There are lessons for all lenders in the latest report on compliance with the Banking Code of Practice (the Code), which offers insights into how lenders can improve compliance, and breach reporting and response systems.

Background

The Banking Code Compliance Committee (BCCC) recently published the latest ‘Banks’ compliance with the Banking Code of Practice report for January – June 2021’ (BCCC Report), which can be found here.

The report is issued bi-annually and aims to improve compliance within the banking sector by monitoring breach reporting and identifying emerging industry trends.

Banks are required to report the total number of breaches identified during the reporting period, as well as other information relating to the nature, significance and economic impact of the breach.

Although subscription is not compulsory, adherence to the Code is considered best practice by regulators and AFCA.

The trends

Particularly poor areas of compliance were found to include opening an account and using banking services, and when things go wrong.

Parts of the Code where breaches increased significantly when compared to the last reporting period included:

• Part 4 – Inclusive and accessible banking – up 9%
• Part 7 - Guaranteeing a loan – up 18%
• Part 8 – Managing your account – up 21%

Areas of concern

Although breaches relating to poor staff training were extensive, this may be a result of incorrect categorisations rather than inadequate staff practices. The BCCC has stressed that banks “tend to blame human error for breaches where better systems may have prevented staff from making the error”. Notably, banks reported that most breach incidents (69%) were caused by human error alone, and the BCCC noted it would like to see a decrease of reported incidents in this area.

Privacy and confidentiality breaches accounted for the most reported incidents (4,662), with one major bank reporting a 20% increase in this area. This figure is of particular concern, as breaches of privacy can carry considerable impacts on those affected, including unauthorised access to customer accounts by criminals.

Scams and fraud

Although breaches relating to scams were few in number, many of the incidents reported in this period were serious in nature, affecting over 170 customers with a financial impact of almost AU$6 million.

The incidents with the largest financial impact on customers related to elder abuse, including the abuse of powers of attorney, and investment scams.

As scams and fraud are generally on the rise, lenders should be particularly proactive in this area to ensure anti-fraud measures are sufficiently robust.

Customer remediation and corrective actions

Interestingly, banks reported that they had undertaken one or more of the following to remediate customers as a result of a breach:

• corrected the individual issue, including updating details, and requests for information be destroyed, deleted or returned (41% of incidents)
• provided financial remediation such as a refund, debt waiver, compensation or goodwill payment (18%)
• communicated or corresponded with the customer (10%)apologised to the customer (5%) and
• logged, managed or resolved a complaint (5%)

However, only 5% of corrective actions included an apology to the customer. Although resolving the issue should be of primary importance, offering the small gesture of an apology may go a long way to preserve customer relationships at no cost to lenders.

Key takeaways

The BCCC are concerned that banks are continuing to identify human errors as the cause of the majority of breach incidents, as a ‘catch-all’ to detract from deficiencies in internal systems and controls.

The most common action taken by banks to prevent reoccurrence was to provide staff training, coaching or feedback (58% of incidents).

While these actions are important, it is crucial that lenders do not over-rely on staff training and feedback as corrective measures, as the opportunity cost of not improving systems and controls could be severe.

In addition to training staff, lenders should consider the below information to ensure they are minimising the opportunities for breach incidents to arise: