Centre (AUSTRAC) has sought declarations that the Commonwealth Bank of Australia (the Bank) contravened certain provisions of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the Act), and an order that the Bank pay a pecuniary penalty to the Commonwealth. The Chief Executive Officer, who is appointed under s 211 of the Act, is charged with enforcing compliance with the Act and its subordinate legislation, including the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No 1) (Cth) (the Rules). 2 At all times relevant to the proceeding, the Bank was a provider of designated services to customers within the meaning of s 6 of the Act, and thus a reporting entity within the meaning of s 5 of the Act. The Bank was also an Authorised Deposit-Taking Institution, authorised under the Banking Act 1959 (Cth) to take deposits from customers. 3 In May 2012, the Bank introduced Intelligent Deposit Machines (IDMs) as a new channel for providing designated services. This was part of a process to refresh the Bank's automated teller machine (ATM) "fleet". An IDM is a type of ATM which can accept cash and cheque deposits into accounts with the Bank. The funds can be deposited using either the Bank's branded card or the card of another financial institution. Unlike other ATMs, cash deposited through an IDM is automatically counted and instantly credited to the nominated beneficiary's account with the Bank. The funds are then immediately available for transfer, including internationally. In May 2012, when the Bank's first five IDMs were rolled out, cash deposits through the machines totalled $868,825 for the month. In May 2017, at a time when the Bank had rolled out 805 IDMs, cash deposits for the month totalled approximately $1.7 billion. 4 For the purposes of this proceeding only, the Bank admits that it has contravened ss 36(1), 41(2)(a), 43(2) and 82(1) of the Act, in particular respects. In general terms, these contraventions concern the Bank's failure to carry out appropriate customer due diligence; failure to provide suspicious matter reporting in a timely manner or at all; failure to comply with its own transaction monitoring program; failure to provide threshold transaction reporting to AUSTRAC in a timely manner; and failure to undertake risk assessments and introduce sufficient and appropriate risk-based controls in relation to the money laundering and terrorism financing risks posed by the operation of its IDMs. All these contraventions are of civil penalty provisions. 5 Section 36(1) of the Act imposes an obligation on a reporting entity to monitor its customers with a view to identifying, mitigating and managing the risk that its designated services might facilitate money laundering or the financing of terrorism. 6 The Bank admits that it contravened s 36(1) in respect of 80 customers by failing sufficiently to monitor those customers in relation to the provision of designated services with a view to identifying, mitigating and managing the money laundering and terrorism financing risks the Bank reasonably faced. 7 The Bank's failures to comply with s 36(1) derive from, or are a combination of, five causes: Insufficient automated transaction monitoring alerts were generated on the customer's account for a period in circumstances where there were transactions that were complex, unusually large, had an unusual pattern, or which had no apparent economic or visible lawful purpose. Alerts had been generated in respect of the customer or account, but a review of the customer or account did not occur quickly enough once that alert had been triggered; Insufficient consideration was given as to whether the Bank should terminate the customer relationship having regard to the money laundering or terrorism financing risk posed by the customer. 30 days' notice was provided to customers of the Bank's intention to terminate the customer relationship and close the account, during which the customers were able to continue transacting without heightened restrictions in place. The delay in rendering the account inactive once the decision to terminate had been made resulted in further suspicious or unusual transactional activity. The Bank's monitoring or enhanced monitoring of the customer was otherwise insufficient to mitigate or manage its money laundering or terrorism financing risk in respect of the customer in accordance with the Rules. 8 The majority of the Bank's admitted contraventions relate to periods of under 12 months, with 21 cases being for a period of three months or less. In 11 cases, the period exceeded two years. The Bank admitted these contraventions promptly. 9 Section 41(2)(a) of the Act imposes an obligation on a reporting entity to provide, within limited timeframes, a report to the Chief Executive Officer of suspicious matters. Relevantly to the present proceeding, the Bank was obliged to submit a suspicious matter report within three business days of forming a suspicion, on reasonable grounds, that a person to whom it commenced, or proposed, to provide a designated service was not the person he, she or it claimed to be. The Bank was also obliged to report that it had information concerning the provision, or prospective provision, of a designated service that may be relevant to the investigation of, or prosecution of a person for, an offence against a law of the Commonwealth or of a State or Territory. 