Zonia Holdings Pty Ltd v Commonwealth Bank of Australia Limited

The proceedings 9 There are two proceedings before the Court that have been commenced under Pt IVA of the Federal Court of Australia Act 1976 (Cth). 10 The first proceeding is Zonia Holdings Pty Ltd v Commonwealth Bank of Australia Limited: VID 1085 of 2017 (the Zonia proceeding). The second proceeding is Philip Anthony Baron and Joanne Baron v Commonwealth Bank of Australia Limited: NSD 1158 of 2018 (the Baron proceeding). The Zonia proceeding was commenced as an "open" class action. The Baron proceeding was commenced as a "closed" class action (whose Group Members are those who had signed a funding agreement with Therium Australia Limited at the commencement of that proceeding). 11 For some time, the two proceedings were case-managed together. After a significant period of conferral between the applicants in each proceeding, interlocutory applications were filed seeking orders that the two proceedings be consolidated. This proposal was abandoned before the interlocutory applications were heard. The interlocutory applications were then amended, with leave, to seek (what were called) Cooperative Case Management orders. These orders were made over the Bank's opposition on 10 July 2019: Zonia Holdings Pty Ltd v Commonwealth Bank of Australia Limited (No 2) [2019] FCA 1061. 12 Amongst other things, the Cooperative Case Management orders provided for the filing of harmonised pleadings to ensure that the allegations against the Bank in each proceeding were substantially the same. The orders also provided that one set of counsel be briefed to represent the applicants and Group Members in each proceeding. 13 As a consequence, one case was presented against the Bank at the hearing. In these reasons, I have referred to this case as "the applicants' case". I have drawn distinctions between the applicants only when it has been necessary to do so. I have also referred to the final amended, but nevertheless harmonised, versions of the statements of claim filed by the applicants in their respective proceedings as, simply, "the statement of claim" and the defences filed by the Bank as "the defence".

The evidence 14 The applicants' case was advanced through documentary tenders and expert evidence. 15 The Bank's case was advanced through documentary tenders, lay evidence, and expert evidence responding to the applicants' expert evidence.

The Bank's lay evidence 16 As to the lay evidence, the Bank read affidavits by: (a) Ian Mark Narev, who was the Managing Director and CEO of the Bank and its related corporate entities (together, the Group) from 1 December 2011 until 8 April 2018; (b) Shirish Moreshwar Apte, who was, at relevant times, a non-executive director of the Bank and a member of the Risk Committee and the Audit Committee (both Board committees); (c) Mark Andrew Worthington, who was, from July 2010 to 31 March 2019, the Executive General Manager of Group Audit and Assurance (Group Audit) for the Bank (i.e., the internal Group Auditor); and (d) David Antony Keith Cohen, who was, at the time of hearing, the Bank's Deputy CEO. From February 2012 to June 2016, he was the Group's General Counsel and Group Executive (Group Corporate Affairs). From July 2016 to November 2018, he was the Group's Chief Risk Officer (CRO). 17 These deponents were cross-examined. 18 The Bank also read affidavits by Gopal Jana, Justin Jun-Ting Lee, Leisa Nicole Zaharis, Craig Bruce Woodburn, Prathish Jose, and Nada Novakovic, all of whom, at the time of the hearing, were employees of the Bank, and affidavits from Bryony Kate Adams, a partner in Herbert Smith Freehills, the solicitors for the Bank. These deponents were not cross-examined. 19 The Bank expected to read an affidavit by Sir David Hartmann Higgins who was, at relevant times, a non-executive director of the Bank and a member of Board committees, including the Risk Committee (from April 2016 until his retirement from the Board on 31 December 2019) and the Audit Committee (from October 2014 until March 2016). However, following my refusal of the Bank's application to permit him to give oral evidence by audio-visual link (Zonia Holdings Pty Ltd v Commonwealth Bank of Australia Limited (No 3) [2022] FCA 1323), Sir David's affidavit was not read. 20 The applicants advance a number of submissions criticising the evidence given by Mr Narev, Mr Apte, Mr Worthington, and Mr Cohen. 21 The applicants contend that Mr Narev's affidavit evidence provided "a selective account of events" that was "an elaborately crafted artifice". In closing submissions, they compared various passages in Mr Narev's affidavit with various passages in the transcript of his cross-examination in an endeavour to demonstrate what they saw to be inconsistencies in his evidence. The applicants went so far as to contend that Mr Narev's affidavit was "never a true or accurate reflection of his recollection of events or state of mind during the Relevant Period". 22 I do not accept these submissions. I do not consider the applicants' criticisms to be warranted. I found Mr Narev to be a sound witness who, in cross-examination, was prepared to revisit his affidavit and accept various propositions put to him. Generally speaking, I do not think that any matters of substance arose in the course of Mr Narev's cross-examination that revealed material inconsistencies with the matters to which he had deposed in his affidavit. On the whole, I accept Mr Narev's evidence. 23 The applicants contend that Mr Apte "had no genuine recollection of, or was not involved in, significant events during the Relevant Period". They contend that Mr Apte "did not appear to possess any memory of significant events immediately prior to or during the Relevant Period". They contend, further, that the opinions expressed by Mr Apte in his affidavit were "nothing more than self-serving submissions constructed after the fact". 24 I do not accept these submissions. Indeed, I think the applicants' criticisms of Mr Apte's evidence are unfair. I found Mr Apte to be a careful witness who attended to the detail of the questions put to him in cross-examination. I do not accept that he did not have, or did not appear to have, a memory of significant events during the time that he was a director of the Bank. I do not think that Mr Apte is to be criticised for making clear the limits of his memory of events that occurred a significant number of years before the hearing. Moreover, I do not consider it to be unusual that, as a non-executive director of the Bank, Mr Apte did not profess to have knowledge of some matters of detail that were put to him. On some occasions, Mr Apte made clear that he was not prepared to speculate on what his state of mind would have been on matters of which he had no actual knowledge. This, however, indicates the care with which Mr Apte attended to the questions put to him. On the whole, I accept Mr Apte's evidence. 25 The applicants contend that Mr Worthington's evidence had "little, if any, relevance to the issues in dispute in this proceeding" and that there were "inconsistencies between [his] affidavit and oral testimony". The applicants contend that Mr Worthington was "a wholly unimpressive witness" whose evidence should be disregarded. 26 I do not accept these submissions. I do not accept that Mr Worthington was "a wholly unimpressive witness" and do not understand why his evidence should be characterised as such. Mr Worthington's evidence was relevant and informative and, on the whole, I accept it. 27 The applicants contend that Mr Cohen's affidavit was "a carefully constructed artifice that did not withstand scrutiny during cross-examination". The applicants contend that because of "significant and numerous contradictions" revealed in Mr Cohen's cross-examination and "his frequently convoluted accounts in the witness box", the Court should not have "any confidence in the reliability or truthfulness of [his] evidence" which, according to the applicants, the Court should set aside save where Mr Cohen made admissions against the Bank's interests. 28 I accept that there were some concerning aspects of Mr Cohen's evidence. One such aspect was Mr Cohen's account of when he first learned of the late TTR issue - a significant matter discussed in greater detail below. In his oral evidence in chief, Mr Cohen corrected the statement he had made in his affidavit (to the effect that he became aware of this issue in October 2015). Mr Cohen said that, in preparing to give his oral evidence, it had become apparent to him that he had received a copy of a 6 September 2015 email referring to this issue and that a verbal disclosure of the issue was also made by Mr Toevs at a meeting of the Bank's Executive Committee on 17 September 2015 (Mr Cohen said that he had mistakenly thought that this disclosure had been made verbally by Mr Toevs at an Executive Committee meeting on 8 October 2015, but Mr Cohen later realised that Mr Toevs was not in attendance at that meeting). 29 In his oral evidence in chief, Mr Cohen said that he wanted to draw attention to these matters because his affidavit "might give the impression that the very first time I heard of the TTR issue was in October 2015". In that assessment, Mr Cohen was correct. I think this is how his affidavit reads. 30 When cross-examined on the correction, Mr Cohen maintained that his affidavit evidence was still correct because, in October 2015, he became aware that, in August 2015, the Bank had (as he said in his affidavit) identified "an error which had resulted in more than 50,000 threshold transaction reports … not being submitted to AUSTRAC through [the Bank's] intelligent deposit machines … within the required 10 day time frame …". In other words, although he had recently come to accept that he had had earlier knowledge of the late TTR issue, Mr Cohen only learned of the number of late TTRs in October 2015 and, to this extent, his affidavit was correct. 31 Mr Cohen was cross-examined on the truthfulness of the last-mentioned explanation. In closing submissions, his explanation was at the forefront of the applicants' contention that his evidence was unsatisfactory, and that his explanation had cast "doubt on both the accuracy of his recollections and his capacity to provide truthful evidence under oath". 32 I am not persuaded that Mr Cohen was being untruthful in defending his affidavit evidence. However, on this matter, I think that Mr Cohen's affidavit evidence was inadvertently incomplete on an important issue. Although Mr Cohen's affidavit evidence on this topic was not critical to establishing the Bank's awareness of the late TTR issue (because the Bank's own evidence was that Mr Narev and Mr Comyn were aware of that issue by 6 September 2015 at the latest), it was important in relation to events concerning the 2015 Entitlement Offer - another significant matter discussed in greater detail below. Uncorrected, the effect of Mr Cohen's affidavit was that, as Chairman of the due diligence committee appointed to oversee the 2015 Entitlement Offer, he did not know of the late TTR issue until after the final meeting of the committee on 17 September 2015 (the day before the shares under the offer were issued). Mr Cohen's inadvertence on this matter leads me to treat his evidence with some care on other topics he addressed. 33 The applicants also criticise Mr Cohen for the lateness of his correction. However, ultimately, nothing turns on this. I do not think it fell to Mr Cohen to decide when the correction to his affidavit should have been communicated to the applicants' legal representatives. 34 The applicants also submit that Mr Cohen's explanation for his correction was "conflicting, incoherent and garbled". I do not accept that submission. Mr Cohen's explanation was clear. 35 The applicants also criticise Mr Cohen's evidence that, as at 24 April 2017, the Bank's Executive Committee did not have sufficient information to warrant disclosure to the market of AUSTRAC's investigation into the Bank's non-compliance with the AML/CTF Act. In his affidavit, Mr Cohen provided reasons for that view. The applicants submit that, in cross-examination, Mr Cohen contradicted the reasons he had given. I am not persuaded that Mr Cohen's affidavit evidence was contradicted by his oral evidence in cross-examination. That said, the cross-examination did assist in putting Mr Cohen's affidavit evidence, on that topic, in context. 36 There are some other aspects of Mr Cohen's evidence on which I will comment in later paragraphs of these reasons. However, for present purposes it is sufficient for me to state that I do not accept that Mr Cohen's affidavit was "a carefully constructed artifice" or that, in cross-examination, he made "significant and numerous contradictions" or "frequently convoluted accounts in the witness box". Further, even though some aspects of Mr Cohen's evidence were qualified in cross-examination, I do not accept that I should set aside his evidence as unreliable or untruthful. On the whole, I found him to be a satisfactory witness although, as I will later explain, I do not accept all his evidence.

The applicants' submissions on inferences to be drawn 37 The applicants also contend that I should draw inferences that are adverse to the Bank's interests because of its failure to call certain witnesses. As a general observation, it is not clear to me what these witnesses could have added to what is already apparent from the extensive documentary record that is before the Court. 38 For example, the applicants point to the fact that the Bank did not call certain employees who (they say) could have given evidence concerning the late TTR issue in relation to events in 2013. I deal with these events in later sections of these reasons. In my view, the documentary record is clear. As will become apparent, my interpretation of that record does not accord with the applicants' interpretation. Therefore, I do not draw the inferences that the applicants say I should draw simply because the Bank did not call these employees to give evidence. 39 The applicants submit that I should draw certain inferences because the Bank did not call Mr Comyn as a witness (in the relevant period, Mr Comyn was the Group Executive for Retail Banking Services). However, the documentary record (as it relates to communications to and from Mr Comyn, or with which Mr Comyn was copied) is clear. The applicants do not suggest that the record is incomplete or contrived. The Bank does not suggest that Mr Comyn had an understanding of events that differs from the documentary record. There is, therefore, no reason why I should not take these communications at face value. 40 The applicants submit that I should infer that Mr Comyn was aware from October 2015 that "no … risk assessment had been completed since May 2012" in respect of the Bank's Intelligent Deposit Machines (IDMs) (as to which see [60] and [97] - [104] below). I am not prepared to draw an inference that adds to the evidence in that way. Even so, I do not see how this submission advances the applicants' case because, as I will later explain, it is not in doubt that the Bank knew in October 2015 that a separate risk assessment had not been carried out when IDMs were introduced in 2012. 41 The applicants also submit that I should infer that Mr Comyn was aware of the seriousness of certain matters communicated to him in emails of 23 June 2016 and 13 July 2016 in relation to a (first) notice given to the Bank under s 167 of the AML/CTF Act seeking the production of information and documents, and in an email dated 7 March 2017 relating to the outcome of a meeting between two employees of the Bank and AUSTRAC. Once again, the content of the emails is clear on the face of the documents themselves, and the Bank does not suggest that Mr Comyn had any view that differed from what the emails clearly say. 42 The applicants submit, further, that I should infer that Mr Comyn knew of, and was kept abreast of, an undertaking within the Bank called Project Concord and that Mr Comyn was concerned to manage reputational damage from the public disclosure of "AML issues" by AUSTRAC, "including by way of a penalty proceeding". Once again, I am not prepared to make an inference that adds to the evidence in that way. In any event, the evidence establishes, independently, that officers of the Bank knew the details of Project Concord, which is discussed in more detail below. 43 The applicants submit that I should infer that, in light of a proceeding commenced by AUSTRAC against Tab Limited, Tabcorp Holdings Limited, and Tabcorp Wagering (Vic) Pty Ltd (collectively, Tabcorp) (the Tabcorp proceeding), certain officers of the Bank (who were not called as witnesses) were concerned that civil penalty proceedings might also be commenced against the Bank for its breaches of the AML/CTF Act. However, as I will come to explain, the evidence already makes it abundantly clear that the Bank knew of the Tabcorp proceeding and that it was possible that civil penalty proceedings could also be commenced against it. Equally, the evidence makes it clear that AUSTRAC had informed the Bank on a number of occasions prior to 3 August 2017 that, if enforcement action were to be taken against the Bank: (a) AUSTRAC had a number of options available to it; (b) that AUSTRAC had made no decision on the question of enforcement action (including what, if any, enforcement option it might take); and (c) that AUSTRAC would give notice to the Bank before taking any enforcement action. 44 The applicants submit that I should draw certain inferences because the Bank did not call Ms Livingstone, the Bank's former Chair, as a witness. Again, I am not prepared to draw inferences that add to the evidence in the way that the applicants suggest. The documents on which they rely - a transcript of part of Ms Livingstone's evidence to the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (the Financial Services Royal Commission) and a copy of Ms Livingstone's file note of a meeting with Mr Jevtovic on 30 January 2017, also discussed below - are in evidence and speak for themselves.

The expert evidence 45 Expert evidence was given through the tender of expert reports (including joint reports) and orally in concurrent expert evidence sessions in which each of the participants was cross-examined. 46 The applicants called expert evidence from: (a) Professor Raymond da Silva Rosa, who is a Professor of Finance at the University of Western Australia's Business School. He is the Chair of the University's Academic Board and Council, a member of the Senate of the University, and a past-President of the Accounting and Finance Association of Australia and New Zealand. He has expertise in studying investor behaviour. He has co-authored research on the impact of Australia's continuous disclosure regime. He has also undertaken and published, in both academic and industry refereed journals, research on the appropriate way to measure investor reaction to corporate events, such as takeover announcements and the publication of substantial shareholder notices. He has lectured on Behavioural Finance (how psychology and economics explain investor behaviour). (b) Mr Rowan Johnston, who has expertise in arranging, managing, underwriting, and advising on share issues and engaging with market participants via a corporate advisory role. From 1987 to 2002, Mr Johnston worked at Deutsche Bank AG in Sydney and Hong Kong in Corporate Finance and then Equity Capital Markets, including some five or six years as Joint Head or Head of Equity Capital Markets in Australia. From 2003 to 2014, Mr Johnston worked at Greenhill (formerly called Caliburn Partnership Pty Ltd) with a focus on advising on capital raisings and sell-downs. Mr Johnston was formerly a corporate lawyer. (c) Professor Peter Easton, who is the Notre Dame Alumni Professor of Accountancy and Director of the Center of Accounting Research and Education at the Mendoza College of Business at the University of Notre Dame in the United States of America. Professor Easton has held a number of other academic positions in Australian and overseas universities. Over the past 40 years, his research has focused on the role of information in securities valuation and investors' decision-making. He has published numerous articles in peer-reviewed academic journals and several textbooks on these subjects. He has also served as editor of a number of peer-reviewed journals. His teaching, as well as a large part of his consulting activities, has involved the detailed analysis of complex accounting and valuation issues, forecasting future financial statements, determining the feasibility of investment opportunities, and exploring the link between financial statements and the value and viability of the underlying entity. (d) Mr Howard Elliot, who has expertise in the design and development of IT systems. 47 The Bank called expert evidence from: (a) Dr Sanjay Unni, who is a former academic with more than 30 years' experience. He has taught at the University of California, Berkeley, the University of Strathclyde, Glasgow, the University of Texas, and Southern Methodist University. He is the Managing Director of the Berkley Research Group. Dr Unni has expertise as a financial economist. (b) Mr Mozammel Ali who is a former investment banker with more than 25 years' experience in the financial services industry. He was a senior executive in the Corporate Finance division of Deutsche Bank AG, including in the Financial Institutions Group and the Capital Markets and Treasury Solutions team. He was also Head of Capital Solutions. Before then he was employed by Citibank advising on mergers and acquisitions, and capital raising transactions. Mr Ali has expertise in equity capital markets. (c) Mr David Singer, who is a former investment banker with more than 25 years' experience. Mr Singer was the Managing Director and Head of Sales Trading at UBS Securities Australia. In that employment, he was active in the market speaking to investors, trading shares (including CBA shares) and making assessments on a day-to-day basis as to the information that was material to investors' decisions. (d) Mr Shane Bell, who is a partner in McGrathNicol. Mr Bell is a technology and cybersecurity expert, and a certified computer examiner. 48 The parties advanced criticisms of the evidence given by the opposing experts. I do not propose to deal with these criticisms seriatim. It is sufficient for me to record that, contrary to some of the submissions that were advanced, I found each expert to be a satisfactory witness whose analysis and opinions provided assistance in elucidating the issues before the Court that were within his field of expertise. I discuss the expert evidence in some considerable detail in later sections of these reasons, including the extent to which I accept that evidence. The fact that I have not accepted a particular expert's opinion is not intended to reflect, and should not be taken as reflecting, adversely on that witness's competence.

The Bank 49 The Bank is, and was at all times relevant to this proceeding, Australia's largest bank. For the years ended 30 June 2014 to 30 June 2017 (a period covering, substantially, the relevant period), the Bank's total annual income was between $22 billion and $26 billion; its profit was between $8.6 billion and $9.9 billion. It employed approximately 52,000 staff members. 50 The Bank operates (and, in the relevant period, operated) in a highly regulated market and processes a large volume of domestic and cross-border transactions. The Bank's own estimate is that it has "visibility" of around 40% of all financial transactions in Australia. According to the Bank, one in two inbound cross-border commercial payments are destined to its account holders. 51 The Bank is required to monitor all these transactions under AML/CTF legislation, to which I will refer in more detail. For present purposes, it is sufficient to record that, as at May 2015, the Bank was monitoring approximately 7 million transactions per day with a value of $219 billion. At that time, peak volumes stood at 16 million transactions per day with a value of $570 billion. As at June 2016, the Bank was monitoring over 8 million transactions per day with a value of $300 billion. As at April 2017, the Bank was reporting approximately 3.1 million International Funds Transfer Instructions (IFTIs), 800,000 Threshold Transaction Reports (TTRs), and almost 9,000 Suspicious Matter Reports (SMRs) to AUSTRAC each year.

AML/CTF legislative regime 52 The Bank is, and was at all times relevant to this proceeding, licensed to carry on banking business in Australia and authorised to take deposits from customers as an Authorised Deposit-Taking Institution (ADI) under the Banking Act 1959 (Cth). It was subject to the AML/CTF Act and the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (Cth) (the AML/CTF Rules). 53 The AML/CTF Act imposes obligations on ADIs which provide "designated services". These services are defined in s 6 of the AML/CTF Act. A "designated service" includes opening an account or allowing a transaction to be conducted in relation to an account. A person who provides a "designated service" is a "reporting entity": s 5. 54 Part 3 of the AML/CTF Act contains reporting obligations for reporting entities. Relevantly to this proceeding, one obligation is to report a "threshold transaction" (as defined in s 5) to the CEO of AUSTRAC (the AUSTRAC CEO): ss 43(2)-(3). A "threshold transaction" includes, for example, a transaction involving the transfer of physical currency, where the total amount of physical currency transferred is not less than $10,000. I will refer to these reports as "TTRs", in accordance with what appears to be the commonly used acronym for these transactions. Section 43(2) is a civil penalty provision: s 43(4). The obligation to report threshold transactions features prominently in this case. 55 Section 81(1) of the AML/CTF Act provides that a reporting entity must not commence to provide a designated service to a customer if the reporting entity has not adopted and maintained an anti-money laundering and counter-terrorism financing program that applies to the reporting entity. Section 81(1) is a civil penalty provision: s 81(2). The program can be a standard AML/CTF program, a joint AML/CTF program, or a special AML/CTF program: s 83(1). The Bank adopted and maintained a joint anti-money laundering and counter-terrorism program. Such a program is divided into two parts - Part A (general) and Part B (customer identification): s 85(1). 56 The primary purpose of Part A is to identify, manage, and mitigate the risk that a reporting entity may reasonably face that the provision of designated services at or through its Australian operations might involve or facilitate money laundering or the financing of terrorism: s 85(2)(a). Section 82(1) provides that a reporting entity must comply with Part A of the program. Section 82(1) is a civil penalty provision: s 82(2). The Bank's compliance with Part A of its program also features in this case. 57 The sole or primary purpose of Part B is to set out the applicable customer identification procedures for the purpose of the application of the Act to customers. Part B must comply with the requirements of the AML/CTF Rules: s 85(3).

The Bank's Joint Anti-Money Laundering and Counter-Terrorism Program Part A 58 Part A of the Bank's program provided that the program would be implemented and monitored in accordance with its Group Compliance Risk Management Framework and Group Operational Risk Management Framework. 59 In relation to risk identification and assessment, Part A provided that the Group must conduct an assessment of Money Laundering and Terrorism Financing (ML/TF) risks faced by members of the Group and maintain a current assessment, with changes in risk recognised and assessed. Each Business Unit or Designated Business Group (where the reporting entities in the Group were related to each other) was required to conduct an assessment, using the Group's ML/TF Risk Assessment Methodology (or another appropriate and approved method), of the inherent ML/TF risk posed by (a) each new designated service prior to introducing it to the market; (b) each new method of designated service delivery prior to adopting it; and (c) each new or developing technology used for the provision of a designated service prior to adopting it. Further, periodic reviews were to be carried out at least every two years. 60 The applicants contend - and it is not disputed - that the "IDM channel" rolled out by the Bank in 2012 (see [97] - [104] below) fitted these descriptions: it was (at least) a "new method of designated service delivery" or a "new or developing technology used for the provision of a designated service".

The Group Compliance Risk Management Framework 61 The Group Compliance Risk Management Framework (CRMF) was directed to the risk of legal and regulatory sanctions, material financial loss, or loss of reputation that the Group might incur as a result of its failure to comply with the requirements of relevant laws, industry and Group standards and policies, and codes of conduct. Compliance risk is also known as regulatory risk. 62 One of the Group CRMF principles concerned monitoring and measuring. The principle was expressed as: Transparency around compliance incidents, control weaknesses and framework effectiveness will be maintained, including timely escalation and reporting. 63 In this regard, the framework also provided that: Issues or incidents must be reported in accordance with the relevant incident and issue procedures. 64 It is appropriate to mention here that, in relation to monitoring and measurement, the Bank adopted a "Three Lines of Defence" model (the 3LoD model) under which the accountability for the management of risk fell primarily (the first line of defence) to business management to ensure effective compliance risk and incident management within their operations, with the second line of defence falling to (a) Business Units to establish and maintain an effective Business Unit CRMF and compliance control infrastructure, and to monitor compliance consistent with that framework; and (b) Group Compliance to monitor and report on compliance risk management across the Group, raising issues where necessary and reporting to senior management, the Risk Committee, and the Board. The third line of defence was Group Audit and External Audit to conduct independent audits of the implementation, condition, maintenance, and management of the Group CRMF. 65 On 3 November 2015, following the findings of the transaction monitoring program (TMP) review report, the 2013 audit report, and the 2015 audit report (discussed at [170] - [221] below), a briefing paper was prepared for Mr Narev which discussed "a range of potential options" in relation to improvements in the Bank's 3LoD model from "tactical adjustments" to "major structural shifts". It would seem that Mr Narev (and perhaps others) had arrived at the view that the Bank's implementation of the then current 3LoD model was neither effective nor efficient and that this state of affairs was not acceptable. These issues led to Project Trifecta, which was a redesign of the Bank's 3LoD model. 66 On 16 November 2015, Mr Toevs (who, at the time, was Group CRO) and Mr Dingley (who, at the time, was Chief Operational Risk Officer) presented a proposal to the Bank's Executive Committee containing three options. The recommended option was a centralisation of specific functions (as opposed to full centralisation (Option 2) or a global model (Option 3)). In March 2016, Mr Toevs circulated a further proposal, which he described as "an iteration of an option presented in the original Trifecta strategy presentation last year" and which included a proposal to create a "Financial Crime Centre of Excellence".

The Compliance Incident Management Group Policy 67 As part of the Group CRMF, the Bank adopted a Compliance Incident Management Group Policy. It was identified as a key component of the framework. The purpose of the policy was to establish principles in relation to identifying, assessing, and managing compliance issues, and outlining the requirements with respect to the regulatory reporting of compliance issues. 68 The policy identified a compliance issue as an actual, suspected, likely, or imminent contravention of an obligation of any applicable law, regulation, industry standard, industry code, or external business rule or guideline (such as the ASX Listing Rules). The policy identified a reportable breach as a compliance incident which had been assessed and had been determined as being reportable to a regulator. 69 Paragraph 5.1 of the policy principles provided: 5.1 BUs must develop and maintain up to date and approved procedures that are clear, well-understood and document the process for: • Identifying compliance incidents or likely compliance incidents; • Assessing all compliance incidents; including determining if they are reportable breaches; • Reporting and escalating compliance Incidents, ensuring the relevant people including those responsible for compliance, are made aware of compliance incidents and reportability; and • Rectifying and resolving compliance incidents. 70 RiskInSite was the Group's integrated system which provided a common platform for managing operational risk and compliance risk across the Group. The policy provided that all compliance risk incidents were to be accurately recorded and maintained in RiskInSite, with the expectation that such incidents would be recorded within a maximum of five business days of discovery.

AUSTRAC's powers 71 AUSTRAC has certain investigative powers. Under s 202(2) of the AML/CTF Act, the AUSTRAC CEO (or another person authorised by s 202(1)) can give a written notice to a person (who the AUSTRAC CEO or another authorised person believes, on reasonable grounds, is a reporting entity) requiring the person to give information or produce documents relevant to: (a) determining whether the person provides designated services at or through a permanent establishment in Australia; (b) ascertaining details relating to any permanent establishment in Australia at or through which the person provides designated services; and (c) ascertaining details relating to designated services provided by the person at or through a permanent establishment of the person in Australia. However, such a notice can only be given where, on reasonable belief, the notice is required to determine whether to take action under the AML/CTF Act or in relation to proceedings under that Act: s 202(3). 72 Under s 167 of the AML/CTF Act, the AUSTRAC CEO (or another authorised officer, as defined in s 5) can give written notice to certain persons, including a reporting entity, to give information or to produce documents where, on reasonable belief, the person has information or a document that is relevant to the operation of the AML/CTF Act, the Anti-Money Laundering and Counter-Terrorism Financing Regulations (Cth) (when in force) (the Regulations), or the AML/CTF Rules. In the present case, notices were given to the Bank under this provision, in the circumstances discussed below. 73 There are a number of avenues open to the AUSTRAC CEO where non-compliance with the AML/CTF Act, Regulations, or AML/CTF Rules has occurred. 74 First, no formal action need be taken. AUSTRAC may engage with the reporting entity on an informal basis to remedy the non-compliance. 75 Secondly, if there are reasonable grounds to think that there has been a contravention of an "infringement notice provision" (defined in s 184(1A)), the AUSTRAC CEO (or another authorised officer) can issue an infringement notice under s 184(1) requiring payment of a penalty. 76 Thirdly, the AUSTRAC CEO can give a remedial direction under s 191(2) of the AML/CTF Act if satisfied that a reporting entity has contravened, or is contravening, a civil penalty provision. The written direction requires the reporting entity to take specified action directed towards ensuring that the entity does not contravene the civil penalty provision, or is unlikely to contravene the civil penalty provision, in the future. 77 Fourthly, the AUSTRAC CEO can accept enforceable undertakings under s 197 of the AML/CTF Act to the effect that a person will take specified action or refrain from taking specified action in order to comply with the AML/CTF Act, Regulations, or AML/CTF Rules, or will take specified action directed towards ensuring that the person does not contravene, or is unlikely in the future to contravene, the AML/CTF Act, Regulations, or AML/CTF Rules. The breach of such an undertaking can result in proceedings being taken against the person for certain relief: see s 198. 78 Fifthly, if the AUSTRAC CEO has reasonable grounds to suspect that a reporting entity has contravened, is contravening, or is proposing to contravene the AML/CTF Act, Regulations, or AML/CTF Rules, a written notice can be given under s 162 of the AML/CTF Act requiring the reporting entity to appoint an external auditor to carry out an audit of, and report on, the reporting entity's compliance with the AML/CTF Act, Regulations, or AML/CTF Rules. 79 Sixthly, the AUSTRAC CEO can commence proceedings under s 175 of the AML/CTF Act seeking a civil penalty order for the contravention of a civil penalty provision. 80 In its published Enforcement Strategy 2012 - 2014, AUSTRAC stated that it generally chooses to use a supervisory approach to secure reporting entity compliance before proceeding to "more formal enforcement activities". AUSTRAC referred to its supervisory activities as having "three levels of intensity: (a) low intensity or "engagement" activities (such as by providing information and tools to enable reporting entities to comply with their obligations); (b) moderate intensity or "heightened" activities (such as behavioural assessments, desk reviews, and themed reviews directed at specific behaviours); and (c) high intensity or "escalated" activities (such as providing tailored on-site activities designed to have a direct impact on improving compliance outcomes). 81 AUSTRAC said: While AUSTRAC prefers to engage and work cooperatively with reporting entities, where these activities do not result in improved compliance, matters are referred to AUSTRAC's Enforcement team for consideration of enforcement action. 82 I observe that this statement implies that, certainly at that time, enforcement action would not necessarily ensue simply because a matter had been referred to AUSTRAC's enforcement team. Moreover, enforcement action did not necessarily mean applying for a civil penalty order. 83 Before 3 August 2017, AUSTRAC had taken 33 enforcement actions. Only one was for a civil penalty order, namely the Tabcorp proceeding, which I discuss below. This action was taken in July 2015 with a civil penalty order for $45 million made by this Court on 16 March 2017. The rest of the enforcement actions involved remedial directions (four cases); the issuance of an infringement notice (four cases); the acceptance of enforceable undertakings (15 cases); and the appointment of an external auditor (nine cases).

The Bank's dealings with AUSTRAC immediately before the relevant period 84 As at March 2012, the Bank's dealings with AUSTRAC were managed through the Group's AML/CTF Compliance Officer. In a briefing to the Bank's Board on 13 March 2012, this relationship was described as "transparent and open" which had enabled the Bank and AUSTRAC "to work collaboratively through a number of AML/CTF issues". The Bank and AUSTRAC met once a month to discuss improvements to the Bank's AML/CTF Program, including quality assurance initiatives on transaction reporting, and progress on open audit items. AUSTRAC also audited the Bank annually. 85 On 16 July 2012, the Bank's Risk Committee was informed that AUSTRAC had conducted its annual audit for 2012 of the Group's AML/CTF Program and had verbally communicated that it had not identified any material issues with that program. 86 At a meeting on 28 June 2012, the Bank's Group Head of AML/CTF and Sanctions, Mr Byrne was informed that AUSTRAC was looking to move to 18 month review periods for the Bank (whereas other banks would be getting three to four reviews per year). 87 AUSTRAC conducted a two-day onsite audit on 19 and 20 November 2013. A Senior Manager provided the Bank with a "high level debrief" during which the Bank was informed that AUSTRAC was "extremely pleased with the process, collaboration and availability of people and systems". AUSTRAC had picked up some "minor errors" and "a few issues" but "nothing systemic" and "nothing serious". It seems that AUSTRAC indicated that an initial draft of its report would be provided before Christmas 2013, with the Bank given a period of approximately one month to provide comments. 88 At what appears to have been a follow-up meeting on 19 February 2014, AUSTRAC explained that the language used in a letter accompanying its audit report may have come across in "somewhat a terse manner". However, as understood by the Bank, AUSTRAC attributed this to the fact that "some institutions [had] not proved as collaborative as [the Bank] so AUSTRAC has 'hardened' its language in formal communications to all entities for consistency". 89 These interactions support the proposition that, before the relevant period, the Bank enjoyed a collaborative, business-like relationship with AUSTRAC that appears to have been free of significant non-compliance issues. 90 Mr Narev gave evidence that, at a meeting with Mr Jevtovic (then the new AUSTRAC CEO) on 19 December 2014 (held in Mr Narev's office), Mr Jevtovic told Mr Narev that there was a "strong relationship" between AUSTRAC and the Bank and that Mr Jevtovic had received "positive feedback" from his team about the Bank. According to Mr Narev, Mr Jevtovic told him that there had been some "minor issues" but these "had always been remedied quickly".

The Bank's IT environment, processes and procedures 91 It is appropriate at this stage to say something briefly about the Bank's information technology (IT) environment. 92 At relevant times, the Bank operated an IT environment of scale and complexity, characterised by a large number of interconnected IT enterprise systems and a large number of internal IT and system support staff. Support was also provided by a large number of external service providers who provided services ranging from system development to day-to-day support. 93 Complex IT environments are prone to possible issues or errors during their life cycles. These issues or errors are driven by various factors. System interdependencies can be affected by upstream changes which can impact information flows and the downstream interpretation of data. Knowledge gaps can occur with system specific teams not having an holistic view of the enterprise architecture and structure. Issues and errors can arise from the requirement to support, update, or replace legacy systems. There may also be dependencies on external service providers, rather than internal staff members, to implement change appropriately. 94 As to complex systems within an IT environment, Mr Elliott and Mr Bell agreed that: … a complex system within an IT environment … consists of a series of steps or events, perhaps with many inputs and outputs. Complex process steps often rely on previous steps to have completed in a specific order and with a specific result in order to determine the next step. Sometimes complex processes may have to deal with many external events, sometimes being introduced randomly. 95 I discuss in more detail below some of the Bank's IT processes that are of particular relevance to this proceeding. 96 Mr Elliott and Mr Bell agreed that organisations such as the Bank, operating within a regulatory environment with compliance obligations, will often call upon numerous frameworks to help them achieve enterprise governance of IT. The Bank had various governance frameworks (broader than IT alone) to assist it in achieving its regulatory requirements and obligations. I have referred to some of them above (being those that are more relevant than others to the issues canvassed in this proceeding). As Mr Elliott and Mr Bell also recognised, the Bank's approach to governance involved an internal audit and assurance capability. I will discuss the output of that capability in later sections of these reasons.

IDMs 97 IDMs are a type of automated teller machine (ATM) with additional functionality. They are part of the Bank's NetBank platform. IDMs allow customers to deposit cash or cheques into their accounts without the need to enter the branch itself. Cash deposits are automatically counted and credited instantly to the nominated recipient account. This means that these funds are then immediately available for transfer to other domestic or international accounts. 98 During the relevant period, the Bank's IDMs could accept up to 200 notes per deposit (i.e., up to $20,000 per cash transaction). The Bank did not limit the number of IDM transactions a customer could make each day. A card was required to activate and make a deposit through an IDM. The card could be issued by any financial institution, but the funds could only be deposited to one of the Bank's account holders. 99 The IDM channel favours anonymity and there is no mechanism to identify the person who activates the machine and performs the transaction. IDMs can also be used to structure transactions in which large cash amounts can be deposited in smaller quantities. IDMs present a high inherent ML/TF risk. When challenged with the proposition that IDMs present a higher risk profile than ATMs, Mr Narev said that the risk with IDMs was different to the risk with ATMs which was worthy of, or required, separate consideration. 100 The Bank began rolling out its fleet of IDMs in around May 2012. At the commencement of the relevant period (16 June 2014), the Bank had 245 active IDMs and 3,147 active ATMs. At the end of the relevant period (3 August 2017), the Bank had 904 active IDMs and 2,522 active ATMs. 101 Before rolling out the IDMs in May 2012, the Bank did not conduct a formal risk assessment in relation to the designated services provided through this channel. The Bank accepts this fact, and also that such an assessment was not made before July 2015. It accepts that, by not conducting the required risk assessment before rolling out the IDMs, it failed to comply with its AML/CTF Program. I will refer to this as the IDM ML/TF risk assessment non-compliance issue. 102 This is not to say, however, that the Bank did not have regard to AML/CTF risks in respect of IDMs at the time they were rolled out. In a business requirements document, the Bank considered the need to report threshold transactions to the AUSTRAC CEO and the means by which this would be done through IDMs. TTR reporting and transaction monitoring were considered to be mandatory requirements as part of the IDM roll out project, and TTR reporting functionality was built and linked to IDMs. IDM deposits were also linked to automated transaction monitoring rules that targeted certain practices. 103 The Bank also gave specific consideration as to whether to impose limits of less than $10,000 on the amount of cash deposits that could be made through IDMs, but decided against this on the basis that, by doing so, the Bank might encourage "structuring activity". 104 The Bank completed its first formal risk assessment of IDMs on 14 July 2015. This assessment was carried out following inquiries from "law enforcement agencies", not AUSTRAC. Following that assessment, the IDMs were rated as "high risk". However, transaction monitoring was in place and, based on its performance as at 28 July 2015, was considered (by the Bank) to be "working well". No further controls were envisaged as necessary at that time. A further risk assessment was carried out in July 2016.

The Bank's TTR processes 105 As I have noted, a "threshold transaction" is a transaction with a cash component of not less than $10,000 in respect of which the Bank is required to submit a TTR to the AUSTRAC CEO. 106 During the relevant period, there were two main ways in which a threshold transaction could occur at the Bank. First, by cash deposit or cash withdrawal at one of the Bank's branches through its "over-the-counter" system. Secondly, by cash deposit into an IDM. 107 Data with respect to a threshold transaction "flowed" from the relevant "input" through various systems within the Bank before a TTR was submitted to the AUSTRAC CEO. These "flows" involved real-time data flows (i.e., data which flowed almost instantaneously) and batch data flows (i.e., data which flowed periodically and which, typically, included data about batches of multiple transactions). 108 The Group Data Warehouse (GDW) was one of the systems within the Bank involved in the TTR process. It stored data relating to the Bank's customers, their accounts, and their transactions. As its name suggests, it was the largest system within the Bank, storing current and historical data for millions of customers in relation to a range of products across the Bank. 109 The systems used in the TTR process connected with other systems across the Bank, such as the Bank's financial crimes systems. These systems included the Financial Crime Platform (FCP) (described in more detail below at [144] - [154]) and Real Time Transaction Monitoring (RTTM). The FCP was used for functions such as sanctions screening, account monitoring, and fraud monitoring. RTTM monitored for fraud in real-time. Its functions included payment and card screening, such as to detect a fraudulent transaction on a customer's credit card. Because of the sensitivity of their functions, access to these systems and their data was restricted to a limited number of the Bank's personnel. 110 The TTR process did not involve data flowing directly to AUSTRAC. Rather, there were a number of intermediate systems which involved a combination of real-time and periodic batch data flows. This meant that there was not a single, uniform TTR process which applied to all transactions. There were separate TTR processes depending on the input used and the nature of the transaction. Further, not all transactions processed through an IDM or "over-the-counter" involved threshold transactions. 111 The Bank used transactional data, including about threshold transactions, for a multitude of purposes in addition to threshold transaction reporting, such as: (a) crediting and debiting customer accounts to reflect the transaction; (b) monitoring transactions for fraud and anti-money laundering (AML) purposes as part of the Bank conducting its own monitoring of transactions for suspicious matters; and (c) customer reporting, customer support, and suggesting ways to improve customers' financial well-being. 112 Therefore, many of the intermediate systems used as part of the Bank's TTR processes also formed part of other processes within the Bank. This meant that common systems contained data which was unrelated to TTRs. In addition to TTR data flows, data from these common systems was exported to other intermediate systems across the Bank which were wholly unrelated to TTRs. Thus, there was a "web" of data flows. TTR processes were just one component of these flows. 113 Data was not stored in a uniform format in all systems. As data flowed downstream, it was filtered and re-formatted as necessary before being sent to the next system. As a result, whilst some irrelevant data flowed downstream, not all data compiled about a transaction at the input stage flowed downstream to the various intermediate systems involved in the Bank's TTR processes. As data did not necessarily remain in the same format from system to system, comparing data at the start of the process with data at the end of the process was not a "one-for-one" comparison. 114 Further, the timing of data flows differed according to the type of transaction. Deposits were processed differently depending on whether they related to a debit account or a credit account. In the case of a debit account, the deposit was credited to the relevant account in real-time. In the case of a credit account, the deposit typically settled the following business day. There was, therefore, a lag between the time of the transaction and the time at which the data hit the GDW. This impacted the timing of submitting a TTR to AUSTRAC because the TTR was only generated once the deposit settled, which, in the case of a transaction on a credit account, could be days later (depending on when the transaction occurred and when the settlement occurred). 115 Deposits in IDMs involved other complexities, such as where cash was not removed from a component of the IDM within the "timeout period" (for example, when the deposited cash was held together by a clip or a rubber band). This led to a "failed" transaction in which the cash was directed to a "retract canister" within the IDM. When this happened, the cash "deposited" was not identified and counted for the purposes of the Bank's automated systems. Such transactions were identified by a customer reporting the failed transaction in a Branch or by the staff within the Branch (in which the IDM was located) identifying the failed transaction from the IDM's end of day balance. The process of identifying the failed transaction could be complicated because the retract canister could contain other cash. In order to process a failed transaction, Branch staff typically pay the relevant funds to the customer through an electronic funds transfer, which was not processed as an IDM transaction. 116 Of central importance to the present case is an issue concerning the late reporting to the AUSTRAC CEO of threshold transactions through IDMs. When the IDMs were introduced, the Bank's processes relied on two transaction codes to generate TTRs (codes 5022 and 4013). However, in November 2012, the Bank introduced an additional transaction code (code 5000) for a sub-set of IDM transactions to clarify a deposit message that was visible to customers via the NetBank platform. The new transaction code fixed the message problem, but it was not factored into the downstream process by which threshold transactions were identified for reporting. In short, a "flag" in the system for TTR reporting was missing. 117 This problem was not discovered, and its implications brought home to officers of the Bank, until much later. It is certainly the case, however, that, much earlier in 2013, a potential problem, with an association with code 5000, was identified by the Bank's staff, but regrettably not fully investigated and rectified. It is necessary to turn, now, to the circumstances in which this occurred.

Enquiries in 2013 118 On 29 August 2013, a Compliance Executive employed by the Bank in the AML Sanction section of Risk Management in Retail Banking Services (RBS), Mr Kalra, sent an email to employees responsible for the GDW seeking confirmation that TTRs were being lodged for cash deposits made through IDMs. The evidence does not suggest that this original inquiry was connected with transaction code 5000. Indeed, the applicants' expert, Mr Elliott, made it clear that "this internal issue was not specifically related to transaction code 5000". 119 On the same day, a Senior Technical Business Analyst, Mr Ashdown (who had done work on extracting TTRs from the GDW), responded to this inquiry by confirming that cash deposits through IDMs were included in TTRs. However, Mr Ashdown raised a concern about whether the cash component of "mixed deposits" (i.e., deposits involving cash and cheques), where the cash component was a threshold amount ($10,000 or more), was being reported. The reason for raising this appears to have been Mr Ashdown's understanding that, during his involvement in working on the "TTR extract", IDMs "couldn't do mixed deposits". He did not know "if the functionality was ever developed". 120 This information prompted Mr Kalra to request that an investigation be conducted: … It has come to my attention that Threshold Transaction Reports (TTR) may not be getting lodged for mixed deposits (cash + cheque) made via the Intelligent Deposit Machines (aka IDA or IDM). [I'm assuming the IDM's would sit under the D&T world.] As per below email from the Group Data Warehouse (GDW) team, they have confirmed that if cash deposits of $10k or more are accompanied with a cheque deposit, no TTR is lodged for the cash component. Regulatory requirement is that any transactions in physical currency of $10k or more are supposed to be lodged as a TTR to AUSTRAC. Therefore if what the GWD team is saying is correct, then there may have been some breaches. Can I please request you to check this process and confirm? … 121 Later, on 3 September 2013, Mr Kalra raised a further query - whether cash deposits in IDMs using an OFI (Other Financial Institution) card were being reported. 122 The context for each of Mr Kalra's queries was an upcoming on-site audit by AUSTRAC. 123 A Service Manager in Retail & Business Banking Enterprise Services, Mr Wright, provided a response to Mr Kalra on 4 September 2013. In relation to the question whether there were "(a)ny cash deposits for which TTRs are not currently reported?", Mr Wright responded: Would appear yes based on this issue being raised. 124 Properly considered, this answer does not evidence Mr Wright's knowledge, or indeed any other employee's knowledge, that these cash transactions were not being reported. Indeed, it was not a substantive answer to Mr Kalra's question. Self-evidently, Mr Wright's answer was no more than the unhelpful comment that, because a query had been raised by Mr Kalra, it "appeared" that there were cash deposits for which TTRs were not being given. 125 It is clear that, at this time, two issues had been raised: whether (a) the cash component of a "mixed deposit" and whether (b) cash deposited using an OFI card (in each case, using an IDM to deposit a threshold amount), were being reported. 126 On about 12 September 2013, Mr Kalra escalated these matters to Ms Ishlove-Morris (the Executive Manager AML/CTF & Sanctions, Group Operational Risk & Compliance, Risk Management) and Mr Byrne. In doing so, he informed Ms Ishlove-Morris and Mr Byrne that "(t)he business is checking to confirm whether or not this is actually an issue or not". 127 There are emails in evidence whose language can be interpreted as stating that, at this time, TTRs were not being provided when they should have been. However, when these emails are read in the context of accompanying emails, it is tolerably clear that Mr Kalra was raising a potential problem and escalating it to those who had an interest in knowing whether there was an actual problem, as Mr Kalra's email to Ms Ishlove-Morris and Mr Byrne makes clear. 128 On 19 September 2013, Mr Kalra was informed by Mr Razdan, a Project Manager in Retail Banking Enterprise Services that, in fact, cash deposits using an OFI card were being reported. 129 Separately, on the same day, Mr Ashdown informed Mr Kalra that "the TTR report is reporting the Mixed Deposits". In somewhat chastising language, Mr Kalra responded: Mark - I thought you'd initially mentioned that for mixed deposits, TTR's weren't being generated even for the cash component and that's why I escalated this issue to the business. Can you please double check again and confirm once and for all? 130 Later that day, Mr Ashdown replied: I didn't know whether they were being reported - that was the issue. I can confirm they are being reported … 131 Having escalated the matter to Ms Ishlove-Morris and Mr Byrne, Mr Kalra then sent an email to Ms Ishlove-Morris on 19 September 2013, stating: After email chains floating around the world, GDW team have come back and confirmed that TTR's are being reported for all relevant cash deposits (whether mixed or individual) and there's no issue. So we don't need to report anything to AUSTRAC. 132 Ms Ishlove-Morris then forwarded Mr Kalra's email to Mr Byrne. 133 It is appropriate to record at this juncture that there is no evidence before the Court as to AUSTRAC's on-site audit which Mr Kalra had mentioned in his emails. It is not disputed that, at this time, AUSTRAC had not detected any problems with the Bank's TTR reporting in respect of cash deposits made through IDMs. 134 On 20 September 2013, employees of the Bank identified two OFI card cash deposits for investigation. One deposit was for $10,000; the other was for $10,500. Details of these transactions found their way to Mr Ashdown on 8 October 2013. 135 On 10 October 2013, Mr Ashdown advised that the two transactions had not been reported in TTRs. Mr Ashdown sought further information. Later that day, Mr Ashdown advised that the two transactions had been processed with transaction code 5000 and that "we only pick up Transaction types (cash and mixed deposits)". In this regard, Mr Ashdown said that there were only two transactions to be considered - those under code 4013 for cheque and mixed deposits to savings accounts, cheque accounts and credit accounts, and those under code 5022 for cash deposits to savings accounts, cheque accounts, and credit accounts. 136 On 11 October 2013, Mr Ashdown was asked to "summarise … if there is an issue, and if there is - what exactly is it and who should be … the owner?". On 14 October 2013, Mr Ashdown provided the following "summary": … Kote sent me 2 transactions (cash deposits on OFI cards) to check if they had been picked up by TTR. These transactions (with transaction code 5000) are not being identified as cash transactions by TTR and were not reported. Kote reported that transaction code 5000 is not on the transaction range for IDA cash transactions. TTR is performing as expected. However, these 2 transactions are the one identified by Kote as being cash transactions on OFI cards, which would indicate to me that there is possibly a problem. My understanding of the actions are: - Refresh Team Confirm whether the tran code on the transactions is correct and therefore the transaction is not a cash transaction. - If not a cash transaction, Refresh Team need to provide new examples of cash transactions on the OFI cards for me to investigate. - If it is a cash transaction, Refresh team need to look into why the transactions have the wrong code. - If Tran code 5000 should be included as a cash deposit, then that's a bigger issue. We'll need to discuss how to resolve this, … 137 It is apparent from this response that the possibilities exercising Mr Ashdown's mind were that: (a) the two transactions were not, in fact, cash transactions; (b) if they were cash transactions, it was possible that the wrong transaction code had been used; and (c) if the transactions were cash transactions and the correct transaction code had been used and transaction code 5000 should have been on the transaction range for IDMs, then there was "a bigger issue". However, Mr Ashdown's advice was that "TTR is performing as expected". 138 Further email correspondence shows that, as at 24 October 2013, the view was taken that "TTR is working as expected" and that "any potential issues with OFI transactions are at the source system level". The matter appears to have been left with those who were responsible for advancing that matter at that level, but nothing happened. 139 With hindsight, the ramifications of that inaction can be readily appreciated. I accept the Bank's submission, however, that, as at 24 October 2013, no-one in the Bank had identified that transactions which should have been flowing through to TTR reporting were not flowing through and being reported to AUSTRAC. While, initially, questions had been raised about TTR reporting in respect of "mixed deposits" and cash deposits using an OFI card, the Bank's employees had determined that these transactions were being reported. While, later, two other OFI card transactions had been identified for investigation, it was queried whether the transactions had been correctly coded and whether they were even cash transactions. Although the possibility of a "bigger issue" had also been flagged, no further investigation was undertaken, and the facts were not known as to whether there was a "bigger issue". 140 The evidence does not elaborate on why, at that time, further investigation of the two OFI card transactions was not undertaken. With hindsight, there should have been further investigation to elucidate whether there was a "bigger issue". Had there been further investigation, it is likely that the general problem associated with cash deposits processed under code 5000 would have come to light. The applicants' disclosure case, however, is concerned with the information that officers of the Bank had, or ought reasonably to have had. The employees with knowledge of the matters in 2013 that I have described, were many levels below "officer" level, and none had identified a general and significant problem with deposits processed through IDMs under transaction code 5000. 141 The next relevant event is that, on 11 August 2015 (some 22 months later), AUSTRAC asked the Bank to locate TTRs relating to "two ATM deposits" (these are not the two deposits considered in October 2013). The Bank could not locate these reports. It realised that they had not been made. On investigation, it was found that the deposits were processed under code 5000, but that code 5000 had not been linked to TTR reporting, as it should have been. It was then found that this resulted in the non-reporting of 51,637 threshold transactions from November 2012 to 18 August 2015. The number of affected transactions represented approximately 2.3% of the overall volume of TTRs provided by the Bank over the same period. 142 On 8 September 2015, the Bank notified AUSTRAC about the issue. By 24 September 2015, the outstanding TTRs had been lodged. In the meantime, the Bank continued to report threshold transactions identified by the two original codes. 143 I will refer to this as the late TTR issue. I provide further details in relation to this issue at [250] - [269] below.

The Bank's Financial Crimes Platform 144 The FCP contained data about the Bank's customers, accounts and transactions, which were sourced from different upstream systems. The platform was used by the Bank to undertake various functions, including: (a) certain kinds of fraud detection, in particular internal fraud by the Bank's employees, cheque fraud, and application fraud; (b) automated politically exposed person and sanctions customer screening; and (c) automated transaction monitoring for AML/CTF purposes 145 The platform was not used by the Bank to undertake "know your customer" (KYC) procedures, suspicious matter reporting, threshold transaction reporting, sanctions payment screening, or manual politically exposed person screening. 146 There were three main ways in which data entered the FCP. The first was from the GDW, discussed above. The second was from the Bank's Operational Data Store which contained data from SAP (the Bank's core banking platform) and the Payments Journal (which recorded payments processed by the Bank). The third was direct data flow (i.e., data not stored in, and then extracted from, an intermediate system such as the GDW). 147 As with the flow of data into the GDW, data flowing into the FCP needed to be "normalised" - in other words, reorganised and transformed into a standardised format that was compatible with the platform. 148 Data was stored in the FCP in a series of "tables". These tables were separated into various topics, such as whether the data were customer data or account data. Each table was divided into fields (or columns) populated by the data relevant to that table. There were several hundred data fields across the various tables in the FCP which, depending on their content, could be relevant to some combination of automated transaction monitoring, fraud monitoring, or politically exposed person and sanctions screening. 149 Not all data which ultimately flowed into the FCP was ultimately relevant to its automated transaction monitoring functions. For example, some of the data flowing into the FCP was only relevant to its fraud monitoring and sanctions customer screening functions. 150 In the case of automated transaction monitoring, the FCP ran a series of transaction monitoring "rules". These rules concerned data in respect of the Bank's transaction accounts, such as savings, cheque, personal, and business lending accounts. Not all rules applied to every account. 151 The automated transaction monitoring rules operated as filters to identify transactions or activities that were potentially suspicious and which warranted further investigation. These rules could be complex, with many different parameters. 152 There were two categories of automated transaction monitoring rules within the FCP: (a) customer level rules, which sought to identify particular transactions or activity across accounts held by a single customer; and (b) account level rules, which sought to identify particular transactions or activity on distinct accounts (these rules were only concerned with the behaviour of specific accounts, not the customer's behaviour more broadly, which was considered by the customer level rules). 153 The automated transaction monitoring rules could, but did not always, apply differently depending on whether an individual or a company was involved. For example, the rules might apply differently to a small business which could be expected to have a high volume of cash transactions, compared with a typical individual customer. How these rules applied depended on whether the rule was an account level rule or a customer level rule. For account level rules, an individual account was usually flagged as either "Personal" or "Commercial" in a field called "ACCOUNT_TYPE_DESC". For customer level rules, the customer was usually flagged as either a "Person" or an "Organisation" in a field in a different table called "PARTY_TYPE_DESC". 154 Where particular transactions or activities were caught by these rules, the FCP automatically generated "alerts", which flagged the relevant transaction or activity for review. The alerts were transmitted into a separate case management tool, called Pegasus. Pegasus was accessed by a separate team within the Bank which sat within the Group Security division, which was responsible for reviewing and investigating the alerts for the purpose of determining whether there was information that needed to be submitted to AUSTRAC as part of an SMR. 155 In 2012, the Bank commenced an internal project known as Project Juno. This project related to enhancing the Bank's ability to monitor and detect potential instances of internal fraud. It was not focused on the Bank's AML/CTF systems, although it did impact on the FCP because the FCP was used for both fraud monitoring and automated transaction monitoring. 156 One aspect of Project Juno involved integrating a new process called the "Associate Web" into the FCP. The Associate Web sourced data from the GDW and the FCP to identify potential linkages between the Bank's staff and their customer profiles, the accounts they held, and any accounts that were related to them. For example, the Associate Web identified accounts that were registered with the same address or telephone number as a Bank staff member, or where an account was shared by a Bank staff member. This data was then used to populate a field in the FCP which flagged whether an account was "employee-related" or not. The rules in the FCP could then automatically run internal fraud monitoring rules to identify instances where Bank employees had initiated transactions involving accounts that had been identified as "related" to them. 157 Another important issue in the present case concerns an error that arose from updating account profiles in the FCP with data from the Associate Web. In that process, the ACCOUNT_TYPE_DESC field for some accounts was populated with a null value (i.e., it was left blank). Over time, this caused the ACCOUNT_TYPE_DESC field in the FCP to be left blank, for a period, for certain "employee related" account profiles (i.e., accounts that were intended to be flagged as accounts belonging to a Bank employee or related to a Bank employee). This occurred even though the process of integrating data from the Associate Web with the FCP was not intended to make any changes to the ACCOUNT_TYPE_DESC field. The consequence was that the automated transaction monitoring rules that depended on this field being populated did not operate for so long as the field was not populated. In short, some account monitoring did not occur in respect of some "employee related" accounts. Not all "employee-related" accounts were affected and the accounts that were affected were still monitored for financial crime screening (they were monitored against sanctions, politically exposed persons, and terrorists lists). Further, only some of the affected accounts were not subject to customer level transaction monitoring in the FCP. 158 This problem was identified by a Bank employee, Mr Dhankhar (who was engaged in Financial Crime Analytics) in the course of developing rules for the FCP in mid-June 2014. On 17 June 2014, Mr Dhankhar circulated an email in which he identified seven issues with FCP data, one of which concerned the ACCOUNT_TYPE_DESC field. This was given the incident number IM0809261. By late August 2014, this issue (amongst other issues) was recorded in RiskInSite as "Medium Impact". 159 On about 18 September 2014, the FCP was updated with a change that resolved the error so that, on updating the account profile, the ACCOUNT_TYPE_DESC field was updated with the relevant data as part of a "self-correct" process, and not left blank. Implementation of the Bank's usual data updating processes resulted in approximately 75% of the affected accounts (being active accounts) self-correcting by 30 November 2015. A manual update of the ACCOUNT_TYPE_DESC field in respect of inactive affected accounts (approximately 25% of the affected accounts) was completed by 27 September 2016. 160 In total, 778,370 accounts were affected in the period 20 October 2012 to 30 November 2015. The accounts were affected over varying time periods. For example, some accounts (54,357 accounts) were affected for a period of less than one month (for example, the period could have been one day); some accounts (73,716 accounts) were affected for a period of between 25 to 36 months. However, as I have noted, a significant percentage of accounts (representing, in number 195,000 accounts) were not active accounts. 161 I will refer to this as the account monitoring failure issue.

