The Case
Citation: Australian Securities and Investments Commission v Westpac Banking Corporation [2026] FCA 651
Court: Federal Court of Australia
Judge: McEvoy J
Date of judgment: 26 May 2026
The Federal Court has ordered Westpac to pay a $26 million pecuniary penalty for failing to respond to 277 online hardship notices from vulnerable customers between October 2015 and June 2023. McEvoy J’s reasons are the first to apply section 175A of the National Consumer Credit Protection Act 2009 (Cth) to a contravention that started before the section’s commencement on 13 March 2019. Credit licensees with legacy compliance gaps should read this judgment closely.
Key Takeaways
The core lesson from this decision is simple: compliance with customer-facing obligations, particularly hardship, cannot be meaningfully separated from operational capability. Hardship obligations are not met by policies alone – they are met by systems that work, risk frameworks that detect failures early, and complaints processes that escalate patterns before they become systemic breaches.
What the court decided
ASIC sought $30 million. Westpac argued for $10 million. McEvoy J settled on $26 million (at [195]).
Two sets of admitted contraventions sat behind the penalty:
- 277 breaches of section 72(4) of the National Credit Code. That is the rule which requires a credit provider to give a written decision notice on a hardship application within 21 days.
- A failure to act “efficiently, honestly and fairly” under section 47(1)(a) and (4) of the National Consumer Credit Protection Act 2009 (Cth). The court treated the hardship-processing systems and the risk-monitoring layer above them as separate contraventions (at [186]).
The cause was systems and operational failure: ageing technology, manual workarounds, batching errors, and a siloed approach to root-cause investigation. The problem surfaced only when one customer rang Westpac to ask why no one had replied (at [102]).
The customers were a vulnerable group: those experiencing illness, family violence, COVID-19 unemployment, carers of dependants in those situations (at [121]). On at least 21 occasions, customers had their debts sold to third-party debt purchasers. Ten customers became bankrupt or entered a debt agreement (at [123]–[125]). Adverse credit ratings were reported for no fewer than 22 customers (at [124]). The circumstances show that significant, irreparable customer harm was caused to a vulnerable customer cohort.
The fact that a remediation program for affected customers was conducted did not warrant a material reduction in the imposed penalty.
Section 175A: the continuing-contravention reach
Section 175A was introduced by the Treasury Laws Amendment (Strengthening Corporate and Financial Sector Penalties) Act 2019 (Cth). It says that where a civil penalty provision requires an act by a particular time, the obligation continues until the act is done. A fresh contravention happens on each day the failure runs on.
Based on the transitional rule, section 175A applies only to conduct occurring “wholly on or after” 13 March 2019. Westpac argued that any hardship-notice breach which started before that date was complete on the day the 21-day window closed and outside ASIC’s reach.
McEvoy J disagreed (at [54]–[55]). The “conduct constituting the contravention” for section 175A purposes is the continuing failure to give the decision notice, not the original breach. If the failure was still running on or after 13 March 2019, the section bites even if the customer’s notice was filed in 2015 or 2016. The court captured 54 further affected customers on that basis (at [56]).
This pushes the analysis past ASIC v National Australia Bank [2025] FCA 947 (Neskovcin J) and ASIC v Australia and New Zealand Banking Group Limited (Retail Cases Omnibus) [2025] FCA 1593 (Beach J). Both applied section 175A only to conduct after commencement. Neither tested the pre-commencement reach.
There is one caveat: McEvoy J accepted at [57] that, even on Westpac’s narrower reading, the penalty would not have shifted in any real way. The section 175A holding is therefore not strictly required for the outcome. The reasoning is still detailed, and it will be cited.
“Grossly negligent” even where the conduct was not deliberate
ASIC did not allege deliberate or reckless conduct. Senior management was not aware of the issue until around February 2022.
McEvoy J still found the conduct grossly negligent (at [107], [195]). The drivers were 16 unactioned customer complaints over several years; internal IT tickets raised in 2018, 2020 and 2021 flagging “missing” hardship notices; sustained underinvestment in legacy technology; and no end-to-end review of the hardship process until April 2023 (at [105]–[108]).
For licensees, the message is plain. Unintentional systems failure plus ignored warning signs may amount to gross negligence, and gross negligence supports a penalty that bites.
Why Westpac drew $26 million when NAB drew $13 million
The parity comparison with ASIC v NAB is the cleanest yardstick available for hardship-notice penalties. McEvoy J distinguished that case on various grounds (at [171]–[173]):
- Separate section 47 contraventions in this proceeding (NAB had none).
- Systems failure rather than human error.
- Longer contravention period.
- Greater customer harm.
- More analogous prior contravening conduct. This is Westpac’s sixth recent finding of failing to engage in financial services “efficiently, honestly and fairly” (at [133]).
- Penalty arrived at by trial, not by joint submission.
The court also rejected Westpac’s “single course of conduct” submission for the section 47 contraventions (at [186]). The systems layer and the risk-monitoring layer were treated as separate contraventions.
What credit licensees should do
- Audit hardship response times. Map every channel (online form, phone, email, branch) against the 21-day window in section 72(5). Sample-test the last 12 months.
- Review the complaint–IT ticket pathway. Unactioned complaints and unresolved IT tickets were the central factual aggravator. Review your escalation process. Investigate similar complaints and incident reports to determine whether there is a potential systemic issue. Ensure complaints and operational-incident data is aggregated, reviewed, and escalated where patterns emerge.
- Stress test your legacy systems. Where credit activity processing runs on technology more than five years old, conduct an end-to-end audit of the system(s) to ensure they are fit for purpose. If not, ensure uplifts are prioritised with appropriate progress monitoring.
- Audit historical hardship backlogs for unresolved obligations. Open hardship-notice files pre-dating 13 March 2019 may now sit within ASIC’s reach if the obligation was still live on or after that date. Don’t assume remediation will meaningfully soften the penalty, particularly if the harm was irreparable.
Frequently Asked Questions
Further Information
For further information about hardship notice obligations, ASIC enforcement risk, and credit licensee compliance systems, please contact the author of this article:
