Last Tuesday, I was blindsided by an email from the Commonwealth Bank of Australia (CBA) demanding intimate details about my financial life. They wanted to know how I built my wealth, why I made certain transactions, and whether I hold cash at home—all within seven days, or they’d freeze my accounts.
I first thought it was spam. But no, it was real.
Citing AUSTRAC, Australia’s anti-money laundering regulator, CBA’s demands felt like an invasion, a dystopian overreach that left me reeling. This wasn’t just bureaucracy; it was personal. Here’s what’s happening, why it’s happening, and what it means for our privacy.
Know your customer
AUSTRAC’s Know Your Customer (KYC) rules, under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, require banks to identify and verify customers to prevent financial crimes like money laundering and terrorism financing. Banks must collect and verify identity details, monitor transactions, and report suspicious activities. For higher-risk customers—like those in cash-intensive businesses or certain industries—enhanced due diligence applies. CBA’s email aligns with these obligations, as banks must ensure customer information is current and accurate, or risk penalties like the $700 million fine CBA faced in 2018 for Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) breaches.
But the way CBA enforced these rules felt like a sledgehammer. Demanding I justify how I made my wealth. Demanding to know if I keep cash at home and why; with threats to lock my accounts, isn’t just compliance—it’s intimidation and a potential security risk for me and my family. It should be noted that AUSTRAC released a statement to the media surrounding my experience that they do not require the banks to freeze customer accounts in order to meet their KYC rules.
Nevertheless, banks are under pressure to avoid AUSTRAC’s wrath, so they cast wide nets, collecting more data than necessary to cover themselves. This overreach raises ethical dilemmas: where’s the balance between security and personal autonomy? My financial history is mine, not a bank’s to interrogate at will. The Privacy Act 1988 requires businesses to limit data collection to what’s necessary, yet CBA’s demands felt speculative, as if I’m guilty until proven innocent.
It should be noted the call ended with the bank demanding they can share this very personal information about me to other third parties including other commercial credit providers.
What's next?
This experience signals a troubling future for community privacy. If banks can demand such intrusive details under AUSTRAC’s banner, what’s next? The global shift to ISO20022 for international fund transfers, implemented in 2022, means even more personal data is collected and shared with regulators. Cash, a last bastion of private transactions, is under threat – the query about my holding of cash at home felt like a nudge toward a cashless society where every move is tracked. This erodes trust. If banks treat customers like suspects, people may turn to unregulated channels, ironically undermining AUSTRAC’s goals by reducing transparency.
What’s next for personal information requirements? Expect tighter regulations. AUSTRAC’s push for robust AML/CTF frameworks means banks will likely demand more frequent updates to customer data, especially as fintech and digital currencies grow. The Consumer Data Right, already active in banking, could expand, giving consumers some control over data sharing but also normalizing constant data flows. Yet, without stronger privacy protections, this risks a surveillance state where personal freedom is sacrificed for security.
This isn’t just about me—it’s about all of us. CBA’s demands, driven by AUSTRAC, highlight a system prioritising compliance over ethics. We need clear boundaries on data collection, robust oversight to prevent overreach, and a public conversation about privacy in a digital age. I’m not a criminal, and neither are most Australians. We deserve better than to be treated like suspects in our own lives.
Louis Christopher is Managing Director of SQM Research.