HSBC (HSBC) has been ordered by Australia's Federal Court to pay a 35 million Australian dollars ($24.6 million) penalty after admitting to serious failures in protecting customers from scams, Australian Securities and Investments Commission said Thursday.

The commission said the court found the bank failed to implement key scam-prevention controls on an internal payment system where most customer losses occurred, took an average of 144 days to investigate scam reports, and did not properly apply rules determining whether customers or the bank should bear scam-related losses.

In addition to the penalty, HSBC must publish notices acknowledging the misconduct on its website, mobile app, and in letters to impacted customers, the agency said.