10 The Bank admits that it contravened s 41(2)(a) of the Act on 120 occasions by failing to give suspicious matter reports within three business days of forming a suspicion, on reasonable grounds, that the information it had may be relevant to the investigation of, or prosecution of a person for, an offence against a law of the Commonwealth or a State. The Bank repeatedly failed to report obvious and very specific patterns of structuring indicative of money laundering, including through its IDMs, despite having identified these patterns. However, in relation to a number of these contraventions, the Bank's failures derive from its misapprehension of the obligations imposed on it by s 41(2)(a). 11 These contraventions can be grouped as follows: On 40 occasions, the Bank did not give suspicious matter reports within the required timeframe because it had already given a suspicious matter report in relation to the relevant customer within the previous three months about a similar pattern of activity on the same account. In 18 of these cases, the Bank subsequently gave a suspicious matter report. However, in 22 cases it gave no report. The Bank admitted these contraventions at the earliest opportunity. On 69 occasions, the Bank did not give suspicious matter reports within the required timeframe where it had received requests from law enforcement agencies for account details. This occurred in the course of seven discrete criminal investigations. On 50 of these occasions, the Bank subsequently gave a suspicious matter report. However, on 19 occasions it gave no report. Nonetheless, in all cases in this group the Bank provided intelligence directly to the law enforcement agency concerned and provided assistance in relation to police investigations. The Bank admitted these contraventions promptly. On 11 occasions, the Bank did not give suspicious matter reports within the required timeframe in circumstances of discrete error. In one of these cases, the Bank reported the transactional activity three weeks late. In the remaining cases, the Bank gave no report. The Bank admitted these contraventions at the earliest opportunity. 12 The Bank also admits that it contravened s 41(2)(a) on 29 occasions by failing to give suspicious matter reports within three business days of forming a suspicion on reasonable grounds that the person to whom it commenced, or proposed, to provide a designated service was not the person he, she or it claimed to be. These contraventions concern 29 accounts opened by two individuals within a criminal syndicate using false identification, where the Bank had received information from law enforcement to this effect. On these occasions, the Bank provided intelligence directly to the law enforcement agency concerned and provided assistance in relation to police investigations. The Bank's failures derive, once again, from its misapprehension of the obligations imposed on it by s 41(2)(a). The Bank admitted these contraventions at the earliest opportunity. 13 The admitted contraventions of s 41(2)(a) occurred between 28 August 2012 and 7 June 2017, with half occurring between March 2015 and December 2015. 14 Section 43(2) of the Act imposes an obligation on a reporting entity to report on threshold transactions within 10 business days after the transaction takes place. In simple terms, a threshold transaction is one that involves the transfer of physical currency of not less than $10,000. 15 The Bank admits that it contravened s 43(2) of the Act on 53,506 occasions by failing to give reports of threshold transactions within the stipulated timeframe. These contraventions arose from the Bank's inadvertent failure to update and configure its automated process for identifying threshold transactions through its IDMs, and reporting those transactions to AUSTRAC, after the Bank had introduced a new transaction code for cash deposits. This represents about 95% of the threshold transactions that occurred through IDMs in the relevant period, with a total value of $624.7 million. Of this sum, approximately $17.5 million related to 1,656 transactions connected with money laundering syndicates being investigated and prosecuted by the Australian Federal Police, or accounts connected with those investigations. A further six transactions related to five customers who had been assessed by the Bank as posing a potential risk of terrorism or terrorism financing. The issue was only identified when AUSTRAC drew reporting anomalies to the Bank's attention. Thereupon, the Bank promptly took steps to address the issue. 16 The admitted contraventions occurred from November 2012 to September 2015. 