The financial press is reporting that CBA has discovered a cluster of loans that had been procured using false documents including fake income statements created with the help of artificial intelligence, draft tax returns and shell companies to the tune of $1billion.
The reports allege that:
a racket obtained loans through two channels:
the bank’s referrer program; and
through third-party mortgage brokers,
the referral program allowed real estate agents, accountants, lawyers and other partners to direct customers to CBA in exchange for an upfront commission if a loan was written
accountants were assisting mortgage brokers to obtain loans from CBA while making commissions by referring their customers through the bank’s referrer program; and
the scam involved an average of seven credit products including home loans, credit cards and personal loans across a range of banks, including CBA
whilst the exposure is substantial. the mortgages are being paid down by the borrowers and are secured against real property.
Interestingly, loan referral programs are not a new risk area. Introducer programs received considerable criticism following the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry, which led to regulatory action. ASIC commenced Federal Court proceedings against National Australia Bank and Australia and New Zealand Banking Group for alleged breaches of the National Consumer Credit Act involving referrals through home loan “introducer programs” by unlicensed individuals outside the program parameters. The scrutiny also led to each of National Australia Bank and Macquarie Group to terminate their loan referrer programs.
What appears to emerge in CBA’s circumstances is the magnitude of the fraud, presumably facilitated through digital processes and the engagement of artificial intelligence.
Market Signals
The CBA scam reflects the ongoing battle which banks encounter with the increasing complexity and articulation of fraud and scams, which in the case of CBA appears, amongst other things, to involve fake income statements to inflate loan applicant finances.
Similar to the case of Bendigo Bank [see our FS insight on this here], where AUSTRAC and APRA have announced a joint investigation into the bank’s anti-money laundering default, the CBA incident reflects the increasing coordination of ASIC and AUSTRAC (together with the police). It highlights the increasing need for a collective and contemporaneous regulatory response by more than one regulator when dealing with the evolving complexity of fraud and scams in financial services, particularly involving artificial intelligence.
Outcomes and Looking Ahead
In October 2025 ASIC signalled one of its key focus areas is mortgage brokers. I in particular, the conduct of brokers and aggregators given that around three quarters of new residential mortgages are facilitated by a broker.
We expect:
that ASIC will step up its supervision of banks, lenders and aggregators of their arrangements with mortgage broker representatives with a strong likelihood of a regulatory review of audit and compliance practices and
an increased collective regulatory focus directed at sales processes for loan introduction, referrals and lead generation including associated participants and intermediaries, AML CTF compliance, customer and other verification processes, credit policies and transaction monitoring.
It is timely that ASIC has also announced separately that it is reviewing financial advice licensees using lead generation services to address practices that inappropriately or unnecessarily encourage consumers to switch their superannuation.
The discovery of the fraud follows CBA’s expansive internal review of compliance practices and customer lending documents which allegedly intensified after police revealed a network of lenders, brokers, realtors and other professionals – known as the Penthouse Syndicate – were circumventing NAB’s credit policies to acquire home and business loans, including for luxury property.
Comparatively, in the recent circumstances of Bendigo Bank, it self-reported its AML CTF breach to AUSTRAC following an independent review undertaken by Deloitte into suspected money laundering at a specific branch, the findings of which led to regulatory action.
Pragmatically each of these examples underscores the importance of strengthening anti-money laundering and transaction monitoring programs aside from financial services compliance and governance.
Fraud is not isolated to particular banks, non-bank financial institutions, private credit providers and other regulated lenders. All lending and credit participants are susceptible to this market risk and given its apparent increasing complexity through the application of artificial intelligence, each should monitor activities and responses across the market to inform individual regulatory (and where applicable, prudential) compliance and governance responses including lending processes and risk management.
Our team regularly advises financial institutions on AML compliance, governance and risk frameworks, including the structuring and review of accreditation and referral arrangements to help mitigate regulatory exposure and avoid similar issues arising. Please contact the author, Michael Bracken. Our Financial Services Team regularly advises financial institutions on the impact of banking, credit and prudential regulatory frameworks on lending operations and business including AML compliance, governance and risk frameworks, including the structuring and review of accreditation and referral arrangements to help mitigate regulatory exposure and avoid similar contingencies. Please contact the author, Michael Bracken.
This publication has been prepared for general guidance on matters of interest only and does not constitute professional legal advice. You should not act upon the information contained in this publication without obtaining specific professional legal advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication and to the extent permitted by law, Cowell Clarke does not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting or refraining to act in relation on the information contained in this publication or for any decision based on it.