Preliminary observations 162 The applicants have directed much attention to various audits that were conducted in relation to the Bank both internally and externally. Although these audits provide background material in relation to the state of the Bank's management of regulatory risk over time, they should not distract attention from the case that the applicants have specifically pleaded against the Bank in relation to the non-disclosure of market sensitive information and related misleading or deceptive conduct. 163 One purpose of the applicants' reliance on this material is to match the reported findings in that material, as objectively and contemporaneously expressed, against the evidence in chief given, mainly, by Mr Narev and Mr Apte respectively, particularly in relation to their individual understandings of the extent of the Bank's shortcomings with respect to AML/CTF compliance issues. The applicants advance numerous submissions to the effect that either or both of these witnesses, in various ways, had, for example, sought to minimise the seriousness of certain findings that were made, or had an incomplete understanding of significant regulatory issues, or had made incorrect assessments of the risk to which the Bank's AML/CTF environment had exposed it in the lead up to the late TTR issue, or had exhibited misplaced confidence in certain audit findings. These submissions were directed to qualifying each witness's evidence in chief and to urge the Court to disregard each witness's own assessment of the materiality of the information with which he had been provided. 164 To the extent that these matters are relevant to the case at hand, I have taken these submissions into account in my assessment of Mr Narev's and Mr Apte's evidence. I accept that an appreciation of Mr Narev's and Mr Apte's subjective thoughts and reactions, as recorded in their affidavits, must have regard to the contemporaneous documentary record, as well as the matters elicited from them in cross-examination. However, I have not found it necessary to discuss, in these reasons, each and every submission that the applicants make in relation to the significance I should attribute to Mr Narev's and Mr Apte's evidence. I have only explicitly addressed the applicants' submissions where I consider it important to do so.

Internal audits 165 The Bank has, and at all times relevant to this proceeding had, a group audit and assurance team (Group Audit) headed by a Group Auditor (whose title within the Bank was Executive General Manager of Group Audit and Assurance). At the times relevant to these proceedings, this team comprised around 100 people in Sydney (who undertook audits across the Group) and around 25 people in Perth (who undertook audits specific to the Bank's Bankwest division). 166 Mr Worthington, who was the Group Auditor in the period July 2010 to 31 March 2019, described Group Audit's role as follows: 18. During my time as Group Auditor, Group Audit's role was to assess risks and internal controls across the Group, provide independent assurance about those controls to senior management and the CBA Board Audit Committee (Audit Committee), assess the effectiveness of risk management across the business, provide recommendations as to how to improve CBA's control environment, and periodically audit and validate the resolution of "Very High" and "High" rated audit issues. As it had an independent assurance function, Group Audit was not involved in making management decisions for the Group. 167 Mr Worthington's evidence was that, in any given year, Group Audit performed around 200 to 250 audits of which around 50 were Bank branch audits, with the remainder generally focused on systems or products. These audits were conducted according to an Annual Audit Plan which was overseen by the Group Auditor. 168 Mr Worthington described the process for conducting Group-wide internal audits in the following terms: 37. When Group Audit carried out an audit of an issue at a Group-wide level, the practice that was followed by Group Audit was: (a) conducting planning to determine the scope, key risks and timeframes for completing the audit; (b) undertaking any required field testing and conducting an assessment of the systems, processes and key risk areas falling within the scope of the audit; (c) issuing draft reports and issues logs to the relevant Group Executives, Executive General Managers, General Managers and Executive Managers (in some cases) within the relevant BUs for discussion. At this point, any feedback from such persons was sought; (d) finalising and issuing the final report to the same executives as identified above, the Accountable Executive (being a person nominated to be the key contact within the relevant BU or Group function for the purposes of the audit), selected line management and other persons within CBA; and (e) reporting and discussing the findings of the audits with the relevant executives, and separately with the Chair of the Audit Committee. 38. The issues logs were records of issues identified through the audit process. The preparation of an issues log involved my team working with the part of the business which had been audited to determine the appropriate action items to be undertaken in order to address audit findings, the "issue owner" for those action items, and a timeframe for their completion. The business formulated draft action items and due dates in response to the audit findings, and the role of my team was to review the proposed action items and due dates before they were finalised to ensure they were a reasonable response to the audit findings. The audit findings, action items and due dates were then incorporated into the issues log, and signed off by my direct reports. On occasions I became involved if the business and my audit team were unable to agree on appropriate action items, although this was rare. My general observation was that Group Audit was given a lot of respect by the business, and if Group Audit identified an issue, the business usually identified an appropriate action to address it. If the "issue owner" and audit team agreed with an action item and the due date, the "Issue Status" was recorded as "Agreed" in the issues log. This engagement with the business meant that in practice, by the time that the audit report and issues log were finalised, key personnel within each BU were already apprised of the matters that had been identified through the audit process as relevant to them and the action items required to address those matters, and had usually indicated acceptance of the action item and the timeframe stipulated to complete it. 39. Each audit report provided an overall rating, as well as separate ratings for the "controls environment" and for "management awareness and actions. The available ratings were "Satisfactory" (green), "Marginal" (amber) or "Unsatisfactory" (red). The criteria for these ratings were set out as an appendix to the accompanying audit report and, to the best of my recollection, remained broadly consistent throughout the Relevant Period. 40. Given the volume of audits undertaken by Group Audit each year, it was not practical for me to be involved in each audit. My primary focus was on audits with either an "Unsatisfactory" or "Marginal" rating. For these audits, my role was to engage with the members of my team responsible for conducting the audit, review and provide feedback on a draft audit report prior to it being issued, and communicate the final audit report findings to senior personnel within CBA including Mr Long, the Audit Committee, Mr Narev, and other relevant Group Executives. As part of this, prior to the audit report being finalised, it was my practice to consider the overall ratings being proposed and whether I agreed with them, and ensure that I understood the key findings and themes to be communicated to the business. 169 I now turn to a number of internal and external audit reports on which the applicants rely.

Transaction Monitoring Program Review Final Report 2011 170 PricewaterhouseCoopers (PwC) was engaged by the Bank to conduct an independent review of the Bank's TMP in relation to the Bank's compliance with its AML/CTF regulatory obligations. In a report dated 25 February 2011 (the TMP review report), PwC identified "gaps" in the course of its review which appeared to be related to "the migration of data to new systems where some data failed to transfer as part of updated TMP automated processes". PwC noted that the Bank was aware of the gaps and had implemented interim measures to cover these gaps. 171 In the TMP review report, PwC made the following key observations: From our observations and testing of the different parts of the TMP, including automated, semi-automated and manual processes, we found a complex monitoring system, with multiple data flows and pathways. Furthermore, the various monitoring pathways are used to monitor different products within and across the three business units under review; and different monitoring pathways utilise different rules, processes, and systems. We noted that there are currently no reconciliations undertaken of data extracted (including volumes) from source systems to the TMP and between stages of the TMP. We understand this is not a simple reconciliation as in some case it involves sophisticated and complex transition and analysis of data between stages and systems within the TMP. Therefore, without such reconciliations being undertaken over time, it is not possible to determine that all data that should have entered the TMP has done so and has subsequently been processed as expected. We also note that the scope of our testing did not cover what occurred prior to data being provided from the source systems and thus we were not able to determine that all transactional activity with customers is recorded in the relevant source systems for TMP purposes. Our recommendations cover further review for TMP upgrades and with respect to reconciliations. If interim arrangements or upgrades are not reviewed there is the risk that systemic failure in the monitoring processes could exist and not be identified immediately. Failure to undertake reconciliations from source systems through the monitoring processes means there is a risk that the TMP could contain incomplete data. We observed that different teams are involved in the many elements of the program. Therefore there is not in all cases a clear understanding of the end to end processes involved across all pathways although within individual stages of the TMP, the teams involved have more detailed knowledge. The lack of a documented, up to date, end to end process with clear accountabilities over time adds to the risk that gaps in the TMP may not be identified quickly in the future. In addition, within specific monitoring pathways there are variable levels of knowledge, documentation, and responsibilities in relation to different elements of the process. The key impact of the varying levels of knowledge and responsibilities is that accountabilities are not always clear, as different teams are responsible for often separate and discrete parts of the process. Changes that are made to the TMP by different teams are not always documented, which makes it difficult to track decisions, and changes to different teams are not always documented, which makes it difficult to track decisions, and changes to the process over time. Due to the separate accountabilities for different stages of the monitoring pathways, issues have arisen around changes to the process (including system upgrades and technological changes) that were not always made in consultation with all potentially impacted stakeholders. Clear accountabilities are also a key aspect to the success of the TMP. 172 Notwithstanding these observations, PwC expressed the overall view that the Bank had "a well developed and in many cases sophisticated TMP compared to other Australian financial institutions". 173 In their Joint Report, Mr Elliott and Mr Bell noted that, in various sections of the TMP review report, PwC highlighted the complexities of the Bank's TMP, but did not identify any immediate, specific recommendations for the Bank to review its account monitoring process.

The Bank's Internal Audit Report 2013 174 On 16 December 2013, Group Audit delivered a report on "Group-wide Anti-Money Laundering/Counter Terrorism Financing" (the 2013 audit report). The 2013 audit report gave an overall "red" rating based on "unsatisfactory" ratings for "Control Environment" and "Management Awareness & Actions". In relation to "Control Environment", this meant: Controls are not appropriate for the risks being managed. There are a significant number of issues that require immediate attention. 175 In relation to "Management Awareness & Actions" this meant: Management has a poor understanding of the risks and controls relevant to their business, and/or were not performing testing of the controls to asses their operating effectiveness. Alternatively, management were not aware of the material issues and/or were not taking appropriate and timely action to resolve and escalate. 176 Group Audit expressed the opinion that: A consolidated view of AML/CTF risk and the effectiveness of the controls over AML/CTF risk across CBA has not been established due to the current inconsistent use of RiskInSite. 177 The Issues Log noted that the RiskInSight functionality was not currently being used to provide an overview of AML/CTF compliance across the Group, with the implication that: (a) there was an "(i)nability to monitor and track key risks and issues to obtain a holistic view of the level of AML compliance"; and (b) "(k)nown risks and issues are not being properly managed and monitored". 178 The Issues Log also noted that Group Operational Risk & Compliance (GORC) was aware that inadequate monitoring and assurance was being performed by Business Unit AML and Compliance teams. 179 Based on the fact that, in cross-examination, Mr Narev could not recall asking for, or being provided with, a copy of the 2013 audit report (although he had received a number of other reports, and attended meetings with Mr Worthington, leading up to the 2013 audit report), the applicants advance a number of submissions. 180 First, the applicants submit that Mr Narev did not have a proper understanding of the "severe deficiencies in [the Bank's] AML/CTF compliance", including deficiencies that, in the applicants' submission, "caused the TTR issue not to be escalated and remediated in October 2013". 181 Secondly, the applicants submit that this lack of understanding contributed to a failure by Mr Narev to properly assess the materiality of the late TTR issue after he was informed of it which, in his affidavit, Mr Narev described as "a single event resulting from an unintended software glitch". 182 There are a number of things to be said in response to these submissions. 183 First, I do not accept that Mr Narev did not have an understanding of the deficiencies identified in the 2013 audit report that was sufficient and appropriate for his role as the Managing Director and CEO of the Bank. 184 Secondly, I am not persuaded that it can be said that the deficiencies identified in the 2013 audit report "caused the TTR issue not to be escalated and remediated in October 2013". Absent explanation, the fact that the potential problem with code 5000 was not fully investigated and rectified in 2013 does not, perhaps, speak well of the Bank's staff. I do not accept, however, that that failure can be rationalised as having been "caused" by the deficiencies that were identified. Moreover, as I have recorded, Mr Kalra did, in fact, promptly escalate the issue with the two deposit transactions he had raised. However, he later "de-escalated" the issue after being told that there was no problem and that TTR was performing as expected. 185 Thirdly, I do not accept that Mr Narev failed to properly assess the materiality of the late TTR issue or that his description of that issue as "a single event resulting from an unintended software glitch" evidences such a failure. I do not think that, by that description, Mr Narev was endeavouring to trivialise the late TTR issue. Rather, he was doing no more than characterising the reason for the failure to report, whose cause was not multifactorial but sourced in the fact that, inadvertently (but no less seriously), a single code had not been implemented when it should have been. 186 The applicants also advance a number of submissions in respect of Mr Apte's evidence. The substance and effect of those submissions is that Mr Apte did not have a proper understanding of the 2013 audit report, whose findings he sought to minimise by saying that it had "flagged some issues to be addressed". 187 I do not accept those submissions. Mr Apte was appointed to the Bank's Board as a non-executive director with effect from 10 June 2014, after the 2013 audit report had been given. The evidence on which the applicants rely was given by Mr Apte in the context of him explaining that the first formal meetings he attended as a non-executive director were meetings of the Audit Committee and Risk Committee on the very date of his appointment. At the Audit Committee meeting, Mr Worthington presented the Annual Audit Plan for 2015. Mr Apte said that he learned from that presentation that a Group-wide AML/CTF audit had been completed in late 2013 and that it had "flagged some issues to be addressed". I do not think that describing the outcome of the audit in these cursory terms, in the narrative of the events given by Mr Apte, portrays that Mr Apte was seeking to minimise the findings of the 2013 audit report. 188 The applicants also advance a submission that seeks to ally a contention that Mr Apte's understanding of regulatory reports was based on "high-level updates", with a contention that Mr Apte had an "incomplete understanding of the deficiencies in [the Bank's] AML/CTF compliance landscape". The applicants submit that these matters undermine "the veracity of [Mr Apte's] assessment of the materiality" of the late TTR issue. To support this submission, the applicants draw attention to Mr Apte's reference, in his evidence in chief, to the late TTR issue being flagged with AUSTRAC as a "coding error". 189 I do not accept this submission. First, I do not accept that Mr Apte's reference to the late TTR issue being flagged with AUSTRAC as a "coding error" signifies that, somehow, Mr Apte dismissed the importance of that issue. It is appropriate to describe the late TTR issue as one arising from a "coding error". 190 Secondly, and perhaps more importantly, I am not persuaded that Mr Apte had an "incomplete understanding of the deficiencies in [the Bank's] AML/CTF compliance landscape". Whilst, in his affidavit, Mr Apte gives evidence about receiving regulatory reports touching on ML/TF risk management considerations, these are not the only reports Mr Apte referred to when discussing the key mechanisms used by the Bank's Board to assess ML/TF risks and compliance. In Section E of his affidavit, Mr Apte identified and discussed a large range of reports and other information sources. This is reflected in the following overview given by Mr Apte, on which he expanded in subsequent paragraphs of his affidavit: 125. Over the Period, there were several mechanisms by which I, as a Board member, (directly or through the Audit and Risk Committees) developed an understanding of the level of the Group's non-financial risk, how it was performing from a compliance perspective and the effectiveness of its AML/CTF policies, processes, systems and controls. I summarise these mechanisms below. 126. As a member of the Board and Risk Committee, it was the practice that I received regular written reports and oral presentations on non-financial risk and compliance including: (a) formal scheduled updates on risk management considerations (including on AML/CTF specific matters), through the routine provision of a CRO Report to the Risk Committee; (b) formal scheduled updates on regulatory risks, issues, engagements and developments, such as through the routine provision of a regulatory report which, from around February 2015, went to the full Board; and (c) other scheduled or unscheduled updates on key developments or areas of interest as requested by the relevant Chair, the CEO, or other Board or Committee members. This included both general risk management updates and updates specific to AML/CTF. 127. As a member of the Board and Audit Committee, I received internal audit updates on non-financial risks and controls including through twice yearly updates on key audit themes that had arisen during the previous six months (Thematic Audit Reports) and through other updates such as scheduled risk and control "deep dives" into particular business units or focus areas. 128. From a broader risk management perspective, I participated in formal processes to understand and get comfortable with CBA's risk management framework, including (from 2015) a formal scheduled annual risk management declaration process. 129. I also engaged in other formal processes to understand and confirm CBA's compliance and risk management, which processes were scheduled into the Board's calendars in advance, such as the process for confirming statements made in CBA's annual reports. 130. Based on the information provided to me through these key mechanisms (both as addressed in Section D and as expanded upon further in the remainder of this Section E) and based on my own observations through participating in the Board and Committees, I developed and maintained a general understanding over the Period that: (a) the Group's overarching risk management processes, systems and controls were substantially effective through to FY17, following which I still understood them to remain largely effective despite some challenges being faced particularly in our offshore business; (b) risk and compliance matters were escalated to Group Executives, the Committees and the Board (as appropriate), whether from the business units, risk and compliance teams or GA&A; (c) in respect of AML/CTF specifically: (i) the Group's AML/CTF framework was overall sound (having been considered by both internal and external experts) albeit that there were opportunities to improve particular processes, systems and controls. As a consequence, for example, management had engaged PwC to undertake reviews of certain of the Group's AML/CTF processes, systems and controls as discussed at paragraph 136(a) below; (ii) where instances of non-compliance, weaknesses in particular processes, systems or controls or other areas for enhancement were identified (which I considered to be inevitable given the size and complexity of the Group), executable action plans were put in place, funding and resources were authorised, and relevant regulators were consulted and kept informed; and (iii) the Group had established a positive and productive relationship with AUSTRAC, such that (for example), even after AUSTRAC was aware of the TTR issue and various additional matters unearthed through GA&A audits, the Board received positive feedback from AUSTRAC and opportunities to partner with AUSTRAC continued to be made available to our personnel (for example, through Ms Watson being invited to join AUSTRAC at a financial crime forum in Moscow, which I refer to in paragraph 109(d) above). 131. This understanding reinforced my view that I did not have material information to disclose in respect of issues being considered by AUSTRAC in respect of CBA over the Period. 191 In relation to the 2013 audit report, I also observe that, in their Joint Report, Mr Elliott and Mr Bell noted that while the report: (a) covered a broad range of areas related to the Bank's AML/CTF Program which identified 21 audit issues; and (b) alerted the Bank that there were numerous issues to be addressed by relevant and nominated people to further uplift the Bank's overall AML/CTF Program, the late TTR issue was not specifically identified in the findings of the report or in the Issues Log, and the report did not identify a specific requirement to immediately review the detection methods for the cash deposit reporting systems. 192 In this connection, it is important to understand that a significant focus (albeit not the sole concern) of the 2013 audit report was the Bank's AML/CTF compliance in respect of KYC requirements and the fact that the escalation of KYC error rates had been ineffective. The report noted that improvement on this matter was required to bring the Bank's management of AML/CTF risks within an acceptable risk tolerance. Any issues the Bank had in respect of its compliance with KYC requirements are not relevant to the issues raised in this case. 193 The Bank provided a copy of the 2013 audit report to AUSTRAC. AUSTRAC prepared a Compliance Assessment Report. On 6 February 2014, AUSTRAC wrote to the Bank expressing its concern with the 2013 audit report's findings: Given the high level of AUSTRAC's concern with the contents of the CBA internal review we anticipate that all issues raised in the report will be addressed in accordance with the prescribed due dates. AUSTRAC appreciates that some of the issues raised are focused on CBA's own internal concerns that may not be relevant to AML/CTF compliance. 194 In its letter, AUSTRAC required the Bank to provide comprehensive and detailed action plans for issues that related to the AML/CTF Act and AML/CTF Rules, and said: Given the serious nature of some [of] the issues identified in the internal review, AUSTRAC will closely monitor CBA's progress against its various action plans. 195 In its letter, AUSTRAC also requested the Bank to provide it with written monthly update reports.

Project Alpha 196 Following the 2013 audit report, the Bank engaged PwC in March 2014 to conduct an external review of the issues that had been raised. On 19 August 2014, PwC delivered its report entitled "Project Alpha: Root cause analysis of the identified Group-wide AML/CTF issues" (the Project Alpha Report). 197 In its report, PwC referred to the increase, from a global perspective, in the punitive measures and regulator expectations in respect of AML/CTF compliance. They noted that, in Australia, "the AML/CTF regulatory landscape is experiencing significant change". PwC spoke of an expectation that the potential for regulatory action by AUSTRAC would increase. 198 PwC noted the key failings identified in the 2013 audit report. Conspicuously, PwC identified that the "crux of the high-risk issues" identified in the 2013 audit report was the failure among all relevant Business Units to "correctly conduct the required customer due diligence … for clients that are non-individual entities (for example, trusts and private companies)". This is a reference to the KYC requirements of the Bank's AML/CTF Program. It was in that context that PwC observed: These issues were compounded by a failure of the AML/CTF operating framework in testing, monitoring and escalating known issues to key stakeholders to ensure sufficient attention and corrective action. 199 Even so, PwC concluded that, in respect of all the issues raised in the 2013 audit report, the root causes included "ambiguity" around the AML/CTF operating framework, an under-investment in specialised AML/CTF resources and training, and the fact that the Bank's AML/CTF assurance activities had been "conducted in silos" (meaning that AML/CTF assurance was not being conducted within an holistic framework supported by systemised reporting). 200 In relation to the "ambiguity" around the AML/CTF operating framework, PwC observed: The AML/CTF operating framework is not consistently understood across the Group. Within each [Business Unit] there are different understandings of the roles and responsibilities of each line of defence and the roles of the [AML Compliance Officer]. As a result, there is limited escalation of issues (unless deemed high risk) or regular reporting through to GORC, and decisions are made in isolation within [Business Units]. 201 One of PwC's primary recommendations was: Build a formal, Group-wide, systemised assurance and monitoring framework for AML/CTF using RiskInSite and leveraging existing CBA assurance processes where possible.

APRA Prudential Review Report 202 The Australian Prudential Regulation Authority (APRA) also conducted a review of the 2013 audit report. On 5 September 2014, it provided a report (the APRA Report) to the Bank. 203 In the report's Executive Summary, APRA said: The CBA Group is a diverse entity, with multiple business units that operate in a variety of regulatory and legislative frameworks in both Australia and overseas jurisdictions. Add to this the volume and complexity of global regulatory change and it highlights the importance of effective compliance risk management. APRA's assessment is that whilst CBA's Compliance Risk Management Framework (CRMF) provides the foundation for sound management of compliance risk, there is a need for improvement in the maturity and consistency of implementation across the Group. This could be facilitated by Group Compliance providing a stronger role in the direction and guidance given to the businesses in terms of how they implement and follow the CRMF. APRA observed some actions in this regard had already been initiated. APRA also considers that the level of challenge from Group and business unit compliance functions could be enhanced to improve consistency and promote the prompt identification of key risks and their escalation to more senior risk forums, where necessary. The development of a more forward looking approach to compliance risk, backed by the appropriate use of data and enhanced compliance reporting, would enable a greater focus on emerging risks and trends within the business. While APRA notes that this is an area requiring development across the industry, we observed that CBA was not making full use of all available data and that there was limited evidence of forward looking discussion and reporting at a business unit level. APRA noted the Group's CRMF includes reputational risk within its definition of compliance risk, and as an outcome of incidents. We were advised that the bank addresses reputational considerations through a variety of executive forums; including the Board, Executive Committee (Exco) and the recently formed Reputational Risk Committee. During the review APRA noted an absence of discussion of reputational risk at a business unit level. Business unit committee minutes and reports focused more on the financial impact of crystallised events as opposed to consideration of potential reputational implications of events that have yet to emerge. APRA's view remains that the CRMF is an important contributor to the management of reputational risk by the Group, and that business unit and compliance staff should take proactive steps to identify, discuss, document and, where appropriate, escalate reputational risks to more senior forums. The review provided APRA with some insights into how CBA assessed its compliance risk culture. We noted a key component to this assessment is the People and Culture Surveys which have contributed to supporting the view of the CBA Board and management that CBA has a 'good culture'. APRA noted that for some survey questions the range of answers was wide, which could indicate potential vulnerabilities, and that staff exhibiting poor behaviours may simply choose to not complete the survey. We also note that this has been the subject of a recent paper to Exco on culture and other discussions with the Board. APRA supports CBA developing its capability to measure and report on the quality of its risk and compliance culture. This is particularly relevant in light of the cultural weaknesses APRA has observed in Bankwest and historically in the Wealth Management Advice business. One area of particular concern was the identified gaps within the bank's AML/CTF and Sanctions controls and monitoring processes. APRA observed that key systems were overdue for upgrading and noted that concerns with the bank's ability to manage these risks have been raised by both Internal Audit and other external regulators. lt is critical that CBA address the deficiencies that have been identified in a prompt and complete manner. This is of increasing importance given the recent large fines levied overseas for breaches of AML regulations and Sanctions. Accordingly, APRA has made this issue a requirement. APRA supports the continued development of RisklnSite as a risk and compliance management tool and noted its strong capability and potential to capture risks, controls, testing and track assessments. However, the current state of RisklnSite implementation and its utilisation across business units varies significantly and is incomplete. APRA observed that multiple businesses were still in the process of inputting data into RisklnSite from other support systems, which included key risks and controls relating to compliance risks. In APRA's view there is a need for greater standardisation across business units and an improvement in the data quality. Until these enhancements are completed, the ability of RisklnSite to be a source for meaningful Group-wide reporting from both a consolidated and bottom-up perspective will be limited. 204 In relation to the 2013 audit report, APRA said: APRA noted that the Internal Audit review of AML/CTF in December 2013 was rated 'Red' and the Group-wide Sanctions Review in February 2013 was rated 'Amber'. Of particular concern to APRA was that in the AML/CTF review, Internal Audit identified that Know Your Customer (KYC) error rates of 25 to 45 per cent had been identified by the business or assurance areas in RBS, lB&B, Markets and Bankwest. However, test plans and RisklnSite controls had been rated 'Green', even though these errors existed and were well above the stated tolerances of 3 per cent. Internal Audit made the comment "we are concerned about the speed and, effectiveness of the escalation of these issues across the Group". Although we only observed one incidence of this, it is a concern that business and risk staff were rating controls 'Green' when they should have been rated 'Red'. This finding also raises the issue of roles and responsibilities in regard to implementation, monitoring and oversight in this area, i.e. what role is played by Group functions versus the business units. APRA notes that CBA is, currently in the process of preparing a Group level assurance program for AML/CTF, Sanctions and anti-bribery and corruption.

Project Beta 205 In order to assess the status of the Bank's remediation of the issues arising from the 2013 audit report, PwC considered AUSTRAC's Compliance Assessment Report of 6 February 2014 and the Bank's monthly updates to AUSTRAC outlining the remediation activities to be undertaken by its Business Units. In April 2015, PwC released a report entitled "Project Beta: Assessment of AML/CTF Remediation Activities Interim Report" in relation to its assessment. 206 In this report, PwC recorded that it "noted improved support and motivation amongst AML/CTF representatives at the Group and Business level" compared to a previous review. Of the 21 issues identified in the 2013 audit report, 20 had been completed and "closed" within the agreed timeframes, and that Business Units had offered and provided training to employees where policies, procedures, systems or controls had changed. PwC noted that Business Units had established Line 1 and Line 2 monitoring and testing, where necessary, to ensure ongoing compliance with remediation actions. PwC said that it was clear from discussions with "Action Owners" and employees within each of the Business Units that the findings of the 2013 audit report and AUSTRAC's Compliance Assessment Report, as well as the remediation plans, had been communicated to relevant employees and that these employees "understood that these matters had to be addressed". 207 PwC noted, however, that RiskInSite was continuing to be used inconsistently and that there appeared to be an "inconsistent understanding of RiskInSite across the [Business Units] regarding its purpose, how to capture an issue and how to describe the activities and controls implemented to address the issue". 208 PwC delivered a final report in June 2016.

The Bank's Internal Audit Report 2015 209 In May 2015, Group Audit delivered a report on an internal audit which focused on the completeness of data captured in the Bank's systems used for centralised AML/CTF screening and the processes it used for the maintenance of "AML/CTF rules" (the 2015 audit report). This audit was one of APRA's requirements notified in the APRA Report. 210 The 2015 audit report gave an overall "red" rating based on an "unsatisfactory" rating for "Control Environment" and a "marginal" rating for "Management Awareness & Actions". A "marginal" rating meant: Management has shown some understanding of the significant risks and controls relevant to their business; however they were not performing regular testing of the controls to assess their operating effectiveness. Alternatively, management was not aware of all material issues and/or was not taking appropriate and timely action to resolve and escalate. 211 In its Audit Conclusion, Group Audit noted (amongst other things): … controls have not been embedded across the Group to validate the completeness and accuracy of data flows between source systems and those used for centralised AML/CTF screening. 212 Group Audit also noted: A small proportion of International Fund Transfer Instructions (IFTI) and Transaction Threshold Reports (TTR) were not reported to AUSTRAC. The accuracy of information provided on IFTI, TTR and Suspicious Matter Reports was also highlighted as a concern by AUSTRAC in its Annual Compliance Assessment performed in January 2015. 213 Group Audit noted, further, that, in relation to co-ordinating the development of clear accountabilities for AML/CTF compliance processes across the Group: … the Chief Compliance Officer will develop an enhanced Financial Crimes Compliance Framework, which will include mapping of end-to-end business processes, systems architecture and accountabilities. This aims to address the lack of ownership of group-wide compliance processes which has contributed to the current weaknesses in the control environment. 214 The 2015 audit report identified certain issues which had been given a "high" rating. 215 One issue was that there was "(u)nclear end-to end ownership and governance for AML/CTF processes across the Group". This involved a lack of definition of roles and responsibilities to ensure that the reporting of IFTIs (and TTRs) to AUSTRAC was complete and accurate. The accompanying Issues Log noted: The audit highlighted that transactional data relating to some high risk rated products is not being fed into the Group's AML/CTF screening systems and high risk customer models maintained in systems are not up-to-date. We also observed knowledge gaps across multiple teams responsible for maintaining data flows between source systems and AML/CTF systems used for AUSTRAC reporting. 216 This issue was also given a "major" impact rating in the Issues Log with a "possible" likelihood (meaning, a less than 50% probability of occurring within the next 12 months). This entailed certain "reputation/brand" consequences, including a possible medium term fall (10 - 20%) in the Group's share price. This rating also entailed certain "legal/regulatory compliance" consequences, including possible focused regulatory surveillance and significant increased regulatory oversight, and possible "major fines and sanctions". 217 Another issue with a "high" rating was that there was "no end-to-end assurance performed over the completeness and accuracy of transactional data used for AML/CTF screening". The Issues Log recorded: There is no process to validate the completeness and accuracy of transactional data flows between source systems and those used for AML/CTF screening such as Financial Crimes Platform (FCP), Financial Crime Case Management (FCCM) and Proactive Risk Manager (PRM). 218 This issue was also given a "major" impact rating in the Issues Log with a "possible" likelihood. 219 Similar issues had been raised in the 2013 audit report. 220 The 2015 audit report identified a number of issues with a "medium" rating. One of these was that all cash deposits and withdrawals greater than or equal to $10,000 were not being reported to AUSTRAC. The Issues Log gave this issue a "moderate" impact rating with a "possible" likelihood. A "moderate" impact rating entailed certain "reputation/brand" consequences, including a possible short term fall (less than 10%) in the Group's share price. It also entailed certain "legal/regulatory compliance" consequences, including "[i]ncreased general regulatory oversight", "[p]otential impact on regulator relationships", and "[f]ines". 221 However, as Mr Elliott and Mr Bell noted in their Joint Report, the late TTR issue was not specifically identified in the 2015 audit report, including in the associated Issues Log. Mr Elliott and Mr Bell also noted that the 2015 audit report did "not identify a specific requirement to immediately review the detection methods for the cash deposit reporting systems". They noted, further, that the account monitoring failure issue had already been self-identified on about 16 June 2014 and had been recorded in RiskInSite on 4 September 2014.

The Tabcorp penalty proceeding 222 On 22 July 2015, AUSTRAC announced that it had commenced proceedings against Tabcorp for "extensive, significant and systemic non-compliance with Australia's anti-money laundering and counter-terrorism financing legislation". In its press release, it stated: As we have demonstrated in this case, we are prepared to work with businesses to improve their systems and controls, but will take strong action when they fail to make the necessary improvements to address serious and systemic non-compliance. 223 These proceedings subsequently resolved with Tabcorp agreeing to pay a pecuniary penalty of $45 million.

AUSTRAC raises concerns 224 On 30 July 2015, the Bank met with AUSTRAC to provide a "general monthly update". It seems that, beforehand, AUSTRAC and APRA had met and discussed the 2015 audit report. As I have noted, this audit was one of APRA's requirements notified in the APRA report. 225 At the meeting with the Bank, AUSTRAC said that it had "serious concerns around" the audit. AUSTRAC made the overarching comment that, on the face of it, the 2015 audit report was "very concerning" and was "raising questions internally within AUSTRAC" and that, potentially, AUSTRAC "would … consider if enforcement action would be necessary". 226 In a file note created on 30 July 2015, Mr Byrne (whose title in the file note was given as the Bank's Head of Group Financial Crime Compliance, Regulatory liaison & complex matters) noted: Examples of concerns from AUSTRAC's perspective are around the apparent gaps in IFTI, TTR and SMR reporting, the fact that the Internal Audit report states that the business didn't understand what is reportable, that systems are not generating alerts that they should be and that there are issues with the High Risk Customer Model. Further concerns include that the systems haven't been looked at since 2009. However, there are general concerns with the report as a whole. 227 On 19 August 2015, a further meeting was held between the Bank and AUSTRAC. A report of the meeting that was given to Mr Toevs makes clear the Bank's appreciation that there had been "a lot of dialog" between AUSTRAC and APRA and that AUSTRAC was "very open" about that fact. The report indicates that the Bank had been told informally that "the enforcement comment" had been made "incorrectly" but that "there was no firm retraction of the comment during the meeting".

Project Nitrogen: The 2015 Entitlement Offer 228 In 2015, the Bank undertook a $5 billion capital raising through a pro-rata renounceable entitlement offer of new shares to existing shareholders. A due diligence committee (DDC) was established for that purpose. Mr Cohen was the Chair of the committee. The DDC was responsible for overseeing the due diligence process established by the Bank in connection with the preparation of the offer documents. One of its tasks was to identify potentially significant matters that might be regarded as market sensitive and to address those matters as appropriate. The DDC met regularly from July to September 2015. 229 The Bank's advisers included their solicitors, PricewaterhouseCoopers Securities (PwCS), Goldman Sachs, Morgan Stanley, and UBS. Morgan Stanley and UBS were the underwriters of the issue. 230 The due diligence process included the following steps: (a) management personnel were issued with a questionnaire and were required to "sign-off" (confirm) information in their assigned areas; (b) the managers of the 2015 Entitlement Offer had the opportunity to question the Bank's management personnel; and (c) Group Executives were required to provide formal verification to the effect that they were not aware of any material information being withheld from continuous disclosure that was required to be disclosed to the market. 231 The DDC was advised that, when assessing whether a particular matter was material to the offer, both quantitative and qualitative factors needed to be considered. In relation to quantitative materiality, PwCS provided input on the threshold that it considered appropriate for the Bank to use. 232 The Bank's Board approved the 2015 Entitlement Offer and the offer documents on 11 August 2015. 233 On the same day, the DDC issued a report (the DDC Report). The DDC Report attached (amongst other things): (a) a management due diligence questionnaire; (b) management "sign offs"; and (c) verification certificates. 234 Amongst other things, the due diligence questionnaire: (a) asked whether there were "any material legal, regulatory or administrative actions, suits or proceedings in any court or by any government agency or body, domestic or foreign, currently pending or that are, to the knowledge of the Group, threatened against or affecting the Group or its directors" (Question 1.48); (b) asked for confirmation "that the Group has substantively complied with money laundering statutes" in Australia (Question 1.55); and (c) asked for confirmation that "the Group has appropriate risk management policies to monitor compliance with applicable laws and regulations and to detect any non-compliance…[and] that no material non-compliance has been detected recently" (Question 1.63). 235 Mr Cohen was the Group Executive responsible for Question 1.48. He answered "No". Mr Cohen's evidence was that this reflected his view at the time. 236 Mr Toevs was the Group Executive responsible for Question 1.55. He answered "Confirmed". As to that answer, Mr Cohen gave this evidence: 36. I note that the wording of question 1.55 sought confirmation that the Group had substantively complied with its AML requirements. My view was that this was the appropriate level of confirmation to seek. Given the volume of transactions and customers using CBA's services (then approximately 68 million branch deposits and withdrawals, 270 million transactions through Automatic Teller Machines (ATMs), 1.532 billion EFTPOS transactions and 528 million internet transactions, as well as a customer base of 15 million in FY15), I did not consider it reasonable (or indeed tenable) to expect there to be no instances of non-compliance (whether known or unknown). 237 Mr Toevs was also the Group Executive responsible for Question 1.63. He answered that question as follows: Confirmed. The Group has appropriate risk management policies to monitor compliance with applicable laws and regulations and to detect non-compliance. Due to the detailed self-reporting regulatory regimes in the various jurisdictions the Group operates, on average each month some regulatory breaches are self-identified and reported. Confirmed that no material non-compliance issues [have] been recently detected. 238 On 12 August 2015, the 2015 Entitlement Offer was announced to the market through a cleansing notice issued under s 708AA(2)(f) of the Corporations Act (the 2015 Cleansing Notice). 239 On 24 August 2015, Mr Cohen signed a "new circumstances" proforma confirmation that he was not aware of any: (a) ... statement in the Offer Documents [that was] false, misleading or deceptive (including by omission) or likely to mislead or deceive (including by omission) or does not otherwise comply with the Corporations Act; or (b) ... omission from the Offer Documents of material required by the Corporations Act; or (c) ... new circumstance that [had] arisen since the Offer Documents were issued which the DDC would have required to be included in the Offer Documents if it had arisen before Offer Documents were issued or that changes the nature of any of the disclosures in the Offer Documents; or (d) ... material change to the potential effect the Offer will have on the control of CBA or the consequences of that effect. 240 Mr Cohen provided this confirmation on the express basis that he had relied on other members of the DDC and those responsible for reporting to the DDC who had appropriate expertise in relation to those matters falling outside his expertise. 241 On 17 September 2015, which was the day before the new shares were to be issued, Mr Cohen signed a confirmation that he was not aware: (a) that there is a statement in the Offer Documents which is false, misleading or deceptive (including by omission) or likely to mislead or deceive (including by omission) or does not otherwise comply with the Corporations Act; or (b) that there is an omission from the Offer Documents of material required by the Corporations Act; or (c) that there is a new circumstance that has arisen since the Offer Documents were issued which the DDC would have required to be included in the Offer Documents if it had arisen before Offer Documents were issued or that changes the nature of any of the disclosures in the Offer Documents; or (d) of a material change to the potential effect the Offer will have on the control of CBA or the consequences of that effect. 242 How does knowledge of the IDM ML/TF risk assessment non-compliance issue, the late TTR issue, and the account monitoring failure issue relate to the 2015 Entitlement Offer? 243 Mr Cohen became aware of the late TTR issue as a result of being sent an email by Mr Narev on 6 September 2015. I refer to this email in a later section of these reasons. As I have noted, in his affidavit Mr Cohen said that he did not become aware of the late TTR issue until October 2015. However, he corrected this statement at the commencement of his evidence in chief. Mr Cohen became aware of the account monitoring failure issue in April 2017. He became aware of the IDM ML/TF risk assessment non-compliance issue in August 2017, after the commencement of proceedings against the Bank by the AUSTRAC CEO. 244 In his affidavit, Mr Cohen turned his mind to what his thought processes would have been if each of these issues had been raised with him as part of the DDC process. He expressed his belief that none of them would have been a matter that needed to be disclosed and none of them would have had an impact on his ability to provide the verifications or confirmations he did provide, or warranted the Bank taking other steps such as "suspending, cancelling, withdrawing, [or] varying the 2015 Entitlement Offer, or making a supplementary disclosure". 245 In the case of the late TTR issue, Mr Cohen's evidence on this score - expressed as a hypothetical - sits somewhat awkwardly with the fact that he had actual knowledge of that issue as at 6 September 2015. However, he also said that, in relation to Question 1.55, he did not recall any discussion of AML/CTF compliance issues in the context of the 2015 Entitlement Offer, or that Mr Toevs or Mr Dingley had raised any concerns about such issues. 246 Mr Cohen's evidence was that: 51. In relation to the TTR issue, at the time of the DDC process, this was a compliance issue affecting a particular BU that had been uncovered in the context of a query from a regulator seeking to locate two TTRs, which needed to be (and was promptly) remediated. While threshold transaction reporting was an important process and the TTR issue was an unsatisfactory occurrence, from a continuous disclosure perspective I also believe that I would not have considered this to meet the threshold for disclosure in the context of CBA's broader business activities. It is my experience that having regard to the nature of CBA's business, it will be contacted regularly by regulators on a weekly, if not daily, basis in relation to CBA providing information and documents (including in response to statutory notices) to that regulator in relation to CBA's activities. It was consistently my view throughout the Relevant Period that the receipt of requests or notices from a regulator is not of itself material information because such receipt does not give any clear indication of whether the regulator intends to or will take any form of regulatory action, what form that action might take or other clear information about the nature, scale and composition of the issues underpinning that action. In the case of the TTR issue, at the time of the DDC process the regulatory query had not even advanced to a statutory notice stage. 247 The applicants contend that the Court should find that, knowing about the late TTR issue, Mr Cohen should not have provided the confirmation that he did on 17 September 2015. They contend that the Court should also find that the late TTR issue warranted the Bank suspending, cancelling, withdrawing, or varying the 2015 Entitlement Offer. 248 As to the account monitoring failure issue, Mr Cohen's evidence was that: 52. … at the time of the DDC process this was a compliance issue that had been self-identified, was close to being resolved and was not to my knowledge the subject of any communication with the regulator. I am not aware of the exact number of affected accounts that were known at the time but in any event it was not something that I understood to be material even when the number of affected accounts later came to my attention. I would not have considered it something that needed to be disclosed in the context of the Entitlement Offer. 249 As to the IDM ML/TF risk assessment non-compliance issue, Mr Cohen's evidence was that: 53. … even if I had understood CBA to have not complied with the Group's joint AML/CTF Program (AML/CTF Program) with respect to preparing an ML/TF Risk assessment of IDMs at or prior to their roll-out, I would not have understood it to be material … and I would again not have considered it something that needed to be disclosed in the context of the Entitlement Offer.

Further events concerning the late TTR issue 250 By 18 August 2015 the late TTR issue had been escalated to Mr Dingley (and others). At that time, Mr Dingley was the Chief Operational Risk Officer. As communicated in an email from Mr Byrne, the Bank's initial investigation at that time was that: RBS [Retail Banking Services] has determined that large cash deposits made thru these IDMs are not feeding the TTR process. It is determining when the issue started and consequently how many reports were not lodged. 251 Mr Dingley responded: … please push hard to get [the] facts quickly so we know how to respond. This does not sound good. 252 On 20 August 2015, Mr Dingley escalated the late TTR issue to Mr Toevs. In an email to Mr Toevs, Mr Dingley described the position as follows: … It appears as if the deposits made through this channel are not being reflected in the cash transaction report that is submitted to Austrac. I have not yet been able to establish if this (sic) for a period of time, or since the machines went into the network. This could go back to 2010 as a worse case scenario. Tony Byrne is working with RBS and ES to get all the facts. If this is systemic, it will be very disappointing as Tony Byrne has had prior confirmation from RBS Risk that this was operating correctly. 253 Mr Dingley also said: If [this] is a systemic issue, it may just tip the balance and it could be a tough ride with Austrac. 254 This last-mentioned comment was made in the context of Mr Dingley reporting to Mr Toevs that AUSTRAC had already raised concerns about the findings of the 2015 audit report (see [224] - [227] above). 255 By at least the morning of 4 September 2015, the late TTR issue had been escalated to Mr Narev who had asked for a "short briefing paper". By the afternoon, Mr Byrne had prepared a briefing paper. The briefing paper said that it had been discovered that the two deposits (which had been referred to the Bank by AUSTRAC) had not been reported "because of a system coding error dating back to November 2012" and that, at that stage, "the investigation has identified that 51,637 TTRs were not reported to AUSTRAC" which represented "approximately 2.5% of the total reportable transactions for the same period (November 2012 to 18 August 2015)". A prefatory section of the report noted that failure to comply with the obligation to lodge TTRs "can result in reputational damage and regulatory enforcement including fines and remedial action". 256 On 6 September 2015 an email exchange took place between Mr Narev and Mr Comyn. In that exchange, Mr Comyn said that "the full extent of the issue is [being] investigated". In response, Mr Narev said that he had spoken to Mr Toevs that day. He continued: It goes without saying that we need to take this extremely seriously. I have let Alden know that he should personally be in touch with Austrac about this, and offer up a discussion with me. We need to adopt a similarly senior posture with AFP, though I suspect David Cohen (also copied) may be the better contact with them given that there are current legal proceedings. Whilst this is as a result of unintentional coding related errors, the circumstances warrant very senior oversight. We need also to make sure that: - we are going through all relevant transactions to check for other problems - we have fixed the problem, and - no-one within the Group had knowledge of/concern about this issue. I understand we have no cause for concern about this, but I want to know that there was no avoidance of the issue/reluctance to escalate. 257 Mr Comyn replied on 7 September 2015 that the matter was being taken "very seriously" but that he had "zero concerns about the reluctance to escalate". 258 In submissions, the applicants make much of the fact that, in his affidavit, Mr Narev did not refer to this correspondence. The applicants also rely on other aspects of Mr Narev's cross-examination to contend that, in his affidavit, Mr Narev sought to minimise his initial reaction to the late TTR issue. 259 On reviewing the cross-examination of Mr Narev, I do not think that much turns on the fact that Mr Narev did not refer, specifically, to his email correspondence with Mr Comyn on 6 September 2015 in his affidavit. That said, I have no reason to doubt that this correspondence reflects Mr Narev's contemporaneous state of mind. 260 In addition, I do not think that, in his affidavit, Mr Narev sought to minimise his initial reaction to the late TTR issue. In his affidavit, he did say that he did not consider that the late TTR issue had exposed the Bank to a "risk" of regulatory action until about October/November 2016. However, in cross-examination, Mr Narev clarified that he meant a "serious risk" of regulatory action. In other words, although in early September 2015 he thought that the late TTR issue posed a risk of AUSTRAC taking regulatory action, it was not until October/November 2016 that he thought that there was a serious risk of that happening. Mr Narev's evidence was that, even then, he did not consider it to be "at all likely that AUSTRAC would commence regulatory action in the form of civil penalty proceedings in respect of the [late] TTR issue". I accept this evidence. 261 On 8 September 2015, Mr Toevs sent a letter to AUSTRAC notifying it that 51,637 TTRs had not been lodged for the period November 2012 to 18 August 2015. The letter advised AUSTRAC of the root cause of the problem and informed it of the "extensive remediation program" that the Bank would implement in response. This included the Bank retrospectively submitting "all of the reportable TTRs that resulted from the missing transaction code". 262 On 24 September 2015, the Bank wrote to AUSTRAC informing it that the late TTRs had been lodged. There were 53,506 TTRs so lodged. 263 On 12 October 2015, Mr Toevs, Mr Dingley, and Ms Williams (the Chief Compliance Officer) prepared a report for the Bank's Risk Committee which, after noting the outcome of the 2015 audit report, included the following: 3.4.2. Group Operational Risk and Compliance (GORC) has accepted the outcomes of the Internal Audit reviews and is driving a series of initiatives to deliver effective end-to-end governance over the control environment. 3.4.3. An example of the outcomes of these control issues and their ongoing rectification is that, following a recent investigation undertaken by the Bank into two unreported threshold transaction reports (TTRs) to AUSTRAC, it was identified that between November 2012 and August 2015, 51,637 cash deposits of over $10,000 conducted through intelligent deposit machines (IDMs) were unreported to AUSTRAC. This arose because of a coding error. 3.4.4. While there is no formal breach reporting requirement under the AML/CTF Act, the breach has been reported to AUSTRAC and the non-compliance remediated. We have also taken steps to ensure better assurance processes are in place to detect these types of failures going forward. By taking steps to rectify the reporting failure and improving our control environment we reduce the risk of any regulatory action being taken by AUSTRAC. 264 The report noted that, in Australia, regulatory action had been taken against Barclays Bank, Mega Bank and Tabcorp for AML/CTF breaches, resulting in enforceable undertakings being given and (in the case of Tabcorp) "Federal Court action". 265 The Bank's Board was informed of the late TTR issue at its meeting on 12 and 13 October 2015. 266 On 12 October 2015, AUSTRAC responded to the Bank's communications of 8 and 24 September 2015. In a letter to Mr Toevs, AUSTRAC expressed its "serious concerns" about the scale of the Bank's non-compliance with s 43 of the AML/CTF Act and the period over which those contraventions had occurred. 267 AUSTRAC sought further details from the Bank in the form of information and documents. Among the documents sought was "any ML/TF risk assessment the CBA conducted on the IDMs before rolling out these machines in May 2012". AUSTRAC sought a response by 26 October 2015. 268 The Bank provided that response by letter on 26 October 2015. In relation to the request for documents of any ML/TF risk assessment before rolling out IDMs, the Bank said: CBA considers that IDMs were an enhancement of the existing ATM functionality as a channel to provide designated services. As a result, CBA has relied upon the ML/TF risk assessments conducted on ATMs as a channel for providing designated services. 269 The Bank also said: No changes have been made to IDMs since 2012 to warrant any further risk assessment. There were no additional high rated ML/TF risks raised in relation to the roll out of IDMs that required escalation to the Board or senior management. IDMs were intended to provide deposit functionality (similar to that of Branches) and the existing AML transaction monitoring controls and TTR reporting were applied to deposits via IDMs.

Board meeting with AUSTRAC on 14 June 2016 270 On 18 April 2016, a briefing paper was prepared for the Board in relation to an upcoming lunch to be attended by the Board and several members of the Bank's management with Mr Jevtovic (the AUSTRAC CEO) and Mr Clark (the Deputy CEO). This was to be Mr Jevtovic's first meeting with the Board. The briefing paper noted Mr Jevtovic's "strong law enforcement background" which, at the time of his appointment in 2014, "was expected to mark a change in AUSTRAC's regulatory approach". The paper said that: Since his appointment, Mr Jevtovic has engaged in a program of reshaping and refocusing the activities of AUSTRAC. This has led to work commencing on a range of new initiatives. Many relate to developing greater partnerships with the private sector. … 271 An additional briefing paper was prepared for the Board on 27 April 2016. In relation to the Bank's regulatory relationship with AUSTRAC, the paper said: 13.1 Whilst CBA's collaboration on many of the initiatives set out above is viewed positively by AUSTRAC, their view of our compliance is less clear. 13.2 In the past year, there have been two issues which appear to have raised senior level concerns within AUSTRAC. 13.3 In May 2015, internal audit completed a review of AML/CTF systems across the Group. This review was undertaken as a result of an APRA Compliance Review in July 2014. 13.4 In July 2015, AUSTRAC raised concerns about findings in the review around potential transaction reporting failures. 13.5 A revalidation exercise was undertaken in relation to the transactions in question and it was determined that in most cases, the transactions identified by internal audit had either been reported manually, or were not reportable. 13.6 In September 2015, we notified AUSTRAC that we had identified that a number of transactions which were undertaken through intelligent deposit machines had not been reported to AUSTRAC. 13.7 AUSTRAC responded with two detailed requests for information in relation to this matter. The non-compliance detected has now been remediated. 272 The lunch was held on 14 June 2016. Mr Narev's evidence of the meeting was that it was "a general discussion about what [the Bank] was doing in the AML/CTF area" and that Mr Jevtovic "did most of the talking". Mr Narev recalled Mr Jevtovic saying words to the effect of "AUSTRAC's relationship with [the Bank] is very strong and I feel very positive about it". According to Mr Narev, nothing was raised at the meeting about the late TTR issue or any other concerns about the Bank's AML/CTF compliance. Mr Narev said that he left the meeting "thinking that the Group was doing well and that AUSTRAC did not seem to have any current areas of concern relating to the Group".