17 Section 82(1) of the Act imposes an obligation on a reporting entity to comply with Part A of the anti-money laundering and counter-terrorism financing program it has adopted. Part A must have the primary purpose of identifying, mitigating and managing the risk a reporting entity may reasonably face that the provision of designated services might involve or facilitate money laundering or terrorism financing. It must comply with the requirements of the Rules. In this connection, r 9.1.5(5) requires that Part A be designed to enable the money laundering or terrorism financing risk posed by all new methods of designated service delivery and all new or developing technologies used for the provision of designated services to be assessed prior to adopting them. 18 The Bank admits that it contravened s 82(1) of the Act on 14 occasions by failing to comply with Section 2 of Part A of its joint anti-money laundering and counter-terrorism financing program with respect to designated services provided through its IDMs. These failures of compliance were reflected in the Bank's failure to undertake, at certain times, an assessment of the inherent money laundering and terrorism financing risk posed by its IDMs and its failure to introduce, at certain times, sufficient and appropriate risk-based controls to mitigate and manage that risk. IDMs pose a high money laundering and terrorism financing risk because cash can be deposited anonymously at any time at hundreds of locations and transferred immediately, either domestically or internationally, without any cash limit being imposed. 19 The admitted contraventions occurred over a six year period. 20 The Bank also admits that it contravened s 82(1) of the Act by failing to comply with the provisions of the transaction monitoring program included in Part A of its joint anti-money laundering and counter-terrorism financing program. This program included the automated monitoring of transactions conducted through certain of the Bank's products and services so as to provide Priority Monitoring, including account-level monitoring. The failure occurred through an error which arose when merging data from two of the Bank's systems, resulting in certain data fields in the Bank's Financial Crime Platform not being populated. In consequence, automated alerts were not always generated as intended, or at all, in respect of 778,370 accounts in the period 20 October 2012 to 12 October 2015. The number of unmonitored transactions cannot be known. The precise number of contraventions cannot be ascertained but it is, potentially, a very significant number. 21 As noted, the admitted contraventions occurred over a three year period. 22 Following a court-ordered mediation, the parties reached agreement as to the terms on which relief should be granted by the Court. They have filed draft orders reflecting their agreement. The parties acknowledge that it is for the Court to determine whether the Bank contravened the relevant provisions of the Act, and for the Court to determine the quantum of any pecuniary penalty that should be imposed and any other relief that should be ordered. This is the purpose to be served by today's hearing. 23 To this end, I have been assisted in my consideration of the matter by substantial written submissions filed by the parties. These submissions were filed on 6 June 2018 and are joint submissions. They represent the agreed position of the parties as to the relevant legal principles and how those principles should be applied to the particular facts and circumstances of this case. On 4 June 2018, the parties filed a document described as a statement of agreed facts and admissions. This document identifies the facts relevant to the contraventions admitted by the Bank. The facts and admissions are agreed and admitted solely for the purpose of this proceeding. 24 I have also been considerably assisted by oral addresses from senior counsel for each party. 25 Rather than attempt to summarise the effect of the joint submissions and the statement of agreed facts and admissions, I will annex them to these reasons as Annexures A and B respectively. They should be taken as having been incorporated in these reasons. I will also have them placed on the Court's official website so that access to them can be obtained conveniently. 26 There are some matters about which I wish to make specific comment. 27 First, the amended statement of claim filed in the proceeding pleads alleged contraventions of the Act in addition to those admitted by the Bank. The applicant does not press these allegations. I note they are denied by the Bank. 28 Secondly, the statement of agreed facts and admissions is a very detailed document. It recognises and identifies the serious and systematic failures by the Bank to observe and fulfil its important obligations under the Act, whose objects include addressing the need to combat money laundering and the financing of terrorism; promoting public confidence in the Australian financial system through the enactment and implementation of controls and powers to detect, deter and disrupt money laundering, the financing of terrorism and other serious crimes; and fulfilling Australia's international obligations in that regard so as to affect beneficially Australia's obligations with foreign countries and international organisations. 29 Thirdly, none of the contraventions was the result of a deliberate intention on the part of the Bank to breach the relevant provisions. However, the contraventions were serious, for the reasons explained in the statement of agreed facts and admissions. For example, the late threshold transaction reports and the failure to report suspicious matters (on time or at all) have deprived AUSTRAC and law enforcement agencies of intelligence to which they were and are entitled involving movements of several million dollars in cash. AUSTRAC and law enforcement agencies were denied timely intelligence on about $625 million in threshold transactions and on several million dollars in suspicious activity. The money laundered through the Bank's accounts included the proceeds of drug and firearms importation. 