Legally Insightful | Friday, 13 November 2026 | Australian legal, financial and technology news
A bank allegedly charges business customers a fee its paperwork doesn't properly explain. Another bank signs up to repay workers after more than a decade of payroll errors. A fashion retailer pays infringement penalties over late injury reports.
These might look like different stories, but they share a deceptively simple question: when an organisation knows how its systems are supposed to work, who checks that they actually do? That's the thread running through this morning's edition. Australia's regulators have new things to say about banking fees, payroll governance, financial-system risk and online wagering advertising.
Fresh water statistics offer a reminder that infrastructure decisions matter well beyond technology. Overseas, an ambitious lawsuit asks a US court to stop frontier AI development, while a Dutch court tightens its grip on a dispute involving a strategically important chipmaker. This edition draws on developments announced or reported in the 24-hour window ending 5:00 am Friday, 13 November 2026, Brisbane time (AEST).
Where a government source provides a date but not a publication time, that limitation is noted in the source record. The important distinction throughout: a regulator's allegation is not a court finding, and an infringement notice is not a judicial conviction.
1. ASIC sues Commonwealth Bank over alleged CommBiz fees: $8.5 million is only part of the story
The Australian Securities and Investments Commission (ASIC) announced civil penalty proceedings against Commonwealth Bank of Australia (CBA) on 12 November. It alleges that approximately 42,000 CommBiz business customers were overcharged around $8.5 million between November 2020 and 31 May 2025 because the bank's terms did not clearly explain an additional fee attached to Direct Debit and Direct Credit transactions. Here are the mechanics without the banking jargon.
A business expected to pay for an outgoing or incoming payment to a third party. ASIC alleges the bank also charged for a linked movement through the business's own nominated account—a so-called contra leg fee. ASIC's example is memorable: a payroll run paying ten staff from two accounts was charged twelve fees rather than ten.
The amounts per transaction were small; the cumulative effect across customers and years was not. ASIC further alleges that the problematic terms dated back to CommBiz's launch in 2006, that customers had complained by 2015, and that a 2016 internal audit identified an overcharging issue. Those historical points form part of ASIC's pleaded account; they have not been decided by a court.
The regulator seeks declarations, pecuniary penalties, adverse publicity and other orders, and no case-management hearing had been listed when it announced the proceedings. A particularly important distinction: the alleged $8.5 million relates to the specified 2020–25 period in the case. ASIC says CBA has already completed a broader remediation program covering accounts from December 2006, paying more than $26.4 million to approximately 93,000 customers, including around 40,000 small businesses.
These are different populations and periods—not two versions of the same figure. CBA has acknowledged the fee disclosure problem and apologised, while disputing aspects of ASIC's allegations.
Why it matters: The dispute is as much about product governance as a 25-cent fee. Customer-facing documents, transaction engines, complaints, audit findings and remediation programs must tell the same story. For consumers and small businesses, it is a reminder to look beyond a fee schedule to the actual charges. For boards, a control issue that appears to have been identified but not fully resolved is precisely the kind of history regulators examine closely.
Sources: ASIC, media release 26-279MR; ABC News, 12 November; Reuters on CBA's response.
2. NAB's payroll undertaking: $127 million in wages, plus interest, super and a $2 million payment
On the same day, the Fair Work Ombudsman announced that National Australia Bank Ltd (NAB) had entered an enforceable undertaking following underpayments affecting 65,999 workers across Australia. The undertaking provides for $127 million in underpaid wages and entitlements, $34 million in interest and $8 million in superannuation—about $169 million for affected workers—alongside a separate $2 million contrition payment to the Commonwealth. It would be misleading to call the entire $171 million a court fine.
This is an enforceable undertaking accepted by the regulator, not a penalty imposed after a judicial finding. The Ombudsman says NAB has already paid at least $155 million of the employee-related amounts, and individual back-payments range from under $5 to more than $87,000, with an average of about $1,934 including interest and superannuation. The roots run deep.
NAB self-reported payroll issues in 2019, and a subsequent review uncovered problems stretching to 2012. The regulator says deficiencies included inadequate governance, incomplete time-and-attendance data, legacy payroll systems, leave accrual problems and failures to implement requirements of enterprise agreements. The bank discovered in 2024 that it had still not fully fixed its earlier compliance problems.
Crucially, the undertaking is not just a cheque. It requires stronger executive oversight, employee reporting channels, independent auditing of a new payroll system and early cross-functional planning for future enterprise agreements. Those requirements recognise that a payroll system is not simply an IT application.
It is a translation of legal obligations into calculations, records and real money entering employees' accounts.
Why it matters: Underpayment risk is often framed as a human-resources problem. This case illustrates why it is also a board, legal, risk and technology problem. When the award or enterprise agreement says one thing and the payroll rules execute another, the company's legal obligation does not disappear into the software. For employees, the practical action is to check back-pay and superannuation records, especially if they worked at NAB during the relevant years.
Source: Fair Work Ombudsman, 12 November announcement and undertaking summary.
