Westpac penalised $26 million after 1,013 online hardship applications went astray

The number attached to the penalty is 277. The number in the findings is 1,013.

On 26 May 2026 Justice Timothy McEvoy of the Federal Court ordered Westpac Banking Corporation to pay a $26 million pecuniary penalty in Australian Securities and Investments Commission v Westpac Banking Corporation [2026] FCA 651. The declared contraventions are 277 breaches of section 72(4) of the National Credit Code, which requires a credit provider to give a customer a written decision on a hardship notice within 21 days, together with contraventions of sections 47(1)(a) and 47(4) of the National Consumer Credit Protection Act 2009, the obligation to engage in credit activities efficiently, honestly and fairly.

The 277 are the customers who never received a decision at all. Behind them sits the finding that at least 1,013 online hardship applications, lodged by 1,003 customers between 2 October 2015 and 7 June 2023, were not properly transferred or processed. The civil penalty period is narrower than the conduct period, running from 4 September 2017 to 8 May 2023.

The failure was a pipeline, not a policy. The applications were made through an online form. Four categories of system fault stopped them reaching the people who decide hardship: network and batching errors when data was transferred between systems, configuration errors affecting handoffs between systems, an inability to process forms that contained an invalid account number, and data formatting problems that prevented applications loading. The bank did not refuse the requests. It did not see them. The failures span four brands, Westpac, St George, BankSA and Bank of Melbourne, and four products, home loans, credit cards, personal loans and car loans.

The consequences were not administrative. Twenty one of the affected customers had debts sold to third parties. Ten became bankrupt or entered debt agreements. Twenty two received adverse credit ratings. The court found some customers suffered irreparable and life changing harm through enforcement action taken while a hardship request sat unanswered.

The penalty was contested, not agreed. ASIC sought $30 million. Westpac argued for $10 million, which Justice McEvoy described as little more than derisory. He found the conduct very serious and grossly negligent, said it affected many vulnerable customers and continued over an extended period, and rejected the characterisation that a systems fault made the failure less culpable. Westpac accepted the breaches and attributed them to ageing technology, manual workarounds, batching errors and a siloed approach to root cause investigation, rather than deliberate refusal. ASIC deputy chair Sarah Court said Westpac's systemic failures let the very customers who needed help slip through the cracks. The bank has paid more than $1.7 million in remediation, made up of fee and interest refunds and compensation.

The judgment also does something new with the statute. Section 175A of the National Consumer Credit Protection Act commenced on 13 March 2019. This is the first decision to apply it to conduct that began before that date. The court held that the relevant conduct was the continuing failure to deliver a decision notice, not the original omission, so each day the failure persisted after 13 March 2019 was a fresh contravention. That reasoning captured 54 additional affected customers who would otherwise have fallen outside the penalty regime.

What is unresolved is whether Westpac is unusual. The finding is about one intake channel: a web form feeding a legacy back end, with no control that reconciled forms submitted against forms received. Nothing in the judgment addresses how other Australian lenders capture digital hardship requests, and no regulator has published a comparison. Hardship notices rose sharply through the period covered, and every large lender now takes them online.

The second open question is completeness. The 1,013 figure is what Westpac and ASIC agreed could be identified from surviving records across a period beginning in October 2015. Applications that failed to load, by definition, may leave no trace. Neither the court nor ASIC has said the count is exhaustive.