Regulatory update
ASIC sues Commonwealth Bank over undisclosed CommBiz fees: lessons for banks and lenders
ASIC alleges CBA overcharged about 42,000 CommBiz business customers $8.5 million in fees they were never told about. Here’s what’s alleged, and what banks and lenders should check now.
On 12 November 2026, ASIC started civil penalty proceedings against Commonwealth Bank of Australia (CBA). It alleges that tens of thousands of CommBiz business customers, many of them small businesses, were charged fees that CBA’s terms and conditions didn’t disclose.
These are allegations, and CBA hasn’t yet had the chance to respond in court. But the case is a clear signal of where ASIC’s attention is: fee disclosure, misleading pricing and the systems that are meant to catch problems early.
Key takeaways
- ASIC alleges about 42,000 CommBiz customers were overcharged about $8.5 million between November 2020 and May 2025.
- The alleged problem was an undisclosed second fee on each Direct Debit and Direct Credit.
- ASIC alleges CBA had customer complaints from at least 2015 and a 2016 internal audit that identified overcharging.
- CBA has already paid more than $26.4 million in remediation, but ASIC is still seeking penalties.
- Misleading pricing is a 2026 enforcement priority for ASIC.
On this page
What ASIC alleges
CommBiz is CBA’s online banking platform for business customers. According to ASIC’s media release, CommBiz customers were told they would be charged a fee for each Direct Debit or Direct Credit payment to or from a third-party account.
ASIC alleges CBA also charged a second, undisclosed fee for the matching movement of money into or out of the customer’s own CommBiz account. ASIC calls these “contra leg” fees.
ASIC’s example
A small business paying the fortnightly wages of 10 employees from two CommBiz accounts was charged 12 fees: 10 for the payments to its employees, and 2 undisclosed fees for the money taken from its own accounts.
| Allegation | Detail |
|---|---|
| Customers affected | About 42,000 CommBiz customers between November 2020 and 31 May 2025 |
| Amount overcharged | About $8.5 million in that period |
| How long | About 19 years, with the terms in place since CommBiz launched in 2006 |
| Warning signs | Customer complaints from at least 2015, and a 2016 internal audit that identified overcharging of Direct Debit fees |
| Contraventions alleged | Misleading terms and conditions, governance failings, and a failure to act efficiently, honestly and fairly |
ASIC is seeking declarations, pecuniary penalties, adverse publicity orders, other orders and costs. Its concise statement sets out its case in more detail.
Remediation isn’t the end of it
CBA stopped charging the fees in June 2025, amended the CommBiz terms in August 2025 and has waived the contra leg fees since February 2026. It has also completed a remediation program covering December 2006 to the present, paying more than $26.4 million to about 93,000 CommBiz customers, including around 40,000 small businesses.
Even so, ASIC has gone to court. For banks and lenders, that’s the key point. Fixing a problem and paying customers back is essential, but it doesn’t rule out penalty proceedings, particularly where ASIC says the warning signs were there for years.
Why ASIC is focused on this
ASIC Commissioner Alan Kirkland said the case should serve as a warning to banks that failing to get the basics right will attract ASIC’s attention. ASIC has an enduring enforcement priority on systemic failures by large financial institutions, and a 2026 priority on misleading pricing practices, especially during the current cost-of-living pressures.
The alleged facts also highlight two themes that run through recent ASIC cases: complaints that weren’t escalated into fixes, and audit findings that didn’t lead to timely change.
Lessons for banks and lenders
Whether you’re a bank, non-bank lender, payments provider or fintech, these are the checks we’d recommend now:
- match your fees to your terms. Map every fee your systems actually charge against what your terms, fee schedules and product disclosure say
- look for hidden legs. Payments, transfers and account features can trigger more than one charge. Make sure each one is disclosed
- use your complaints data. ASIC’s RG 271 expects firms to identify and escalate systemic issues from complaints. Repeated fee complaints are a warning sign
- close out audit findings. Track internal audit actions to completion, and escalate when they slip
- consider breach reporting. If you find a problem, assess whether it’s a reportable situation, and plan remediation early
- test your terms for clarity. Small business customers should be able to work out what they’ll pay without scrutinising every transaction.
Questions for your board
- When did we last reconcile the fees our systems charge with the fees we disclose?
- Which products or features could trigger more than one fee per transaction?
- What are customers complaining about, and are we fixing the cause?
- Are any audit findings about fees or pricing still open?
- If a fee error were found tomorrow, how quickly could we stop it, report it and remediate?
If you’re a CommBiz customer
If you’re a business customer who believes you were affected and you haven’t been remediated, ASIC suggests you contact CBA. It’s also worth checking your statements for Direct Debit and Direct Credit fees, and asking your bank to explain any fee you don’t understand.
Our banking and financial services team advises lenders and financial institutions on disclosure, pricing and regulatory investigations. See our recent updates on ASIC’s private credit review and lead generators, and our consumer credit services.
Frequently asked questions
What is ASIC alleging against Commonwealth Bank?
That CBA’s CommBiz terms were misleading because they didn’t disclose a second “contra leg” fee charged on Direct Debits and Direct Credits, and that about 42,000 customers were overcharged about $8.5 million between November 2020 and May 2025.
Has CBA been found liable?
No. These are ASIC’s allegations in civil penalty proceedings. The court hasn’t yet listed the matter for a case management hearing.
Has CBA refunded customers?
Yes. CBA has completed a remediation program paying more than $26.4 million to about 93,000 CommBiz customers, covering December 2006 to the present.
What should I do if I think I was affected?
If you haven’t been remediated, ASIC suggests you contact CBA.
Reviewing your fee disclosure?
Talk to our banking and financial services team
Banking & Financial Services Law
Our team can review your terms, fee schedules and disclosure against what your systems actually charge, help you assess breach reporting and remediation, and support you if ASIC comes asking.
This article is general information only and is not legal advice. Please contact us for advice about your circumstances.
Related updates
Table of Contents
Posted in Financial Services Regulation