The statutory notices 273 On 22 June 2016, a notice was given to the Bank under s 167(2) of the AML/CTF Act seeking the production of information and documents (the first statutory notice). The notice was circulated to Mr Comyn and others by an email dated 23 June 2016. The content of the notice (and the background to it) was described by Mr Keaney (General Manager, Group Financial Crime Services) in a further email dated 13 July 2016 that was sent to various people, including Mr Comyn: On 22 June 2016, a statutory notice was received from AUSTRAC for the production of information and documents. Information collected under this notice could be used by AUSTRAC in civil penalty proceedings against the Group, although at this stage AUSTRAC is silent on its intentions. The notice is wide ranging but primarily relates to CBA's compliance with AUSTRAC's customer on-boarding and ongoing customer due diligence requirements. There is a particular focus on on-line account opening procedures, including electronic verification of customer identities, and the monitoring of transactions through Intelligent Deposit Machines. The notice also seeks detailed information in relation to 59 customers and 120 accounts, and asks for AML-related audit reports (over multiple years) as well as minutes of Board meetings where those reports were considered. This incident is related to the non-reporting of Threshold Transaction Reports for transactions undertaken through Intelligent Deposit Machines which was detected and self-reported to AUSTRAC in August 2015. Issues relating to that incident are largely closed out. The root cause for regulatory interest in relation to our customer on-boarding and ongoing customer due diligence processes more generally is not yet known. Further information on the root cause may be determined over the course of responding to the notice. Should AUSTRAC launch Federal Court proceedings against the Group (as in the case of Tabcorp) there will be reputational impacts. In addition, the Group would incur costs in defending such action. The maximum penalty that could potentially be applied by a court is $18 million per breach. Based on the CEO of AUSTRAC's description to the CBA Board just weeks ago that he has no concerns about the CBA's intention to be fully compliant with AML legislation, and his belief that the Group is a diligent manager of AML Risk (against a backdrop of significant business and technology complexity) it is hard to believe that AUSTRAC intends to impose significant penalties on the Group - especially given that the CEO Mr Jevtovic would have known about this imminent notice at the time he met with our Board and yet didn't raise it to offset his praise of the Group in relation to the management of financial crime. 274 Mr Keaney's email was forwarded to Mr Narev on the same day. 275 The applicants submit that, in his affidavit, Mr Narev sought to downplay the significance of the first statutory notice. I am not persuaded that that is so. Mr Narev was clearly conscious of the fact that information collected under the notice could be used by AUSTRAC in civil penalty proceedings. However, Mr Narev said: 89. Mr Keaney stated in his email that: "Information collected under this notice could be used by AUSTRAC in civil penalty proceedings against the Group, although at this stage AUSTRAC is silent on its intentions" and he provided a maximum penalty per breach as available under the AML/CTF Act. From my experience as CEO, it was common at any one time for several entities within the Group to be engaging with regulators (including ASIC, APRA and others, both domestic and foreign), including through formal and informal requests for information and documents at any given time. This included engaging through notices that could be used in civil penalty proceedings. The Regulatory Reports that I received routinely prior to CBA Board meetings, contained a table of "significant" interactions with a range of regulators for the previous period of which there were always several entries. However, as the Group had less experience in dealing with statutory notices from AUSTRAC, it made sense to me that Mr Keaney would confirm the use to which the notice could be put and the theoretical fines that could result. 90. For the reasons given in his email, I understood that Mr Keaney continued to think that AUSTRAC's concerns stemmed from the TTR Issue and that he did not believe that AUSTRAC intended to impose significant penalties on the Group, especially given recent interactions with Mr Jevtovic. This was consistent with my own view. My understanding was that the TTR Issue had been promptly actioned upon discovery by CBA and that AUSTRAC had only brought one civil penalty proceeding up until this point (against Tabcorp, which I expand on at paragraph 122 below). I did not consider there to be any likely prospect of AUSTRAC commencing civil penalty proceedings against CBA. 276 Despite some concessions made by Mr Narev in cross-examination to the effect that this was the first time the Bank had received a s 167(2) notice from AUSTRAC and that the Bank's receipt of similar notices from other regulators could not inform him of how seriously AUSTRAC was undertaking its inquiries, I accept the general thrust of Mr Narev's evidence as to his understanding at the time. 277 The applicants also submit that, in his affidavit, Mr Cohen sought to downplay the significance of the first statutory notice. Having reviewed Mr Cohen's evidence, I do not accept that submission. 278 At the request of the Bank's Legal Services team, a project team was formed to assist in maintaining confidentiality and legal privilege in respect of responses to the first statutory notice. This was part of a project called Project Concord (the project being the Bank's response to AUSTRAC's investigation as reflected in the first statutory notice). 279 On 2 September 2016, a second notice was given to the Bank under s 167(2). 280 On 14 October 2016, a third notice was given to the Bank under s 167(2) (the third statutory notice). 281 On 17 October 2016, an Executive Committee report was prepared seeking endorsement of a proposal to execute a program of work that would "establish the fundamentals for the Group to manage its financial crime risk effectively and efficiently over the next three years". The report commenced by noting: 1.1. The Executive Committee is aware of the Group's exposure to financial crime risk, including money-laundering, sanctions-violations and bribery and corruption, and of consequences of non-compliance, including fines by onshore and offshore regulators. 1.2. Notwithstanding the Group's investment in financial crime compliance in recent years, there is still a way to go, as recently confirmed by Group Audit. 1.3. The potential for fines or other regulatory action seem elevated in light of AUSTRAC recently issuing the Group with an Enforcement Notice, stemming from breaches in Threshold Transaction Reporting from branch-based Intelligent Deposit Machines. 1.4. Group Security is taking a leadership role in improving the Group's management of financial crime and is now returning to ExCo to provide an update and plan for the way forward. 282 As I have noted above, by October/November 2016, Mr Narev thought that there was a serious risk of AUSTRAC taking regulatory action in relation to the late TTR issue. However, he did not consider it to be likely that AUSTRAC would commence civil penalty proceedings. 283 Mr Narev gave this evidence, which I accept: 98. I recall that the updates in respect of AUSTRAC's notices continued to be very administrative (that is, they were updates on the status and timetable of CBA's responses to the notices) and discussion at CBA Board meetings about the issues was limited. AUSTRAC's enquiries were just one aspect of the Group's regulatory engagements at the time. Nobody suggested to me that this was more serious than the various other regulatory issues that the Group was dealing with at the time. That said, at about the time I became aware of AUSTRAC's third statutory notice, I started to become concerned by the fact that AUSTRAC was continuing to ask questions and seek documents notwithstanding that we had by now been engaging for more than a year. I turned my mind to the possibility that it may take some type of formal action against CBA. At the time, I thought that if AUSTRAC decided to take formal action, it was likely to involve some type of remedial direction, engagement of an external auditor, or enforceable undertaking. I based that view on my experience in dealing with other regulators over the course of my role, and my understanding of the issues and their status as set out above. To my mind, while AUSTRAC was asking a range of questions, their interest stemmed from the TTR Issue which CBA had been open with them about and had worked hard to address. Based on the reports I had read as described above, my understanding was that the issues had been closed out and that AUSTRAC had indicated that it was "comfortable" with how that had been done. My direct interactions with Mr Jevtovic had been positive, even at a CBA Board lunch directly before CBA received the first statutory notice as I have referred to above. In the circumstances, I did not consider it at all likely that AUSTRAC would commence civil penalty proceedings. I do not recall anyone expressing a different view. 284 The applicants place reliance on evidence given by the Chairperson of the Bank's Board, Ms Livingstone (who was appointed with effect from 1 January 2017), at the Financial Services Royal Commission: … either at the October meeting, and I think it was the October meeting, because I think by then the second notice had been received, I challenged management about why were we getting these notices. What was behind them. And was AUSTRAC concerned about something. And so the answer I received was, well, AUSTRAC knew that we were working hard and investing in our financial crimes compliance platform but that we weren't fully compliant at that time. And that there was significant work and significant investment going on, and that we were maintaining contact with AUSTRAC. And in addition, the then CEO of AUSTRAC had actually met with the board at its June 2016 meeting, at which I was not present, but had not raised any issues with the board at that meeting. I have to say, I was concerned about the fact of the notices, and I had had experience with AUSTRAC in a previous role. So it didn't feel quite right to me that AUSTRAC would be comfortable with where we were, but management provided assurances that they were fully informed about the situation of - in terms of our level of compliance. When you say "management", who provided those assurances?---The CFO did. 285 I do not think that this evidence advances matters substantively other than to confirm that, while service of the statutory notices was a matter of concern, senior executives in the Bank were of the view that the Bank was working productively with AUSTRAC in relation to the Bank's AML/CTF compliance issues and did not think that it was likely that AUSTRAC would commence civil penalty proceedings against the Bank.

The Bank's internal audit report 2016 286 In the meantime, on 28 September 2016, Group Audit delivered a report on a further internal audit in relation to the Bank's AML/CTF framework (the 2016 audit report). The 2016 audit report gave an overall "red" rating based on an "unsatisfactory" rating for "Control Environment" and a "marginal" rating for "Management Awareness & Actions". 287 In its Audit Conclusion, Group Audit noted (amongst other things) that: A large number of AML/CTF issues continue to exist across the Group, with weaknesses identified across Business Unit's (sic) … and Group-wide AML/CTF processes. A number of repeat issues were identified due to inadequate implementation of action plans. Many of the prior issues remain open, with projects currently underway or due to commence to revisit the AML/CTF operating model and completeness of AML/CTF data flows. 288 Group Audit also said: As part of this Audit, Internal Audit conducted an independent review of the Group's Part A AML/CTF Program as required by the AML/CTF Rules … Whilst we found that the Bank's AML/CTF framework covered all of the key requirements of an effective AML/CTF framework, we noted a number of gaps in the development of the program (for example, mapping of compliance obligations), and the implementation and operationalisation of the program … 289 Group Audit noted that the Group had been "slow to address many of the previously identified issues and associated root causes" and that a "number of significant issues from our Audits in 2013 and 2015 remain unaddressed and are either still being remediated … have been reopened due to inadequate remediation … or are yet to be addressed …".

Meeting with the AUSTRAC CEO 290 On 30 January 2017, Ms Livingstone had a meeting with Mr Jevtovic. Ms Livingstone did not give evidence in this proceeding, but her handwritten note of the meeting is in evidence. The note records, amongst other things, the following matters. 291 First, the note records Mr Jevtovic's view that the Bank's relationship with AUSTRAC was professional "outside of IDMs". The apparent concern in that regard appears to have been the late TTR issue and the Bank's failure to lodge TTRs as discussed above. However, the note records that, while that matter "warrants close scrutiny", the Bank did respond to "the systems issue". 292 Secondly, the note records that AUSTRAC was concerned about whether the Bank had done sufficient work on understanding AML/CTF risk. In this regard, the note refers to the 2015 internal audit and appears to question the Bank's "risk culture" (with the Bank's "poor performance" as against other banks noted). 293 Thirdly, the note records that AUSTRAC was concerned about the Bank's lack of reporting, its poor risk assessment, its slow response to risk assessment, and the fact that its IDMs had been compromised by organised crime. 294 Fourthly, the note refers to the issue of the three statutory notices, but records AUSTRAC's view that the Bank had responded adequately to the notices. 295 Fifthly, the note records that AUSTRAC had made no decision on what action "it may or may not take". The note appears to indicate that AUSTRAC would make a decision in that regard within two weeks, and that there were "options". 296 On 31 January 2017, Mr Narev (who, at this time, was concerned that the late TTR issue had been "dragging on" with AUSTRAC and that AUSTRAC might be considering taking action, such as an enforceable undertaking, which he wanted to avoid) sent Ms Livingstone an email in which he said: I am keen to get your instincts on how, if at all, you believe we can engage with [AUSTRAC] in advance of the final determination to influence it. 297 Mr Cohen gave evidence that he had a conversation with Ms Livingstone following her meeting with Mr Jevtovic in which she said that "[t]he discussion was unremarkable", that Mr Jevtovic was "fine", and that "AUSTRAC has no major issues", although there was "an ongoing investigation which we obviously know about". 298 This evidence was based on Mr Cohen's recollection of the conversation some years after the event (in the course of preparing his affidavit). Mr Cohen had not seen Ms Livingstone's note and had made no record of his conversation with her. Mr Cohen's recollection of the conversation does not sit well with the matters recorded in Ms Livingstone's note, which reflects a concern by AUSTRAC that was more significant than Mr Cohen's recollection of Ms Livingstone's words suggest. I consider that Ms Livingstone's note provides a more reliable picture of AUSTRAC's concerns at the time.

The development of Project Concord 299 The further action, if any, that AUSTRAC might take as a consequence of the late TTR issue remained a matter of abiding concern for the Bank. The Bank continued to consider the causes and impacts of that issue. 300 By 7 February 2017, Project Concord had expanded to include "an internal and external communications plan to be used in the event of public dialogue from AUSTRAC on the TTR matter". The concern appears to have been that, through various means, the fact that AUSTRAC was investigating the Bank in relation to the late TTR issue might or would become public knowledge. The Bank was concerned about bad publicity. One of the aims of the management of this issue was to seek to influence, to the extent possible, how the Bank's customers and investors would react upon becoming aware of the investigation of the late TTR issue. However, at that time, the plan did not envisage that AUSTRAC would commence proceedings against the Bank. 301 On 14 February 2017, Ms Watson (the Executive General Manager, Group Security and Advisory) sent an email to Mr Craig (the Bank's Chief Financial Officer), stating (amongst other things): - No new information from AUSTRAC - AUSTRAC have knocked back multiple requests for clarity - Paul Jevtovic has declined two invitations to meet with the CBA Board this week (invited May and June - no to both) - Latest update is Catherine Livingstone's where Paul said "I will let you know soon…" - Action could include: o Civil penalties following court proceedings o Enforceable undertaking style action o External review/audit of our financial crime arrangements. There would likely be a media overlay to any of these actions.

The settlement of the Tabcorp proceeding 302 On 16 February 2017, The Australian newspaper reported that Tabcorp had revealed the terms of a settlement with the AUSTRAC CEO in which it had agreed to pay a pecuniary penalty of $45 million. A copy of the article was sent, by internal email, to Mr Cohen. Mr Cohen's response was: Yes saw that today - this will potentially embolden AUSTRAC in its issue with us. 303 I understand Mr Cohen's reference to "its issue with us" to be to the late TTR issue. 304 Ms Watson sent an email to Mr Comyn and others attaching a media release and articles explaining the settlement. Mr Comyn's response was: Jeez, that's a lot of money. Can you please remind me of the nature of their breach. I hope it's much more severe than us? 305 Around 21 February 2017, Mr Cohen reviewed a draft regulatory report to be presented at the upcoming March 2017 Board meeting. The report was directed to regulatory matters concerning APRA, the Australian Securities and Investments Commission (ASIC), and other regulators (including AUSTRAC). Mr Cohen made a number of amendments to the draft including in relation to the section dealing with "Other Domestic Regulators and Financial Crime Compliance". As amended by Mr Cohen, the report provided the following update in relation to AUSTRAC's investigation into the late TTR issue (the italicised words are Mr Cohen's additions and the strike throughs are his deletions): There have been no further regulatory enquiries from AUSTRAC since 9 December 2016 but AUSTRAC has stated that it is considering whether to take regulatory action against CBA for failing to report transactions processed through Intelligent Deposit Machines when the final responses were submitted to the AUSTRAC notices on customer due diligence and ongoing customer due diligence requirements. CBA continues to meet with AUSTRAC and support its AUSTRAC's broader strategic initiatives. On 16 February 2017, it was reported that AUSTRAC had has reached a $45 million out of court settlement with Tabcorp for breaches of the AML/CTF Act. Tabcorp is the first entity against which AUSTRAC has ever sought to take civil penalty action. 306 In his affidavit, Mr Cohen commented that he could not recall the source of the added statement about AUSTRAC considering regulatory action. He expressed his confidence that the addition of this statement was not intended to indicate the view that AUSTRAC was considering civil penalty proceedings. In this connection, he referred to his use of the expression "regulatory action" which, in his understanding, conveys that there are a range of steps that are available to a regulator. He said that if, at the time, he had considered that the commencement of civil penalty proceedings against the Bank was a real risk, he would have used the words "commence legal proceedings". 307 Mr Cohen was challenged on this evidence in cross-examination. It was put to him that, by his affidavit, he was seeking to "ameliorate or alter the plain meaning of the contemporaneous record". 308 I do not accept that contention. First, I can think of no reason why, if Mr Cohen had considered the commencement of civil penalty proceedings to be a real risk, he would not have said so directly in the report. Secondly, AUSTRAC's armamentarium included a range of actions (discussed above). According to Ms Livingstone's note, Mr Jevtovic had communicated to her only some weeks beforehand that AUSTRAC had made no decision on what action "it may or may not take", and that it had "options". There is nothing in the evidence to suggest that this view had changed in the period between Ms Livingstone's meeting with Mr Jevtovic and Mr Cohen's amendment to the draft report.

7 March 2017 meeting with AUSTRAC 309 On 7 March 2017, Ms Watson and Mr Keaney met with AUSTRAC. Ms Watson summarised the meeting in an email to Mr Craig on 8 March 2017, as follows: Matt Keaney and I met with AUSTRAC yesterday. They described their view of the TTR and associated matters as "serious, significant and systemic". They also said our failure to immediately and proactively tell them about these and other problems (here they were talking about control weaknesses over multiple years, etc) is a show of bad faith which leads them to wonder what else is broken across CBA's financial crime landscape. They said they have not made a determination but it isn't far off. And in either a slip or a deliberate signal they said "we will tell you before we go public or to media." Legal is helping draft a defence outline so we can work out what we do under a civil penalty scenario in particular. I didn't get any sense of them being interested in us putting an EU to them - they told me that the ball is in their court and they're going to make a decision then either advise or consult with us. 310 A copy of the email found its way to Mr Narev. Mr Narev gave this evidence: 109. I understood the discussion that AUSTRAC had with Ms Watson and Mr Keaney as an opening up of the lines of communications with CBA, and I also anticipated that AUSTRAC had used this opportunity to play 'hardball' ahead of further discussions between the parties. In that context, I was not surprised by the message from AUSTRAC, including the fact that AUSTRAC had described CBA's conduct as "serious, significant and systemic" - this was the first time I had seen that language used in CBA's engagement with AUSTRAC, and I interpreted it as part of AUSTRAC's desire to be taken seriously ahead of discussions. In response, I suggested CBA take the initiative, and seek to initiate high level discussions involving Mr Jevtovic, Ms Livingstone and myself. I wanted to quickly engage with AUSTRAC at the highest levels of the organisations. My view was that now that we had heard from AUSTRAC, and that it appeared it was contemplating some type of action but had not yet made a determination, it was time for CBA to step up its attempts at engagement with them. While my view remained that a civil penalty proceeding continued to be unlikely, at about this time (I do not now recall precisely when), I did turn my mind to what the outcome might look like for CBA, in what I considered to be the unlikely event that civil proceedings were commenced in respect of the TTR Issue. To the best of my recollection, I speculated that a penalty might be in the region of about $10 million, because I viewed the TTR Issue as a single event resulting from an unintended software glitch. 311 Mr Narev forwarded Ms Watson's email to Ms Livingstone, saying: Obviously not good news here, though also not surprising. The judgment call we need to make from here is whether at the Chair/CEO level we ought to reach out again before a final determination? 312 Ms Livingstone responded: Agree - not good news. Paul didn't say anything on Monday and in fact could not have been more friendly. It might be a good idea if you and I together seek a meeting with Paul. If they speculate publicly about 'what else is broken' it will play into the very convenient culture rhetoric. We must make sure that we are dealing with facts and not supposition. 313 I understand the reference to "Paul" in Ms Livingstone's email to be to Mr Jevtovic.

21 March 2017 meeting with AUSTRAC 314 On 21 March 2017, Mr Narev and Ms Livingstone met with Mr Jevtovic and Mr Clark. In preparation for that meeting Mr Narev drafted a "high level script". This script envisaged that Mr Narev would suggest to AUSTRAC that the Bank and AUSTRAC: … [engage] heavily now, in good faith, prior to any formal action, in discussions that would result, within a month, in an agreed path that involves acknowledgement for our part of weaknesses, a clear commitment to remediation, and a monetary fine. We would engage senior subject matter experts rather than lawyers (though of course some legal input would be necessary). And those experts would report directly to us. At a minimum, if that does not work within the relevant legal frameworks, it would involve an announcement by Austrac that it is commencing proceedings, accompanied by a clear statement that Austrac and CBA are already working constructively towards a solution. 315 It is apparent that, in preparing this script, Mr Narev's thinking was to attempt to negotiate an outcome with AUSTRAC which, preferentially, did not involve the bringing of proceedings for a civil penalty. In that regard, it is apparent that he thought that he could agree on a monetary "fine" with AUSTRAC without further action being taken. 316 As events transpired, Mr Narev's thinking changed with respect to the approach to be taken at the meeting. A further draft script (this time comprising bullet points) omitted the above quoted passage and any reference to payment of a "fine". 317 In oral closing submissions (in reply), the applicants pointed to a document prepared by Ms Watson entitled: "Do we believe we can influence the outcome?". The document appears to have been prepared around 15 March 2017. It discusses the possible action that AUSTRAC might take and the Bank's preferred outcome. 318 The applicants refer to a part of the document that recognises (contrary to what seems to have been Mr Narev's understanding at the time) that a "fine" could not be imposed by AUSTRAC "outside of court proceedings". The applicants submit that this realisation is the reason why Mr Narev's thinking changed with respect to the approach to be taken at the meeting. I note, however, that the document also suggests that the Bank not offer a "fine", not just because AUSTRAC "can't do it" but also because "the EU should be to prevent a fine on any known issues or new issues found through the review". This reference, read with other elements of the document, suggests that the Bank had in mind that it could influence AUSTRAC to require the Bank to give an enforceable undertaking rather than proceeding down the path of civil penalty proceedings (notwithstanding the reservation expressed in Ms Watson's email of 8 March 2017 (see [309] above)). Another part of the document looks to the possibility that another preferred outcome would be the appointment of an external auditor. Read as a whole, the document shows that the Bank believed that there was, indeed, a prospect of influencing AUSTRAC's thinking as to the course it could follow. 319 Mr Narev gave evidence of the discussion at the meeting. After recounting statements made by Mr Jevtovic and Mr Clark about the general nature of the engagement between the Bank and AUSTRAC, Mr Narev gave this evidence of the discussion: Mr Jevtovic: We have been looking into the information which CBA had been providing to us, and we have found some other things beyond the non-reporting of the TTRs. As recently as January, something happened that concerned us. We are looking into possible failures to lodge reports, submit reports linked to investigations, do some on­going customer due diligence, and undertake adequate risk assessment of the IDMs. We think this is serious because of the scale of the IDMs, which should have prompted an earlier risk assessment than what was undertaken in mid-2016. Internal advice had highlighted the risk of IDMs. I wonder whether CBA's investment has necessarily been in the right place. We think accounts have remained open without follow-up. We also think that CBA's SMR policy may contradict the Act. There is a written policy which suggests that once SMRs had been submitted, further SMRs did not need to be. In terms of next steps, AUSTRAC is going to take an evidence-based approach. The options for us are an external auditor, a remedial direction, seeking an Enforceable Undertaking, or instituting civil penalty proceedings. We think it will take approximately one more month until we decide which path we want to follow. As we consider our options, CBA's leadership approach will be critical. This is the first time that a Chair and CEO have ever come personally to AUSTRAC, and that makes a difference. We are also very encouraged by Philippa's leadership and her relationship with Peter. Ms Livingstone: I have met with Paul prior to this meeting, on matters unrelated to these issues. We acknowledge that the issues you are now raising are serious, and that CBA needs to do better. We do think it is important that the path forward be constructive. Beyond the regulatory issues, there are potential reputational issues that are important to CBA, and it is key to us that it is not portrayed that CBA has a cavalier and disrespectful approach. It is clear that this is about systems, policy and capability, not bad intent. Our priority is to make sure this process sticks to the facts. Mr Jevtovic: We are not interested in adding to "bank bashing", and in fact all the major banks have been important and constructive partners for us. We will give you advance notice once we have decided what path to go down. We will definitely not do anything without telling CBA first, and we'll allow CBA time to consider what AUSTRAC is going to do. The work that CBA has done in recent times will be instrumental in shaping AUSTRAC's thinking about which path it will take. Ms Livingstone: We will have Philippa Watson articulate CBA's vision today and walk that over. 320 Mr Narev's evidence in this regard was not challenged substantively in cross-examination. I note that, consistently with Mr Jevtovic's advice to Ms Livingstone at their meeting on 30 January 2017, and the indication given at the meeting on 7 March 2017 between AUSTRAC and Ms Watson and Mr Keaney, AUSTRAC was still referring to "options" which not only included civil penalty proceedings, but other regulatory action which was available to it. In cross-examination, Mr Narev accepted that it was fair to say (apparently based on his understanding of the matter) that AUSTRAC was seriously considering all options, including civil penalty proceedings. Even so, Mr Jevtovic had made it clear that AUSTRAC had not made a decision about "the path we want to follow". He had also made it clear that AUSTRAC would give the Bank "advance notice once we have decided what path to go down" and provide the Bank with an opportunity to consider what AUSTRAC was going to do. 321 Although Mr Narev did not deploy the idea of agreeing to an outcome with AUSTRAC that involved the bank paying a "fine", he was cross-examined on his preparation of the first draft of the script. Mr Narev accepted that, at that time, his thinking was that it was "highly likely", but not inevitable, that AUSTRAC would be seeking a "fine" from the Bank. 322 On 27 March 2017, Ms Watson sent a letter to Mr Clark referring to the meeting with Mr Narev and Ms Livingstone on 21 March 2017. The letter affirmed the Bank's commitment to combatting financial crime and advised on key enhancements the Bank had made to the way in which it managed its AML/CTF obligations and the actions it had taken to address specific concerns that had been raised by AUSTRAC through the statutory notices. The letter also spoke of the steps that the Bank had taken to strengthen its "AML/CTF capability".

Mr Jevtovic leaves AUSTRAC 323 On 13 April 2017, it was announced that Mr Jevtovic was leaving AUSTRAC. In a departing public statement, Mr Jevtovic said: I want to also acknowledge the strong support for our vision received from industry, particularly CBA, NAB, Westpac, ANZ, Western Union, PayPal and Thomson Reuters, as well as partners in academia, non-government organisations and the community. 324 On that day Ms Watson sent an email to Mr Craig, saying: As you see, some positive statements about CBA. I connected with Peter Clarke (sic) (the acting CEO) on a separate issue prior to this announcement and received a warm note back, signed "cheers" so perhaps all the effort we have made to build the relationship with AUSTRAC is starting to pay off. Time will tell. We still need to get the enhancement work done as a priority, so we're driving that. 325 Mr Craig forwarded this email to Mr Narev. Mr Craig's accompanying message to Mr Narev included the following: Philippa has developed an excellent relationship with Peter Clarke (sic) and has accepted his invitation to attend a Conference that he is co-leading in Moscow in a couple of week's time. 326 From that time, up to 3 August 2017, there were no substantive updates from AUSTRAC. However, on 13 April 2017, the Bank did respond to a request from AUSTRAC (made on 1 March 2017) for further information in relation to two matters arising from the Bank's responses to the first and third statutory notices (issued on 22 June 2016 and 14 October 2016, respectively) in respect of the account monitoring failure issue. 327 Also, on 22 June 2017, Ms Watson had a telephone discussion with the Acting Deputy CEO of AUSTRAC and Head of Enforcement on a range of matters. The call was initiated by Ms Watson. In an email to Mr Craig on that day, Ms Watson said: We explained that the call was very much in the spirit of wanting to maintain an open dialogue and to demonstrate our commitment to building a trust-based relationship where an early "heads up" on matters reinforces the relationship. 328 As to this communication, Ms Watson said: "All in all, it was a good call". Ms Watson reported that, in the call, she raised the "TTR/IDM Issue" but was told that "things had slowed at AUSTRAC". The indication was given to Ms Watson that AUSTRAC was hoping to inform the Bank of its deliberations "by late July". 329 Mr Narev forwarded Ms Watson's email to Ms Livingstone, saying: A good update; and a sign that the relationship management is good. Though of course the risks all remain. 330 In his evidence, Mr Narev described his reaction to Ms Watson's email as one of "cautious optimism". He said: I thought AUSTRAC was likely in a period of disorganisation following the announcement of Mr Jevtovic's departure, and that there was likely to be a further period before AUSTRAC made any decision about CBA. It seemed to me that there continued to be a very constructive relationship between the two organisations, and while I was aware AUSTRAC still needed to make a decision on its approach, I thought this was a good update from CBA's perspective, but was not a cause for complacency. 331 On 23 June 2017, Mr Narev had a meeting with the Minister for Justice and Minister Assisting the Prime Minister on Counter Terrorism, the Honourable Michael Keenan. Mr Narev wanted to meet Mr Keenan prior to any further developments with AUSTRAC. In an email (which included Mr Craig and Ms Watson as recipients), Mr Narev described the meeting as "very valuable" and reported: … Key points are as follows: - The Minister is aware of Austrac's investigations - This is very much Austrac's process, ie he does not expect to have significant involvement - He has heard directly that Austrac considers us to have a partnership approach. He noted specifically that he was made aware that Catherine and I had made the effort to go and visit - In that sense it was considered a different type of issue than Tabcorp - Although of course there is currently a leadership change, he believes these views are shared by the level below Paul as well, ie the key acting leaders. Whilst of course this does not alter the seriousness with which we should take all this, nor remove the risk, it does show that the approach we are taking in our interactions is unquestionably the right one.

The Bank develops a communications strategy on a "worst case scenario" 332 By 22 March 2017, Project Concord had reached the stage of formulating a communications strategy should AUSTRAC commence proceedings against the Bank, described as a "worst case scenario". The strategy was based on the events attending the Tabcorp proceeding. It also focused on AUSTRAC's investigation of the late TTR issue.

AUSTRAC informs the Bank it is commencing proceedings 333 At about 10.18 am on 3 August 2017, Mr Narev received a message that Mr Clark of AUSTRAC needed to speak to him "quite urgently". Shortly after receiving the message, Mr Narev telephoned Mr Clark, who, according to Mr Narev, said: AUSTRAC is issuing civil proceedings against CBA in around 15 minutes. We will arrange service of the relevant court documents and this will be followed shortly after by a media release from AUSTRAC. 334 Mr Narev's response to Mr Clark was: This is exactly what you said you wouldn't do. 335 Mr Clark replied: I hope this doesn't harm the relationship AUSTRAC has with CBA. 336 I accept that Mr Clark's message took Mr Narev (and the Bank) by surprise, in that AUSTRAC had informed the Bank on a number of occasions that it would give advance notice of any action it decided to take to enable the Bank to consider its position. No doubt, from the Bank's perspective, adequate notice would have provided it with the opportunity to make further representations to AUSTRAC.

AUSTRAC announces the commencement of proceedings 337 At 12.26 pm on 3 August 2017, AUSTRAC posted the following Tweet: 338 The Tweet linked to the following media release posted on AUSTRAC's website: 339 It will be apparent that the media release refers to, sequentially, the IDM ML/TF risk assessment non-compliance issue, the account monitoring failure issue, and the late TTR issue. However, importantly, the media release also refers to two other issues of non-compliance - the Bank's failure to report suspicious matters (either on time or at all) for transactions totalling over $77 million, and the Bank's failure to monitor customers even after becoming aware of suspected money laundering or structuring in respect of accounts held with the Bank. 340 The media release also communicated AUSTRAC's view that, by commencing proceedings against the Bank, it was sending "a clear message" to all reporting entities about "the importance of meeting their AML/CTF obligations". 341 This media release conveyed significant public censure by AUSTRAC of the Bank's failings. It conveyed the message that AUSTRAC's action against the Bank should be taken by other reporting entities as a warning that similar strong action could be expected for like conduct. It included a link to the Concise Statement that AUSTRAC had filed (which is reproduced in Schedule 1 to these reasons). 342 The Concise Statement contains significantly more detail than the media release. Paragraph 6 deals with the IDM ML/TF risk assessment non-compliance issue and para 8 deals with the account monitoring failure issue. However, para 7 refers to another area of alleged non-compliance: CommBank has not introduced appropriate risk-based systems and controls to mitigate and manage the higher ML/TF risks it reasonably faces by providing designated services through IDMs, contrary to Section 2 of Part A [of the Bank's AML/CTF Program]. 343 Paragraphs 9 and 10 refer to the late TTR issue. However, para 10 includes the following additional information: … 1,640 of the Late TTRs (totalling about $17.3 million) related to transactions connected with money laundering syndicates being investigated and prosecuted by the Australian Federal Police (AFP) or accounts connected with those investigations. A further 6 of the Late TTRs related to 5 customers who had been assessed by CommBank as posing a potential risk of terrorism or terrorism financing. Two of the Late TTRs were lodged with AUSTRAC on 24 August 2015 and the remaining 53,504 were lodged with AUSTRAC on 24 September 2015. 344 Paragraphs 11 to 14 refer to the Bank's alleged failure to lodge SMRs and to carry out ongoing due diligence on accounts, even after becoming aware of suspected money laundering and the structuring of accounts: 11. Suspected money laundering was conducted through CommBank accounts, by way of cash deposits, many through IDMs, followed immediately by international and domestic transfers. Many of the cash deposits were 'structured' by customers: that is, deposited in amounts just under the threshold transaction limit to avoid triggering CommBank's obligation to give a TTR to AUSTRAC. Structuring is an offence under s 142 of the Act. 12. Despite identifying the pattern of activity on these accounts as suspicious and indicative of money laundering, CommBank repeatedly failed to comply with its obligations to give a suspicious matter report (SMR) to AUSTRAC either at all or within the time required by s 41 of the Act. In part, this was because CommBank adopted a policy not to submit SMRs if the same type of suspicious behaviour had been reported any time within 3 months prior. In other cases, SMRs were not reported because no transaction monitoring alert had been raised, alerts had not been reviewed, or, where alerts had been raised and reviewed, CommBank only partially reported its suspicions. CommBank also failed to lodge SMRs because notifications by law enforcement of unlawful activity were ignored. 13. Section 36 of the Act requires CommBank to monitor its customers with a view to identifying, mitigating and managing ML/TF risk. CommBank failed to do this, including because in some instances, no transaction monitoring alerts were raised for suspicious activity, and, when alerts were raised, they were not reviewed in a timely manner having regard to ML/TF risk (in many instances, alerts were not reviewed for months after they were raised). In many cases, the accounts the subject of money laundering were not being monitored at all. 14. Even after suspected money laundering or structuring on CommBank accounts had been brought to CommBank's attention (by law enforcement or through internal analysis), CommBank did not monitor its customers with a view to mitigating and managing ML/TF risk, including the ongoing ML/TF risks of doing business with these customers. Rather, once suspected money laundering or structuring had been identified on these accounts, CommBank often looked no further than whether or not to submit an SMR. The Rules require mandatory enhanced customer due diligence (ECDD) where a s 41 suspicion is formed. CommBank did not carry out any ECDD on these accounts (such as identifying the source of the customer's wealth or terminating accounts) either at all or until after several SMRs had been raised. When CommBank terminated accounts, customers were generally given 30 days' notice. Suspicious transactions were allowed to, and did, continue during the notice period on some of these accounts. 345 The Concise Statement then proceeds to give details of the consequences of the Bank's failings in relation to the activities of four money laundering syndicates (paras 15 to 29) and a "cuckoo smurfing" syndicate (paras 30 to 34). ("Cuckoo smurfing" is a particular form of money laundering.) 346 Finally, paras 35 to 37 provide other instances of non-compliance by the Bank with its AML/CTF obligations. 347 It will be noted that, even though Mr Clark had told Mr Narev after 10.18 am on 3 August 2017 that AUSTRAC would be commencing proceedings, the Concise Statement had, in fact, been lodged with the Court for filing at 9.39 am on that day. In other words, AUSTRAC had taken steps to commence enforcement proceedings seeking pecuniary penalties against the Bank without prior warning or, indeed, the advance notice that AUSTRAC said that it would give to the Bank when it had arrived at a decision as to the action, if any, it intended to take. Contrary to the expectation that AUSTRAC had engendered, the Bank did not have an opportunity to consider its position in relation to AUSTRAC's decision. No doubt that consideration would have included whether steps could, or should, be taken by the Bank to attempt to dissuade AUSTRAC from taking its chosen course. 348 I will refer to AUSTRAC's Tweet, its media release, and the Concise Statement as the 3 August 2017 announcement.

The Bank's media release 349 On 3 August 2017, the Bank issued the following media release: Commonwealth Bank today acknowledges that civil proceedings have been brought by the Australian Transaction Reports and Analysis Centre (AUSTRAC). The proceedings relate to deposits made through our Intelligent Deposit Machines from 2012. We have been in discussions with AUSTRAC for an extended period and have cooperated fully with their requests. Over the same period we have worked to continuously improve our compliance and have kept AUSTRAC abreast of those efforts, which will continue. We take our regulatory obligations extremely seriously and we are one of the largest reporters to AUSTRAC. On an annual basis we report over four million transactions to AUSTRAC in an effort to identify and combat any suspicious activity as quickly and efficiently as we can. We have invested more than $230 million in our anti-money laundering compliance and reporting processes and systems, and all of our people are required to complete mandatory training on the Anti-Money Laundering and Counter-Terrorism Financing Act. Money laundering undermines the integrity of our financial system and impacts the Australian community's safety and wellbeing. We will always work alongside law enforcement, intelligence agencies and government authorities to identify, disrupt and prevent this type of activity. We are reviewing the nature of the proceedings and will have more to say on the specific claims in due course. 350 It is noteworthy that the Bank's media release referred to AUSTRAC's action against it as relating to "deposits made through our Intelligent Deposit Machines from 2012". The proceeding commenced by AUSTRAC against the Bank concerned non-compliance that was far more extensive than the late TTR issue. The focus of the Bank's media release on the late TTR issue reveals the Bank's perception that this issue was the one that had attracted AUSTRAC's concern and was the catalyst for AUSTRAC commencing proceedings - not the IDM ML/TF risk assessment non-compliance issue, the account monitoring failure issue, or any other issue. 351 It would seem that the Bank was mistaken in this perception. Much of the Concise Statement was directed to the Bank's failure to file SMRs, the Bank's actual awareness of suspicious transactions, and its failure to carry out ongoing due diligence. The Bank's failure to lodge TTRs is implicated in some of this conduct, but that failure is only an aspect of what was identified by AUSTRAC as more extensive, and condemnatory, conduct by the Bank.

The market disclosure regime governing the Bank's obligations of disclosure 352 The Bank is, and was at all times relevant to this proceeding, included in the official list of the financial market operated by the ASX. Its shares are "ED securities" for the purposes of s 111AE of the Corporations Act and are able to be acquired and disposed of by investors on the financial market operated by the ASX. 353 The Bank is, and was at all time relevant to this proceeding, a "disclosing entity" within the meaning of s 111AC(1), and a "listed disclosing entity" within the meaning of s 111AL(1), of the Corporations Act. 354 Section 674(1) of the Corporations Act provides: Obligation to disclose in accordance with listing rules (1) Subsection (2) applies to a listed disclosing entity if provisions of the listing rules of a listing market in relation to that entity require the entity to notify the market operator of information about specified events or matters as they arise for the purpose of the operator making that information available to participants in the market. 355 In turn, s 674(2) (as it applies in the present case) provides: (2) If: (a) this subsection applies to a listed disclosing entity; and (b) the entity has information that those provisions require the entity to notify to the market operator; and (c) that information: (i) is not generally available; and (ii) is information that a reasonable person would expect, if it were generally available, to have a material effect on the price or value of ED securities of the entity; the entity must notify the market operator of that information in accordance with those provisions. Note 1: Failure to comply with this subsection is an offence (see subsection 1311(1)). Note 2: This subsection is also a civil penalty provision (see section 1317E). For relief from liability to a civil penalty relating to this subsection, see section 1317S. Note 3: An infringement notice may be issued for an alleged contravention of this subsection, see section 1317DAC. 356 Section 677 of the Corporations Act is a facultative provision. As it applies in the present case, it provides: For the purposes of sections 674 and 675, a reasonable person would be taken to expect information to have a material effect on the price or value of ED securities of a disclosing entity if the information would, or would be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of the ED securities. 357 In Grant-Taylor v Babcock & Brown Ltd (in liquidation) [2016] FCAFC 60; 245 FCR 402 (Babcock & Brown), the Full Court (at [92]) addressed the statutory purposes for the continuous disclosure regime. The Full Court said that the main purpose is to achieve a well-informed market leading to greater investor confidence, with the object of enhancing the integrity and efficiency of capital markets through the timely disclosure of price or market sensitive information. Further, the Full Court (at [93]) observed that ss 674 to 677 of the Corporations Act are remedial or protective legislation. With reference to James Hardie Industries NV v Australian Securities and Investments Commission [2010] NSWCA 332; 274 ALR 85 (James Hardie) the Full Court (at [356]) said that those provisions should be construed beneficially to the investing public, in a manner that gives the fullest relief which the fair meaning of their language allows. 358 The Bank is subject to, and bound by, the Listing Rules of the ASX (the ASX Listing Rules). 359 Rule 3.1 provides that, once an entity is or becomes aware of any information concerning it that a reasonable person would expect to have a material effect on the price or value of the entity's securities, the entity must immediately tell the ASX that information. In Babcock & Brown at [95], the Full Court said that the "Listing Rule 3.1 concept" should be read as implicitly embracing the elaboration that s 677 of the Corporations Act provides. 360 Exceptionally, however, r 3.1A provides that r 3.1 does not apply to particular information while certain cumulative criteria are satisfied in relation to that information. 361 First, one or more of the following must apply: (a) it would be a breach of a law to disclose the information; (b) the information concerns an incomplete proposal or negotiation; (c) the information comprises matters of supposition or is insufficiently definite to warrant disclosure; (d) the information is generated for the internal management purposes of the entity; or (e) the information is a trade secret. 362 Secondly, the information must be confidential and ASX has not formed the view that the information has ceased to be confidential. 363 Thirdly, a reasonable person would not expect the information to be disclosed. 364 The Bank relies on the r 3.1A exception in respect of each disclosure which the applicants allege that the Bank should have made to the ASX.

The applicants' case: an overview 365 The applicants' case is that the Bank has contravened s 674(2) of the Corporations Act by failing to disclose to the ASX during the relevant period, one or more of a number of categories of information, being the pleaded Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information. 366 The applicants contend that there are only two issues in relation to their case on liability. 367 The first issue is whether the Bank "had" the pleaded forms of the information. This involves consideration of whether officers of the Bank were "aware" of the pleaded information in the requisite sense, and whether the ASX Listing Rules required that information to be disclosed. 368 The second issue is whether, assuming the first issue is decided in the applicants' favour, each category of the pleaded information was material in the sense that a reasonable person would expect it to have a material effect on the price of the Bank's shares: s 674(2)(c)(ii). As noted above, this is answered affirmatively if the information would, or would be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of the Bank's shares: s 677. 369 The applicants submit that each issue should be answered affirmatively.

The Late TTR Information 370 The applicants plead three forms of the Late TTR Information.

The June 2014 Late TTR Information 371 The June 2014 Late TTR Information as pleaded, and supplemented by further particulars, is: From around November 2012 to 16 June 2014: (a) CBA had failed to give TTRs for 12,374 cash transactions of $10,000 or more processed through IDMs following the introduction of IDMs (June 2014 Late TTRs); (b) the June 2014 Late TTRs represented between approximately 80% and 95% of threshold transactions that occurred through CBA's IDMs during the period from around November 2012 to June 2014; (c) the June 2014 Late TTRs had a total value of approximately [$]143.7 million; (d) the June 2014 Late TTRs had not been lodged, at least in part because of a systems error which had occurred in or around November 2012; and (e) the cause of the June 2014 Late TTRs had not been rectified. (the June 2014 Late TTR Information).

The August 2015 Late TTR Information 372 The August 2015 Late TTR Information as pleaded, and supplemented by further particulars, is: From around November 2012 to 11 August 2015: (a) CBA had failed to give TTRs for 50,385 cash transactions of $10,000 or more processed through IDMs following the introduction of IDMs (August 2015 Late TTRs); (b) the August 2015 Late TTRs represented between approximately 80% and 95% of threshold transactions that occurred through CBA's IDMs during the period from November 2012 to August 2015; (c) the August 2015 Late TTRs had a total value of approximately $588.6 million dollars; (d) the August 2015 Late TTRs had not been lodged, at least in part because of a systems error which occurred in or around November 2012; and (e) the cause of the August 2015 Late TTRs had not been rectified. (the August 2015 Late TTR Information).

The September 2015 Late TTR Information 373 The September 2015 Late TTR Information, as pleaded, is: From around November 2012 to 8 September 2015: (a) CBA had failed to give TTRs on time for approximately 53,506 cash transactions of $10,000 or more processed through IDMs following the introduction of IDMs (September 2015 Late TTRs); (b) the September 2015 Late TTRs represented between approximately 80% and 95% of threshold transactions that occurred through CBA's IDMs during the period from November 2012 to September 2015; (c) the September 2015 Late TTRs had a total value of approximately $624.7 million dollars; (d) the September 2015 Late TTRs had not been lodged, at least in part because of a systems error which occurred in or around November 2012 (the September 2015 Late TTR Information).

The Account Monitoring Failure Information 374 The applicants plead three forms of the Account Monitoring Failure Information.

The June 2014 Account Monitoring Failure Information 375 The June 2014 Account Monitoring Failure Information, as pleaded, is: From around 16 June 2014 or shortly thereafter, CBA was aware (within the meaning of ASX Listing Rule 19.12) that from at least 20 October 2012 CBA had failed to conduct account level monitoring with respect to approximately 676,000 accounts (the June 2014 Account Monitoring Failure Information).

The August 2015 Account Monitoring Failure Information 376 The August 2015 Account Monitoring Failure Information, as pleaded, is: From around 11 August 2015 or shortly thereafter, CBA was aware (within the meaning of ASX Listing Rule 19.12) that from at least 20 October 2012 to 11 August 2015, CBA failed to conduct account level monitoring with respect to 778,370 accounts (the August 2015 Account Monitoring Failure Information).

The September 2015 Account Monitoring Failure Information 377 The September 2015 Account Monitoring Failure Information, as pleaded, is: From around 8 September 2015 or shortly thereafter, CBA was aware (within the meaning of ASX Listing Rule 19.12) that from at least 20 October 2012 to 8 September 2015, CBA failed to conduct account level monitoring with respect to 778,370 accounts (the September 2015 Account Monitoring Failure Information).

The IDM ML/TF Risk Assessment Non-Compliance Information 378 The applicants plead two forms of the IDM ML/TF Risk Assessment Non-Compliance Information.

The June 2014 IDM ML/TF Risk Assessment Non-Compliance Information 379 The June 2014 IDM ML/TF Risk Assessment Non-Compliance Information, as pleaded, is: From around 16 June 2014, or shortly thereafter, CBA was aware (within the meaning of ASX Listing Rule 19.12) of the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information, namely that CBA had failed in the period prior to the roll-out of CBA's IDMs in May 2012 or at any time since May 2012 to carry out any assessment of ML/TF Risk in relation to or including the provision of designated services through CBA's IDMs, as required to comply with CBA's AML/CTF Program.

The August 2015 IDM ML/TF Risk Assessment Non-Compliance Information 380 The August 2015 IDM ML/TF Risk Assessment Non-Compliance Information, as pleaded, is: Further or alternatively, from 11 August 2015, or shortly thereafter, CBA was aware (within the meaning of ASX Listing Rule 19.12) of the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information; namely that CBA had failed: (a) in the period prior to the roll-out of CBA's IDMs in May 2012, and between May 2012 and July 2015, to carry out any assessment of ML/TF Risk in relation to or including the provision of designated services through CBA's IDMs, as required to comply with CBA's AML/CTF Program; further or alternatively, (b) in the period since July 2015, to carry out an assessment of ML/TF Risk in relation to or including the provision of designated services through CBA's IDMs that followed the procedures in, and/or complied with the requirements of, CBA's AML/CTF Program.

The Potential Penalty Information 381 The Potential Penalty Information, as pleaded, is: From around 16 June 2014 or shortly thereafter, or alternatively 11 August 2015 or shortly thereafter, or alternatively 8 September 2015 or shortly thereafter, or alternatively 24 April 2017 or shortly thereafter, CBA was potentially exposed to enforcement action by AUSTRAC in respect of allegations of serious and systemic non-compliance with the AML/CTF Act, which might result in CBA being ordered to pay a substantial civil penalty (Potential Penalty Information).

The significance of the applicants' pleading 382 A contravention of s 674(2) of the Corporations Act must be "finally and precisely" pleaded and the party making the allegations must "identify the case it seeks to make … clearly and distinctly": Cruickshank v Australian Securities and Investments Commission [2022] FCAFC 128; 292 FCR 627 (Cruickshank) at [120]; see also TPT Patrol Pty Ltd, as trustee for Amies Superannuation Fund v Myer Holdings Limited [2019] FCA 1747; 140 ACSR 38 (TPT Patrol) at [1121]. This is a matter that I emphasised when dealing with the Bank's objection to an earlier form of the statement of claim: Zonia Holdings Pty Ltd v Commonwealth Bank of Australia Limited [2018] FCA 659 at [24]. 383 The applicants' pleaded case proceeds on the basis that the pleaded forms of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information - which I will call, collectively, the Information (as did the expert witnesses) - set the metes and bounds of the information that the Bank was obliged to disclose, and should have disclosed, to the ASX. 384 The Bank specifically canvassed this matter in correspondence with the applicants, who confirmed that the precise form of the information they contend that the Bank should have disclosed to the ASX was the information defined by the terms of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information as pleaded in the statement of claim. 385 Therefore, in the case of each of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information, it can be taken that: (a) all the integers pleaded by the applicants, for each form of the Information, are necessary to identify the information that the applicants say the Bank should have disclosed to the ASX and are an inseparable part of that information, and that (b) each pleaded form is a complete statement of the information that the applicants say should have been disclosed. 386 In closing submissions, the applicants deviated from the course they had set by contending, in the context of submissions directed to the June 2014 Late TTR Information, that: … if the Court were to find … that components of the June 2014 Late TTR Information … did not exist, or … [were] for some reason not required or apt to be disclosed to the ASX, the resultant exercise for the Court would involve determining the effects and consequences of, and in particular the quantum of loss caused by, CBA's failure to disclose the components of the June 2014 Late TTR Information in the remaining sub-paragraphs, being those components of the June 2014 Late TTR Information that did exist or were apt to be disclosed. 387 They also submitted that if the disclosure of further, contextual information is necessary to make the pleaded information complete, it was not their task to supply that information as part of their case under s 674(2) of the Corporations Act, so long as the pleaded information was otherwise material: T 1198, line 13 - 1199, line 8. 388 I do not accept that it is the task of the Court, in a case such as the present, to refashion a plaintiff's pleaded case to define, to its own liking, the information that, arguably, should have been disclosed by a defendant. The task of the Court is to adjudicate upon a pleaded case, not to plead the case itself. 389 Nor do I accept that it is the task of a defendant to refashion a plaintiff's pleaded case. The defendant may, in its defence, identify omissions from the pleaded information which go to the materiality of that information and whether the defendant is required to disclose the information in its pleaded form. It remains, nevertheless, the plaintiff's onus to plead, completely, the information which, it says, the market operator required to be disclosed: see s 674(1) of the Corporations Act. In the present case, this means information conforming to the requirements of r 3.1 of the ASX Listing Rules. I discuss some of these requirements in a later section of these reasons at [568] - [572] below. 390 To adopt the approach advocated by the applicants would not only create the potential for procedural unfairness, but also the potential to create confusion and disorder in the conduct of the proceeding, particularly where the expert evidence has been prepared and adduced in a form which is directed to the plaintiff's pleaded case. 391 In the present case, I do not accept, for example, that the Court should embark on its own course to select parts of the pleaded forms of the Information that it finds to be material to determine for itself, in the absence of appropriate evidence, the likely market effects and consequences of those parts or, in the absence of appropriate evidence, to determine for itself whether those parts were, in and of themselves, productive of actual loss. In any event, as I will later explain, the evidence in respect of the event study on which the applicants rely to establish the existence and quantum of their alleged loss makes clear that the task they now advocate cannot be performed on the basis of that study.

Legal principles 392 I have already briefly referred to the market disclosure regime governing the Bank's obligations of disclosure. It is necessary to say something more about the notion of "awareness" as understood by r 3.1 of the ASX Listing Rules. 393 Chapter 19.12 of the ASX Listing Rules provides the following definition of "aware": … an entity becomes aware of information if, and as soon as, an officer of the entity … has, or ought reasonably to have, come into possession of the information in the course of the performance of their duties as an officer of that entity. 394 This definition invokes an officer's actual or constructive awareness: Babcock & Brown at [185]. 395 The notion of constructive awareness was explained by Jagot and Murphy JJ in Crowley v Worley Limited [2022] FCAFC 33; 293 FCR 438 (Crowley (FC)). After stating (at [176]) that the word "information", as used in the definition of "aware", embraces "facts", "circumstances", and "opinions", their Honours said (at [178]): 178 If the evidence shows that: (a) the information in fact existed, (b) reasonable information systems or management procedures ought to have brought the information to the attention of a relevant company officer; and (c) acting reasonably the company officer ought to have discerned the significance of the information, then s 674 and the Listing Rules deem the company to have had the information. … 396 What does it mean to say that "the information in fact existed"? It is tolerably clear that, for this first critical step of the inquiry, Jagot and Murphy JJ were not inviting an excursion into metaphysics. Their Honours could only have been referring to the fact that, at a given point in time, the information in question was extant because it was already in a form whose content was fixed and comprehensible as a matter of ordinary perception. 397 It is important to understand that the focus of their Honours' concern was a case in which it had been argued that r 3.1 was not engaged where officers did not realise, even though they should have realised, the implications of information of which they were actually aware. Their Honours did not accept that r 3.1 was not engaged in those circumstances. They accepted the submission that the information that a corporation ought reasonably to "have" includes opinions that an officer ought to have held by reason of known facts. At [182] their Honours said: 182 Given the statutory provisions, to confine the inquiry to the question whether an officer or employee under a duty to inform an officer in fact formed an opinion or drew an inference consistent with [the pleaded information] would be in error. The required inquiry extends to the question whether an officer or employee under a duty to inform an officer knew facts from which they reasonably ought to have formed an opinion or drawn an inference consistent with [the pleaded information]. … 398 This aspect of their Honours' reasoning has importance for the present case. The Bank submits, and I accept, that Crowley (FC) does not extend the notion of "awareness" to an awareness of unknown facts that are merely capable of discovery through a process of further investigation to ascertain their existence. I would add that, even more so, Crowley (FC) does not extend "awareness" to facts that are capable of discovery with the benefit of hindsight.

The Late TTR Information: the applicants' submissions 399 The applicants accept that there is no evidence that any officer of the Bank had actual awareness of the June 2014 Late TTR Information by 16 June 2014. Their case is that one or more officers of the Bank ought reasonably to have come into possession of this information by that date. In advancing this case, the applicants adopt a three step process of reasoning. 400 The first step is that the facts comprising the June 2014 Late TTR Information "existed" as at 16 June 2014. 401 It will be appreciated that, as pleaded, this information comprises a number of integers. The applicants submit that there is no controversy that, from its introduction, transaction code 5000 was not linked or "mapped" to the Bank's TTR processes from around November 2012 to 16 June 2014. So much can be accepted. 402 The applicants then contend that, as a matter of fact, the Bank failed to lodge approximately 12,374 TTRs with the AUSTRAC CEO due to "the transaction code 5000 problem" in that period (integer (a)). I note that this figure is taken from a spreadsheet that was discovered by the Bank and appears to have been prepared on 22 September 2015. 403 By reference to other documents, the applicants contend that, in November 2012, the late TTRs represented approximately 80% of the threshold transactions that occurred through the Bank's IDMs, and in June 2014, approximately 95% of such transactions (integer (b)). 404 The applicants contend that the value component of the June 2014 Late TTR Information (integer (c)) is "a simple mathematical exercise" based on an analysis of the number of TTRs not lodged. This, the applicants submit, is supported by the spreadsheet to which I have referred. 405 Therefore, according to the applicants, the information comprising the number, percentage, and value, of cash deposits made in the Bank's IDMs for which TTRs were not given from around November 2012 to 16 June 2014, "existed". 406 As to integer (d), the applicants submit that the reference to "systems error" is accurate and apt to capture the simple fact that, as at 16 June 2014, the 12,374 contraventions of s 43 of the AML/CTF Act resulting from the Bank's failure to lodge TTRs on time were not the result of 12,374 individual errors "by, and idiosyncratic to, one or more individual employees" of the Bank. Rather, there was "an error in CBA's computer system: it had been coded wrongly". 407 As to integer (e), the applicants contend that, as a matter of fact, "the transaction code 5000 issue" was rectified by about 11 September 2015. Therefore, as a matter of fact, that error existed at all times from November 2012 to 11 September 2015. Accordingly, any disclosure as at June 2014 would have required a statement that the cause of the June 2014 Late TTRs had not been rectified. 408 The second step of the applicants' reasoning is that, by 16 June 2014, the June 2014 Late TTR Information ought reasonably to have been escalated to an officer of the Bank. 409 The applicants advance this part of their case principally by reference to three matters. First, according to the applicants, the Bank's policies and procedures, particularly its compliance policy, required the June 2014 Late TTR Information to be escalated to officer level on or shortly after October 2013. Secondly, the applicants rely on (what they contend was) Mr Narev's acceptance in cross-examination that the late TTR issue should have been escalated prior to 16 June 2014. Thirdly, the applicants contend that Mr Elliott's evidence demonstrates that this information should have been escalated. 410 It will be apparent that this part of the applicants' case focuses on the events I have described in 2013 at [118] - [140] above. 411 As to escalation and the Bank's compliance policy (see, in particular, the summary of the Compliance Incident Management Group Policy at [67] - [70] above), the applicants submit that: (a) "there is no doubt" that, on or by 14 October 2013, the Bank's employees had identified that two threshold transactions had not been reported to AUSTRAC; (b) the failure to lodge such reports comprised or gave rise to two contraventions of s 43 of the AML/CTF Act; (c) the cause of these contraventions was that transaction code 5000 was not "mapping" with or "on the range for" TTR reporting processes; and (d) the failure to link transaction code 5000 with the Bank's TTR processes meant that there was a "bigger issue" than the two contraventions of s 43. 412 The applicants submit that, amongst other things: (a) these incidents were not logged in RiskInSite; (b) the procedures in phases 2, 3, and 4 of para 5.1 of the Bank's Compliance Incident Management Group Policy summarised at [69] above (Identification→Assess→Report & Escalate→Rectify & Resolve) were not followed; (c) the incidents were not elevated to "the relevant Group Executive" (who, the applicants say, was Mr Comyn) or reported to AUSTRAC; and (d) employees did not investigate, or even consider, let alone rectify, the "bigger issue" (that transaction code 5000 was not "mapping" with the Bank's reporting processes). 413 As to Mr Narev's evidence, the applicants rely on the following exchange in cross-examination: MR STOLJAR: … The way I put it was this, Mr Narev: If someone else at the bank - not you - but if someone else at the bank had discovered the transaction code 5000 issue at some earlier point in time, would you expect that that issue would have been investigated fully?---Can I just ask one - I think the answer is yes, but I want one clarification. Are you talking about the inaccurate code or the consequence of the - with the TTRs? I'm talking about both, both limbs?---Yes. I would expect it would be investigated promptly upon anyone becoming aware of it. That would be my assumption. And conformably with - well, and it would have been escalated?---I would have expected, had that - had it been identified that there was a coding issue and as a consequence there was a compliance breach, at a minimum I would expect it to be in the sorts of reports that we've talked about. Based on my practice running the bank I would have hoped and expected I would be made aware of it fairly rapidly under normal practice. And it would have been reported to AUSTRAC, I take it?---I would assume, absolutely, in the way it was when it was discovered. And indeed, because the compliance incident policy and other procedures at the bank require that to be done?---Yes. That's a fair summary?---There's nothing in that I disagree with. Yes, it is. 414 The applicants also rely on Mr Narev's evidence that, when he was briefed on the late TTR issue in September 2015, it is likely that he was briefed on the proportion of affected transactions through IDMs and the dollar value of those transactions. The applicants' point, here, is that, had that information been sought as part of a "fuller investigation" that the Bank was "required to undertake", it would have produced, and made the Bank's officers aware of, that particular information. 415 As to Mr Elliott's evidence, Mr Elliott expressed opinions on a range of matters in his report of 12 April 2022, including whether the Bank "could/should" have detected the June 2014 Late TTRs by 16 June 2014. 416 In an introductory part of his report dealing with Terminology and Relevant Concepts, Mr Elliott discussed quality assurance in IT systems. He explained that the objective of quality assurance is to eliminate or minimise the occurrence and consequent impact of errors in data processing. Mr Elliott said that these errors generally arise from unexpected external events (such as unexpected input data) or logic errors (usually coding or design errors). 417 Mr Elliott also explained that quality assurance frameworks generally focus on the implementation of Prevention Methods and Detection Methods: … Prevention Methods are usually implemented during development and focus on ensuring the developed systems are robust and able to handle issues or problems arising. Detection Methods are designed to detect situations where the Prevention Methods have not anticipated a particular external event or logic error resulting in the system not functioning as required. They are implemented in the production (or "live") environment and can be thought of as the "checks and balances". Detection Methods are also used to trace problem situations when attempting to identify the underlying cause. 418 Later in his report, Mr Elliott exemplified a Detection Method as the temperature gauge in a car: when the gauge exceeds a threshold temperature it alerts the driver of a potential problem in the engine. 419 Mr Elliott said that Reconciliation Methods are commonly used Detection Methods in IT systems: … Generally, a Reconciliation Method checks the output of two systems each of which process the same input data but the outputs of each can be compared to check the veracity of each system. A simple example of a Reconciliation Method is where you check your credit card statement against the receipts in your wallet. The common input data is the details of each transaction. The first system is the merchant terminal which produces the paper receipts. The second system is the online transaction processing system(s) which ultimately produce your statement. When you compare the paper receipts to the statement you are carrying out a reconciliation. 420 Mr Elliott also discussed Compensating Controls, which he said are "designed to detect situations where the Prevention Methods have not envisioned a particular external event or logic error and Detection Methods are too complex or not economically feasible to implement". Mr Elliott said that Reconciliations are the more commonly encountered Compensating Control and are often used by auditors. 421 Finally, Mr Elliott explained that, when auditors audit a system, they review not just the output of the Detection Methods but whether the Detection Method (or audit control) is effective (the extent to which the Detection Method meets the risk objective). He said that it is reasonable to expect that audit controls should be effective. 422 Mr Elliott expressed the opinion that, because the Bank had the necessary data available in an accessible form, and because it "could have reasonably implemented an effective Detection Method or Compensating Control such as a reconciliation", it could have detected the June 2014 Late TTRs by 16 June 2014. 423 Mr Elliott also expressed the opinion that the Bank should have detected the June 2014 Late TTRs by 16 June 2014. He based his opinion on four matters. First, the Bank was, and is, required by the AML/CTF Act to implement appropriate controls and processes. Secondly, the Bank's attention was drawn to "issues raised regarding cash deposits in the IDMs" (this was a reference to the events in 2013). Thirdly, Group Audit had "identified AML/CTF systems deficiencies well prior to the Late TTRs being first identified by CBA" (this was a reference to the 2013 audit report). Fourthly, the Bank should have implemented Detection Methods, such as reconciliation controls in its IT processes and procedures. 424 Mr Elliott's overall conclusion was: … CBA had a regulatory requirement and had the necessary data from the time the Late TTR problem arose (November 2012) to implement effective detection controls. Deficiencies in their Detection Methods had been identified, and incidents had occurred which should have caused CBA to investigate whether TTR Reporting from IDMs was effective, such as by a reconciliation. CBA should have implemented effective Detection Methods which would have enabled them to detect the June 2014 Late TTRs and therefore should have detected the June 2014 Late TTRs on or before 16 June 2014. 425 In their closing submissions, the applicants deployed Mr Elliott's evidence by making this submission: Mr Elliott opines that CBA should have detected the Late TTR problem prior to the commencement of the Relevant Period. In Mr Elliott's opinion, when an issue of this nature is identified, as it was in October 2013, both reasonable information technology processes and CBA's own policies and procedures dictate that the issue should be appropriately investigated and escalated. Had that been attended to in October 2013, the issue would have been subject to the formal escalation and oversight processes that are applicable to what CBA defines as 'compliance incidents'. In particular, Mr Elliott observes that reasonable information technology practice would have involved the deployment of detection methods, including reconciliations: however reconciliations either were not in place for threshold transaction reporting, or they were not operating effectively. Thus, having regard to the fact that CBA had identified the coding error which caused the Late TTR problem by no later than October 2013, the fact that CBA's internal audit had called out the poor controls and lack of end to end data assurances in AML reporting and the fact that reconciliations are an important control for systems generally, Mr Elliott concludes that CBA should have identified the Late TTR problem prior to the Relevant Period. Having been detected, the scope of the Late TTR problem should have been investigated and the results of that investigation escalated appropriately. 426 The third step of the applicants' reasoning is that, acting reasonably, an officer of the Bank would have discerned "the significance of the June 2014 Late TTR Information" (by this I take the applicants to mean the significance of the facts known to the Bank's employees in 2013). 427 For this step, the applicants rely on the Bank's response following AUSTRAC's email of 11 August 2015 which identified two missing TTRs: see [141] - [142] above. The applicants submit that this "prompt investigation and escalation" of the issue is a "useful blueprint" of how matters should have been dealt with had the Bank's processes been followed in 2013. Once again relying on Mr Narev's evidence (quoted at [413]) above, the applicants submit that the problem would have been escalated to officer level. 428 For these reasons, the applicants submit that the Bank "had" the June 2014 Late TTR Information by 16 June 2014, the start of the relevant period. 429 The applicants' case with respect to the Bank's possession of the August 2015 Late TTR Information proceeds on a similar basis of constructive awareness, with integers (a) - (e) of the pleaded information based on the same documents that inform the applicants' case on constructive awareness of integers (a) - (e) of the June Late TTR Information. 430 Whilst the applicants' case on the Bank's possession of the September 2015 Late TTR Information has similarities to the other forms of the Late TTR Information (such as the fact that integers (b) - (d) are based on the same documents), it, nevertheless, has three distinguishing features. 431 The first distinguishing feature is that the Bank accepts that from late August 2015 it had actual knowledge of the fact that approximately 51,000 TTRs had not been submitted to the AUSTRAC CEO on time. It is not in dispute that preliminary estimates of the number of TTRs that had not been lodged on time were escalated to Mr Narev (amongst other officers) and, hence, an "officer" of the Bank for the purposes of the ASX Listing Rules. 432 The second distinguishing feature is that, unlike the June 2014 Late TTR Information and the August 2015 Late TTR Information, the September 2015 Late TTR Information does not include integer (e) - namely that, at the relevant date by which the information should have been disclosed, the cause of the late TTRs had not been rectified. 433 The third distinguishing feature is that the applicants plead that the Bank was aware of the September Late TTR Information as at both 8 September 2015 (or shortly thereafter) and 24 April 2017.

The Late TTR Information: analysis 434 I am not satisfied that the Bank was "aware" of the June 2014 Late TTR Information "from around 16 June 2014 or shortly thereafter", as pleaded. There are a number of reasons for this finding. 435 First, the applicants' case purports to be based on the three steps discernible from Jagot and Murphy JJ's statement at [178] of Crowley (FC) quoted at [395] above. However, the applicants' reasoning misapplies what Jagot and Murphy JJ said. As I have emphasised, their Honours were addressing a case where "opinions" which had not been formed should have been formed, or "inferences" which had not be drawn should have been drawn, on or from facts known to an officer or by an employee under a duty to inform an officer (for the purposes of this part of my reasons I will refer to such persons as a relevant person). 436 In this connection, the applicants treat the first element of Jagot and Murphy JJ's statement - that the information in fact existed - as an abstract inquiry, where the "existence" of the fact can be ascertained by an ex post facto investigation, divorced from whether a relevant person actually knew the fact at the relevant time or ought to have formed an opinion or drawn an inference to the effect of the fact from other known facts. This is not the correct approach. 437 With respect to integers (a) - (c) of the June 2014 Late TTR Information, the applicants arrive at the position that these facts "existed" by recourse to facts ascertained well after the relevant period. What is more, these facts only came to be ascertained because of an actual awareness of the late TTR issue. Thus, the first step of the applicants' analysis is also affected by hindsight. 438 To explain, the applicants have ascertained that, in the relevant period, the Bank failed to give TTRs for 12,374 cash transactions of $10,000 or more that had been processed through IDMs by reference to an electronic spreadsheet created by the Bank on 22 September 2015. The date of creation of the spreadsheet can be deduced (as the applicants themselves contend) from the file name (TTR-FBS2015092201). It appears that the spreadsheet was created as part of the Bank's lodgement of the late TTRs. The evidence shows that on 24 September 2015 the Bank lodged the file with AUSTRAC. 439 Next, the applicants have ascertained that the June 2014 Late TTRs represented between approximately 80% and 95% of threshold transactions that occurred through the Bank's IDMs in the relevant period from email correspondence on 22 January 2016 and 3 August 2017 between Bank employees. Furthermore, the applicants have misreported the 95% figure. According to the email of 22 January 2016, this figure is referable to the period November 2012 to August 2015, not November 2012 to June 2014. 440 Next, the applicants have ascertained that the June 2014 Late TTRs had a value of approximately $143.7 million from, once again, the spreadsheet created on 22 September 2015. 441 On the evidence before me, all these facts, for the purposes of "awareness", have been ascertained from investigations undertaken well after 16 June 2014, with knowledge of the late TTR issue. As at 16 June 2014, no relevant person (being an officer or someone with a duty to report to an officer) knew that, in the relevant period: (a) the Bank had failed to give TTRs for 12,374 cash transactions of $10,000 or more that had been processed through the Bank's IDMs; (b) that those transactions represented between approximately 80% and 95% of threshold transaction that occurred through the Bank's IDMs; or (c) that the total value of the June 2014 Late TTRs was approximately $143.7 million. Nor on the facts known as at 16 June 2014, could any relevant person deduce the content of the June 2014 Late TTR Information in this regard. 442 Integers (d) and (e) of the June 2014 Late TTR Information can only be determined with knowledge of the late TTR issue (which was only ascertained in August 2015) and with the assistance of the spreadsheet and emails referred to above, all of which were created well after 16 June 2014. 443 It is convenient to note at this juncture that the applicants' contention that the other pleaded forms of the Information also "existed" at relevant times is based on the same incorrect approach, as I will explain. 444 The applicants are not assisted by Mr Elliott's opinion. Mr Elliott's opinion proceeds on the basis of what the Bank could have done, and what the Bank should have done, to detect the late TTR issue. These are not relevant questions. The correct starting point for determining whether the Bank was "aware" of the June 2014 Late TTR Information by 16 June 2014 is the fact or facts known to a relevant person or the facts on which a relevant person ought to have formed an opinion or drawn an inference from other known facts. The starting point is not the facts that could have been discovered or the facts that should have been discovered by a relevant person through an investigation which did not, in fact, take place. To use the Bank's expression, Mr Elliott's expert task "misfired" because the task he was instructed to undertake was misdirected from the outset. 445 The Bank advances a number of criticisms of Mr Elliott's evidence. In the end, Mr Elliott's evidence has played only a minimal role in the presentation of the applicants' case in final submissions (in relation to the Late TTR Information it does not, in substance, go beyond the matters I have summarised and quoted above). For this reason, I do not propose to address the Bank's detailed criticisms given the limited use of Mr Elliott's evidence. Consequently, I also do not propose to address Mr Bell's evidence (which challenges a number of Mr Elliott's opinions) beyond the matters I have already recorded from Mr Elliott and Mr Bell's Joint Report in earlier paragraphs of these reasons. 446 However, there are two matters to which I should refer in relation to the applicants' deployment of Mr Elliott's opinion. 447 First, in their closing submissions (quoted at [425] above), the applicants refer to the Bank having identified, by no later than October 2013, "the coding error which caused the Late TTR problem". Also, as I have already noted, the applicants submit that: (a) "there is no doubt that", on or by 14 October 2013, the Bank's employees had identified that two threshold transactions had not been reported to AUSTRAC; (b) that the failure to lodge such reports comprised or gave rise to two contraventions of s 43 of the AML/CTF Act; (c) that the cause of these contraventions was that transaction code 5000 was not "mapping" with or "on the range for" TTR reporting processes; and (d) that the failure to link transaction code 5000 with the Bank's TTR processes meant that there was a "bigger issue" than the two contraventions of s 43. 448 I do not accept that these submissions accurately reflect the evidence. 449 To begin with, I do not accept that it is substantively correct to say that, by no later than October 2013, the Bank had identified "the coding error which caused the Late TTR problem". That statement rolls up a number of facts and does not place them in their correct sequence or context. 450 Initially, on 29 August 2013 and 3 September 2013, two queries were raised with respect to cash deposits for threshold amounts made through IDMs: whether the cash component of a "mixed deposit" and whether cash deposited using an OFI card were being reported. On 19 September 2013, these queries were resolved. On the information then known by the Bank's employees, all cash deposits for threshold amounts were being reported. 451 On 20 September 2013, a further query was raised with respect to two OFI card cash deposits for threshold amounts. As I have said, on 14 October 2013 a number of potential issues were identified, only one of which was "a bigger issue". With hindsight, there should have been further investigation to elucidate whether there was a "bigger issue". Had there been further investigation, it is likely that the general problem associated with cash deposits processed through the Bank's IDMs under code 5000 would have come to light at that time. However, there was no further investigation at that time, and the general problem did not come to light until approximately 22 months later. Indeed, the view taken at that time was that "TTR is performing as expected" and any "potential issues" were at the "source system level": see [138] above. 452 Further, I do not accept that it can be said that, armed with Mr Ashdown's understanding of the "actions" to be taken (see the email quoted at [136] above), the Bank's employees ought reasonably to have formed an opinion or drawn an inference that there was a general problem associated with cash deposits processed through IDMs under code 5000, still less an opinion or inference consistent with the June 2014 Late TTR Information: see Crowley (FC) at [182]. The only reasonable opinion that could have been drawn at that time was that, based on the state of affairs communicated by Mr Ashdown on 14 October 2013, there should be (and, viewed at the present time, should have been) a more complete investigation to try to find the answer to the query raised on 20 September 2013 with respect to the two OFI card cash deposits for the threshold amounts, having regard to the "actions" noted by Mr Ashdown. 453 Secondly, Mr Elliott's opinion that the Bank should have implemented effective Detection Methods which would have enabled it to detect the June 2014 Late TTRs on or before 16 June 2014 (such that the Bank should have detected those TTRs), and the appellants' submission quoted at [425] above which rely on Mr Elliott's opinion, ally the detection of the late TTRs with the findings of the Bank's internal audit in the 2013 audit report. However, as I have noted (at [191] above), Mr Elliott's and Mr Bell's joint opinion was that, while the 2013 audit report covered a broad range of areas related to the Bank's AML/CTF Program (identifying 21 audit issues), and alerted the Bank that there were numerous issues to be addressed to uplift the Bank's overall AML/CTF Program, the late TTR issue was not specifically identified in the findings of the report or the Issues Log, and the 2013 audit report did not identify a specific requirement to immediately review the detection methods for the cash deposit reporting systems. Therefore, the findings of the 2013 report do not have the significance that the applicants attribute to them in relation to the Bank's "awareness" of the June 2014 Late TTR Information. 454 Next, the applicants' reliance on Mr Narev's evidence needs to be considered in the light of the findings I have made in relation to the events of 2013. Mr Narev accepted that, had a coding issue (with reference to code 5000) been discovered, he would have expected it to have been investigated fully. That acceptance, however, does not advance matters materially. The queries raised on 29 August 2013 and 3 September 2013 did not reveal a coding error involving transaction code 5000. The queries raised on 20 September 2013 led to the recognition, on 14 October 2013, of the possibility of a coding error which remained unconfirmed. Whilst I accept that this possibility should have been investigated further, it does not assist in establishing that the June 2014 late TTR Information in fact existed. 455 Mr Narev also accepted that, had a coding error been identified, with the consequence that there had been a compliance breach, then that matter should have been escalated. Although by 10 October 2013 it had been identified that the two OFI card transactions referred for investigation on 20 September 2013 "are not in the TTR reports", a coding error had not been identified. What had been identified was a query on the use of transaction code 5000. Further, had the "actions" identified in Mr Ashdown's email of 14 October 2013 been escalated, I have little doubt that the instruction would have been to investigate the two OFI card transactions further to ascertain whether there was a coding problem. But, once again, this does not advance matters materially as to what was known as at 16 June 2014. 456 Finally, it is clear from Mr Narev's evidence that he did not consider that the problem with transaction code 5000 was discovered until August 2015, when the matter was escalated, and the late TTR issue then reported to AUSTRAC. 457 As to the August 2015 Late TTR Information, the applicants' closing submissions do not extend beyond noting the source of the information in each of integers (a) - (e), and relying on the same submissions they advance in respect of the June 2014 late TTR Information. Therefore, the findings I have made above apply equally to the August 2015 Late TTR Information. I am not satisfied that the Bank was "aware" of the August 2015 Late TTR Information from around 11 August 2015 or shortly thereafter, as pleaded. 458 As to the September 2015 Late TTR Information, there is (as I have already noted) no question that, by 8 September 2015, the late TTR issue had come to light, and was known by officers of the Bank. On 8 September 2015, Mr Toevs wrote to AUSTRAC, stating that, following AUSTRAC's letter of 11 August 2015, an investigation had been immediately commissioned by the Bank. This was because the TTR details relating to the two transactions (to which AUSTRAC had drawn attention) "were not immediately available in our records". Mr Toevs' letter continued: Our investigation identified that the Threshold Transactions in question were related to cash deposits made through deposit taking teller machines (Intelligent Deposit Machines or IDMs) and it was revealed that TTRs were not generated for either of these transactions. Further analysis revealed that there are three possible transaction codes that may be generated where a transaction contains a cash component of $10,000.00 or greater via an IDM. It was however identified only two of the three transaction codes are currently automatically generating a TTR when the transaction is conducted using an IDM. Root Cause Analysis performed on this matter revealed the following: • At the time of rolling out IDMs in May 2012, two transaction types, each with a unique transaction code (5022 & 4013) were mapped to automated TTR reporting where the cash component of a transaction involved $10,000 or more; • Subsequently, in November 2012 (as part of another IT project), one of these transaction types was divided into two separate transaction codes. While transaction code 5022 continued for some products, a new transaction code of 5000 was introduced for deposits made to others. However it appears that inadvertently, code 5000 was not linked to TTR reporting. Impact • The issue highlighted above resulted in the non-reporting of TTRs for 51,637 Threshold Transactions (from November 2012 to 18 August 2015). The number of affected transactions represents approximately 2.3% of the overall volume of TTRs reported by CBA over the same period. 459 The balance of Mr Toevs' letter addressed the remediation action the Bank intended to take. 460 On the evidence before me, Mr Toevs was first alerted to a problem in relation to TTR reporting through the Bank's IDMs on 20 August 2015: see [252] above. At that time, the scope of the problem, and the period over which it had occurred, was not known, but was in the course of being investigated. 461 By 4 September 2015, Mr Narev was aware of the late TTR issue. A briefing paper dated 4 September 2015, which was prepared at Mr Narev's request, noted that, at that stage of the investigation, 51,637 TTRs had not been reported to AUSTRAC. Mr Narev said that he could not recall whether he received a copy of the briefing paper or was just provided with an oral briefing. He nevertheless said that the content of the briefing paper reflected his initial understanding of the late TTR issue. 462 When the Bank lodged the late TTRs on 24 September 2015, the late TTRs were for 53,506 cash transactions, not for 51,637 transactions as notified in the Bank's letter dated 8 September 2015. AUSTRAC raised a query about this difference. Mr Toevs provided an explanation in a responding letter to AUSTRAC dated 26 October 2015: The difference in the number of TTRs at the date of notification (8 September) relative to the number of TTRs reported (24 September) relates to the subset of relevant transaction that occurred between the date at which the coding issue was identified (18 August 2015) and the date at which the coding error was rectified (8 September 2015). 463 Although the error which caused the late TTR issue had been rectified on 8 September 2015, the evidence does not enable me to conclude, on the balance of probabilities, that, as at 8 September 2015, anyone at the Bank knew that the Bank had failed to give TTRs on time for "53,506" threshold transactions (integer (a) of the September 2015 Late TTR Information). This information only appears to have come to light at the time that the spreadsheet (to which I have referred) was prepared on 22 September 2015. 464 Recognising this difficulty, the applicants point to the fact that, as at 4 September 2015, officers of the Bank knew that, for the period November 2012 to 18 August 2015, 51,637 TTRs had not been reported to AUSTRAC. They also submit that, as pleaded, integer (a) of the September 2015 Late TTR Information refers to "approximately" 53,506 transactions and that officers (such as Mr Narev, Mr Comyn, and Mr Toevs) knew or ought to have known that a further number of TTRs had not been lodged between 18 August 2015 (when the issue was identified) and 8 September 2015 (when the issue was rectified). 465 I accept this submission. I am satisfied that the expression "approximately" has significant amplitude given the large number of transactions involved. I am also satisfied that, as at 8 September 2015, both Mr Narev and Mr Toevs must have known, or at least ought reasonably to have formed an opinion or drawn an inference, that, in the period between 18 August 2015 and 8 September 2015, a material number of TTRs which should have been lodged, had not been lodged (53,506), so that, as at 8 September 2015, the late TTRs numbered materially more than the known number of late TTRs (51,637) as at 18 August 2015. 466 I am also satisfied that the Bank was "aware" of integer (d) of the September 2015 Late TTR Information, because of evidence such as the briefing note discussed above. 467 As to integers (b) and (c) of the September 2015 Late TTR Information, the Bank admits that, from around November 2012 to September 2015, the late TTRs represented approximately 95% of threshold transactions that occurred through the Bank's IDMs and that those transactions had a total value of approximately $624.7 million. The Bank puts in issue, however, the question of the Bank's "awareness" of that information as at 8 September 2015. 468 In his evidence in chief, Mr Narev said that at the time that he first became aware of the late TTR issue on (around) 4 September 2015, "the exact number of affected transactions had not yet been finalised". Nevertheless, Mr Narev said that, at that time, he understood the number to be above 50,000. He said that he was told that the "affected transactions" were around 2.5% of the Bank's total threshold transactions over the "affected period". Mr Narev also said that he did not recall "being expressly informed of the proportion of affected transaction through IDMs specifically, or the dollar value of those transactions, at any stage prior to AUSTRAC commencing proceedings". 469 Mr Narev was cross-examined on the two last-mentioned matters. The following exchange took place: Now, both of those two items of information, that is, information about the proportion of affected transactions through IDMs and the dollar value, is part of the context of the late TTR issue. Do you accept that?---The number and the dollar value, part of the context - sorry, in what sense? Well, just perhaps put it this way: you were briefed extensively on the late TTR issue, I take it?---At around that time, yes. Yes. And I take it the purpose of the briefings was to give you a full understanding of the late TTR issues?---Yes, it would have been. And as far as you were concerned, you did receive or obtain a full understanding of the late TTR issues through and by, or as a result of those briefings?---Well, a sufficient understanding, yes. And you say in this paragraph: I don't recall being expressly informed of those two matters. That's in the fourth line. Do you see that?---Yes. But you accept that, I take it, that even if you can't expressly remember it, it's likely in the course of the briefings you received information concerning a proportion of affected - - -?---Look, in fairness, I can't recall, but it wouldn't surprise me if I had heard that. I'm saying here I didn't recall it, but it wouldn't surprise me if I had heard the dollar value. Well, heard the dollar value and also heard the proportion of - - -?---And the - yes. - - - of affected transactions through IDMs?---Yes. That was all. I wasn't meaning anything else when I was putting to you - - -?---No, no. That's fine. - - - that it's part of the context?---I understand. I just mean it is likely that in those briefings you received both of those two items of information; correct?---I'm happy to say yes. 470 Although Mr Narev was prepared to make the concession recorded above, his evidence, given in the way it was, does not fill me with confidence. I am not persuaded, on the balance of probabilities, that, before 8 September 2015, he was informed of the proportion of "affected transactions" through IDMs specifically, or the dollar value of those transactions, as recorded in the September 2015 Late TTR Information. 471 In that regard, the applicants have not drawn my attention to any contemporaneous documents that record that information at that time. The briefing note that was prepared for Mr Narev on 4 September 2015 contains no such information. 472 Further, the cross-examination did not elicit that Mr Narev was told, or that it was likely that Mr Narev was told, the content of integers (b) and (c) (i.e., the actual proportion and dollar value of the late TTRs); nor could it be said that Mr Narev was in a position to form an opinion or draw an inference to the effect of integers (b) and (c) based on the information he did have. 473 Moreover, there is no evidence that any other officer of the Bank had that information, or could form an opinion or draw an inference to the effect of integers (b) and (c) as at 8 September 2015. 474 While integer (c) appears to have been discernible from the spreadsheet prepared on 22 September 2015, the source of integer (b) is the email of 22 January 2016, to which I have referred. The email of 22 January 2016 appears to have been part of an investigation to answer a request for information made by AUSTRAC on 15 December 2015. In that regard, AUSTRAC had asked the Bank to provide details of how many TTRs were reported during the period November 2012 to August 2015 in relation to the other two codes for which the Bank was lodging TTRs - transaction codes 5022 and 4013. 475 In the email of 22 January 2016, Ms Wood (who was the author of the email and Head of Financial Crime Compliance Policy & Framework, and who was relaying information internally to another employee of the Bank) appears to have ascertained, at around that time, that: … only a very small number of TTRs were lodged in respect of the other two codes meaning that the 53,529 unreported TTRs is 95 per cent of all TTRs that should have been relating to IDMs during the period. 476 Therefore, I am not satisfied that the Bank was "aware" of the September 2015 Late TTR Information from around 8 September 2015 or shortly thereafter, as pleaded, because, at that time, the Bank did not have the information in integer (b), which only appears to have come to light in January 2016. 477 I am satisfied, however, that, as at 24 April 2017 (the date referred to in para 41C of the statement of claim), the Bank was "aware" of the September 2015 Late TTR Information.

The Account Monitoring Failure Information: the applicants' submissions 478 As to the June 2014 Account Monitoring Failure Information, the applicants rely on the Bank's admissions that, from about 20 October 2012 to about 12 October 2015, Part A of the Bank's Joint AML/CTF Program provided that products or services subject to Priority Monitoring (as referred to in the program) would be subject to automated transaction monitoring as determined by the AML/CTF Compliance Officer and that, for some or all of that period, automated transaction monitoring did not operate as intended because of a computer coding error which occurred in the process of merging data from two systems. I have discussed the circumstances in which this error occurred at [155] - [161] above. 479 The applicants also rely on the Bank's admissions that this issue was identified by the Bank on about 16 June 2014, and was progressively remedied until 12 October 2015. The applicants submit that there is "no real doubt" that, by 16 June 2014, the June 2014 Account Monitoring Failure Information "existed". 480 As to the number of affected accounts, the Bank reported that 778,370 accounts were affected by this issue, over varying periods of time, in a letter to AUSTRAC dated 13 April 2017 (see [326] above). On the basis that the error was progressively remedied up to 12 October 2015, and assuming a steady rate of progression, the applicants have calculated that by 16 June 2014, approximately 676,454 accounts would have been affected. Thus, this integer of the June 2014 Account Monitoring Failure Information rests on the applicants' own assumptions and calculations, rather than evidence that this information was a known fact as at 16 June 2014. 481 The applicants also rely on Mr Elliott's evidence. Adopting similar reasoning as he had in relation to the June 2014 Late TTR Information, Mr Elliott expressed the opinion that the Bank should have detected the June 2014 Account Monitoring Failure Information by 16 June 2014. He based his opinion on four matters. First, the Bank had "the necessary data available in an accessible form, and had the requisite skills and knowledge to implement a reconciliation method". Secondly, the Bank was required by the AML/CTF Act to implement appropriate controls and processes. Thirdly, the Bank had been "advised of deficiencies in their AML/CTF systems prior to the June 2014 Account Monitoring Failure being first identified" by the Bank (this was a reference to the TMP review report in 2011 by PwC). Fourthly, the Bank should have implemented Detection Methods, such as reconciliation controls in its IT processes and procedures. 482 Mr Elliott's overall conclusion was: … CBA had a regulatory requirement and had the necessary data to implement effective Detection Methods. Deficiencies in the AML/CTF systems had been identified by CBA. Having regard to these matters, CBA should have implemented effective Detection Methods and Compensating Controls contemporaneously with the production system which would have enabled them to detect the June 2014 Account Monitoring Failure Information on or before 16 June 2014. 483 Further, based on the four principles in the Bank's Compliance Incident Management Group Policy ([69] above), the applicants submit that, by July to August 2014, the Bank had identified a "compliance incident" and "reportable breach". In this connection, they submit that the June 2014 Account Monitoring Failure Information represented a contravention of s 36 of the AML/CTF Act (a failure to monitor customers in accordance with the AML/CTF Rules) or a contravention of s 82 (a failure to comply with Part A of the Bank's AML/CTF Program). The applicants submit that had the Bank's policy been followed, these matters would have been escalated. 484 In his evidence in chief, Mr Narev said that, until May 2017, he was not aware that, from at least 20 October 2012 to 8 September 2015, the Bank had failed to conduct account level monitoring with respect to 778,370 accounts. However, in cross-examination he accepted that knowledge as at June 2014 of the failure to monitor should have been escalated to officer level at that time: You accept that not carrying out monitoring of priority accounts is a non-compliance with CBAs program?---Yes. And do you accept that that issue having been discovered in June 2014, it should have been conformably with CBAs procedures, that breach should have been escalated to officer level at that time or shortly thereafter?---Yes. I am not familiar with exactly the nature of the discovery, but if as outlined here this sort of thing was discovered, then yes. Yes, it should have been escalated to an - - -?---Yes. - - - officer level shortly after June 2014?---Well, you know, again it should have been identified as a compliance breach, reported to AUSTRAC, and then I would expect it to show up in that regulatory report that I've said that we would get monthly. 485 The applicants submit that this evidence is supported by, amongst other things, the course of events that took place when "data integrity issues" with respect to upgrading and testing the FCP as part of work called Project Isaac came to light in October 2015. At that time, those particular issues were escalated to a number of the Bank's officers. 486 The applicants submit that the August 2015 Account Monitoring Failure Information "existed" within the Bank by 11 August 2015. They submit that, given that 778,370 were, in fact, not subjected to transaction monitoring, it must be the case that by 11 August 2015 - which was just two months before the error was fixed - "approximately" 778,370 accounts were affected. 487 The applicants rely on an internal email dated 13 April 2015 between employees of the Bank in which one employee stated that he was aware that "about 1 million CBA profiles are not being picked up by FCP/Pegasus". The applicants submit that this email demonstrates that AML/CTF staff were aware in early 2015 of a compliance incident and reportable breach requiring escalation under the terms of the Compliance Incident Management Group Policy. 488 As to the September 2015 Account Monitoring Failure Information, the applicants rely on the fact that 8 September 2015 was only five weeks prior to the error being fixed. According to the applicants, it can be said, therefore, that, as at 8 September 2015, "approximately" 778,370 accounts would have been affected, and that this information "existed" within the Bank.

The Account Monitoring Failure Information: analysis 489 I am not satisfied that the Bank was "aware" of the Account Monitoring Failure Information in any of its pleaded forms as at 16 June 2014 or shortly thereafter or as at 11 August 2015 or shortly thereafter, or at 8 September 2015, or shortly thereafter. 490 There is no doubt that the account monitoring failure issue was identified on about 16 June 2014 by an employee of the Bank. However, this issue was not escalated at that time. I am satisfied that, had the Bank's Compliance Incident Management Group Policy been adhered to, the account monitoring failure issue would have come to the attention of the responsible company officer at around that time. 491 However, this part of the applicants' case relies on the same incorrect approach I have criticised at [441] - [442] above - it is based on an abstract inquiry, where the "existence" of the fact can be ascertained by an ex post facto investigation, divorced from whether a relevant person actually knew the fact at the relevant time or ought to have formed an opinion or drawn an inference to the effect of that fact from other known facts. 492 As to the June 2014 Account Monitoring Failure Information, I am not satisfied that, from around 16 June 2014 or shortly thereafter, it was known (and that the Bank was accordingly "aware") that, from at least 20 October 2012, the Bank had failed to conduct account level monitoring with respect to approximately 676,000 accounts. Indeed, there is no evidence that, in fact, approximately 676,000 accounts were not monitored, as the applicants allege. As I have said, this integer of the June 2014 Account Monitoring Failure Information rests on the applicants' own assumptions and calculations. There is certainly no evidence that this information existed at the relevant time. 493 Further, I am not satisfied that, from around 11 August 2015 or shortly thereafter (in respect of the August 2015 Account Monitoring Failure Information), or from around 8 September 2015 or shortly thereafter (in respect of the September 2015 Account Monitoring Failure Information), it was known (and that the Bank was accordingly "aware") that, from at least 20 October 2012, the Bank had failed to conduct account level monitoring with respect to 778,370 accounts. 494 The figure of 778,370 accounts appears to have been obtained from the Bank's letter to AUSTRAC on 13 April 2017 ([326] above). This letter was a response to a request for information made by AUSTRAC on 1 March 2017. In its letter of 1 March 2017, AUSTRAC referred to the internal email dated 13 April 2015 between employees of the Bank to which I have referred ([487] above). Based on that email, AUSTRAC sought a number of items of information, including the following: Please confirm the exact number of CBA profiles that were not picked up by FCP/Pegasus and the dates between which these profiles were not being picked up by FCP/Pegasus. 495 In response to that request for information, the Bank provided a table in its letter of 13 April 2017, which recorded that, in total, 778,370 accounts were affected: Period account affected Number of Affected Accounts not subject to relevant TM by maximum time impacted* 10% would be "material". It was also the expectation that a change of < 5% would not be "material". For a change of between 5% and 10%, the information might be material, but further consideration was required. I note that Guidance Note 8 to the ASX Listing Rules states that, "[v]ery large entities or those that normally have very stable or predictable earnings may consider that a materiality threshold closer to 5% than to 10% is appropriate". 706 Mr Singer said: In assessing quantitative materiality, the quantitative effect on a financial metric of a company would need to impact a metric that was considered by investors to be important and/or followed by the analyst community. In my experience, the relevant financial metrics for a company are its revenue, expenses and profit. 707 Mr Singer described qualitative information as "information that may not have a direct impact on a financial metric of a company, but which may translate indirectly to affect such metrics". Such information may be reflected in the "price/earnings ratio premium/discount" that a company holds to its peers or the market. Mr Singer said: 88. … It was my experience that during the Relevant Period it was rarer for companies to disclose qualitative information as opposed to quantitative information. The market's view on the consistency and deliverability of quantitative information or reliability and consistency of performance could have a qualitative effect on the stock's rating. That is for example consistent earnings upgrades and a higher level of earning certainty and deliverability could demand a premium rating. During the Relevant Period companies would generally disclose qualitative information where that information would materially affect the markets' perception of the ability of the company to generate earning or profit. For example, small companies may announce industry awards to highlight their progression while larger companies are unlikely to announce this. 708 Mr Singer stressed the importance of context in assessing whether information is qualitatively material. As to this, Mr Singer said: 89. In my experience, to assess whether information is qualitatively material, it is necessary to consider this information within its context (including the timing, the method, the source and overall landscape in which the information is being provided). When I refer to: (a) timing, I mean the point in time at which the information is released. For example, in my experience volatility around a results release will generally be higher pre and post the release than at other times during the year, and the materiality and potential price effect will be impacted as I have described …; (b) method, I mean the means by which the information becomes available to the investor. For instance, whether the information is released by way of an ASX Announcement by CBA to the market, a joint media release by AUSTRAC and CBA, an AUSTRAC statement on its website or a tweet by AUSTRAC; (c) source, I mean how the information is received by the market, such as direct from the company, the regulator or media generally; and (d) the prevailing market conditions, I mean the macro factors: i. such as global environment, geopolitical risk, inflation, interest rates and regulatory and changing regulatory environments; and ii. which have a qualitative effect on how equities markets are rated versus other asset classes and therefore how individual shares such as CBA are priced and the decision of an investor whether or not to buy or sell shares. 709 Mr Singer also said: 91. As I have explained …, retail investors were principally concerned with yield stocks for income generation and dividend certainty. For this reason, it was my experience during the Relevant Period that materiality from the perspective of a retail investor was assessed by reference to whether the information would affect the dividend of a yield stock. 92. From the perspective of institutional investors, the focus of those investors was on a comparison between the peer group, for instance in the case of banks (CBA, ANZ, Westpac and NAB), and in the case of resource stocks (BHP, Rio Tinto, Fortescue and Woodside). This was assessed by reference to each of those stocks as a discounted cash flow. One way of measuring this is the Gordon Growth model which determines a valuation of the company based on its forecast dividend divided by the expected rate of return minus the dividend growth ((D1/RE-RG)). For this reason, materiality was assessed by reference to whether the information affected cash flow for the stock going forward.

The applicants' submissions 710 The applicants submit that the Late TTR Information is intuitively information that would, or would be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares. In this regard, the applicants do not differentiate between the different pleaded forms of the Late TTR Information. They say that the differences in detail between the pleaded forms do not have a bearing on the materiality of the information concerned. 711 The applicants advance four reasons in support of their submission.

Serious non-compliance 712 First, the applicants argue that the Late TTR Information was "serious in its nature". It concerned a large number of failures by the Bank to meet its regulatory obligations over a period of years, and "a large quantum of transaction value". The information suggested that the Bank "had engaged in tens of thousands of contraventions of the AML/CTF Act in circumstances where the object of that Act is the prevention of serious criminal offences". 713 Apart from the content of the information itself, the applicants call in aid the Bank's own awareness that, as Australia's largest financial institution, it had a major role to play in reducing the flow of money used to finance criminal activity. The applicants also call in aid the evidence given in cross-examination by Mr Narev, Mr Worthington, and Mr Cohen. Mr Narev accepted that AML regulation was an area of critical risk for the Bank's business and that regular reporting (in relation to TTRs) was "a key regulatory outcome that AUSTRAC was focusing on". Mr Worthington accepted that the regulation of "AML and CTF issues" was an area of significant or important risk. Mr Cohen accepted that the Bank had a vital role in assisting AUSTRAC in protecting the public from "money laundering and terrorism [financing] activities". 714 The applicants submit that the "tens of thousands of failures" by the Bank to comply with "a basic regulatory obligation in an area of critical risk for [the Bank's] business", and a regulation "designed to reduce the risk of ongoing and serious financial crime", would have been perceived by investors as objectively serious and, therefore, "plainly a matter that would influence their decision making". 715 Further, the applicants call in aid the fact that, at the time, no other Australian financial institution or corporation had previously reported non-compliance of such obligations on such a large number of occasions over such a lengthy period of time. The applicants submit that this would have been known to investors and had greater significance following the commencement of the Tabcorp proceeding on 22 July 2015, with even greater significance in February 2017 when the settlement of the Tabcorp proceeding was announced. 716 The applicants also argue that the objective seriousness of the Bank's non-compliance in relation to the late TTR issue can be measured by the large penalties that could be imposed for contravention of the AML/CTF Act. The applicants submit that this information was available and would have been known to "a portion of the broad cross-section of rational investors", who would "take a pretty rough approach to try and work out what range the fine might be in" by multiplying the maximum penalty by the number of instances of non-compliance. 717 The applicants submit that the objective seriousness of the Late TTR Information is supported by AUSTRAC's own assessment of the matter. They rely on AUSTRAC's expression of "serious concerns" about the scale of the Bank's non-compliance with s 43 of the AML/CTF Act in its letter of 12 October 2015, and the later expression of its view (at the meeting on 7 March 2017 with Ms Watson and Mr Keaney) that "the TTR and associated matters" were "serious, significant and systemic". 718 In light of these matters, the applicants submit: 445. Investor concerns would be around what the attitude of the regulator was likely to be, and they would consider that in the absence of confirmation to the contrary from a credible source, they should proceed on the basis that the regulator's view would accord with their own, namely that the non-compliances were objectively large in number, affected a (sic) the whole IDM network, resulted in an objectively large amount of transactions in dollar terms going unreported, and were thus apparently serious, significant and systemic. Accordingly, a revelation by CBA that it had failed to comply with a basic obligation under the AML/CTF Act tens of thousands of times would have led investors to lower their assessment of CBA's competence in complying with its regulatory requirements and upwardly revise their estimates of CBA's operational risk. The number and apparent seriousness of the failures would have been influential upon their decisions as to whether to buy and sell CBA shares. (Footnote omitted.) 719 The applicants argue that it would only be of "secondary significance" to investors to know whether the systems error, which led to the TTRs not being lodged in time, had been fixed. According to the applicants, this is because investors would "naturally assume" that the issue would be fixed upon being identified. Investors would nonetheless appreciate that there was "an element of irremediability" because a failure to report on time could never be fixed. The applicants submit that investors would focus on the large scale non-compliance that had occurred over a long period of time.

Reputational damage 720 Secondly, the applicants argue that the Late TTR Information would have led investors to consider that the Bank's reputation was "going to be damaged, perhaps irretrievably". They argue that investors would have appreciated that this damage would influence the CBA share price. 721 In cross-examination, Mr Narev accepted that contraventions of the AML/CTF regime could give rise to reputational damage to the Bank, and "large reactive share price declines". He accepted that such contraventions could lead the media to describe the Bank as "morally bankrupt". 722 Specifically with respect to the late TTR issue, Mr Narev accepted that the Bank's failure to give TTRs on time for some 53,000 threshold transactions over a three-year period could give rise to adverse publicity and consequential reputational damage for the Bank. 723 Mr Narev accepted that, from at least February 2017, the Bank was concerned about the management of the late TTR issue in the media: see [299] - [300] and [332] above in relation to Project Concord. One of the aims of this management was to seek to influence, to the extent possible, how the Bank's customers and investors would react upon becoming aware of that issue. 724 The applicants submit that the academic literature (Sturm) supports the contention that reputational damage can result in a loss in value of an entity's share price.

The perception of the risk of regulatory action 725 Thirdly, the applicants argue that the Late TTR Information would have suggested to investors that the Bank was at risk of regulatory action, including the risk of substantial pecuniary penalties being imposed. They advance this as a matter of common sense. They also advance this consideration independently of, and regardless of, whether the Potential Penalty Information should have been disclosed. According to the applicants, the substantive content of the Potential Penalty Information would arise in investors' minds as a consequential inference to be drawn from the Late TTR Information itself, given the quantum of non-compliance in terms of the aggregate dollar value of the transactions for which TTRs had not been lodged on time. As the applicants put it: "Regardless of how much had 'gone right' (in the sense of regulatory compliance in other areas), what had gone wrong was objectively serious". 726 The applicants also point to Mr Narev's evidence that, from October/November 2016, he considered that there was a serious risk that AUSTRAC might take regulatory action against the Bank in respect of the late TTR issue, and that one outcome of regulatory action could be the imposition of a significant fine on the Bank. In Mr Narev's view, the primary concern of shareholders and investors would be around the attitude of the regulator.

The cost of remediation 727 Fourthly, the applicants argue that the Late TTR Information would have suggested that the Bank's AML/CTF systems might require remediation at a "higher than anticipated expenditure in its compliance and systems improvement functions". According to the applicants, this would be so because the non-detection of the late TTR issue for a significant period of time "would rather cast a pall over the quality of CBA's detection systems, audit and compliance function and risk management culture". Investors would fear that, regardless of the work that the Bank might have done in improving its compliance function, "not enough had been spent, and more could be required". The announcement of the Late TTR Information "would be regarded by investors as a canary in a coal-mine, in terms of possible future remediation costs".

The expert evidence 728 The applicants submit that the materiality of the Late TTR Information is supported by the evidence given by their expert witnesses, Professor da Silva Rosa and Mr Johnston. It is convenient to also refer, at this point, to the evidence given by the Bank's expert witnesses, Mr Ali, Mr Singer, and Dr Unni. 729 As will become apparent, the applicants' expert witnesses, and the Bank's expert witnesses, presented opposing views on the materiality of the pleaded information.

Professor da Silva Rosa 730 Professor da Silva Rosa expressed the opinion that investors would consider, or would be likely to consider, the June 2014 Late TTR Information to be value-relevant for three reasons. First, it described a substantial breach by the Bank of its reporting obligations under the AML/CTF Act. Secondly, the late TTRs comprised the overwhelming majority of threshold transaction which occurred through IDMs for an extended period of time, such as to indicate that these reporting failures were substantial and systematic over an extended period of time. Thirdly, the dollar value of the TTRs was materially large, such as to indicate that the late TTRs concerned an economically substantive set of transactions. 731 Professor da Silva Rosa said that, in light of this information, investors would infer that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act. This information would, or would be likely to, influence investors to: (a) lower their assessment of the Bank's competence in complying with its obligations under the AML/CTF Act; (b) upwardly revise their estimates of the Bank's operational risk with economically significant adverse consequences (including regulatory penalties and the cost of remediation); and (c) increase their estimates of the Bank's reputational risk (in the sense of adversely affecting the Bank's ability to maintain existing, or establish new, business relationships and continued access to sources of funding). 732 Professor da Silva Rosa said that, while investors do not expect a financial institution such as the Bank to be entirely risk free, they do expect sufficient measures to be taken, and investments made, to mitigate operational risk to the extent required by legislation such as the AML/CTF Act. 733 Professor da Silva Rosa said that an additional reason why investors would infer that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act is that the cause of the late TTRs was a systems error that had not been rectified. I have already commented on the incongruity of that integer of the June 2014 Late TTR Information and the August 2015 Late TTR Information given that, had the Bank actually known that the TTRs had not been lodged, it is inconceivable that the Bank would not have promptly rectified the problem and informed the market accordingly. 734 Professor da Silva Rosa expressed the opinion that the August 2015 Late TTR Information and the September 2015 Late TTR Information are materially equivalent to the June 2014 Late TTR Information. In this regard, he said that the particular numerical values evidencing the Bank's non-compliance is not critical beyond the point where it is evident that the non-compliance is "systematic and large in scale". As Professor da Silva Rosa put it: … the cause of a flooded bathroom is not affected by the amount of damage done. Further, once the extent of flooding reaches the point where, say, the whole bathroom has to be renovated the level of water in the bathroom is trivially consequential, if at all. 735 Professor da Silva Rosa sought to support his opinion on this topic by reference to academic literature reporting on research findings, and published analyst opinions. Professor da Silva Rosa said that professional analysts' views are widely regarded as a valid proxy for investors' views. Professor da Silva Rosa considered 11 such reports. Notably, the reports were based on the 3 August 2017 announcement, not the pleaded information as such. Even so, Professor da Silva Rosa read these reports as expressing views that were consistent with his opinion on the influence or likely influence of the Late TTR Information on investors' decisions to acquire or dispose of CBA shares. 736 It is important to emphasise two matters here. First, Professor da Silva Rosa considered that the 3 August 2017 announcement would, or would be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares. Secondly, he reasoned that the elements of the announcement that would have that influence did not convey anything more material than the cumulative effect of the pleaded forms of the Information. In this regard, he said that the material elements of the 3 August 2017 announcement, and the pleaded forms of the Information that the applicants say the Bank should have disclosed, were "economically equivalent". Professor da Silva Rosa said that two sets of information will be "economically equivalent" when the information conveys the same implications as to risk and expected cash flows. 737 It is important to understand that Professor da Silva Rosa considered each of the pleaded forms of the Information would lead investors to infer that the Bank had been substantially and systematically deficient in its compliance with its requirements under the AML/CTF Act and that this would then lead to investors making the assessment and estimations I have noted above. On this reasoning, Professor da Silva Rosa considered that "each species of information was economically equivalent to each other species of information" and that "each species of information was economically equivalent to" the 3 August 2017 announcement. As Professor da Silva Rosa also put it, each of these forms of information (including the 3 August 2017 announcement) "conveyed the same value-relevant implications to investors".

