Westpac has been cleared of any breaches of the Banking Act and the Banking Executive Accountability Regime in relation to its breaches of anti-money laundering and counter-terrorism financing rules.
APRA announced on Friday that it has closed its investigation, saying: “Although the investigation has not found evidence of breaches of the Banking Act and BEAR, APRA remains determined to ensure Westpac rectifies its risk governance weaknesses effectively and sustainably.”
The bank is still subject to an enforceable undertaking to implement an integrated risk governance remediation plan.
In November 2019, Austrac applied to the Federal Court for civil penalty orders against Westpac after finding that there was systemic non-compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act. Austrac alleged that Westpac contravened the Act on more than 23 million occasions.
Westpac self-reported its failure to report a large number of international funds transfer instructions, acknowledging that “these issues should never have occurred”. The bank embarked on an overhaul of its risk management.
Last December, APRA announced that the bank’s efforts to deal with its risk management problems through its Customer Outcomes and Risk Excellence program had fallen short and the bank had given APRA an enforceable undertaking to “lift substantially its efforts to address risk governance deficiencies”.
The bank had already conceded that its remediation work had not delivered. An assessment conducted by an internal review team supported by Oliver Wyman, published last July, identified further changes the bank needed to make to fix weaknesses in the way it manages risk.
At the time, Westpac chief executive Peter King said: “Our management of non-financial risk is currently not at the standard we set for ourselves. It is clear we have more to do.”
When the review team went looking for the causes of the bank’s weaknesses in risk management, it found that the bank’s organisational structure was too complex. This introduced inconsistencies in the way risk is managed across the bank, made execution difficult and created confusion about policies and practices.
It found that awareness of risks was inconsistent and the approach to managing those risks was not sufficiently proactive.
It also found that Westpac employees did not have sufficient capability to manage non-financial risk. Another problem was that “processes to identify systemic issues are constrained by the need to manually aggregate and analyse issue data”.
APRA’s own review came to much the same conclusions, adding that the changes achieved so far have only been “incremental” and that new risk governance issues have continued to emerge, such as the breach of the liquidity standard.
“APRA’s conclusion is that Westpac has failed to deliver the expected risk governance improvements, despite almost two years of remediation,” the regulator said.
The enforceable undertaking requires Westpac to develop an integrated plan for deal with risk governance remediation, obtain independent assurance and assign accountabilities for delivery of the plan to named executives and board members.