Commonwealth Bank of Australia: A working deposit machine can still miss a reporting duty

← All case files

LCF-008 · Reporting systems

A working deposit machine can still miss a reporting duty

A payment product can work for customers while its reporting controls fail. Launch checks should cover the journey from transaction capture to submission.

Commonwealth Bank of Australia · Intermediate · About 5 minutes

The documented case

What the official sources say

Historical event: 20 June 2018
Outcome at that date: Federal Court civil penalty ordered
Jurisdiction: Australia

AUSTRAC’s enforcement record states that the Federal Court ordered CBA to pay an A$700 million penalty on 20 June 2018. [1]

The June 2018 statement of agreed facts and admissions records CBA’s admission that 53,506 threshold transaction reports for cash deposits through intelligent deposit machines were late, alongside risk-assessment, control and monitoring failings. [2]

Read the outcome precisely

This is a civil AML/CTF enforcement case. A reporting breach is not proof that each underlying deposit was illicit. Historical Australian reporting requirements must not be reused as universal current thresholds.

What to learn from it

Original LearnAML teaching analysis. The following controls and exercises are not additional findings against the named parties.

  1. Trace product activity through reporting selection and submission.
  2. Specify an end-to-end reporting test.
  1. 01New product
  2. 02Transaction codes
  3. 03Reporting engine
  4. 04Submission evidence

Simplified LearnAML control map; not a reconstruction of every transaction in the case.

Test the whole reporting chain

A payment product can work for customers while its reporting controls fail. Launch checks should cover the journey from transaction capture to submission.

Reconcile independent populations

Compare source-system transactions with reporting-engine output and submission acknowledgements. A report showing zero rejected files does not identify transactions never selected for reporting.

Scope the retrospective work

If a mapping defect is found, define the affected codes and period. Preserve records, assess reporting obligations and obtain approval for correction and remediation.

Your decision · Fictional practice

What would you do next?

Fictional exercise: A new cash-deposit channel passes customer testing. Its transactions use a new code. Compliance sees successful submission receipts for existing channels, but no test proves that the new code reaches the reporting selection rules.

Which launch evidence is most important?

Put the decision into words

Use fictional details only. Do not enter customer information. Optional saves remain on this device, not your LearnAML account.

Compare your reasoning

Use this checklist to improve your answer. It is not an automatically marked essay.

  • Reconcile new-product activity to the intended reporting population.
  • Test selection rules and submission outcomes, not just customer functionality.
  • Define who owns missing or rejected reporting events.

Take one lesson back to work

In your own environment: Reconcile new-product activity to the intended reporting population.

Educational analysis, not instructions for a live customer or transaction. Consider your role, authorised procedures and current local requirements.

Sources and editorial record

  1. AUSTRAC: enforcement actions and CBA outcome ↗AUSTRAC · 20 June 2018Evidence location: Commonwealth Bank of Australia section
  2. CBA / AUSTRAC: statement of agreed facts and admissions (PDF) ↗CBA / AUSTRAC (ASX filing) · 4 June 2018Evidence location: PDF page 2 and attached statement, paragraphs 41–48

Sources accessed and educational analysis prepared: 27 October 2026. Historical snapshot; subsequent proceedings, present custody, current controls and present law are not asserted. Original LearnAML educational analysis. Version 1.0.

About LearnAML