Mr Johnston 738 Mr Johnston's opinion was that the Late TTR Information would be material to investors on a quantitative basis "because of their number and potential cost to CBA" (meaning, as I understand Mr Johnston's evidence, that the potential penalty payable by the Bank for non-compliance was very large). Mr Johnston addressed the question of a "fine" by treating each failure to lodge a TTR on time as a separate contravention of the AML/CTF Act. He then multiplied the aggregate number of contraventions for each pleaded form of the Late TTR Information by the amount of the maximum statutory penalty for a contravention, to arrive at the quantum of each "fine". On this basis, he said: The Late TTR [I]nformation alone would therefore, on a quantitative basis, be material to investors when assessing CBA's assets and liabilities, financial position and performance, profits and losses and prospects. There was no information indicating that CBA would escape a material fine. 739 However, having performed these calculations, Mr Johnston volunteered that "fines" of these magnitudes were "practically and politically inconceivable". Nevertheless, he said that conjecture about the amount of the "fine" would have "spooked" the market. 740 Mr Johnston expressed the opinion that the Late TTR Information would be qualitatively material to investors. He said that: (a) the proportion of late TTRs relative to all threshold transactions through the Bank's IDMs in each pleaded period indicated "persistent and seemingly systemic failings"; (b) the values of the affected transactions would likely seem material to investors when assessing the need for financial institutions to deter money laundering and terrorism financing; (c) the non-compliance for the pleaded periods indicates a level of ongoing and systemic failings that would have exposed Australia to the risk of serious and ongoing financial crime; (d) the Bank's need to "remedy the issues causing the contraventions" would lead investors to expect that the Bank was exposed to "material remediation and ongoing systems costs"; and (e) the cost of doing business for the Bank (and other banks) was likely to increase materially (and revenues might decline) due to the "risk of increased regulatory and government intervention". 741 In his second report, Mr Johnston also expressed this opinion: 36. For completeness I note that in my opinion, independent advisors, corporate advisors, lead managers, underwriters, institutional sales forces, research analysts, retail investor advisors, brokers and other advisors would consider, and would conclude that investors would consider, that: - the potential reputational or brand damage to CBA …; and - the potential fines resulting from the material in the Information, including multiple corporate failings causing multiple breaches of Australia's AML/CTF legislation (which at different time periods went from around 12,000 breaches to over 53,000 breaches): (a) could impact on CBA's ability to carry on business as in the past, and were definitely outside CBA's normal business course …; (b) related to an area of significant or critical risk for CBA …; (c) involved a significant and unexpected actual or potential liability for CBA …; (d) could have a long-term effect on the CBA's business and therefore its profitability or revenue …; (e) had a material adverse effect on CBA's reputation, proposed activities, prospects or financial condition … including affecting not only CBA's prospects but also the extent to which investors price CBA shares at a premium or discount to shares in those comparable companies; and (f) might otherwise be reasonably expected to influence an investor's decision to offer to buy CBA shares at the then current market price, so that for any one or more of these reasons the Information would be material to an investor considering the sale or purchase of shares in CBA. 742 The applicants rely in particular on the following evidence given by Mr Johnston in the course of concurrent evidence as to the "health checks" or "sanity checks" he would have made if advising in the context of "due diligence and offer processes" on whether information should be disclosed. This approach was not expressed in Mr Johnston's reports: … So what I would have done in a normal issue would really do a number of health checks, sanity checks, on whether disclosure really was required. The first one is the easy one: would a next day investor complaint lack any rational justification? And my view on the information is that a rational investor would be rightly upset if they invested without the information. My second sanity check is whether the information is adequately covered by existing disclosure, and my view there is that the generic risks previously disclosed weren't equivalent to disclosing the actual failings or breaches or losses. The third sanity check would be to ask whether the information was trivial or immaterial ultimately, and, again, my view on the information that with 12,000 or 50,000 or 53,506 strict liability TTR failings depending on the period chosen with no permissible margin of error, the information was material. And with over half a billion dollars improperly reported over two years of sustained systemic failings and matters affecting the integrity and credibility of the financial system, the information would be material to investors. A fourth sanity check is always whether the risks are effectively zero, meaning that there was no reasonably foreseeable impact regardless of the quantum involved. My view on the information is that was a real risk of reputational damage and regulatory sanctions, so it couldn't be said the risk was zero and it could be said the information wasn't material to investors. Fourth - sorry, the next sanity check is whether the impact is conditional on an unknowable third party action, and my view on the information is that there was no reasonable basis to assume there would be a lack of regulatory action or lack of brand damage. And I point out that brand damage would be substantially independent of the existence or size of financial penalties as seen in the NAB - market's response to NAB's 2021 disclosure and the Wells Fargo 2016 penalties, so it would have been material to investors. The final check in issues is whether the disclosure is actually avoidable because it falls within an exception to any disclosure requirement, and my view on the information is that it didn't fall within any of the ASX listing rule 3.1 carve-outs. … 743 It is appropriate at this point to note an aspect of Mr Johnston's evidence on the question of materiality that was most clearly revealed during the course of cross-examination. In his first report, Mr Johnston addressed the following question: Q1 Whether, during the whole or any part (and if so, which part) of the period between 16 June 2014 and 1:00pm on 3 August 2017 (inclusive) each of the following categories of information: a) the June 2014 Late TTR Information; the August 2015 Late TTR Information, and/or the September 2015 Late TTR Information; b) the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information, and/or the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information; c) the June 2014 Account Monitoring Failure Information, August 2015 Account Monitoring Failure Information, and/or the September 2015 Account Monitoring Failure Information; d) the Pre-16 June 2014 System Deficiencies, and/or the Ongoing Systems Deficiencies; or e) the Potential Penalty Information, (collectively the Information) was information that would, or would be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA Shares. 744 In cross-examination, Mr Johnston volunteered that, in preparing his reports, he assumed for the purpose of assessing materiality that all the information identified in this question was disclosed, not just the Late TTR Information. He said that he was "hesitant to try and break out one of the five components in my head and give the court a considered opinion". 745 It would appear, therefore, that, for the purpose of expressing his opinion on the question of materiality, Mr Johnston in fact considered the collective effect of the "Information" defined in the question, not just the Late TTR Information itself or a particular pleaded form of that information. This "Information" included information that the applicants no longer rely on (see integer (d) at [743] above) in their continuous disclosure case. Mr Johnston nevertheless said: … My only starting point would be that the late TTR information as at June 14 contained the 14,000 breach - or failings carrying a $200 billion penalty. I think that is still to my mind a heart-stopping and jaw dropping number which would cause concern about a lot of things within CBA, including potential management changes. 746 Mr Johnston also said that if the September 2015 Late TTR Information were to have been disclosed, "it would have [had] a massive impact on investors". 747 Mr Johnston argued that the likely materiality of "the categories of Information and the Information collectively", and its influence on persons who invest in securities in deciding whether to acquire or dispose of CBA shares, could be cross-checked against the commentary of banking analysts published in reports after the 3 August 2017 announcement. Mr Johnston considered four of the reports analysed by Professor da Silva Rosa. He said: 129. In my opinion, themes that can be distilled from all four reports are: (a) on a quantitative basis - the fines payable by CBA were not capable of precise estimation, but the early $6bn fall in market capitalisation was seen as being at least as high as expected fines; and (b) on a qualitative basis - a bigger risk for investors in not just CBA brand damage and consequential costs for it (and potentially other Australian banks) but also the potential for greater regulatory intervention, leading to direct costs, greater supervision and more regulatory (ie lower-yielding) capital, which would reduce returns for investors in all banking stocks, including CBA . The specific areas and exact period of CBA's non-compliance was not overly relevant to the research analysts, who would have known CBA investors well. Their concern was not the specific areas of AML/CTF laws that had been breached, but rather that CBA had been in serious and systemic non-compliance with AML/CTF laws generally. 748 Mr Johnston also addressed the market effect of the 3 August 2017 announcement. He opined that the major contributor to the decline in value of the Bank's shares after the 3 August 2017 announcement was the market's concerns about the penalty that the Bank would have to pay, with the penalties for Late TTRs being "the largest and most clearly identified concern". 749 In this regard, he placed less significance on the fact that the 3 August 2017 announcement referred to the actual commencement of proceedings against the Bank. In cross-examination, he said: MR JOHNSTON: I understand that lawyers would understand the process well, but as a market participant, people sit there wondering that there's announcements of enforcement action, there are defences, there are filings, there are a huge range of steps; no one really knows, and no one really cares. The question is what's going to happen at the end? Investors don't really care to the extent that they're all steps towards an outcome and they will - in my opinion, investors would have assumed there would be regulatory action, therefore they would have assumed these steps. They're relative - their incremental materiality was minimal. They're all steps towards something that was going to happen. MR HUTLEY: That's because you assumed proceedings was inevitable; correct? MR JOHNSTON: I assumed regulatory action was inevitable, yes. MR HUTLEY: Which involved penalty proceedings; correct? You thought there was 100 per cent certainty that penalty proceedings would be brought; correct? MR JOHNSTON: I thought the - the risk was so high that it could be regarded as certain. MR HUTLEY: Right. The risk was - all - most advisers would say legal proceedings are inevitable; correct? MR JOHNSTON: If I had to put it in the terms advisers would put they would say, "CBA is going to be sued and they're going to be fined," yes. MR HUTLEY: There's nothing obscure about the concept of being sued, is there? MR JOHNSTON: They would know that it was going to be sued. MR HUTLEY: Quite. It's not an obscured formal step - it's not an obscure step; correct? MR JOHNSTON: Again, I think we're quibbling here, but the whole process of how are you sued, does AUSTRAC lodge a noticement (sic), is there a Twitter? In the end it's being sued. MR HUTLEY: It's a very important event in the life of any public company to be sued by a regulator, isn't it? MR JOHNSTON: It would be, yes, to be sued. MR HUTLEY: Right. It is a matter which I suggest to you the market would treat as vital in assessing the value of that company so far as they were concerned with regulatory departures; correct? MR JOHNSTON: No, in the sense that, once you've assumed they will be sued, the fact that - that if the legal proceedings commenced the next week or the week after doesn't matter, you've assumed it's going to happen. There will be those steps. 750 In his first report, Mr Johnston expressed the opinion that: … if the elements of the Information knowable in June 2014 (which included contraventions relating almost entirely to Late TTRs) had been disclosed in June 2014, the market reaction would not have been materially different to the market reaction following the [3 August 2017 announcement]. 751 He expressed the same opinion with respect to "Information knowable in August 2015" and "Information knowable in September 2015". 752 It would seem that, here, Mr Johnston was aggregating various forms of the pleaded Information, including information on which the applicants no longer rely in their continuous disclosure case. 753 Mr Johnston said that, although there were differences between the Information (at the variously pleaded points in time) and the information in the 3 August 2017 announcement, the differences in the information in the 3 August 2017 announcement had only an "incremental effect" which would be "parabolic and decreasing rather than linear", given the "baseline disclosure of the Late TTR Information" (meaning, in the first instance, the June 2014 Late TTR Information). According to Mr Johnston, the additional integers of the information in the 3 August 2017 announcement (including the fact that proceedings against the Bank for civil penalties had been commenced) "made no material difference to the market's overall reaction". Mr Johnston expressed the same opinion taking the August 2015 Late TTR Information and the September 2015 Late TTR Information as "baseline" disclosures. 754 From this evidence, I understand Mr Johnston to say that each pleaded form of the Late TTR Information was (to use Professor da Silva Rosa's expression) "economically equivalent" to the 3 August 2017 announcement. Therefore, had each pleaded form of the Late TTR Information been disclosed at the time when the applicants say it should have been disclosed, the market's reaction to the disclosure would not have been materially different to the market's reaction to the 3 August 2017 announcement. 755 The corollary of this approach is that disclosure of any of the pleaded forms of the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, or the Potential Penalty Information, if disclosed by the Bank at the relevantly pleaded times, would also have had only "incremental effect" given the posited "baseline" of the Late TTR Information.

Mr Ali 756 Mr Ali's opinion was that, in the absence of AUSTRAC actually commencing proceedings against the Bank on 3 August 2017, investors would have likely viewed the Late TTR Information as not material, and not information that would, or would be likely to, influence persons who commonly invest in securities in determining whether to acquire or dispose of CBA shares. 757 Mr Ali said that investors consider materiality in "a relative sense with the relevant context". With specific reference to the September 2015 Late TTR Information (which Professor da Silva Rosa considered to be materially equivalent to the June 2014 Late TTR Information and the August 2015 Late TTR Information), Mr Ali referred to a number of contextual matters. He noted that the Bank was a large and complex financial institution with a very large customer base (in the millions) and also a very large number of accounts (in the tens of millions). It had "invested heavily on risk and compliance expenditure", and had an extensive AML/CTF Program that incorporated elements to assess, identify, mitigate, and manage ML/TF risk. Its program incorporated reporting elements and associated processes to comply with its regulatory obligations, and automated processes to identify threshold transactions. 758 Mr Ali noted that the cause of the September 2015 Late TTRs was an operational error by way of a coding error. The cause was not fraud or other misconduct by the Bank's staff or management. Mr Ali said that this was important because, in his experience, non-fraud related operational risk events are perceived to be less significant than fraud related operational risk events. Mr Ali noted that this operational error was substantially self-identified and self-reported to AUSTRAC and had been rectified within the space of several weeks. According to Mr Ali, this relatively swift remediation would indicate that the specific coding error was not complex or expensive to resolve once identified. Mr Ali said that this was relevant because investors would not perceive there to be a "significant remediation related impost to rectify the error". 759 Mr Ali also noted that there was "no material profitability ascribable to [the Bank] as a result of the operational error", and "no material loss of profitability expected pursuant to the resolution of the operational error". 760 Further, the period of time between the Bank reporting the error relating to the late TTR issue, and AUSTRAC commencing proceedings against the Bank, was almost two years. Mr Ali said that this was relevant because investors "may perceive that AUSTRAC did not view this error to be a matter that required urgent action on its part". 761 Mr Ali noted Professor da Silva Rosa's comment that investors do not expect a financial institution, such as the Bank, to be entirely free of risk, including operational risk. Mr Ali said that investors would not expect that the Bank's systems "would operate completely effectively 100% of the time", including its systems relating to AML/CTF compliance and reporting processes. 762 Mr Ali acknowledged that the September 2015 Late TTRs concerned approximately 53,506 threshold transactions to the value of approximately $624.7 million, and that these were "large numbers in an absolute sense". However, these transactions represented: (a) approximately 2.3% of all TTRs submitted by the Bank between November 2012 and September 2015 (indicating that, in that period, the Bank had submitted 97.7% of TTRs within the required timeframe); (b) the value of the September 2015 Late TTRs represented approximately 1.3% of the value of all TTRs submitted by the Bank between November 2012 and September 2015 (indicating that, in that period, the Bank had submitted 98.7% of the total value of TTRs); (c) the number of September 2015 Late TTRs represented approximately 0.76% of the average number of transactions per day and approximately 0.003% of the aggregate number of transaction per annum monitored by the Bank's AML/CTF processes (indicating that the late TTRs comprised an extremely small fraction of the transactions monitored by the Bank); and (d) the value of the September 2015 Late TTRs represented approximately 0.29% of the value of transactions per day and approximately 0.001% of the aggregate value of transactions per annum monitored by the Bank's AML/CTF processes (indicating that the value of the late TTRs comprised an extremely small fraction of the value of transaction that were being monitored by the Bank). 763 Mr Ali expressed the opinion that, given the increasingly extensive and complex regulatory environment in which the Bank operated, investors would reasonably expect that, from time to time, the Bank may experience errors of the nature that resulted in the September 2015 Late TTRs. 764 Mr Ali also expressed the opinion that generalisations based on academic research are not necessarily reliable predictors of how market investors will react. 765 Mr Ali's opinion in relation to the materiality of the Late TTR Information, and the September 2015 Late TTR Information in particular, was influenced by the responses to AUSTRAC's announcement on 3 August 2017 concerning the commencement of proceedings against the Bank. 766 Mr Ali said that the fact that AUSTRAC had commenced proceedings against the Bank was information that would, or would be likely to, influence investors in deciding whether to acquire or dispose of CBA shares. He considered that "the substantial majority of the market reaction" to the 3 August 2017 announcement was a consequence of the fact that AUSTRAC had commenced proceedings. 767 Mr Ali said that this fact had implications for investors' assessments of: (a) the likelihood of any penalty being imposed on the Bank; (b) the potential amount of the penalty; (c) the potential for greater regulatory scrutiny; (d) the potential for increased risk in their expectations of the Bank's future cash flows; and (e) the potential implications for the Bank's share price. 768 However, Mr Ali did not consider that the fact that AUSTRAC had commenced proceedings was "economically equivalent" to the pleaded forms of the Information because the fact that AUSTRAC had commenced proceedings was not an integer of that information. 769 The applicants place much reliance on Mr Ali's statement that "the substantial majority of the market reaction" to the 3 August 2017 announcement was a consequence of the fact that AUSTRAC had commenced proceedings. In cross-examination, Mr Ali accepted that this meant that some part of the market reaction may have been for reasons other than the commencement of proceedings. In this connection, Mr Ali said: I wouldn't be in a position to say conclusively that all of the … market reaction was as a result of the commencement of [the] AUSTRAC proceedings, but I wouldn't necessarily rule that out. 770 When pressed on what might have contributed to a "minority" of the market reaction, Mr Ali said: There are a number of aspects of the announcements that occurred on that day, including, for example, the references to the money laundering, the references to - the references to drug importation and facilitation of drug manufacture and drug importation. Any of those factors could have had - could have caused some part of the market reaction. Other factors such as the relatively negative press commentary, the relatively negative analyst commentary associated with the announcement on that day could have had - could have exacerbated the market reaction. 771 The applicants submit that Mr Ali did not exclude the possibility that, on 3 and 4 August 2017, the market was reacting to the facts underlying the AUSTRAC proceeding, not just its commencement. The applicants submit: Once it is accepted that some of the market reaction is caused by the subject matter of the proceedings - such as the Late TTR Information (or other information alleged by the applicants for that matter) - that information is plainly material information within the meaning of s 677. 772 The difficulty with this submission is the qualification on which it is based. The submission is question-begging: Was the Late TTR Information a cause of the market reaction following the 3 August 2017 announcement? Nowhere in his evidence did Mr Ali accept that the market reaction was because of the Late TTR Information, or because of the other Information alleged by the applicants. Indeed, Mr Ali's evidence was to the opposite effect. 773 By stating that "the substantial majority of the market reaction" to the 3 August 2017 announcement was a consequence of the fact that AUSTRAC had commenced proceedings, I am satisfied that Mr Ali was doing no more than expressing caution, and signifying an unwillingness to speak in absolute terms. His oral evidence quoted above indicates those aspects of the 3 August 2017 announcement that he considered might also have had a role to play in the market reaction. 774 The applicants criticise other aspects of Mr Ali's evidence. They take issue with Mr Ali's statement that the September 2015 Late TTRs were substantially self-identified and self-reported to AUSTRAC (they argue that this only occurred because AUSTRAC had identified that TTRs had not been lodged in respect of two transactions). They criticise Mr Ali's reliance on the scale of the September 2015 Late TTRs compared to the scale of the Bank's overall monitoring operations; his reliance on the fact that these contraventions were caused by "an operational error" that was a "coding error"; and his reliance on the fact that the error was relatively swiftly remediated. The applicants related these criticisms to similar criticisms they made of Mr Singer's evidence, which I address below. 775 The applicants also criticise Mr Ali's observation that, given the time between the Bank reporting the late TTR issue to AUSTRAC, and AUSTRAC commencing proceedings against the Bank, investors "may perceive that AUSTRAC did not view this error to be a matter that required urgent action on its part". They submit that this is "nonsensical" because, on their case, this non-compliance should have been disclosed significantly earlier than 3 August 2017 and that when the "error" was "made known to the market on 3 August 2017 it caused a significant price reduction in CBA's shares, irrespective of the alleged delay in AUSTRAC initiating proceedings". As to this submission, I simply note that, here, the applicants once again equate the September 2015 Late TTR Information with the 3 August 2017 announcement - an equivalence that Mr Ali did not accept. 776 Most importantly, the applicants criticise Mr Ali's performance of a beta analysis and certain conclusions that Mr Ali drew with respect to two case studies involving Westpac and NAB. I deal with the beta analysis and the case studies in later paragraphs of these reasons.

Mr Singer 777 Mr Singer's opinion was that the Late TTR Information, in and of itself, would not, or would not likely, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares at any time during the relevant period. Mr Singer advanced a number of reasons for this opinion. 778 First, considered in its numerical context, and against the scale of the Bank's operations and larger TTR process, Mr Singer said that the number and value of the Late TTRs were not quantitatively material because it would not have a numerical effect on the Bank's financial forecast. In this regard, Mr Singer compared the number and value of the transactions in the Late TTR information with the overall number and value of the transactions processed by the Bank in each pleaded period. 779 In relation to the June 2014 Late TTR Information, Mr Singer noted that, on his calculation, the June 2014 Late TTRs were only 0.0002% of the total transactions processed by the Bank, and 1.08% of the total TTRs reported by the Bank, in the pleaded period. Further, the June 2014 Late TTRs were a "statistically infinitesimal percentage" of the value of all deposits processed by the Bank, and only 0.6% of the total value of the threshold transactions processed by the Bank, in the pleaded period. 780 In relation to the August 2015 Late TTR Information, Mr Singer noted that, on his calculation, the August 2015 Late TTRs were a "statistically infinitesimal percentage" of the total transactions processed by the Bank, and 2.25% of the total TTRs reported by the Bank, in the pleaded period. Further, the August 2015 Late TTRs were a "statistically infinitesimal percentage" of the value of all deposits processed by the Bank, and 2.4% of the total value of the threshold transactions processed by the Bank, in the pleaded period. 781 In relation to the September 2015 Late TTR Information, Mr Singer noted that, on his calculation, the September 2015 Late TTRs were a "statistically infinitesimal percentage" of the total transactions processed by the Bank, and only 2.3% of the total TTRs reported by the Bank, in the pleaded period. Further, the September 2015 Late TTRs were a "statistically infinitesimal percentage" of the value of all deposits processed by the Bank, and 1.3% of the total value of the threshold transactions processed by the Bank, in the pleaded period. 782 Secondly, Mr Singer said that it was not market practice for a company to make a disclosure of every operational issue that arose. Investors had no expectation that information like the Late TTR Information would be disclosed. 783 Thirdly, the late TTR issue arose from a single IT coding error. 784 Fourthly, the Late TTR Information did not have any value-related implications for the Bank apart from the imposition of a "fine". In relation to that matter, investors would consider it unrealistic that a "fine" would be calculated by simply multiplying the number of contraventions (TTRs late lodged) by the statutory maximum amount per contravention. 785 Fifthly, the late TTR issue was fixed within a relatively short period of time of becoming known. 786 Sixthly, there was a range of options available to AUSTRAC on becoming aware of the late TTR issue, and investors would have known that fact. Further, given this "range of incomplete potential outcomes" there would be no reason for the Bank to disclose the Late TTR Information. 787 Mr Singer analysed the analyst reports discussed by Professor da Silva Rosa and Mr Johnston. These reports covered the period 3 August 2017 to 9 August 2017 (the latter date being the date when the Bank released its 2017 results). Mr Singer prepared a table summarising each report and the valuation recommendation it made. He then made these observations: 114. Of the 11 broker notes set out in the table above, four were published post the 3 August 2017 AUSTRAC announcement, but before the 9 August 2017 release of CBA's FY17 results and none of the four made any change to their valuation, recommendations or price target. Most reference the Tabcorp settlement in March 2017 as a benchmark, Morgan Stanley also gives a potential fine range and Bell Potter makes the point that any "potential penalty not as excessive as claimed in press". 115. Of the other 7 broker notes that I have analysed in the table above that consider the 9 August 2017 release of results and also reference the AUSTRAC announcement on 3 August 2017 all brokers reference the risks associated with potential penalty as a result of the AUSTRAC proceedings[,] most have left valuations unchanged or increased slightly as a result of the FY17 result[,] and there is only one broker (Macquarie) who has reduced their price target from $81.50 to $80.50; a move of just over 1%, which in my experience would not be considered material. 116. Given the table above, and the 11 broker reports that I have looked at in conjunction with the Johnston report I note that after the actual release of the AUSTRAC proceedings no broker makes a material change to any valuation therefore any earlier release by CBA would be unlikely to have a material valuation effect by brokers. 788 Mr Singer also considered the "economic equivalence" of the 3 August 2017 announcement and the pleaded forms of the Information that the applicants say the Bank should have disclosed. He proceeded on the basis that "economic equivalence" meant that information had "an equal and or relatively similar economic effect on the share price such that it would have the same or a similar influence on a person's decision to acquire or dispose of CBA shares". 789 From an investor's perspective, Mr Singer considered the "key components" of the 3 August 2017 announcement to be that: (a) AUSTRAC had commenced proceedings against the Bank (the most serious of the options available to AUSTRAC); (b) AUSTRAC would be seeking penalties for a range of contraventions for an unspecified amount (creating uncertainty around the magnitude of the penalties given the pecuniary penalty awarded against Tabcorp was the only market benchmark); and that (c) AUSTRAC had made the statement that the Bank had become aware of suspected money laundering or structuring on its accounts but did not monitor its customer to mitigate and manage ML/TF risk (an "aggressive" statement by the regulator bearing upon the level of the penalties to be imposed). 790 Mr Singer remarked that these "key components" were not part of the pleaded information. 791 Furthermore, according to Mr Singer, the context, and the prevailing market conditions, in which the 3 August 2017 announcement was made, are important. Mr Singer pointed to four matters. First, the 3 August 2017 announcement was made by a regulator, not by the Bank itself or the Bank in conjunction with the regulator. Secondly, even though the 3 August 2017 announcement referred to discussions between the Bank and AUSTRAC, it appeared that AUSTRAC had not foreshadowed that it would commence proceedings against the Bank. According to Mr Singer, this may have signalled a breakdown in the relationship between the Bank and AUSTRAC. Thirdly, in the period leading up to 3 August 2017 there had been a lot of regulatory commentary on banks, including the possibility of a Royal Commission. This meant that, as at 3 August 2017, there was a higher degree of sensitivity by market participants to any regulatory announcement. Fourthly, investors would be aware that companies like the Bank have operational issues, and dealings with regulators on a day-to-day basis. These dealings generally occur without proceedings being commenced, or announcements made that penalties will be sought. 792 For these reasons, Mr Singer did not consider the 3 August 2017 announcement to be economically equivalent to the pleaded forms of the Information. Nor did Mr Singer consider there to be economic equivalence between the various pleaded forms of the Information because, at each pleaded point in time, the content of the information was different and the context in which the information would have been received was different. 793 Similarly to the submissions they advance in respect of Mr Ali's evidence, the applicants place reliance on Mr Singer's statement during the concurrent evidence session that "the most serious - the most significant elements of the [3 August 2017 announcement] that would or would likely influence an investor is the actual commencement of proceedings seeking unquantified penalties". The applicants submit that, by this statement, "Mr Singer was … not of the view that the commencement of proceedings was the only thing that mattered to investors" and that he had "abandoned the more extreme position articulated in his report". 794 I do not accept that, by referring to "the most serious - the most significant elements" of the 3 August 2017 announcement, Mr Singer was resiling from the view expressed in his report concerning the materiality of the pleaded forms of the Late TTR Information. Mr Singer was merely emphasising the importance, from an investor's perspective, that AUSTRAC had commenced proceedings against the Bank for civil penalties. As Mr Singer pointed out, there were, from an investor's perspective, other "key components" of the 3 August 2017 announcement (see [789] above), including that the Bank had become aware of suspected money laundering and structuring and had failed to monitor this activity - which Mr Singer said was an "aggressive" statement by the regulator. 795 The applicants criticise other aspects of Mr Singer's evidence. 796 First, they criticise Mr Singer's reliance on the "statistically infinitesimal percentage" of the Late TTRs in terms of number and value, compared to total transactions (deposits) processed by the Bank and total TTRs reported by the Bank at the pleaded times. 797 The applicants submit that, by making these observations, Mr Singer seemingly ignored the fact that the Bank's non-compliance "affected the whole IDM product channel, the scale of non-compliance with the AML/CTF [A]ct was unmatched in Australian history, and the statistical size of the non-compliance relative to CBA's volume of transactions mattered little to the market when the 3 August 2017 announcements were made". 798 I am not persuaded by that submission. I do not accept that Mr Singer ignored the extent to which the IDM product channel was affected. His evidence was directed to putting that particular matter into the broader context of the Bank's operations. Further, Mr Singer directed his attention to what, in his opinion, "mattered" to the market when the 3 August 2017 announcement was made. He did not ignore that question. 799 Secondly, the applicants take issue with Mr Singer's evidence that it was not market practice for a company to make a disclosure of every operational issue that arose. They submit that this would depend on the nature and extent of the operational issue. So much can be accepted. I do not understand Mr Singer to say otherwise. Mr Singer made this point in the context of explaining why, in his opinion, investors would not have expected the Late TTR Information to be disclosed. He gave several reasons for that opinion. 800 Thirdly, the applicants submit that Mr Singer's evidence was "predicated on false assumptions". 801 In this regard, they take issue with his statement that the late TTRs arose from a single IT coding error. They point to a "bow tie analysis" which appears to have been prepared by Bank employees in April 2016. This analysis identifies a number of broadly-stated deficiencies feeding into the problem that led to the introduction of transaction code 5000 and the failure to factor this code into the downstream process by which threshold transactions were identified for reporting. 802 The applicants also take issue with Mr Singer's statement that the error was fixed within a relatively short period of time. They submit that this statement ignores the fact that "the error had subsisted for a lengthy period of time". 803 The applicants also dispute Mr Singer's opinion that, apart from the potential imposition of a pecuniary penalty, the Late TTR Information did not have any value-related implications for the Bank. 804 None of these matters make good the proposition that Mr Singer's evidence was "predicated on false assumptions". It is accurate, and apt, to say that the late TTRs arose from a single IT coding error. This was the immediate cause of the late TTR issue. For the purposes of considering the question of materiality in respect of the applicants' continuous disclosure case, it is not necessary to regress to the multiple possible underlying causes of how a single IT coding error came to be made. It is accurate to say that the error was fixed within a relatively short period of time. To recognise this fact is not to ignore the period of time from the making of the error to the point of its detection. The applicants' submissions about the value-related implications of the Late TTR Information are no more than a disagreement with the opinion that Mr Singer expressed. 805 Fourthly, the applicants contend that Mr Singer's evidence in cross-examination was "generally" consistent with their case. 806 In this connection, the applicants commence with the proposition that Mr Singer accepted that if the September 2015 Late TTR Information had come to him in an ASX release in September 2015, he would have considered whether it might affect the price or value of CBA shares. However, this, of itself, says nothing about the materiality of that information. 807 Next, the applicants refer to Mr Singer's evidence that domestic regulators seek to change corporate behaviour through enforcement action, including by seeking a "fine" that is "appropriate to the size of the institution". Mr Singer accepted that, in light of the September 2015 Late TTR Information, investors would "take a pretty rough approach" to try to work out the "range" of that "fine". He accepted that the pecuniary penalty imposed in the Tabcorp proceeding would provide a benchmark for the "fine" that might be imposed on the Bank in respect of the contraventions referred to in the September 2015 Late TTR Information. Mr Singer also accepted that the Bank was a much larger institution than Tabcorp and that the September 2015 Late TTR Information identified a larger number of contraventions than the contraventions involved in the Tabcorp proceeding. He accepted that a "fine" imposed on the Bank could be "an order of magnitude larger". 808 It is important to understand that, although allied to the September 2015 Late TTR Information, this evidence was given by Mr Singer in the context of a domestic regulator seeking a pecuniary penalty as part of enforcement action. In other words, his evidence was predicated on investor knowledge that a regulator had commenced proceedings for a pecuniary penalty. 809 Next, the applicants refer to Mr Singer's evidence that, in the relevant period, CBA shares traded at a premium compared to the price of the shares of the Bank's competitors, as reflected in the Bank's price/earnings ratio. Mr Singer accepted that such a premium could be associated with "a very good brand or reputation" and "excellence in management". He accepted that the Bank had "one of the most recognisable and trusted bank brand[s] in Australia at the time" and that its reputation was "a function of delivering both earnings and compliance". 810 Based on this evidence, the applicants submit: This reputation of delivering compliance, which underpinned CBA's reputation and consequent high P/E ratio, is precisely what would have been shattered had the Late TTR Information (or Potential Penalty Information) been disclosed to the market. It is also precisely what occurred when the information was released on 3 August 2017. 811 As will be apparent, this submission equates the economic effect of the Late TTR Information with the economic effect of the 3 August 2017 announcement. However, Mr Singer's evidence was that neither the pleaded forms of the Late TTR Information, nor any of the pleaded forms of the other Information (when taken alone, or combined), were economically equivalent to the information disclosed in the 3 August 2017 announcement. I do not consider that Mr Singer's evidence in cross-examination qualified that opinion. 812 Finally, the applicants refer to Mr Singer's evidence that investors understand that from time to time large financial institutions experience "regulatory issues" involving regulators "conducting investigations in relation to those issues on a regular basis". They point to Mr Singer's acceptance in cross-examination that the market may be "surprised by non-compliances which are of a large scale" and that the period of time over which non-compliance occurs, and "the type of regulation breached", "may matter to investors". They also point to Mr Singer's acceptance that, in the period from 2014 through to 2017, investors in the market had an appreciation that "AML/CTF legislation" was of great importance and that non-compliance would have been regarded as "a very serious matter". I note, however, Mr Singer's acceptance of the last-mentioned matter was qualified by the following statement: Correct, depending on the non-compliance and benchmarking, various other issues, or looking at the context of how they were fined or received.

Dr Unni 813 Dr Unni's opinion was that the Late TTR Information was not material in any of its pleaded forms. 814 First, he did not consider that the academic literature or the analysts' reports on which Professor da Silva Rosa relied provided support for Professor da Silva Rosa's contrary opinion. 815 Dr Unni distinguished the academic literature on the basis that, predominantly, it deals with the impact of the announcement of the realisation of an actual operational loss rather than the announcement of the risk that an operational loss may occur, which Dr Unni considered to be a fundamentally different economic event. Dr Unni said that a financial economist evaluating the materiality of the pleaded information would need to quantify not only the likely magnitude of the operational loss but also the probability of that loss occurring, which had not been done here. Further, Dr Unni said that, even if the pleaded information consists of the disclosure of an operational loss, it cannot be assumed, based on the literature, that there would be a negative stock price reaction. According to Dr Unni, one would need to examine the specific details of the particular episode at issue and evaluate how it ranks (or compares) to the events that are statistically analysed in the research papers. 816 Dr Unni noted Professor da Silva Rosa's reference to Ittonen, which reported that investors react positively to disclosures of internal control weaknesses when those disclosures are made by a firm without prompting from an independent third party, and negatively when those weaknesses are identified and disclosed by an auditor. Relating that observation to the present case, Dr Unni reasoned that, since a hypothetical disclosure of the pleaded forms of the Information at earlier points in time during the relevant period would have involved a voluntary disclosure by the Bank, the implication must be that such a disclosure would be received more benignly by market participants compared to disclosure by the regulator in the adversarial circumstances of litigation. 817 With respect to Barakat et al (on which Professor da Silva Rosa relied for, amongst other things, the proposition that investors penalise firms that are the subject of adverse media announcements about operational risks, but less so where there is uncertainty about the bad news), Dr Unni argued that a hypothetical voluntary disclosure of the pleaded forms of the Information would likely leave significant uncertainty about potential penalties that might follow from the disclosure, such that the negative impact would be less. 818 With respect to Gowin et al, Dr Unni said that the paper does not provide statistical evidence that an announced operational loss reduces the market value of a firm by a greater amount. 819 With respect to Sturm, Dr Unni argued that the paper does not provide any basis to conclude that the Bank would suffer reputational harm from disclosure of the Late TTR Information. 820 Dr Unni made various other observations and comments about the academic literature. It is not necessary for me to descend to the detail of those observations and comments (or Professor da Silva Rosa's responses to any of Dr Unni's observations and comments) for the purposes of these reasons. This is because there are other aspects of the evidence that I consider to be far more influential in considering the question of materiality. 821 As to the analysts' reports, Dr Unni noted that Professor da Silva Rosa's treatment of the reports was based on the proposition that each of the pleaded forms of the Information was economically equivalent to the 3 August 2017 announcement. Dr Unni disputed that proposition. He said that the 3 August 2017 announcement was not economically equivalent to the pleaded forms of the Information. Indeed, he expressed the opinion that the 3 August 2017 announcement differed in economically significant ways from the pleaded forms of the Information, at least in the following ways. (a) the 3 August 2017 announcement represented the realisation of the risk that AUSTRAC would seek a pecuniary penalty against the Bank; (b) the 3 August 2017 announcement signified the materialisation of litigation, which the research evidence indicates is associated with operational harm and a reduction in the value of a company; (c) the 3 August 2017 announcement revealed information in the context of regulatory litigation, as compared to news voluntarily disclosed by the Bank; (d) the 3 August 2017 announcement was accompanied by negative media publicity due to the adversarial nature of the proceeding which AUSTRAC had commenced; (e) the 3 August 2017 announcement involved the increased likelihood of the forced removal of its CEO, which the research evidence indicates is associated with a decline in the market value of a company; and (f) the circumstances of the 3 August 2017 announcement raised the prospect of a Royal Commission, with potentially broader ramifications for the business prospects of the Bank. 822 As to the last two matters, Dr Unni noted that no economic basis had been established in the present case to conclude that a voluntary disclosure by the Bank of the pleaded forms of the Information at earlier times would increase the likelihood of those events coming to fruition. 823 As Dr Unni put it: Analysts were reacting to the entire set of information arising from the announcement of the AUSTRAC litigation, including not only the collective allegations made by AUSTRAC but also that these claims were made in the adversarial setting of litigation, with foreseeable consequences of top executive turnover and regulatory inquiries. As an economic matter, the market's reaction to this collective set of information revealed in litigation launched by a regulator cannot be used to determine the likely reaction of market participants to any individual element of the Information claimed by Applicants. 824 Dr Unni said that the significance of any disclosure of an operational error must be evaluated against the overall scale of the economic activity against whose backdrop the errors occurred. Here, the Bank faced the technology risks associated with being a complex financial institution, and was required to process and monitor, in many cases on a daily basis, a large number of transactions, many of which are highly complex. 825 Dr Unni also remarked that the occurrence of an operational loss does not, by itself, imply the existence of a lack of internal control. This is because adequate internal controls do not make businesses error free. As a conceptual matter, errors can be reduced or minimised, but not eliminated. 826 The applicants criticise a number of aspects of Dr Unni's evidence. 827 First, they submit that the distinction between the announcement of a risk that an operational loss might occur, and the announcement that such a risk has been realised, is artificial. They submit that reliance on such a distinction implies that the 3 August 2107 announcement and the Late TTR Information have "economically different value". They argue, however, that Dr Unni did not state in his report that the TTR Information had no value to investors. The applicants also argue that this distinction is irrelevant to the question of materiality. 828 I do not accept that this distinction is artificial or irrelevant. Further, as I have noted, Dr Unni's opinion was that the 3 August 2017 announcement was not economically equivalent to any of the pleaded forms of the Late TTR Information, or any of the pleaded forms of the other Information (when taken alone, or combined). 829 Secondly, the applicants submit that Dr Unni mischaracterised the bases on which Professor da Silva Rosa relied on the academic literature. This, it seems to me, is simply a matter of debate that does not feature significantly in my analysis of the question of materiality. As I have said, I do not propose to descend to the detail of Dr Unni's observations and comments on the academic literature (or Professor da Silva Rosa's responses to any of Dr Unni's observations and comments) for the purposes of these reasons, beyond what I have already noted. 830 Thirdly, the applicants point to Dr Unni's observation that a financial economist evaluating the materiality of the pleaded forms of the Information would need to quantify not only the likely magnitude of the operational loss, but also the probability of that loss occurring. The applicants submit that this observation is "largely irrelevant" because the question of materiality focuses on the perspective of the investor, not on the perspective of a financial economist. Whilst I accept that, for the purposes of assessing materiality, the focus is on persons who commonly invest in securities, I do not accept that the perspective of a financial economist cannot inform the question of materiality, particularly when materiality is considered on a quantitative basis. 831 Fourthly, the applicants criticise Dr Unni's comment that Professor da Silva Rosa did not evaluate the significance of a disclosure about operational errors against the overall scale of the economic activity in which the errors occurred. This criticism is a repetition of the same criticism made with respect to Mr Ali's and Mr Singer's evidence which directed attention to the scale of the Bank's monitoring of transactions. 832 Fifthly, the applicants submit that Dr Unni failed "to grapple in any meaningful way" with the "central findings" of the Lieser paper. I discuss this paper at [836] - [841] and [1019] - [1020] below. 833 Sixthly, the applicants criticise the way in which Dr Unni, in oral evidence, distinguished the 3 August 2017 announcement from the pleaded forms of the Information, particularly in relation to the disclosure in the 3 August 2017 announcement of the Bank's non-compliance facilitating specific crimes. The applicants accept that Dr Unni was correct to point out this difference. They argue, however, that this difference is only relevant if "one were to accept the false proposition that investors are unsophisticated and incapable of assessing information and drawing information on their own". In this regard, the applicants submit: The notion that investors would not be able to discern that CBA may have facilitated financial crime due to its non-compliance, or would not have been able to identify the seriousness of CBA's pro-longed and record-breaking AML/CTF non-compliance without AUSTRAC informing them, has no semblance of common sense or reality. 834 I do not accept these submissions. It is one thing to think, in some abstract and generalised way, that the Bank's non-compliance with its AML/CTF obligations may have facilitated financial crime. It is an entirely different matter to be told the detail, extent, and consequences of that non-compliance, as revealed in the 3 August 2017 announcement, particularly with reference to the Concise Statement. The point made by Dr Unni has nothing to do with a "false proposition" that investors are unsophisticated or incapable of assessing information. 835 Seventhly, the applicants submit that, in cross-examination, Dr Unni did not rule out the possibility that investors may consider the Late TTR Information to be material. However, properly understood, Dr Unni's evidence went no further than accepting that the pleaded forms of the Information (other than the Potential Penalty Information) relate to an existing state of affairs (Dr Unni described these as "materialisations of operational error in the technical observance of reporting rules") with the risk of operational loss in the form of penalties and other economic costs.

The Lieser paper 836 The Lieser paper (Securities class action litigation, defendant stock price revaluation, and industry spillover effects, Patrick Lieser and Sascha Kolaric (2016)) was introduced into evidence through Dr Unni but relied on by the applicants to support their case on materiality. It concerns a study that: … examines shareholder wealth effects of shareholder-initiated class action lawsuits for sued firms and their closest industry rivals. Based on the process of shareholder-initiated class action lawsuits, three critical events are identified that are expected to have a significant impact on stock prices. First, the revelation date of a potential misconduct: This date provides shareholders with a basis for potential claims against the firm, as it becomes clear that the firm did not act in accordance to the law. Second, the actual filing of a class action lawsuit. This filing should resolve any residual uncertainty that may still remain following the revelation, as it is not clear on the revelation date whether a lawsuit will actually be filed. Third, the date of the conclusion of the lawsuit, either by dismissal or settlement. On this day, any remaining uncertainty with regard to the litigation outcome should be resolved and therefore again impact the share price of the defendant firm. 837 With regard to the first two events, the authors made the following findings: We find that shareholders are able to anticipate these critical events during a securities class action process and adjust their price expectation of the defendant firms' shares accordingly. We conduct multiple event studies for sued firms and their closest rivals. In line with expectations, we find that the revelation of potential misconduct and the following filing event of shareholder class action lawsuits lead to consistently negative shareholder wealth effects. With an average of -20.06% abnormal return during the three days surrounding the revelation date of potential misconduct, losses are much larger in magnitude than the -3.25% during the three days surrounding the filing date. Both these results are highly significant and economically relevant. In addition, this (sic) results also shows that only investigating the filing day of a lawsuit potentially underestimates the actual losses in shareholder wealth. … 838 The authors concluded that the event study results for the conclusion of class action lawsuits were "less clear". They found that the defendant firms "experience a slight positive price reaction during the three day period surrounding the conclusion day, primarily driven by lawsuits that are dismissed". 839 The authors also made this observation: … Furthermore, the results of the event studies also indicate that shareholders are capable of anticipating the outcome of securities class action lawsuits, showing a consistent pattern of larger negative returns for securities associated with lawsuits that will eventually be settled rather than dismissed. The pattern of a decreasing magnitude of abnormal returns with the progression of the lawsuit in time implies that shareholders efficiently incorporate the relevant information that becomes available at earlier stages, with subsequent events resolving residual uncertainty. … 840 The applicants submit that there is no material difference between the cases analysed in the Lieser paper and the circumstances that ought to have prevailed in the present case: Both sets of circumstances involve the fact of a company's non-compliance with law becoming known to the market as a distinct and separate event to the commencement of the proceedings for non-compliance. Further, there is no material difference between a prosecution for that non-compliance by a regulator in a penalty proceeding and prosecution for that non-compliance by a representative plaintiff in a class action. The circumstances of the research are directly analogous, and the closest match of all the papers considered by the experts in this proceeding. 841 The applicants submit further that the results of the Lieser paper are "compelling, and entirely consistent with the views expressed by Mr Johnston and Professor da Silva Rossa [sic]…".

Case studies 842 The Bank called in aid two case studies concerning disclosures made by, firstly, Westpac and, secondly, NAB, about their non-compliance with the AML/CTF Act. Both case studies relate to events after the relevant period, at a time when (in the Bank's submission) "the market would have been sensitised to any AUSTRAC related announcement". 843 The relevance of these disclosures to the Bank's defence is that (in the Bank's submission) the market "did not react in a meaningful way" to these disclosures. The Bank submits that this is "particularly striking" because: … the presence of any reaction would be expected to have been heightened given that by the time each of Westpac and NAB made their disclosures, the market had already observed a marked difference in the approach of AUSTRAC from that which existed at the time the Applicants allege CBA should have made its disclosures. Moreover, and importantly, it was only once each of Westpac and NAB disclosed information that conveyed to the market that AUSTRAC would commence proceedings that their respective share prices reacted in a meaningful way. 844 It should be noted that the NAB disclosure on which the Bank relies is one which it contends would have been interpreted by the market as conveying a "high degree of certainty that AUSTRAC would commence proceedings", even though the disclosure included a conditional statement that, at that time, AUSTRAC was not considering civil penalty proceedings to address its concerns.

The Westpac case study 845 On 20 November 2019, AUSTRAC published the following media release: AUSTRAC, Australia's anti money-laundering and terrorism financing regulator, has today applied to the Federal Court of Australia for civil penalty orders against Westpac Banking Corporation (Westpac). The civil penalty orders relate to systemic non-compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). AUSTRAC alleges Westpac contravened the AML/CTF Act on over 23 million occasions. AUSTRAC Chief Executive Officer, Nicole Rose, says that AUSTRAC's decision to commence civil penalty proceedings was made following a detailed investigation into Westpac's non- compliance. It is alleged that Westpac's oversight of the banking and designated services provided through its correspondent banking relationships was deficient. Westpac's oversight of its AML/CTF Program, intended to identify, mitigate and manage the money laundering and terrorism financing risks of its designated services, was also deficient. These failures in oversight resulted in serious and systemic non-compliance with the AML/CTF Act. Westpac failed to: 1. appropriately assess and monitor the ongoing money laundering and terrorism financing risks associated with the movement of money into and out of Australia through correspondent banking relationships. Westpac has allowed correspondent banks to access its banking environment and the Australian Payments System without conducting appropriate due diligence on those correspondent banks and without appropriate risk assessments and controls on the products and channels offered as part of that relationship. 2. report over 19.5 million International Funds Transfer Instructions (IFTIs) to AUSTRAC over nearly five years for transfers both into and out of Australia. The late incoming IFTIs received from four correspondent banks alone represent over 72% of all incoming IFTIs received by Westpac in the period November 2013 to September 2018 and amounts to over $11 billion dollars. IFTIs are a key source of information from the financial services sector that provides vital information into AUSTRAC's financial intelligence to protect Australia's financial system and the community from harm. 3. pass on information about the source of funds to other banks in the transfer chain. This conduct deprived the other banks of information they needed to understand the source of funds to manage their own AML/CTF risks. 4. keep records relating to the origin of some of these international funds transfers. 5. carry out appropriate customer due diligence on transactions to the Philippines and South East Asia that have known financial indicators relating to potential child exploitation risks. Westpac failed to introduce appropriate detection scenarios to detect known child exploitation typologies, consistent with AUSTRAC guidance and their own risk assessments. "These AML/CTF laws are in place to protect Australia's financial system, businesses and the community from criminal exploitation. Serious and systemic non-compliance leaves our financial system open to being exploited by criminals," Ms Rose said. "The failure to pass on information about IFTIs to AUSTRAC undermines the integrity of Australia's financial system and hinders AUSTRAC's ability to track down the origins of financial transactions, when required to support police investigations." AUSTRAC's approach to regulation is based on building resilience in the financial system and on educating the financial services sector to ensure they understand, and are able to comply with, their compliance and reporting obligations. Businesses are the first line of defence in protecting the financial system from abuse. "We have been, and will continue to work with Westpac during these proceedings to strengthen their AML/CTF processes and frameworks," Ms Rose said. "Westpac disclosed issues with its IFTI reporting, has cooperated with AUSTRAC's investigation and has commenced the process of uplifting its AML/CTF controls." Westpac is a member of the Fintel Alliance. The Fintel Alliance is a private-public partnership established by AUSTRAC to tackle serious financial crime, including money laundering and terrorism financing. 846 The announcement included links to the originating application, statement of claim, and a concise statement. 847 However, prior to that announcement, Westpac made the following disclosure on 5 November 2018 in its Group Annual Report for 2018 (under the heading "Anti-money laundering and counter-terrorism financing reforms and initiatives"): The Group has recently self-reported to AUSTRAC a failure to report a large number of International Funds Transfer Instructions (IFTIs) (as required under Australia's AML/CTF Act) in relation to one WIB product. These IFTIs relate to batch instructions received from 2009 until recently from a small number of correspondent banks for payments made predominantly to beneficiaries in Australia in Australian dollars. Through the product, Westpac facilitates payments on behalf of clients of certain of its correspondent banks. The majority of the payments are low value and made by Government pension funds and corporates. The Group is investigating and working with AUSTRAC to remediate the failure to report IFTIs. Further details regarding the consequences of the failure to comply with financial crime obligations are set out in the Risk Factors section of this report. 848 In an earnings call with analysts on the same day, Westpac's then Managing Director and CEO, Mr Hartzer, reported: … So the AML issue that we talked about is not a suspicious matter reporting issue, like one of our colleague banks dealt with. It relates to something called an FTE [quaere, IFTI] which is an inward transaction in Australian dollars to an Australian payee that we process on behalf of correspondent banks. And we're required to disclose those payments to AUSTRAC. We found in going through our checks that there were a couple of banks for whom those files for some reason weren't passed. The composition of those files is pretty low value payments. They relate to things like pensions from foreign governments that are being paid to Australian residents. So we're still working through that with AUSTRAC, but that's what it is. 849 On 6 May 2019, when publishing its interim results for the first half of the 2019 financial year, Westpac reiterated its earlier disclosure and made a statement that it was working with AUSTRAC to remediate its system. 850 On 4 November 2019, Westpac again referred to its non-compliance in its Group Annual Report for 2019, stating: Any enforcement action against Westpac may include civil penalty proceedings and result in the payment of a significant financial penalty, which Westpac is currently unable to reliably estimate. Previous enforcement action by AUSTRAC against other institutions has resulted in a range of outcomes depending on the nature and severity of the relevant conduct and its consequences. 851 Dr Unni conducted event studies in respect of these voluntary disclosures and found that there was no evidence that they constituted material information for market participants. Dr Unni noted that Westpac's share price declined at closing on 6 May 2019 and 5 November 2019 (but not on 5 November 2018) but that these abnormal and negative returns were based on Westpac's weak performance (6 May 2019) and its poor results and outlook (5 November 2019). But when AUSTRAC made its announcement on 20 November 2019 that it had commenced proceedings, Westpac's share price declined to $25.67 (from a closing price of $26.55 on 19 November 2019), then to $25.16 (on 21 November 2019) to $24.77 (on 22 November 2019) and to $24.44 (25 November 2019) - a total decline of $2.11 (8%). Dr Unni concluded that this announcement "evoked a significant and negative market reaction". 852 The Bank submits that this evidence is important for two reasons. First, the Bank submits that it falsifies the case theory that the mere fact that there have been contraventions of the AML/CTF Act is material because, when Westpac made such disclosures, "there was no reaction to that matter". 853 Secondly, the Bank submits that the negative effect on Westpac's share price upon AUSTRAC's announcement that it had commenced proceedings for a pecuniary penalty demonstrates that it is the actual commencement of proceedings that the market considers to be material. This, the Bank submits, contradicts Mr Johnston's evidence that investors would assume that the disclosure of AML/CTF contraventions meant that proceedings would be commenced. As the Bank puts it: Were Mr Johnston's evidence to be correct, then Westpac's share price would not have reacted on the commencement of proceedings against Westpac by AUSTRAC as that matter would already have been assumed by reason of the previous announcement of AML/CTF related contraventions. 854 Mr Ali also analysed the decline in Westpac's share price following the commencement of proceedings by AUSTRAC. He said that this decline was notable notwithstanding the fact that Westpac had previously provided disclosure of its AML/CTF issues and of its self-reporting to AUSTRAC on several occasions. Mr Ali said: It is readily observable that the Westpac share price decline could not have been due to new revelations regarding Westpac's AML/CTF issues because those issues had already been disclosed by Westpac. Accordingly, in my opinion, the Westpac share price decline was substantially the result of the market reaction to the fact that AUSTRAC had commenced proceedings, which is consistent with my opinion regarding the CBA share price decline. 855 For their part, the applicants submit that AUSTRAC's announcement on 20 November 2019 concerned substantially similar events to those covered by the media release it made on 3 August 2017 in relation to the Bank, in that both announcements concerned serious and systemic contraventions of the AML/CTF Act involving, primarily, large-scale non-reporting. The applicants submit that the "overwhelming inferences" the Court should draw are that, on 6 May 2019 and 5 November 2019, the market reacted to partial information about the potential enforcement action and penalties to which Westpac was exposed, and that the market's reaction on 20 November 2019 was driven, at least in part, by learning of the number of contraventions involved (approximately, 23 million), which was an indicator of Westpac's "serious, systemic and large scale AML/CTF compliance problems".

The NAB case study 856 On 7 June 2021, NAB made the following announcement: National Australia Bank Limited (NAB) has been informed by AUSTRAC it has identified serious concerns with NAB's compliance with the Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) Act 2006 and the Anti-Money Laundering and Counter-Terrorism Financing Rules 2007. AUSTRAC advised NAB in a letter dated 4 June, 2021, (attached) that it is AUSTRAC's view that there is "potential serious and ongoing non-compliance" with customer identification procedures, ongoing customer due diligence and compliance with Part A of NAB's AML/CTF Program. These concerns have been referred to AUSTRAC's enforcement team, which has initiated a formal enforcement investigation. In the letter to NAB, AUSTRAC stated that it has not made any decision about whether or not enforcement action would be taken. AUSTRAC stated that, at this stage, it is not considering civil penalty proceedings and that this decision is "reflective of the work undertaken" by NAB to date. AUSTRAC's referral to its enforcement team follows regular engagement by NAB with AUSTRAC over a long period of time, both to report issues and keep AUSTRAC informed of progress in uplifting and strengthening the Group's AML/CTF Program. NAB has disclosed the existence of AML/CTF compliance issues in various public disclosures since 2017, including most recently in NAB's 2021 Half Year Financial Report AUSTRAC has a wide range of enforcement options available to it, including civil penalty orders, enforceable undertakings, infringement notices and remedial directions. NAB CEO Ross McEwan said NAB would continue to cooperate with AUSTRAC in its investigations. "NAB takes its financial crime obligations seriously. We are very aware that we need to further improve our performance in relation to these matters. We have been working to improve and clearly have more to do," Mr McEwan said. "NAB has an important role in monitoring and reporting suspicious activity and keeping Australia's financial system, our bank and our customers safe. "It is a key priority for everyone at NAB to uplift our financial crime capabilities, minimise risk to customers and the bank, and improve operational performance. That's why we are so focused on getting the basics right every time to protect our customers and our bank." Since June 2017, NAB has invested about $800 million as part of a multi-year program to uplift its financial crime and fraud controls and has more than 1,200 people dedicated to managing financial crime risks. 857 The announcement was accompanied by a copy of AUSTRAC's letter to NAB. In that letter, AUSTRAC stated that, although it was not considering civil penalty proceedings at that stage, "this position may be subject to change and you [NAB] will be notified if that occurs". 858 Prior to this announcement, since 2017, NAB had disclosed that it had identified various types of AML/CTF compliance issues. 859 On 2 November 2017 NAB made the following disclosure when providing its 2017 Full Year Results: Where significant AML/CTF compliance issues are identified, they are notified to AUSTRAC or equivalent foreign regulators, and those regulators are typically consulted and updated about progress in investigating and remediating the relevant issues. The Group is currently investigating and remediating a number of identified issues, including certain weaknesses with the implementation of 'Know Your Customer' requirements and systems and process issues that impacted transaction monitoring and reporting for some specific areas. 860 On 3 May 2018, when providing its 2018 Half Year Results, NAB disclosed continuing compliance issues with its KYC requirements: Investigation and remediation activities [of AML/CTF compliance issues] are currently occurring in relation to a number of identified issues, including certain weaknesses with the implementation of 'Know Your Customer' requirements and systems and process issues that impacted transaction monitoring and reporting for some specific areas. It is possible that, as the work progresses, further issues may be identified and additional strengthening may be required. The outcomes of the investigation and remediation process for specific issues identified to date, and for any issues identified in the future, are uncertain. 861 On 1 November 2018, when providing its 2018 Full Year Results, NAB disclosed: Investigation and remediation activities are currently occurring in relation to a number of identified issues, including certain weaknesses with the implementation of 'Know Your Customer' requirements, as well as systems and process issues that impacted transaction monitoring and reporting in some specific areas. NAB continues to keep AUSTRAC (and where applicable, relevant foreign regulators) informed of its progress in resolving these issues, and will continue to cooperate with, and respond to queries from, such regulators. 862 On 2 May 2019, when providing its 2019 Half Year Results, NAB reiterated its non-compliance problems: Investigation and remediation activities are currently occurring in relation to a number of identified issues, including certain weaknesses with the implementation of 'Know Your Customer' requirements, other financial crime risks, as well as systems and process issues that impacted transaction monitoring and reporting in some specific areas. 863 On 7 November 2019, in an earnings call, NAB disclosed that it had reported further breaches to AUSTRAC: So we observed 2 years ago off the back of the initial CBA issues, that we had reported a number of breaches to AUSTRAC. I think we have subsequently reported some further breaches. We have been working with AUSTRAC on those. And we've been very cooperative with AUSTRAC in making sure that not only do we meet the letter of the law but we meet the spirit of the law by alerting them to a range of issues even we're (sic) not strictly required. 864 On 27 April 2020, in an earnings call, NAB disclosed: We've been quite clear for the last 18 to 24 months that we are in conversation with AUSTRAC about our remediation of anti-money laundering. There's no change to that. There hasn't been any change to that wording for the last 18 months. We just want to be clear about that. We are not aware of anything that will come out of the blue in the nest week or 2. But that's not in my hands. It's purely in AUSTRAC's hands. We're not aware of anything of that nature. But we haven't changed our wording and our risk factors, so no change whatsoever. 865 On 5 November 2020, when providing its 2020 Full Year Results, NAB disclosed: The Group has reported compliance breaches to relevant regulators, including over the last financial year, and has responded to a number of requests from regulators requiring the production of documents and information. Identified issues include certain weaknesses with the Group's implementation of 'Know Your Customer' (KYC) requirements, other financial crime risks, as well as systems and process issues that impacted transaction monitoring and reporting in some specific areas. In particular, the Group has identified issues with collection and verification of identity information and enhanced customer due diligence for non-individual customers. This is the subject of a dedicated remediation program that is underway. 866 On 6 May 2021, when providing its 2021 Half Year Results, NAB disclosed: Identified issues include certain weaknesses with the Group's implementation of 'Know Your Customer' (KYC) requirements, other financial crimes risks, as well as systems and process issues that impacted transaction monitoring and reporting in some specific areas. In particular, the Group has identified issues with collection and verification of identity information and enhanced customer due diligence for non-individual customers. This is the subject of a dedicated remediation program that is underway. 867 Dr Unni conducted event studies in respect of the voluntary disclosures. In respect of the disclosures in the period 2 November 2017 to 6 May 2021, he found that NAB's share price declined at close of trading on 2 November 2017, 3 May 2018, 2 May 2019, 27 April 2020, and 6 May 2021, and increased at close of trading on 1 November 2018, 7 November 2019, and 5 November 2020. He reviewed the commentaries of analysts on each date and noted that, in the main, the analysts discussed NAB's earning results and its higher cost guidance. Importantly, not one analyst commented on the first disclosure on 2 November 2017, nor on the subsequent disclosures made on 3 May 2018, 1 November 2018, 2 May 2019 and 5 November 2020. There was, however, limited mention of NAB's AUSTRAC "news" (J.P Morgan on 7 November 2019, Morgan Stanley on 27 April 2020, and Morgan Stanley and Morningstar on 6 May 2021, with Morningstar estimating a penalty of $700 million). Dr Unni's opinion was that, despite the share price movements on these days, the voluntary disclosures about "AML violations" were not material to market participants. 868 With respect to the disclosure on 7 June 2021, Dr Unni noted that NAB's share price declined. When analysing NAB's announcement, three analysts commented on the size of penalties paid by the Bank and Westpac for non-compliance, with Credit Suisse suggesting that, although AUSTRAC had stated that it was "not considering civil penalties at this stage", "the market will mostly dismiss this statement". I note that an article published in The Sydney Morning Herald on 7 June 2021 referred to "the financial intelligence regulator" having "ramped up" an investigation into NAB amid "fresh revelations" that its AML department was "struggling to cope with a blow-out in processing times for suspicious transactions and a year-long backlog for reviewing high-risk customers", despite the fact that the article noted that AUSTRAC had not decided whether enforcement action will be taken against NAB. This article also revealed opinions expressed by former employees of NAB about the backlogs, and the reasons for the backlogs, the bank was experiencing. The article referred to "multiple sources" claiming that NAB had "hired under-qualified people to fill the gaps, creating further problems". 869 Dr Unni opined that the market reaction on 7 June 2021 was likely due to three matters: (a) NAB's announcement occurred after the Bank and Westpac had faced litigation in which sizeable penalties had been awarded (and which saw the ouster of their CEOs); (b) the market's assessment of AUSTRAC's resolve to pursue AML/CTF violations was likely magnified by AUSTRAC's announcement that it had simultaneously brought action against three other companies; and (c) allegations had been made by former NAB employees regarding significant underlying problems within NAB's AML compliance department. 870 Mr Ali also analysed the decline in NAB's share price following its announcement on 7 June 2021. He observed that this decline occurred notwithstanding that NAB had provided disclosure of its AML/CTF issues on numerous occasions, including in its financial results for the 2017, 2018, 2019 and 2020 years. He said: 214. It can be readily observed that the NAB share price decline could not have been due to new revelations regarding NAB's AML/CTF issues because those issues had already been disclosed by NAB. 215. I believe investors would have had regard for the fact that: a) AUSTRAC had already commenced proceedings against CBA in August 2017; b) AUSTRAC had already commenced proceedings against Westpac in November 2019; and c) it was relatively unusual for a financial institution such as NAB to publicly release a copy of correspondence from a regulator relating to an enforcement investigation, and, in my opinion, many investors would have likely perceived this disclosure by NAB as conveying a high degree of certainty that commencement of proceedings by AUSTRAC was likely, notwithstanding the fact that the correspondence from AUSTRAC stated that "at this stage, AUSTRAC is not considering civil penalty proceedings…". 216. Accordingly, in my opinion, the NAB share price decline was substantially a result of the market reaction to what was perceived by investors to be disclosure by NAB conveying a high degree of certainty that commencement of proceedings by AUSTRAC was likely. 217. This view is consistent with that of market analysts as indicated by a Reuters article which noted that, "Credit Suisse analysts told clients in a note that the market was likely to "dismiss" the regulator's statement that it was not considering financial penalties". (Footnotes omitted.) 871 The Bank submits that NAB's announcement on 7 June 2021 was "very much akin to an announcement of AUSTRAC commencing proceedings", particularly given the conditional manner in which AUSTRAC had expressed its then view about whether civil penalty proceedings would be commenced, and the scepticism expressed by Credit Suisse (referred to above). 872 The applicants submit that the share price reaction on 7 June 2021 was entirely consistent with NAB's announcement marking the first occasion that the public became aware that NAB's non-compliance with the AML/CTF Act was serious and ongoing. In this connection, the applicants submit that NAB's earlier disclosures never rose above general statements that it was investigating and remediating a number of identified issues, and that NAB had reported AML/CTF compliance breaches to AUSTRAC and other regulators. 873 The applicants contrast NAB's earlier disclosures with the disclosure made on 7 June 2021, which revealed that NAB did not just have weaknesses but "'potential serious and ongoing non-compliance' with its customer identification procedures, ongoing customer due diligence and compliance with Part A of its joint AML/CTF Program" which had taken place over a prolonged period. The applicants also refer to AUSTRAC's identification (in the letter accompanying NAB's disclosure) that NAB's "closure rates" of compliance issues were "concerning". The applicants submit that this information is "arguably analogous to the nature of the information the subject of this proceeding". They point to the evidence given by Mr Johnston in cross-examination: Market response was because this indicated another bank with AML/CTF problems. The brand damage didn't depend on penalties being issued. Even if AUSTRAC had never taken civil enforcement action or even if AUSTRAC were not to take civil enforcement action, investors basically marked down the price by several billion dollars because they were worried about the brand and other damage flowing to NAB, costs of remedial action, the costs of being involved in the AUSTRAC enforcement process, that they were material worries to investors absent the existence of a civil penalty.

