Zonia Holdings Pty Ltd v Commonwealth Bank of Australia Limited

Introduction 1 This proceeding is a representative proceeding commenced under Part IVA of the Federal Court of Australia Act 1976 (Cth) by the applicant on its own behalf and on behalf of all persons (save for certain exceptions) which or who acquired an interest in CBA shares during the period between 1 July 2015 and 1.00 pm on 3 August 2017 (referred to in the statement of claim as the Relevant Period) and suffered loss or damage by reason of the conduct pleaded in the statement of claim. 2 By an interlocutory application filed on 23 February 2018, the respondent, Commonwealth Bank of Australia Ltd (CBA), moves to strike out para 46 of the statement of claim under r 16.21(1) of the Federal Court Rules 2011 (Cth) (the Rules), which provides: (1) A party may apply to the Court for an order that all or part of a pleading be struck out on the ground that the pleading: (a) contains scandalous material; or (b) contains frivolous or vexatious material; or (c) is evasive or ambiguous; or (d) is likely to cause prejudice, embarrassment or delay in the proceeding; or (e) fails to disclose a reasonable cause of action or defence or other case appropriate to the nature of the pleading; or (f) is otherwise an abuse of the process of the Court. 3 CBA relies on paras (c)-(f) above, although its oral submissions focused on para 46 of the statement of claim as causing "embarrassment" in the technical sense in which that word is understood and used in the context of rules such as r 16.21(1): Bartlett v Swan Television & Radio Broadcaster Pty Ltd [1995] FCA 638; (1995) ATPR 41-434 at 12; Shelton v National Roads and Motorists' Association Ltd [2004] FCA 1393; (2004) 51 ACSR 278 at [18]; Spiteri v Nine Network Australia Pty Ltd [2008] FCA 905 at [22]. Alternatively, CBA says that, under r 16.45 of the Rules (which I will not set out) the applicant should be required to provide further particulars of para 46 of the statement of claim. This alternative is not at the forefront of CBA's application. 4 The allegations pleaded in the statement of claim stem from CBA's alleged failure to comply with certain of its obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act) and the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth) (the AML/CTF Rules), as well as its own anti-money laundering and counter-terrorism financing program (the AML/CTF program). 5 On 3 August 2017, the Australian Transaction Reports and Analysis Centre (AUSTRAC), established under the Financial Transaction Reports Act 1988 (Cth) (and continued in force by s 209(1) of the AML/CTF Act) commenced a civil penalty proceeding in this Court in relation to the alleged non-compliance. CBA has admitted a number of the allegations made in that proceeding. 6 On the same day, AUSTRAC published a statement which announced that it had commenced the civil penalty proceeding. The published statement contained a link to the Concise Statement filed in that proceeding. In the present proceeding, the applicant places reliance on the Concise Statement and has pleaded relevant parts of it in the statement of claim, as follows: 32. The 3 August AUSTRAC Statement contained a link to a Concise Statement filed in the Federal Court in the AUSTRAC Proceeding, which inter alia stated: (a) In May 2012, CBA had rolled out IDMs, a type of ATM that accepts deposits by both cash and cheque, which are automatically counted and credited instantly to the nominated recipient account, the funds then being available for immediate transfer to other accounts both domestically and internationally: [1]; (b) CBA's IDMS could accept up to 200 notes per deposit (that is, up to $20,000 per cash transaction), and CBA did not limit the number of IDM transactions a customer can make a day: [2]; (c) IDMs facilitate anonymous cash deposits. Although a card must be entered to activate and make a deposit through an IDM, the card could be from any financial institution and if it was not a CBA card, the cardholder details were not known to CBA: [3]; (d) There was significant growth in CBA IDM use since their roll-out; in the six months from January to June 2016, cash deposits through IDMs grew to about $5.81 billion, and in May and June 2016 over $1 billion in cash was deposited each month through CBA IDMs: [4]; (e) CBA had not complied with a number of the procedures in CBA's AML/CTF Program on and from May 2012: [5]; (f) CBA did not carry out a ML/TF Risk assessment: (i) prior to rolling out IDMs; (ii) in response to the exponential rise in cash deposits through IDMs; (iii) in response to alerts raised by internal transaction monitoring systems: (iv) in response to identification by law enforcement of significant instances of money laundering through IDMs; (v) until mid-2015, three years after IDMs were introduced (and after about $8.91 billion in cash had been deposited through CBA IDMs), [6]; (g) CBA had not, at any stage and even after mid-2015, introduced appropriate risk-based systems and controls to mitigate and manage the higher ML/TF Risks it reasonable faced by providing designated services through IDMS: [7]; (h) CBA did not comply with the requirements of its transaction monitoring program (part of CBA's AML/CTF Program) at various times between about 20 October 2012 to 27 September 2016 with respect to 778,370 accounts, none of which were subject to transaction monitoring at the "account level" at various times, and some were not subject to "customer level" transaction monitoring: [8]; (i) CBA was required to report to AUSTRAC "threshold transactions" (being transactions involving the transfer of physical currency in the amount of $10,000 or more) within 10 business days after the transaction occurred: [9]; (j) CBA failed to give TTRs on time for 53,506 cash transactions of $10,000 or more processed through IDMs from 5 November 2012 to 1 September 2015 (Late TTRs): [10] (k) In respect of the Late TTRs: (i) the Late TTRs represented 95% of threshold transactions that occurred through IDMs; and (ii) the Late TTRs had a total value of $624.7 million; (iii) 1,640 of the Late TTRs (totalling about $17.3 million) related to transactions with money laundering syndicates being investigated by the Australian Federal Police or accounts connected with those investigations; (iv) 6 of the Late TTRs related to 5 customers who CBA had assessed as posing a potential risk of terrorism or terrorism financing, [10]; (l) CBA lodged 2 of the Late TTRs with AUSTRAC on 24 August 2015, and the remaining 53,504 late TTRs on 24 September 2015: [10]; (m) CBA repeatedly failed to give suspicious matter reports (SMRs) to AUSTRAC either at all, or within the time required by s 41 of the AML/CTF Act, in some cases because it had adopted a policy of not submitting SMRs if the same type of suspicious behaviour had been reported any time within the 3 months prior and in some cases because no transaction monitoring alert had been raised, alerts had not been reviewed, CBA only partially notified its suspicious, or notifications by law enforcement of unlawful activity were ignored: [12] (n) CBA failed to monitor its customers with a view to identifying, mitigating and managing ML/TF Risk, including: (i) because in some instances no transaction monitoring alerts were raised for suspicious activity, and when alerts were raised they were not reviewed in a timely manner having regard to ML/TF risk (in many instances, not being reviewed for months after they were raised): [13]; (ii) because even after suspected money laundering or structuring on CBA accounts had been brought to CBA's attention (by law enforcement or through internal analysis), CBA often looked no further than whether or not to submit an SMR, and did not carry out mandatory enhanced due diligence as required (including terminating accounts), and when accounts were terminated customers were given 30 days' notice and permitted to transact on the accounts in the meantime: [14]; (o) CBA's failure to file TTRs and SMRs on time, or at all, had deprived AUSTRAC and other law enforcement and designated agencies of information, which delays and hinders law enforcement efforts, resulting in lost intelligence and evidence, further money laundering and lost proceeds of crime: [43]; (p) It was essential to the integrity of the Australian financial system that a major bank such as CBA had compliant and appropriate risk-based systems and controls in place to deter money laundering and terrorism financing, and the effect of CBA's conduct had exposed the Australian community to serious and ongoing financial crime: [44] 7 The events described in this paragraph of the statement of claim set the background for the present proceeding. The reference to ML/TF Risk is a reference to the risk that a reporting entity, such as CBA, may reasonably face that the provision by it of designated services might (whether inadvertently or otherwise) involve or facilitate money laundering or the financing of terrorism.

