Australian Securities and Investments Commission v Money3 Loans Pty Ltd (Penalty) [2026] FCA 506

This case is a penalty judgment. That matters because the court was not deciding from scratch whether Money3 had broken the law. It had already done that in an earlier liability judgment delivered on 5 September 2025. The later judgment, dated 27 April 2026, dealt with what final relief should follow.

ASIC had sued Money3 Loans Pty Ltd over alleged breaches of responsible lending and general conduct obligations under the National Consumer Credit Protection Act 2009 (Cth). ASIC succeeded only in limited respects in the liability phase, but those findings still exposed Money3 to civil penalties.

The proven contraventions related to five credit contracts entered into with six consumers between 8 May 2019 and 18 February 2021. The court's description of the conduct is commercially important because it was not a case where the lender had no information. Money3 required consumers to provide bank account statements covering the 90 days before the application. The court found that the lender had reliable transaction data available, but the analysts did not reasonably use that data to inquire into or verify declared living expenses before making the required assessment.

Instead, standardised expense amounts from Money3's Matrix or Product Guides were applied. The court said that even a cursory review of the bank data would have shown that actual living expenses greatly exceeded the declared weekly or monthly rounded amounts. In the file involving Consumers 4 and 5, there was also an additional problem: Money3 included amounts for an application fee and brokerage in pre-approval documentation without first asking whether the consumers actually wanted finance for those charges.

The penalty reasons summarise the declarations made after the liability judgment. In broad terms, the court found contraventions of s 130(1) because Money3 failed to make reasonable inquiries and failed to take reasonable steps to verify aspects of the consumers' financial situation before making the assessment required by the Act.

For Consumers 1, 2, 3 and 6, the court found that Money3 failed to make reasonable inquiries about declared living expenses by inquiring into third party bank account transaction data it had obtained, and failed to take reasonable steps to verify those declared living expenses by reference to that same data. For Consumer 3, there was also a failure to follow up a query relating to certain payments shown in the transaction data.

For Consumers 4 and 5, the court found failures to inquire into bank account transaction data the consumers had provided and failures to verify declared living expenses by reference to that data. In addition, for those two consumers, the court found a contravention of s 130(1)(a) because Money3 failed to inquire whether finance was sought for the application fee or brokerage.

The court also found contraventions of s 128(d). In substance, those findings reflected the failure to make the inquiries and verification required by s 130 within 90 days of entering into each credit contract.

This distinction is important for business readers. The penalty judgment was based on earlier findings about process failures under ss 128 and 130. It was not a judgment that the loans were unsuitable. The court recorded Money3's submission that ASIC had failed to establish unsuitability, and the penalty reasoning proceeded on the contraventions that had actually been found.

The main dispute in the penalty hearing was how serious the contraventions were and what relief should follow. ASIC sought a total pecuniary penalty of $4 million. It also sought compliance orders requiring Money3 to ensure it had appropriate systems, policies and procedures in place for responsible lending compliance under ss 128 and 130.

ASIC argued that a strong penalty was needed for both general deterrence and specific deterrence. It said lenders must meet the standards imposed by the Act because failures of this kind can have serious and unacceptable consequences for consumers. ASIC also pointed to Money3's own internal guidance. The judgment records that Money3 had an Analyst Guide, NCCP awareness training material and a Credit Policy requiring analysts to review bank statements and verify information. ASIC's point was that the actual analysis carried out in the relevant files was much more limited than Money3's own guidance required.

Money3 accepted that the established contraventions were serious, but it resisted ASIC's characterisation of the case. It argued that the court had not found the credit contracts were unsuitable and that the consumers had obtained funding that was not unsuitable for them. It also said this was not a case of systemic misconduct. According to Money3, the contraventions were five isolated instances where staff failed to follow company policy and procedures, rather than evidence of broader defects in systems, training or corporate culture.

Money3 also relied on the scale of its lending activity during the relevant period, submitting that the proven contraventions were very small in number compared with the volume of Micro Motor loans it entered into. It argued that the findings in relation to ASIC's broader s 47 case showed there had been no established contravention concerning Money3's general processes, policies, procedures or training.

The legal issue in this judgment was what penalty and other final relief were appropriate after the earlier findings of contravention. The court had to decide the amount of any pecuniary penalty under s 167(2), taking into account the matters identified in s 167(3) and the established principles governing civil penalties.

The judgment explains that the primary purpose of civil penalties is deterrence, both specific and general. A penalty must have enough sting or burden to deter future non-compliance, but it must not be disproportionate or oppressive. The court also referred to the need to consider the statutory maximums, while not applying them mechanically.