Media and analysts' reports 874 The applicants seek to support their case on the materiality of the Late TTR Information by reference to media and analyst's reports given on 3 August 2017 (or shortly thereafter), even though those reports were prompted by AUSTRAC's announcement of the commencement of proceedings against the Bank for a civil penalty based on a range of contraventions of the AML/CTF Act. 875 In closing submissions, the applicants referred to two articles in particular which reported on the late TTR issue. The first article was in The Australian published online on 3 August 2017. While the article referred to "53,506 instances of deposits of more than $10,000 through CBA's 'intelligent' deposit machines that were either not reported or were slow to be reported" which "accounted for 95 per cent of all notifiable transactions between 2012 … and September 2015", and provided other information on this issue, the article, in fact, referred to "a host of failings" in respect of other AML/CTF compliance issues. 876 What is more, the article made a number of other serious claims and accusations. For example: (a) The Bank was accused of "ignoring warnings". (b) The Bank's breaches of financial reporting rules resulted in "the financing of drug manufacturing and importation, money laundering and terrorism as well as hindering authorities' efforts to gather evidence and intelligence". (c) AUSTRAC's commencement of proceedings against the Bank was "the latest of scandals to engulf Australia's biggest bank" and that the Bank had been "the centre of a number of customer failings in recent years, paying out tens of millions of dollars in compensation for issues ranging from poor financial advice and the denial of claims in its life insurance division". (d) Even after "law enforcement agencies" brought suspicious matters to the Bank's attention, it "did not perform mandatory checks to establish the source of a customer's wealth or terminate the account until after multiple issues were raised by police". (e) When the Bank did shut down accounts, it "gave 30 days' notice to the account user and allowed suspicious transactions in the account to continue during that period". (f) In some cases, the Bank "ignored tip-offs from Federal Police about accounts being used for illegal activity". (g) The Bank failed to review "alerts" in a timely manner with regard to ML/TF risks, until "often months later". 877 The second article was in the Chanticleer business column published in the Australian Financial Review on 4 August 2017. While this article also referred to the late TTR issue, it did so in conjunction with a number of other matters, including comment. For example: (a) When "problematic issues" were identified by regulators or the media, "Narev and his leadership team have been slow to respond". (b) Major issues that followed "this pattern" included "the financial planning scandal" and the "CommInsure scandal". (c) CommSec (the Bank's online broking platform, which was also Australia's largest online broking platform) was a "serial offender" with "a culture of non-compliance going back almost eight years". (d) There were "six separate prongs" to AUSTRAC's allegations, "the worst of which is the claim that even after it became aware of suspected money laundering or structuring on CBA accounts it did not monitor its customers to mitigate and manage the risks of money laundering and terrorism financing". 878 I pause here to note that, in closing submissions, the applicants referred to articles that mentioned the IDM ML/TF risk assessment non-compliance issue, and the account monitoring failure issue, or which reflected on the size of the potential penalty that might be imposed on the Bank. Similar comments can be made with respect to these references, as made above. 879 The applicants draw attention to an analyst report by Goldman Sachs (3 August 2017) commenting on the fact that AUSTRAC had commenced civil proceedings against the Bank. The report referred to AUSTRAC alleging "over 53,700 contraventions of the Act, particularly relating to the use of" IDMs. Goldman Sachs said that it "[did] not take a view on the outcome" but noted, amongst other things, that Tabcorp had paid a civil penalty of $45 million in respect of 108 contraventions of the Act and that the maximum civil penalty for each contravention of the AML/CTF Act was $21 million. The report noted that the Bank's capital generation was "strong" but said: … any material fines that could potentially result from these proceedings might require CBA's capital strategy to extend beyond just non-discounted DRPs. 880 As to valuation, the report said: CBA currently trades at a 16% premium to its peers. If CBA were to move to its 5 year peer relative valuation low due to a potential hit to its reputation, the implied downside to the stock price would be 9%. 881 Importantly, however, when discussing implications, the report said: At this early stage, we make no changes to our earnings estimates or target price, and maintain our Neutral rating. 882 The applicants also draw attention to an analyst report from Morgan Stanley (4 August 2017). This report also refers to the late TTR issue, but in conjunction with all the allegations of contravention made by AUSTRAC, as well the allegations that: (a) Even after the Bank became aware of suspected money laundering or structuring, "it did not monitor its customers to mitigate and manage ML/TF risk, including the ongoing ML/TF risks of doing business with those customers". (b) In its Concise Statement, AUSTRAC had provided "details in relation to four money laundering syndicates and one 'cuckoo smurfing' syndicate". (c) The Bank's conduct had "exposed the Australian community to serious and ongoing financial crime". 883 The report noted the potential civil penalty that could be imposed on the Bank by reference to the civil penalty imposed on Tabcorp. It observed, however, that "it should not be assumed that the method for determining any penalty will be similar". 884 As to implications, the report said: In addition to penalties, we see six other potential implications for CBA: (1) brand damage; (2) material costs for process and system remediation; (3) management changes; (4) changes to CBA's sales and growth strategies arising from broader concerns about conduct; (5) greater oversight from APRA; (6) higher probability of a Royal Commission into the banking sector, or other inquiries into conduct and pricing. 885 The applicants referred to other analyst reports commenting on AUSTRAC's commencement of proceedings against the Bank. It is not necessary for me to summarise the detail of the reports in these reasons. 886 The applicants submit that commentary from media and analysts showed that they were concerned by the Bank's "serious and longstanding non-compliance with the AML/CTF Act". I note, however, that, of the 11 analyst reports published in the period immediately after 3 August 2017, only one analyst (Macquarie) decreased its share price target for CBA shares. Even then, the decrease was only $1.00 ($81.50 to $80.50). All other analysts either increased or maintained their price targets for CBA shares. 887 Professor da Silva Rosa gave evidence that analysts are often very reluctant to change their price targets and that this is "one of the least accurate things about analysts' reports". Even if this be so, these were the rational views of informed market participants. I do not accept that their views can be dismissed in the way that Professor da Silva Rosa sought to dismiss them. It is notable that the conduct disclosed by AUSTRAC in the 3 August 2017 announcement - which, on any view, was far more egregious than the Late TTR Information (or any of the other pleaded forms of the Information) - did not move analysts, in the main, to revise their estimates of the Bank's share value. 888 The Bank submits that the analyst reports represent an "unvarnished view" of the effect that analysts expected the 3 August 2017 announcement to have on the Bank's share price. The Bank submits that this is an indication that the "less significant" information that the applicants allege the Bank should have disclosed to the market, was not material.

The beta analysis 889 It will be recalled that Professor da Silva Rosa was of the opinion that investors would consider, or would be likely to consider, the Late TTR Information to be value-relevant, such as to lead them to infer that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act. According to Professor da Silva Rosa, this would then lead investors to (amongst other things) upwardly revise their estimates of the Bank's operational risk with economically significant adverse consequences. Based on his view of investor decision-making, Professor da Silva Rosa opined that, if expected cash flows and risk aversion remained unchanged, an increase (decrease) in investor perception of risk would cause security prices to decrease (increase). 890 To test this proposition, Mr Ali undertook an empirical analysis of the "riskiness of CBA's share price" as measured by its historical "beta" (the beta analysis). The "beta" of a share is the measure of its price volatility relative to the market's volatility. 891 Mr Ali analysed the historical price volatility of CBA shares (and of ANZ, NAB, and Westpac shares) relative to the volatility of all shares comprising the All Ordinaries Index, for the 24 month periods immediately preceding and immediately following the 3 August 2017 announcement. This analysis showed that the market perception of the "riskiness" of CBA shares did not increase following the 3 August 2017 announcement. Rather, it decreased. 892 Specifically, Mr Ali observed that the Bank's historical beta for the 24 month period immediately following the 3 August 2017 announcement was 9.9% lower than the Bank's historical beta for the 24 month period immediately preceding the announcement. This reduction was broadly in line with the reduction in the corresponding 24 month historical betas for ANZ and Westpac. The reduction in NAB's corresponding 24 month historical beta was greater, as shown in the following chart: 893 For completeness, Mr Ali also measured the historical betas for 12 month, 6 month, and 3 month periods immediately preceding and following the 3 August 2017 announcement, and observed similar results. 894 Mr Ali then analysed the rolling 24 month historical beta of CBA shares and the peer major banks over time. (This is the daily observable historical market beta of the share, calculated each day based on the preceding 24 month historical prices for the share, and market index data). As this is a rolling series, the addition of each new data point sees the oldest historical data point correspondingly removed from the calculation. 895 Care must be taken in interpreting rolling historical beta in the present case because the rolling historical beta for CBA shares in the months immediately following the 3 August 2017 announcement will include data from the months preceding 3 August 2017, in which there was relatively higher share price volatility. 896 Mr Ali analysed the rolling historical beta for CBA shares against both the All Ordinaries and ASX200 indices and noted that there was no observable increase in the rolling 24 month historical beta around the time of the 3 August 2017 announcement. He said that this was consistent with his earlier analysis that the "riskiness of CBA shares" actually fell in the period immediately following the 3 August 2017 announcement: 897 The Bank submits that Mr Ali's beta analysis demonstrates, empirically, that the theory on which Professor da Silva Rosa's opinion was expressed on the value-relevance of the Late TTR Information is incorrect. The evidence does not show that, when informed of the matters in the 3 August 2017 announcement, investors upwardly revised their estimates of the Bank's operational risk with economically significant adverse consequences. 898 I note, in this regard, that Mr Ali's beta analysis is relevant not only to my consideration of the materiality of the Late TTR Information but of each of the other pleaded forms of the Information. 899 I should record that Professor Easton criticised Mr Ali's analysis on the basis that Mr Ali had used historical beta, not expected future beta. This criticism was based on academic literature which cautions that, in valuing a company, the objective is not to precisely measure historical beta but to estimate future beta. 900 I accept the Bank's submission that this criticism is misdirected. Mr Ali was not seeking to value CBA shares. Rather, he was seeking to ascertain the market's historical perception of risk attaching to CBA shares around the pivot of the 3 August 2017 announcement. I am satisfied that his use of historical beta was suitable for that purpose.

Materiality: The account monitoring failure information and the IDM ML/TF Risk Assessment Non-Compliance Information

The applicants' submissions 901 In closing submissions, the applicants made clear that they do not advance the materiality of the Account Monitoring Failure Information and the IDM ML/TF Risk Assessment Non-Compliance Information in isolation from the Late TTR Information. Their justification for closing their case in this way was that these pleaded forms of the Information "would have been liable to be disclosed at the same time". This assumption is questionable given that the applicants have pleaded that different forms of the various categories of the Information should have been disclosed at different times. Nevertheless, this is the way the applicants chose to put their final case on materiality. Indeed, in their submissions on causation and loss, the applicants went so far as to say that "there was no world" in which the Account Monitoring Failure Information and the IDM ML/TF Risk Assessment Non-Compliance Information "would be disclosed individually". 902 Having chosen this course, the applicants still referred briefly to Professor da Silva Rosa's evidence and Mr Johnston's evidence on these topics.

Professor da Silva Rosa 903 I have already referred to the fact that Professor da Silva Rosa considered that "each species of information was economically equivalent to each other species of information". This was because each of the pleaded forms of the Information would lead investors to infer that the Bank had been substantially and systematically deficient in its compliance with its requirements under the AML/CTF Act. This would then lead investors to: (a) lower their assessment of the Bank's competence in complying with the requirements of the AML/CTF Act; (b) upwardly revise their estimates of the Bank's operational risk of presently being non-compliant in a substantial way with the AML/CTF Act and consequently risking economically significant adverse consequences; and (c) increase their estimation of the Bank's reputational risk.

Mr Johnston 904 As to the Account Monitoring Failure Information, Mr Johnston said that it was not possible to determine whether the information would be quantitatively material to investors. However, he said that the Account Monitoring Failure Information would be qualitatively material because: (a) the failure to monitor the accounts was a failing in the Australian banking system (the integrity and credibility of the Australian financial system relied on preventing ML/TF, which required the four major banks to have compliant and appropriate risk-based systems and controls in place); (b) the failure would materially damage the Bank's market standing (its contraventions related to an area of concern to the Government and of relevance to the national interest); (c) the failure of the Bank to comply with its own AML/CTF Program would add to "the sense of material failings under AML/CTF"; (d) the Bank had seemingly allowed inappropriate monitoring to continue even after it was aware, or ought reasonably to have been aware, of its monitoring failures and the underlying cause; (e) the Bank's contraventions continued over the pleaded periods of time; (f) the Bank was likely to be exposed to material remediation and ongoing systems costs as well as penalties; and (g) the cost of doing business for the Bank and other banks was likely to increase materially (and revenues might decline) due to the risk of increased regulatory and government intervention. 905 As to the IDM ML/TF Risk Assessment Non-Compliance Information, Mr Johnston said that this information would be qualitatively material for substantially the same reasons that the Account Monitoring Failure Information was qualitatively material: (a) the failure to carry out a risk assessment was a failing in the Australian banking system (the integrity and credibility of the Australian financial system relied on preventing ML/TF, which required the four major banks to have compliant and appropriate risk-based systems and controls in place); (b) the failure would materially damage the Bank's market standing (its contraventions related to an area of concern to the Government and of relevance to the national interest); (c) the failure of the Bank to comply with its own AML/CTF Program would add to "the sense of material failings under AML/CTF"; (d) the failure to have sound AML/CTF systems and controls in place meant that the Bank's business was at risk of being misused for criminal purposes (which would materially damage the Bank's standing); (e) the Bank did not carry out an assessment between May 2012 and July 2015, meaning that, for an extended period, it would have exposed Australia to the risk of serious and ongoing financial crime; (f) the Bank was likely to be exposed to material remediation and ongoing systems costs as well as penalties; and (g) the cost of doing business for the Bank and other banks was likely to increase materially (and revenues might decline) due to the risk of increased regulatory and government intervention. 906 As with the Account Monitoring Failure Information, Mr Johnston said that the IDM ML/TF Risk Assessment Non-Compliance Information could not readily be quantified by investors or analysts.

Mr Ali 907 Mr Ali's opinion was that, in the absence of the actual commencement of proceedings by AUSTRAC on 3 August 2017, investors would have likely viewed the Account Monitoring Failure Information as being not material, and not information that would, or would be likely to, influence persons who commonly invest in securities in determining whether to acquire or dispose of CBA shares. 908 Mr Ali said that, for the purpose of assessing materiality, the Account Monitoring Failure Information had to be considered in the context of prevailing circumstances during the relevant period. In that regard, he referred to the same matters of context that were relevant to assessing the materiality of the Late TTR Information. 909 Mr Ali also pointed to the following matters: (a) throughout the relevant period, the Bank's AML/CTF Program included a transaction monitoring program which provided for automated and manual monitoring depending on the ML/TF risk associated with particular products; (b) automated transaction alerts were potentially not generated in respect of transactions conducted on approximately 778,370 accounts. However, the affected accounts represented approximately 1.6% of the accounts within the Bank's FCP system (implying that approximately 98.4% of the accounts in that system were not affected by the account monitoring failure issue); (c) the account monitoring failure issue arose from a coding error that occurred in the merging of two systems, with no fraud or misconduct on the part of the Bank; (d) only accounts held by a customer who was a Bank employee or associated with a Bank employee (such as sharing contact details) had the potential to be affected (meaning that the account monitoring failure issue was confined to a "relatively small defined subset of CBA customers"); (e) the coding error was self-identified and rectified, such that it no longer affected new accounts within three months of being identified (indicating a proactive approach to rectifying such errors); (f) a remediation program was undertaken for all affected accounts within a specified timeframe (indicating, once again, a proactive approach to "ensuring fulsome remediation of the issue"); and (g) the precise period for which account monitoring did not operate as intended varied between accounts. 910 Mr Ali said: 149. In my opinion, based on my experience, market investors understand that operational errors of the nature that resulted in the Account Monitoring issue may arise from time to time, particularly in the context of large-scale data migration projects. Moreover, investors appreciate that it would be highly unusual for large-scale data migration projects to be implemented without such technical or operational errors occurring, notwithstanding extensive system controls, review and testing, and that it would be more common in large scale data migration projects that numerous such technical errors occurred, with some errors being identified and remedied more swiftly than others. 911 Mr Ali also said: 152. Having regard to the prevailing circumstances and context described above, in my opinion, investors would reasonably expect that operational errors such as data migration errors may occur from time to time and would not conclude that CBA's operational risk was materially increased as a result of this error. Furthermore, in my opinion during the Relevant Period, in the absence of the actual commencement of proceedings by AUSTRAC on 3 August 2017, investors would have likely viewed the Account Monitoring Failure Information as being not material over and above the disclosure already provided by CBA in, for example, its 2014 US Disclosure Document which included the following statements: • the Group faced operational risks associated with being a complex financial institution and may incur losses as a result of ineffective risk management processes and strategies; • the Group was exposed to the risk of loss resulting from human error, the failure of internal or external processes and systems or from external events; • the Group's businesses were highly dependent on the Group's ability to process and monitor, in many cases on a daily basis, a very large number of transactions, many of which were highly complex, across multiple markets in many currencies; • the Group's financial, accounting, data processing or other operating systems and facilities might fail to operate properly or may become disabled as a result of events that are wholly or partially beyond its control; • as with any business operating in the financial services market, the Group utilised complex technology frameworks and systems to deliver its services and manage internal processes; • the Group faced technology risks associated with being a complex financial institution and may incur losses as a result of ineffective risk management processes and strategies; • as part of its Technology Risk Management Framework, the Group employed a range of risk monitoring and risk mitigation techniques however there could be no assurance that the risk management processes and strategies that the Group had developed in response to current market conditions would adequately anticipate additional market stress or unforeseen circumstances and therefore the Group may, in the course of the Group's activities, incur losses or reputational harm as a result of technology disruptions; and • disruptions to the technology framework could have a significant impact on the Group's operations and that these disruptions could be caused from internal events (e.g. system upgrades) and external events (e.g. failure of vendors' systems or power supplies or technology attacks by third parties). 912 Mr Ali expressed substantially the same opinion with respect to the IDM ML/TF Risk Assessment Non-Compliance Information. He said that, in the absence of the actual commencement of proceedings by AUSTRAC on 3 August 2017, investors would have likely viewed the IDM ML/TF Risk Assessment Non-Compliance Information as not being material, and not information that would, or would be likely to, influence persons who commonly invest in securities in determining whether to acquire or dispose of CBA shares. 913 As well as referring to the same matters of context as the Late TTR Information, Mr Ali pointed to the following matters: (a) prior to the introduction of the IDMs, the Bank had conducted an assessment of ML/TF risk in respect of ATMs (IDMs being considered by the Bank as ATMs with enhanced functionality), had given consideration to certain ML/TF risks in respect of IDMs, and determined controls to manage those risks. However, it had not carried out a separate formal assessment of IDMs as required by its own AML/CTF Program; (b) at all times since the introduction of the IDMs in 2012, the Bank carried out its transaction monitoring program as relevant to accounts accessible through IDMs, including: through the Bank's FCP (which generated automated transaction monitoring alerts); manual alerts raised by Bank employees who had identified potentially suspicious activity; and a platform for reviewing both automated and manual transaction alerts; and (c) in July 2015 an ML/TF risk assessment was carried out, which found that no additional risk-based controls were introduced (the implication being that no identifiable risk based controls were considered to be necessary). 914 Mr Ali observed that the risk assessment failure issue did not, of itself, have any direct cash flow implications for the Bank. Further, he said that, given the increasingly extensive and complex regulatory environment within which the Bank operated, investors would reasonably expect that certain of the Bank's operational risk management processes may not operate as intended from time to time.

Mr Singer 915 Mr Singer's opinion was that the Account Monitoring Failure Information, in and of itself, would not, or would not likely, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares at any time during the relevant period. Mr Singer advanced a number of reasons for this opinion, including the following. 916 First, Mr Singer said that, considering the Account Monitoring Failure Information in its numerical context, and against the scale of the Bank's operations (involving tens of millions of open accounts), the information is not quantitatively material. 917 Secondly, Mr Singer said that it was not market practice for companies to disclose every time an operational issue arose. He said that investors have an expectation that operational issues will arise from time to time and be dealt with in accordance with internal protocols. This may include dealing with regulators. He said that investors would not expect information, such as the Account Monitoring Failure Information, to be disclosed. 918 Thirdly, Mr Singer said that, post the GFC, investors accept that there is a risk of regulatory and governmental intervention and that financial institutions will be subject to a higher level of government oversight and regulatory burden. 919 Fourthly, Mr Singer said that the error was an IT coding error that the Bank had identified and rectified, as part of its existing resourcing. 920 Fifthly, the Account Monitoring Failure Information did not have any value-related implications for the Bank - specifically, it did not have any impact on the Bank's net profit apart from a potential "fine". 921 Similarly, Mr Singer's opinion was that the IDM ML/TF Risk Assessment Non-Compliance Information, in and of itself, would not, or would not likely, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares at any time during the relevant period. He advanced a number of reasons for this. His reasons included the fact that Mr Singer did not consider the IDM ML/TF Risk Assessment Non-Compliance Information to be quantitatively material. It involved a limited issue, and he did not perceive that the Bank's non-compliance would attract a substantial penalty. Mr Singer also stated that, post the GFC, investors accepted that financial institutions would be subject to a higher level of government oversight and regulatory burden. He referred, once again, to the fact that it was not the practice for companies to make a disclosure every time an operational issue arose, nor would investors expect such a disclosure. Moreover, as with the Account Monitoring Failure Information, he said that the IDM ML/TF Risk Assessment Non-Compliance Information did not have any value-related implications for the Bank.

Dr Unni 922 Dr Unni did not consider the Account Monitoring Failure Information or the IDM ML/TF Risk Assessment Non-Compliance Information to be material. However, he did not advance any arguments beyond those he advanced in respect of the Late TTR Information.

Materiality: Potential Penalty Information 923 The applicants also allied their case on the materiality of the Potential Penalty Information with their case on the Late TTR Information. In closing submissions they argued that: … the provision of information to the market as to the potential regulatory outcome of enforcement action and a substantial civil penalty arising from CBA's non-compliance, would make it easier for investors to appreciate the gravity and significance of CBA's conduct in respect of Late TTRs. This outcome would only be strengthened had the Potential Penalty Information been released not only in conjunction with the Late TTR Information, but either the Account Monitoring Failure Information and/or the IDM ML/TF Risk Assessment [Non-Compliance] Information. 924 It will be apparent that the effect of this argument is to bolster the materiality of the Late TTR Information (and the Account Monitoring Failure Information and the IDM ML/TF Risk Assessment Non-Compliance Information) rather than address the materiality of the Potential Penalty Information itself. 925 Nevertheless, the applicants seek to support the materiality of the Potential Penalty Information by reference to the Bank's own conduct. 926 In this regard, the applicants refer to the Bank's initiation of Project Concord after the Bank's receipt of the first statutory notice. As I have recorded, by 7 February 2017, Project Concord had expanded to include an internal and external communications plan to be used in the event of public dialogue from AUSTRAC in relation to the Late TTR issue. By 22 March 2017, Project Concord had reached the stage of formulating a communications strategy should AUSTRAC commence proceedings against the Bank. However, as I have also noted, the Bank considered this to be a "worst case scenario". 927 The applicants also rely on Mr Narev's acceptance that from October/November 2016 he considered there to have been a serious risk of AUSTRAC taking regulatory action against the Bank, which could be the imposition of a significant "fine". However, it is also fair to say that Mr Narev's assessment of risk in this regard included AUSTRAC taking other forms of regulatory action, not just the imposition of a "fine". 928 The applicants also submit that the materiality of the Potential Penalty Information is supported by Professor da Silva Rosa's evidence and Mr Johnston's evidence. 929 The starting point for Mr Johnston was quantitative materiality. He looked to the theoretical maximum amount of the pecuniary penalty that could be imposed on the Bank. He argued that industry participants would have quickly learnt of the maximum theoretical penalty for the Late TTR Information alone. This amount not only pointed to the materiality of the Bank's "contraventions" but indicated that "even smaller numbers of contraventions could have a serious adverse impact on CBA's profits, prospects and financial standing". Mr Johnston also called in aid the financial penalties that had been imposed on other financial institutions in overseas jurisdictions as a "cross-check to investor awareness of the ramifications of AML/CTF contraventions". 930 Mr Johnston said that the Potential Penalty Information would also be material to investors on a qualitative basis. In this connection, Mr Johnston said that the strict liability nature of contraventions of the AML/CTF Act would highlight to investors the Bank's "need to avoid even isolated contraventions of the AML/CTF laws, and the seriousness of systemic failures and/or management recklessness if CBA continually contravened them". 931 Professor da Silva Rosa advanced the materiality of the Potential Penalty Information on the same basis as he advanced the materiality of the Late TTR Information, the Account Monitoring Failure Information, and the IDM ML/TF Risk Assessment Non-Compliance Information - investors who received the Potential Penalty Information would, or would be likely to, infer that the Bank had been substantially and systematically deficient in its compliance with requirements under the AML/CTF Act, influencing investors to lower their assessment of the Bank's competence in complying with its requirements under the AML/CTF Act, upwardly revising their estimates of the Bank's operational risk of being non-compliant in a substantial way, and increasing their estimation of the Bank's reputational risk, all leading to a decrease in the Bank's expected net cash flows. 932 Mr Ali's opinion was that, in the absence of a high degree of certainty regarding the probability of AUSTRAC actually commencing civil penalty proceedings, the Potential Penalty Information was not information that investors would likely have viewed as being material, and not information that would, or would be likely to, influence persons who commonly invest in securities in determining whether to acquire or dispose of CBA shares. 933 Mr Ali's reasons for this opinion included the following: (a) AUSTRAC had a number of courses of action it could take apart from commencing proceedings for a civil penalty; (b) the Bank had been engaging extensively with AUSTRAC throughout the relevant period and, up to 3 August 2017, AUSTRAC had advised the Bank that it had not made a decision on what action it may or may not take, and would not advise the Bank on the course it would take until AUSTRAC had made a decision on that question; and (c) the amount of any pecuniary penalty that would be imposed would be a matter for the Court to decide, and this would depend on a number of factors. 934 Mr Ali's assessment of materiality also included his assessment of the materiality of the Late TTR Information, the Account Monitoring Failure Information, and the IDM ML/TF Risk Assessment Non-Compliance Information, on which, in his view, the materiality of the Potential Penalty Information would depend. Mr Ali did not consider that, in and of itself, the Potential Penalty Information conveyed any materially greater level of information than the general information that the Bank had already disclosed about its operational risks in an increasingly extensive and complex regulatory environment, and the consequences of those risks should regulatory action be taken. 935 Further still, Mr Ali said that in order to make an assessment of the implications of the Potential Penalty Information, investors would have to assess: (a) the probability of proceedings for a pecuniary penalty being commenced; (b) the probability of a pecuniary penalty being imposed; and (c) an estimate of the probability weighted amount of the impost associated with a pecuniary penalty order. Mr Ali said: Given the multiple layers of contingent probability, there is necessarily a significant element of subject judgement required on the part of investors to make such an assessment. Based on my experience and judgement, investors would require clarity regarding the likelihood of the commencement of proceedings before seeking to determine the likelihood of a penalty actually being imposed and estimating a probability weighted impost. In practice, the clarity so required could only be provided if the company had a high degree of certainty regarding the probability of proceedings being so commenced. 936 Mr Ali also said that, in his experience, it was not common practice during the relevant period for financial institutions to disclose the specifics of potential litigation or regulatory enforcement unless proceedings had been commenced or regulatory action taken (or a high degree of certainty that this would happen), or the financial institution could provide investors with some degree of clarity regarding the implications of the proceedings/action, such as by recognising a provision in the entity's contingent liabilities. 937 Mr Singer's opinion was that the Potential Penalty Information, in and of itself, would not, or would not be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares during the relevant period. Mr Singer did not read the Potential Penalty Information as incorporating the Late TTR Information, the Account Monitoring Failure Information, or the IDM ML/TF Risk Assessment Non-Compliance Information. However, Mr Singer said that, if it did include the other information, he relied on the opinions he had expressed with regard to the (lack of) materiality of that information. 938 Mr Singer also noted that the Potential Penalty Information is not expressed with any degree of certainty. He expressed the view that the market does not expect the possibility of a penalty to be released at a stage when an entity is still in discussions with a regulator. 939 Mr Singer also said that, in his experience, "the market expects the process to be regulator-led" - meaning that a decision to escalate regulatory non-compliance is a matter that is ultimately in the hands of the regulator for it to announce an "enforcement action". 940 Finally, Mr Singer, like Mr Ali, commented that the question of whether a penalty would be imposed, and the quantum of any penalty, are matters for a court to determine having regard to a number of factors. Unlike Mr Johnston, Mr Singer did not regard the quantum of penalties imposed on other financial institutions for non-compliance with ML/TF obligations in overseas jurisdictions as offering practical guidance on the penalties that would be imposed in the Australian context for contravention of the AML/CTF Act. Mr Singer also said that investors would hold the view that the maximum penalties on which Mr Johnston relied are "not in the realms of probability". 941 In his report, Dr Unni confined his opinion on the materiality of the Potential Penalty information to commenting that neither the academic literature nor the analysts' reports following the 3 August 2017 announcement, on which Professor da Silva Rosa relied, supports a conclusion that the Potential Penalty Information would have been material.

The significance of the market reaction to the 3 August 2017 announcement 942 There can be no doubt that, following the 3 August 2017 announcement, the market price of CBA shares on the ASX fell. For present purposes, I shall proceed on the assumption that this price movement was caused by, and resulted from, the 3 August 2017 announcement itself. 943 Although the applicants' case on materiality is not dependent on my acceptance of Professor da Silva Rosa's evidence and Mr Johnston's evidence on that question, the applicants nevertheless rely on the evidence of both experts to support their case in this regard. As the market reaction to the 3 August 2017 announcement is fundamental to both Professor da Silva Rosa's and Mr Johnston's opinions on materiality, it is convenient to commence my analysis of the question of materiality with their evidence and the significance that the 3 August 2017 announcement has to their evidence and the applicants' case. 944 Professor da Silva Rosa expressed the opinion that each pleaded form of the Late TTR Information, each pleaded form of the Account Monitoring Failure Information, each pleaded form of the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information, was "economically equivalent" to the 3 August 2017 announcement. As I have noted, Professor da Silva Rosa regarded two sets of information to be "economically equivalent" when they convey the same "implications" as to risk and expected cash flows. For Professor da Silva Rosa, the implication as to risk and expected cash flows of each pleaded form of the Information and the 3 August 2017 announcement was that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act. 945 Subject to one significant qualification which I discuss below, Mr Johnston's opinion was to the effect that, if any of the pleaded forms of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, or the Potential Penalty Information were to have been disclosed when the applicants say it should have been disclosed, the market's reaction to the disclosure would not have been materially different to the market's reaction to the 3 August 2017 announcement. 946 These opinions are substantially the same in effect. I do not accept them. 947 First, I do not accept that any of the pleaded forms of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, or the Potential Penalty Information, is equivalent, in any sense, to the information disclosed in the 3 August 2017 announcement. Indeed, I am satisfied that the information conveyed by the 3 August 2017 announcement is materially, and significantly, different to the information conveyed by each of the pleaded forms of the Information or any combination of those pleaded forms. 948 As I have previously recorded, the 3 August 2017 announcement comprised the cumulative information provided by AUSTRAC's Tweet, media release, and the Concise Statement. I have previously summarised the features of that information. There are obvious and notable differences in the content of the 3 August 2017 announcement and the discrete information conveyed by the pleaded forms of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information, although elements of those various pleaded forms of the Information are contained within the 3 August 2017 announcement. 949 There are also elements of the Late TTR Information, the Account Monitoring Failure Information, and the IDM ML/TF Risk Assessment Non-Compliance Information that are not present in the 3 August 2017 announcement. I refer, in particular, to the elements of June 2014 Late TTR Information, the August 2015 Late TTR Information, and the June 2014 Account Monitoring Failure Information. Significantly, each of the June 2014 Late TTR Information and the August 2015 Late TTR Information contain the integer that the cause of the Late TTRs had not been rectified. I have already remarked on the incongruous nature of this element, given that it is inconceivable that the Bank would have failed to rectify the cause of the problem upon becoming aware of it. Further, the June 2014 Account Monitoring Failure Information stipulates the number of affected accounts by reference to the applicants' own assumptions and calculations. 950 The Potential Penalty Information is completely at variance with the 3 August 2017 announcement in that the Potential Penalty Information is characterised by high level, contingent, and inconclusive language about the possibility of enforcement action and the possibility that AUSTRAC might seek a pecuniary penalty, whereas the 3 August 2017 announcement is the clearest possible statement that enforcement action had been taken by AUSTRAC and that that enforcement action was the commencement of proceedings against the Bank for pecuniary penalties, amongst other relief. 951 Secondly, as I have also noted, the 3 August 2017 announcement included AUSTRAC's significant public censure of the Bank's failings and the message that AUSTRAC wanted its action to be taken as a warning to other reporting entities. This adds an important, explicitly adverse quality to the 3 August 2017 announcement that is not present in the pleaded forms of the Information. 952 Thirdly, having reached these views, I do not accept that the pleaded forms of the Information would convey the same "value-relevant implications to investors" (to use Professor da Silva Rosa's expression) as the 3 August 2017 announcement.

Consideration of Professor da Silva Rosa's evidence

The IDM ML/TF Risk Assessment Non-Compliance Information 953 Staying with Professor da Silva Rosa's evidence, I do not accept that the IDM ML/TF Risk Assessment Non-Compliance Information implies, or that persons who commonly invest in securities would infer, that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act, simply on the basis of the single failure to carry out a formal and separate assessment of ML/TF risk in respect of its IDMs. I do not accept that, by reason of that single failure, such investors would upwardly revise their estimates of the Bank's operational risk, or increase their estimates of the Bank's reputational risk, in any significant way, such as to influence their decision to acquire or dispose of CBA shares. 954 This is particularly so when the pleaded forms of the IDM ML/TF Risk Assessment Non-Compliance Information are considered in their proper context. As I have noted, when, in response to a query raised by AUSTRAC, the Bank informed AUSTRAC on 26 October 2015 that it had relied on the ML/TF risk assessment it had conducted on ATMs, AUSTRAC did not raise any issue about that fact at that time. Further, there is no evidence that the failure to carry out a separate and formal risk assessment before the roll out of the IDMs in May 2012, or in the period May 2012 to July 2015, had any direct consequences. The Bank understood that threshold transaction monitoring and other transaction monitoring were mandatory requirements of its roll out of the IDMs, and threshold transaction monitoring and other transaction monitoring rules were in place with respect to the IDMs. The late TTR issue was not the consequence of the Bank failing to carry out a risk assessment. It was a coding error. All these matters are important in assessing the materiality of the IDM ML/TF Risk Assessment Non-Compliance Information. 955 In addition, if disclosed in its pleaded forms, investors would be left in some wonderment as to why they were being told this information by the Bank. To the extent that such investors would regard the IDM ML/TF Risk Assessment Non-Compliance Information to be of concern, or even interest, I am satisfied that they would want concrete information on its significance and potential consequences for the Bank before being influenced to either acquire or dispose of CBA shares. Such information is completely lacking from the IDM ML/TF Risk Assessment Non-Compliance Information. It is possible that such investors might speculate about those matters, but I do not accept that, by reason of such speculation alone, they would be influenced, or that it is likely that they would be influenced, in deciding whether to acquire or dispose of CBA shares. 956 Much the same considerations apply to the Late TTR Information and the Account Monitoring Failure Information.

The Late TTR Information 957 Turning to the Late TTR Information, I accept that, considered in the abstract, the number of threshold transactions, and the value of those transactions, are quantitatively large in all pleaded forms of that information, particularly in relation to the August 2015 Late TTR Information and the September 2015 late TTR Information. However, when that information is considered in its proper context, I am not persuaded that persons who commonly invest in securities would infer that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act in the sense that the Bank had engaged in widespread non-compliance by reason of various deficiencies throughout its ML/TF monitoring processes. 958 This is because, although the Bank's failing involved a large number of threshold transactions of a correspondingly large dollar amount, the proper context for assessing the materiality of the Late TTR Information includes the important facts that: (a) the failure to lodge these TTRs on time resulted from a single coding error; (b) this error had been rectified (or notionally would have been rectified after discovery in relation to the June 2014 Late TTR Information or the August 2015 Late TTR Information, contrary to the pleaded facts); and (c) the TTRs had been lodged, albeit later than they should have been lodged. 959 In a sense, the late TTR issue, like the IDM ML/TF risk assessment non-compliance issue, concerned a single failure. This failure was a coding error. However, unlike the IDM ML/TF risk assessment non-compliance issue, there were consequences: a large number of TTRs were lodged late in circumstances where the lateness itself could not be rectified. This should not have happened. It was a significant failure in respect of an important regulatory obligation. However, that fact alone does not mean that the Late TTR Information was material in the relevant sense. In this regard, there are other important contextual matters that must be taken into account in assessing the materiality of the late TTR Information. 960 First, the Bank's monitoring of threshold transactions through IDMs was but one part of the Bank's overall monitoring of threshold transactions. Further, the monitoring of threshold transactions was but one part of the Bank's transaction monitoring for ML/TF purposes. Thus, the fact that the Late TTRs represented a large proportion of threshold transactions through IDMs in the relevant period must be seen in the context that the Late TTRs represented between 1.08% and 2.3% of the total TTRs lodged by the Bank, and represented between 0.0002% and 0.0007% of the total transactions monitored by the Bank, in the relevant period. 961 This puts the Late TTR Information in perspective. It makes clear that not only was the Bank's failing in relation to IDMs the result of a single coding error that had been rectified, but that the error affected, relatively speaking, a small part of the Bank's overall threshold transaction monitoring processes, and an even smaller part of the Bank's overall monitoring processes. 962 This is not to deny the large number of Late TTRs or the value of the transactions involved with this error, or the fact that the lateness itself could not be rectified. It does, however, inform the question whether persons who commonly invest in securities would infer that, by this failing, the Bank was substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act in the sense I have described. As I have said, I am not persuaded that such investors would draw that inference. 963 Secondly, while I accept that investors who commonly invest in securities would have an expectation that financial institutions will take sufficient measures and undertake sufficient investment to mitigate their operational risks, including those risks arising from their need to comply with the AML/CTF Act, I also accept that such investors would understand that financial institutions are not free of risk in that regard. Such investors would factor that consideration into their decision-making with respect to, here, the acquisition or disposal of CBA shares. It means that the fact of non-compliance would not be reason alone to influence such investors in deciding to acquire or dispose of CBA shares. 964 Thirdly, and relatedly, like the IDM ML/TF Risk Assessment Non-Compliance Information, the Late TTR Information is completely silent on the significance, and consequences for the Bank, of not lodging the TTRs on time. The context in which the Late TTR Information must be assessed includes the fact that the Bank had been in discussions with, and supplying information to, AUSTRAC for nearly two years before AUSTRAC commenced proceedings, in circumstances where the Bank itself had reported the late TTR issue. In other words, the Bank had been working cooperatively with AUSTRAC on that issue for an extended period of time, without any enforcement action being taken by the Bank. What is more, AUSTRAC had not made clear its intentions on whether it would take enforcement action in respect of that particular episode of non-compliance. Throughout that time, AUSTRAC maintained the consistent position that: (a) it had not decided what, if any, action it would take; (b) if it were to take action, a range of options were available to it; and (c) once it had reached a decision in that regard, it would provide notice of that fact to the Bank to allow the Bank to consider its position in light of AUSTRAC's decision. 965 These facts also put the Late TTR Information into perspective, particularly when materiality is assessed as at 24 April 2017. It means that, although the Bank had failed to lodge a large number of TTRs on time in respect of transactions through its IDMs, it was far from clear that this failing would be likely to have had any operational or reputational consequences for the Bank that would or might affect the value of, or return on, CBA shares. The real potential for those consequences only became clear following the 3 August 2017 announcement that AUSTRAC had, in fact, commenced proceedings against the Bank seeking pecuniary penalties for alleged contraventions based on the range of conduct referred to in AUSTRAC's Concise Statement. 966 Fourthly, Mr Ali's beta analysis casts significant doubt on the application of Professor da Silva Rosa's analytical framework to the facts of the present case insofar as it concerns investor perceptions of the significance of operational risk. As I have noted, Mr Ali's beta analysis shows, persuasively, that, even when informed of all the matters in the 3 August 2017 announcement, investors did not upwardly revise their estimates of the Bank's operational risk with economically significant adverse consequences. Once again, Mr Ali's beta analysis is relevant, in this regard, to each of the other pleaded forms of the Information. 967 Taking all these considerations into account, as they should be taken into account, I am not satisfied that any heightened perception of investors with respect to the Bank's operational risk or reputational risk arising from the disclosure of the Late TTR Information, at any of the pleaded times, would be such as to influence, or be likely to influence, persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares. 968 It is convenient at this juncture for me to record that I do not accept the applicants' submission that the Late TTR Information is "intuitively" information that would, or would be likely, to influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares. 969 First, while I accept that, from a regulatory perspective, the Late TTR Information is serious in nature, I do not accept, as I have already said, that that fact alone means that the Late TTR Information was material in the sense that it would, or would be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares. 970 Secondly, I do not accept that the Late TTR Information would have led investors to consider that the Bank's reputation was going to be damaged irretrievably, as the applicants' submissions suggest. While I accept the likelihood that investors would not approve of the Bank's failing, and be critical of the fact that the Bank had failed in that regard, those consequences must be considered in the context of all the circumstances I have described. When that is done, I am not persuaded that any damage to the Bank's reputation would be of such significance to investors who commonly invest in securities that it would influence, or be likely to influence, their decision to acquire or dispose of CBA shares. 971 Thirdly, even if the Late TTR Information would have suggested to investors that the Bank was at risk of regulatory action, including the risk of substantial pecuniary penalties being imposed, I am satisfied that, in the absence of more concrete information being provided as to AUSTRAC's intentions, the Late TTR Information would not influence, or be likely to influence, them in deciding to acquire or dispose of CBA shares. Concrete information of AUSTRAC's intentions was only revealed by the 3 August 2017 announcement. 972 Fourthly, I do not accept the applicants' submission that the Late TTR Information would have suggested to persons who commonly invest in securities that the Bank's AML/CTF systems might require remediation at a "higher than anticipated expenditure". There is no reason to think that investors would have any rationally held views on that matter. What is more, on the evidence before me, the late TTR issue was readily and promptly rectified once the problem was known. There is nothing to suggest that the cost of rectification involved "higher than anticipated expenditure". These facts form part of the context in which the materiality of the Late TTR Information must be assessed. The context does not suggest that rectification of the late TTR issue had any value-related implications for the Bank and I am not satisfied that investors who commonly invest in securities would have thought otherwise.

The Account Monitoring Failure Information 973 A similar analysis applies to the Account Monitoring Failure Information. When considered in the abstract, the number of affected accounts disclosed in the Account Monitoring Failure Information, in all its pleaded forms, is large. However, when that information is considered in its proper context, I am not persuaded that persons who commonly invest in securities would infer that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act in the sense that the Bank had engaged in widespread non-compliance by reason of various deficiencies throughout its ML/TF monitoring processes. 974 This is because the proper context for considering the Account Monitoring Failure Information includes the important facts that: (a) the failure to monitor resulted from an error in updating account profiles in the Bank's FCP as part of a project directed to enhancing the Bank's ability to monitor and detect potential instances of internal fraud; (b) the error was the population of a particular data field with a null value; (c) the error affected only a subset of particular accounts (employee-related accounts); (d) the error did not mean that there was a complete absence of monitoring in respect of these accounts; (e) a large percentage of these accounts (25%) were inactive; (f) the monitoring of the accounts was affected for varying periods of time (which included relatively short periods of time); and (g) the error had been rectified. 975 Like the Late TTR Information, the Account Monitoring Failure Information, in a sense, concerned a single failure. This failure resulted from a single data entry step that affected the monitoring, but not the complete monitoring, of a particular group of accounts for (as I have said) varying periods of time. Although the number of affected accounts was numerically large, the failing, in this regard, was but an aspect of the Bank's significantly larger overall monitoring of accounts. 976 Further, as with the Late TTR Information, such investors would understand that financial institutions are not free of risk in respect of regulatory compliance and factor that into their decision-making. I refer, once again, to the implications of Mr Ali's beta analysis. I am not persuaded that the fact of non-compliance alone would be a sufficient reason to influence such investors in deciding to acquire or dispose of CBA shares. 977 In relation to the September 2015 Account Monitoring Failure Information (as it applies to the Bank's "awareness" pleaded as at 24 April 2017), a further matter militating against the materiality of that information (in the sense of whether the information would, or would be likely to, influence investors in deciding whether to acquire or dispose of CBA shares) is the fact that, by that time, the account monitoring failure issue was truly historical. It had been identified, and steps put in place to rectify it, some years beforehand in the period June to September 2014. There was no ongoing problem. I am not satisfied that, considered as at 24 April 2017, investors would regard such historical and rectified non-compliance as, itself, having any significant operational or reputational consequences for the Bank that would or might affect the value of, or return on, CBA shares. 978 Taking all these considerations into account, I am not satisfied that any heightened perception of investors with respect to the Bank's operational risk or reputational risk arising from the disclosure of the Account Monitoring Failure Information would be of such significance as to influence, or be likely to influence, persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares.

The Potential Penalty Information 979 I have previously remarked on the fact that the Potential Penalty Information is vague and imprecise. I have also observed that the high level, contingent, and inconclusive language used to express the Potential Penalty Information would more likely confuse, rather than inform, investors. 980 Whilst the definition of the Potential Penalty Information includes reference to "allegations of serious and systemic non-compliance with the AML/CTF Act", those allegations must be seen in context. The context, here, is the Late TTR Information, the Account Monitoring Failure Information and the IDM ML/TF Risk Assessment Non-Compliance Information. 981 As I have previously noted, not even the applicants plead that the IDM ML/TF Risk Assessment Non-Compliance Information is an example of "systemic" non-compliance and, for the reasons expressed above, I do not accept that to be an appropriate characterisation in any event. 982 Further, for the reasons expressed above, I am not persuaded that when each of the Late TTR Information and the Account Monitoring Failure Information is considered in its proper context, persons who commonly invest in securities would infer that the Bank had been substantially and systematically deficient in its compliance with the requirements of the AML/CTF Act in the sense that the Bank had engaged in widespread non-compliance by reason of various deficiencies throughout its ML/TF monitoring processes. 983 Therefore, to say that, by reason of either of these failings, the Bank was potentially exposed to enforcement action that might result in it being ordered to pay a pecuniary penalty adds little meaningful information for investors, particularly when the context for assessing the materiality of the Potential Penalty Information also requires account to be taken of the fact that, even if AUSTRAC did decide to take enforcement action against the Bank, it had a number of other options available to it, not just the commencement of proceedings for civil penalties. 984 Thus, I am not satisfied that any heightened perception of investors with respect to the Bank's operational risk or reputational risk arising from the disclosure of the Potential Penalty Information would be of such significance as to influence, or be likely to influence, persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares.

Consideration of Mr Johnston's evidence 985 So far my consideration of the materiality of the pleaded forms of the Information has focused on the framework provided by Professor da Silva Rosa. However, the findings I have reached and my reasons for those findings apply equally to the question of materiality when considered with reference to Mr Johnston's evidence. There are, however, two particular aspects of Mr Johnston's evidence to which I should refer. 986 The first aspect concerns Mr Johnston's oral evidence about the "health checks" or "sanity checks" he would have made if advising on whether information should be disclosed to the market. 987 As I have remarked, this approach in Mr Johnston's oral evidence is different to the way in which he based his opinions in his reports. I cannot help but think that, when giving this evidence with reference to the present case, Mr Johnston's views were affected by his knowledge of the 3 August 2017 announcement and the fall in the CBA share price following that announcement, particularly when, in his reports, Mr Johnston advanced the proposition that the market's reaction to the disclosure of the pleaded forms of the Information would not have been materially different to the market's reaction to the 3 August 2017 announcement. In short, this aspect of Mr Johnston's evidence is informed by hindsight, and is therefore affected by the rationalisation that inevitably follows such knowledge. 988 The second aspect is Mr Johnston's disclosure in the course of oral evidence that, in preparing his reports, he assumed for the purpose of assessing materiality that all the information identified in the question he was asked to answer (Question 1 quoted at [743] above) was disclosed. As I have remarked, although there are aspects of Mr Johnston's reports that indicate that he was aggregating information when considering the question of materiality, the fact that he took that approach certainly became much clearer in his oral evidence. What is more, Mr Johnston said (as I have recorded) that he was "hesitant to try and break out one of the five components in my head and give the court a considered opinion". 989 This concession is significant in two ways. First, even though there are parts of Mr Johnston's reports that can be read as expressing an opinion on the materiality of the Late TTR Information alone, or the Account Monitoring Failure Information alone, or the IDM ML/TF Risk Assessment Non-Compliance Information alone, it is doubtful that, in expressing those opinions, Mr Johnston was considering the materiality of that information alone, divorced from the other information referred to in the question he was answering. 990 Secondly, the information that Mr Johnston addressed in his reports included information that is no longer part of the applicants' continuous disclosure case - namely, the "Pre-16 June 2014 System Deficiencies" and the "Ongoing Systems Deficiencies". It would seem, therefore, that this (now) irrelevant information formed part of Mr Johnston's assessment of materiality. 991 These matters affect the weight that I give to Mr Johnston's opinions on the question of the materiality of each pleaded form of the Information.