The statement of claim 8 The statement of claim in the present proceeding is structured in the following way: Paras 1 to 29 identify the parties and group members including, in the case of CBA, its relevant directors and officers; its business and brand; and the market disclosure regime, and the anti-money laundering and counter-terrorism financing regime, governing its activities. Paras 30 to 37 deal with AUSTRAC's commencement of the civil penalty proceeding and its announcement made on 3 August 2017; CBA's response to the announcement; and the price impact of the announcement, and CBA's response, on CBA's shares. Paras 40 to 49 plead that CBA was aware of certain information, referred to in the statement of claim as the Late TTR Information; the IDM ML/TF Risk Assessment Non-Compliance Information; the Account Monitoring Failure Information; the ML/TF Risk Systems Deficiency Information; and the Potential Penalty Information. The applicant pleads that CBA did not, at any time prior to 3 August 2017, make any statement which disclosed this information to the market (para 50). Paras 51 to 66 plead that CBA made certain representations to the market, which were to the effect that it had in place effective systems for ensuring compliance with relevant regulatory requirements (including the AML/CTF Act) and that its risk management systems had ensured appropriate monitoring and reporting of compliance activities (including compliance with the AML/CTF Act). Paras 67 to 68 plead that CBA continuously made representations throughout the Relevant Period that it was in compliance with its continuous disclosure obligations, which was itself a continuing representation throughout the Relevant Period. Paras 69 to 92 plead that, by failing to make certain disclosures, CBA contravened ASX Listing Rule 3.1 and s 674(2) of the Corporations Act 2001 (Cth) (the Corporations Act). The statement of claim identifies these contraventions as the Late TTR Continuous Disclosure Contraventions; the IDM ML/TF Risk Assessment Non-Compliance Continuous Disclosure Contraventions; the Account Monitoring Failure Continuous Disclosure Contraventions; the ML/TF Risk Systems Deficiency Continuous Disclosure Contraventions; the Potential Penalty Continuous Disclosure Contraventions; and the Combined Continuous Disclosure Contraventions. Paras 93 to 100 plead the applicant's case that CBA engaged in conduct that was misleading or deceptive, or likely to mislead or deceive, in contravention of ss 1041H(1) and 1041H(2)(b) of the Corporations Act; s 12DA(1) of the Australian Securities and Investments Commission Act 2001 (Cth); and/or s 18 of Schedule 2 of the Competition and Consumer Act 2010 (Cth). Paras 101 to 107 plead the applicant's case on loss or damage. 9 In relation to the Late TTR Information, the applicant pleads that CBA failed to give TTRs on time for tens of thousands of cash transactions of $10,000 or more processed through IDMs following the introduction of IDMs; the Late TTRs represented the vast majority of threshold transactions that occurred through CBA's IDMs; the Late TTRs had a total value in excess of $500 million; the Late TTRs were lodged significantly late; and there was a material risk or likelihood that some of the transactions the subject of the Late TTRs related to money laundering or terrorism financing (para 40). 10 In relation to the IDM ML/TF Risk Assessment Non-Compliance Information, the applicant pleads that CBA failed, in the period between the roll-out of CBA's IDMs in May 2012 and July 2015, to carry out an assessment of ML/TF Risk in relation to the provision of designated services through CBA's IDMs and failed to comply with the AML/CTF program (para 42). 11 In relation to the Account Monitoring Failure Information, the applicant pleads that, by June 2014, CBA had failed to conduct account level monitoring with respect to hundreds of thousands of accounts for a significant period of time (para 44). 12 In relation to the Potential Penalty Information, the applicant pleads that at all material times in the Relevant Period, CBA was potentially exposed to enforcement action by AUSTRAC in respect of allegations of serious and systemic non-compliance with the AML/CTF Act, which might result in CBA being ordered to pay a substantial civil penalty (para 48). 13 The focus of the present application is the applicant's pleading in para 46 of the statement of claim of the ML/TF Risk Systems Deficiency Information. At the commencement of the hearing, senior counsel for the applicant, Mr Moore SC, handed up a revised form of para 46 which contained amendments to overcome certain infelicities of drafting which, it seems, the applicant identified in the course of considering para 46 in the context of the present dispute. Argument on the present application proceeded on the basis of this revised pleading: 46 At all material times in the Relevant Period, CBA's systems for assessing, monitoring and managing ML/TF Risk and reporting transactions which may be affected by ML/TF Risk in relation to IDMs, and generally, were deficient (ML/TF Risk Systems Deficiency Information). Particulars i) The systems for assessing, monitoring and managing ML/TF Risk and reporting transactions which may be affected by ML/TF Risk were deficient by reason of the matters the subject of each and any combination of the Late TTR Information, the IDM ML/TF Risk Assessment Non-Compliance Information and the Account Monitoring Failure Information. ii) The systems for assessing, monitoring and managing ML/TF Risk and reporting transactions which may be affected by ML/TF Risk were also deficient in that: A) CBA adopted a policy of not giving suspicious matter reports to AUSTRAC pursuant to s 41 of the AML/CTF Act if a report had been given for the customer in question within the previous three months; B) CBA's system for reviewing transaction monitoring alerts and reviewing concerns raised by CBA employees about suspicious transactions was insufficient to give timely suspicious matter reports to AUSTRAC pursuant to s 41 of the AML/CTF Act; C) Where CBA decided to terminate a customer's account for suspected money laundering or terrorism financing, CBA gave the customer 30 days' notice and permitted ongoing transactions, including cash deposits and international transfers, on the account in the meantime; D) CBA's system for mitigating and managing the risk that its services (including IDMs) might involve or facilitate money laundering or financing or terrorism pursuant to s 36 of the AML/CTF Act was inadequate, in that in circumstances where CBA had identified a risk that a particular account was being used for money laundering or terrorism financing, CBA's system did not ensure that CBA took timely steps to verify the identity of the customer, verify whether the customer had a legitimate reason for depositing cash amounts or transferring such deposits out of the CBA, restrict transactions on the account or terminate the account. ii) The deficiencies had not completely been redressed: 9 August Announcement. 14 Initially, CBA read para 46 as confined to deficiencies in relation to its systems for assessing, monitoring, managing and reporting ML/TF Risk in relation to IDMs. However, in correspondence, the applicant said that para 46 should be read as an allegation that: CBA's systems for assessing, monitoring and managing ML/TF Risk and reporting transactions which may be affected by ML/TF Risk in relation to IDMs were deficient; and CBA's systems for assessing, monitoring and managing ML/TF Risk and reporting transactions which may be affected by ML/TF Risk were generally deficient. 15 This interpretation was advanced by the applicant in its submissions in the present application. In this connection, the applicant submitted that the first allegation is narrower than the second, in that the systems that are the subject of the first allegation are limited to CBA's ML/TF Risk systems insofar as they relate to IDMs. With this in mind, it seems to me that the word "generally" as used in para 46 is to be understood as qualifying CBA's "systems", not their alleged "deficiencies". In other words, the applicant does not allege that CBA's systems for assessing, monitoring and managing ML/TF Risk and reporting transactions were "generally" deficient but that CBA's systems, in general (not confined to IDMs), were deficient. 16 CBA complains that para 46 lacks clarity and is embarrassing.

CBA's submissions 17 First, CBA submitted that the systems said by the applicant to have been deficient - either in relation to IDMs or "generally" - have not been identified. CBA submitted that the pleading of para 46 leaves it in a position where it does not know which of its systems are, in fact, said to have been deficient. It submitted that it would be difficult, if not impossible, for it to be able to identify the extent of the evidence required to rebut the allegations made in the paragraph. It submitted that, potentially, it would be required to adduce evidence of every system it has which could touch on ML/TF Risk. CBA also submitted that it would be similarly difficult, if not impossible, for it to know the nature and extent of its discovery obligations. 18 Secondly, CBA submitted that the pleading does not explain how the (unidentified) systems should have operated or how they in fact operated. In other words, the "deficiencies" have not been sufficiently or appropriately identified, as such. According to CBA, all that the applicant has pleaded is, in substance, a conclusion (the systems were deficient); it has not pleaded the facts from which the conclusion is properly to be drawn. CBA submitted that the particulars to para 46 that have been provided, do not cure this problem. 19 Thirdly, CBA pointed to an apparent incongruity between the time period referred to in para 46 ("At all material times in the Relevant Period…") and the earlier time periods conditioning each component of the information making up the ML/TF Risk Systems Deficiency Information. 20 Fourthly, CBA submitted that the deficiencies in the pleading of para 46 have consequences for later allegations in the statement of claim, particularly in relation to CBA's alleged contravening conduct. 21 Fifthly, CBA submitted that the applicant's particularisation of an announcement made by CBA on 9 August 2017 is unclear given that (according to CBA) the announcement refers not to deficiencies in CBA's systems but the strengthening of CBA's policies and procedures. 22 Sixthly, CBA submitted that the applicant has failed to plead material allegations of fact. It is not enough to provide particulars when material allegations of fact should be pleaded.