30 Fourthly, the Bank: acknowledges that there were deficiencies in oversight, accountabilities and resources in respect of its anti-money laundering and counter-terrorism financing compliance and its risk management functions; now also acknowledges that it did not take all necessary steps to appropriately identify, mitigate and manage the money laundering and terrorism financing risks posed by its IDMs; agrees that money laundering and terrorism financing undermine the integrity of the Australian financial system and impact the Australian community's safety and well-being; acknowledges that, as a bank, it plays a key role in combating money laundering and terrorism financing; accepts accountability for the admitted contraventions; expresses its deep regret for those contraventions; acknowledges the significant impact that deficiencies in its systems and processes can have on efforts to combat money laundering and terrorism financing; accepts that it needs to be ever vigilant in this area; and emphasises its commitment to working with AUSTRAC and law enforcement agencies to fight money laundering and the financing of terrorism. 31 Fifthly, apart from taking corrective measures to address directly the immediate causes of its failures, the Bank has undertaken a number of enhancements to its anti-money laundering and counter-terrorism financing processes, systems and controls and introduced a number of other enhancements to further identify, mitigate and manage its money laundering and terrorism financing risk in respect of IDMs. It has also made enhancements to its threshold transaction reporting processes, systems and controls and its transaction monitoring program. Further, it has undertaken a range of enhancements to its suspicious matter reporting processes. Once again, these are identified and summarised in the statement of agreed facts and admissions. 32 Sixthly, the parties jointly seek a pecuniary penalty totalling $700 million. As I have recorded, the parties acknowledge that, notwithstanding their agreement on this sum, it is for the Court to determine the appropriate penalty. It is not unusual for parties to civil penalty proceedings to reach agreement on the quantum of a penalty and, indeed, on other relief that should be granted. The function of the Court is then to scrutinise the appropriateness of the relief sought including, in relation to an agreed pecuniary penalty, the quantum of that penalty. The joint submissions set out in some detail the approach that courts in Australia take when civil penalty orders are sought by consent. In these brief reasons, I merely draw attention to the observation of the plurality in Commonwealth of Australia v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; (2015) 258 CLR 482 at [58] where their Honours said: ... Subject to the court being sufficiently persuaded of the accuracy of the parties' agreement as to facts and consequences, and that the penalty which the parties propose is an appropriate remedy in the circumstances thus revealed, it is consistent with principle and … highly desirable in practice for the court to accept the parties' proposal and therefore impose the proposed penalty. To do so is no different in principle or practice from approving an infant's compromise, a custody or property compromise, a group proceeding settlement or a scheme of arrangement. 33 Seventhly, in considering the appropriate pecuniary penalty, s 175(3) of the Act requires me to have regard to all "relevant matters" including the nature and extent of the contravention; the nature and extent of any loss or damage suffered as a result of the contravention; and the circumstances in which the contravention took place. The joint submissions advance the matters that are relevant to the present case, supported by the parties' agreement on the facts set out in the statement of agreed facts and admissions. Section 175(3) also requires me to take into account, if appropriate, whether a contravener has been found by a local or foreign court to have engaged in similar conduct. There has been no such finding in relation to the Bank. 34 I now turn to identify how the parties have arrived at the sum of $700 million as the total penalty that, in their submission, should be imposed. 35 In relation to the contraventions of s 36(1) of the Act concerning the failure to undertake ongoing customer due diligence, the parties submit that an appropriate penalty is $170 million. 36 In relation to the contraventions of s 41(2)(a) of the Act concerning the 40 occasions on which the Bank failed to give suspicious matter reports because it had already given such a report in respect of a customer within the previous three months, the parties submit that, as these contraventions derive from a common source - the Bank's misapprehension as to its reporting obligations in such circumstances - they should be regarded as a single course of conduct and represent, essentially, the same wrongdoing. The parties submit that an appropriate penalty for these contraventions is $55 million. 