ASIC says CBA left a fee problem unresolved for nine years after a red audit

Australia’s corporate regulator announced on November 12 that it had filed civil proceedings against Commonwealth Bank the prior afternoon, alleging that about 42,000 CommBiz customers were overcharged about A$8.5 million between November 2020 and May 31, 2025. The Federal Court has not decided the allegations, and no case-management hearing has been listed.

The disputed charge was a second “contra leg” fee tied to moving money into or out of a customer’s own CommBiz account. ASIC says the published terms appeared to promise one fee for each Direct Credit or Direct Debit. Its example says a small business paying 10 workers from two accounts was charged 12 fees: 10 for the employee payments and two more for the movements out of its own accounts.

The filing describes a wider historical period than the penalty-period total. ASIC’s concise statement alleges roughly A$21 million in overcharges to about 93,000 customers from December 2006 through May 2025. ASIC separately says CBA made remediation payments exceeding A$26.4 million across about 93,000 customers. Those A$8.5 million, A$21 million and A$26.4 million figures measure different scopes and should not be combined.

The accountability question begins years before the lawsuit. ASIC alleges an April 2016 internal audit rated the CommBiz control environment “red” and “unsatisfactory.” The audit required a review of terms against actual billing, a root-cause analysis and corrective action by October 2016, followed by customer remediation and permanent fixes by July 2017. ASIC alleges none of that occurred and the charging continued until May 2025.

ASIC also alleges customers raised at least 13 serious complaints from February 2015 through 2025. In December 2022, according to the filing, a customer-relations specialist said the terms did not clearly disclose charging “per transaction line” and raised a systemic issue. The filing says CBA then closed that issue on a finding of “no bank error.”

Additional controls allegedly failed to connect the billing practice to the customer terms. ASIC cites a 2019 incident framework, a 2023 public-documents procedure, a CommBiz executive action team and a 2024 quarterly billing control. It alleges those processes still missed the mismatch because the billing control treated internal eBilling information as the source of truth rather than checking actual charges, contractual authority and customer disclosures.

The filing says a senior manager warned in May 2024 that the terms did not disclose per-leg charging and that customers might see it as “double charging.” CBA opened an investigation in July 2024, but ASIC alleges the matter was initially classified as not reportable on the mistaken premise that only one relevant complaint existed. CBA first lodged a reportable-situation notice with ASIC in June 2025, the filing says.

CBA says the fee was 25 Australian cents plus GST and had been charged consistently, while an effort to simplify the terms failed to reflect the charging method accurately. The bank says it identified and reported the issue, cooperated with ASIC, completed remediation and took additional rectification steps to reduce risk. ASIC’s filing says CBA temporarily ceased the fees in June 2025, amended the terms in August 2025 and has waived the fees since February 2026. As of October 20, CBA says the median customer payment was about A$85 and the mean was about A$442 including interest.

CBA apologized to affected customers but said it does not accept the way some allegations were framed and expects to defend parts of the case or work with ASIC toward resolution. ASIC is seeking declarations, financial penalties, adverse-publicity orders and costs. The filing does not name the executives who owned the failed 2016 remediation or explain why later control owners did not reopen it.

The new court record therefore puts more than a disputed transaction price at issue. It tests whether a large bank’s audit, complaint and compliance systems could identify a problem yet leave it unresolved for years, and whether the litigation may produce evidence about who had authority to fix it. The strongest answer is still allegation, not judgment; CBA’s defense and the court’s findings will determine which failures are proved.