Coastline Bank: Deceased-Estate Fees, the FAR, and What to Tell ASIC
Coastline Bank Ltd is an ASX-listed regional bank with AUD 28 billion in assets and 1.9 million customers. In February a journalist's enquiry revealed that for six years the bank had kept charging monthly account fees to the estates of deceased customers: 9,300 accounts, AUD 4.2 million. The issue surfaced through a single customer complaint; the bank's own conduct monitoring had not detected it.
The board has seven directors. The chair is a former mining executive in his eleventh year of service; only two directors have banking backgrounds. The risk committee meets quarterly and reviews credit, liquidity and cyber metrics, but no customer-outcome measures. Executive scorecards are 80% weighted to cost-to-income and cash earnings. Coastline entered the Financial Accountability Regime in March 2024 and has 14 accountable persons.
The CEO wants to 'remediate and move on'. The CFO notes that APRA's CPS 230 obligations will require the bank to map the very processes that failed. ASIC has not been contacted. Media coverage is intensifying and two institutional investors have requested a meeting.
1. Diagnose the underlying governance and culture failures, distinguishing symptoms from causes. Rank the three board actions that would most reduce recurrence risk and justify the ranking.
Read the worked answer
Symptoms: a two-year-plus overcharging, a single-complaint detection, and a CEO framing this as a remediation exercise. Causes sit in three layers.
Information layer. The board sees credit, liquidity and cyber. It does not see customer outcomes. A board can only govern what appears in its pack, so the failure was designed in at the reporting layer.
Incentive layer. Scorecards weighted 80% to cost-to-income and cash earnings make fee leakage economically rational at the operating level. Nobody had to intend harm; the incentive did the work.
Accountability layer. Fourteen accountable persons under the FAR, but no accountable person mapped to the fee-charging process. Unmapped processes are unowned processes.
To these, add a structural cause: the second line relied on complaints as a control. Complaints are lagging, single-point and low-volume - an unusable detection mechanism for a systemic defect.
Ranking, by impact multiplied by time-to-effect:
- Add mandatory customer-outcome and process-integrity reporting to the board risk pack and risk appetite statement. It changes what the board can see and is achievable within one quarter.
- Reweight executive scorecards and introduce a conduct gate. It changes behaviour fastest and is entirely within the board's control.
- Board renewal - skills matrix, tenure and a genuine risk committee chair with banking experience. Necessary, but it takes six to twelve months and cannot precede the information flow that makes renewal useful.
Renewal ranks third not because it matters least but because it is slowest; starting it now does not displace actions 1 and 2.
2. Advise the CEO on disclosure sequencing: what must be reported to ASIC and APRA, on what timeframe, and what should be volunteered beyond the legal minimum. Explain the reasoning and the risks of each option.
Read the worked answer
Legal floor. The reportable-situations regime requires notification to ASIC of a significant breach within five business days of becoming aware of it, with a corrective action plan. Systematic fee deductions from deceased estates is unlikely to be assessed as immaterial or inadvertent. APRA separately expects prompt notification of material control failures, and CPS 230 formalises operational incident management including notification of material incidents. Both should be notified this week, APRA in parallel rather than after.
The FAR obligation is the decisive point. Accountable persons must deal with APRA and ASIC in an open, constructive and cooperative manner. Delaying while the media cycle runs is not a neutral commercial choice; it is itself a potential breach of each accountable person's obligations. That argument should be put to the CEO directly, because it reframes disclosure from reputational risk to personal regulatory exposure.
Beyond the minimum. Volunteer: proactive remediation to all 9,300 customers without requiring claims, an independent review of the fee engine with published findings, and a single clear public statement. The reasoning is that ASIC's remediation expectations and the class-action exposure both turn on whether remediation is voluntary and complete. The counter-risk is that volunteered findings create admissions - mitigate by separating the factual account (disclose) from legal conclusions (investigate under privilege) and by keeping the investigation privileged while disclosing facts.
Sequencing: 72 hours to verify the population and cause, day five ASIC and APRA notifications, customer remediation commenced within 30 days and completed within 90, public statement same week as notification. Notifying before customers hear it from the media is the point.
3. Redesign the executive scorecard and board risk reporting so that this failure mode becomes detectable next time. Show what you would remove, add and reweight.
Read the worked answer
Reweight, do not merely add. Current scoring is 80% financial. Move to: financial 40%, customer outcomes 30%, risk and conduct 30%. Adding conduct metrics at 5% while cost-to-income stays at 80% would change nothing - the weighting is the message.
Add a conduct gate, not just a conduct score. If a threshold breach occurs in the executive's area, short-term incentive is reduced to zero regardless of financial performance. A gate changes behaviour in a way that a weighted score cannot, because it removes the trade-off.
Deferral and clawback. Align with APRA's remuneration requirements: a substantial portion of variable reward deferred over several years with malus and clawback triggers covering remediation events. Accountable persons' scorecards should name the processes they own, closing the FAR-mapping gap.
Board reporting - leading indicators. Quarterly-to-monthly additions: process defect rates and manual adjustments per 1,000 accounts; fee-waiver volumes and reasons; exception reports closed versus raised; complaints per 1,000 accounts with a root-cause taxonomy; ageing of unresolved remediation. The specific signal missed here was manual adjustment and waiver volume in estate accounts - a leading indicator that was visible in operations and invisible to the board.
Remove: cost-to-income as a headline board metric without a customer-outcome companion. Retain it, but never present it alone.
Accountability: one named executive owns customer remediation end-to-end, reports monthly to the risk committee rather than quarterly, and the committee's charter is amended to include conduct and customer outcomes explicitly.