37 In relation to the contraventions of s 41(2)(a) of the Act concerning the 69 occasions on which the Bank failed to give suspicious matter reports in circumstances where it had received and acted on requests from law enforcement agencies for information, the parties submit that the commonalities between these contraventions should be taken into account for the purposes of assessing penalty. They submit that an appropriate penalty for these contraventions is $40 million. 38 In relation to the contraventions of s 41(2)(a) of the Act concerning the 11 occasions of discrete error, the parties treat these as one group and submit that an appropriate penalty for these contraventions is $15 million. 39 In relation to the contraventions of s 41(2)(a) of the Act concerning the 29 occasions on which the Bank failed to give suspicious matter reports in respect of customer false identity, the parties submit that the commonalities between these contraventions should be taken into account for the purposes of assessing penalty. They submit that an appropriate penalty for these contraventions is $15 million. 40 In relation to the contraventions of s 43(2) of the Act concerning the 53,506 occasions on which threshold transaction reporting was not given within the required timeframe, the parties submit that it is appropriate to impose a single pecuniary penalty. They submit that an appropriate penalty is $125 million. 41 In relation to the contraventions of s 82(1) of the Act concerning the Bank's failures to undertake risk assessment and introduce sufficient and appropriate risk-based controls in respect of its IDMs, the parties submit that, for the purposes of determining penalty, each contravention should be considered separately. The maximum penalty for the 14 contraventions is $238 million. The parties submit that an appropriate overall penalty is $180 million. 42 In relation to the contraventions of s 82(1) of the Act concerning the Bank's failures to comply with the transaction monitoring program included in Part A of its joint anti-money laundering and counter-terrorism financing program, the parties submit that it would be appropriate for the Court to impose a single penalty, particularly in circumstances where the precise number of contraventions cannot be ascertained. They submit that an appropriate penalty is $100 million. 43 Apart from addressing the specific circumstances attending the various groups of contraventions I have summarised, the joint submissions and the statement of agreed facts and admissions address a number of considerations that are relevant to the assessment of penalties (some of which I have already touched on), namely: the absence of past similar conduct; the Bank's size and financial position; specific and general deterrence; the period of the contravening conduct; the conduct of the Bank's board and senior management; the likelihood and nature of the loss or damage caused by the Bank's conduct; corrective measures undertaken by the Bank; the Bank's co-operation with AUSTRAC in the conduct of this proceeding, including its willingness to make admissions at the first available opportunity, its willingness to respond to document and information requests without the need for court applications, and its agreement to a substantial total penalty without the need for a complex and lengthy contested hearing, which has resulted in considerable savings in cost for AUSTRAC and the broader Australian community; and the Bank's contrition and remorse by acknowledging the seriousness of its contraventions, and undertaking significant steps to address the underlying deficiencies that led to the contraventions. 44 On the basis of the facts agreed by the parties and the admissions made by the Bank, I am satisfied that the contraventions have been established and that those contraventions are of civil penalty provisions. 45 I accept that the way in which the parties have grouped and dealt with the contraventions is an appropriate framework for considering the imposition of penalties. The amounts put forward, in accordance with that framework, reflect penalties that are appropriate in the circumstances of the case. 46 I accept further that, rather than imposing multiple penalties, it is appropriate that a single penalty be imposed that represents the totality of the contravening conduct. I am satisfied that the sum of $700 million is an appropriate single penalty. It marks the Court's strong disapproval of the Bank's conduct. I am satisfied that a penalty of this amount will be sufficient to achieve the object of specific deterrence. It will also strongly deter others from contravening the Act. 47 The parties also submit that it would be appropriate for the Court to grant declaratory relief. I am satisfied that it would be appropriate to do so in the present case for the reasons advanced in the joint submissions. The declarations I will make are to be understood in light of the statement of agreed facts and admissions incorporated in these reasons. 48 Finally, I note that the Bank has agreed to pay the applicant's costs. I certify that the preceding forty-eight (48) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Yates.

Associate: Dated: 20 June 2018 ANNEXURE A ANNEXURE B