The maximum penalties were significant. The court said that for the ss 128 and 130 contraventions, the penalty for a single contravention by a corporation was 50,000 penalty units under s 167B(2)(a). Because penalty units changed during the relevant period from $210 to $222, the court calculated a maximum total penalty of $53.1 million across the five credit contracts.

The court also had to deal with overlap between the contraventions. The same underlying conduct could give rise to both s 128 and s 130 contraventions. Applying the course of conduct principle, and with ASIC accepting that approach, the court agreed that it should not duplicate punishment for what was in substance the same conduct. Instead, a single penalty should be imposed for each credit contract, meaning five separate courses of conduct.

That part of the reasoning is useful for businesses because it shows how the court approached overlapping responsible lending obligations. The court did not ignore the multiple contraventions, but it also did not stack penalties in a way that punished the same conduct twice.

The court ordered Money3 to pay a pecuniary penalty of $1,550,000 to the Commonwealth within 14 days. It also made directions requiring the parties to confer about costs, with costs to be determined on the papers if no agreement was reached.

The court considered this a case requiring a substantial penalty to achieve both specific and general deterrence. The judge described the contraventions as serious and as basic failures. In each case, the analysts had reliable bank statement data that could have been used to compare declared living expenses with actual transaction data. The court said it would not have been difficult to make that comparison before deciding to apply standard expense figures from the Matrix or Product Guides.

The reasons emphasise that these were not cases of minimal discrepancy. For Consumer 1, for example, the court said a simple comparison with the bank data would have revealed glaring inconsistencies between the declared expenses and the spending shown in the statements. The same overall reasoning applied across the files: Money3 had reliable data for inquiry and verification purposes, but failed to use it.

At the same time, the court did not simply adopt ASIC's broader framing of the matter as systemic misconduct. The judgment notes that ASIC had not pleaded broader systemic contraventions and that no contravention had been established in relation to Money3's broader guidance, training systems or s 47 general conduct case. Even so, the file-level failures were serious enough to justify a substantial penalty.

The court also accepted the course of conduct approach. ASIC did not seek separate penalties for both ss 128 and 130 in a way that would duplicate punishment for the same conduct. The court agreed that a single penalty should be imposed for each of the five credit contracts.

Importantly, the compliance orders sought by ASIC were refused. So the final relief was the pecuniary penalty and costs directions, not a court-imposed compliance program.

For lenders, brokers and credit teams, the most useful lesson is that responsible lending compliance often fails in ordinary workflow steps. A business may have policies, training slides and analyst guides that say the right things, but that will not protect it if staff do not actually use the information collected from customers.

This case is especially relevant where a business receives both declared expense information and bank statement or transaction data. The court's reasoning shows that the lender cannot simply collect the statements, check income and poor banking conduct, and then default to standard expense figures without doing a reasonable comparison. If the transaction data shows obvious inconsistencies, follow-up inquiries and verification steps are expected.

The case is also important for businesses using brokers or introducers. The liability reasoning quoted in the penalty judgment refers to the risk of relying on information in a broker-initiated application form without properly checking it against reliable bank transaction data already in hand. If your business receives broker-supplied application information, your process should make clear who checks it, what discrepancies trigger escalation and how the final assessment is documented.

Another practical point is that a commercially workable loan outcome is not the same thing as a compliant assessment process. Money3 argued that the loans were not unsuitable, but that did not prevent the court from imposing a substantial penalty for failures in inquiry and verification. Businesses should not assume that a loan performing in practice will excuse weak assessment steps at the time of approval.

The penalty judgment was delivered by McElwaine J on 27 April 2026 in the Federal Court of Australia. The earlier liability judgment referred to in the reasons was delivered on 5 September 2025. The court had made declarations of contravention on 30 October 2025 before hearing argument on penalty and final relief. The hearing on penalty took place on 26 February 2026.

The orders required Money3 to pay the penalty within 14 days and required the parties to confer about costs by 8 May 2026, with costs to be determined on the papers if no agreement was reached.

This page is based on the Federal Court penalty judgment in Australian Securities and Investments Commission v Money3 Loans Pty Ltd (Penalty) [2026] FCA 506. The judgment itself states that it should be read with the earlier liability decision, Australian Securities and Investments Commission v Money3 Loans Pty Ltd (No 3) [2025] FCA 1086, because the penalty reasons assume familiarity with the findings and defined terms used there.

The explanation here stays close to what the penalty reasons expressly record. It focuses on the commercial story, the contraventions found, the penalty reasoning and the practical compliance points for businesses.