Commonwealth Bank and AUSTRAC

As of November 2026: The A$700 million penalty was ordered on 20 June 2018 and the proceedings were otherwise dismissed. The breach counts, dates and amounts on this page were checked in November 2026 against AUSTRAC's releases, the Court's judgment and the filed statement of agreed facts. The A$400 million remediation spend and the staffing and daily-limit claims are CBA's own statements. The APRA capital add-on history comes from APRA's 2018 and 2022 releases. No later AUSTRAC action against CBA was reviewed.

Also known as: CBA AUSTRAC case · Commonwealth Bank A$700 million penalty · Commonwealth Bank intelligent deposit machines.

What happened?

On 3 August 2017, AUSTRAC began civil penalty proceedings against Commonwealth Bank of Australia (CBA), the country’s largest bank. AUSTRAC is both Australia’s financial regulator for AML and its financial intelligence unit, so it receives the reports banks must send about large cash deposits and suspicious activity. Its claim alleged over 53,700 breaches of the Anti-Money Laundering and Counter-Terrorism Financing Act.

After a court-ordered mediation, CBA admitted 53,750 contraventions and agreed a A$700 million penalty on 4 June 2018. On 20 June 2018, Justice Yates of the Federal Court ordered it, plus A$2.5 million for AUSTRAC’s legal costs according to the bank. AUSTRAC called it the largest civil penalty in Australian corporate history. It stood as the record until Westpac’s A$1.3 billion penalty in 2020.

The case centred on a new kind of machine. In May 2012 CBA began rolling out intelligent deposit machines (IDMs). They count cash and credit it to a CBA account at once, and the money can be sent on, including overseas, straight away. Everything else in the case grew out of the gap between how fast that channel grew and how slowly the bank’s controls caught up.

Which techniques did it use?

Nobody at CBA was accused of designing a laundering scheme. This section covers the exposure.

The Court found the IDM risk was high and obvious: cash could be deposited anonymously, at any time, at hundreds of locations, and moved on immediately with no limit. Monthly cash deposits through IDMs rose from A$868,825 across 5 machines in May 2012 to about A$1.7 billion across 805 machines in May 2017. Before launch, the bank did not run the IDM-specific risk assessment its own AML/CTF program required.

The bank’s records show criminal groups used that channel. By around July 2015, CBA had evidence that syndicates were laundering several million dollars through IDMs, and its own monitoring and intelligence staff had flagged it. The pattern that investigators call structuring, breaking cash into smaller deposits to avoid reports, was one of the things the bank’s alerts picked up. The admitted facts say the laundered money included proceeds of drug and firearms importation, predominantly methamphetamine.

How was it found?

The reporting failure surfaced through AUSTRAC’s own data. On 11 August 2015, AUSTRAC asked CBA about two cash deposits mentioned in a suspicious matter report the bank had filed on 7 August, because AUSTRAC could not find matching threshold transaction reports (TTRs). The bank looked and found the cause. When it added a third transaction code for some IDM cash deposits in November 2012, its automated reporting was never updated to search for that code. Those deposits were not reported from 5 November 2012 to 1 September 2015. The bank sent the missing reports late, by 24 September 2015.

The monitoring failure had a similar origin. A data-merging error in October 2012 left a field blank on 778,370 accounts, so account-level monitoring rules did not run as intended. CBA found the coding error itself in June 2014 and finished the fix in October 2015. AUSTRAC then investigated with the Australian Federal Police and the New South Wales and Western Australia police forces before filing its claim.

What was the outcome?

The Court’s declarations covered:

• 14 breaches of the bank’s own program for failing to assess IDM risk and add suitable controls.
• One breach for the account monitoring failure across 778,370 accounts.
• 53,506 late TTRs for IDM cash deposits of A$10,000 or more, about 95% of such deposits and worth A$624.7 million. Of these, 1,656 reports (about A$17.5 million) related to syndicates under investigation by the AFP.
• 149 late or missing suspicious matter reports: 120 on possible crime and 29 on accounts opened with false identification by two members of a criminal syndicate.
• 80 customers not sufficiently monitored.

The penalty was agreed first, then examined by the Court, which said the sum marked its strong disapproval of the conduct. The Court noted none of the breaches was deliberate and that the bank cooperated, admitted fault early and had no earlier breaches. It still described the failures as serious and systemic, saying AUSTRAC and the police were denied timely intelligence on about A$625 million of cash transactions.

What were the warning signs?

Most of them sat in the bank’s own systems.

• A fast-growing cash channel with no risk assessment. Monthly cash deposits rose from under A$1 million to about A$1.7 billion in five years, yet the first assessment came only in July 2015, and it did not follow the bank’s own procedures.
• Reports that stop when a system changes. A new transaction code broke the link between deposits and reports, and no routine check compared cash deposits with reports filed.
• Known guidance, no action. AUSTRAC gave banks a confidential brief on ATM deposits on 18 December 2015, describing the lack of daily deposit limits plus anonymous cash deposit as a significant vulnerability. CBA relied on after-the-event monitoring and set limits only from November 2017.
• Alerts that never fire or sit unread. Monitoring rules did not run on 778,370 accounts, and in some cases alerts went unreviewed for months.
• Reporting treated as done. Staff skipped new suspicious matter reports where the bank had filed one in the last three months about a similar pattern, which the bank later said was a misunderstanding of the law.
• Slow exits. Where accounts were closed, customers got 30 days’ notice, and in 20 cases laundering continued during that time with no extra monitoring.

What changed afterwards?

CBA said it had spent over A$400 million on systems, processes and people for AML/CTF compliance by June 2018. It also reported over 300 specialist staff, an upgraded monitoring platform, a customer-onboarding hub and daily cash deposit limits on IDMs. The admitted facts record the limits arriving in two steps: A$20,000 for personal accounts using a CBA card in November 2017, then an account-based A$10,000 limit on 12 April 2018.

A second, wider check ran in parallel. In August 2017 APRA, the prudential regulator, announced a Prudential Inquiry led by an independent panel into the bank’s governance, culture and accountability. Its report of 1 May 2018 said that “CBA’s continued financial success dulled the senses of the institution” and that pay and accountability rules had little effect on senior managers until the AUSTRAC action. APRA imposed a A$1 billion capital add-on and an enforceable undertaking. It cut the add-on to A$500 million in November 2020 and removed the rest on 30 September 2022 after it validated the bank’s remediation.

For the wider industry, the lesson is that a bank must test that its reporting still works after every system change. See the detection overview and reporting for how these reports feed investigations, and the TD Bank case for a US example of monitoring that left most activity unwatched.

First published November 4, 2026 · Last updated November 4, 2026 · Legal statuses current as of November 2026