3. APRA's warning: the next financial shock could be both monetary and operational
The Australian Prudential Regulation Authority (APRA) published its November 2026 System Risk Outlook. The headline is not that Australia's financial system is failing. APRA says it remains strong and stable.
Its warning is subtler: future shocks could arrive together and reinforce one another. The regulator points to elevated international government bond yields and the potential for a sharp revaluation of financial assets. It also identifies vulnerabilities from AI-enabled cyber threats, operational dependence on major technology service providers and concentrated infrastructure.
A problem at a widely used provider, for example, can spread across organisations that appear independent on paper but rely on the same critical systems. APRA also observes that Australian housing prices have declined and lending has slowed, while most households and lenders retain meaningful buffers. High household debt still matters, especially if a more serious downturn coincides with job losses.
These are risks under review, not forecasts that a crash is inevitable. The most useful passage may be the regulator's emphasis on the ability to manage combined financial and operational crises. Capital and liquidity help institutions absorb losses.
Tested recovery plans, incident response, third-party management and clear decision-making matter when a major technology failure occurs at the same time.
Why it matters: Financial resilience can no longer be treated as a spreadsheet of capital ratios alone. A board that has asked about interest-rate exposure should also ask how long critical services can remain available during a cyber incident, and whether multiple suppliers are actually dependent on one upstream provider. In that sense, an AI risk conversation is increasingly a financial stability conversation.
Sources: APRA, System Risk Outlook media release; APRA, full November 2026 outlook.
4. Cotton On pays $19,800 over alleged late reporting of serious product injuries
The Australian Competition and Consumer Commission (ACCC) announced that Cotton On Australia Pty Ltd had paid $19,800 across two infringement notices concerning alleged delays in mandatory injury reports. The incidents involved a Supre-branded pair of jeans and a Typo Christmas snow globe. Under the Australian Consumer Law, a supplier generally must notify the ACCC within two days of becoming aware that its product may have caused a death or serious injury or illness.
That obligation is about reporting a potentially serious incident; it does not wait for a company to prove a design defect. The distinction is essential here. Cotton On undertook risk assessments and further testing, and the ACCC said no product safety concern was identified in relation to the two items.
The agency nevertheless alleged the reports were late. Cotton On cooperated, strengthened its processes and committed to auditing injury-related complaints regularly for three years. Payment of an infringement notice should not be described as a court ruling establishing a contravention.
Equally, discovering no defect does not necessarily undo a reporting obligation triggered earlier by knowledge of a serious injury.
Why it matters: A complaint buried in customer-service software can become a legal notification obligation within 48 hours. That requires front-line training, timely escalation and an accessible decision-maker—not merely a policy somewhere on the intranet. The incident is a particularly clear example of why reporting duties and product recalls are not the same thing.
Source: ACCC, 12 November media release.
5. Online gambling advertising: ACMA explains the three locks before January's restrictions
On 12 November the Australian Communications and Media Authority (ACMA) published initial guidance explaining the triple-lock exception for online content services. From 1 January 2027, providers will be prohibited from supplying wagering advertising content through those services unless they can rely on an applicable exception. For the triple-lock route, the provider must take reasonable steps to satisfy three conditions: prevent restricted users from receiving or accessing the ads; ensure recipients are using a registered account; and let registered users opt out.
A restricted user includes someone who is under 18, has not confirmed their age, is not logged in or has opted out. This is not quite as simple as adding an “I'm over 18” pop-up. The exception is about operationally effective steps, not a decorative checkbox.
ACMA has said it intends to publish a list of services that implement the triple lock and encourages providers planning to rely on it to notify the regulator. The rules are future-facing: the prohibition takes effect on 1 January, while the new guidance was released this week. The measures should not be confused with the separate digital-duty-of-care proposals discussed in earlier editions.
Why it matters: Ad platforms, publishers and online services need to know which users receive particular content—and have a workable record of age checks, log-in status and opt-outs. It is a powerful example of how consumer protection is increasingly embedded in product design rather than appended as a disclaimer.
Source: ACMA, initial triple-lock guidance, 12 November.
6. Australia's water equation is changing: desalination and reuse rise
Not every consequential risk announcement comes from a regulator. New Australian Bureau of Statistics (ABS) figures released on 12 November show that in 2024–25, Australian water utilities supplied 323 gigalitres of recycled or reuse water, up 5.5% on the previous year. Desalinated water supply increased 16% to 199 gigalitres.
Household water use also rose, by 2.7% to 1,920 gigalitres, although the ABS says the average household still consumes less water than a decade ago. Desalination remains a relatively small portion of total national water use, around 1.2%, but its rapid growth tells a story about how Australia manages variable rainfall and pressure on traditional supplies. These figures are not measurements of today's rainfall or a forecast of the next drought.
They describe the 2024–25 financial year and were published this week. The distinction between a new statistical release and the period being measured matters.
