Commonwealth Bank let 53,700 cash deposits go unreported — and paid A$700M

Commonwealth Bank of Australia (CBA) is the country's largest bank. Between 2012 and 2015 it rolled out Intelligent Deposit Machines — ATMs that let customers deposit cash and have it credited to an account almost immediately. The machines were configured to post funds before the transaction was logged for reporting, and the bank's systems never generated the reports the law requires.

Under Australia's anti-money-laundering and counter-terrorism-financing (AML/CTF) laws, a cash deposit of A$10,000 or more must be reported to the financial intelligence agency, AUSTRAC. CBA failed to report about 53,700 such transactions. It also failed to monitor or assess the risk on the accounts behind them, so patterns that should have triggered scrutiny went unseen for years.

In August 2017 AUSTRAC filed a statement of claim in the Federal Court — the largest civil penalty action it had ever brought. CBA admitted the breaches and agreed to the facts. In June 2018 the Federal Court imposed a A$700 million penalty, the largest civil penalty in Australian corporate history at the time.

The case is now a standard compliance lesson: a product built for speed was shipped without the reporting it legally required, and the control failure sat undetected for years. The bill was not the cost of the deposits — it was the cost of a bank that did not know what its own machines were doing.