Introduction 23 It is convenient to commence an analysis of para 46 by reference to the role that this allegation plays in the applicant's case. The applicant says that the allegation is informed by the particulars that have been given. So understood, para 46, in substance, contains a number of different allegations concerning deficiencies in CBA's systems for assessing, monitoring and managing ML/TF Risk, and for reporting transactions which may be affected by ML/TF Risk. 24 The respondent emphasised, and the applicant did not doubt, that the specification of the information of which, it is said, CBA was aware is critically important in a "non-disclosure" case. Thus, it is important that the pleading identify this information with appropriate precision because it is the starting point for determining whether, in light of its nature and character, each element was information that a reasonable person would expect to have a material effect on the price or value of CBA shares (within the meaning of ASX Listing Rule 3.1 and s 674(2)(c)(ii) of the Corporations Act), such that CBA came under an obligation to disclose it to the market.

The identification of the systems 25 I do not accept that para 46 of the statement of claim is deficient as a matter of pleading because it does not identify the systems that were allegedly deficient with the precision sought by CBA. The allegation is plainly directed to CBA's systems for assessing, monitoring and managing ML/TF Risk and for reporting transactions that might be affected by ML/TF Risk. CBA would be well aware of the systems that answer these general descriptions. The fact that CBA is able to identify such systems is implicit in its complaint that, potentially, it might be required to adduce evidence of every system it has which could touch on ML/TF Risk. Whether CBA chooses to adduce such evidence is a matter within its own forensic decision-making. But it does not follow that, as a matter of pleading, para 46 is deficient because of that circumstance. Provided the alleged deficiencies are properly identified, and otherwise properly pleaded, then para 46 will not fall foul of r 16.21(1) of the Rules because the systems are not more precisely identified. Further, if para 46 is properly pleaded, then questions touching on the scope of discovery can be considered in the context of case management generally.

The particulars given in para (i) to para 46 26 The applicant submitted that, although there was a difference in each of the time periods conditioning the Late TTR Information ("Prior to the Relevant Period …"), the IDM ML/TF Risk Assessment Non-Compliance Information ("… in the period… May 2012 and July 2015…") and the Accountant Monitoring Failure Information ("By June 2014…") - all of which predate the Relevant Period - and the time period specified in para 46 ("At all material times in the Relevant Period…"), the particularised allegation in para 46 of the statement of claim is to be read as referring to deficiencies in CBA's systems that continued in the Relevant Period. 27 I accept that this interpretation is one reading of para 46. However, I do not accept that the pleading of para 46 is, in this respect, unambiguous - especially when read with the paragraphs of the statement of claim on which particular (i) depends. 28 For example, para 40 pleads (amongst other things) that, prior to the Relevant Period, CBA failed to give TTRs on time, representing the vast majority of threshold transactions that occurred through CBA's IDMs. Despite the applicant's submission, by confining the pleading of para 40 in this way, it is not clear whether the applicant is alleging that, at all material times in the Relevant Period, CBA's systems for reporting continued to have the same deficiency, so that, throughout that period, CBA failed to give TTRs on time for tens of thousands of cash transactions of $10,000 or more processed through IDMs and that these represented the vast majority of threshold transactions that occurred through those IDMs in that period. 29 Similarly, in relation to para 42, CBA's alleged failure is that, in the period May 2012 to July 2015, it did not carry out an assessment of ML/TF Risk in relation to the provision of designated services through CBA's IDMs, with the consequence that, in that period, it did not comply with the AML/CTF program. There is no pleading that this alleged failure also occurred throughout the Relevant Period. Therefore, it is not clear whether the applicant alleges that, throughout the Relevant Period, CBA failed, contrary to its own AML/CTF program, to carry out an assessment of ML/TF Risk in relation to the provision of designated services through its IDMs, such that, at all material times in the Relevant Period, CBA's systems were deficient for this reason. 30 The same applies to para 44 of the statement of claim. It is not clear whether, despite the wording of para 44, the applicant alleges that, throughout the Relevant Period, CBA also failed to conduct account level monitoring with respect to hundreds of thousands of accounts, such that, at all material times in the Relevant Period, its systems were deficient for this reason. 31 If para 46 of the statement of claim is to be read in the way advanced by the applicant in submissions then, for the sake of clarity, the applicant should plead CBA's alleged failures, beyond the periods specified in paras 40, 42 and 44 of the statement of claim, by reference to material allegations of fact supported by necessary particulars, including, of course, CBA's awareness of those facts. If, on the other hand, para 46 is to be read with only the time periods in paras 40, 42 and 44 in mind then it is not clear how or why it is alleged that CBA's systems were deficient at all material times in the Relevant Period. Either way, the pleading is deficient.