Consideration of the other evidence 992 The other evidence on this question does not persuade me that the Late TTR Information, or the Account Monitoring Failure Information, or the IDM ML/TF Risk Assessment Non-Compliance Information, would, or would be likely to, influence persons who commonly invest in securities in deciding to acquire or dispose of CBA shares, had the Bank disclosed the information when the applicants say it should have been disclosed. 993 First, the evidence given by Mr Ali, Mr Singer, and Dr Unni is to the effect that the Late TTR Information, the Account Monitoring Failure Information, and the IDM ML/TF Risk Assessment Non-Compliance Information would not, or would not be likely to, have that influence in the absence of AUSTRAC commencing proceedings against the Bank for pecuniary penalties because of its non-compliance. 994 I do not think that investor knowledge that proceedings had been commenced is necessarily critical. I am satisfied, however, that, as a minimum, an expression of AUSTRAC's resolve to take enforcement action against the Bank in the form of proceedings for a pecuniary penalty would be indispensable to a finding of materiality in the relevant sense. 995 I say this having regard to the fact that, notwithstanding the Tabcorp proceeding, AUSTRAC's usual and preferred approach during the relevant period was to seek cooperative engagement with reporting entities, and only to consider enforcement action where that engagement did not result in improved compliance. As I have observed, even referral of a matter to its Enforcement Team did not mean that AUSTRAC would take enforcement action. And even if enforcement action were taken, this did not necessarily mean that proceedings would be commenced for a civil penalty. Other forms of action were available. 996 The market circumstances before 3 August 2017 were that AUSTRAC had taken only 33 enforcement actions, and even then only one of those actions (the Tabcorp proceeding) was for a civil penalty. The rest of the enforcement actions involved remedial directions, the acceptance of enforceable undertakings, the issuance of infringement notices, or the appointment of an external auditor. 997 These are important market circumstances affecting the question of the materiality of the pleaded forms of the Information. The fact that the Bank had not complied with its obligations under the AML/CTF Act did not, in and of itself, entail adverse financial consequences, or likely adverse financial consequences, for the holders of CBA shares in the form of a loss of share value or a loss of dividend income, even though non-compliance is a serious matter from a regulatory perspective. However, the commencement of proceedings for a civil penalty, or AUSTRAC's announced resolve to do so, would raise that prospect. Whether that prospect would, in turn, lead to adverse financial consequences, or likely adverse financial consequences, for shareholders would depend on, amongst other things, the extent and seriousness of the non-compliance involved. 998 Secondly, I am not persuaded that persons who commonly invest in securities would readily be influenced in their decision-making regarding the acquisition or disposal of CBA shares. I am satisfied that such persons would only be influenced, or be likely to be influenced, by information that conveys, expressly or implicitly, some real likelihood, as opposed to the mere possibility, that the information has financial consequences for them. I am not persuaded that any of the pleaded forms of the Information provide sufficient certainty as to the likely financial consequences of that information for the holding of CBA shares, as to have the required influence or likely influence on investor decision-making. 999 I say this bearing in mind Mr Singer's evidence about the significance of CBA shares (and the shares of the other four major Australian banks) to portfolio construction, and the role of such shares in wealth creation and management. Mr Singer also said that a large portion of investors will be "less influenced by micro announcements than by ensuring that their overall portfolio is constructed so as to provide them with the appropriate diversification and income growth". He referred, in particular, to the Bank's large base of retail shareholders who are "stickier" in their decision-making in relation to the holding of CBA shares. 1000 I do not accept, therefore, the applicants' submission that much of the decision-making involved in buying and selling shares is heuristic in nature, insofar as that submission is directed to the holding of CBA shares. Certainly, this does not appear to have been the applicants' experience based on their own decision-making with respect to investing in CBA shares. 1001 In this connection, the documentary evidence shows that Mr and Mrs Baron received financial advice from JBWere in December 2009 to the effect that, bearing in mind their overall investment objectives and tolerance for risk, and given the long-term nature of their investment portfolio, their investment in a higher, rather than lower, allocation of Australian equities was warranted in order to generate acceptable long-term returns and growth to their income stream. The recorded advice noted the benefit of franking credits to Mr and Mrs Baron which, JBWere said, had been taken into consideration in making their recommendations. 1002 This advice appears to have been fully embraced by Mr and Mrs Baron over the ensuing years - so much so that in May 2018 JBWere advised them to diversify their portfolio to reduce risk. An internal JBWere email dated 29 May 2018 records: I continued to remind [Mr Baron] that his portfolio was too heavily skewed to Australian equities and in particular banks and financials. He noted this and agreed we should slowly diversify, but he remains very focussed on fully franked dividends, which I pointed out needs to be considered in light of dividend sustainability and not just 'headline yield'. 1003 A further internal JBWere email dated 30 August 2018 records that JBWere continued to advise Mr and Mrs Baron to diversify their portfolio. Mr Baron: … noted this and said he would consider the advice, but that he remained very focussed on generating a strong flow of fully franked dividends, acknowledging that this skewed the asset allocation and increased the risk of the portfolio. 1004 This focus is certainly evident with respect to Mr and Mrs Baron's holding of CBA shares. On 21 August 2014, 19 February 2015, and 20 August 2015 they acquired shares under the Bank's dividend reinvestment plan (DRP). On 18 September 2015, they acquired shares under the 2015 Entitlement Offer and, on 29 May 2017, they made an on-market acquisition of shares. As at 3 August 2017, their portfolio included 3,757 CBA shares. Notwithstanding the 3 August 2017 announcement, Mr and Mrs Baron continued to hold those shares. It was not until 14 May 2019 that they made a relatively small divestment. 1005 As at 3 August 2017, Zonia Pty Limited (Zonia) held 17,213 CBA shares. It had acquired 718 of those shares on 18 September 2015 under the Bank's DRP. Notwithstanding the 3 August 2017 announcement, Zonia continued to hold its shares. On 16 August 2017, within two weeks of the announcement, it purchased 593 PERLS IX hybrid securities (subject to a mandatory exchange for CBA shares in 2024) for $60,248.80. Further, on 17 August 2017, Zonia elected to participate in the Bank's DRP under which it was allotted 522 CBA shares for a payment of $39,531.06. Zonia did sell some of its CBA shares on 29 September 2017, along with some of its PERLS IX hybrid securities on 11 October 2017. The reason for these disposals is not explained in the evidence. Zonia elected not to call evidence in relation to its acquisition and disposal of CBA shares and PERLS IX hybrid securities. I infer that there is nothing it could say on that score that would assist its case on materiality. 1006 These facts reflect the investing behaviour to which Mr Singer referred. Certainly, Mr and Mrs Baron's and Zonia's dealings in CBA shares following the 3 August 2017 announcement do not support a finding that, as a result of the disclosures in the announcement, they upwardly revised their estimates of the Bank's operational risk or increased their estimates of the Bank's reputational risk, or that they regarded those disclosures as having any adverse financial consequences for them in holding CBA shares. 1007 My non-acceptance of the applicants' submissions about the heuristic nature of buying and selling shares (as that submission is directed to the buying and selling of CBA shares) is also supported by Mr Ali's beta analysis to which I have already referred. As I have noted, this analysis shows that, even when informed of the matters in the 3 August 2017 announcement, investors did not upwardly revise their estimates of the Bank's operational risk with economically significant adverse consequences. In other words, they did not consider that holding CBA shares was financially "riskier" as a result of that information. 1008 This conclusion is also supported by the Westpac case study. Dr Unni's event studies provide persuasive evidence that Westpac's voluntary disclosures of non-compliance with the AML/CTF Act were not material information for market participants. It was only the information that AUSTRAC had commenced proceedings against Westpac that resulted in a significant market reaction. 1009 I am not persuaded by the applicants' submission that I should infer that the decline in the Westpac share price that was observed on 6 May 2019 and 4 November 2019 was based on partial information about the potential enforcement action and penalties to which Westpac was exposed. I think the more likely reason for those declines was the somewhat more brutal information about Westpac's weak performance, and poor results and outlook, to which Dr Unni referred. It is possible that the market's reaction on 20 November 2019, when AUSTRAC announced its commencement of proceedings, was due, in part, to more concrete information about the extent of Westpac's non-compliance. But this does not gainsay the fact that Westpac's own earlier announcements of actual non-compliance were not, in and of themselves, seemingly material to investors. 1010 The NAB case study is not as clear in its support. Dr Unni's opinion was that, despite the negative price movements on five of the days on which NAB made announcements about its non-compliance, the likely cause of the movements was the higher cost guidance provided by NAB, and its announced earnings results. I accept that evidence. As I have noted, on the other days when NAB made announcements about its non-compliance (other than 7 June 2021, when it announced AUSTRAC's investigation), its share price actually increased. 1011 I am also persuaded that the decline in the NAB share price on 7 June 2021 is unlikely to have been due to the mere fact that it had failed to comply with its obligations under the AML/CTF Act. That fact - that is, the simple fact of non-compliance - had been disclosed on numerous occasions in the past. I am persuaded that the likely explanation for the market reaction on 7 June 2021 was because that announcement was of a different character. It included the information that AUSTRAC had referred NAB's non-compliance to its Enforcement Team. 1012 As I have discussed, this did not necessarily mean that enforcement action would be taken or that, if such action were to be taken, enforcement would be by way of proceedings for a civil penalty. But, the announcement made clear that, unlike the earlier announcements of non-compliance, the position had been reached where NAB's relationship with AUSTRAC had gone beyond cooperative dialogue and had escalated into a formal enforcement investigation which could result in any of the available enforcement options being taken, including proceedings for civil penalties. 1013 Importantly, when NAB made its announcement on 7 June 2021, market circumstances had changed significantly from those obtaining on 3 August 2017. By 7 June 2021, the regulator had demonstrated a willingness to aggressively pursue legal proceedings to obtain substantial civil penalties. In this regard, it had achieved notable success. By 7 June 2021, AUSTRAC had not only obtained a civil penalty order against Tabcorp, it had been successful in obtaining civil penalty orders for very large amounts against the Bank ($700 million) and Westpac ($1.2 billion). The announcement on 7 June 2021was likely further impacted by the emergence of information that former NAB employees had come forward to speak about significant underlying problems within NAB's AML compliance department. 1014 It is certainly possible that considerations such as these would lead investors to view with some caution, if not scepticism, the statement that AUSTRAC was not, at that stage, considering civil penalty proceedings against NAB, as is made clear at least in the assessment of Credit Suisse's analysts to which I have referred. 1015 In any event, I am not persuaded by the applicants' submission that the disclosures made by NAB's announcement on 7 June 2021 was "arguably analogous to the nature of the information the subject of this proceeding". In my view, the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information, when considered in their proper context, are markedly different to the information given by NAB in its 7 June 2021 announcement having regard, also, to the markedly different market circumstances pertaining at the time of NAB's announcement compared to the times at which the applicants say the Bank should have disclosed the various pleaded forms of the Information. 1016 I also observe that, when NAB first announced its non-compliance on 2 November 2017, not one analyst commented on that fact. This was so even though, by that time, the 3 August 2017 announcement had been made. This tends to underscore the fact that the mere disclosure of non-compliance with the AML/CTF Act, without more, is not material to investor decision-making in relation to shares in the major four banks. 1017 Thirdly, I am not persuaded that the media and analysts' reports provide any real support for the applicants' case on materiality. As I have already noted, these reports were prompted by the 3 August 2017 announcement which, as I have said, was materially, and significantly, different to the information conveyed by each of the pleaded forms of the Information, and included AUSTRAC's significant public censure of the Bank's failings. 1018 Moreover, as I have also noted, of the 11 analysts' reports published in the period immediately after the 3 August 2017 announcement, only one analyst decreased its share price target for CBA shares. Even then, the decrease was for a relatively modest amount. Other analysts either increased or maintained their price targets for CBA shares. This shows that, even though the analysts commented on the 3 August 2017 announcement and aspects of the Bank's publicised non-compliance with the AML/CTF Act, including in relation to potential penalties, overall they were unmoved by that information, or at least decided to act cautiously before attributing significance to it in terms of its actual financial consequences for holders of CBA shares. I accept the effect of Mr Singer's evidence that, had the pleaded forms of the Information been disclosed earlier by the Bank, it is unlikely that that information would have a "material valuation effect" from the point of view of brokers. 1019 Fourthly, I am not persuaded that the Lieser paper provides any real support for the applicants' case on materiality. I do not accept that the results reported in the paper are "compelling" in relation to the determination of the question of materiality in the present case. 1020 The Lieser paper's concern is with the shareholder wealth effect of the revelation of alleged wrongdoing, the commencement of class action proceedings in relation to the alleged wrongdoing, and the resolution of such proceedings. I am not persuaded that the broad analogy that the applicants seek to draw between the class of cases discussed in the paper, and the present case, is of any real assistance. The applicants assert that there is "no material difference between the circumstances of the cases analysed in the Lieser Paper and the circumstance that the applicants allege ought to have prevailed here". However, no attempt has been made to analyse the specific facts and circumstances of any of the cases analysed in the Lieser paper to see whether they bear any meaningful relationship with the specific facts and circumstances of the present case. I am not prepared to accept that the cases analysed in the Lieser paper can be used as a proxy for the present case.

The materiality of the information of which the Bank was "aware" 1021 So far I have discussed the reasons why, in my estimation, each category of the pleaded Information was not material in the relevant sense. There are further remarks I should make in respect of the materiality of the specific information of which the Bank was "aware". 1022 I have found that the Bank was constructively aware of the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information as at 26 October 2015. Apart from the matters I have discussed at [953] - [955] above, I am satisfied that, had this information been disclosed by the Bank at that date, persons who commonly invest in securities would more likely than not regard that information as purely historical information having no significant bearing on the Banks' operational or reputational risk. Although the Bank had not carried out a formal and separate assessment of ML/TF risk in respect of IDMs before they were rolled out in May 2012, such an assessment had been carried out in July 2015. There were no known consequences of the Bank not having carried out such an assessment earlier. 1023 Finally, I turn to consider whether, as at 24 April 2017, the September 2015 Late TTR Information and the September 2015 Account Monitoring Failure Information, together with the Potential Penalty Information (to the extent that it is dependent on the Bank's awareness of the September 2015 Late TTR Information and the September 2015 Account Monitoring Failure Information), was material in the requisite sense. In other words, even though I am not satisfied that the September 2015 Late TTR Information, or the September 2015 Account Monitoring Failure, or the Potential Penalty Information (to the extent that it is dependent on either of the other two forms of information), would influence or be likely to influence investors who commonly invest in securities in deciding whether to acquire or dispose of CBA shares, would the combination of that information, if disclosed at 24 April 2017, lead to the contrary conclusion? 1024 I am not persuaded that the combination of this information, if disclosed at 24 April 2017, does lead to the contrary conclusion. The September 2015 Late TTR Information and the September 2015 Account Monitoring Failure Information stand as two discrete instances of non-compliance. While, as a general proposition, I accept the likelihood that investors would view the disclosure of two instances of non-compliance with the AML/CTF Act to be more serious than the disclosure of one instance of non-compliance, it does not follow that this combination of information was, at 24 April 2017, materially more influential on investor decision-making than each form of information considered alone. 1025 This is because, at 24 April 2017, both forms of information concerned truly historical instances of non-compliance that had been rectified some time ago. There was no continuing operational problem in relation to them, and there was nothing further the Bank was required to do, or could do. AUSTRAC had made no decision as to what regulatory action, if any, it might take because of the Bank's known non-compliance with the AML/CTF Act, and no-one was closer to knowing what its intentions were. AUSTRAC's declared position was that, if it did take enforcement action, it had a range of options open to it. Absent the benefit of hindsight (and remembering that the assessment of materiality is an ex ante assessment), there is no reason to think that, at 24 April 2017, the commencement of proceedings for civil penalties was AUSTRAC's preferred position if it were to take enforcement action against the Bank. Certainly no sound prediction to that effect could have been made. 1026 It is, of course, to be recalled that, on 7 March 2017, AUSTRAC had informed Ms Watson and Mr Keaney that it viewed "the TTR and associated matters" as "serious, significant and systemic". However, that statement immediately led to the Bank taking the initiative to engage in high level discussions between Ms Livingston and Mr Narev (on behalf of the Bank) and Mr Jevtovic and Mr Clark (on behalf of AUSTRAC) on 21 March 2017. Although Mr Narev's initial strategy was to seek to negotiate a relatively swift outcome with AUSTRAC that would involve, amongst other things, the payment of a negotiated "fine", this was not the strategy he deployed at this meeting and, as I have noted, the Bank had in mind the prospect of persuading AUSTRAC to the position of pursuing other forms of enforcement, if AUSTRAC's then undisclosed intention was, or was moving towards, enforcement through proceedings for pecuniary penalties. 1027 At the meeting on 21 March 2017, Mr Jevtovic said that, in terms of next steps, AUSTRAC was going to take an "evidence-based approach". He made clear that a decision had not been made as to the "path" that AUSTRAC would follow. He reiterated that there were a number of options open to AUSTRAC. Plainly, at that time, and armed with that information, no-one could arrive at a mature view as to what AUSTRAC would do. One could speculate what AUSTRAC could do, but such speculation was not appropriate information to put before the market. 1028 I do not think that, as at 24 April 2017, the stage to which Project Concord had developed betrays some more informed view by the Bank, or any prescience, about the path that AUSTRAC did in fact take on 3 August 2017. I regard the Bank's development of Project Concord as no more than proactive planning, in uncertain times, as to what the Bank's strategy should be, or could be, in the event that the "worst case scenario" (the commencement of proceedings against the Bank for civil penalties) eventuated. 1029 Nor do I think that Mr Narev's acceptance in evidence that, from October/November 2016, there was a serious risk that AUSTRAC would take regulatory action against the Bank which could involve the imposition of a significant "fine", advances matters. Mr Narev's acceptance was really no more than the acknowledgement of a possibility. And, as I have previously remarked, Mr Narev's assessment of risk also included the risk of AUSTRAC taking other forms of regulatory action.

Conclusion 1030 For these reasons, I am not satisfied that the Information, in any of its pleaded forms, was information that, if disclosed at the relevantly pleaded times, would, or would be likely to, influence persons who commonly invest in securities in deciding whether to acquire or dispose of CBA shares. More generally, I am not satisfied that the Information, in any of its pleaded forms, was information that a reasonable person would expect, if the information were generally available at the relevantly pleaded times, to have a material effect on the price or value of CBA shares. 1031 These conclusions, and the other conclusions I have reached at [566] - [567] and [631] above, mean that the applicants have not established that the Bank contravened s 674(2) of the Corporations Act.

Introduction 1032 The applicants bring a case against the Bank for misleading or deceptive conduct in contravention of s 1041H(1) of the Corporations Act, s 12DA(1) of the ASIC Act, or s 18(1) of the Australian Consumer Law (Sch 2 to the Competition and Consumer Act 2010 (Cth)) (the Competition and Consumer Act). The applicants contend that, in the circumstances of the present case, "the different statutory regimes will yield the same result". 1033 Section 1041H of the Corporations Act provides: 1041H Misleading or deceptive conduct (civil liability only) (1) A person must not, in this jurisdiction, engage in conduct, in relation to a financial product or a financial service, that is misleading or deceptive or is likely to mislead or deceive. Note 1: Failure to comply with this subsection is not an offence. Note 2: Failure to comply with this subsection may lead to civil liability under section 1041I. For limits on, and relief from, liability under that section, see Division 4. (2) The reference in subsection (1) to engaging in conduct in relation to a financial product includes (but is not limited to) any of the following: (a) dealing in a financial product; (b) without limiting paragraph (a): (i) issuing a financial product; (ii) publishing a notice in relation to a financial product; (iii) making, or making an evaluation of, an offer under a takeover bid or a recommendation relating to such an offer; (iv) applying to become a standard employer-sponsor (within the meaning of the Superannuation Industry (Supervision) Act 1993) of a superannuation entity (within the meaning of that Act); (v) permitting a person to become a standard employer-sponsor (within the meaning of the Superannuation Industry (Supervision) Act 1993) of a superannuation entity (within the meaning of that Act); (vi) a trustee of a superannuation entity (within the meaning of the Superannuation Industry (Supervision) Act 1993) dealing with a beneficiary of that entity as such a beneficiary; (vii) a trustee of a superannuation entity (within the meaning of the Superannuation Industry (Supervision) Act 1993) dealing with an employer-sponsor (within the meaning of that Act), or an associate (within the meaning of that Act) of an employer-sponsor, of that entity as such an employer-sponsor or associate; (viii) applying, on behalf of an employee (within the meaning of the Retirement Savings Accounts Act 1997), for the employee to become the holder of an RSA product; (ix) an RSA provider (within the meaning of the Retirement Savings Accounts Act 1997) dealing with an employer (within the meaning of that Act), or an associate (within the meaning of that Act) of an employer, who makes an application, on behalf of an employee (within the meaning of that Act) of the employer, for the employee to become the holder of an RSA product, as such an employer; (x) carrying on negotiations, or making arrangements, or doing any other act, preparatory to, or in any way related to, an activity covered by any of subparagraphs (i) to (ix). (3) Conduct: (a) that contravenes: (i) section 670A (misleading or deceptive takeover document); or (ii) section 728 (misleading or deceptive fundraising document); or (iii) section 1021NA, 1021NB or 1021NC; or (b) in relation to a disclosure document or statement within the meaning of section 953A; or (c) in relation to a disclosure document or statement within the meaning of section 1022A; does not contravene subsection (1). For this purpose, conduct contravenes the provision even if the conduct does not constitute an offence, or does not lead to any liability, because of the availability of a defence. 1034 A "financial product" includes a security (which, in turn, includes a share): ss 9 and 764A(1)(a) of the Corporations Act. 1035 Section 12DA of the ASIC Act provides: 12DA Misleading or deceptive conduct (1) A person must not, in trade or commerce, engage in conduct in relation to financial services that is misleading or deceptive or is likely to mislead or deceive. (1A) Conduct: (a) that contravenes: (i) section 670A of the Corporations Act (misleading or deceptive takeover document); or (ii) section 728 of the Corporations Act (misleading or deceptive fundraising document); or (b) in relation to a disclosure document or statement within the meaning of section 953A of the Corporations Act; or (c) in relation to a disclosure document or statement within the meaning of section 1022A of the Corporations Act; does not contravene subsection (1). For this purpose, conduct contravenes the provision even if the conduct does not constitute an offence, or does not lead to any liability, because of the availability of a defence. (2) Nothing in sections 12DB to 12DN limits by implication the generality of subsection (1). 1036 As defined, "financial service" includes "financial product advice": s 12BAB(1)(a) of the ASIC Act. 1037 Section 12BAB(5) provides: 12BAB Meaning of financial service … Meaning of financial product advice (5) For the purposes of this section, financial product advice means a recommendation or a statement of opinion, or a report of either of those things, that: (a) is intended to influence a person or persons in making a decision in relation to a particular financial product or class of financial products, or an interest in a particular financial product or class of financial products; or (b) could reasonably be regarded as being intended to have such an influence; but does not include anything in: (c) a document prepared in accordance with requirements of Chapter 7 of the Corporations Act, other than a document of a kind prescribed by regulations made for the purposes of this paragraph; or (d) any other document of a kind prescribed by regulations made for the purposes of this paragraph. 1038 Section 12BAA(7)(a) defines a "financial product" to include securities. 1039 Section 18(1) of the Australian Consumer Law provides: 18 Misleading or deceptive conduct (1) A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive. 1040 Section 131A of the Competition and Consumer Act provides: 131A Division does not apply to financial services (1) Despite section 131, this Division does not apply (other than in relation to the application of Part 5-5 of Schedule 2 as a law of the Commonwealth) to the supply, or possible supply, of services that are financial services, or of financial products. (2) Without limiting subsection (1): (a) Part 2-1 of Schedule 2 and sections 34 and 156 of Schedule 2 do not apply to conduct engaged in in relation to financial services; and (b) Part 2-3 of Schedule 2 does not apply to, or in relation to: (i) contracts that are financial products; or (ii) contracts for the supply, or possible supply, of services that are financial services; and (c) if a financial product consists of or includes an interest in land - the following provisions of Schedule 2 do not apply to that interest: (i) section 30; (ii) paragraphs 32(1)(c) and (d) and (2)(c) and (d); (iii) paragraphs 50(1)(c) and (d); (iv) section 152; (v) subparagraphs 154(1)(b)(iii) and (iv) and (2)(b)(iii) and (iv); (vi) subparagraphs 168(1)(b)(iii) and (iv); and (d) sections 39 and 161 of Schedule 2 do not apply to: (i) a credit card that is part of, or that provides access to, a credit facility that is a financial product; or (ii) a debit card that allows access to an account that is a financial product. 1041 In the present case, the applicants rely on the Australian Consumer Law as applicable in each of the States and Territories of Australia, rather than as a law of the Commonwealth, with the intent that the exclusion under s 131A does not apply.

The alleged representations 1042 The misleading or deceptive conduct case rests on two alleged groups of representations - the Compliance Representations and the Continuous Disclosure Representation. 1043 As pleaded, the Compliance Representations are: 66. By the matters pleaded in paragraphs 51 to 65, CBA represented to the Affected Market throughout the Relevant Period that: (a) CBA had in place effective policies, procedures and systems for ensuring compliance by CBA with relevant regulatory requirements (including the AML/CTF Act); and/or (b) CBA's risk management systems had ensured, and would continue to ensure appropriate monitoring and reporting of compliance activities (including compliance with the AML/CTF Act), (Compliance Representations). Particulars i) The Compliance Representations are to be implied from: A) the AML/CTF Compliance Statements; AB) the 2014 Compliance Statements, from the dates they were made; and B) the 2015 Compliance Statements, from the dates they were made; and C) the 2016 Compliance Statements, from the dates they were made; and D) the absence of any correction or qualification to the statements referred to in (A) to (C). 1044 By way of explanation, the AML/CTF Compliance Statements referred to in para (A) of the particulars were statements published on the Bank's website during the relevant period: paras 51 to 53 of the statement of claim. In closing submissions, the applicants referred to four such statements, headed "Anti-Money Laundering and Counter-Terrorism Financing Disclosure Statement". So far as I can see, they are in substantially the same, if not the same, terms. 1045 In closing submissions, the applicants drew particular attention to the following passages from the AML/CTF Compliance Statements: (a) "CBA is subject to, and complies with, Australian law". This statement was accompanied by a reference to the AML/CTF Act, and a number of other listed Acts; (b) "CBA has adopted internal policies, procedures and controls to ensure that it complies with existing legislation. CBA has adopted an AML/CTF Program that reasonably identifies, mitigates and manages the risk of Money Laundering or Terrorism Financing in the provision of services designated by legislation"; (c) "CommBank is required to report significant account and non-account based cash transactions of AUD 10,000 or more to the regulatory authority AUSTRAC. Details of all IMTs (wire transfers) eg. sender and beneficiary names, address and account number are retained and reported to AUSTRAC. Internal policies and procedures are in place to ensure compliance with the applicable legislation and regulatory requirements"; (d) "Commbank has not been the subject of any money laundering or terrorist financing-related proceedings, investigations, sanctions or punitive actions". 1046 As pleaded, the 2014 Compliance Statements referred to in para (AB) of the particulars, are various statements selected from the Bank's 2014 Annual Report and the Bank's 2014 US Disclosure document: paras 53A to 53D of the statement of claim. 1047 As pleaded, the 2015 Compliance Statements referred to in para (B) of the particulars are various statements selected from: (a) various announcements published and lodged with the ASX, including the 2015 Cleansing Notice (referred to collectively in the statement of claim as the "12 August 2015 Announcements"); (b) the "2015 Entitlement Offer Booklet"; (c) the Bank's 2015 Annual Report; and (d) the Bank's 2015 US Disclosure document: paras 54 to 61 of the statement of claim. 1048 As pleaded, the 2016 Compliance Statements referred to in para (C) of the particulars are various statements selected from the Bank's 2016 Annual Report and the Bank's 2016 US Disclosure document: paras 62 to 65 of the statement of claim. 1049 The applicants plead that, prior to 3 August 2017, the Bank did not make any statement that corrected, qualified or contradicted any of these statements. 1050 As pleaded, the Continuous Disclosure Representation is: 67. By the matters pleaded in paragraphs 54 to 65, CBA continuously represented to the Affected Market throughout the Relevant Period that: (a) it had policies, procedures and systems in place to ensure that material matters were reported to its CEO and then notified to the ASX, and (b) it had complied with, and would continue to comply with, its Continuous Disclosure Obligations (Continuous Disclosure Representation). Particulars i) The Continuous Disclosure Representation was partly express and partly implied. ii) To the extent it was express, the Applicants refer to the statements in the 2015 Cleansing Notice pleaded in sub-paragraph 56(b); iii) To the extent it was implied, it is to be implied from: A) at all times, CBA's listing on the ASX which required adherence to ASX Listing Rule 3.1, B) the statements in the 2015 Cleansing Notice pleaded in sub- paragraph 56(b), from the date they were made; BA) the 2014 Compliance Statements pleaded in sub-paragraphs 53B(d)(i) and (ii) from the dates they were made; and C) the 2015 Compliance Statements pleaded in sub-paragraphs 58(c)(i) and (ii), from the dates they were made; and D) the 2016 Compliance Statements (as pleaded in sub-paragraph 63(a)(i) to (ii)), from the dates they were made; and E) the absence of any correction or qualification to the statements referred to in (B) to (D) above, 1051 As will be apparent from the foregoing, paras 54 to 65 of the statement of claim concern the 2015 Compliance Statements and the 2016 Compliance Statements. However, the particulars indicate that the applicants also rely on the 2014 Compliance Statements (i.e., their case in this regard is also based on paras 53A to 53D of the statement of claim). 1052 The 2015 Cleansing Notice referred to in para (ii) of the particulars was in this form: 1053 The applicants allege that the Compliance Representations and the Continuous Disclosure Representation were continuing representations throughout the relevant period. They allege that these representations were made to the "Affected Market" - meaning, investors and potential investors in CBA shares on the financial market operated by the ASX: see para 7(a)(ii) of the statement of claim.

The applicants' submissions 1054 The applicants submit that in making, maintaining, and in failing to correct or qualify, these representations, the Bank engaged in misleading or deceptive conduct, or conduct that was likely to mislead or deceive. 1055 In this connection, the applicants submit in closing submissions that the Compliance Representations were "erroneous" in light of the Bank's compliance failures, including its failure: (a) from November 2012 to 8 September 2015, to report on time the approximately 53,506 threshold cash transactions through its IDMs; (b) to conduct, in accordance with its AML/CTF Program, a ML/TF risk assessment in respect of IDMs prior to the roll out of the IDMs in May 2012 and throughout the period May 2012 to July 2015; and (c) from 20 October 2012 to 14 October 2014, to carry out account level monitoring "with respect to hundreds of thousands of accounts". 1056 In short, the applicants rely on the facts underpinning the Late TTR Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Account Monitoring Failure Information to make good their case that the Compliance Representations were "erroneous" and that the Bank's conduct in making the Compliance Representations was, therefore, misleading or deceptive. 1057 In this connection, the applicants submit that, from the date that these failures occurred until they were resolved, the Bank did not have in place effective policies, procedures, and systems for ensuring compliance with "relevant regulatory requirements", including the AML/CTF Act, or risk management systems that ensured, and would continue to ensure, appropriate monitoring and reporting of compliance activities. 1058 The applicants also submit that the Compliance Representations were "erroneous" in light of the system deficiencies that resulted in each of the failures noted above. In other words, the Bank's systems ought to have: (a) given the late TTRs on time; (b) identified that TTRs were not being given on time "much earlier than some years after the configuration error arose in November 2012"; (c) caused the Bank to undertake an assessment of ML/TF risk for IDMs prior to their roll out in May 2012; and (d) ensured that automated account-level monitoring rules operated as intended. 1059 The applicants also point to the fact that, between approximately 28 August 2012 and the end of the relevant period, the Bank adopted an approach of not providing SMRs in two cases: (a) if the Bank had already submitted an SMR in respect of the relevant customer within the previous three months in respect of a similar pattern of activity on the same account; and (b) where the Bank had received information from a law enforcement body (the Bank misapprehended that this information did not need to be reported to AUSTRAC). 1060 The applicants' submission appears to be that the Bank's systems ought to have prevented these failures and thus, to that extent, the Bank's systems were not effective to ensure its compliance with these obligations under the AML/CTF Act. 1061 The applicants accept that: … a reasonable person may not have construed the Compliance Representations as excluding any breach of the AML/CTF Act, no matter how slight. Most reasonable persons would accept that from time to time in an organisation the size of CBA trivial, limited or one-off breaches of the AML/CTF Act could or might occur, including because of human error. 1062 That said, the applicants submit that the failures referred to above "are quite another" thing. They submit that those failures represented "serious, long term and extensive contravening conduct", and the Bank failed to correct or qualify the Compliance Representations in light of those failures. 1063 As to the Continuous Disclosure Representation, the applicants submit that this representation was "erroneous" in light of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information. The applicants submit: From the date on which each of those pieces of information (as modified in accordance with the pleaded dates) came into existence, they each (or collectively in any combination) rendered the Continuous Disclosure Representations erroneous. … the failure to appropriately escalate that information to the CEO and disclose it to the ASX meant that it was no longer the case that CBA had policies, procedures and systems in place to ensure that material matters were reported to its CEO and then notified to the ASX, and it had complied with, and would continue to comply with, its continuous disclosure obligations.

The Compliance Representations 1064 As pleaded, the Compliance Representations have two components pertaining to the relevant period: (a) the Bank had effective policies, procedures, and systems for ensuring regulatory compliance, and that (b) the Bank's systems had ensured, and would continue to ensure, appropriate monitoring and reporting of compliance activities. 1065 It is apparent that, by use of the word "effective", the applicants allege that the Bank represented that it had policies, procedures, and systems for ensuring regulatory compliance which had been "effective" in the particular sense that, through these policies, procedures, and systems, the Bank had, in fact, complied with all the regulatory requirements imposed on it, without exception. Otherwise, these policies, procedures, and systems could not be "effective". 1066 It is apparent that, by use of the word "ensured", the applicants allege that the Bank represented that its risk management systems had, in fact, secured, and would continue to secure, the monitoring and reporting that the Bank was required to undertake, without exception. 1067 I am not satisfied that the Bank made any representation to the effect of the Compliance Representations. 1068 The 2014 Compliance Representations, the 2015 Compliance Representations, and the 2016 Compliance Representations, as pleaded by the applicants, are far removed from conveying any such representations. As the Bank pointed out in closing submissions, a number of the express statements on which the applicants rely in this regard have no correlation with the implied representations they allege. Indeed, some documents on which the applicants rely emphasise that the Bank is exposed to operational risks including regulatory risks and reputational risks. The following examples will suffice. 1069 In the Bank's 2014 US Disclosure document (forming part of the 2014 Compliance Representations), the following headline statement is made: The Group faces operational risks associated with being a complex financial institution and may incur losses as a result of ineffective risk management processes and strategies. 1070 The following explanation is provided: Operational risk is defined as the risk of economic gain or loss resulting from (i) inadequate or failed internal processes and methodologies, (ii) people, (iii) systems and models used in making business decisions or (iv) external events. The Group is exposed to the risk of loss resulting from human error, the failure of internal or external processes and systems or from external events including the failure of third party suppliers and vendors to provide the contracted services. Such operational risks may include theft and fraud, improper business practices, client suitability and servicing risks, product complexity and pricing risk or improper recording, evaluating or accounting for transactions, breach of security and physical protection systems, or breaches of the Group's internally or externally imposed policies and regulations. As the Group increases its analytical capabilities and the use of models in its decision making, the reliability of the Group's data and models is becoming even more crucial. There is a risk that the Group makes inappropriate decisions due to poor data quality or models that are not fit for purpose, resulting in actual risk exposures being greater than expected by Management, leading to unexpected losses and deletion of capital levels. While the Group employs a range of risk monitoring and risk mitigation techniques as part of the implementation of its Operational Risk Management Framework, there can be no assurance that the risk management processes and strategies that we have developed in response to current market conditions will adequately anticipate additional market stress or unforeseen circumstances. Therefore, the Group may, in the course of the Group's activities, incur losses or reputational harm as a result of operational disruptions. 1071 The 2014 US Disclosure document also contains this headline statement: Reputational damage could harm the Group's business and prospects. 1072 The following explanation is provided: Various issues may give rise to reputational risk and cause harm to the Group's business and prospects. These issues include inappropriately dealing with potential conflicts of interest and legal and regulatory requirements (such as money laundering, trade sanctions and privacy laws), inadequate sales and trading practices, inappropriate management of conflicts of interest and other ethical issues, technology failures, and non-compliance with internal policies and procedures. Failure to address these issues appropriately could also give rise to additional legal risk, subjecting the Group to regulatory enforcement actions, fines and penalties, or harm the Group's reputation and integrity among the Group's customers, investors and other stakeholders. 1073 Similar statements are made in the Bank's 2015 US Disclosure document and 2016 US Disclosure document. 1074 In the 2015 Entitlement Offer Booklet (forming part of the 2015 Compliance Representations), the following headline statement is made: CBA is subject to operational risks and may incur losses 1075 The following explanation is provided: CBA's businesses are highly dependent on their ability to process and monitor a very large number of transactions, many of which are complex, across numerous and diverse markets and in many currencies, on a daily basis. CBA's financial, accounting, data processing or other operating systems and facilities may fail to operate properly, become unstable or vulnerable as a result of events that are wholly or partly outside CBA's control. Poor decisions may be made due to data quality issues and inappropriate data management. This may cause CBA to incur losses. In addition, CBA is exposed to the risk of loss resulting from product complexity and pricing risk; client suitability and servicing risk (including distribution risk and mis-selling); incorrect evaluating, recording or accounting for transaction; human error; cyber-risk and data security risk from a failure of CBA's information technology systems; breaches of CBA's internal policies and regulations, breaches of security; theft and fraud; inappropriate conduct of employees; and improper business practices. CBA employs a range of risk identification, mitigation and monitoring and review techniques. However, those techniques and the judgments that accompany their use cannot anticipate every risk and outcome or the timing of such incidents. 1076 Plainly, where a representation is said to arise from conduct, the totality of the conduct must be considered when determining whether the representation was made: Campomar Sociedad, Limitada v Nike International Limited [2000] HCA 12; 202 CLR 45 at [100]; Taco Bell Pty Limited v Taco Company of Australia Inc [1982] FCA 170; 42 ALR 177 at 202. 1077 In Parkdale Custom Built Furniture Proprietary Limited v Puxu Proprietary Limited [1982] HCA 44; 149 CLR 191, Gibbs CJ emphasised this precept by cautioning (at 199): … It would be wrong to select some words or act, which, alone, would be likely to mislead if those words or acts, when viewed in their context, were not capable of misleading. It is obvious that where the conduct complained of consists of words it would not be right to select some words only and to ignore others which provided the context which gave meaning to the particular words. The same is true of facts. … 1078 Statements, such as those quoted above, which are part of the corpus of material on which the applicants rely for the implied representations they allege, point away from any such representations having been made. 1079 The Bank's AML/CTF Compliance Statements are more focused in respect of ML/TF risk and the Bank's risk systems than the other statements on which the applicants rely. The AML/CTF Compliance Statements speak only in general terms of the Bank's obligation to comply with, amongst other legislation, the AML/CTF Act, and of its policies, procedures, and controls (as reflected in its AML/CTF Program) that are directed to achieving that end. 1080 Although the Bank uses the word "ensure" in various parts of these statements, it is tolerably clear that, in context, the word is used only as a reference to the objective of the Bank's policies, procedures, and controls, not as a guarantee that the Bank has achieved or will achieve compliance through these policies, procedures, and controls or, indeed, through its systems. Read as a whole, I am not satisfied that the AML/CTF Compliance Statements make the absolute representations that the applicants allege. 1081 As I have noted, in their closing submissions the applicants accept that, taking the paradigm of the ordinary and reasonable member of the class to whom the conduct is directed (here, the class is the Affected Market as pleaded), no absolute representation in terms of the Compliance Representations would be conveyed by the express statements on which they rely. This concession is well-made. It is, however, a significant qualification to the applicants' pleaded case. 1082 The applicants seek to limit their concession to an acceptance that the ordinary and reasonable member of the class would understand that, from time to time, the Bank would commit slight, trivial, limited, or "one-off" breaches of the AML/CTF Act, but no more than that. 1083 The effect of the applicants' submission is that the ordinary and reasonable member of the relevant class would understand the Bank to have impliedly represented that: (a) the Bank had effective policies, procedures, and systems for ensuring regulatory compliance, which had been "effective" in the sense that, through these policies, procedures, and systems, the Bank had, in fact, complied with all the regulatory requirements imposed on it, except for slight, trivial, limited, or "one-off" breaches of the AML/CTF Act; and that (b) the Bank's risk management systems had ensured, and would continue to ensure, appropriate monitoring and reporting of compliance activities in the sense that its risk management systems had, in fact, secured, and would continue to secure, the monitoring and reporting that the Bank was required to undertake, except for slight, trivial, limited, or "one-off" breaches of the AML/CTF Act. 1084 I do not accept the thrust of the applicants' submission. Once it is accepted that the ordinary and reasonable member of the relevant class would not understand the Bank to have made the unqualified representations that the applicants allege about the efficacy of the Bank's policies, procedures, and systems for ensuring regulatory compliance, or the fact of regulatory compliance, there is no warrant for then treating that person as having divined from the Bank's express statements some unexpressed reservation about, or qualification to, what the Bank had actually said. The simple fact is that the Bank did not represent that which the applicants allege it had represented. 1085 Further, I am not persuaded that the ordinary and reasonable member of the class would think otherwise. While I have previously accepted that investors who commonly invest in securities would have an expectation that financial institutions will take sufficient measures, and undertake sufficient investment, to mitigate their operational risks, including those risks arising from their need to comply with the AML/CTF Act, I have also accepted that such investors would understand that financial institutions are not free of risk in that regard. This is particularly so in circumstances where, despite the policies, procedures, and systems that the Bank had in place in the relevant period, it published, in the same period, express statements about the existence and consequences of the operational and reputational risks to which it was exposed, including by reason of regulatory non-compliance. 1086 This conclusion also follows from the applicants' submission. If the ordinary and reasonable member of the class understands that, from time to time, the Bank would commit breaches of the AML/CTF Act (even if they be, as the applicants contend, slight, trivial, limited, or "one-off" breaches), then it follows that such a person would equally understand, and expect, that, in those circumstances, it is highly unlikely that the Bank would give compliance guarantees it could not possibly honour. 1087 Further, although it is not necessary for the applicants to call evidence to prove that any person actually understood the Bank to have made the Compliance Representations, it is notable that the applicants themselves did not give evidence of any such understanding or call evidence from any other person (as a member of the relevant class) that he or she had such an understanding. Thus, there is no evidentiary support for the applicants' allegations beyond that which I have dismissed as insufficient to support their case in this regard. 1088 Having reached the finding that the Bank had not made the Compliance Representations, I do not propose to deal with the applicants' case that the Compliance Representations were misleading or deceptive.

The Continuous Disclosure Representation 1089 As pleaded, the Continuous Disclosure Representation also has two components pertaining to the relevant period: (a) the Bank had policies, procedures, and systems in place to ensure that material matters were reported to its CEO and then notified to the ASX, and that (b) it had complied with, and would continue to comply with, its continuous disclosure obligations. 1090 Having regard to the applicants' closing submissions on this topic, the first aspect of this representation is advanced as an absolute statement, in that the word "ensure" is deployed, once again, to denote that the Bank's policies, procedures, and systems were such that they had secured the result that material matters would be reported to the Bank's CEO and then notified to the ASX, without exception. This aspect can then be seen to be reinforced by the second aspect that, the Bank had, in fact, complied with, and would continue to comply with, its continuous disclosure obligations. 1091 I am not satisfied that the Bank made any representation to the effect of the Continuous Disclosure Representation. First, I do not accept that any such representation can be implied from the express statements made in the 2014 Compliance Statements, the 2015 Compliance Statements, or the 2016 Compliance Statements. Secondly, I do not accept that it follows from the fact that the Bank is required to adhere to r 3.1 of the ASX Listing Rules that the Bank impliedly represented throughout the relevant period that it had policies, procedures, and systems in place to ensure that it complied with that rule, or that it had complied with that rule. Thirdly, I do not accept that the 2015 Cleansing Notice made the general representation that the applicants have pleaded as the Continuous Disclosure Representation. The 2015 Cleansing Notice represented no more than it had stated - relevantly, that, as at 12 August 2015, and in the context of the 2015 Entitlement Offer, the Bank had complied with s 674 of the Corporations Act and that there was no excluded information of the type referred to in ss 708AA(8) and (9) thereof that was required to be set out under s 708AA(7) thereof. 1092 For completeness, I should note a further difficulty standing in the applicants' way to establishing that the Bank made the Continuous Disclosure Representation. In closing submissions, the Bank identified what it described as the "inherent implausibility" of such a representation being made. Given that the continuous disclosure regime requires the disclosure of information of which an officer is constructively aware, as well as of information of which an officer is actually aware, it follows that an entity can fail to comply with its continuous disclosure obligations even when it fails to disclose information that is not actually known. Realising this, how then could the reasonable and ordinary member of the class sensibly understand the Bank to have represented that it had policies, procedures, and systems in place that would ensure that it disclosed matters which were not in fact known to it? 1093 This conundrum has some attraction as a reason why, objectively considered, the Bank did not make the Continuous Disclosure Representation. However, it is not necessary for me to place any reliance on the argument because I am not satisfied that the Bank made the Continuous Disclosure Representation for the reasons I have already given. 1094 Further, the misleading or deceptive nature of the Continuous Disclosure Representation lies in the applicants establishing that the Bank failed to comply with its continuous disclosure obligations because it failed to disclose the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information and, or alternatively, the Potential Penalty Information at relevant times within the relevant period. 1095 So understood, the applicants' case on misleading or deceptive conduct, advanced through the instrumentality of the Continuous Disclosure Representation, is really no more than an iteration of the applicants' continuous disclosure case discussed above. This is certainly the effect of how the matter was put in closing submissions. 1096 Therefore, even if (contrary to my finding) the Bank made the Continuous Disclosure Representation, its case on misleading or deceptive conduct with reference to this representation is not established, just as its continuous disclosure case is not established.

Conclusion 1097 For these reasons, the applicants have not established that the Bank contravened s 1041H(1) of the Corporations Act, s 12DA(1) of the ASIC Act, or s 18(1) of the Australian Consumer Law.

The applicants' case 1098 The applicants advance an additional case in respect of the 2015 Cleansing Notice. They allege that the notice was defective within the meaning of s 708AA(11) of the Corporations Act, and was not corrected as required by s 708AA(10) thereof. 1099 Section 708AA provides: 708AA Rights issues that do not need disclosure (1) This section applies to an offer of a body's securities (the relevant securities) for issue if: (a) but for subsection (2), disclosure to investors under this Part would be required by section 706; and (b) a determination under subsection (3) is not in force in relation to the body at the time when the relevant securities are offered. Conditions required for rights issue (2) The offer does not need disclosure to investors under this Part if: (a) the relevant securities are being offered under a rights issue; and (b) the class of the relevant securities are quoted securities at the time at which the offer is made; and (c) trading in that class of securities on a prescribed financial market on which they are quoted was not suspended for more than a total of 5 days during the shorter of the following periods: (i) the period during which the class of securities is quoted; (ii) the period of 12 months before the day on which the offer is made; and (d) no exemption under section 111AS or 111AT covered the body, or any person as director or auditor of the body, at any time during the relevant period referred to in paragraph (c); and (e) no order under section 340 or 341 covered the body, or any person as director or auditor of the body, at any time during the relevant period referred to in paragraph (c); and (f) the body gives the relevant market operator for the body a notice that complies with subsection (7) within the 24 hour period before the offer is made. ... Requirements for notice (7) A notice complies with this subsection if the notice: (a) states that the body will offer the relevant securities for issue without disclosure to investors under this Part; and (b) states that the notice is being given under paragraph (2)(f); and (c) states that, as at the date of the notice, the body has complied with: (i) the provisions of Chapter 2M as they apply to the body; and (ii) section 674; and (d) sets out any information that is excluded information as at the date of the notice (see subsections (8) and (9)); and (e) states: (i) the potential effect the issue of the relevant securities will have on the control of the body; and (ii) the consequences of that effect. Note 1: A person is taken not to contravene section 727 if a notice purports to comply with this subsection but does not actually comply with this subsection: see subsection 727(5). Note 2: A notice must not be false or misleading in a material particular, or omit anything that would render it misleading in a material respect: see sections 1308 and 1309. The body has an obligation to correct a defective notice: see subsection (10) of this section. (8) For the purposes of subsection (7), excluded information is information: (a) that has been excluded from a continuous disclosure notice in accordance with the listing rules of the relevant market operator to whom that notice is required to be given; and (b) that investors and their professional advisers would reasonably require for the purpose of making an informed assessment of: (i) the assets and liabilities, financial position and performance, profits and losses and prospects of the body; or (ii) the rights and liabilities attaching to the relevant securities. (9) The notice given under subsection (2) must contain any excluded information only to the extent to which it is reasonable for investors and their professional advisers to expect to find the information in a disclosure document. Obligation to correct defective notice (10) The body contravenes this subsection if: (a) the notice given under subsection (2) is defective; and (b) the body becomes aware of the defect in the notice within 12 months after the relevant securities are issued; and (c) the body does not, within a reasonable time after becoming aware of the defect, give the relevant market operator a notice that sets out the information necessary to correct the defect. (11) For the purposes of subsection (10), the notice under subsection (2) is defective if the notice: (a) does not comply with paragraph (2)(f); or (b) is false or misleading in a material particular; or (c) has omitted from it a matter or thing, the omission of which renders the notice misleading in a material respect. 1100 The applicants allege that the 2015 Cleansing Notice was defective within the meaning of s 708AA(11) of the Corporations Act in that it did not contain the June 2014 Late TTR Information; the August 2015 Late TTR Information; the June 2014 Account Monitoring Failure Information; the August 2015 Account Monitoring Failure Information; the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information; the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information; the Potential Penalty Information; and, or alternatively, any correction or qualification to the Compliance Representations to the extent they arose by reason of the AML/CTF Compliance Statements, the 2014 Compliance Statements and the 2015 Compliance Statements. 1101 The applicants submit that s 708AA has a remedial purpose to ensure that investors, especially retail investors, have adequate information to make an informed decision about participation in a rights offer. To this end, s 708AA(7)(d) requires a cleansing notice to set out "excluded information". 1102 Relevantly to the present case, the applicants submit that this is information within r 3.1 of the ASX Listing Rules that, even if excluded from disclosure by r 3.1A, is information that investors would reasonably require for the purpose of making an informed assessment of the assets and liabilities, financial position and performance, profits and losses and prospects of the body (s 708AA(8)(b)), provided it is information that it is reasonable for investors and their professional advisers to expect to find in a disclosure document (s 708AA(9)). 1103 The applicants put this part of their case as follows: If the Court were to find that the pleaded information was material and information of which CBA was aware (in the relevant sense) as of 12 August 2015, that would make false the statement in CBA's cleansing notice issued that day that "there is no excluded information of the type referred to in sections 708AA(8) and 708AA(9) of the Act that is required to be set out in this notice under section 708AA(7) of the Act". Put another way, CBA could not rely on 3.1A in respect of such information, given the heightened disclosure required by ss 708AA(7)(d), (8) and (9). 1104 The applicants advance an alternative case. They contend that officers of the Bank became aware of the September 2015 Late TTR Information and the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information shortly after the cleansing notice was issued. Section 708AA(10) of the Corporations Act requires a cleansing notice to be corrected if the company becomes aware of a defect in the notice within 12 months of the issue of securities pursuant to the notice. 1105 In Vocation, Nicholas J reasoned (at [717] - [722]) that s 708A(9) and (10) of the Corporations Act, which are closely similar in terms to s 708AA(10) and (11), do not deal with constructive knowledge. In oral closing submissions, the applicants submitted that Vocation should not be followed in this regard. 1106 Notwithstanding that invitation, the applicants nevertheless submit that there can be "no serious contest" that Mr Narev was aware of the September 2015 Late TTR Information by no later than 6 September 2015, and that Mr Narev "accepted in cross-examination that he was aware that information of that kind was material". The second part of this submission was explained in a footnote. It needed to be explained because Mr Narev did not signify any acceptance in cross-examination that the September 2015 Late TTR Information was "material" in the relevant sense: The Court should proceed on the basis that it is not necessary to show that the directing mind and will of CBA actually drew the conclusion that the information was material, but rather was aware of the facts which made it material. The applicants draw an analogy with cases regarding involvement (which requires proof of knowing participation in the contravention), in which it is considered that "To establish accessorial liability it must be established that the relevant person knew the representation was made and the facts which made it misleading or deceptive, or likely to mislead or deceive, or false. It need not be shown that the relevant person actually drew the conclusion that the representation was misleading or deceptive, or likely to mislead or deceive, or was false": Keller v LED Technologies Pty Ltd [2010] FCAFC 55; (2010) 185 FCR 449 at [336] per Besanko J; Kim v Hodgson Faraday Pty Limited [2022] FCA 1190 at [56] per Jagot J. 1107 The applicants submit that, if the Court were to find that r 3.1A of the ASX Listing Rules was available to the Bank, and that the Bank was not aware of the information (in the relevant sense) as at 12 August 2015, Mr Narev's actual knowledge of the September 2015 Late TTR Information would, if that information were accepted to be material in the relevant sense, have required the Bank to correct the 2015 Cleansing Notice notwithstanding any reliance on r 3.1A. The applicants submit that the Bank's failure to correct meant that it contravened s 708AA(10) of the Corporations Act.

Analysis 1108 I have found that the Bank did not make the Compliance Representations. It follows that I do not accept that the 2015 Cleansing Notice was defective because it did not contain any correction or qualification to the Compliance Representations. 1109 As to the balance of the applicants' allegations, I have found that the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information was not information that the Bank was required to disclose under s 674 of the Corporations Act. Therefore, to this extent, the 2015 Cleansing Notice was not defective within the meaning of s 708AA(11) of the Corporations Act. 1110 Further, I am not satisfied that the June 2014 Late TTR Information; the August 2015 Late TTR Information; the June 2014 Account Monitoring Failure Information; the August 2015 Account Monitoring Failure Information; the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information; the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information; or the Potential Penalty Information is information that investors and their professional advisers would reasonably require for the purpose of making an informed assessment of any of the matters referred to in ss 708AA(8)(b)(i) and (ii). I reach this conclusion for the same reasons that I have found that the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information was not material in the relevant sense. 1111 In addition, even if s 708AA(8)(b) would otherwise require the 2015 Cleansing Notice to contain the June 2014 Late TTR Information; the August 2015 Late TTR Information; the June 2014 Account Monitoring Failure Information; the August 2015 Account Monitoring Failure Information; the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information; the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information and, or alternatively, the Potential Penalty Information, I am not satisfied that this information, in its pleaded forms, was information that investors and their professional advisers would reasonably expect to find in a disclosure statement. This is because this information, in its pleaded forms, was incomplete, misleading, or inaccurate or, in the case of the Potential Penalty Information, also vague, in the respects I have found above. 1112 Further, I am not satisfied that investors and their professional advisers reasonably expect that financial institutions, such as the Bank, which deal with regulatory matters, including issues of non-compliance, with regulators on a day-to-day basis, will apprise the market of the toings and froings on those matters, unless the Bank has meaningful and substantially concrete information to impart. In short, I am not persuaded that the June 2014 Late TTR Information; the August 2015 Late TTR Information; the June 2014 Account Monitoring Failure Information; the August 2015 Account Monitoring Failure Information; the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information; the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information or the Potential Penalty Information reaches the threshold of s 708AA(9) of the Corporations Act. 1113 I am not satisfied, therefore, that the 2015 Cleansing Notice was defective within the meaning of s 708AA(11) of the Corporations Act because the June 2014 Late TTR Information; the August 2015 Late TTR Information; the June 2014 Account Monitoring Failure Information; the August 2015 Account Monitoring Failure Information; the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information; the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information or the Potential Penalty Information was excluded information that should have been included in the notice. 1114 Further, I am not satisfied that the 2015 Cleansing Notice was false or misleading in a material particular, or omitted matter which rendered it misleading in a material respect (see ss 708AA(11)(b) and (c)), and thus defective, because it did not contain the June 2014 Late TTR Information; the August 2015 Late TTR Information; the June 2014 Account Monitoring Failure Information; the August 2015 Account Monitoring Failure Information; the June 2014 IDM ML/TF Risk Assessment Non-Compliance Information; the August 2015 IDM ML/TF Risk Assessment Non-Compliance Information or the Potential Penalty Information. 1115 I now turn to the applicants' alternative case with regard to correction. As s 708AA(10) makes clear, an obligation to correct a cleansing notice only arises if the notice is defective. As I am not satisfied that the 2015 Cleansing Notice was defective within the meaning of s 708AA(11), it follows that the applicants' case based on s 708AA(10) fails at the threshold. Thus, the applicants' reliance on Mr Narev's actual knowledge of the September 2015 Late TTR Information cannot avail them. 1116 Nevertheless, for completeness, I should record that I am not persuaded that Vocation was wrongly decided by holding (at [721]) that s 708A(9) of the Corporations Act requires proof of actual knowledge. Consistency in statutory construction requires that s 708AA(10)(b) be applied in the same way. 1117 Further, I do not accept the applicants' submission that Mr Narev had actual knowledge that the 2015 Late TTR Information was material in the relevant sense. That knowledge has not been proved, and I am not persuaded that it is knowledge that should be imputed to Mr Narev. 1118 In any event, as I have already held, the applicants have not established that the Bank was aware that the 2015 Cleansing Notice was defective within the meaning of s 708AA(11).

Conclusion 1119 For these reasons, the applicants have not established their additional case that the 2015 Cleansing Notice was defective within the meaning of s 708AA(11) of the Corporations Act, and was not corrected as required by s 708AA(10) thereof.