Why it matters: Water security is a business-continuity and investment question. More recycling and desalination can improve resilience to changing weather, but they also create infrastructure, energy, procurement and environmental trade-offs. As energy-intensive industries and data centres compete for resources, clear, comparable water statistics will matter more—not less.
Source: ABS, Five insights from Australia's changing water supply, released 12 November 2026.
7. US nonprofits sue leading AI companies, asking a court to halt frontier-model development
In a striking international development, Reuters reported on 12 November US time that a group of nonprofits, including Public Citizen, the Irreplaceable Education Fund and the Heat Initiative, filed a lawsuit in San Francisco against several major AI developers, including OpenAI, Anthropic, Google, Meta and SpaceX's AI division. The plaintiffs seek extraordinary relief: a court order restricting further development of advanced AI models, relying on allegations grounded in California law governing unfair business practices and public nuisance. They argue that the risks created by advanced models require intervention.
The companies' legal defences and the merits of the plaintiffs' claims have not been determined in the new case. An important correction to the natural headline instinct: a lawsuit asking for a pause does not mean an injunction has been granted. As at Reuters' publication, this was a newly filed claim, not an enforceable development ban.
The report also describes other, separate AI-related lawsuits and applications; those must not be conflated with the new proceeding.
Why it matters: The case is an attempt to use existing legal doctrines to regulate a technology where legislation is still evolving. Whether it succeeds is highly uncertain. But it raises a serious question for developers and their customers: can conventional consumer and nuisance law be used to demand safety controls before the next generation of technology is released?
Source: Reuters, 12 November 2026, reported 18:23 UTC.
8. Dutch court strengthens protections around Nexperia in its dispute with Wingtech
A second international legal story shows how company governance and industrial policy increasingly overlap. Reuters reported on 12 November that an Amsterdam court had ordered additional measures to protect semiconductor manufacturer Nexperia from interference by its Chinese owner, Wingtech. The Enterprise Chamber made its new order on 11 November, according to Nexperia, after concluding that actions by Wingtech and Nexperia China had undermined earlier court measures.
The latest directions require relevant parties to refrain from interfering with normal business operations and respect the authority of independent court-appointed officials. Nexperia said significant penalties would support compliance. Wingtech's response was not available in the report.
This follows a dispute involving Dutch state intervention in 2025 and earlier corporate-control orders. The current story is about new court measures, not a newly announced acquisition, a confiscation of all shares or a final decision about who will ultimately control the company.
Why it matters: Semiconductors are ordinary products in one sense and strategic infrastructure in another. The more geopolitical value a technology supply chain carries, the harder it becomes to separate shareholder rights, court-supervised governance and national economic security.
Source: Reuters, 12 November 2026, reported 16:18 UTC.
The bigger picture: compliance isn't a document, it's a working system
Across today's stories, a recurring lesson emerges. CBA faces allegations about a mismatch between disclosed fees and transaction processing. NAB has agreed to remediation and governance reform after payroll systems failed to keep up with legal agreements.
Cotton On's case concerns the timing of escalation, even though subsequent testing did not reveal a product defect. APRA is asking institutions to think about interlocking financial and operational failures. The practical insight is not that companies need yet another policy.
It is that law, customer communications, staff processes and technology have to meet in the middle. A control which only exists in a presentation will be of limited comfort when the actual system does something different. And the international cases?
They remind us that courts are increasingly being asked to resolve questions about the governance of technology before society has settled on the rules. That tends to produce ambitious claims, complex disputes and a great deal of work for lawyers. At least one industry is recession-resistant.
Frequently asked questions
Has a court found Commonwealth Bank liable for overcharging CommBiz customers?
No. ASIC commenced civil penalty proceedings on 12 November 2026. Its allegations have not been resolved by the court.
CBA has separately undertaken customer remediation and disputes aspects of the case.
Is NAB paying a $171 million court fine?
No. The Fair Work Ombudsman announced an enforceable undertaking covering $127 million in underpayments, $34 million in interest, $8 million in superannuation and a separate $2 million payment to the Commonwealth. It is not accurate to describe the total as a court-imposed fine.
Why did Cotton On pay infringement penalties if products were not found to be defective?
The ACCC's alleged breach concerned late mandatory reporting of serious injury incidents. Reporting can be required before the cause of an injury is established. The ACCC said subsequent testing identified no safety concerns with the products.
When do the new online wagering advertising restrictions begin?
The ACMA guidance says the prohibition for relevant online content services begins on 1 January 2027, subject to the available exceptions, including a reasonable-steps triple-lock exception.
Has a US court stopped ChatGPT or other advanced AI models from being developed?
No. A group of nonprofits filed a lawsuit seeking restrictions. The requested injunction was not reported as having been granted.
About Legally Insightful: We make the legal and business significance of the day's news understandable without sacrificing the details.
General-information disclaimer: This article is general news commentary and information only, not legal, financial, investment or other professional advice. Laws and outcomes may change, proceedings may be contested, and readers should consult original sources and obtain advice suited to their circumstances before acting. Allegations and reported claims are identified as such and should not be treated as established findings unless stated.
Comments
Post a Comment