Macquarie to pay $10m penalty for ineffective controls

The Federal Court has ordered Macquarie Bank Ltd to pay a penalty of $10 million after it was found to have ineffective controls to prevent and detect unauthorised fee transactions conducted by third parties, such as financial advisers, on certain accounts.

In the case, brought against the bank by the Australian Securities & Investments Commission (ASIC), it was alleged that Macquarie enabled its customers to give third parties, such as financial advisers, stockbrokers, and accountants, different levels of authority to transact on their accounts, including a limited authority to withdraw the third party’s fees.

Macquarie was also alleged to have made available to third parties a bulk transacting tool to make multiple withdrawals across multiple customer accounts simultaneously.

The court found that between 1 May 2016 and 15 January 2020, Macquarie failed to implement effective controls to monitor whether third-party bulk transactions on customer cash management accounts (under the fee authority) were actually for fees.

The case focused on the fact that former financial adviser Ross Hopkins was able to make 167 unauthorised transactions on 13 of his client’s cash management accounts via Macquarie’s bulk transaction system. As such, he was able to fraudulently withdraw around $2.9 million from his customers’ accounts without being detected by Macquarie.

Hopkins has already been sentenced to six years’ imprisonment after an investigation and referral of a prosecution brief from ASIC and permanently banned from providing financial services or from controlling an entity carrying on a financial services business.

While Macquarie initially defended the proceeding, it later admitted that it contravened its obligation to provide its financial services efficiently, honestly, and fairly by failing to implement effective controls to prevent or detect transactions conducted by third parties through its bulk transacting system that were outside the scope of the fee authority conferred on them, including those carried out by Hopkins.

Macquarie has now agreed to pay a penalty of $10 million for its conduct.

In a statement, the bank said: "Macquarie Bank Limited and ASIC have resolved their dispute regarding the third-party fee authority on the cash management account (CMA). The Federal Court approved the parties’ proposed resolution of ASIC’s case, which it commenced in April 2022.

"The case arose in relation to an independent financial adviser who misappropriated client funds through Macquarie’s CMA between 2016 and 2019. The financial adviser, who was not a Macquarie employee, pleaded guilty to fraud and was convicted in 2021. Following his failure to compensate the clients for their losses, Macquarie took the decision to fully reimburse the 13 clients.

"Macquarie acknowledges that it had contravened a statutory obligation in connection with the controls to monitor bulk transactions made under third party fee authorities on the CMA. In 2020, Macquarie introduced new controls and processes for third party fee authorities on the CMA to address the issue."

Speaking of the finding, ASIC chair Joe Longo said: “Fraud controls are increasingly important and this case sends an important message to financial institutions and other financial service licensees that they must have appropriate controls in place.

“While Macquarie implemented effective controls from January 2020, its earlier failures meant that financial adviser Ross Hopkins was able to fraudulently withdraw around $2.9 million from his customers’ accounts without being detected by Macquarie.

“ASIC expects financial institutions to prioritise and invest in systems that protect their customers.

“Macquarie fell short of its obligation to do all things necessary to provide its financial services efficiently, honestly and fairly and as a result it has become liable for a substantial penalty.”

[Related: Corporate watchdog sues Macquarie]