Overview 1120 In light of the dispositive findings I have already made in respect of the applicants' case on liability, it is not necessary for me to make findings in respect of all aspects of their case on causation and loss. There are, however, some critical findings I can and should make, not least because some of my earlier findings on liability are equally relevant to this aspect of the applicants' case. 1121 It is appropriate that I commence this section of my reasons by acknowledging that the various forms of language in which the relevant statutory causes of action for damages or compensation (on which the applicants rely) are expressed, can be taken to be equivalent in legal effect so far as the question of causation is concerned. See, for example, the observations in Masters v Lombe (Liquidator); In the Matter of Babcock & Brown Limited (In Liq) [2019] FCA 1720 (Masters) at [346]; TPT Patrol at [1526]; Flogineering Pty Ltd v Blu Logistics SA Pty Ltd (No 3) [2019] FCA 1258; 138 ACSR 172 at [27] - [28]. 1122 In their case on causation, the applicants emphasise that, regardless of the causal language used in respect of the statutory causes of action on which they rely, the inquiry which the Court must address is a straightforward one that is based, in large measure, on commonsense. They caution that the Court's approach to this inquiry should not be overcomplicated. As the applicants put it, the inquiry is simply: What happened that should not (and therefore would not) have happened? And what would have happened instead? Would the applicants have acquired the shares they bought in the Relevant Period for the same price, or a lower price? 1123 As to this, the applicants submit: All that is necessary is for the Court to be persuaded that the share price would have been lower in any way than what it was during the Relevant Period by reason of the Information that was not disclosed; if so, causation has been established. 1124 The applicants submit, further, that the Court should not conflate the fact of a lower price (the causation question) with the extent of the lower price (a measurement question). The applicants submit that, once the Court finds that the Information (or some part of it) is material (in the sense that it requires disclosure in accordance with s 674(2) of the Corporations Act), it follows, by reason of the efficient market hypothesis, that loss has been caused to the applicants, unless the Bank can establish that "the whole of the price reaction which in fact occurred" was attributable to something else. 1125 This submission requires elucidation. 1126 The notion of an "efficient market" was described by Professor Easton in these terms: An efficient market is one in which prices adjust quickly to new and material information. This implies that the firm's stock price will reflect the investors' understanding of the stock's value given the total mix of publicly available information. Investors acting to take advantage of all new and material information drive markets to become efficient because, through these investors' action, prices adjust quickly until the superior profits from the new and material information disappear. Consequently, all the information in past prices and public information is reflected in the current stock price. This concept of market efficiency has broad empirical support. 1127 Professor Easton and Dr Unni agreed that the form of efficiency here is "semi-strong", meaning that security prices reflect all information that is publicly available, not just information on historical prices. 1128 The price reaction to which the applicants refer in their submission is the price reaction to the 3 August 2017 announcement. Here, the applicants' evidence, based on Professor Easton's event study (which I discuss below), is that the 3 August 2017 announcement caused a statistically abnormal return of -$3.29 per CBA share. 1129 In developing this line of reasoning, the applicants submit: (O)nce the Court finds that the information was material, and that information was disclosed as part of the 3 August 2017 announcements, the applicants have made out the legal onus of establishing share price inflation, and therefore causation. To be more precise, because there is no doubt that the Late TTR Information (at least in its September 2015 form) was material, and because the other items of information relied upon by the applicants are incrementally material to the Late TTR Information, the Court can be confident that at least some of the price reaction which did occur was attributable to the Late TTR Information (in its September 2015 form). That is a sufficient basis to establish that there was at least some inflation attributable to undisclosed information, and to establish causation. 1130 As I said at the outset of these reasons, the applicants' case, put simply, is that they paid too much for the CBA shares they acquired during the relevant period because of the artificial inflation for which they contend. Zonia says that it acquired CBA shares on 18 September 2015 through the acceptance of entitlements under the 2015 Entitlement Offer. Mr and Mrs Baron say they acquired CBA shares on 21 August 2014, 19 February 2015, 20 August 2015, 18 September 2015, and 29 May 2017 by various means - through the Bank's DRP, the acceptance of entitlements under the 2015 Entitlement Offer, and on-market acquisitions. 1131 The applicants posit four "causation pathways" that are involved in this inquiry. The first pathway concerns on-market acquisitions. The second pathway concerns the 2015 Entitlement Offer acquisitions. The third pathway depends on a finding that disclosure of the Information or correction of the representations that the applicants contend were misleading or deceptive, prior to or during the 2015 Entitlement Offer, would have led the Bank to cancel, withdraw, or suspend the offer, with the consequence that those who did acquire shares under the 2015 Entitlement Offer would not have done so. The fourth pathway concerns individual reliance. However, the fourth pathway is not one which the applicants advance in their own cause. For that reason, they do not address this pathway in any detail. They point out that it is, nevertheless, a pathway on which individual Group Members may wish to rely. 1132 The first pathway and the second pathway are the principal pathways on which the applicants rely. There are similarities between them. 1133 To elaborate, the first pathway has three aspects, which depend on: (a) whether the Bank failed to disclose information that it was required to disclose under s 674 of the Corporations Act (which the applicants call Pathway 1A); (b) whether the Bank engaged in misleading or deceptive conduct by making and failing to qualify representations about price-sensitive matters (which the applicants call Pathway 1B); and (c) whether, in respect of on-market purchases after the 2015 Cleansing Notice was published on 12 August 2015, the Bank failed to correct or qualify the notice (as a "defective" notice) under s 708AA(10) of the Corporations Act (which the applicants call Pathway 1C). 1134 In respect of each of these pathways, the applicants allege that, in the relevant period, the market for CBA shares was such that the price at which those shares traded rapidly adjusted to reflect all material information disclosed by the Bank. The applicants allege that the price would have rapidly adjusted "had corrective information been disclosed in a timely way as it should have been". According to the applicants, the alleged non-disclosures and failures to correct resulted in CBA shares trading at artificially inflated prices above the price that a properly informed market would have set. The applicants allege that Mr and Mrs Baron, and Group Members, acquired shares in that inflated market, and thereby suffered loss because they "paid too much". 1135 The second pathway also has three aspects, which depend on: (a) whether, prior to the 2015 Entitlement Offer, the Bank failed to disclose information that it was required to disclose under s 674 of the Corporations Act (which the applicants call Pathway 2A); (b) whether, prior to the 2015 Entitlement Offer, the Bank engaged in misleading or deceptive conduct by making and failing to qualify representations about price-sensitive matters (which the applicants call Pathway 2B); and (c) whether the Bank failed to correct the allegedly "defective" 2015 Cleansing Notice (which the applicants call Pathway 2C). 1136 In respect of each of these pathways, the applicants also allege that, in the relevant period, the price of CBA shares rapidly adjusted to reflect all material information disclosed by the Bank and would have rapidly adjusted "had corrective information been disclosed in a timely way prior to the 2015 Entitlement Offer, as it should have been". According to the applicants, because the 2015 Entitlement Offer price was set by reference to the market-traded price of CBA shares (albeit at a discounted price), the alleged non-disclosures or failures to correct caused the 2015 Entitlement Offer to proceed at an artificially inflated price. Therefore, those who acquired CBA shares under the 2015 Entitlement Offer paid more than they should have paid.

Market-based causation 1137 The applicants' case on causation that is advanced through the first, second, and third pathways is based on the theory of "market-based causation". More specifically, those pathways are instances of "active indirect causation" (to employ the description used by Beach J in TPT at [1662] - [1663]). On the applicants' case, these pathways do not involve any allegation (let alone any requirement for proof) that they relied on, or were induced to act or not act by, anything that the Bank did or did not do. Rather, the applicants say that it is sufficient that they acquired CBA shares in a misinformed market by reason of the Bank's failure to disclose the Information (or some part of it) or to correct the representations it had allegedly made. 1138 According to the applicants, because the market was misinformed, the price of CBA shares was artificially inflated. Therefore, their acquisition of CBA shares at an artificially inflated price represents a loss which they have suffered (they paid too much). On their case, they are entitled to claim, and the Bank is liable to pay, damages for that loss because the Bank caused it. 1139 The applicants advance TPT as "the principal judgment that provides direct support for market-based causation in a securities case" such as the present case. 1140 In that case, Beach J carried out an extensive analysis of a number of cases that discuss the conditions that establish legal causation for the purposes of maintaining a statutory cause of action for damages or compensation for misleading or deceptive conduct: at [1514] - [1673]. 1141 His Honour said that, in those cases, the legal test of causation will be satisfied where the person claiming damages or compensation shows that the loss was suffered because they relied on, or were induced to act or not act in some way, because of the misleading or deceptive conduct. His Honour said that the legal test of causation will also be satisfied where someone other than the person claiming damages or compensation relies on, or is induced to act or not act in some way because of, the misleading or deceptive conduct, and that this circumstance results in loss to the person claiming damages or compensation. 1142 His Honour concluded that reliance of each kind is "sufficient to establish causation in misleading or deceptive conduct cases", but "neither is a necessary condition in all cases" (meaning, in all misleading or deceptive conduct cases). Further, his Honour concluded that "neither of these mechanisms are necessary to establish causation in continuous disclosure cases": see [1635] - [1639]. 1143 By way of further elaboration, Beach J reasoned (at [1656] - [1660]) that, on proper analysis, there are two categories, but three well-established mechanisms, of causation in misleading or deceptive conduct cases: (a) direct causation; (b) passive indirect causation; and (c) active indirect causation. 1144 At [1657], Beach J explained direct causation: 1657 ... This is the scenario where absent a power in the respondent to direct or compel the applicant to take a course of action, the mechanism by which misleading acts or omissions by the respondent might directly cause loss to the applicant is almost invariably by inducing the applicant to some course of action. This inducing requires proof that the applicant relied upon some impression created by the respondent's misleading act or omission. ... 1145 At [1660], his Honour explained passive indirect causation: 1660 ... This is the scenario where the respondent's misleading conduct induces some reaction in X, and that reaction by X itself causes loss to the applicant without any requirement for a reaction by the applicant. This is the Janssen-Cilag type of case. ... In the Janssen-Cilag type case the defendant's misleading representations to the plaintiff's customers caused their customers to shift their custom to the defendant's business. Provided that the plaintiff established, by direct proof or proper inference, that the customers relied upon the defendant's misleading conduct, there was no second requirement of 'reliance' by the plaintiff, either on the defendant or on the reactions of the customers. The plaintiff was relevantly passive, but there was still causation of loss and it was still recoverable. 1146 At [1659], his Honour explained active indirect causation: 1659 ... This is the scenario where a respondent's misleading conduct induces some reaction in X, and the applicant would have acted differently but for that reaction by X. There is no additional requirement that the applicant was aware of or relied on the respondent's conduct. It is enough that X relied, and that the applicant would have acted differently but for that reliance by X. Or in other words, it is enough that the applicant relied on X. Thus in Hampic the injured cleaner succeeded because the supervisor had relied on a misleading label which the cleaner herself never saw. ... 1147 His Honour considered TPT to be a case of active indirect causation in which: (a) the respondent, Myer Holdings Limited (Myer), failed to disclose information; (b) those "disclosure failures" caused the action of intermediaries (the buyers and sellers in the market) to inflate the trading price of MYR ED securities above the price which a properly-informed market would have set; (c) the applicant acquired its securities (i.e., it was active not passive in that inflated market); and (d) the applicant would not have acquired those securities, at that price, but for the market's reaction to Myer's misleading or deceptive conduct and disclosure failures. 1148 On this analysis, the fourth proposition ((d) above) appears to be no more than a statement of the inevitable consequence of the first three propositions ((a) to (c) above). Thus, at [1663] Beach J said: 1663 … In my view it is enough, in terms of causation, that the applicant unknowingly acted by acquiring its MYR ED securities at the prevailing market price during the period of inflation, assuming that to be so for the sake of the argument at this point. 1149 It is important to understand that Beach J's analysis and discussion of market-based causation was directed to a point of principle - namely, whether that theory of causation could apply in continuous disclosure cases. His Honour was firmly of the view that it could. He expressed that view in circumstances where, even though the applicant had established contraventions of ss 674 and 1041H of the Corporations Act, there was no evidence which established that those contraventions caused any loss or damage to the applicant or Group Members. In other words, the applicant's case on liability for damages was not established. His Honour's remarks on market-based causation were, therefore, obiter. That said, I readily accept that his Honour's remarks were part of a carefully reasoned (and if I may also say so, illuminating) judgment on a matter that was fully argued before him: see the observations of Megarry J in Brunner v Greenslade [1971] Ch 993 at 1002 - 1003 as to the weight that should be given to such an analysis. 1150 In undertaking his analysis, Beach J addressed, in principle, the argument that permitting a case on market-based causation might mean that an investor has a right to recover even if that investor did not hold any belief as to the integrity of the market price. At [1530], his Honour said: 1530 … For those that did not have such a belief or would have purchased at the same price even if they knew the true position … such circumstances may break or negate any causation chain. 1151 However, having noted that possibility, his Honour remarked that "(a)ll these questions are yet to be worked out" and may give rise to "individual specific causation questions": at [1531]. 1152 Later in his reasons, Beach J returned to this theme. At [1669] - [1672] he identified a number of questions. The first question was posed at a general level: Was there share price inflation caused by the s 674 contravention? 1153 Raising this question in this way shows that the plaintiff bears the onus of establishing the existence of share price inflation, although at [1668] his Honour adverted to the possibility that a defendant might show that the relevant non-disclosure did not affect the market price (as appears to have happened in TPT itself). This question also reveals that the inquiry whether there has been artificial share price inflation at any point in time is not automatically answered by establishing the materiality of non-disclosed information (if the non-disclosed information were not material, there could be no s 674 contravention in the first place). 1154 The other questions were specific questions: 1671 … In respect of an individual claim, did the investor purchase shares when the share price was inflated? Did the investor continue to hold or sell those shares after the inflation was backed out of the share price by the corrective disclosure? If so, any loss may prima facie be recoverable under the market-based causation theory. But on one view an investor may still need to give evidence that but for the contravention he would not have purchased the shares or not at the price he paid. The individual claimant may still have this onus, but it would hardly be onerous or challenged in the vast majority of cases; and it could be discharged by a simple statutory declaration or ticking boxes in a verified questionnaire post judgment on the common issues. That is one solution to get around the reverse onus problem involved in the control mechanism of a novus actus interveniens solution of the type discussed in HIH Insurance. And it cures the perceived problem in market-based causation referred to by Foster J in Masters at [392]. … 1155 It is necessary to make some further observations about the "reverse onus problem" identified in this passage of his Honour's reasons. 1156 In Re HIH Insurance Ltd (in liquidation) [2016] NSWSC 482; 335 ALR 320 (HIH), Brereton J considered a case of admitted contraventions of s 52 of the Trade Practices Act 1974 (Cth) and ss 995 and/or 999 of the Corporations Law (Cth) (repealed) for misleading or deceptive conduct. The conduct was constituted by HIH Insurance Ltd (in liq) (HIH) publishing financial results which conveyed misleading or deceptive representations. It was said that these representations caused the market price of HIH shares to be inflated. The plaintiffs bought HIH shares at the allegedly inflated price. Central to the case (an appeal from a liquidator's rejection of a proof of debt) was whether the plaintiffs had established that their claims for damages were enforceable against HIH. This turned on whether the plaintiffs had established that they were entitled to damages against HIH on the basis of "indirect causation" without proving direct reliance on the contravening conduct. 1157 Like Beach J in TPT, Brereton J carried out an extensive analysis of the cases on causation of loss in the context of statutory causes of action for damages for misleading or deceptive conduct. His Honour concluded that "indirect causation" was available to the plaintiffs. It is convenient to quote in full those paragraphs of his Honour's reasons that informed that conclusion: 74 The plaintiffs bought their shares on the ASX, to which HIH released information, including the FY1999 results, the FY2000 interim results and the FY2000 final results, which formed part of the matrix of information that influenced the trading price of the shares from day to day. If the contravening conduct deceived the market to produce a market price which reflected a misapprehension of HIH's financial position (which is a factual question to be resolved in conjunction with the quantification of damages), then it had the effect of setting the market at a higher level - and the price the plaintiffs paid greater - than would otherwise have been the case. In such circumstances, plaintiffs who decided - entirely oblivious to the contravening conduct - to acquire shares in HIH, were inevitably exposed to loss. Moreover, they were members of the class who would obviously be affected by the contravening conduct. Upon the assumption that the effect of the misleading conduct was, as the plaintiffs allege, that HIH shares traded on the market at a higher price than would otherwise have been the case, it was inevitable that any purchaser of HIH shares would, upon acquiring such shares, incur loss. The case is analogous to the first class described by McHugh J in Henville v Walker, though it is the laws of the market rather than those of nature which dictated that the inevitable consequence of the contravening conduct would be that share purchasers would pay an inflated price - although an investor who was shown to have acquired shares knowing that the results were overstated, or indifferent to it, could not be said to have incurred the loss "by" the contravening conduct - a decision to do so with such knowledge or indifference would break the causal chain. Alternatively put, the plaintiffs would have acted differently if the contravening conduct had not occurred, in that they would have paid a lesser price for their shares than they did. 75 The chain of causation was (1) HIH released overstated financial results to the market, (2) the market was deceived into a misapprehension that HIH was trading more profitably than it really was and had greater net assets than it really had, (3) HIH shares traded on the market at an inflated price, and (4) investors paid that inflated price to acquire their shares, and thereby suffered loss. Thus, the contravening conduct materially contributed to that outcome. 76 This can be tested by a counterfactual inquiry: what would have happened if each contravention had not occurred? On relevant assumptions, the answer is that the market price of the HIH shares would have been lower, and the plaintiffs would have paid less for the shares they acquired. 77 In those circumstances, I do not see how the absence of direct reliance by the plaintiffs on the overstated accounts denies that the publication of those accounts caused them loss, if they purchased shares at a price set by a market which was inflated by the contravening conduct: the contravening conduct caused the market on which the shares traded to be distorted, which in turn caused loss to investors who acquired the shares in that market at the distorted price. In the absence of any suggestion that any of the plaintiffs knew the truth about, or were indifferent to, the contravening conduct, but proceeded to buy the shares nevertheless[,] I conclude that "indirect causation" is available and direct reliance need not be established. 78 As Edelman J pointed out in Caason v Cao, that does not mean that indirect causation has been established. The above reasoning proceeds on the assumption that the contravening conduct caused the market to be inflated. The plaintiffs must establish, by evidence and/or inference, that the contravening conduct distorted the market price so as to cause the shares to trade at an inflated price. In this case, whether the contravening conduct had the effect of inflating the market price of HIH shares is intertwined with the quantification of the plaintiffs' damages, if any. (Footnote omitted.) (Emphasis added.) 1158 Attention should be directed to Brereton J's statements at [74] and [77] concerning the position of investors who acquire shares knowing that results are overstated or who are indifferent to that fact. 1159 In Masters, Foster J observed (at [392]) that this might well indicate a "serious problem" with market-based causation. At [390], Foster J said: 390 There are difficulties with the market-based causation theory in any event. As Brereton J correctly identified, the theory allows recovery by persons who actually knew the information which was not disclosed and also by persons who would have taken no notice of the information had it been disclosed. His Honour addressed those problems by regarding the impact on the causal chain of such knowledge or indifference as a novus actus interveniens. By taking that approach, his Honour imported into the relevant enquiry the novus actus concept from tort where, as a matter of principle, the courts have placed the onus of proof on the defendant. Because he imported into the relevant inquiry the novus actus concept, Brereton J concluded that the onus of proving that there was a relevant break in the causal chain for the purposes of the market-based causation theory was on the defendant. 1160 This is the problem that Beach J in TPT saw as capable of being overcome by proof by a claimant for damages that, but for the contravention, that person would not have purchased the shares, or would not have purchased the shares at the price that was paid. In other words, while Brereton J recognised in HIH that a claimant's reliance was relevant to the question of causation, Beach J took the further step in TPT of recognising that proof of reliance may still be an element in a claimant's proof of loss. 1161 Therefore, although the theory of market-based causation is a causal explanation of how particular shares might come to have been purchased at an artificially inflated price, that explanation may not be sufficient in and of itself to establish that a claimant has suffered loss by reason of that inflation. This is because the proper operation of the theory of market-based causation should recognise that persons who purchase their securities with actual knowledge of the non-disclosed information, or would still have purchased their securities even if they had known the non-disclosed information, are not persons who can establish compensable loss occasioned by that inflation. 1162 In closing submissions, the applicants contended that the "supposed difficulty" of market-based causation allowing for recovery by "investors who are indifferent to whether the market price for shares accurately reflects all of the price-sensitive information that the company is required to disclose" is "illusory". I disagree. What is more, this is not the view expressed by Brereton J in HIH, by Foster J in Masters, or by Beach J in TPT. Conspicuously, the applicants have not given evidence on these matters in their respective cases. 1163 Attention should also be directed to Brereton J's observation in HIH at [78] to the effect that determining whether contravening conduct has had the effect of inflating the market price of the securities in question is intertwined with the quantification of a plaintiff's damages (if any). Whilst it can be accepted (as the applicants emphasise) that the causation of loss, and the quantification of loss, are distinct concepts and, for that reason, should not be conflated, it does not follow that the factual questions that arise in respect of these matters are entirely separate for the purpose of fact-finding, particularly as to whether, in a given case, any loss has been established. 1164 Brereton J's observations in HIH at [78] also make clear, as do Beach J's reasons in TPT at [1669] to [1672], that share price inflation, by reason of the alleged contravening conduct (whether by actionable non-disclosure of price sensitive information or misleading or deceptive conduct) must be proved, not merely assumed.

Professor Easton's event study 1165 Professor Easton was engaged by the applicants to provide an opinion on the following questions: Q1 Did the release of the 3 August Corrective Disclosure have an effect on the price of CBA Shares, and if so, what was the magnitude of that effect? Q2 Would the price at which CBA Shares traded on the ASX have been affected, and if so by what magnitude, if CBA had disclosed the information contained in the 3 August Corrective Disclosure from the beginning of, and at any time during, the Relevant Period? 1166 The terms "3 August Corrective Disclosure", "CBA Shares", and "Relevant Period", as used in these questions, are defined in the statement of claim. In these reasons, I have used the neutral expression "the 3 August 2017 announcement" in preference to "the 3 August Corrective Disclosure". Purely for stylistic reasons, I have also used "CBA shares" in preference to "CBA Shares" and "relevant period" in preference to "Relevant Period". Professor Easton also used the expression the "Alleged Corrective Disclosures" to refer to the 3 August 2017 announcement and the Bank's media release. 1167 In order to answer the first question, Professor Easton undertook an event study. The methodology of an event study is premised on the efficient market hypothesis. Professor Easton explained that the economic concepts underlying an event study are: (a) the price of a company's shares at any point in time reflects all information available at that time; (b) new share-specific information causes a revision in expectations about the investment in the shares and hence a change in price; (c) the effects of other market-wide information (such as a change in borrowing rates), and industry-wide information (such as a change in industry regulation), which might also affect the share price, are removed in order to determine the portion of the price change that is caused by the new information. 1168 Professor Easton studied a two day event window, namely 3 and 4 August 2017. His model yielded a residual return for CBA shares on those days of -3.91% or -$3.29 per share. He noted that this return was an unusually large negative two-day return for CBA shares which was highly unlikely to have been caused only by random volatility, market-wide effects, or an industry effect. He concluded that the share price decline for CBA shares on 3 and 4 August 2017 was economically material. 1169 Professor Easton opined that the Bank's investors were reacting to the disclosure of value-relevant information in those days - in other words, the information changed their expectations about future benefits from investing in CBA shares. He concluded that the Alleged Corrective Disclosures, and their foreseeable consequences, caused this decline. According to Professor Easton, the foreseeable consequences included potential fines, reputational effects, operational risk, costs of remediation, management and governance policy changes, changes in growth strategies, regulatory investigations, greater oversight, and additional inquiries. 1170 In discussing the "event" he analysed, Professor Easton said: In order for information to be conveyed to market participants, there must be a disclosure via a medium (e.g., a press release, a tweet, a conference call) and the disclosure must be analyzed. An event study determines the reaction of market participants as they understand and interpret the implications of the disclosure for their expectations of the amounts, timing, and uncertainty of future pay-offs from investing in shares of the firm. The four elements of information (the message that was disclosed, the medium, the analysis, and the interpretation) are all part and parcel of the event analyzed and cannot and should not be separated. … 1171 Professor Easton said that, in his study, the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, the ML/TF Risk Systems Deficiency, "and/or" the Potential Penalty Information was the information, and thus the "message", disclosed. The Alleged Corrective Disclosures (i.e., the 3 August 2017 announcement and the Bank's media release) was the "medium" by which this information was disclosed to market participants. He said that the Alleged Corrective Disclosures implicitly included the "message". 1172 Professor Easton continued: Market participants assessed and reacted to the Information in the medium by which the Information was disclosed, and the market assessment of the Information was integral with the assessment of the Information by professional commentators and analysts. The Alleged Corrective Disclosures and the analysis of the implications of the disclosures were part and parcel of the information conveyed to the market. Importantly, the medium and the analysis cannot and should not be divorced from the message in the disclosure. 1173 In cross-examination, Professor Easton confirmed that "everything that comes out on 3 August cannot be split into its constituent parts and separately analysed". 1174 It is important, at this point, to note the following matters about this evidence. 1175 First, as Professor Easton stressed, the "event" he analysed is not simply the "message" but the inseparable combination of the "message", the "medium", the "analysis", and the "interpretation" of the Alleged Corrective Disclosures. All these matters comprise the "event". 1176 Secondly, and obviously, this "event" does not correspond to the mere hypothetical disclosure, by the Bank, of any of the pleaded forms of the Late TTR Information, or of the Account Monitoring Failure Information, or of the IDM ML/TF Risk Assessment Non-Compliance Information; nor does the "event" correspond to the hypothetical disclosure, by the Bank, of the Potential Penalty Information. 1177 Thirdly, Professor Easton catalogued the ML/TF Risk Systems Deficiency as part of the "message", whereas this information is no longer part of the applicants' continuous disclosure case (and was not part of the applicants' continuous disclosure case when they opened their case). 1178 Fourthly, as I have previously discussed, there is additional, significant, and damning, information contained in the 3 August 2017 announcement (and hence the Alleged Corrective Disclosures) that is not part of the applicants' continuous disclosure case. 1179 Fifthly, it is not accurate to say that the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, "and/or" the Potential Penalty Information was the information, and thus the "message", disclosed in the Alleged Corrective Disclosures. The Late TTR Information, the Account Monitoring Failure Information, and the IDM ML/TF Risk Assessment Non-Compliance Information exist in differently pleaded forms with differently pleaded content that (on the applicants' case) should have been disclosed at different times. The variously pleaded forms of the Information were not disclosed by the 3 August 2017 announcement (and hence by the Alleged Corrective Disclosures). Some information, in some of the pleaded forms, was disclosed. 1180 Similarly, the Potential Penalty Information is pleaded in alternatives. None of these alternatives was disclosed as part of the 3 August 2017 announcement (and hence as part of the Alleged Corrective Disclosures). What was disclosed was the fact that proceedings for civil penalties had been commenced by AUSTRAC, not the fact that the Bank was "potentially exposed to enforcement action by AUSTRAC". 1181 I raise these matters because the evidence appears to glide over important differences between (a) what information the applicants allege the Bank should have disclosed and when the Bank should have disclosed it, and (b) what AUSTRAC in fact disclosed on 3 August 2017. However, it is the hypothetical market effect of the former, not the actual market effect of the latter, that is in issue and must be determined. 1182 I wish to make clear, however, that these observations are not a criticism of Professor Easton. Far from it. For the purposes of his task, Professor Easton was instructed to express his opinions on the basis of the following core assumption: A2 From the beginning of, and at any time during, the Relevant Period, CBA could have conveyed information materially equivalent to that contained in the 3 August Corrective Disclosure. 1183 In his Expert Report in Reply, Professor Easton explained the ramifications of making that assumption: Given the assumption I was provided … [Assumption A2] … the focus of my report is on the stock price reaction of CBA on 3 and 4 August 2017. This assumption implies that the effect of the content of the disclosure (although the disclosure differs across the Relevant Period), the medium by which the information became known to investors in CBA shares, and the analysis of the disclosure would have a materially equivalent effect on the price of shares of CBA at the beginning and any time during the Relevant Period; that is, at least $3.29 per share. 1184 This statement explains why Professor Easton said that, in his study, the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, the ML/TF Risk Systems Deficiency, "and/or" the Potential Penalty Information was the information, and thus the "message", disclosed. The equivalence that Professor Easton was instructed to assume meant that the content of that information in its various pleaded forms, and the time when the applicants allege that the information in its various pleaded forms should have been disclosed, had no consequence for Professor Easton's consideration of the second question he was asked. 1185 Equally irrelevant to Professor Easton's consideration of the second question were the medium by which the hypothetical disclosures would have been made (including the fact that, on the applicants' case, the disclosure should have been made by the Bank in the course of engaging with the regulator, not by AUSTRAC in the course of actually disclosing that it had commenced proceedings against the Bank for civil penalties) and any analysis that, hypothetically, might have followed from any disclosure of relevant information by the Bank at a relevant time. 1186 In short, all these matters - the message, the medium, the analysis and the interpretation of the information, that, hypothetically the Bank could have disclosed at any point in the relevant period - were, in combination, and on instructions, to be taken as equivalent, in market effect, to the Alleged Corrective Disclosures. 1187 In answering the second question posed for his consideration, Professor Easton noted the assumption he was required to make, and said: Therefore in response to Question 2, the price declines on 3-4 August 2017 reflect the artificial inflation in CBA shares on each day during the Relevant Period. In other words, the artificial inflation embedded in CBA shares on each of the Relevant Period is at least A$3.29 per share. … 1188 It will be appreciated that Professor Easton's answer to the second question followed ineluctably from his answer to the first question, without separate or further analysis. 1189 In their closing submissions, the applicants emphasised that the abnormal return derived from Professor Easton's event study (-A$3.29 per share) is a measure of only the new and material information disclosed to the market (after stripping out market and industry movements). They emphasised that information that is not new does not contribute to the price impact (it is "stale") and that information that is already generally available will have been impounded into the price when it was "new". 1190 The applicants contend that the 3 August 2017 announcement contains the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, and the Potential Penalty Information. As to the Potential Penalty Information, the applicants argue that, even if not articulated expressly, the market would have inferred the Potential Penalty Information from the other three categories of information, particularly the Late TTR Information. 1191 It will be appreciated that, at this point in their case, the applicants, like Professor Easton, do not differentiate between the Late TTR Information, the Account Monitoring Failure Information, or the IDM ML/TF Risk Assessment Non-Compliance Information, or the various pleaded forms of that information. The applicants further contend that it does not matter that the content of the various pleaded forms of the Information change due to "temporal differences". 1192 I do not accept that submission. It is to be borne in mind that, here, the inquiry is whether, in the relevant period, and if so when, the market price of CBA shares was artificially inflated because of the Bank's alleged non-disclosure of material information or its alleged misleading or deceptive conduct. There are important differences in content between the different categories of Information, and the various pleaded forms of that Information, which the applicants allege the Bank should have disclosed to the market. It cannot be assumed that each category and form, if disclosed, would have had the same, or any, market impact. 1193 Moreover, to ignore "temporal differences" is to ignore, and thus fail to address, the important question of the market circumstances that existed when the applicants say the different categories of the Information, and the various pleaded forms of that information, or combinations of information, should have been disclosed. 1194 These matters are plainly relevant to determining whether there was artificial share price inflation. As Foster J remarked in Masters (at [389]): The enquiry has to commence with a finding, based upon the relevant facts and any pertinent expert evidence, that, had the information which was not disclosed … been disclosed, the market price of shares in [the company] would have been lower. … 1195 Further, regardless of whether the market would have inferred the Potential Penalty Information from the other three categories of information, the Potential Penalty Information is not equivalent to the fact that AUSTRAC had commenced proceedings against the Bank for civil penalties. It is, in fact, different information which speaks of no more than the Bank's potential exposure to enforcement action that might result in the Bank paying a substantial civil penalty. 1196 From this imprecise foundation, the applicants argue: … the consequence of a finding of immateriality in relation to any one piece of information would not result in a change to the abnormal return. To put it very bluntly, even if the IDM ML/TF Risk Assessment Information or Account Monitoring Failure Information was either generally available or not material (which is denied), the inflation removed would (sic) on 3-4 August 2017 would be the same ($3.29) and that inflation would be wholly attributable to the information released on that day which was new and material. 1197 The applicants continue: Accordingly, the event study shows that if the information disclosed in the 3 August 2017 disclosures contained any of the Late TTR Information, the IDM ML/TF Risk Assessment Information, Account Monitoring Information, or the Potential Penalty Information (as long as they were each new and material pieces of information), there is an overwhelming inference that the $3.29 excess return was attributable at least in part to those pieces of information. If CBA ought to have disclosed them earlier, then it also follows that the share price was inflated between the date of CBA's continuous disclosure contraventions and the date of 3 August 2017. This is all that is required to found the inference of causation, with the result that the Court is thereafter engaged in a valuation exercise. However, lest there be any doubt, the applicants do contend … that the 3 August 2017 announcements were, as a matter of economic substance, equivalent to the information that ought to have been disclosed had CBA complied with its statutory obligations.

The applicants' submissions that CBA shares were trading at an inflated price

Pathway 1A 1198 The applicants submit that there are "multiple mutually reinforcing bases" that demonstrate why the Bank's contraventions of s 674(2) of the Corporations Act caused Mr and Mrs Baron, and Group Members, to acquire CBA shares at an inflated price during the relevant period. 1199 First, the applicants submit that a finding that CBA shares traded at an inflated price in the relevant period can be inferred by applying the efficient market hypothesis to a finding that the Information (or some part of it) was material (hence the Bank's contravention). The applicants argue that this fact can be demonstrated by the price reaction to the 3 August 2017 announcement: … (B)ecause abnormal returns are only experienced in response to new material information, if (as is the case) the September 2015 Late TTR Information was new material information then because the market reaction on 3 August 2017 was to material information contained in a market disclosure that included the September 2015 Late TTR Information (i.e, that there had been 53,306 TTRs not lodged over a 2 year period from 2012 to 2015, etc), it necessarily follows that the September 2015 Late TTR Information was a material contributing cause of the abnormal price reaction on that date even if some other piece of new material information was also a material contributing cause. Identifying two pieces of new material information which together caused an abnormal price reaction necessarily means that each of them materially contributed to it. This is sufficient to establish causation. Even if it were not possible to separate out the relative contributions of the two pieces of material information, one could still conclude that each contributed in some measure, and thus that each caused part of the price impact. 1200 As I have already noted, the applicants contend that the consequence of this reasoning can only be avoided if the Bank establishes that the whole of the price reaction to the 3 August 2017 announcement, which in fact occurred, is attributable to "something other" than the components of the announcement that correspond to the Information. 1201 Secondly, the applicants submit that a finding that CBA shares traded at an inflated price is demonstrated by Professor Easton's event study. This submission, however, appears to be nothing more than an aspect of the first submission, in that this submission simply identifies the evidence of an abnormal return on 3 and 4 August 2017. 1202 Thirdly, the applicants submit that a finding that CBA shares traded at an inflated price in the relevant period is supported by the evidence given by Professor da Silva Rosa and Mr Johnston. This is because both witnesses considered that: (a) the information disclosed in the 3 August 2017 announcement and (b) each pleaded form of the Information, were economically equivalent. The applicants submit that this evidence proves the assumption that Professor Easton was asked to make. They submit that, for this reason, the Court can have "further confidence" that Professor Easton's event study is "a sound basis to infer that the price of CBA shares would have been lower to some extent had the pleaded information been disclosed [to] the market as it should have been". 1203 Fourthly, the applicants submit that a finding that CBA shares traded at an inflated price is supported by Mr Ali's evidence. This is because Mr Ali said that "the substantial majority" of the market reaction to the 3 August 2017 announcement was a consequence of the fact that AUSTRAC had commenced proceedings against the Bank - meaning (according to the applicants) that not all the market reaction was caused by the disclosure that proceedings against the Bank had been commenced. They contend, once again, that once it is accepted that some of the market reaction was caused by the subject matter of the proceedings - meaning the Information or some part of it - causation is established. I have already commented on the question-begging nature of this submission.

Pathway 1B 1204 The applicants submit that there is "little doubt" that investors would be concerned as to the level of the Bank's compliance with the AML/CTF Act and its continuous disclosure obligations. The applicants submit that the Compliance Representations and the Continuous Disclosure Representation concerned "price-sensitive matters" that "were material to the market". 1205 Having regard to the fact that CBA shares traded in an efficient market, the applicants contend that the information comprising the Compliance Representations and the Continuous Disclosure Representation "was quickly assimilated into the market price of CBA's shares". Therefore, the Bank's misleading or deceptive conduct in making, and failing to correct, the representations was a cause of the CBA share price being inflated. As a result, Mr and Mrs Baron, and the Group Members who acquired CBA shares in that "inflated market", suffered loss because "they paid too much". 1206 The applicants submit: The fact they paid too much can be seen from the fact that the measure of how much they overpaid is at least the same as the inflation contained in the CBA share price, because CBA ought to have ceased to engage in the misleading conduct by revealing the true position, namely the Late TTR Information, the IDM ML/TF Risk Assessment Information, the Account Monitoring Failure Information, and/or the Potential Penalty Information.

Pathway 1C 1207 The applicants submit that the 2015 Cleansing Notice would have had the same effect on the price of CBA shares as the Compliance Representations and the Continuous Disclosure Representation. Therefore, according to the applicants, the Bank's contravention in publishing and failing to correct the 2015 Cleansing Notice was a cause of the CBA share price being inflated. The applicants contend, once again, that Mr and Mrs Baron and Group Members acquired shares in that "inflated market" and thereby suffered loss because "they paid too much".

Pathways 2A, 2B, and 2C 1208 The applicants submit that if, by reasons of Pathways 1A, 1B or 1C, the market price of CBA shares was inflated, then the offer price for shares under the 2015 Entitlement Offer were also inflated. This is because the offer price is a discounted amount based on the "theoretical ex-rights price" (TERP) of CBA shares. The TERP is, itself, based on the traded price of the shares after the announcement of the offer. Therefore, to the extent that that price embeds inflation, so too will the TERP (and thus the offer price calculated at a discount to the TERP).

2015 Entitlement Offer alternative pathway 1209 The applicants advance an alternative case in relation to the 2015 Entitlement Offer. They contend that the late TTR issue warranted the Bank "suspending, cancelling, or withdrawing" the 2015 Entitlement Offer. In developing that case, the applicants argue that the August 2015 Late TTR Information ought to have been released to the market and that, had that been done, the Bank would have "at least deferred the entitlement offer pending a full understanding of the late TTR issue, and its disclosure implications". The market would then have digested the new information and considered its impact on price or value, including whether the offer price was realistic. This, however, did not occur and "money was paid over which would not have been paid over". 1210 This, as I understand it, is a contention that, had the 2015 Entitlement Offer been suspended, cancelled, or withdrawn, transactions which did take place would not have taken place. But as the 2015 Entitlement Offer had not been suspended, cancelled, or withdrawn, the transactions that did take place were at an inflated price.

Analysis 1211 Having already found that the applicants' case on liability cannot be established for the various reasons I have given above, I do not propose to add to the obiter remarks concerning the availability of market-based causation as a mechanism for establishing the link between a finding of contravention and a finding of loss that is compensable by an award of damages or other pecuniary relief. I am content to proceed on the assumption that market-based causation is an available mechanism. There are, however, numerous difficulties in applying that mechanism in the present case. (I note that the Bank maintains, at least formally, that market-based causation is not available at all as a mechanism of causation.)

Pathway 1A 1212 As will be apparent, the applicants' case on causation under Pathway 1A is intertwined with the market reaction to the 3 August 2017 announcement and the fact that Professor Easton's event study showed that that reaction was reflected in an abnormal return on the CBA share price. 1213 The applicants' case on causation is also premised on the Court finding the materiality (of the relevant information) that is necessary to sustain a contravention of s 674(2)(c)(ii) of the Corporations Act. 1214 Proceeding from (a) the fact of an abnormal return, as established by Professor Easton's study, and (b) the assumption that materiality in the requisite sense has been established, the applicants then (c) call in aid the efficient market hypothesis to contend that they have established a prima facie case on loss sufficient to (d) cast an onus on the Bank to establish that "the whole of the price reaction which in fact occurred" following the 3 August 2017 announcement was attributable to something other than any part of the pleaded Information that was contained in that announcement. The applicants contend that, absent the Bank discharging that onus, (e) loss has been established for which the Bank is causally (and therefore legally) responsible. 1215 I do not accept any of the steps in this reasoning. 1216 First, Professor Easton was at pains to stress that, in his event study, the "event" comprised four inseparable elements - the message, the medium, the analysis and the interpretation of the Alleged Corrective Disclosures made on 3 August 2017. Professor Easton did not profess to have studied any other "event". Similarly, Professor Easton did not profess to have studied any "event window" other than the period 3 - 4 August 2017. 1217 The answer given by Professor Easton to the second question he was asked was driven by the core assumption he was instructed to make. He did not substantively address the question whether the traded price of CBA shares on the ASX would have been affected if the Bank had disclosed the information in the Alleged Corrective Disclosures from the beginning of, and at any time during, the relevant period. 1218 More specifically, he was not asked to address, and did not address, whether the traded price of CBA shares on the ASX would have been affected if the Bank had disclosed any particular pleaded form of the Late TTR Information, or of the Account Monitoring Failure Information, or of the IDM ML/TF Risk Assessment Non-Compliance Information, or if the Bank had disclosed the Potential Penalty Information, or some particular combination of the Information, at the particular time at which the applicants allege the Bank should have disclosed any of that information (i.e., at a particular time earlier than the "event window" actually studied by Professor Easton). 1219 Secondly, for the reasons I have previously given, I do not accept that any of the pleaded forms of the Late TTR Information, the Account Monitoring Failure Information, the IDM ML/TF Risk Assessment Non-Compliance Information, or the Potential Penalty Information, is equivalent, in any sense, to the information disclosed in the 3 August 2017 announcement (and hence the Alleged Corrective Disclosures). I am satisfied that the information conveyed by the 3 August 2017 announcement (and hence the Alleged Corrective Disclosures) was materially, and significantly, different to the information conveyed by each of the pleaded forms, or any combination of the pleaded forms, of the Information. 1220 Thirdly, for the reasons I have previously given, I do not accept that each category of the Information, or the various pleaded forms of that information, would have conveyed the same "value-relevant implications to investors" as the 3 August 2017 announcement (and hence the Alleged Corrective Disclosures). In this regard, I have not accepted Professor da Silva Rosa's opinion or Mr Johnston's opinion that each of the categories of the Information, the various pleaded forms of that information, and the information in the 3 August 2017 announcement, are "economically equivalent". 1221 Fourthly, for the reasons I have previously given, I do not accept that each of the categories of the Information and the various pleaded forms of that information were "material" in the requisite sense. 1222 Fifthly, even if I had found that the Information (or some part of it) was "material" in the requisite sense, it does not necessarily follow from such finding that the Bank's failure to disclose the Information (or some part of it), in the relevant period, resulted in the market price of CBA shares being artificially inflated in that period. 1223 Sixthly, and relatedly, the applicants bear the onus of proving the existence of loss (on their case, that CBA shares were acquired at an artificially inflated market price). The Bank does not bear an onus of negativing the existence of loss. 1224 Seventhly, the correct approach to establishing loss is to start with the precise information that the applicants allege the Bank should have disclosed, and the time when, they allege, the Bank should have made the disclosure. From that starting point, the hypothetical inquiry is whether the disclosure of that information to the market at that time would have resulted in CBA shares trading on the ASX at a lower price than happened to be the case. 1225 This hypothetical inquiry is, in fact, the simple, uncomplicated inquiry that the applicants urge the Court to undertake. It is not, however, the case that the applicants have presented. Rather, the applicants have invited the Court to start from the existence of the abnormal return that Professor Easton identified from the "event" that he had analysed - which I have found is not the same as any of the pleaded forms of the Information - and then to infer - based on reasoning and assumptions which I also do not accept and have rejected - that loss has occurred. 1226 Conspicuously, the applicants have not attempted to differentiate between the various categories of the Information, or their variously pleaded forms. Thus, as presented, the applicants' case is that, in terms of market price effect, each category of the Information, each pleaded form of the Information, and each combination of the Information, had it been disclosed by the Bank at any time during the relevant period, would have resulted in not only a particular market price effect (a lower market price for CBA shares), but the same price effect and, hence, the very same loss, which then endured for the remainder of the relevant period. If this be so, these are facts to be proved, not assumed. They have not been proved. 1227 I am not satisfied, therefore, that the applicants have established that, had the Information (or any part of it) been disclosed at any particular time in the relevant period, the market price of CBA shares would have been lower immediately following the disclosure or, indeed, that any lower price would have endured for the remainder of the relevant period. 1228 Eighthly, the applicants have not adduced evidence of the kind referred to by Beach J in TPT at [1671] (i.e., as to whether they would have acquired their CBA shares, or acquired those shares at the price they paid, if, at that time, they had known the precise non-disclosed information). 1229 This is important so far as the applicants claim to have suffered loss. I have already recorded Mr and Mrs Baron's and Zonia's acquisition of CBA shares in the relevant period, and their investment behaviour in relation to CBA shares following the 3 August 2017 announcement. As I have said, the evidence does not support a finding that, as a result of the disclosures in the 3 August 2017 announcement, they upwardly revised their estimates of the Bank's operational risk or increased their estimates of the Bank's reputational risk, or that they regarded those disclosures as having any adverse financial consequences for them in holding CBA shares. Indeed, the evidence supports an inference that Mr and Mrs Baron, and Zonia, were each indifferent to the disclosures in the 3 August 2017 announcement and simply took no notice of it in relation to their holding and, in Zonia's case, further acquisition, of CBA shares. This, then, supports an inference that Mr and Mrs Baron, and Zonia, would also have been similarly indifferent to the disclosure of any of the pleaded forms of the Information. As Mr and Mrs Baron have elected not to give evidence, and as Zonia has elected not to call evidence from any officer of the company, I can more safely draw, and do draw, these inferences. 1230 For these reasons, the applicants have not established their case on causation and loss through Pathway 1A.

Pathway 1B 1231 I reach the same finding in relation to the applicants' case on causation and loss through Pathway 1B, assuming the Compliance Representations and the Continuous Disclosure Representation to have been made, and to have been misleading or deceptive (a matter which I have not found it necessary to consider in relation to the Compliance Representations). 1232 Making those assumptions, it is still necessary for the applicants to prove that, at a particular time in the relevant period: (a) the market price of CBA shares was artificially inflated; (b) the Bank's conduct (its failure to correct the representations it allegedly made) was a cause of that inflation; and (c) they purchased CBA shares at that artificially inflated price. 1233 The applicants' mode of proof is substantially the same as their mode of proof of Pathway 1A, and suffers similar deficiencies. Pathway 1B commences from the result of Professor Easton's event study and, by inference, posits the Bank's (assumed) misleading or deceptive conduct as a cause of the abnormal result that Professor Easton identified, because the representations the Bank allegedly made "concerned price sensitive matters" and "were material to the market". 1234 However, the alleged representations are not the same as the "event", and do not concern the "event window" that Professor Easton analysed. The applicants have not sought to establish, independently of Professor Easton's study, that the alleged representations, if made, and the failure to correct such representations, would have had an effect on the market price of CBA shares at any particular time in the relevant period.

Pathway 1C 1235 Given the way in which the applicants advance Pathway 1C (which is dependent on price inflation being established by Pathway 1B), I reach the same finding in relation to this pathway as I do in relation to Pathway 1B.

Pathways 2A, 2B, and 2C 1236 The applicants' case on Pathways 2A, 2B, and 2C is not made out because those pathways are dependent on Pathways 1A, 1B, and 1C succeeding. 1237 In any event, Mr Ali and Mr Johnston agreed that the offer price under the 2015 Entitlement Offer could not have affected whether a shareholder was, economically, better off or worse off by having participated in the capital raising. A pro rata rights offer (such as the 2015 Entitlement Offer) is non-dilutive. The value of a participating shareholder's total shareholding following a pro-rata rights offer for a consistent amount, is independent of the price (or size of discount) at which the rights offer is conducted. The shareholder is still required to contribute the same amount of money. The amount of the offer price might determine the number of shares issued under the offer (for example, more shares might be issued at a lower price), but the shareholder's proportionate shareholding after the offer remains the same. It follows that these pathways cannot lead to a loss.

2015 Entitlement Offer alternative pathway 1238 The alternative pathway advanced by the applicants is difficult to follow. The contention that, had it known the August 2015 Late TTR Information, the Bank would have suspended, cancelled, or withdrawn the 2015 Entitlement Offer appears to me to be completely beside the point. I am unable to see how this pathway adds to the applicants' existing case on causation and loss in any meaningful way. And, as I have noted, the offer price under the 2015 Entitlement Offer could not have affected whether a shareholder was, economically, better off or worse off by having participated in the capital raising, in any event. Therefore, the 2015 Entitlement Offer alternative pathway seems to me to be both theoretical and inconsequential. 1239 In case I have misunderstood the point, the evidence does not suggest, and I am not persuaded, that, had the Bank known the August 2015 Late TTR Information in the period between 12 August and 8 September 2015, it would have suspended, cancelled, or withdrawn the 2015 Entitlement Offer. 1240 Mr Cohen gave evidence on this point. As I have recorded, he knew about the late TTR issue as a result of an email sent by Mr Narev on 6 September 2015 (Mr Cohen was one of the recipients). Mr Cohen was the Chair of the DDC for the 2015 Entitlement Offer. Mr Dingley was also on the DDC. The DDC was responsible for overseeing the due diligence process established by the Bank in connection with the preparation of the offer documents. This task included identifying potentially significant matters that might be market sensitive. 1241 As I have recorded, Mr Cohen said that he regarded the late TTR issue, at that time, to be simply a compliance issue. Although it was an unsatisfactory occurrence, he did not consider it to be an issue that met the threshold for disclosure. Furthermore, he could not recall any discussion with Mr Toevs or Mr Dingley about AML/CTF compliance issues in the context of the 2015 Entitlement Offer. 1242 Mr Narev said that, prior to AUSTRAC commencing proceedings against the Bank, he did not regard the late TTR issue as something to be disclosed to the market. Mr Narev gave considered reasons for that view and was not substantively challenged on those reasons. 1243 Mr Apte was on the Bank's Risk Committee. He first became aware of the late TTR issue in October 2015. Although this was after the 2015 Entitlement Offer, his view, at that time, still assists in considering the present question. His evidence was that, at that time, he did not consider the late TTR issue to be material information that needed to be disclosed to the market in accordance with the Bank's continuous disclosure obligations. 1244 Collectively, this evidence points persuasively to the contrary finding that, had the Bank known of the August 2015 Late TTR Information (which must include all appropriate contextual information), it would not have suspended, cancelled, or withdrawn the 2015 Entitlement Offer.

Conclusion 1245 Even if the applicants had succeeded in their case on contravention, I would not have found that their case on causation and loss had been established.

Damages 1246 Leaving to one side the fact that the applicants' case has failed at a number of levels - so that one never gets to the assessment of damages - I have reached the conclusion that their case on the assessment of damages also fails, for the following briefly stated reasons. 1247 The measure of damages the applicants seek is share price inflation. They advance two approaches to quantifying that inflation. 1248 The first approach is to rely on the result of Professor Easton's event study. There are obvious difficulties with that approach. It proceeds on the acceptance of a number of propositions which I have already rejected, including that the Information which the applicants contend should have been disclosed (or some part of it) is economically equivalent to Professor Easton's Alleged Corrective Disclosures. For the reasons I have already given, that approach cannot succeed. 1249 The second approach also relies on the result of Professor Easton's event study. It is, therefore, flawed at the outset. Even so, in this approach the applicants contend that if the Court finds that some part of the price impact determined by Professor Easton was not causally related to the non-disclosure of the information the applicants say should have been disclosed, the Court should adjust the artificial inflation derived from the event study to award, as best it can, compensation which "strips out" the impact of the disclosure of "unrelated matters". 1250 The problem with this approach is that Professor Easton's own evidence establishes that his event study cannot be used for this purpose, as I have previously explained. Therefore, this approach also cannot succeed. 1251 Apart from these matters, a further difficulty with the second approach is determining, rationally, what adjustment should be made in any event. 1252 In this regard, the applicants submit that data from the Lieser paper is available to guide the Court. Whilst that data might be of academic interest (which is the purpose for which the Lieser paper was written), I do not consider it to be useful for the purpose of assessing damages, and would not use it in the present case. The Lieser paper simply does not deal with the case that the applicants have presented, and says nothing about the value relevance of information in the market conducted in Australia by the ASX in the relevant period. 1253 The applicants also suggest that guidance can be provided by the market reaction in the NAB case study, which I have discussed. I do not accept that the NAB case study provides any reliable guidance for the assessment of damages in the present case. Apart from the fact that the 7 June 2021 announcement by NAB conveyed different information to the information that the applicants say the Bank should have disclosed in the present case, NAB's announcement occurred in entirely different market circumstances than existed in the relevant period. 1254 These conclusions mean that the Court is left with no evidence of the valuation of the loss that the applicants claim. Nevertheless, the applicants urge the Court to assess compensation in a "robust manner". They rely on the settled rule that mere difficulty in estimating damages does not relieve a court from the responsibility of assessing damages as best it can: The Commonwealth of Australia v Amann Aviation Pty Limited [1991] HCA 54; 174 CLR 64 at 83 (Mason CJ and Dawson J) and 125 (Deane J). 1255 In closing submissions, the applicants drew attention to my decision in Sanda v PTTEP Australasia (Ashmore Cartier) Pty Ltd (No 7) [2021] FCA 237 at [1057] - [1058] as illustrating that rule. In that case, I considered a submission to the effect that, notwithstanding the existence of a proven loss (the loss of a seaweed crop due to the presence of oil), the paucity of reliable evidence of the lead applicant's seaweed production and costs meant that damages could not be assessed. Contrary to that submission, I was satisfied that there was a way in which the applicant's loss in that case could be quantified by making reasonable estimates, on the available evidence, of both the applicant's seaweed production and his costs of that production: see at [1060] - [1162]. 1256 The present case is different. First and foremost, there is no proven loss. Secondly, and in any event, once the limitations of Professor Easton's event study are recognised (as Professor Easton himself recognised), there is no rational starting point for the valuation of the inflation that the applicants allege. 1257 As recognised by Brereton J in HIH at [78], the valuation question in a case such as the present is inextricably bound up with the problem of establishing loss in the first place. Just as Professor Easton's event study cannot be used to establish loss in the present case - and, in the absence of appropriate evidence, there is no reason to assume that there has been or would have been loss - so too his event study cannot be used to value the alleged loss. 1258 The present case is not one involving a paucity of evidence. It is a case involving the absence of proof of these two critical matters. Contrary to the applicants' submissions, this is not a problem of the Bank's making. The present case is not one where the principle in Armory v Delamirie (1722) 1 Stra 505; 93 ER 664 applies. The applicants cannot lay the blame for the deficiencies in their own proof at the feet of the Bank.

Further submissions 1259 When judgment in these proceedings was reserved, the Bank applied for leave to file written submissions on the implications of two cases that had been decided after the delivery and presentation of the parties' closing submissions: Crowley v Worley Limited (No 2) [2023] FCA 1613 and McFarlane as Trustee for the S McFarlane Superannuation Fund v Insignia Financial Ltd [2023] FCA 1628. Both cases concern shareholder class actions involving allegations of breaches of continuous disclosure obligations and misleading or deceptive conduct, in which reliance was placed on market-based causation. 1260 Despite the applicants' contention that the Bank has not established the burden required for the grant of leave, I am satisfied the leave should be granted. Both cases are recent contributions to the learning in this area and constitute part of a developing legal landscape which should be brought to the Court's attention. 1261 The Bank filed submissions on these cases on 9 February 2024, the applicants filed responsive submissions on 16 February 2024, and the Bank filed reply submissions on 20 February 2024. 1262 I considered these submissions after reaching the conclusions, and making the findings, expressed above. I am satisfied that nothing I have said runs counter to the principles that were discussed and applied in those cases, insofar as those principles are applicable to the present case. Further, despite the extensive debate between the parties on a variety of matters ventilated in their further submissions, there is nothing in them that has caused me to change or modify my views, or to alter the way in which I think that the present case should and must be decided. 1263 In these circumstances, I do not consider it to be necessary for me to summarise the parties' further submissions or to engage in any analysis of either of the cases to which they refer, which largely turned on their own facts and the forensic positions taken in them.

Disposition 1264 Each proceeding should be dismissed. I see no reason why costs should not follow the event. However, I will, if necessary, hear the parties on that question should there be some consideration, of which I am not aware, that bears on the costs order that should be made. 1265 The parties should prepare draft orders providing for the disposition of both proceedings, including the answers that should be given to the common questions. If there is any disagreement about the orders that should be made, or the answers that should be given, or if the parties consider that some further finding should be made by the Court, then my Associate should be advised of that fact by a joint communication from the parties. I will then make the appropriate case management orders to enable final orders to be made. I certify that the preceding one thousand two hundred and sixty-five (1265) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Yates.