The particulars given in para (ii) (first mentioned) to para 46 32 The particulars in para (ii) point to certain alleged deficiencies but, in general, do not go far enough to illuminate why it is said that the identified matters constituted deficiencies throughout the Relevant Period. This may be a simple matter to do - but it should, nonetheless, be done. The identified matters are not necessarily self-evident "deficiencies" in the relevant systems and a reader of the pleading should not be left to speculate why each identified matter was a "deficiency". I accept CBA's submission that, in the circumstances of the present case, it is necessary for the applicant to identify the relevant respects in which CBA's systems for assessing, monitoring and managing ML/TF Risk or, as the case might be, its systems for reporting transactions that may be affected by ML/TF Risk, should have operated; how these systems in relevant respects in fact operated; and thus how or why there was a "deficiency". This is critical to determining whether there was a "deficiency"; whether CBA was aware (in the relevant sense) of the "deficiency"; and, if so, whether that information was such that a reasonable person would expect it to have a material effect on the price of CBA shares.

The particulars given in para (ii) (second mentioned) to para 46 33 The relevance of the 9 August 2017 announcement referred to in this paragraph is not apparent, both as a matter of text and timing. If it is to be relied on, its significance to the allegation that "the deficiencies had not been completely redressed" - presumably in the Relevant Period - should be pleaded beyond the mere identification of the announcement.

Conclusion and disposition 34 Given the pleading deficiencies I have identified, I am persuaded that para 46 of the statement of claim should be struck out with leave given to the applicant to replead. I am not satisfied that the deficiencies can be overcome by merely requiring the applicant to provide further particulars of its allegations. 35 I should also record that I accept CBA's submission that the matters provided as particulars to para 46 should, strictly speaking, have been pleaded as material allegations of fact and not merely as particulars of an overarching allegation that CBA's systems were deficient. As I have noted, in substance para 46, when read with the particulars, contains a number of different allegations concerning deficiencies in CBA's systems for assessing, monitoring and managing ML/TF Risk, and for reporting transactions which may be affected by ML/TF Risk. I accept that, in some cases, the dividing line between "material allegations of fact" and "particulars" is not always clear cut. I also accept that, while under r 16.02 of the Rules the pleading party must state the material facts on which that party relies, the strictness with which the "rules of pleading" are required to be observed will vary depending on the case at hand. In this connection, I respectfully adopt Moshinsky J's discussion of the relevant principles and appropriate approach in Sadie Ville Pty Ltd v Deloitte Touche Tohmatsu (A Firm) [2017] FCA 1202 at [15]-[21] to which I was taken in oral addresses. Had this been the only objection raised in relation to para 46, I would not have been minded to strike out para 46. However, as matters have transpired, more significant deficiencies in pleading have been identified. 36 As CBA has succeeded in its application, the applicant should pay CBA's costs. I certify that the preceding thirty-six (36) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Yates.