Macquarie Bank has been slapped with a $10 million fine for its lack of controls to detect and prevent unauthorised fee transactions conducted by third parties like financial advisors.
The Australian Securities and Investments Commission (ASIC) said the bank enabled its customers to give third parties, such as stockbrokers and accountants, different levels of authority to transact on their accounts, including a limited authority to withdraw the third party's fees.
Macquarie also made available to third parties a bulk transacting tool to make multiple withdrawals across multiple customer accounts simultaneously, the securities regulator said.
ASIC Chairman Joe Longo said fraud controls were becoming increasingly important.
"This case sends an important message to financial institutions and other financial service licensees that they must have appropriate controls in place," he said in a statement.
"While Macquarie implemented effective controls from January 2020, its earlier failures meant that financial adviser Ross Hopkins was able to fraudulently withdraw around $2.9 million from his customers' accounts without being detected by Macquarie."
Longo said the regulator expected financial institutions to prioritise and invest in systems that protect their customers.
"Macquarie fell short of its obligation to do all things necessary to provide its financial services efficiently, honestly and fairly and as a result it has become liable for a substantial penalty," he said.
The regulator said Macquarie had failed to implement effective controls to monitor whether third-party bulk transactions under the fee authority were actually for fees between May 1, 2016, and January 15, 2020.
Macquarie acknowledged it had contravened a statutory obligation to provide its financial services efficiently.
The bank agreed to pay a penalty of $10 million for its conduct.
